movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

nixos/firewall: Always use global firewall.allowed rules

Browse source 
Apply global firewall.allowed* rules separately from the
interface specific rules.
This commit is contained in:
Ben Blaxill 2018-11-18 15:03:42 -05:00
parent 0925c482c8
commit 551d2f7ed2
1 changed files with 10 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

24
nixos/modules/services/networking/firewall.nix
View file

@ -151,39 +151,39 @@ let
${concatStrings (mapAttrsToList (iface: cfg: ${concatStrings (mapAttrsToList (iface: cfg:
concatMapStrings (port: concatMapStrings (port:
'' ''
ip46tables -A nixos-fw -p tcp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} ip46tables -A nixos-fw -p tcp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "any") "-i ${iface}"}
'' ''
) cfg.allowedTCPPorts ) cfg.allowedTCPPorts
) cfg.interfaces)} ) (cfg.interfaces // {any={allowedTCPPorts = cfg.allowedTCPPorts;};}))}
# Accept connections to the allowed TCP port ranges. # Accept connections to the allowed TCP port ranges.
${concatStrings (mapAttrsToList (iface: cfg: ${concatStrings (mapAttrsToList (iface: cfg:
concatMapStrings (rangeAttr: concatMapStrings (rangeAttr:
let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in
'' ''
ip46tables -A nixos-fw -p tcp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} ip46tables -A nixos-fw -p tcp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "any") "-i ${iface}"}
'' ''
) cfg.allowedTCPPortRanges ) cfg.allowedTCPPortRanges
) cfg.interfaces)} ) (cfg.interfaces // {any={allowedTCPPortRanges = cfg.allowedTCPPortRanges;};}))}
# Accept packets on the allowed UDP ports. # Accept packets on the allowed UDP ports.
${concatStrings (mapAttrsToList (iface: cfg: ${concatStrings (mapAttrsToList (iface: cfg:
concatMapStrings (port: concatMapStrings (port:
'' ''
ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "any") "-i ${iface}"}
'' ''
) cfg.allowedUDPPorts ) cfg.allowedUDPPorts
) cfg.interfaces)} ) (cfg.interfaces // {any={allowedUDPPorts = cfg.allowedUDPPorts;};}))}
# Accept packets on the allowed UDP port ranges. # Accept packets on the allowed UDP port ranges.
${concatStrings (mapAttrsToList (iface: cfg: ${concatStrings (mapAttrsToList (iface: cfg:
concatMapStrings (rangeAttr: concatMapStrings (rangeAttr:
let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in
'' ''
ip46tables -A nixos-fw -p udp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} ip46tables -A nixos-fw -p udp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "any") "-i ${iface}"}
'' ''
) cfg.allowedUDPPortRanges ) cfg.allowedUDPPortRanges
) cfg.interfaces)} ) (cfg.interfaces // {any={allowedUDPPortRanges = cfg.allowedUDPPortRanges;};}))}
# Accept IPv4 multicast. Not a big security risk since # Accept IPv4 multicast. Not a big security risk since
# probably nobody is listening anyway. # probably nobody is listening anyway.
@ -508,15 +508,11 @@ in
}; };
interfaces = mkOption { interfaces = mkOption {
default = { default = { };
default = mapAttrs (name: value: cfg."${name}") commonOptions;
};
type = with types; attrsOf (submodule [ { options = commonOptions; } ]); type = with types; attrsOf (submodule [ { options = commonOptions; } ]);
description = description =
'' ''
Interface-specific open ports. Setting this value will override Interface-specific open ports.
all values of the <literal>networking.firewall.allowed*</literal>
options.
''; '';
}; };
} // commonOptions; } // commonOptions;