108 lines
4.4 KiB
Bash
Executable File
108 lines
4.4 KiB
Bash
Executable File
#!/bin/sh
|
|
# =====================================================================
|
|
# Network namespace guard for owuitools-api and owuitools-searxng.
|
|
#
|
|
# WHY THIS EXISTS
|
|
#
|
|
# Putting the API on an `internal: true` network is not, on its own,
|
|
# enough. `internal` removes the default route, so the container cannot
|
|
# reach the wider LAN - but the bridge gateway address (172.22.0.1) is the
|
|
# HOST, and it sits on the container's own subnet. It is therefore
|
|
# on-link and reachable with no routing at all. Measured on this host
|
|
# before this file existed: a TCP connect from the API container to
|
|
# 172.22.0.1:22 succeeded, which is the host's sshd. Every other service
|
|
# the host binds to 0.0.0.0 - nginx, portainer, grafana - was equally
|
|
# reachable.
|
|
#
|
|
# That is precisely the thing this suite is supposed to make impossible,
|
|
# so the containers that handle user-controlled input run inside this
|
|
# namespace instead, behind a default-deny filter. They keep no network
|
|
# interface of their own; see `network_mode: container:owuitools-netguard`
|
|
# in docker-compose.yml.
|
|
#
|
|
# The result is a hard allowlist: squid, valkey, and the gateway's inbound
|
|
# request. The host is not on it.
|
|
# =====================================================================
|
|
set -eu
|
|
|
|
# What this applied, kept with every other component's log. `exec` so the
|
|
# redirection covers the verification output at the end too, which is the
|
|
# part worth having: it is the difference between "the filter ran" and
|
|
# "the filter is in force".
|
|
LOG_DIR="${OWUITOOLS_LOG_DIR:-/logs}"
|
|
if [ -d "$LOG_DIR" ] && [ -w "$LOG_DIR" ]; then
|
|
exec > >(tee -a "$LOG_DIR/netguard.log") 2>&1
|
|
fi
|
|
|
|
# These come from docker-compose.yml, which is where the addresses are
|
|
# pinned in the first place. They used to be written out again here, and
|
|
# two copies of an address is one copy that gets changed: a compose edit
|
|
# that moved a container would leave this file quietly filtering for the
|
|
# old address, which fails CLOSED but looks like the service is down.
|
|
#
|
|
# The defaults are the pinned values, so the script still runs standalone.
|
|
GW_IP="${OWUITOOLS_GW_IP:-172.22.0.10}" # the only permitted inbound source
|
|
EGRESS_IP="${OWUITOOLS_EGRESS_IP:-172.22.0.12}" # squid, the only route to the internet
|
|
VALKEY_IP="${OWUITOOLS_VALKEY_IP:-172.22.0.14}" # cache
|
|
API_PORT="${OWUITOOLS_API_PORT:-8000}"
|
|
|
|
echo "Configuring owuitools netguard..."
|
|
|
|
# Fail closed before opening anything.
|
|
iptables -w 10 -P INPUT DROP
|
|
iptables -w 10 -P OUTPUT DROP
|
|
iptables -w 10 -P FORWARD DROP
|
|
|
|
# Filter table only. Docker's embedded DNS resolver installs NAT rules in
|
|
# this namespace; flushing nat would break name resolution for every
|
|
# service lookup the containers make.
|
|
iptables -w 10 -F INPUT
|
|
iptables -w 10 -F OUTPUT
|
|
iptables -w 10 -F FORWARD
|
|
|
|
# Loopback: the embedded DNS resolver at 127.0.0.11, the API's own health
|
|
# check, and api -> searxng, which is now localhost because both share
|
|
# this namespace.
|
|
iptables -w 10 -A INPUT -i lo -j ACCEPT
|
|
iptables -w 10 -A OUTPUT -o lo -j ACCEPT
|
|
|
|
iptables -w 10 -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
iptables -w 10 -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# Inbound: only the gateway, only the API port.
|
|
iptables -w 10 -A INPUT -s "$GW_IP/32" -p tcp --dport "$API_PORT" \
|
|
-m conntrack --ctstate NEW -j ACCEPT
|
|
|
|
# Outbound: squid for anything leaving this host, valkey for the cache.
|
|
iptables -w 10 -A OUTPUT -d "$EGRESS_IP/32" -p tcp --dport 3128 \
|
|
-m conntrack --ctstate NEW -j ACCEPT
|
|
iptables -w 10 -A OUTPUT -d "$VALKEY_IP/32" -p tcp --dport 6379 \
|
|
-m conntrack --ctstate NEW -j ACCEPT
|
|
|
|
# Verify the rules that matter actually took, and that the policies are
|
|
# still DROP. A firewall that silently failed to apply is worse than none,
|
|
# because everything downstream carries on as though it were enforced.
|
|
iptables -w 10 -C INPUT -s "$GW_IP/32" -p tcp --dport "$API_PORT" \
|
|
-m conntrack --ctstate NEW -j ACCEPT
|
|
iptables -w 10 -C OUTPUT -d "$EGRESS_IP/32" -p tcp --dport 3128 \
|
|
-m conntrack --ctstate NEW -j ACCEPT
|
|
|
|
test "$(iptables -S INPUT | head -n 1)" = "-P INPUT DROP"
|
|
test "$(iptables -S OUTPUT | head -n 1)" = "-P OUTPUT DROP"
|
|
test "$(iptables -S FORWARD | head -n 1)" = "-P FORWARD DROP"
|
|
|
|
touch /tmp/firewall-ready
|
|
|
|
echo
|
|
echo "owuitools netguard ready."
|
|
echo " inbound $GW_IP -> tcp/$API_PORT"
|
|
echo " outbound $EGRESS_IP:3128 (squid), $VALKEY_IP:6379 (valkey)"
|
|
echo " the host (172.22.0.1) is NOT reachable from this namespace"
|
|
echo
|
|
|
|
trap 'exit 0' TERM INT
|
|
while :; do
|
|
sleep 3600 &
|
|
wait $!
|
|
done
|