fwtool: allow udp/tcp for all user rules

[hcoop/domtool2.git] / src / plugins / firewall.sml

diff --git a/src/plugins/firewall.sml b/src/plugins/firewall.sml
index 5d2155c..4c10f24 100644 (file)
--- a/src/plugins/firewall.sml
+++ b/src/plugins/firewall.sml
@@ -165,8 +165,8 @@ fun generateNodeFermRules rules  =
                  | Server (ports, hosts) => (confLine_in (uname, rule); confLine_in_v6 (uname, rule))
                  | LocalServer ports => (insertConfLine (uname, ruleNode, Client (ports, ["127.0.0.1/8"]));
                                          insertConfLine (uname, ruleNode, Server (ports, ["127.0.0.1/8"]));
-                                         insertConfLine (uname, ruleNode, Client (ports, [":::1"]));
-                                         insertConfLine (uname, ruleNode, Server (ports, [":::1"])))
+                                         insertConfLine (uname, ruleNode, Client (ports, ["::1"]));
+                                         insertConfLine (uname, ruleNode, Server (ports, ["::1"])))
                  | ProxiedServer ports => if (fn FirewallNode r => r) ruleNode = Slave.hostname () then
                                               (insertConfLine (uname, ruleNode, Server (ports, ["$WEBNODES"]));
                                                insertConfLine (uname, ruleNode, Client (ports, [fwnode_domain ruleNode])))
@@ -199,10 +199,9 @@ fun generateFirewallConfig rules =
        val nodeFermRules = generateNodeFermRules rules
 
        fun write_tcp_in_conf_preamble outf =
-           (* no ipv6 support yet, but use @ipfilter() in ferm to prepare *)
            TextIO.output (outf, String.concat ["@def $WEBNODES = @ipfilter((",
-                                               (String.concatWith " " (List.map (fn (_, ip) => ip)
-                                                                                (List.filter (fn (node, _) => List.exists (fn (n) => n = node) (List.map (fn (node, _) => node) (Config.Apache.webNodes_all @ Config.Apache.webNodes_admin)))
+                                               (String.concatWith " " (List.map (fn (_, ip, ipv6) => ip ^ " " ^ "[" ^ ipv6 ^ "]")
+                                                                                (List.filter (fn (node, _, _) => List.exists (fn (n) => n = node) (List.map (fn (node, _) => node) (Config.Apache.webNodes_all @ Config.Apache.webNodes_admin)))
                                                                                              Config.nodeIps))),
                                                "));\n\n"])
 
@@ -213,7 +212,7 @@ fun generateFirewallConfig rules =
            let
                val _ = SysWord.toInt (Posix.ProcEnv.uidToWord (Posix.SysDB.Passwd.uid (Posix.SysDB.getpwnam uname)))
            in
-               TextIO.output (tcp_inf, "proto tcp mod comment comment \"user:" ^ uname ^ "\" {\n");
+               TextIO.output (tcp_inf, "proto (tcp udp) mod comment comment \"user:" ^ uname ^ "\" {\n");
                TextIO.output (tcp_inf, concat lines);
                TextIO.output (tcp_inf, "\n}\n\n")
            end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n") (* no sense in opening ports for bad users *)
@@ -222,7 +221,7 @@ fun generateFirewallConfig rules =
            let
                val uid = SysWord.toInt (Posix.ProcEnv.uidToWord (Posix.SysDB.Passwd.uid (Posix.SysDB.getpwnam uname)))
            in
-               TextIO.output (tcp_outf, "mod owner uid-owner " ^ (Int.toString uid) ^ " mod comment comment \"user:" ^ uname ^ "\" proto tcp {\n");
+               TextIO.output (tcp_outf, "mod owner uid-owner " ^ (Int.toString uid) ^ " mod comment comment \"user:" ^ uname ^ "\" proto (tcp udp) {\n");
                TextIO.output (tcp_outf, concat lines);
                TextIO.output (tcp_outf, "\nDROP;\n}\n\n")
            end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n")