X-Git-Url: https://git.hcoop.net/hcoop/domtool2.git/blobdiff_plain/794c19eafcc1c1a8aed86d23a06906ded060c111..5511dd203b05a6589083674078932d0b2563e775:/src/plugins/firewall.sml diff --git a/src/plugins/firewall.sml b/src/plugins/firewall.sml index bb58a84..4c10f24 100644 --- a/src/plugins/firewall.sml +++ b/src/plugins/firewall.sml @@ -88,6 +88,9 @@ fun query (node, uname) = (List.filter (fn (User u, FirewallNode n, _) => u = uname andalso n = node) rules) end +fun validIp (ip, ipv6) = (case ipv6 of FwIPv6 => Domain.validIpv6 ip + | FwIPv4 => Domain.validIp ip) + fun dnsExists dnsRR dnsRecord = let val dnsRR_string = case dnsRR of @@ -97,19 +100,15 @@ fun dnsExists dnsRR dnsRecord = (* timeout chosen arbitrarilty, shorter is better if it's reliable *) (* dig outputs true even if the lookup fails, but no output in short mode should work *) case Slave.runOutput (Config.Firewall.dig, ["+short", "+timeout=3", "-t", dnsRR_string, dnsRecord]) of - (_, SOME s) => (case Domain.validDomain (substring (s, 0, size s - 2)) of (* delete trailing . from cname *) - true => dnsExists dnsRR s (* dig will return CNAME, must recurse *) - | false => true) (* maybe also double check ip? use size s - 1 if so! *) - - | (_, NONE) => false + (_, SOME s) => (validIp (List.last (String.tokens Char.isSpace s), dnsRR)) + | (x, NONE) => false end fun fermVariable x = String.isPrefix "$" x fun filterHosts (hosts, ipv6) = - List.filter (fn host => fermVariable host - orelse (case ipv6 of FwIPv6 => Domain.validIpv6 host - | FwIPv4 => Domain.validIp host) - orelse dnsExists ipv6 host) + List.filter (fn host => (fermVariable host + orelse validIp (host, ipv6) + orelse dnsExists ipv6 host)) hosts @@ -158,19 +157,23 @@ fun generateNodeFermRules rules = fun confLine_out_v6 (uname, rule) = confLine outputLines_v6 (uname, formatOutputRule (rule, FwIPv6)) fun insertConfLine (uname, ruleNode, rule) = - case rule of - Client (ports, hosts) => (confLine_out (uname, rule); confLine_out_v6 (uname, rule)) - | Server (ports, hosts) => (confLine_in (uname, rule); confLine_in_v6 (uname, rule)) - | LocalServer ports => (insertConfLine (uname, ruleNode, Client (ports, ["127.0.0.1/8"])); - insertConfLine (uname, ruleNode, Server (ports, ["127.0.0.1/8"])); - insertConfLine (uname, ruleNode, Client (ports, [":::1"])); - insertConfLine (uname, ruleNode, Server (ports, [":::1"]))) - | ProxiedServer ports => if (fn FirewallNode r => r) ruleNode = Slave.hostname () then - (insertConfLine (uname, ruleNode, Server (ports, ["$WEBNODES"])); - insertConfLine (uname, ruleNode, Client (ports, [(fn FirewallNode r => r ^ "." ^ Config.defaultDomain) ruleNode]))) - else (* we are a web server *) - (insertConfLine (uname, ruleNode, Client (ports, [(fn FirewallNode r => r ^ "." ^ Config.defaultDomain) ruleNode])); - insertConfLine (User "www-data", ruleNode, Client (ports, [(fn FirewallNode r => r) ruleNode]))) + let + val fwnode_domain = fn FirewallNode node => node ^ "." ^ Config.defaultDomain + in + case rule of + Client (ports, hosts) => (confLine_out (uname, rule); confLine_out_v6 (uname, rule)) + | Server (ports, hosts) => (confLine_in (uname, rule); confLine_in_v6 (uname, rule)) + | LocalServer ports => (insertConfLine (uname, ruleNode, Client (ports, ["127.0.0.1/8"])); + insertConfLine (uname, ruleNode, Server (ports, ["127.0.0.1/8"])); + insertConfLine (uname, ruleNode, Client (ports, ["::1"])); + insertConfLine (uname, ruleNode, Server (ports, ["::1"]))) + | ProxiedServer ports => if (fn FirewallNode r => r) ruleNode = Slave.hostname () then + (insertConfLine (uname, ruleNode, Server (ports, ["$WEBNODES"])); + insertConfLine (uname, ruleNode, Client (ports, [fwnode_domain ruleNode]))) + else (* we are a web server *) + (insertConfLine (uname, ruleNode, Client (ports, [fwnode_domain ruleNode])); + insertConfLine (User "www-data", ruleNode, Client (ports, [fwnode_domain ruleNode]))) + end val _ = map insertConfLine (filter_node_rules rules) in @@ -196,10 +199,9 @@ fun generateFirewallConfig rules = val nodeFermRules = generateNodeFermRules rules fun write_tcp_in_conf_preamble outf = - (* no ipv6 support yet, but use @ipfilter() in ferm to prepare *) TextIO.output (outf, String.concat ["@def $WEBNODES = @ipfilter((", - (String.concatWith " " (List.map (fn (_, ip) => ip) - (List.filter (fn (node, _) => List.exists (fn (n) => n = node) (List.map (fn (node, _) => node) (Config.Apache.webNodes_all @ Config.Apache.webNodes_admin))) + (String.concatWith " " (List.map (fn (_, ip, ipv6) => ip ^ " " ^ "[" ^ ipv6 ^ "]") + (List.filter (fn (node, _, _) => List.exists (fn (n) => n = node) (List.map (fn (node, _) => node) (Config.Apache.webNodes_all @ Config.Apache.webNodes_admin))) Config.nodeIps))), "));\n\n"]) @@ -210,19 +212,19 @@ fun generateFirewallConfig rules = let val _ = SysWord.toInt (Posix.ProcEnv.uidToWord (Posix.SysDB.Passwd.uid (Posix.SysDB.getpwnam uname))) in - TextIO.output (tcp_inf, "proto tcp mod comment comment \"user:" ^ uname ^ "\" {\n"); + TextIO.output (tcp_inf, "proto (tcp udp) mod comment comment \"user:" ^ uname ^ "\" {\n"); TextIO.output (tcp_inf, concat lines); TextIO.output (tcp_inf, "\n}\n\n") - end handle OS.SysErr _ => print "Invalid user in firewall config, skipping.\n" (* no sense in opening ports for bad users *) + end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n") (* no sense in opening ports for bad users *) fun writeUserOutRules tcp_outf (uname, lines) = let val uid = SysWord.toInt (Posix.ProcEnv.uidToWord (Posix.SysDB.Passwd.uid (Posix.SysDB.getpwnam uname))) in - TextIO.output (tcp_outf, "mod owner uid-owner " ^ (Int.toString uid) ^ " mod comment comment \"user:" ^ uname ^ "\" proto tcp {\n"); + TextIO.output (tcp_outf, "mod owner uid-owner " ^ (Int.toString uid) ^ " mod comment comment \"user:" ^ uname ^ "\" proto (tcp udp) {\n"); TextIO.output (tcp_outf, concat lines); TextIO.output (tcp_outf, "\nDROP;\n}\n\n") - end handle OS.SysErr _ => print "Invalid user in firewall config, skipping.\n" + end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n") in write_tcp_in_conf_preamble (users_tcp_in_conf);