bridge-filtering

#!/bin/bash

set -euo pipefail

stdin=$(cat /dev/stdin)
logFile="${LOGFILE:-/var/log/bridge-filtering.log}"

KUBECONFIG_PATH="${KUBECONFIG_PATH:-/etc/cni/net.d/bridge-filtering.d/bridge-filtering.kubeconfig}"
CNI_VERSION="$(echo "$stdin" | jq -r ".cniVersion")"
CNI_PREV_RESULT="$(echo "$stdin" | jq -cr ".prevResult")"

exec 2>> $logFile

NFT_BRIDGE_TABLE=bridge
NFT_TABLE=filter

NFT_INGRESS_CHAIN=prerouting
NFT_INGRESS_HOOK=prerouting

NFT_POSTROUTING_CHAIN=postrouting
NFT_EGRESS_HOOK=postrouting

get_object() {
    local json_object="$1"
    local json_path="$2"
    echo "$json_object" | jq -cr "$json_path"
}

get_array_items() {
    local json_object="$1"
    local json_path="$2"
    echo "$json_object" | jq -c $json_path | jq -cr ".[]"
}

get_array_len() {
    local json_object="$1"
    local json_path="$2"
    echo "$json_object" | jq -c "$json_path" | jq ". | length"
}

for_json_array() {
    local json_object="$1"
    local json_path="$2"
    local fn="$3"
    for item in $(get_array_items "$json_object" "$json_path"); do
        $fn $item
    done
}

get_ip_version() {
    local ip_address="$1"
    if [[ "$ip_address" =~ .*:.* ]]; then
        echo "ip6"
    else
        echo "ip"
    fi
}

create_table() {
    local type="$1"
    local name="$2"
    echo "add table $type $name" | tee -a $logFile
}

create_netdev_base_chain() {
    local type="$1"
    local name="$2"
    local chain="$3"
    local hook="$4"
    local device="$5"
    echo "add chain $type $name $chain { type filter hook $hook device $device priority -1; policy accept; }" | tee -a $logFile
}

create_base_chain() {
    local type="$1"
    local name="$2"
    local chain="$3"
    local hook="$4"
    echo "add chain $type $name $chain { type filter hook $hook priority -1; policy accept; }" | tee -a $logFile
}

create_chain() {
    local type="$1"
    local name="$2"
    local chain="$3"
    echo "add chain $type $name $chain" | tee -a $logFile
}

nft_add_rule() {
    local type="$1"
    local table="$2"
    local chain="$3"
    set -- "${@:4}"
    echo "add rule $type $table $chain $@" | tee -a $logFile
}

netns_exec_nft() {
    local command="$1"
    ip netns exec "${CNI_CONTAINERID}" nft "${command}" || exitWithError "${CNI_VERSION}" "Failed to run: ${command}"
}

create_rules_for_filtering() {
    local config_id="$1"
    local config="$2"
    local table_type="$3"
    local direction="$4"
    local match_addr="saddr"
    if [[ "$direction" == "egress" ]]; then
        match_addr="daddr"
    fi
    local match_iface="iifname"
    if [[ "$direction" == "egress" ]]; then
        match_iface="oifname"
    fi
    local filtering_chain="${CNI_IFNAME}-${direction}"
    local policy_filtering_chain="${CNI_IFNAME}-${config_id}-${direction}"

    # check JSON is well-formatted and can be parsed with jq
    echo "$config" | jq "keys" &> /dev/null || exitWithError "${CNI_VERSION}" "Failed to parse JSON config, check formatting"
    
    _create_policy_filtering_chain() {
        local config_id="$1"
        local config="$2"
        local table_type="$3"
        local direction="$4"
        netns_exec_nft "$(create_chain "${table_type}" "${NFT_TABLE}" "${policy_filtering_chain}")"
        netns_exec_nft "$(nft_add_rule "${table_type}" "${NFT_TABLE}" "${filtering_chain}" "${match_iface}" "$CNI_IFNAME" counter jump "${policy_filtering_chain}")"
        netns_exec_nft "$(nft_add_rule "${table_type}" "${NFT_TABLE}" "${policy_filtering_chain}" counter meta mark set meta mark "&" 0xfffcffff)"
    }

    _create_subnet_rule() {
        local subnet=$1
        if [[ "$(get_object "${subnet}" ".except")" != "null" ]]; then
            for_json_array "${subnet}" ".except" _drop_subnet
        fi

        if [[ "$(get_object "${subnet}" ".cidr")" == "null" || "$(get_object "${subnet}" ".cidr")" == "" ]]; then
            netns_exec_nft "$(nft_add_rule ${table_type} ${NFT_TABLE} "${policy_filtering_chain}"-subnets ${match_iface} $CNI_IFNAME counter meta mark set mark or 0x20000)"
        else
            _accept_cidr "${subnet}"
        fi
    }

    _drop_subnet() {
        local subnet="$1"
        netns_exec_nft "$(nft_add_rule ${table_type} ${NFT_TABLE} "${policy_filtering_chain}"-subnets ${match_iface} $CNI_IFNAME $(get_ip_version "${subnet}") ${match_addr} ${subnet} counter drop)"
    }

    _accept_cidr() {
        local subnet="$1"
        local cidr=$(echo "${subnet}" | jq -r ".cidr")
        netns_exec_nft "$(nft_add_rule ${table_type} ${NFT_TABLE} "${policy_filtering_chain}"-subnets ${match_iface} $CNI_IFNAME $(get_ip_version "${cidr}") ${match_addr} ${cidr} counter meta mark set mark or 0x20000)"
    }

    _accept_port() {
        local ports="$1"
        local port=$(echo "$ports" | jq -r ".port")
        local protocol=$(echo "$ports" | jq -r ".protocol")

        if [[ "$port" == "null" || "$port" == "" ]]; then
            if [[ "$protocol" == "null" || "$protocol" == "" ]]; then
                netns_exec_nft "$(nft_add_rule ${table_type} ${NFT_TABLE} "${policy_filtering_chain}"-ports ${match_iface} $CNI_IFNAME counter meta mark set meta mark "|" 0x00010000)"
            else
                netns_exec_nft "$(nft_add_rule ${table_type} ${NFT_TABLE} "${policy_filtering_chain}"-ports ${match_iface} $CNI_IFNAME ip protocol ${protocol,,} counter meta mark set meta mark "|" 0x00010000)"
                netns_exec_nft "$(nft_add_rule ${table_type} ${NFT_TABLE} "${policy_filtering_chain}"-ports ${match_iface} $CNI_IFNAME ip6 nexthdr ${protocol,,} counter meta mark set meta mark "|" 0x00010000)"
            fi
        else
            if [[ "$protocol" == "null" || "$protocol" == "" ]]; then
                netns_exec_nft "$(nft_add_rule ${table_type} ${NFT_TABLE} "${policy_filtering_chain}"-ports ${match_iface} $CNI_IFNAME tcp dport ${port} counter meta mark set meta mark "|" 0x00010000)"
                netns_exec_nft "$(nft_add_rule ${table_type} ${NFT_TABLE} "${policy_filtering_chain}"-ports ${match_iface} $CNI_IFNAME udp dport ${port} counter meta mark set meta mark "|" 0x00010000)"
            else
                netns_exec_nft "$(nft_add_rule ${table_type} ${NFT_TABLE} "${policy_filtering_chain}"-ports ${match_iface} $CNI_IFNAME ${protocol,,} dport ${port} counter meta mark set meta mark "|" 0x00010000)"
            fi
        fi
    }

    local is_policy_filtering_chain_created=false
    if [[ $(echo "$config" | jq -r ".${direction}.subnets") != "null" || $(echo "$config" | jq -r ".${direction}.ports") != "null" ]]; then
        _create_policy_filtering_chain "${config_id}" "${config}" "${table_type}" "${direction}"
        is_policy_filtering_chain_created=true
    fi

    # handle ip subnet
    if [[ $(echo "$config" | jq -r ".${direction}.subnets") != "null" && $(get_array_len "$config" ".${direction}.subnets") > 0 ]]; then

        netns_exec_nft "$(create_chain "${table_type}" "${NFT_TABLE}" "${policy_filtering_chain}"-subnets)"
        netns_exec_nft "$(nft_add_rule "${table_type}" "${NFT_TABLE}" "${policy_filtering_chain}" counter jump "${policy_filtering_chain}"-subnets)"

        for_json_array "$config" ".${direction}.subnets" _create_subnet_rule
    fi

    # handle ports
    if [[ $(echo "$config" | jq -r ".${direction}.ports") != "null" && $(get_array_len "$config" ".${direction}.ports") > 0 ]]; then
        netns_exec_nft "$(create_chain "${table_type}" "${NFT_TABLE}" "${policy_filtering_chain}"-ports)"
        netns_exec_nft "$(nft_add_rule "${table_type}" "${NFT_TABLE}" "${policy_filtering_chain}" counter jump "${policy_filtering_chain}"-ports)"
        
        for_json_array "$config" ".${direction}.ports" _accept_port
    fi

    if [[ "$is_policy_filtering_chain_created" == true ]]; then
        netns_exec_nft "$(nft_add_rule "${table_type}" "${NFT_TABLE}" "${policy_filtering_chain}" meta mark "&" 0x00030000 == 0x00030000 counter accept)"
    fi
}

exitWithError() {
    local cni_version="$1"
    local message="${2:-""}"
    local details="${3:-""}"
    echo "{\"cniVersion\": \"${cni_version}\",\"msg\":\"${message}\",\"code\":101,\"details\":\"${details}\"}"
    exit 1
}

exitWithSuccess() {
    local cni_version="$1"
    local prev_result="$2"
    if [[ "$prev_result" == "null" ]]; then
        echo "{\"cniVersion\": \"$cni_version\"}"
    else
        echo "$prev_result"
    fi
    exit 0
}

main() {
    case $CNI_COMMAND in
    ADD)
        echo "CNI_NETNS: $CNI_NETNS" >> $logFile
        echo "CNI_CONTAINERID: $CNI_CONTAINERID" >> $logFile
        echo "STDIN: $stdin" >> $logFile
        echo "CNI_ARGS: $CNI_ARGS" >> $logFile

        local cidr_filtering_cni_label="bridge-filtering"
        local cni_spec_name=$(echo "$stdin" | jq -r ".name")
        local pod_namespace=""

        for i in ${CNI_ARGS//;/ }
        do
            case $i in
            "K8S_POD_NAMESPACE="*)
                pod_namespace=$(echo $i | awk -F'=' '{print $2}')
                if [[ "$pod_namespace" == "" ]]; then
                    exitWithError "${CNI_VERSION}" "Failed to parse pod namespace from CNI_ARGS"
                fi
            ;;
            esac
        done

        mkdir -p /var/run/netns/
        ln -sfT "$CNI_NETNS" /var/run/netns/"${CNI_CONTAINERID}"

        # Check API access
        kubectl --kubeconfig=${KUBECONFIG_PATH} api-resources > /dev/null || exitWithError "${CNI_VERSION}" "Failed to reach kubernetes API server" "kubeconfig path: $KUBECONFIG_PATH"

        netns_exec_nft "$(create_table ${NFT_BRIDGE_TABLE} ${NFT_TABLE})"
        netns_exec_nft "$(create_table ${NFT_BRIDGE_TABLE} ${NFT_TABLE})"

        # create base chains
        netns_exec_nft "$(create_base_chain ${NFT_BRIDGE_TABLE} ${NFT_TABLE} ${NFT_INGRESS_CHAIN} ${NFT_INGRESS_HOOK})"
        netns_exec_nft "$(create_base_chain ${NFT_BRIDGE_TABLE} ${NFT_TABLE} ${NFT_POSTROUTING_CHAIN} ${NFT_EGRESS_HOOK})"

        # filter chains
        netns_exec_nft "$(create_chain ${NFT_BRIDGE_TABLE} ${NFT_TABLE} "${CNI_IFNAME}"-ingress)"
        netns_exec_nft "$(create_chain ${NFT_BRIDGE_TABLE} ${NFT_TABLE} "${CNI_IFNAME}"-egress)"

        # accept icmp
        netns_exec_nft "$(nft_add_rule ${NFT_BRIDGE_TABLE} ${NFT_TABLE} ${CNI_IFNAME}-ingress ip protocol icmp counter accept)"
        netns_exec_nft "$(nft_add_rule ${NFT_BRIDGE_TABLE} ${NFT_TABLE} ${CNI_IFNAME}-egress ip protocol icmp counter accept)"

        # accept icmpv6
        netns_exec_nft "$(nft_add_rule ${NFT_BRIDGE_TABLE} ${NFT_TABLE} ${CNI_IFNAME}-ingress ip6 nexthdr icmpv6 counter accept)"
        netns_exec_nft "$(nft_add_rule ${NFT_BRIDGE_TABLE} ${NFT_TABLE} ${CNI_IFNAME}-egress ip6 nexthdr icmpv6 counter accept)"
        

        # setup prerouting chain
        netns_exec_nft "$(nft_add_rule ${NFT_BRIDGE_TABLE} ${NFT_TABLE} ${NFT_INGRESS_CHAIN} ether type arp counter accept)"
        netns_exec_nft "$(nft_add_rule ${NFT_BRIDGE_TABLE} ${NFT_TABLE} ${NFT_INGRESS_CHAIN} iifname $CNI_IFNAME counter jump "${CNI_IFNAME}"-ingress)"

        # setup postrouting chain
        netns_exec_nft "$(nft_add_rule ${NFT_BRIDGE_TABLE} ${NFT_TABLE} ${NFT_POSTROUTING_CHAIN} ether type arp counter accept)"
        netns_exec_nft "$(nft_add_rule ${NFT_BRIDGE_TABLE} ${NFT_TABLE} ${NFT_POSTROUTING_CHAIN} oifname $CNI_IFNAME counter jump "${CNI_IFNAME}"-egress)"

        _process_configmap() {
            local configmap_namespaced_name="$1"
            local configmap_config="$2"
            local config_id="$(echo "${configmap_namespaced_name}" | sha1sum )"
            config_id="${config_id:0:5}" # use first 5 characters to identify configuration specified in a configmap

            create_rules_for_filtering "$config_id" "$configmap_config" "${NFT_BRIDGE_TABLE}" "ingress"
            create_rules_for_filtering "$config_id" "$configmap_config" "${NFT_BRIDGE_TABLE}" "egress"
        }

        referenced_configmaps=$(kubectl --cache-dir=/var/cache/bridge-filtering --kubeconfig=${KUBECONFIG_PATH} get cm -l${cni_spec_name},${cidr_filtering_cni_label} -n ${pod_namespace} -o json)
        local referenced_configmaps_count=$(get_array_len "$referenced_configmaps" ".items")
        for (( i = 0; i < $((referenced_configmaps_count)); i++ )); do
            _process_configmap "$(printf "%s" "${referenced_configmaps}" | jq -rc ".items[$i].metadata.name",".items[$i].metadata.namespace")" "$(printf "%s" "${referenced_configmaps}" | jq -rc ".items[$i].data.config")"
        done


        netns_exec_nft "$(nft_add_rule "${NFT_BRIDGE_TABLE}" "${NFT_TABLE}" "${CNI_IFNAME}"-ingress counter drop)"
        netns_exec_nft "$(nft_add_rule "${NFT_BRIDGE_TABLE}" "${NFT_TABLE}" "${CNI_IFNAME}"-egress counter drop)"

        exitWithSuccess "${CNI_VERSION}" "${CNI_PREV_RESULT}"
    ;;

    DEL)
        echo "Delete $CNI_CONTAINERID" >> $logFile
        rm -f /var/run/netns/"$CNI_CONTAINERID"
    ;;

    VERSION)
        echo "{\"cniVersion\":\"0.3.1\",\"supportedVersions\":[\"0.1.0\",\"0.2.0\",\"0.3.0\",\"0.3.1\"]}"
    ;;

    *)
        exitWithError "${CNI_VERSION}" "Unrecognized CNI command: ${CNI_COMMAND}"
    ;;

    esac
}

main