1 /*
2 * Copyright (c) 2021, The OpenThread Authors.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 * 3. Neither the name of the copyright holder nor the
13 * names of its contributors may be used to endorse or promote products
14 * derived from this software without specific prior written permission.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
17 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
20 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26 * POSSIBILITY OF SUCH DAMAGE.
27 */
28
29 /**
30 * @file
31 * @brief
32 * This file includes the implementation of OTBR firewall.
33 */
34
35 #include "firewall.hpp"
36
37 #include <string.h>
38
39 #include <openthread/logging.h>
40 #include <openthread/netdata.h>
41
42 #include "common/code_utils.hpp"
43 #include "posix/platform/utils.hpp"
44
45 namespace ot {
46 namespace Posix {
47
48 #if defined(__linux__) && OPENTHREAD_POSIX_CONFIG_FIREWALL_ENABLE
49
50 #if !OPENTHREAD_CONFIG_BORDER_ROUTER_ENABLE || !OPENTHREAD_CONFIG_PLATFORM_NETIF_ENABLE
51 #error Configurations 'OPENTHREAD_CONFIG_BORDER_ROUTER_ENABLE' and 'OPENTHREAD_CONFIG_PLATFORM_NETIF_ENABLE' are required.
52 #endif
53
54 static const char kIpsetCommand[] = OPENTHREAD_POSIX_CONFIG_IPSET_BINARY;
55 static const char kIngressDenySrcIpSet[] = "otbr-ingress-deny-src";
56 static const char kIngressDenySrcSwapIpSet[] = "otbr-ingress-deny-src-swap";
57 static const char kIngressAllowDstIpSet[] = "otbr-ingress-allow-dst";
58 static const char kIngressAllowDstSwapIpSet[] = "otbr-ingress-allow-dst-swap";
59
60 class IpSetManager
61 {
62 public:
63 otError FlushIpSet(const char *aName);
64 otError AddToIpSet(const char *aSetName, const char *aAddress);
65 otError SwapIpSets(const char *aSetName1, const char *aSetName2);
66 };
67
FlushIpSet(const char * aName)68 inline otError IpSetManager::FlushIpSet(const char *aName)
69 {
70 return ExecuteCommand("%s flush %s", kIpsetCommand, aName);
71 }
72
AddToIpSet(const char * aSetName,const char * aAddress)73 inline otError IpSetManager::AddToIpSet(const char *aSetName, const char *aAddress)
74 {
75 return ExecuteCommand("%s add %s %s -exist", kIpsetCommand, aSetName, aAddress);
76 }
77
SwapIpSets(const char * aSetName1,const char * aSetName2)78 inline otError IpSetManager::SwapIpSets(const char *aSetName1, const char *aSetName2)
79 {
80 return ExecuteCommand("%s swap %s %s", kIpsetCommand, aSetName1, aSetName2);
81 }
82
UpdateIpSets(otInstance * aInstance)83 void UpdateIpSets(otInstance *aInstance)
84 {
85 otError error = OT_ERROR_NONE;
86 otNetworkDataIterator iterator = OT_NETWORK_DATA_ITERATOR_INIT;
87 otBorderRouterConfig config;
88 otIp6Prefix prefix;
89 char prefixBuf[OT_IP6_PREFIX_STRING_SIZE];
90 IpSetManager ipSetManager;
91
92 // 1. Flush the '*-swap' ipsets
93 SuccessOrExit(error = ipSetManager.FlushIpSet(kIngressAllowDstSwapIpSet));
94 SuccessOrExit(error = ipSetManager.FlushIpSet(kIngressDenySrcSwapIpSet));
95
96 // 2. Update otbr-deny-src-swap
97 while (otNetDataGetNextOnMeshPrefix(aInstance, &iterator, &config) == OT_ERROR_NONE)
98 {
99 if (config.mDp)
100 {
101 continue;
102 }
103 otIp6PrefixToString(&config.mPrefix, prefixBuf, sizeof(prefixBuf));
104 SuccessOrExit(error = ipSetManager.AddToIpSet(kIngressDenySrcSwapIpSet, prefixBuf));
105 }
106 memcpy(prefix.mPrefix.mFields.m8, otThreadGetMeshLocalPrefix(aInstance)->m8,
107 sizeof(otThreadGetMeshLocalPrefix(aInstance)->m8));
108 prefix.mLength = OT_IP6_PREFIX_BITSIZE;
109 otIp6PrefixToString(&prefix, prefixBuf, sizeof(prefixBuf));
110 SuccessOrExit(error = ipSetManager.AddToIpSet(kIngressDenySrcSwapIpSet, prefixBuf));
111
112 // 3. Update otbr-allow-dst-swap
113 iterator = OT_NETWORK_DATA_ITERATOR_INIT;
114 while (otNetDataGetNextOnMeshPrefix(aInstance, &iterator, &config) == OT_ERROR_NONE)
115 {
116 otIp6PrefixToString(&config.mPrefix, prefixBuf, sizeof(prefixBuf));
117 SuccessOrExit(error = ipSetManager.AddToIpSet(kIngressAllowDstSwapIpSet, prefixBuf));
118 }
119
120 // 4. Swap ipsets to let them take effect
121 SuccessOrExit(error = ipSetManager.SwapIpSets(kIngressDenySrcSwapIpSet, kIngressDenySrcIpSet));
122 SuccessOrExit(error = ipSetManager.SwapIpSets(kIngressAllowDstSwapIpSet, kIngressAllowDstIpSet));
123
124 exit:
125 if (error != OT_ERROR_NONE)
126 {
127 otLogWarnPlat("Failed to update ipsets: %s", otThreadErrorToString(error));
128 }
129 }
130
131 #endif // defined(__linux__) && OPENTHREAD_POSIX_CONFIG_FIREWALL_ENABLE
132
133 } // namespace Posix
134 } // namespace ot
135