Changeset 14206 in genesis

Timestamp:

Aug 29, 2018, 7:03:25 PM (6 years ago)

Author:

rick

Message:

Add option for whitelisting services on proxy

To avoid clutter on the network a non-proxy service also requires
this list to be present. This could how-ever yield to unwanted results if the
proxy dynamically changes to one which have a lesser set of features allowed.

Files:

• nodes/Meerburg/wleiden.yaml (modified) (1 diff)
• nodes/Rick/wleiden.yaml (modified) (1 diff)
• tools/gformat.py (modified) (4 diffs)

nodes/Meerburg/wleiden.yaml

@@ -22 +22 @@
 status    : "up"
 whitelist : ['58:12:43:AA:6E:D6']
+publicnat : ['http', 'https', 'submission', 'imaps', 'pop3s']
 
 

nodes/Rick/wleiden.yaml

@@ -26 +26 @@
 serviceid : "172.31.254.9"
 status    : "up"
+publicnat : ['http', 'https', 'submission', 'imaps', 'pop3s']
 
 

tools/gformat.py

@@ -171 +171 @@
       'autogen_gfile' : gfile,
       'service_proxy_ileiden' : False, 
+      'publicnat' : ['http', 'https'],
     }
     f = open(gfile, 'r')
@@ -836 +837 @@
 pf_rules="/etc/pf.conf"
 {% if autogen_ileiden_enable -%}
-pf_flags="-D ext_if={{ externalif }} -D int_if={{ internalif }} -D publicnat={80,443}"
+pf_flags="-D ext_if={{ externalif }} -D int_if={{ internalif }} -D publicnat={{ publicnat|join(',') }} -D ileiden_ports={{ publicnat|join(',') }}"
 lvrouted_enable="{{ autogen_ileiden_enable }}"
 lvrouted_flags="-u -s s00p3rs3kr3t -m 28"
@@ -892 +893 @@
       pf_flags="-D ext_if=$externalif -D ext_if_net=$externalif:network -D inet_if=$externalif -D inet_ip='($externalif:0)' -D masterip=$masterip"
     {% endif %}
-    pf_flags="$pf_flags -D publicnat=80,443"
+    pf_flags="$pf_flags -D publicnat={{ publicnat|join(',') }}"
     lvrouted_flags="$lvrouted_flags -g"
   {% elif service_proxy_normal or service_incoming_rdr %}
@@ -906 +907 @@
     named_auto_forward_only="YES"
     pf_rules="/etc/pf.node.conf"
-    pf_flags=""
+    pf_flags="-D ileiden_ports={{ publicnat|join(',') }}"
     lvrouted_flags="$lvrouted_flags -z `make_list "$list_ileiden_proxies" ","`"
   {% endif %}