Skip to content

Commit b5b9b79

Browse files
Andrei-PozolotinAndrei-Pozolotin
authored
Merge pull request #56 from random-archer/vvl-nftables
initrd nftables service
2 parents c11c916 + f0eca7f commit b5b9b79

File tree

27 files changed

+466
-21
lines changed

27 files changed

+466
-21
lines changed

‎.azure.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ jobs:
4545
#
4646
- template: tool/azure/steps-cache.yml
4747
parameters: # change to reset cache
48-
cache_version: V16
48+
cache_version: V17
4949
#
5050
- bash: env|sort|grep CACHE
5151
displayName: review caches
@@ -70,6 +70,10 @@ jobs:
7070
- template: tool/azure/steps-image.yml
7171
parameters:
7272
image_path: test/unitada
73+
#
74+
- template: tool/azure/steps-image.yml
75+
parameters:
76+
image_path: test/nftables
7377
#
7478
- bash: machinectl --all --full
7579
displayName: review machines

‎PKGBUILD‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#
2+
# manual build: cd $repo ; makepkg -e ;
3+
#
4+
5+
pkgname=mkinitcpio-systemd-tool
6+
pkgver=build
7+
pkgrel=$(date +%s)
8+
pkgdesc="Provisioning tool for systemd in initramfs (systemd-tool)"
9+
arch=('any')
10+
url="https://github.com/random-archer/mkinitcpio-systemd-tool"
11+
license=('Apache')
12+
depends=('mkinitcpio' 'systemd')
13+
optdepends=('cryptsetup: for initrd-cryptsetup.service'
14+
'dropbear: for initrd-dropbear.service'
15+
'busybox: for initrd-tinysshd.service'
16+
'tinyssh: for initrd-tinysshd.service'
17+
'tinyssh-convert: for initrd-tinysshd.service'
18+
'mc: for initrd-debug-progs.service')
19+
conflicts=('mkinitcpio-dropbear' 'mkinitcpio-tinyssh')
20+
backup=("etc/${pkgname}/config/crypttab"
21+
"etc/${pkgname}/config/fstab"
22+
"etc/${pkgname}/network/initrd-network.network" )
23+
#source=("$pkgname-$pkgver.tar.gz::https://github.com/random-archer/${pkgname}/archive/v${pkgver}.tar.gz")
24+
#install="${pkgname}.install"
25+
#sha512sums=()
26+
27+
package() {
28+
cd ..
29+
make DESTDIR="$pkgdir/" PREFIX='/usr' install
30+
}

‎src/initrd-nftables.conf‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
#!/usr/bin/nft -f
2+
3+
# This file is part of https://github.com/random-archer/mkinitcpio-systemd-tool
4+
5+
# Provides firewall when running inside initrd
6+
# see: https://wiki.archlinux.org/index.php/Nftables
7+
8+
# file location in initramfs:
9+
# /etc/nftables.conf
10+
11+
# file location in real-root:
12+
# /etc/mkinitcpio-systemd-tool/config/initrd-nftables.conf
13+
14+
# note:
15+
# * more nft examples are in /usr/share/nftables/
16+
# * make sure SSHD_PORT matches dropbear or tinysshd
17+
18+
define SSHD_PORT = 22
19+
20+
table inet filter {
21+
set knockd4-allow {
22+
type ipv4_addr
23+
timeout 7d
24+
}
25+
set knockd4-step2 {
26+
type ipv4_addr
27+
timeout 5s
28+
}
29+
set knockd4-step1 {
30+
type ipv4_addr
31+
timeout 5s
32+
}
33+
set knockd6-allow {
34+
type ipv6_addr
35+
timeout 7d
36+
}
37+
set knockd6-step2 {
38+
type ipv6_addr
39+
timeout 5s
40+
}
41+
set knockd6-step1 {
42+
type ipv6_addr
43+
timeout 5s
44+
}
45+
chain input {
46+
type filter hook input priority 0; policy drop;
47+
ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate 1/second accept
48+
ip6 nexthdr icmpv6 icmpv6 type echo-request counter drop
49+
ip protocol icmp icmp type echo-request limit rate 1/second accept
50+
ip protocol icmp icmp type echo-request counter drop
51+
ct state {established, related} accept
52+
ct state invalid drop
53+
tcp dport $SSHD_PORT ip saddr @knockd4-allow accept
54+
ip saddr @knockd4-step2 tcp dport $SSHD_PORT set add ip saddr @knockd4-allow
55+
ip saddr @knockd4-step1 tcp dport $SSHD_PORT set add ip saddr @knockd4-step2
56+
tcp dport $SSHD_PORT set add ip saddr @knockd4-step1
57+
tcp dport $SSHD_PORT ip6 saddr @knockd6-allow accept
58+
ip6 saddr @knockd6-step2 tcp dport $SSHD_PORT set add ip6 saddr @knockd6-allow
59+
ip6 saddr @knockd6-step1 tcp dport $SSHD_PORT set add ip6 saddr @knockd6-step2
60+
tcp dport $SSHD_PORT set add ip6 saddr @knockd6-step1
61+
ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-reply, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
62+
ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept
63+
reject
64+
}
65+
chain forward {
66+
type filter hook forward priority 0; policy accept;
67+
accept
68+
}
69+
chain output {
70+
type filter hook output priority 0; policy accept;
71+
}
72+
}

‎src/initrd-nftables.service‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# This file is part of https://github.com/random-archer/mkinitcpio-systemd-tool
2+
3+
# Provides firewall when running inside initrd
4+
# see: https://wiki.archlinux.org/index.php/Nftables
5+
6+
# service dependencies:
7+
# - https://www.archlinux.org/packages/community/x86_64/nftables
8+
9+
[Unit]
10+
Description=Initrd Firewall Service
11+
Documentation=https://github.com/random-archer/mkinitcpio-systemd-tool/blob/master/README.md
12+
ConditionPathExists=/etc/initrd-release
13+
DefaultDependencies=no
14+
Before=initrd-network.service
15+
16+
[Service]
17+
# reproduce default nftables.service
18+
Type=oneshot
19+
ExecStart=/usr/bin/nft -f /etc/nftables.conf
20+
ExecReload=/usr/bin/nft flush ruleset ';' include '"/etc/nftables.conf"'
21+
ExecStop=/usr/bin/nft flush ruleset
22+
RemainAfterExit=yes
23+
24+
[Install]
25+
# activate by reverse dependency
26+
WantedBy=initrd-network.service
27+
28+
[X-SystemdTool]
29+
30+
# include nftables binaries
31+
InitrdCall=add_all_modules /netfilter/nft_*
32+
InitrdCall=add_all_modules /netfilter/nf_tables*
33+
34+
# provision firewall settings in initrd
35+
InitrdPath=/etc/nftables.conf source=/etc/mkinitcpio-systemd-tool/config/initrd-nftables.conf replace=yes

‎tool/image/arch/base/build.py‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
#
44
# build basic archux image
55
#
6+
# note:
7+
# * using azure cache, update `azure.yml/.../cache_version` when changing this file
68

79
from nspawn.build import *
810

@@ -69,9 +71,7 @@
6971
# provide host sshd keys
7072
"openssh "
7173
# build/install deps
72-
"sed "
73-
"grep "
74-
"make "
74+
"base-devel "
7575
# core package deps
7676
"linux "
7777
"mkinitcpio "
@@ -83,6 +83,8 @@
8383
"tinyssh-convert "
8484
# initrd-cryptsetup.service
8585
"cryptsetup "
86+
# initrd-nftables.service
87+
"nftables "
8688
)
8789

8890
# enable services

‎tool/image/test/cryptsetup/etc/systemd/system/initrd-debug-progs.service.d/override.conf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,11 @@ InitrdBinary=/usr/bin/strace
88
InitrdBinary=/usr/bin/cryptsetup
99

1010
# dependency reporter
11-
InitrdBinary=/usr/bin/systemd-analyze
11+
InitrdBinary=/usr/bin/systemd-analyze
1212

1313
# serial console resizer
1414
InitrdBinary=/usr/bin/resize
1515

1616
# qemu guest drivers
17+
InitrdCall=add_module e1000
1718
InitrdCall=add_all_modules /virtio/

‎tool/image/test/cryptsetup/setup.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,6 @@
2929
# MACVLAN=network_face,
3030
# Capability='all',
3131
# )
32+
33+
# configure machine ssh access
34+
WITH(BindReadOnly="/root/.ssh/authorized_keys")

‎tool/image/test/cryptsetup/verify.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
project_root = os.popen("git rev-parse --show-toplevel").read().strip()
1515
python_module = f"{project_root}/tool/module"
1616
sys.path.insert(0, python_module)
17+
from arkon_config import kernel_version
1718
from arkon_config import cryptsetup_machine
1819
from machine_unit import MachineUnit
1920

@@ -51,7 +52,7 @@
5152
"/bin/swapon",
5253
"/bin/swapoff",
5354

54-
"/usr/lib/modules/5.5.6-arch1-1/kernel/dm-crypt.ko",
55+
f"/usr/lib/modules/{kernel_version}/kernel/dm-crypt.ko",
5556

5657
"/usr/lib/udev/rules.d/10-dm.rules",
5758
"/usr/lib/udev/rules.d/11-dm-initramfs.rules",

‎tool/image/test/dropbear/setup.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,6 @@
2121

2222
# container name
2323
MACHINE(name=dropbear_machine)
24+
25+
# configure machine ssh access
26+
WITH(BindReadOnly="/root/.ssh/authorized_keys")

‎tool/image/test/nftables/build.py‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/usr/bin/env python
2+
3+
#
4+
# build nftables image
5+
#
6+
7+
from nspawn.build import *
8+
9+
import os
10+
import sys
11+
12+
# import shared config
13+
project_root = os.popen("git rev-parse --show-toplevel").read().strip()
14+
python_module = f"{project_root}/tool/module"
15+
sys.path.insert(0, python_module)
16+
from arkon_config import base_image_url
17+
from arkon_config import nftables_image_url
18+
19+
# declare image identity
20+
IMAGE(url=nftables_image_url)
21+
22+
# provision dependency image
23+
PULL(url=base_image_url)
24+
25+
# copy local resources
26+
COPY(path="/etc")
27+
28+
# publish image
29+
PUSH()

0 commit comments

Comments
 (0)