diff --git a/mantis/build.rs b/mantis/build.rs index e61bcf4..2187468 100644 --- a/mantis/build.rs +++ b/mantis/build.rs @@ -273,8 +273,6 @@ fn build_egress_ebpf(dst: &PathBuf) { } fn build_frontend(frontend_dir: &PathBuf, static_dir: &PathBuf) { - let _ = dotenvy::dotenv(); - if !frontend_dir.exists() { panic!("Frontend directory {:?} does not exist", frontend_dir); } diff --git a/mantis/src/core/ebpf/access_control.rs b/mantis/src/core/ebpf/access_control.rs index 10b255b..38b0206 100644 --- a/mantis/src/core/ebpf/access_control.rs +++ b/mantis/src/core/ebpf/access_control.rs @@ -7,7 +7,7 @@ use common::define::setting::MAX_RULES_PORT; use common::model::ip_address::{IPv4, IPv6, Port}; use tokio::sync::RwLock; -use crate::model::direction::{Direction, FlowDirection}; +use crate::model::direction::FlowDirection; use crate::model::error::Error; use crate::model::error::ebpf::EbpfError; use crate::model::ip_address::NativeConvert; @@ -15,266 +15,117 @@ use crate::model::list_type::ListType; use crate::utils::ip_address::convert_ports_to_vec; pub struct AccessControl { - ingress_ipv4_src_whitelist: RwLock>, - ingress_ipv4_src_blacklist: RwLock>, - ingress_ipv4_dst_whitelist: RwLock>, - ingress_ipv4_dst_blacklist: RwLock>, - ingress_ipv6_src_whitelist: RwLock>, - ingress_ipv6_src_blacklist: RwLock>, - ingress_ipv6_dst_whitelist: RwLock>, - ingress_ipv6_dst_blacklist: RwLock>, - egress_ipv4_src_whitelist: RwLock>, - egress_ipv4_src_blacklist: RwLock>, - egress_ipv4_dst_whitelist: RwLock>, - egress_ipv4_dst_blacklist: RwLock>, - egress_ipv6_src_whitelist: RwLock>, - egress_ipv6_src_blacklist: RwLock>, - egress_ipv6_dst_whitelist: RwLock>, - egress_ipv6_dst_blacklist: RwLock>, + ipv4_src_whitelist: RwLock>, + ipv4_src_blacklist: RwLock>, + ipv4_dst_whitelist: RwLock>, + ipv4_dst_blacklist: RwLock>, + ipv6_src_whitelist: RwLock>, + ipv6_src_blacklist: RwLock>, + ipv6_dst_whitelist: RwLock>, + ipv6_dst_blacklist: RwLock>, } impl AccessControl { - pub fn new(ingress_ebpf: &mut Ebpf, egress_ebpf: &mut Ebpf) -> Result { - Ok(Self { - ingress_ipv4_src_whitelist: RwLock::new(MapWrapper::new(ingress_ebpf, "IPV4_SRC_WHITELIST")?), - ingress_ipv4_src_blacklist: RwLock::new(MapWrapper::new(ingress_ebpf, "IPV4_SRC_BLACKLIST")?), - ingress_ipv4_dst_whitelist: RwLock::new(MapWrapper::new(ingress_ebpf, "IPV4_DST_WHITELIST")?), - ingress_ipv4_dst_blacklist: RwLock::new(MapWrapper::new(ingress_ebpf, "IPV4_DST_BLACKLIST")?), - ingress_ipv6_src_whitelist: RwLock::new(MapWrapper::new(ingress_ebpf, "IPV6_SRC_WHITELIST")?), - ingress_ipv6_src_blacklist: RwLock::new(MapWrapper::new(ingress_ebpf, "IPV6_SRC_BLACKLIST")?), - ingress_ipv6_dst_whitelist: RwLock::new(MapWrapper::new(ingress_ebpf, "IPV6_DST_WHITELIST")?), - ingress_ipv6_dst_blacklist: RwLock::new(MapWrapper::new(ingress_ebpf, "IPV6_DST_BLACKLIST")?), - egress_ipv4_src_whitelist: RwLock::new(MapWrapper::new(egress_ebpf, "EGRESS_IPV4_SRC_WHITELIST")?), - egress_ipv4_src_blacklist: RwLock::new(MapWrapper::new(egress_ebpf, "EGRESS_IPV4_SRC_BLACKLIST")?), - egress_ipv4_dst_whitelist: RwLock::new(MapWrapper::new(egress_ebpf, "EGRESS_IPV4_DST_WHITELIST")?), - egress_ipv4_dst_blacklist: RwLock::new(MapWrapper::new(egress_ebpf, "EGRESS_IPV4_DST_BLACKLIST")?), - egress_ipv6_src_whitelist: RwLock::new(MapWrapper::new(egress_ebpf, "EGRESS_IPV6_SRC_WHITELIST")?), - egress_ipv6_src_blacklist: RwLock::new(MapWrapper::new(egress_ebpf, "EGRESS_IPV6_SRC_BLACKLIST")?), - egress_ipv6_dst_whitelist: RwLock::new(MapWrapper::new(egress_ebpf, "EGRESS_IPV6_DST_WHITELIST")?), - egress_ipv6_dst_blacklist: RwLock::new(MapWrapper::new(egress_ebpf, "EGRESS_IPV6_DST_BLACKLIST")?), - }) + pub fn new(ebpf: &mut Ebpf) -> Result { + let access_control = Self { + ipv4_src_whitelist: RwLock::new(MapWrapper::new(ebpf, "IPV4_SRC_WHITELIST")?), + ipv4_src_blacklist: RwLock::new(MapWrapper::new(ebpf, "IPV4_SRC_BLACKLIST")?), + ipv4_dst_whitelist: RwLock::new(MapWrapper::new(ebpf, "IPV4_DST_WHITELIST")?), + ipv4_dst_blacklist: RwLock::new(MapWrapper::new(ebpf, "IPV4_DST_BLACKLIST")?), + ipv6_src_whitelist: RwLock::new(MapWrapper::new(ebpf, "IPV6_SRC_WHITELIST")?), + ipv6_src_blacklist: RwLock::new(MapWrapper::new(ebpf, "IPV6_SRC_BLACKLIST")?), + ipv6_dst_whitelist: RwLock::new(MapWrapper::new(ebpf, "IPV6_DST_WHITELIST")?), + ipv6_dst_blacklist: RwLock::new(MapWrapper::new(ebpf, "IPV6_DST_BLACKLIST")?), + }; + Ok(access_control) } - pub async fn get_ipv4_list( - &self, - nic: Direction, - flow: FlowDirection, - list_type: ListType, - ) -> HashMap> { - let guard = match (nic, flow, list_type) { - (Direction::Ingress, FlowDirection::Source, ListType::White) => { - self.ingress_ipv4_src_whitelist.read().await - } - (Direction::Ingress, FlowDirection::Source, ListType::Black) => { - self.ingress_ipv4_src_blacklist.read().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::White) => { - self.ingress_ipv4_dst_whitelist.read().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::Black) => { - self.ingress_ipv4_dst_blacklist.read().await - } - (Direction::Egress, FlowDirection::Source, ListType::White) => { - self.egress_ipv4_src_whitelist.read().await - } - (Direction::Egress, FlowDirection::Source, ListType::Black) => { - self.egress_ipv4_src_blacklist.read().await - } - (Direction::Egress, FlowDirection::Destination, ListType::White) => { - self.egress_ipv4_dst_whitelist.read().await - } - (Direction::Egress, FlowDirection::Destination, ListType::Black) => { - self.egress_ipv4_dst_blacklist.read().await - } + pub async fn get_ipv4_list(&self, direction: FlowDirection, list_type: ListType) -> HashMap> { + let map_wrapper = match (direction, list_type) { + (FlowDirection::Source, ListType::White) => self.ipv4_src_whitelist.read().await, + (FlowDirection::Source, ListType::Black) => self.ipv4_src_blacklist.read().await, + (FlowDirection::Destination, ListType::White) => self.ipv4_dst_whitelist.read().await, + (FlowDirection::Destination, ListType::Black) => self.ipv4_dst_blacklist.read().await, }; - guard.get_list() + map_wrapper.get_list() } - pub async fn get_ipv6_list( - &self, - nic: Direction, - flow: FlowDirection, - list_type: ListType, - ) -> HashMap> { - let guard = match (nic, flow, list_type) { - (Direction::Ingress, FlowDirection::Source, ListType::White) => { - self.ingress_ipv6_src_whitelist.read().await - } - (Direction::Ingress, FlowDirection::Source, ListType::Black) => { - self.ingress_ipv6_src_blacklist.read().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::White) => { - self.ingress_ipv6_dst_whitelist.read().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::Black) => { - self.ingress_ipv6_dst_blacklist.read().await - } - (Direction::Egress, FlowDirection::Source, ListType::White) => { - self.egress_ipv6_src_whitelist.read().await - } - (Direction::Egress, FlowDirection::Source, ListType::Black) => { - self.egress_ipv6_src_blacklist.read().await - } - (Direction::Egress, FlowDirection::Destination, ListType::White) => { - self.egress_ipv6_dst_whitelist.read().await - } - (Direction::Egress, FlowDirection::Destination, ListType::Black) => { - self.egress_ipv6_dst_blacklist.read().await - } + pub async fn get_ipv6_list(&self, direction: FlowDirection, list_type: ListType) -> HashMap> { + let map_wrapper = match (direction, list_type) { + (FlowDirection::Source, ListType::White) => self.ipv6_src_whitelist.read().await, + (FlowDirection::Source, ListType::Black) => self.ipv6_src_blacklist.read().await, + (FlowDirection::Destination, ListType::White) => self.ipv6_dst_whitelist.read().await, + (FlowDirection::Destination, ListType::Black) => self.ipv6_dst_blacklist.read().await, }; - guard.get_list() + map_wrapper.get_list() } pub async fn add_ipv4_list( &self, - nic: Direction, - flow: FlowDirection, + direction: FlowDirection, list_type: ListType, address: SocketAddrV4, ) -> Result<(), Error> { let ip: u32 = (*address.ip()).to_bits().to_be(); let port = address.port(); - let mut guard = match (nic, flow, list_type) { - (Direction::Ingress, FlowDirection::Source, ListType::White) => { - self.ingress_ipv4_src_whitelist.write().await - } - (Direction::Ingress, FlowDirection::Source, ListType::Black) => { - self.ingress_ipv4_src_blacklist.write().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::White) => { - self.ingress_ipv4_dst_whitelist.write().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::Black) => { - self.ingress_ipv4_dst_blacklist.write().await - } - (Direction::Egress, FlowDirection::Source, ListType::White) => { - self.egress_ipv4_src_whitelist.write().await - } - (Direction::Egress, FlowDirection::Source, ListType::Black) => { - self.egress_ipv4_src_blacklist.write().await - } - (Direction::Egress, FlowDirection::Destination, ListType::White) => { - self.egress_ipv4_dst_whitelist.write().await - } - (Direction::Egress, FlowDirection::Destination, ListType::Black) => { - self.egress_ipv4_dst_blacklist.write().await - } + let mut map_wrapper = match (direction, list_type) { + (FlowDirection::Source, ListType::White) => self.ipv4_src_whitelist.write().await, + (FlowDirection::Source, ListType::Black) => self.ipv4_src_blacklist.write().await, + (FlowDirection::Destination, ListType::White) => self.ipv4_dst_whitelist.write().await, + (FlowDirection::Destination, ListType::Black) => self.ipv4_dst_blacklist.write().await, }; - guard.add(ip, port) + map_wrapper.add(ip, port) } pub async fn add_ipv6_list( &self, - nic: Direction, - flow: FlowDirection, + direction: FlowDirection, list_type: ListType, address: SocketAddrV6, ) -> Result<(), Error> { let ip: u128 = (*address.ip()).to_bits().to_be(); let port = address.port(); - let mut guard = match (nic, flow, list_type) { - (Direction::Ingress, FlowDirection::Source, ListType::White) => { - self.ingress_ipv6_src_whitelist.write().await - } - (Direction::Ingress, FlowDirection::Source, ListType::Black) => { - self.ingress_ipv6_src_blacklist.write().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::White) => { - self.ingress_ipv6_dst_whitelist.write().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::Black) => { - self.ingress_ipv6_dst_blacklist.write().await - } - (Direction::Egress, FlowDirection::Source, ListType::White) => { - self.egress_ipv6_src_whitelist.write().await - } - (Direction::Egress, FlowDirection::Source, ListType::Black) => { - self.egress_ipv6_src_blacklist.write().await - } - (Direction::Egress, FlowDirection::Destination, ListType::White) => { - self.egress_ipv6_dst_whitelist.write().await - } - (Direction::Egress, FlowDirection::Destination, ListType::Black) => { - self.egress_ipv6_dst_blacklist.write().await - } + let mut map_wrapper = match (direction, list_type) { + (FlowDirection::Source, ListType::White) => self.ipv6_src_whitelist.write().await, + (FlowDirection::Source, ListType::Black) => self.ipv6_src_blacklist.write().await, + (FlowDirection::Destination, ListType::White) => self.ipv6_dst_whitelist.write().await, + (FlowDirection::Destination, ListType::Black) => self.ipv6_dst_blacklist.write().await, }; - guard.add(ip, port) + map_wrapper.add(ip, port) } pub async fn remove_ipv4_list( &self, - nic: Direction, - flow: FlowDirection, + direction: FlowDirection, list_type: ListType, address: SocketAddrV4, ) -> Result<(), Error> { let ip: u32 = (*address.ip()).to_bits().to_be(); let port = address.port(); - let mut guard = match (nic, flow, list_type) { - (Direction::Ingress, FlowDirection::Source, ListType::White) => { - self.ingress_ipv4_src_whitelist.write().await - } - (Direction::Ingress, FlowDirection::Source, ListType::Black) => { - self.ingress_ipv4_src_blacklist.write().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::White) => { - self.ingress_ipv4_dst_whitelist.write().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::Black) => { - self.ingress_ipv4_dst_blacklist.write().await - } - (Direction::Egress, FlowDirection::Source, ListType::White) => { - self.egress_ipv4_src_whitelist.write().await - } - (Direction::Egress, FlowDirection::Source, ListType::Black) => { - self.egress_ipv4_src_blacklist.write().await - } - (Direction::Egress, FlowDirection::Destination, ListType::White) => { - self.egress_ipv4_dst_whitelist.write().await - } - (Direction::Egress, FlowDirection::Destination, ListType::Black) => { - self.egress_ipv4_dst_blacklist.write().await - } + let mut map_wrapper = match (direction, list_type) { + (FlowDirection::Source, ListType::White) => self.ipv4_src_whitelist.write().await, + (FlowDirection::Source, ListType::Black) => self.ipv4_src_blacklist.write().await, + (FlowDirection::Destination, ListType::White) => self.ipv4_dst_whitelist.write().await, + (FlowDirection::Destination, ListType::Black) => self.ipv4_dst_blacklist.write().await, }; - guard.remove(ip, port) + map_wrapper.remove(ip, port) } pub async fn remove_ipv6_list( &self, - nic: Direction, - flow: FlowDirection, + direction: FlowDirection, list_type: ListType, address: SocketAddrV6, ) -> Result<(), Error> { let ip: u128 = (*address.ip()).to_bits().to_be(); let port = address.port(); - let mut guard = match (nic, flow, list_type) { - (Direction::Ingress, FlowDirection::Source, ListType::White) => { - self.ingress_ipv6_src_whitelist.write().await - } - (Direction::Ingress, FlowDirection::Source, ListType::Black) => { - self.ingress_ipv6_src_blacklist.write().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::White) => { - self.ingress_ipv6_dst_whitelist.write().await - } - (Direction::Ingress, FlowDirection::Destination, ListType::Black) => { - self.ingress_ipv6_dst_blacklist.write().await - } - (Direction::Egress, FlowDirection::Source, ListType::White) => { - self.egress_ipv6_src_whitelist.write().await - } - (Direction::Egress, FlowDirection::Source, ListType::Black) => { - self.egress_ipv6_src_blacklist.write().await - } - (Direction::Egress, FlowDirection::Destination, ListType::White) => { - self.egress_ipv6_dst_whitelist.write().await - } - (Direction::Egress, FlowDirection::Destination, ListType::Black) => { - self.egress_ipv6_dst_blacklist.write().await - } + let mut map_wrapper = match (direction, list_type) { + (FlowDirection::Source, ListType::White) => self.ipv6_src_whitelist.write().await, + (FlowDirection::Source, ListType::Black) => self.ipv6_src_blacklist.write().await, + (FlowDirection::Destination, ListType::White) => self.ipv6_dst_whitelist.write().await, + (FlowDirection::Destination, ListType::Black) => self.ipv6_dst_blacklist.write().await, }; - guard.remove(ip, port) + map_wrapper.remove(ip, port) } }