mirror of
https://github.com/gensokyo-zone/infrastructure.git
synced 2026-02-09 12:29:19 -08:00
fix(nftables): local firewall
This commit is contained in:
arcnmx
parent
6dc06a746a
commit
a283b4bf9a
9 changed files with 167 additions and 41 deletions
|
|
@ -1,16 +1,18 @@
|
|||
{
|
||||
pkgs,
|
||||
inputs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
inherit (lib.modules) mkIf mkMerge mkDefault mkOptionDefault;
|
||||
inherit (lib.options) mkOption;
|
||||
inherit (lib.modules) mkIf mkMerge mkBefore mkAfter mkDefault mkOptionDefault;
|
||||
inherit (lib.options) mkOption mkEnableOption;
|
||||
inherit (lib.lists) optionals;
|
||||
inherit (lib.strings) concatStringsSep;
|
||||
inherit (lib.strings) concatStringsSep optionalString;
|
||||
inherit (config.services) tailscale avahi;
|
||||
inherit (config) networking;
|
||||
inherit (networking) hostName;
|
||||
cfg = config.networking.access;
|
||||
cidrModule = { config, ... }: {
|
||||
options = with lib.types; {
|
||||
all = mkOption {
|
||||
|
|
@ -41,6 +43,15 @@ in {
|
|||
type = attrsOf (submodule cidrModule);
|
||||
default = { };
|
||||
};
|
||||
localaddrs = {
|
||||
enable = mkEnableOption "localaddrs" // {
|
||||
default = networking.firewall.interfaces.local.nftables.enable;
|
||||
};
|
||||
stateDir = mkOption {
|
||||
type = path;
|
||||
default = "/var/lib/localaddrs";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config.networking.access = {
|
||||
|
|
@ -50,11 +61,11 @@ in {
|
|||
hasStaticAddress = eth0.address or [ ] != [ ] || eth0.addresses or [ ] != [ ];
|
||||
hasSLAAC = eth0.slaac.enable or false;
|
||||
in mkMerge [
|
||||
(mkIf (hasStaticAddress || hasSLAAC) (mkDefault "${hostName}.local.${config.networking.domain}"))
|
||||
(mkIf (hasStaticAddress || hasSLAAC) (mkDefault "${hostName}.local.${networking.domain}"))
|
||||
(mkIf (avahi.enable && avahi.publish.enable) (mkOptionDefault "${hostName}.local"))
|
||||
];
|
||||
tail = mkIf tailscale.enable "${hostName}.tail.${config.networking.domain}";
|
||||
global = mkIf (networking.enableIPv6 && networking.tempAddresses == "disabled") "${hostName}.${config.networking.domain}";
|
||||
tail = mkIf tailscale.enable "${hostName}.tail.${networking.domain}";
|
||||
global = mkIf (networking.enableIPv6 && networking.tempAddresses == "disabled") "${hostName}.${networking.domain}";
|
||||
};
|
||||
cidrForNetwork = {
|
||||
loopback = {
|
||||
|
|
@ -86,14 +97,114 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
config.networking.firewall = {
|
||||
interfaces.local = {
|
||||
nftables.conditions = [
|
||||
"ip saddr { ${concatStringsSep ", " networking.access.cidrForNetwork.local.v4} }"
|
||||
(mkIf networking.enableIPv6
|
||||
"ip6 saddr { ${concatStringsSep ", " networking.access.cidrForNetwork.local.v6} }"
|
||||
)
|
||||
];
|
||||
config.networking = {
|
||||
nftables.ruleset = mkBefore (''
|
||||
define localrange6 = 2001:568::/29
|
||||
'' + optionalString cfg.localaddrs.enable ''
|
||||
include "${cfg.localaddrs.stateDir}/*.nft"
|
||||
'');
|
||||
firewall = {
|
||||
interfaces.local = {
|
||||
nftables.conditions = [
|
||||
"ip saddr { ${concatStringsSep ", " networking.access.cidrForNetwork.local.v4} }"
|
||||
(mkIf networking.enableIPv6
|
||||
"ip6 saddr { $localrange6, ${concatStringsSep ", " networking.access.cidrForNetwork.local.v6} }"
|
||||
)
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
config.systemd.services = let
|
||||
localaddrs = pkgs.writeShellScript "localaddrs" ''
|
||||
set -eu
|
||||
getaddrs() {
|
||||
local PREFIX=$1 PATTERN=$2 IPADDRS
|
||||
IPADDRS=$(${pkgs.iproute2}/bin/ip -o addr show to "$PREFIX") || return $?
|
||||
IPADDRS=$(printf '%s\n' "$IPADDRS" | ${pkgs.gnugrep}/bin/grep -o "$PATTERN") || return $?
|
||||
if [[ -z $IPADDRS ]]; then
|
||||
return 1
|
||||
fi
|
||||
printf '%s\n' "$IPADDRS"
|
||||
}
|
||||
getaddrs4() {
|
||||
getaddrs 10.1.1.0/24 '[0-9]*\.[0-9.]*/[0-9]*'
|
||||
}
|
||||
getaddrs6() {
|
||||
getaddrs 2001:568::/29 '[0-9a-f:]*:[0-9a-f:]*/[0-9]*'
|
||||
}
|
||||
mkdir -p $STATE_DIRECTORY
|
||||
if LOCALADDRS4=$(getaddrs4); then
|
||||
printf '%s\n' "$LOCALADDRS4" > $STATE_DIRECTORY/localaddrs4
|
||||
else
|
||||
echo WARNING: localaddr4 not found >&2
|
||||
fi
|
||||
if LOCALADDRS6=$(getaddrs6); then
|
||||
echo "$LOCALADDRS6" > $STATE_DIRECTORY/localaddrs6
|
||||
else
|
||||
echo WARNING: localaddr6 not found >&2
|
||||
fi
|
||||
'';
|
||||
localaddrs-nftables = pkgs.writeShellScript "localaddrs-nftables" ''
|
||||
set -eu
|
||||
LOCALADDR6=$(head -n1 "${cfg.localaddrs.stateDir}/localaddrs6" || true)
|
||||
if [[ -n $LOCALADDR6 ]]; then
|
||||
printf 'redefine localrange6 = %s\n' "$LOCALADDR6" > ${cfg.localaddrs.stateDir}/ranges.nft
|
||||
fi
|
||||
'';
|
||||
localaddrs-nginx = pkgs.writeShellScript "localaddrs-nginx" ''
|
||||
set -eu
|
||||
LOCALADDR6=$(head -n1 "${cfg.localaddrs.stateDir}/localaddrs6" || true)
|
||||
if [[ -n $LOCALADDR6 ]]; then
|
||||
printf 'allow %s;\n' "$LOCALADDR6" > ${cfg.localaddrs.stateDir}/allow.nginx.conf
|
||||
fi
|
||||
LOCALADDR4=$(head -n1 "${cfg.localaddrs.stateDir}/localaddrs4" || true)
|
||||
if [[ -n $LOCALADDR4 ]]; then
|
||||
printf 'allow %s;\n' "$LOCALADDR4" >> ${cfg.localaddrs.stateDir}/allow.nginx.conf
|
||||
fi
|
||||
'';
|
||||
localaddrs-reload = pkgs.writeShellScript "localaddrs-reload" ''
|
||||
${config.systemd.package}/bin/systemctl reload localaddrs 2>/dev/null ||
|
||||
${config.systemd.package}/bin/systemctl restart localaddrs ||
|
||||
true
|
||||
'';
|
||||
in {
|
||||
localaddrs = mkIf cfg.localaddrs.enable {
|
||||
unitConfig = {
|
||||
After = [ "network-online.target" ];
|
||||
};
|
||||
serviceConfig = rec {
|
||||
StateDirectory = "localaddrs";
|
||||
ExecStart = mkMerge [
|
||||
[ "${localaddrs}" ]
|
||||
(mkIf networking.nftables.enable (mkAfter [
|
||||
"${localaddrs-nftables}"
|
||||
]))
|
||||
(mkIf config.services.nginx.enable (mkAfter [
|
||||
"${localaddrs-nginx}"
|
||||
]))
|
||||
];
|
||||
ExecReload = ExecStart;
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
};
|
||||
nftables = mkIf (networking.nftables.enable && cfg.localaddrs.enable) rec {
|
||||
wants = [ "localaddrs.service" ];
|
||||
after = wants;
|
||||
serviceConfig = {
|
||||
ExecReload = mkBefore [
|
||||
"+${localaddrs-reload}"
|
||||
];
|
||||
};
|
||||
};
|
||||
nginx = mkIf (config.services.nginx.enable && cfg.localaddrs.enable) rec {
|
||||
wants = [ "localaddrs.service" ];
|
||||
after = wants;
|
||||
serviceConfig = {
|
||||
ExecReload = mkBefore [
|
||||
"+${localaddrs-reload}"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -101,10 +212,10 @@ in {
|
|||
systemFor = hostName: inputs.self.nixosConfigurations.${hostName}.config;
|
||||
systemForOrNull = hostName: inputs.self.nixosConfigurations.${hostName}.config or null;
|
||||
in {
|
||||
systemFor = hostName: if hostName == config.networking.hostName
|
||||
systemFor = hostName: if hostName == networking.hostName
|
||||
then config
|
||||
else systemFor hostName;
|
||||
systemForOrNull = hostName: if hostName == config.networking.hostName
|
||||
systemForOrNull = hostName: if hostName == networking.hostName
|
||||
then config
|
||||
else systemForOrNull hostName;
|
||||
};
|
||||
|
|
|
|||
|
|
@ -44,17 +44,24 @@ in {
|
|||
};
|
||||
|
||||
config = {
|
||||
networking.firewall = mkIf cfg.enable {
|
||||
allowedTCPPorts = mkIf (cfg.homekit.enable && cfg.homekit.openFirewall) (
|
||||
networking.firewall = let
|
||||
homekitTcp = mkIf cfg.homekit.enable (
|
||||
map ({ port, ... }: port) cfg.config.homekit or [ ]
|
||||
);
|
||||
|
||||
allowedUDPPortRanges = [
|
||||
(mkIf (cfg.cast.enable && cfg.cast.openFirewall) {
|
||||
castUdpRanges = mkIf cfg.cast.enable [
|
||||
{
|
||||
from = 32768;
|
||||
to = 60999;
|
||||
})
|
||||
}
|
||||
];
|
||||
in mkIf cfg.enable {
|
||||
interfaces.local = {
|
||||
allowedTCPPorts = mkIf (!cfg.homekit.openFirewall) homekitTcp;
|
||||
allowedUDPPortRanges = mkIf (!cfg.cast.openFirewall) castUdpRanges;
|
||||
};
|
||||
allowedTCPPorts = mkIf cfg.homekit.openFirewall homekitTcp;
|
||||
allowedUDPPortRanges = mkIf cfg.cast.openFirewall castUdpRanges;
|
||||
};
|
||||
|
||||
# MDNS
|
||||
|
|
|
|||
|
|
@ -2,10 +2,11 @@
|
|||
|
||||
let
|
||||
inherit (lib) types;
|
||||
inherit (lib.options) mkOption;
|
||||
inherit (lib.options) mkOption mkEnableOption;
|
||||
inherit (lib.modules) mkIf;
|
||||
inherit (lib.attrsets) mapAttrsToList;
|
||||
inherit (lib.strings) optionalString concatStringsSep concatMapStringsSep;
|
||||
inherit (lib.lists) optionals;
|
||||
fwcfg = config.networking.firewall;
|
||||
cfg = config.networking.nftables;
|
||||
|
||||
|
|
@ -41,7 +42,7 @@ let
|
|||
concatStringsSep "\n" (mapAttrsToList (name: ifcfg: concatMapStringsSep "\n" (cond:
|
||||
mkPorts "${cond} tcp" ifcfg.allowedTCPPorts ifcfg.allowedTCPPortRanges "accept"
|
||||
+ mkPorts "${cond} udp" ifcfg.allowedUDPPorts ifcfg.allowedUDPPortRanges "accept"
|
||||
) ifcfg.nftables.conditions) fwcfg.interfaces)
|
||||
) (optionals ifcfg.nftables.enable ifcfg.nftables.conditions)) fwcfg.interfaces)
|
||||
}
|
||||
|
||||
# DHCPv6
|
||||
|
|
@ -86,9 +87,16 @@ let
|
|||
'';
|
||||
interfaceModule = { config, name, ... }: {
|
||||
options = {
|
||||
nftables.conditions = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = "iifname ${name}";
|
||||
nftables = {
|
||||
enable = mkEnableOption "nftables firewall" // {
|
||||
default =
|
||||
config.allowedTCPPorts != [ ] || config.allowedTCPPortRanges != [ ]
|
||||
|| config.allowedUDPPorts != [ ] || config.allowedUDPPortRanges != [ ];
|
||||
};
|
||||
conditions = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = "iifname ${name}";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -5,10 +5,10 @@
|
|||
}: let
|
||||
inherit (lib.modules) mkIf mkBefore;
|
||||
inherit (lib.options) mkOption mkEnableOption;
|
||||
inherit (lib.strings) concatMapStringsSep;
|
||||
inherit (lib.strings) concatMapStringsSep optionalString;
|
||||
inherit (lib.lists) optionals;
|
||||
inherit (config.services) tailscale;
|
||||
inherit (config.networking.access) cidrForNetwork;
|
||||
inherit (config.networking.access) cidrForNetwork localaddrs;
|
||||
localModule = { config, ... }: {
|
||||
options = with lib.types; {
|
||||
local = {
|
||||
|
|
@ -22,7 +22,9 @@
|
|||
cidrForNetwork.loopback.all
|
||||
++ cidrForNetwork.local.all
|
||||
++ optionals tailscale.enable cidrForNetwork.tail.all;
|
||||
allows = concatMapStringsSep "\n" mkAllow allowAddresses;
|
||||
allows = concatMapStringsSep "\n" mkAllow allowAddresses + optionalString localaddrs.enable ''
|
||||
include ${localaddrs.stateDir}/*.nginx.conf;
|
||||
'';
|
||||
in mkBefore ''
|
||||
${allows}
|
||||
deny all;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue