(List.filter (fn (User u, FirewallNode n, _) => u = uname andalso n = node) rules)
end
+fun validIp (ip, ipv6) = (case ipv6 of FwIPv6 => Domain.validIpv6 ip
+ | FwIPv4 => Domain.validIp ip)
+
fun dnsExists dnsRR dnsRecord =
let
val dnsRR_string = case dnsRR of
(* timeout chosen arbitrarilty, shorter is better if it's reliable *)
(* dig outputs true even if the lookup fails, but no output in short mode should work *)
case Slave.runOutput (Config.Firewall.dig, ["+short", "+timeout=3", "-t", dnsRR_string, dnsRecord]) of
- (_, SOME s) => (case Domain.validDomain (substring (s, 0, size s - 2)) of (* delete trailing . from cname *)
- true => dnsExists dnsRR s (* dig will return CNAME, must recurse *)
- | false => true) (* maybe also double check ip? use size s - 1 if so! *)
-
- | (_, NONE) => false
+ (_, SOME s) => (validIp (List.last (String.tokens Char.isSpace s), dnsRR))
+ | (x, NONE) => false
end
fun fermVariable x = String.isPrefix "$" x
fun filterHosts (hosts, ipv6) =
- List.filter (fn host => fermVariable host
- orelse (case ipv6 of FwIPv6 => Domain.validIpv6 host
- | FwIPv4 => Domain.validIp host)
- orelse dnsExists ipv6 host)
+ List.filter (fn host => (fermVariable host
+ orelse validIp (host, ipv6)
+ orelse dnsExists ipv6 host))
hosts
| Server (ports, hosts) => (confLine_in (uname, rule); confLine_in_v6 (uname, rule))
| LocalServer ports => (insertConfLine (uname, ruleNode, Client (ports, ["127.0.0.1/8"]));
insertConfLine (uname, ruleNode, Server (ports, ["127.0.0.1/8"]));
- insertConfLine (uname, ruleNode, Client (ports, [":::1"]));
- insertConfLine (uname, ruleNode, Server (ports, [":::1"])))
+ insertConfLine (uname, ruleNode, Client (ports, ["::1"]));
+ insertConfLine (uname, ruleNode, Server (ports, ["::1"])))
| ProxiedServer ports => if (fn FirewallNode r => r) ruleNode = Slave.hostname () then
(insertConfLine (uname, ruleNode, Server (ports, ["$WEBNODES"]));
insertConfLine (uname, ruleNode, Client (ports, [fwnode_domain ruleNode])))
val nodeFermRules = generateNodeFermRules rules
fun write_tcp_in_conf_preamble outf =
- (* no ipv6 support yet, but use @ipfilter() in ferm to prepare *)
TextIO.output (outf, String.concat ["@def $WEBNODES = @ipfilter((",
- (String.concatWith " " (List.map (fn (_, ip) => ip)
- (List.filter (fn (node, _) => List.exists (fn (n) => n = node) (List.map (fn (node, _) => node) (Config.Apache.webNodes_all @ Config.Apache.webNodes_admin)))
+ (String.concatWith " " (List.map (fn (_, ip, ipv6) => ip ^ " " ^ "[" ^ ipv6 ^ "]")
+ (List.filter (fn (node, _, _) => List.exists (fn (n) => n = node) (List.map (fn (node, _) => node) (Config.Apache.webNodes_all @ Config.Apache.webNodes_admin)))
Config.nodeIps))),
"));\n\n"])
let
val _ = SysWord.toInt (Posix.ProcEnv.uidToWord (Posix.SysDB.Passwd.uid (Posix.SysDB.getpwnam uname)))
in
- TextIO.output (tcp_inf, "proto tcp mod comment comment \"user:" ^ uname ^ "\" {\n");
+ TextIO.output (tcp_inf, "proto (tcp udp) mod comment comment \"user:" ^ uname ^ "\" {\n");
TextIO.output (tcp_inf, concat lines);
TextIO.output (tcp_inf, "\n}\n\n")
- end handle OS.SysErr _ => print "Invalid user in firewall config, skipping.\n" (* no sense in opening ports for bad users *)
+ end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n") (* no sense in opening ports for bad users *)
fun writeUserOutRules tcp_outf (uname, lines) =
let
val uid = SysWord.toInt (Posix.ProcEnv.uidToWord (Posix.SysDB.Passwd.uid (Posix.SysDB.getpwnam uname)))
in
- TextIO.output (tcp_outf, "mod owner uid-owner " ^ (Int.toString uid) ^ " mod comment comment \"user:" ^ uname ^ "\" proto tcp {\n");
+ TextIO.output (tcp_outf, "mod owner uid-owner " ^ (Int.toString uid) ^ " mod comment comment \"user:" ^ uname ^ "\" proto (tcp udp) {\n");
TextIO.output (tcp_outf, concat lines);
TextIO.output (tcp_outf, "\nDROP;\n}\n\n")
- end handle OS.SysErr _ => print "Invalid user in firewall config, skipping.\n"
+ end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n")
in
write_tcp_in_conf_preamble (users_tcp_in_conf);