feat(firewall): IPv6 in Regeln + NAT (familienbewusstes nft-Rendering) — v1.2.90
Bisher rendete das Template alle Adress-Matches als 'ip saddr/daddr' (v4-only); ein v6-Eintrag hätte 'nft -f' (und damit das ganze Ruleset) gebrochen. Jetzt: - Adressausdrücke werden je Eintrag als v4/v6 klassifiziert (addrFamily). - Regeln mit Adressen werden pro Familie als separate nft-Zeile gerendert (ip vs ip6 saddr/daddr); adresslose Regeln bleiben eine familienagnostische Zeile (v4-Verhalten unverändert). - icmp nur auf v4-, icmpv6 nur auf v6-Zeilen. - NAT familienbewusst inkl. v6-DNAT-Target [..]:port; gemischte v4/v6-NAT-Regeln werden übersprungen (statt nft -f zu brechen) + geloggt. - WireGuard site-to-site Masquerade v6-fähig. Eingabeseite war bereits v6-fähig (validateAddrObjValue/validateRule via net.ParseIP/ParseCIDR; Service-Proto-CHECK erlaubt icmpv6; Builtin PING-v6). Neue Unit-Tests (firewall_ipv6_test.go) inkl. optionalem 'nft -c'-Syntaxcheck. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Debian
@@ -22,6 +22,7 @@ import (
|
||||
"context"
|
||||
_ "embed"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"net"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
@@ -138,6 +139,7 @@ type View struct {
|
||||
type WGSiteMasqEntry struct {
|
||||
Iface string // wg interface name, e.g. "wg7"
|
||||
VPNNet string // network CIDR of the VPN subnet, e.g. "192.168.99.0/24"
|
||||
L3 string // "ip" oder "ip6" — Familie von VPNNet
|
||||
}
|
||||
|
||||
// AutoFWRule is one auto-emitted inbound rule. Proto is "tcp" or
|
||||
@@ -162,7 +164,11 @@ type RuleLeg struct {
|
||||
DstIfaces []string
|
||||
SrcAddrs []string
|
||||
DstAddrs []string
|
||||
Service ResolvedService // Proto="" → no service match (any)
|
||||
// L3 ist "ip" (IPv4) oder "ip6" (IPv6) für das Adress-Matching —
|
||||
// gesetzt, sobald SrcAddrs/DstAddrs nicht leer sind. Bei adresslosen
|
||||
// Regeln bleibt es "" (familienagnostisch, kein ip/ip6-Match).
|
||||
L3 string
|
||||
Service ResolvedService // Proto="" → no service match (any)
|
||||
}
|
||||
|
||||
// ResolvedRule has all addresses + services already expanded so the
|
||||
@@ -195,6 +201,12 @@ type ResolvedNATRule struct {
|
||||
DPortStart, DPortEnd int
|
||||
TargetAddr string
|
||||
TargetPortStart, TargetPortEnd int
|
||||
// L3 ist "ip" oder "ip6" — Adressfamilie der Regel (aus SrcCIDR/
|
||||
// DstCIDR/TargetAddr abgeleitet). TargetHost ist TargetAddr, bei
|
||||
// IPv6 MIT Port in eckigen Klammern ("[2001:db8::1]") für korrekte
|
||||
// nft-dnat-Syntax.
|
||||
L3 string
|
||||
TargetHost string
|
||||
Comment string
|
||||
}
|
||||
|
||||
@@ -280,26 +292,15 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Expand to one Leg per (rule × service); rules without a service
|
||||
// produce one leg with empty Proto.
|
||||
// Expand to one Leg per (rule × service × address-family). Rules
|
||||
// without a service produce one leg-set with empty Proto.
|
||||
for _, r := range rules {
|
||||
if len(r.Services) == 0 {
|
||||
view.Legs = append(view.Legs, RuleLeg{
|
||||
RuleID: r.ID, Action: r.Action, Log: r.Log, Name: r.Name,
|
||||
Comment: r.Comment,
|
||||
SrcIfaces: r.SrcIfaces, DstIfaces: r.DstIfaces,
|
||||
SrcAddrs: r.SrcAddrs, DstAddrs: r.DstAddrs,
|
||||
})
|
||||
view.Legs = append(view.Legs, expandFamilyLegs(r, ResolvedService{}, false)...)
|
||||
continue
|
||||
}
|
||||
for _, svc := range r.Services {
|
||||
view.Legs = append(view.Legs, RuleLeg{
|
||||
RuleID: r.ID, Action: r.Action, Log: r.Log, Name: r.Name,
|
||||
Comment: r.Comment,
|
||||
SrcIfaces: r.SrcIfaces, DstIfaces: r.DstIfaces,
|
||||
SrcAddrs: r.SrcAddrs, DstAddrs: r.DstAddrs,
|
||||
Service: svc,
|
||||
})
|
||||
view.Legs = append(view.Legs, expandFamilyLegs(r, svc, true)...)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -323,9 +324,14 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
|
||||
if wgRows.Scan(&name, &cidr) == nil {
|
||||
view.WGServerIfaces = append(view.WGServerIfaces, name)
|
||||
if _, ipNet, err := net.ParseCIDR(cidr); err == nil {
|
||||
l3 := addrFamily(ipNet.String())
|
||||
if l3 == "" {
|
||||
l3 = "ip"
|
||||
}
|
||||
view.WGSiteMasq = append(view.WGSiteMasq, WGSiteMasqEntry{
|
||||
Iface: name,
|
||||
VPNNet: ipNet.String(),
|
||||
L3: l3,
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -435,6 +441,131 @@ func isLoopback(ip string) bool {
|
||||
return strings.HasPrefix(ip, "127.")
|
||||
}
|
||||
|
||||
// addrFamily klassifiziert einen nft-Adressausdruck (host, CIDR oder
|
||||
// range "a-b") als "ip" (IPv4), "ip6" (IPv6) oder "" (unbestimmt, z.B.
|
||||
// FQDN-Platzhalter). Adressen enthalten selbst kein '-', daher trennt der
|
||||
// erste Bindestrich sicher eine Range in ihr erstes Element.
|
||||
func addrFamily(expr string) string {
|
||||
expr = strings.TrimSpace(expr)
|
||||
if expr == "" {
|
||||
return ""
|
||||
}
|
||||
if i := strings.IndexByte(expr, '-'); i > 0 {
|
||||
expr = strings.TrimSpace(expr[:i])
|
||||
}
|
||||
if i := strings.IndexByte(expr, '/'); i > 0 {
|
||||
expr = expr[:i]
|
||||
}
|
||||
ip := net.ParseIP(expr)
|
||||
if ip == nil {
|
||||
return ""
|
||||
}
|
||||
if ip.To4() != nil {
|
||||
return "ip"
|
||||
}
|
||||
return "ip6"
|
||||
}
|
||||
|
||||
// splitByFamily teilt eine Liste von nft-Adressausdrücken in v4 und v6.
|
||||
// Unbestimmte (FQDN o.ä.) werden verworfen.
|
||||
func splitByFamily(exprs []string) (v4, v6 []string) {
|
||||
for _, e := range exprs {
|
||||
switch addrFamily(e) {
|
||||
case "ip":
|
||||
v4 = append(v4, e)
|
||||
case "ip6":
|
||||
v6 = append(v6, e)
|
||||
}
|
||||
}
|
||||
return v4, v6
|
||||
}
|
||||
|
||||
// serviceL3: icmp ist v4-only, icmpv6 v6-only, tcp/udp/leer agnostisch.
|
||||
func serviceL3(svc ResolvedService) string {
|
||||
switch svc.Proto {
|
||||
case "icmp":
|
||||
return "ip"
|
||||
case "icmpv6":
|
||||
return "ip6"
|
||||
default:
|
||||
return ""
|
||||
}
|
||||
}
|
||||
|
||||
// natFamily ermittelt die Adressfamilie einer NAT-Regel aus ihren
|
||||
// Adressen. ok=false bei gemischten v4/v6-Adressen (ungültig → die Regel
|
||||
// muss übersprungen werden, sonst bricht `nft -f` das gesamte Ruleset).
|
||||
func natFamily(r ResolvedNATRule) (fam string, ok bool) {
|
||||
for _, a := range []string{r.SrcCIDR, r.DstCIDR, r.TargetAddr} {
|
||||
f := addrFamily(a)
|
||||
if f == "" {
|
||||
continue
|
||||
}
|
||||
if fam == "" {
|
||||
fam = f
|
||||
} else if fam != f {
|
||||
return "", false
|
||||
}
|
||||
}
|
||||
if fam == "" {
|
||||
fam = "ip" // keine Adressen (reine iface/proto-Regel) → v4-Default
|
||||
}
|
||||
return fam, true
|
||||
}
|
||||
|
||||
// expandFamilyLegs materialisiert die nft-Zeilen für eine Regel + optional
|
||||
// einen Service, getrennt nach Adressfamilie. Adresslose Regeln ergeben eine
|
||||
// einzige familienagnostische Zeile (unverändertes v4-Verhalten, greift
|
||||
// zugleich für v6). Regeln mit Adressen werden pro Familie als separate
|
||||
// Zeile emittiert — ein nft-Paket ist immer entweder v4 oder v6.
|
||||
func expandFamilyLegs(r ResolvedRule, svc ResolvedService, hasSvc bool) []RuleLeg {
|
||||
base := RuleLeg{
|
||||
RuleID: r.ID, Action: r.Action, Log: r.Log, Name: r.Name, Comment: r.Comment,
|
||||
SrcIfaces: r.SrcIfaces, DstIfaces: r.DstIfaces,
|
||||
}
|
||||
if hasSvc {
|
||||
base.Service = svc
|
||||
}
|
||||
|
||||
if len(r.SrcAddrs) == 0 && len(r.DstAddrs) == 0 {
|
||||
// Kein Adress-Match → eine Zeile, L3 leer. Die Proto-Render-Logik
|
||||
// im Template setzt icmp/icmpv6 selbst familienkorrekt.
|
||||
return []RuleLeg{base}
|
||||
}
|
||||
|
||||
src4, src6 := splitByFamily(r.SrcAddrs)
|
||||
dst4, dst6 := splitByFamily(r.DstAddrs)
|
||||
svcFam := ""
|
||||
if hasSvc {
|
||||
svcFam = serviceL3(svc)
|
||||
}
|
||||
|
||||
var legs []RuleLeg
|
||||
for _, fam := range []string{"ip", "ip6"} {
|
||||
if svcFam != "" && svcFam != fam {
|
||||
continue // icmp nur auf v4, icmpv6 nur auf v6
|
||||
}
|
||||
srcF, dstF := src4, dst4
|
||||
if fam == "ip6" {
|
||||
srcF, dstF = src6, dst6
|
||||
}
|
||||
// Eine eingeschränkte Seite ohne Mitglied dieser Familie → die
|
||||
// Zeile würde nichts (oder Falsches) matchen → überspringen.
|
||||
if len(r.SrcAddrs) > 0 && len(srcF) == 0 {
|
||||
continue
|
||||
}
|
||||
if len(r.DstAddrs) > 0 && len(dstF) == 0 {
|
||||
continue
|
||||
}
|
||||
leg := base
|
||||
leg.L3 = fam
|
||||
leg.SrcAddrs = srcF
|
||||
leg.DstAddrs = dstF
|
||||
legs = append(legs, leg)
|
||||
}
|
||||
return legs
|
||||
}
|
||||
|
||||
// addrObjMap is keyed by id; value is the nft expression for that
|
||||
// object (e.g. "1.2.3.4", "10.0.0.0/24", "1.2.3.4-1.2.3.10").
|
||||
type addrObjMap map[int64]string
|
||||
@@ -693,6 +824,19 @@ ORDER BY priority DESC, id ASC`)
|
||||
if outZone != nil {
|
||||
r.OutIfaces = zoneIfaces[*outZone]
|
||||
}
|
||||
fam, ok := natFamily(r)
|
||||
if !ok {
|
||||
// Gemischte v4/v6-Adressen → ungültige NAT-Regel. Überspringen
|
||||
// statt das gesamte Ruleset mit `nft -f` zu brechen.
|
||||
slog.Warn("firewall: NAT-Regel mit gemischten v4/v6-Adressen übersprungen", "id", r.ID)
|
||||
continue
|
||||
}
|
||||
r.L3 = fam
|
||||
r.TargetHost = r.TargetAddr
|
||||
if fam == "ip6" && r.TargetAddr != "" && r.TargetPortStart > 0 {
|
||||
// nft braucht [v6]:port für dnat-Targets mit Port.
|
||||
r.TargetHost = "[" + r.TargetAddr + "]"
|
||||
}
|
||||
out = append(out, r)
|
||||
}
|
||||
return out, rows.Err()
|
||||
|
||||
Reference in New Issue
Block a user