basic internal ipv6 support

[hcoop/domtool2.git] / src / plugins / firewall.sml

diff --git a/src/plugins/firewall.sml b/src/plugins/firewall.sml
index bb58a84..ec5ad54 100644 (file)
--- a/src/plugins/firewall.sml
+++ b/src/plugins/firewall.sml
@@ -88,6 +88,9 @@ fun query (node, uname) =
            (List.filter (fn (User u, FirewallNode n, _) => u = uname andalso n = node) rules)
     end
 
+fun validIp (ip, ipv6) = (case ipv6 of FwIPv6 => Domain.validIpv6 ip
+                                    | FwIPv4 =>  Domain.validIp ip)
+
 fun dnsExists dnsRR dnsRecord =
     let
        val dnsRR_string = case dnsRR of
@@ -97,19 +100,15 @@ fun dnsExists dnsRR dnsRecord =
        (* timeout chosen arbitrarilty, shorter is better if it's reliable *)
        (* dig outputs true even if the lookup fails, but no output in short mode should work *)
        case Slave.runOutput (Config.Firewall.dig, ["+short", "+timeout=3", "-t", dnsRR_string, dnsRecord]) of
-           (_, SOME s) => (case Domain.validDomain (substring (s, 0, size s - 2)) of (* delete trailing . from cname *)
-                               true => dnsExists dnsRR s (* dig will return CNAME, must recurse *)
-                             | false => true) (* maybe also double check ip? use size s - 1 if so! *)
-
-         | (_, NONE) => false
+           (_, SOME s) => (validIp (List.last (String.tokens Char.isSpace s), dnsRR))
+         | (x, NONE) => false
     end
 
 fun fermVariable x = String.isPrefix "$" x
 fun filterHosts (hosts, ipv6) =
-    List.filter (fn host => fermVariable host
-                           orelse (case ipv6 of FwIPv6 => Domain.validIpv6 host
-                                              | FwIPv4 =>  Domain.validIp host)
-                           orelse dnsExists ipv6 host)
+    List.filter (fn host => (fermVariable host
+                            orelse validIp (host, ipv6)
+                            orelse dnsExists ipv6 host))
                hosts
 
 
@@ -158,19 +157,23 @@ fun generateNodeFermRules rules  =
        fun confLine_out_v6 (uname, rule) = confLine outputLines_v6 (uname, formatOutputRule (rule, FwIPv6))
 
        fun insertConfLine (uname, ruleNode, rule) =
-           case rule of
-               Client (ports, hosts) => (confLine_out (uname, rule); confLine_out_v6 (uname, rule))
-             | Server (ports, hosts) => (confLine_in (uname, rule); confLine_in_v6 (uname, rule))
-             | LocalServer ports => (insertConfLine (uname, ruleNode, Client (ports, ["127.0.0.1/8"]));
-                                     insertConfLine (uname, ruleNode, Server (ports, ["127.0.0.1/8"]));
-                                     insertConfLine (uname, ruleNode, Client (ports, [":::1"]));
-                                     insertConfLine (uname, ruleNode, Server (ports, [":::1"])))
-             | ProxiedServer ports => if (fn FirewallNode r => r) ruleNode = Slave.hostname () then
-                                          (insertConfLine (uname, ruleNode, Server (ports, ["$WEBNODES"]));
-                                           insertConfLine (uname, ruleNode, Client (ports, [(fn FirewallNode r => r ^ "." ^ Config.defaultDomain) ruleNode])))
-                                      else (* we are a web server *)
-                                          (insertConfLine (uname, ruleNode, Client (ports, [(fn FirewallNode r => r ^ "." ^ Config.defaultDomain) ruleNode]));
-                                           insertConfLine (User "www-data", ruleNode, Client (ports, [(fn FirewallNode r => r) ruleNode])))
+           let
+               val fwnode_domain = fn FirewallNode node => node ^ "." ^ Config.defaultDomain
+           in
+               case rule of
+                   Client (ports, hosts) => (confLine_out (uname, rule); confLine_out_v6 (uname, rule))
+                 | Server (ports, hosts) => (confLine_in (uname, rule); confLine_in_v6 (uname, rule))
+                 | LocalServer ports => (insertConfLine (uname, ruleNode, Client (ports, ["127.0.0.1/8"]));
+                                         insertConfLine (uname, ruleNode, Server (ports, ["127.0.0.1/8"]));
+                                         insertConfLine (uname, ruleNode, Client (ports, [":::1"]));
+                                         insertConfLine (uname, ruleNode, Server (ports, [":::1"])))
+                 | ProxiedServer ports => if (fn FirewallNode r => r) ruleNode = Slave.hostname () then
+                                              (insertConfLine (uname, ruleNode, Server (ports, ["$WEBNODES"]));
+                                               insertConfLine (uname, ruleNode, Client (ports, [fwnode_domain ruleNode])))
+                                          else (* we are a web server *)
+                                              (insertConfLine (uname, ruleNode, Client (ports, [fwnode_domain ruleNode]));
+                                               insertConfLine (User "www-data", ruleNode, Client (ports, [fwnode_domain ruleNode])))
+           end
 
        val _ = map insertConfLine (filter_node_rules rules)
     in
@@ -196,10 +199,9 @@ fun generateFirewallConfig rules =
        val nodeFermRules = generateNodeFermRules rules
 
        fun write_tcp_in_conf_preamble outf =
-           (* no ipv6 support yet, but use @ipfilter() in ferm to prepare *)
            TextIO.output (outf, String.concat ["@def $WEBNODES = @ipfilter((",
-                                               (String.concatWith " " (List.map (fn (_, ip) => ip)
-                                                                                (List.filter (fn (node, _) => List.exists (fn (n) => n = node) (List.map (fn (node, _) => node) (Config.Apache.webNodes_all @ Config.Apache.webNodes_admin)))
+                                               (String.concatWith " " (List.map (fn (_, ip, ipv6) => ip ^ " " ^ "[" ^ ipv6 ^ "]")
+                                                                                (List.filter (fn (node, _, _) => List.exists (fn (n) => n = node) (List.map (fn (node, _) => node) (Config.Apache.webNodes_all @ Config.Apache.webNodes_admin)))
                                                                                              Config.nodeIps))),
                                                "));\n\n"])
 
@@ -213,7 +215,7 @@ fun generateFirewallConfig rules =
                TextIO.output (tcp_inf, "proto tcp mod comment comment \"user:" ^ uname ^ "\" {\n");
                TextIO.output (tcp_inf, concat lines);
                TextIO.output (tcp_inf, "\n}\n\n")
-           end handle OS.SysErr _ => print "Invalid user in firewall config, skipping.\n" (* no sense in opening ports for bad users *)
+           end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n") (* no sense in opening ports for bad users *)
 
        fun writeUserOutRules tcp_outf (uname, lines) =
            let
@@ -222,7 +224,7 @@ fun generateFirewallConfig rules =
                TextIO.output (tcp_outf, "mod owner uid-owner " ^ (Int.toString uid) ^ " mod comment comment \"user:" ^ uname ^ "\" proto tcp {\n");
                TextIO.output (tcp_outf, concat lines);
                TextIO.output (tcp_outf, "\nDROP;\n}\n\n")
-           end handle OS.SysErr _ => print "Invalid user in firewall config, skipping.\n"
+           end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n")
 
     in
        write_tcp_in_conf_preamble (users_tcp_in_conf);