From e478f140e0e704f9985db039eb178be13af63abb Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 18 Jul 2015 13:29:07 +0200 Subject: 3 lass.iptables: refactor imports --- 3modules/lass/iptables.nix | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) (limited to '3modules/lass') diff --git a/3modules/lass/iptables.nix b/3modules/lass/iptables.nix index 6d567ca23..1cd6d3f8e 100644 --- a/3modules/lass/iptables.nix +++ b/3modules/lass/iptables.nix @@ -2,7 +2,28 @@ arg@{ config, lib, pkgs, ... }: let inherit (pkgs) writeScript writeText; - inherit (lib) concatMapStringsSep concatStringsSep attrNames unique fold any attrValues catAttrs filter flatten length hasAttr mkEnableOption mkOption mkIf types; + + inherit (lib) + concatMapStringsSep + concatStringsSep + attrNames + unique + fold + any + attrValues + catAttrs + filter + flatten + length + hasAttr + mkEnableOption + mkOption + mkIf + types + sort; + + elemIsIn = a: as: + any (x: x == a) as; cfg = config.lass.iptables; -- cgit v1.2.3 From 7f30f58a3e2f5e9a7333fa1f5be9c998c6ad098a Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 18 Jul 2015 13:55:17 +0200 Subject: 3 lass.iptables: sort rules by precedence --- 3modules/lass/iptables.nix | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to '3modules/lass') diff --git a/3modules/lass/iptables.nix b/3modules/lass/iptables.nix index 1cd6d3f8e..ba05abeb2 100644 --- a/3modules/lass/iptables.nix +++ b/3modules/lass/iptables.nix @@ -95,10 +95,12 @@ let }; }; - #buildTable :: iptablesAttrSet` -> str + #buildTable :: iptablesVersion -> iptablesAttrSet` -> str #todo: differentiate by iptables-version - buildTables = iptv: ts: + buildTables = v: ts: let + sortedTable = sort (a: b: a.precedence < b.precedence) ts; + declareChain = t: cn: #TODO: find out what to do whit these count numbers ":${cn} ${t."${cn}".policy} [0:0]"; @@ -106,7 +108,6 @@ let buildChain = tn: cn: #"${concatStringsSep " " ((attrNames t."${cn}") ++ [cn])}"; - #TODO: sort by precedence #TODO: double check should be unneccessary, refactor! if (hasAttr "rules" ts."${tn}"."${cn}") then if (ts."${tn}"."${cn}".rules == null) then @@ -144,7 +145,7 @@ let "\nCOMMIT"; in concatStringsSep "\n" ([] - ++ map buildTable (attrNames ts) + ++ map buildTable (attrNames sortedTable) ); #===== -- cgit v1.2.3 From 06a969575684ee21179a7d5730bbed2d65c38173 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 18 Jul 2015 13:55:56 +0200 Subject: 3 lass.iptables: check if target is valid --- 3modules/lass/iptables.nix | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) (limited to '3modules/lass') diff --git a/3modules/lass/iptables.nix b/3modules/lass/iptables.nix index ba05abeb2..52058821c 100644 --- a/3modules/lass/iptables.nix +++ b/3modules/lass/iptables.nix @@ -114,20 +114,18 @@ let "" else concatMapStringsSep "\n" (rule: "\n-A ${cn} ${rule}") ([] - ++ map buildRule ts."${tn}"."${cn}".rules + ++ map (buildRule tn cn) ts."${tn}"."${cn}".rules ) else "" ; - buildRule = rule: - #TODO implement rule validation-test here - # - #target: - #target needs to be an existing chain (in the same table) or ACCEPT, REJECT, DROP, LOG, QUEUE, RETURN + buildRule = tn: cn: rule: + #target validation test: + assert (elemIsIn rule.target ([ "ACCEPT" "REJECT" "DROP" "QUEUE" "LOG" "RETURN" ] ++ ts."${tn}"."${cn}")); - #predicate: + #predicate validation test: #maybe use iptables-test #TODO: howto exit with evaluation error by shellscript? #apperantly not possible from nix because evalatution wouldn't be deterministic. -- cgit v1.2.3 From 83901e1e475f6bcb6aca0aefbcbebde62339b481 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 18 Jul 2015 14:30:29 +0200 Subject: 3 lass.iptables sort rules instead of tables --- 3modules/lass/iptables.nix | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) (limited to '3modules/lass') diff --git a/3modules/lass/iptables.nix b/3modules/lass/iptables.nix index 52058821c..b78879d2c 100644 --- a/3modules/lass/iptables.nix +++ b/3modules/lass/iptables.nix @@ -99,26 +99,27 @@ let #todo: differentiate by iptables-version buildTables = v: ts: let - sortedTable = sort (a: b: a.precedence < b.precedence) ts; declareChain = t: cn: #TODO: find out what to do whit these count numbers ":${cn} ${t."${cn}".policy} [0:0]"; buildChain = tn: cn: - #"${concatStringsSep " " ((attrNames t."${cn}") ++ [cn])}"; - - #TODO: double check should be unneccessary, refactor! - if (hasAttr "rules" ts."${tn}"."${cn}") then - if (ts."${tn}"."${cn}".rules == null) then - "" + let + sortedRules = sort (a: b: a.precedence < b.precedence) ts."${tn}"."${cn}".rules; + + in + #TODO: double check should be unneccessary, refactor! + if (hasAttr "rules" ts."${tn}"."${cn}") then + if (ts."${tn}"."${cn}".rules == null) then + "" + else + concatMapStringsSep "\n" (rule: "\n-A ${cn} ${rule}") ([] + ++ map (buildRule tn cn) sortedRules + ) else - concatMapStringsSep "\n" (rule: "\n-A ${cn} ${rule}") ([] - ++ map (buildRule tn cn) ts."${tn}"."${cn}".rules - ) - else - "" - ; + "" + ; buildRule = tn: cn: rule: @@ -143,7 +144,7 @@ let "\nCOMMIT"; in concatStringsSep "\n" ([] - ++ map buildTable (attrNames sortedTable) + ++ map buildTable (attrNames ts) ); #===== -- cgit v1.2.3 From 70711515910f5627262f0da0270ab76024811c20 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 18 Jul 2015 14:32:02 +0200 Subject: 3 lass.iptables: fix broken predicate check --- 3modules/lass/iptables.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '3modules/lass') diff --git a/3modules/lass/iptables.nix b/3modules/lass/iptables.nix index b78879d2c..c97b9f730 100644 --- a/3modules/lass/iptables.nix +++ b/3modules/lass/iptables.nix @@ -124,7 +124,7 @@ let buildRule = tn: cn: rule: #target validation test: - assert (elemIsIn rule.target ([ "ACCEPT" "REJECT" "DROP" "QUEUE" "LOG" "RETURN" ] ++ ts."${tn}"."${cn}")); + assert (elemIsIn rule.target ([ "ACCEPT" "REJECT" "DROP" "QUEUE" "LOG" "RETURN" ] ++ (attrNames ts."${tn}"))); #predicate validation test: #maybe use iptables-test -- cgit v1.2.3