gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/networking.firewall.nftables: remove with lib;

Browse Source
This commit is contained in:
Felix Buehler
2024-09-15 10:43:54 +02:00
committed by Jörg Thalheim
parent 15edaa6e16
commit e915ced804
1 changed files with 25 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/networking/firewall-nftables.nix
+25 -28
View File
@@ -1,16 +1,13 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.networking.firewall;
ifaceSet = concatStringsSep ", " (
ifaceSet = lib.concatStringsSep ", " (
map (x: ''"${x}"'') cfg.trustedInterfaces
);
portsToNftSet = ports: portRanges: concatStringsSep ", " (
portsToNftSet = ports: portRanges: lib.concatStringsSep ", " (
map (x: toString x) ports
++ map (x: "${toString x.from}-${toString x.to}") portRanges
);
@@ -22,8 +19,8 @@ in
options = {
networking.firewall = {
extraInputRules = mkOption {
type = types.lines;
extraInputRules = lib.mkOption {
type = lib.types.lines;
default = "";
example = "ip6 saddr { fc00::/7, fe80::/10 } tcp dport 24800 accept";
description = ''
@@ -34,8 +31,8 @@ in
'';
};
extraForwardRules = mkOption {
type = types.lines;
extraForwardRules = lib.mkOption {
type = lib.types.lines;
default = "";
example = "iifname wg0 accept";
description = ''
@@ -46,8 +43,8 @@ in
'';
};
extraReversePathFilterRules = mkOption {
type = types.lines;
extraReversePathFilterRules = lib.mkOption {
type = lib.types.lines;
default = "";
example = "fib daddr . mark . iif type local accept";
description = ''
@@ -61,7 +58,7 @@ in
};
config = mkIf (cfg.enable && config.networking.nftables.enable) {
config = lib.mkIf (cfg.enable && config.networking.nftables.enable) {
assertions = [
{
@@ -73,7 +70,7 @@ in
message = "extraStopCommands is incompatible with the nftables based firewall: ${cfg.extraStopCommands}";
}
{
assertion = cfg.pingLimit == null || !(hasPrefix "--" cfg.pingLimit);
assertion = cfg.pingLimit == null || !(lib.hasPrefix "--" cfg.pingLimit);
message = "nftables syntax like \"2/second\" should be used in networking.firewall.pingLimit";
}
{
@@ -84,16 +81,16 @@ in
networking.nftables.tables."nixos-fw".family = "inet";
networking.nftables.tables."nixos-fw".content = ''
${optionalString (cfg.checkReversePath != false) ''
${lib.optionalString (cfg.checkReversePath != false) ''
chain rpfilter {
type filter hook prerouting priority mangle + 10; policy drop;
meta nfproto ipv4 udp sport . udp dport { 67 . 68, 68 . 67 } accept comment "DHCPv4 client/server"
fib saddr . mark ${optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept
fib saddr . mark ${lib.optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept
jump rpfilter-allow
${optionalString cfg.logReversePathDrops ''
${lib.optionalString cfg.logReversePathDrops ''
log level info prefix "rpfilter drop: "
''}
@@ -107,7 +104,7 @@ in
chain input {
type filter hook input priority filter; policy drop;
${optionalString (ifaceSet != "") ''iifname { ${ifaceSet} } accept comment "trusted interfaces"''}
${lib.optionalString (ifaceSet != "") ''iifname { ${ifaceSet} } accept comment "trusted interfaces"''}
# Some ICMPv6 types like NDP is untracked
ct state vmap {
@@ -118,18 +115,18 @@ in
untracked: jump input-allow,
}
${optionalString cfg.logRefusedConnections ''
${lib.optionalString cfg.logRefusedConnections ''
tcp flags syn / fin,syn,rst,ack log level info prefix "refused connection: "
''}
${optionalString (cfg.logRefusedPackets && !cfg.logRefusedUnicastsOnly) ''
${lib.optionalString (cfg.logRefusedPackets && !cfg.logRefusedUnicastsOnly) ''
pkttype broadcast log level info prefix "refused broadcast: "
pkttype multicast log level info prefix "refused multicast: "
''}
${optionalString cfg.logRefusedPackets ''
${lib.optionalString cfg.logRefusedPackets ''
pkttype host log level info prefix "refused packet: "
''}
${optionalString cfg.rejectPackets ''
${lib.optionalString cfg.rejectPackets ''
meta l4proto tcp reject with tcp reset
reject
''}
@@ -138,20 +135,20 @@ in
chain input-allow {
${concatStrings (mapAttrsToList (iface: cfg:
${lib.concatStrings (lib.mapAttrsToList (iface: cfg:
let
ifaceExpr = optionalString (iface != "default") "iifname ${iface}";
ifaceExpr = lib.optionalString (iface != "default") "iifname ${iface}";
tcpSet = portsToNftSet cfg.allowedTCPPorts cfg.allowedTCPPortRanges;
udpSet = portsToNftSet cfg.allowedUDPPorts cfg.allowedUDPPortRanges;
in
''
${optionalString (tcpSet != "") "${ifaceExpr} tcp dport { ${tcpSet} } accept"}
${optionalString (udpSet != "") "${ifaceExpr} udp dport { ${udpSet} } accept"}
${lib.optionalString (tcpSet != "") "${ifaceExpr} tcp dport { ${tcpSet} } accept"}
${lib.optionalString (udpSet != "") "${ifaceExpr} udp dport { ${udpSet} } accept"}
''
) cfg.allInterfaces)}
${optionalString cfg.allowPing ''
icmp type echo-request ${optionalString (cfg.pingLimit != null) "limit rate ${cfg.pingLimit}"} accept comment "allow ping"
${lib.optionalString cfg.allowPing ''
icmp type echo-request ${lib.optionalString (cfg.pingLimit != null) "limit rate ${cfg.pingLimit}"} accept comment "allow ping"
''}
icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139). See RFC 4890, section 4.4."
@@ -161,7 +158,7 @@ in
}
${optionalString cfg.filterForward ''
${lib.optionalString cfg.filterForward ''
chain forward {
type filter hook forward priority filter; policy drop;