X-Git-Url: https://git.hcoop.net/hcoop/domtool2.git/blobdiff_plain/93278775f0877b33c24e18cc9fa837c315d95fcc..bde7b866604a48787a753075785581de905195e2:/src/plugins/firewall.sml

diff --git a/src/plugins/firewall.sml b/src/plugins/firewall.sml
index 2561f1c..5d2155c 100644
--- a/src/plugins/firewall.sml
+++ b/src/plugins/firewall.sml
@@ -88,6 +88,9 @@ fun query (node, uname) =
 	    (List.filter (fn (User u, FirewallNode n, _) => u = uname andalso n = node) rules)
     end
 
+fun validIp (ip, ipv6) = (case ipv6 of FwIPv6 => Domain.validIpv6 ip
+				     | FwIPv4 =>  Domain.validIp ip)
+
 fun dnsExists dnsRR dnsRecord =
     let
 	val dnsRR_string = case dnsRR of
@@ -97,19 +100,15 @@ fun dnsExists dnsRR dnsRecord =
 	(* timeout chosen arbitrarilty, shorter is better if it's reliable *)
 	(* dig outputs true even if the lookup fails, but no output in short mode should work *)
 	case Slave.runOutput (Config.Firewall.dig, ["+short", "+timeout=3", "-t", dnsRR_string, dnsRecord]) of
-	    (_, SOME s) => (case Domain.validDomain (substring (s, 0, size s - 2)) of (* delete trailing . from cname *)
-				true => dnsExists dnsRR s (* dig will return CNAME, must recurse *)
-			      | false => true) (* maybe also double check ip? use size s - 1 if so! *)
-
-	  | (_, NONE) => false
+	    (_, SOME s) => (validIp (List.last (String.tokens Char.isSpace s), dnsRR))
+	  | (x, NONE) => false
     end
 
+fun fermVariable x = String.isPrefix "$" x
 fun filterHosts (hosts, ipv6) =
-    List.filter (fn host => if (Domain.validIpv6 host orelse Domain.validIp host)
-			    then
-				true
-			    else
-				dnsExists ipv6 host)
+    List.filter (fn host => (fermVariable host
+			     orelse validIp (host, ipv6)
+			     orelse dnsExists ipv6 host))
 		hosts
 
 
@@ -158,17 +157,23 @@ fun generateNodeFermRules rules  =
 	fun confLine_out_v6 (uname, rule) = confLine outputLines_v6 (uname, formatOutputRule (rule, FwIPv6))
 
 	fun insertConfLine (uname, ruleNode, rule) =
-	    case rule of
-		Client (ports, hosts) => (confLine_out (uname, rule); confLine_out_v6 (uname, rule))
-	      | Server (ports, hosts) => (confLine_in (uname, rule); confLine_in_v6 (uname, rule))
-	      | LocalServer ports => (insertConfLine (uname, ruleNode, Client (ports, ["127.0.0.1/8", ":::1"]));
-				      insertConfLine (uname, ruleNode, Server (ports, ["127.0.0.1/8", ":::1"])))
-	      | ProxiedServer ports => if (fn FirewallNode r => r) ruleNode = Slave.hostname () then
-					   (insertConfLine (uname, ruleNode, Server (ports, ["$WEBNODES"]));
-					    insertConfLine (uname, ruleNode, Client (ports, [(fn FirewallNode r => r) ruleNode])))
-				       else (* we are a web server *)
-					   (insertConfLine (uname, ruleNode, Client (ports, [(fn FirewallNode r => r) ruleNode]));
-					    insertConfLine (User "www-data", ruleNode, Client (ports, [(fn FirewallNode r => r) ruleNode])))
+	    let
+		val fwnode_domain = fn FirewallNode node => node ^ "." ^ Config.defaultDomain
+	    in
+		case rule of
+		    Client (ports, hosts) => (confLine_out (uname, rule); confLine_out_v6 (uname, rule))
+		  | Server (ports, hosts) => (confLine_in (uname, rule); confLine_in_v6 (uname, rule))
+		  | LocalServer ports => (insertConfLine (uname, ruleNode, Client (ports, ["127.0.0.1/8"]));
+					  insertConfLine (uname, ruleNode, Server (ports, ["127.0.0.1/8"]));
+					  insertConfLine (uname, ruleNode, Client (ports, [":::1"]));
+					  insertConfLine (uname, ruleNode, Server (ports, [":::1"])))
+		  | ProxiedServer ports => if (fn FirewallNode r => r) ruleNode = Slave.hostname () then
+					       (insertConfLine (uname, ruleNode, Server (ports, ["$WEBNODES"]));
+						insertConfLine (uname, ruleNode, Client (ports, [fwnode_domain ruleNode])))
+					   else (* we are a web server *)
+					       (insertConfLine (uname, ruleNode, Client (ports, [fwnode_domain ruleNode]));
+						insertConfLine (User "www-data", ruleNode, Client (ports, [fwnode_domain ruleNode])))
+	    end
 
 	val _ = map insertConfLine (filter_node_rules rules)
     in
@@ -187,11 +192,9 @@ fun generateFirewallConfig rules =
     let
 	val users_tcp_out_conf = TextIO.openOut (Config.Firewall.firewallDir ^ "/users_tcp_out.conf")
 	val users_tcp_in_conf = TextIO.openOut (Config.Firewall.firewallDir ^ "/users_tcp_in.conf")
-	val user_chains_conf = TextIO.openOut (Config.Firewall.firewallDir ^ "/user_chains.conf")
 
 	val users_tcp6_out_conf = TextIO.openOut (Config.Firewall.firewallDir ^ "/users_tcp6_out.conf")
 	val users_tcp6_in_conf = TextIO.openOut (Config.Firewall.firewallDir ^ "/users_tcp6_in.conf")
-	val user_chains6_conf = TextIO.openOut (Config.Firewall.firewallDir ^ "/user_chains6.conf")
 
 	val nodeFermRules = generateNodeFermRules rules
 
@@ -210,45 +213,39 @@ fun generateFirewallConfig rules =
 	    let
 		val _ = SysWord.toInt (Posix.ProcEnv.uidToWord (Posix.SysDB.Passwd.uid (Posix.SysDB.getpwnam uname)))
 	    in
-		TextIO.output (tcp_inf, "proto tcp {\n");
+		TextIO.output (tcp_inf, "proto tcp mod comment comment \"user:" ^ uname ^ "\" {\n");
 		TextIO.output (tcp_inf, concat lines);
 		TextIO.output (tcp_inf, "\n}\n\n")
-	    end handle OS.SysErr _ => print "Invalid user in firewall config, skipping.\n" (* no sense in opening ports for bad users *)
+	    end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n") (* no sense in opening ports for bad users *)
 
-	fun writeUserOutRules tcp_outf chains_outf (uname, lines) =
+	fun writeUserOutRules tcp_outf (uname, lines) =
 	    let
 		val uid = SysWord.toInt (Posix.ProcEnv.uidToWord (Posix.SysDB.Passwd.uid (Posix.SysDB.getpwnam uname)))
 	    in
-		TextIO.output (tcp_outf, "mod owner uid-owner " ^ (Int.toString uid)
-						   ^ " { jump user_" ^ uname ^ "_tcp_out"
-						   ^ "; DROP; }\n");
-
-		TextIO.output (chains_outf, "chain user_" ^ uname ^ "_tcp_out"
-						 ^ " proto tcp {\n");
-		TextIO.output (chains_outf, concat lines);
-		TextIO.output (chains_outf, "\n}\n\n")
-	    end handle OS.SysErr _ => print "Invalid user in firewall config, skipping.\n"
+		TextIO.output (tcp_outf, "mod owner uid-owner " ^ (Int.toString uid) ^ " mod comment comment \"user:" ^ uname ^ "\" proto tcp {\n");
+		TextIO.output (tcp_outf, concat lines);
+		TextIO.output (tcp_outf, "\nDROP;\n}\n\n")
+	    end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n")
 
     in
 	write_tcp_in_conf_preamble (users_tcp_in_conf);
-	StringMap.appi (writeUserOutRules users_tcp_out_conf user_chains_conf) (#output_rules nodeFermRules);
+	StringMap.appi (writeUserOutRules users_tcp_out_conf) (#output_rules nodeFermRules);
 	StringMap.appi (writeUserInRules users_tcp_in_conf) (#input_rules nodeFermRules);
 
 	write_tcp_in_conf_preamble (users_tcp6_in_conf);
-	StringMap.appi (writeUserOutRules users_tcp6_out_conf user_chains6_conf) (#output6_rules nodeFermRules);
+	StringMap.appi (writeUserOutRules users_tcp6_out_conf) (#output6_rules nodeFermRules);
 	StringMap.appi (writeUserInRules users_tcp6_in_conf) (#input6_rules nodeFermRules);
 
-	TextIO.closeOut user_chains_conf;
 	TextIO.closeOut users_tcp_out_conf;
 	TextIO.closeOut users_tcp_in_conf;
 
-	TextIO.closeOut user_chains6_conf;
 	TextIO.closeOut users_tcp6_out_conf;
 	TextIO.closeOut users_tcp6_in_conf;
 
 	true
     end
 
+
 fun publishConfig _ =
     Slave.shell [Config.Firewall.reload]
 end