interface: T5550: Interface source-validation priority over global value

- Migrate IPv4 source-validation to nftables
- Interface source-validation value takes priority, fallback to global value

4 files changed, 58 insertions, 46 deletions

diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2
index 0fbddfaa9..d7660c37b 100644
--- a/data/templates/firewall/nftables.j2
+++ b/data/templates/firewall/nftables.j2
@@ -5,29 +5,36 @@
 flush chain raw FW_CONNTRACK
 flush chain ip6 raw FW_CONNTRACK
 
+flush chain raw vyos_global_rpfilter
+flush chain ip6 raw vyos_global_rpfilter
+
 table raw {
     chain FW_CONNTRACK {
         {{ ipv4_conntrack_action }}
     }
+
+    chain vyos_global_rpfilter {
+{% if global_options.source_validation is vyos_defined('loose') %}
+        fib saddr oif 0 counter drop
+{% elif global_options.source_validation is vyos_defined('strict') %}
+        fib saddr . iif oif 0 counter drop
+{% endif %}
+        return
+    }
 }
 
 table ip6 raw {
     chain FW_CONNTRACK {
         {{ ipv6_conntrack_action }}
     }
-}
 
-{% if first_install is not vyos_defined %}
-delete table inet vyos_global_rpfilter
-{% endif %}
-table inet vyos_global_rpfilter {
-    chain PREROUTING {
-        type filter hook prerouting priority -300; policy accept;
+    chain vyos_global_rpfilter {
 {% if global_options.source_validation is vyos_defined('loose') %}
         fib saddr oif 0 counter drop
 {% elif global_options.source_validation is vyos_defined('strict') %}
         fib saddr . iif oif 0 counter drop
 {% endif %}
+        return
     }
 }
 
diff --git a/data/vyos-firewall-init.conf b/data/vyos-firewall-init.conf
index 41e7627f5..b0026fdf3 100644
--- a/data/vyos-firewall-init.conf
+++ b/data/vyos-firewall-init.conf
@@ -19,6 +19,15 @@ table raw {
         type filter hook forward priority -300; policy accept;
     }
 
+    chain vyos_global_rpfilter {
+        return
+    }
+
+    chain vyos_rpfilter {
+        type filter hook prerouting priority -300; policy accept;
+        counter jump vyos_global_rpfilter
+    }
+
     chain PREROUTING {
         type filter hook prerouting priority -300; policy accept;
         counter jump VYOS_CT_IGNORE
@@ -82,8 +91,13 @@ table ip6 raw {
         type filter hook forward priority -300; policy accept;
     }
 
+    chain vyos_global_rpfilter {
+        return
+    }
+
     chain vyos_rpfilter {
         type filter hook prerouting priority -300; policy accept;
+        counter jump vyos_global_rpfilter
     }
 
     chain PREROUTING {
diff --git a/python/vyos/ifconfig/interface.py b/python/vyos/ifconfig/interface.py
index 41ce352ad..9e9a6b92a 100644
--- a/python/vyos/ifconfig/interface.py
+++ b/python/vyos/ifconfig/interface.py
@@ -175,10 +175,6 @@ class Interface(Control):
             'validate': assert_boolean,
             'location': '/proc/sys/net/ipv4/conf/{ifname}/bc_forwarding',
         },
-        'rp_filter': {
-            'validate': lambda flt: assert_range(flt,0,3),
-            'location': '/proc/sys/net/ipv4/conf/{ifname}/rp_filter',
-        },
         'ipv6_accept_ra': {
             'validate': lambda ara: assert_range(ara,0,3),
             'location': '/proc/sys/net/ipv6/conf/{ifname}/accept_ra',
@@ -252,9 +248,6 @@ class Interface(Control):
         'ipv4_directed_broadcast': {
             'location': '/proc/sys/net/ipv4/conf/{ifname}/bc_forwarding',
         },
-        'rp_filter': {
-            'location': '/proc/sys/net/ipv4/conf/{ifname}/rp_filter',
-        },
         'ipv6_accept_ra': {
             'location': '/proc/sys/net/ipv6/conf/{ifname}/accept_ra',
         },
@@ -745,40 +738,32 @@ class Interface(Control):
             return None
         return self.set_interface('ipv4_directed_broadcast', forwarding)
 
-    def set_ipv4_source_validation(self, value):
-        """
-        Help prevent attacks used by Spoofing IP Addresses. Reverse path
-        filtering is a Kernel feature that, when enabled, is designed to ensure
-        packets that are not routable to be dropped. The easiest example of this
-        would be and IP Address of the range 10.0.0.0/8, a private IP Address,
-        being received on the Internet facing interface of the router.
+    def _cleanup_ipv4_source_validation_rules(self, ifname):
+        results = self._cmd(f'nft -a list chain ip raw vyos_rpfilter').split("\n")
+        for line in results:
+            if f'iifname "{ifname}"' in line:
+                handle_search = re.search('handle (\d+)', line)
+                if handle_search:
+                    self._cmd(f'nft delete rule ip raw vyos_rpfilter handle {handle_search[1]}')
 
-        As per RFC3074.
+    def set_ipv4_source_validation(self, mode):
         """
-        if value == 'strict':
-            value = 1
-        elif value == 'loose':
-            value = 2
-        else:
-            value = 0
-
-        all_rp_filter = int(read_file('/proc/sys/net/ipv4/conf/all/rp_filter'))
-        if all_rp_filter > value:
-            global_setting = 'disable'
-            if   all_rp_filter == 1: global_setting = 'strict'
-            elif all_rp_filter == 2: global_setting = 'loose'
-
-            from vyos.base import Warning
-            Warning(f'Global source-validation is set to "{global_setting}", this '\
-                    f'overrides per interface setting on "{self.ifname}"!')
+        Set IPv4 reverse path validation
 
-        tmp = self.get_interface('rp_filter')
-        if int(tmp) == value:
-            return None
-        return self.set_interface('rp_filter', value)
+        Example:
+        >>> from vyos.ifconfig import Interface
+        >>> Interface('eth0').set_ipv4_source_validation('strict')
+        """
+        self._cleanup_ipv4_source_validation_rules(self.ifname)
+        nft_prefix = f'nft insert rule ip raw vyos_rpfilter iifname "{self.ifname}"'
+        if mode in ['strict', 'loose']:
+            self._cmd(f"{nft_prefix} counter return")
+        if mode == 'strict':
+            self._cmd(f"{nft_prefix} fib saddr . iif oif 0 counter drop")
+        elif mode == 'loose':
+            self._cmd(f"{nft_prefix} fib saddr oif 0 counter drop")
 
     def _cleanup_ipv6_source_validation_rules(self, ifname):
-        commands = []
         results = self._cmd(f'nft -a list chain ip6 raw vyos_rpfilter').split("\n")
         for line in results:
             if f'iifname "{ifname}"' in line:
@@ -795,7 +780,9 @@ class Interface(Control):
         >>> Interface('eth0').set_ipv6_source_validation('strict')
         """
         self._cleanup_ipv6_source_validation_rules(self.ifname)
-        nft_prefix = f'nft add rule ip6 raw vyos_rpfilter iifname "{self.ifname}"'
+        nft_prefix = f'nft insert rule ip6 raw vyos_rpfilter iifname "{self.ifname}"'
+        if mode in ['strict', 'loose']:
+            self._cmd(f"{nft_prefix} counter return")
         if mode == 'strict':
             self._cmd(f"{nft_prefix} fib saddr . iif oif 0 counter drop")
         elif mode == 'loose':
diff --git a/smoketest/scripts/cli/base_interfaces_test.py b/smoketest/scripts/cli/base_interfaces_test.py
index 820024dc9..51ccbc9e6 100644
--- a/smoketest/scripts/cli/base_interfaces_test.py
+++ b/smoketest/scripts/cli/base_interfaces_test.py
@@ -834,8 +834,12 @@ class BasicInterfaceTest:
                     self.assertEqual('1', tmp)
 
                 if cli_defined(self._base_path + ['ip'], 'source-validation'):
-                    tmp = read_file(f'{proc_base}/rp_filter')
-                    self.assertEqual('2', tmp)
+                    base_options = f'iifname "{interface}"'
+                    out = cmd('sudo nft list chain ip raw vyos_rpfilter')
+                    for line in out.splitlines():
+                        if line.startswith(base_options):
+                            self.assertIn('fib saddr oif 0', line)
+                            self.assertIn('drop', line)
 
         def test_interface_ipv6_options(self):
             if not self._test_ipv6: