The packet filter's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4)
nftables drops its container, NET_ADMIN, the container-runtime capability, the runtime base images, the Dockerfile, and the bus credential and state directory only the container read; its tools are declared as a TypeScript bundle the toolchain compiles and node-tools loads on every node, and the iptables package the image used to carry is declared on the host. The runtime runs as the operator's account, so the tool runs the filter's commands through sudo without a prompt when it is not root (ADR 0175 §4, to-be 38 WP4), naming sudo's absence or refusal by how it failed; the filter file is the path the manifest's filtering names, held to it by a test; a found firewall that is present but will not answer stops a removal rather than passing for inactive; a legacy tool that is present but fails is said, not swallowed.
This commit is contained in:
jochen
+71
-13
@@ -2,9 +2,13 @@
|
||||
// rule set from every module's `listens` and writes it to the filter file (ADR 0045); the module
|
||||
// loads it through its own unit. This code reads the filter back as the machine enforces it, reloads
|
||||
// the mesh's own table, and removes one thing the mesh did not write when the operator names it
|
||||
// (ADR 0168, ADR 0170) — the seat's three verbs, over the machine's own tools.
|
||||
// (ADR 0168, ADR 0170) — the seat's three verbs, over the machine's own tools. Root is the module's
|
||||
// concern (ADR 0175 §4): the runtime loading this bundle runs as the operator's account (to-be 38
|
||||
// WP4), so the commands go through sudo without a prompt where the account is not root.
|
||||
|
||||
import { execFile } from "node:child_process";
|
||||
import { accessSync, constants } from "node:fs";
|
||||
import { delimiter, join } from "node:path";
|
||||
import { promisify } from "node:util";
|
||||
|
||||
const execFileP = promisify(execFile);
|
||||
@@ -12,9 +16,54 @@ const execFileP = promisify(execFile);
|
||||
/** A command runner, so the acts can be tested without a packet filter. */
|
||||
export type Runner = (cmd: string, args: string[]) => Promise<string>;
|
||||
|
||||
/** Where the mesh writes this node's filter: the path the manifest's `filtering.into` names. A
|
||||
* bundle has no environment of its own (to-be 38 WP4), so the path is said here once, and a test
|
||||
* holds it to the manifest's. */
|
||||
export const FILTER_FILE = "/etc/nftables.conf";
|
||||
|
||||
/** The command as it is run: as given when this process is root, else through sudo without a
|
||||
* prompt. The packet filter answers only to root, listing included. */
|
||||
export function escalated(cmd: string, args: string[], uid: number | undefined = process.getuid?.()): [string, string[]] {
|
||||
if (uid === 0) return [cmd, args];
|
||||
return ["sudo", ["-n", cmd, ...args]];
|
||||
}
|
||||
|
||||
/** Whether a tool is on this machine: an executable of that name on the path, or where the
|
||||
* system keeps its administration. Asked before a tool is run, so "not here" and "refused" are
|
||||
* never confused — the former is a fact to work around, the latter an error to say. */
|
||||
export function installed(tool: string, path: string = process.env.PATH ?? ""): boolean {
|
||||
const dirs = [...path.split(delimiter), "/usr/sbin", "/sbin", "/usr/bin"].filter((d) => d !== "");
|
||||
return dirs.some((dir) => {
|
||||
try {
|
||||
accessSync(join(dir, tool), constants.X_OK);
|
||||
return true;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
export const execRunner: Runner = async (cmd, args) => {
|
||||
const { stdout } = await execFileP(cmd, args, { maxBuffer: 16 * 1024 * 1024 });
|
||||
return stdout;
|
||||
const [program, argv] = escalated(cmd, args);
|
||||
try {
|
||||
const { stdout } = await execFileP(program, argv, { maxBuffer: 16 * 1024 * 1024 });
|
||||
return stdout;
|
||||
} catch (err) {
|
||||
// What failed is named by how it failed, not by prose: sudo missing is a spawn error; sudo
|
||||
// refusing speaks on its own stderr line; anything else is the command's own failure.
|
||||
const e = err as { code?: string | number; stderr?: string };
|
||||
if (program === "sudo") {
|
||||
if (e.code === "ENOENT") {
|
||||
throw new Error(`${cmd} needs root, and sudo is not installed here for the runtime's account to escalate with`);
|
||||
}
|
||||
const stderr = String(e.stderr ?? "").trim();
|
||||
if (/^sudo: .*command not found/m.test(stderr)) throw new Error(`${cmd} is not installed here`);
|
||||
if (/^sudo:/m.test(stderr)) {
|
||||
throw new Error(`${cmd} needs root and the runtime's account may not run it without a prompt: ${stderr}`);
|
||||
}
|
||||
}
|
||||
throw err;
|
||||
}
|
||||
};
|
||||
|
||||
/** The mesh's own tables, which `remove` never touches. */
|
||||
@@ -34,14 +83,17 @@ export interface Removal {
|
||||
export class FirewallClient {
|
||||
private readonly run: Runner;
|
||||
private readonly filterFile: string;
|
||||
private readonly have: (tool: string) => boolean;
|
||||
|
||||
constructor(run: Runner = execRunner, filterFile: string = process.env.MESH_FILTER_FILE ?? "/etc/nftables.conf") {
|
||||
constructor(run: Runner = execRunner, filterFile: string = FILTER_FILE, have: (tool: string) => boolean = installed) {
|
||||
this.run = run;
|
||||
this.filterFile = filterFile;
|
||||
this.have = have;
|
||||
}
|
||||
|
||||
static fromEnv(env: NodeJS.ProcessEnv = process.env): FirewallClient {
|
||||
return new FirewallClient(execRunner, env.MESH_FILTER_FILE ?? "/etc/nftables.conf");
|
||||
/** The filter as this machine has it: its own tools, the mesh's file. */
|
||||
static onThisMachine(): FirewallClient {
|
||||
return new FirewallClient();
|
||||
}
|
||||
|
||||
/** The mesh's live table — exactly what the mesh's own filter is dropping and accepting. */
|
||||
@@ -65,11 +117,14 @@ export class FirewallClient {
|
||||
const legacy: Record<string, string> = {};
|
||||
if (!table) {
|
||||
for (const tool of ["iptables-legacy", "ip6tables-legacy"]) {
|
||||
if (!this.have(tool)) continue; // no legacy tool, nothing to list
|
||||
try {
|
||||
const out = await this.run(tool, ["-S"]);
|
||||
if (out.trim()) legacy[tool] = out;
|
||||
} catch {
|
||||
// the tool is not here, or the legacy filter is empty: nothing to list
|
||||
} catch (err) {
|
||||
// The tool is here and would not answer: said, not swallowed — a listing that silently
|
||||
// leaves out a predecessor's rules reads as "none".
|
||||
legacy[tool] = `error: ${err instanceof Error ? err.message : String(err)}`;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -82,14 +137,17 @@ export class FirewallClient {
|
||||
return { loaded: this.filterFile, table: await this.ruleset() };
|
||||
}
|
||||
|
||||
/** Whether the found front end is in force, whose chains `remove` leaves alone. */
|
||||
/** Whether the found front end is in force, whose chains `remove` leaves alone. Absent, it is
|
||||
* not; present and not answering, nothing is removed on a guess. */
|
||||
private async ufwActive(): Promise<boolean> {
|
||||
if (!this.have("ufw")) return false;
|
||||
let out: string;
|
||||
try {
|
||||
const out = await this.run("ufw", ["status"]);
|
||||
return /^Status:\s*active/m.test(out);
|
||||
} catch {
|
||||
return false;
|
||||
out = await this.run("ufw", ["status"]);
|
||||
} catch (err) {
|
||||
throw new Error(`cannot tell whether the found firewall is in force, so nothing of its is removed: ${err instanceof Error ? err.message : String(err)}`);
|
||||
}
|
||||
return /^Status:\s*active/m.test(out);
|
||||
}
|
||||
|
||||
/** Remove one rule set the mesh did not write, named as the host reports it (ADR 0168). */
|
||||
|
||||
Reference in New Issue
Block a user