Skip to content

Commit

Permalink
firewall shenanigans and af specialization
Browse files Browse the repository at this point in the history
  • Loading branch information
ifd3f committed Apr 9, 2024
1 parent 3e10e21 commit a6b8872
Show file tree
Hide file tree
Showing 5 changed files with 58 additions and 4 deletions.
3 changes: 2 additions & 1 deletion netconf/asmodeus.rkt
Original file line number Diff line number Diff line change
Expand Up @@ -28,4 +28,5 @@
("172.20.0.0/14")
("172.31.0.0/16"))))))

(displayln (commandtree->string commands))
(for ([s (commandtree->strings commands)])
(displayln s))
1 change: 0 additions & 1 deletion netconf/util-test.rkt
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
#lang racket

(require rackunit "util.rkt")
(require net/ip)

(check-equal? (expand-command-tree '()) '(()))
(check-equal? (expand-command-tree '(a b)) '((a b)))
Expand Down
24 changes: 22 additions & 2 deletions netconf/util.rkt
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@
(require scribble/srcdoc
(for-doc scribble/base scribble/manual))

(require net/ip)
(require rebellion/type/record)
(require racket/symbol)
(require (for-syntax racket/syntax))
Expand Down Expand Up @@ -32,6 +31,12 @@
(set policy route-map dn42-roa rule 20 match rpki notfound)
(set policy route-map dn42-roa rule 30 action deny)
(set policy route-map dn42-roa rule 30 match rpki invalid)]]})
dual-stack
afmap
extract-v4
extract-v6
extract-all
dual-stacked-suffix
wireguard/tunnel:render-vyos
wireguard/tunnel
wireguard/peer
Expand Down Expand Up @@ -68,7 +73,22 @@
(cons (cons obj before) after)]
[('()) (cons '() '())])

(struct dual-stack (v4 v6))
(struct dual-stack (v4 v6)
#:transparent)
(define extract-v4 dual-stack-v4)
(define extract-v6 dual-stack-v6)
(define (extract-all ds)
(append (extract-v4 ds) (extract-v6 ds)))
(define (dual-stacked-suffix name)
(dual-stack (format "~a-v4" name)
(format "~a-v6" name)))

(define (afmap f t)
(match t
['() '()]
[(cons (? list? l) rest) (cons (afmap f l) (afmap f rest))]
[(cons (? dual-stack? ds) rest) (cons (f ds) (afmap f rest))]
[(cons other rest) (cons other (afmap f rest))]))

(define-record-type wireguard/tunnel
(ifname
Expand Down
5 changes: 5 additions & 0 deletions netconf/vyos-firewall-test.rkt
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
#lang racket

(require rackunit)
(require "util.rkt")
(require "vyos-firewall.rkt")
29 changes: 29 additions & 0 deletions netconf/vyos-firewall.rkt
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
#lang racket

(require rebellion/type/record)
(require racket/match)
(require "util.rkt")

(provide
dn42-tunnels-in)

(define dn42-allowed-transit-addrs
(dual-stack '("10.0.0.0/8"
"172.20.0.0/14"
"172.31.0.0/16")
'("fd00::/8")))

(define ifd3f-dn42-addrs
(dual-stack '("172.23.7.176/28")
'("fd00:ca7:b015::/48")))

(define (dn42-tunnels-in)
`[(rule 10 [(description "Allow peer transit")
(src ,(dual-stacked-suffix "dn42-allowed-transit"))
(dst ,(dual-stacked-suffix "dn42-allowed-transit"))
(action drop)])

(rule 20 [(description "Block traffic to operator-assigned IP space")
(src ,(dual-stacked-suffix "dn42-allowed-transit"))
(dst ,(dual-stacked-suffix "ifd3f-dn42"))
(action drop)])])

0 comments on commit a6b8872

Please sign in to comment.