From 2d90e34a6f1134d699d1554b7af37460d83ddc0c Mon Sep 17 00:00:00 2001
From: Aleksandr Alekseev <alexander.alekseev@virtuozzo.com>
Date: Thu, 22 Oct 2020 21:15:51 +0300
Subject: [PATCH] example: add ipv6 filters examples
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Aleksandr Alekseev <alexander.alekseev@virtuozzo.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
---
 src/nwfilter/xml/allow-dhcpv6-server.xml | 27 ++++++++++++++++++++++++
 src/nwfilter/xml/allow-dhcpv6.xml        | 24 +++++++++++++++++++++
 src/nwfilter/xml/allow-incoming-ipv6.xml |  3 +++
 src/nwfilter/xml/allow-ipv6.xml          |  3 +++
 src/nwfilter/xml/meson.build             |  6 ++++++
 src/nwfilter/xml/no-ipv6-multicast.xml   |  9 ++++++++
 src/nwfilter/xml/no-ipv6-spoofing.xml    | 15 +++++++++++++
 7 files changed, 87 insertions(+)
 create mode 100644 src/nwfilter/xml/allow-dhcpv6-server.xml
 create mode 100644 src/nwfilter/xml/allow-dhcpv6.xml
 create mode 100644 src/nwfilter/xml/allow-incoming-ipv6.xml
 create mode 100644 src/nwfilter/xml/allow-ipv6.xml
 create mode 100644 src/nwfilter/xml/no-ipv6-multicast.xml
 create mode 100644 src/nwfilter/xml/no-ipv6-spoofing.xml

diff --git a/src/nwfilter/xml/allow-dhcpv6-server.xml b/src/nwfilter/xml/allow-dhcpv6-server.xml
new file mode 100644
index 0000000000..214a95f412
--- /dev/null
+++ b/src/nwfilter/xml/allow-dhcpv6-server.xml
@@ -0,0 +1,27 @@
+<filter name='allow-dhcpv6-server' chain='ipv6'>
+
+    <!-- accept outgoing DHCP requests.
+         note, this rule must be evaluated before general MAC broadcast
+         traffic is discarded since DHCP requests use MAC broadcast.
+         according to https://tools.ietf.org/html/rfc3315#section-14,
+         client sends messages to FF02::1:2 from link-local addresses -->
+    <rule action='accept' direction='out' priority='100'>
+        <ipv6 protocol='udp'
+              srcipaddr='FE80::'
+              srcipmask='10'
+              dstipaddr='FF02::1:2'
+              srcportstart='546'
+              dstportstart='547'/>
+    </rule>
+
+    <!-- accept incoming DHCP responses from a specific DHCP server
+         parameter DHPCSERVER needs to be passed from where this filter is
+         referenced -->
+    <rule action='accept' direction='in' priority='100' >
+        <ipv6 srcipaddr='$DHCPSERVER'
+              protocol='udp'
+              srcportstart='547'
+              dstportstart='546'/>
+    </rule>
+
+</filter>
diff --git a/src/nwfilter/xml/allow-dhcpv6.xml b/src/nwfilter/xml/allow-dhcpv6.xml
new file mode 100644
index 0000000000..f3512af153
--- /dev/null
+++ b/src/nwfilter/xml/allow-dhcpv6.xml
@@ -0,0 +1,24 @@
+<filter name='allow-dhcpv6' chain='ipv6'>
+
+    <!-- accept outgoing DHCP requests.
+         note, this rule must be evaluated before general MAC broadcast
+         traffic is discarded since DHCP requests use MAC broadcast.
+         according to https://tools.ietf.org/html/rfc3315#section-14,
+         client sends messages to FF02::1:2 from link-local addresses -->
+    <rule action='accept' direction='out' priority='100'>
+        <ipv6 protocol='udp'
+              srcipaddr='FE80::'
+              srcipmask='10'
+              dstipaddr='FF02::1:2'
+              srcportstart='546'
+              dstportstart='547'/>
+    </rule>
+
+    <!-- accept incoming DHCP responses from any DHCP server -->
+    <rule action='accept' direction='in' priority='100' >
+        <ipv6 protocol='udp'
+              srcportstart='547'
+              dstportstart='546'/>
+    </rule>
+
+</filter>
diff --git a/src/nwfilter/xml/allow-incoming-ipv6.xml b/src/nwfilter/xml/allow-incoming-ipv6.xml
new file mode 100644
index 0000000000..93e1b18784
--- /dev/null
+++ b/src/nwfilter/xml/allow-incoming-ipv6.xml
@@ -0,0 +1,3 @@
+<filter name='allow-incoming-ipv6' chain='ipv6'>
+  <rule direction='in' action='accept'/>
+</filter>
diff --git a/src/nwfilter/xml/allow-ipv6.xml b/src/nwfilter/xml/allow-ipv6.xml
new file mode 100644
index 0000000000..8da5188cb9
--- /dev/null
+++ b/src/nwfilter/xml/allow-ipv6.xml
@@ -0,0 +1,3 @@
+<filter name='allow-ipv6' chain='ipv6'>
+  <rule direction='inout' action='accept'/>
+</filter>
diff --git a/src/nwfilter/xml/meson.build b/src/nwfilter/xml/meson.build
index 95af75bb15..0d96c54ebe 100644
--- a/src/nwfilter/xml/meson.build
+++ b/src/nwfilter/xml/meson.build
@@ -2,8 +2,12 @@ nwfilter_xml_files = [
   'allow-arp.xml',
   'allow-dhcp-server.xml',
   'allow-dhcp.xml',
+  'allow-dhcpv6-server.xml',
+  'allow-dhcpv6.xml',
   'allow-incoming-ipv4.xml',
+  'allow-incoming-ipv6.xml',
   'allow-ipv4.xml',
+  'allow-ipv6.xml',
   'clean-traffic-gateway.xml',
   'clean-traffic.xml',
   'no-arp-ip-spoofing.xml',
@@ -11,6 +15,8 @@ nwfilter_xml_files = [
   'no-arp-spoofing.xml',
   'no-ip-multicast.xml',
   'no-ip-spoofing.xml',
+  'no-ipv6-multicast.xml',
+  'no-ipv6-spoofing.xml',
   'no-mac-broadcast.xml',
   'no-mac-spoofing.xml',
   'no-other-l2-traffic.xml',
diff --git a/src/nwfilter/xml/no-ipv6-multicast.xml b/src/nwfilter/xml/no-ipv6-multicast.xml
new file mode 100644
index 0000000000..a736366374
--- /dev/null
+++ b/src/nwfilter/xml/no-ipv6-multicast.xml
@@ -0,0 +1,9 @@
+<filter name='no-ipv6-multicast' chain='ipv6'>
+
+    <!-- drop if destination IP address is in the ff00::/8 subnet -->
+    <rule action='drop' direction='out'>
+        <ipv6 dstipaddr='FF00::' dstipmask='8' />
+    </rule>
+
+    <!-- not doing anything with receiving side ... -->
+</filter>
diff --git a/src/nwfilter/xml/no-ipv6-spoofing.xml b/src/nwfilter/xml/no-ipv6-spoofing.xml
new file mode 100644
index 0000000000..a9ca690345
--- /dev/null
+++ b/src/nwfilter/xml/no-ipv6-spoofing.xml
@@ -0,0 +1,15 @@
+<filter name='no-ipv6-spoofing' chain='ipv6-ip' priority='-610'>
+  <!-- allow UDP sent from link-local addresses (DHCP);
+       filter more exact later -->
+  <rule action='return' direction='out' priority='100'>
+    <ipv6 srcipaddr='FE80::' srcipmask='10' protocol='udp'/>
+  </rule>
+
+  <!-- allow all known IP addresses -->
+  <rule direction='out' action='return' priority='500'>
+    <ipv6 srcipaddr='$IPV6'/>
+  </rule>
+
+  <!-- drop everything else -->
+  <rule direction='out' action='drop' priority='1000'/>
+</filter>