Commit Graph

1510 Commits

Author SHA1 Message Date
Daniel Barlow
01fe2159b4 ppp: write ifindex as output
because what happens if the service is restarted but the new ppp0 is
a different interface than the old one so that services which had
bound to it with the old name are now not getting new data

(I am not 100% that this actually happens but it seems like it would
be good to avoid it if it does)
2025-03-31 23:11:30 +01:00
Daniel Barlow
d7d19b5ed0 dhcp6 client: fix service dir in address and prefix acquirers
the scripts now expect the actual service dir instead of the .outputs
subdir
2025-03-31 23:06:40 +01:00
Daniel Barlow
ee683f2202 firewall: fix syntax of icmp v4 rule 2025-03-31 23:03:24 +01:00
Daniel Barlow
d9723aeb87 secrets subscriber: make restart-all work 2025-03-31 23:01:48 +01:00
Daniel Barlow
46ed8f0199 add bandwidth as a service option for ppp (l2tp, pppoe) 2025-03-27 20:23:26 +00:00
Daniel Barlow
dd44fbaec1 rate limit for v4 icmp 2025-03-27 20:21:48 +00:00
Daniel Barlow
89065be6cd bandwidth is bits/second so divide by 8 2025-03-27 20:21:14 +00:00
Daniel Barlow
420320e434 firewall: remove unused args/names/vars 2025-03-27 18:40:07 +00:00
Daniel Barlow
9ecd2b4fb4 think 2025-03-25 23:55:00 +00:00
Daniel Barlow
1a6160bcab firewall: show how to ratelimit icmp6 to 5% of available bandwidth
it's a little klunky as yet, requires setting properties.bandwidth on
the interface service
2025-03-25 23:53:02 +00:00
Daniel Barlow
b1bf13bb01 add svc:directory, mostly for use in debugging messages 2025-03-25 23:47:01 +00:00
Daniel Barlow
c3f550698d watch-outputs fix update logic
it was only working by accident, when it worked, which was by no
means all of the time

note that we unconditionally perform the action (restart or whatever)
once we've started and got the initial state of the outputs. That's
because we have no idea whether the outputs changed in the interval
between the controlled service initially starting and watch-outputs
starting, so updates in that interval could be lost
2025-03-25 23:44:21 +00:00
Daniel Barlow
05991225de anoia.svc allow open of a service that is not yet running
we change the inotify watcher so that it attempts to monitor
/run/service as well as /run/service/foo. If foo doesn't yet exist
then that call to addwatch fails, so we need to be looking at the
parent if we are to be told when foo gets created
2025-03-25 23:37:58 +00:00
Daniel Barlow
7ce1c6bb7d add realpath to lualinux 2025-03-24 22:39:59 +00:00
Daniel Barlow
8440378a39 anoia: make dirname handle tralning / like posix 2025-03-24 22:37:24 +00:00
Daniel Barlow
e5cfd41013 add nft_limit kmodule for rate limiting in firewall 2025-03-21 21:19:48 +00:00
Daniel Barlow
0ae5689a40 support maps in firewallgen 2025-03-21 21:19:18 +00:00
Daniel Barlow
45047dc023 squahs falls back 2025-03-21 21:09:05 +00:00
Daniel Barlow
3673804b93 think 2025-03-21 21:08:17 +00:00
Daniel Barlow
be03e9e8c8 service outputs falls back to properties (untested) 2025-03-18 18:38:04 +00:00
Daniel Barlow
4e51977ae0 provide properties attr to services
properties are similar to outputs, but are different in that they are
fixed values (do not change) and are present even when the service is
down

if the attribute is present and an attrset, this will write the
equivalent recursive directory structure to $out/.properties/
2025-03-12 23:35:56 +00:00
Daniel Barlow
2b0972ed73 svc.open accepts a /nix/store folder not an outputs folder
this mostly makes things simpler
2025-03-11 00:21:44 +00:00
Daniel Barlow
f22237a3b3 doc: filter src attribute to not rebuild as much 2025-03-10 23:08:37 +00:00
Daniel Barlow
9dc0f25587 min-copy-clocure test: ensure sshd up before starting
this test goes wrong intermittently in CI, see if this makes it more
reliable
2025-03-09 21:37:13 +00:00
Daniel Barlow
9ab77a7d7e remove unused function 2025-03-09 20:44:35 +00:00
Daniel Barlow
c6918fec00 firewall: use extraText for zone set contents
* the lua necessary is quite wordy, but it's less of a hack than
post-processing the rules file with pseudo-sed to get rid of `elements
= { }` lines

* also switch from stop/starting the firewall service to using a
signal, so that we don't go briefly offline every time a new interface
appears
2025-03-09 20:42:02 +00:00
Daniel Barlow
d4e46dbe28 secrets/subscriber don't depend on the services we're watching
this means a watched service can stop and start without killing
the subscriber, and that we can watch for services that don't
yet exist
2025-03-09 20:35:40 +00:00
Daniel Barlow
d1f87a56e0 secrets/subscriber: use correct numbers for signals to s6-svc 2025-03-09 20:34:29 +00:00
Daniel Barlow
8c39b47cae output-template: allow splicing statements instead of expression
if the text inside the delimiters begins with ; (a semicolon) then
the rest of it is expected to be one or more Lua statements. It needs
to say `return "foo"` to interpolate anything, as there is no
implicit return of the value of the last statement
2025-03-05 22:38:48 +00:00
Daniel Barlow
2c7a16d792 firewallgen: add extraText param to set
anything in here is added verbatim to the set definition
2025-03-05 22:36:35 +00:00
Daniel Barlow
d6b06abb63 delet second copy of output-template 2025-03-02 21:34:02 +00:00
Daniel Barlow
6b32aa569e think 2025-03-02 21:21:45 +00:00
Daniel Barlow
234d1bd87e basic unit tests for output-template 2025-03-02 21:14:46 +00:00
Daniel Barlow
c38f180fb7 output-template expose table module 2025-03-02 21:14:16 +00:00
Daniel Barlow
9a8b22997c output-template: pass the tests 2025-03-02 21:09:32 +00:00
Daniel Barlow
c32d09bd83 output-template: run the tests 2025-03-02 21:09:11 +00:00
Daniel Barlow
6649ebeccd firewall: use watch-outputs to track changes in zone->interface map
includes a horrible hack to work around (claimed (by me)) deficiencies
in the nftables parser
2025-02-28 00:43:20 +00:00
Daniel Barlow
929226ed9e delete commented code 2025-02-27 20:55:30 +00:00
Daniel Barlow
a98f026210 think 2025-02-27 20:54:44 +00:00
Daniel Barlow
f4dc001b71 check firewall zones in pppoe test 2025-02-25 23:32:05 +00:00
Daniel Barlow
024c018262 run the output-template test 2025-02-22 00:10:19 +00:00
Daniel Barlow
e1293e3778 think 2025-02-21 23:22:39 +00:00
Daniel Barlow
0c406058e9 remove acceotance of udp sport 5 on wan
this was added for replies to dns queries but isn't needed for
that purpose as connection tracking does that anyway
2025-02-12 21:54:01 +00:00
Daniel Barlow
19d441333c remove duplicate rule 2025-02-10 23:50:07 +00:00
Daniel Barlow
a726c09ae4 improve explanaton of reverse path filtering rule
thanks RoS for the references :-)
2025-02-10 23:48:29 +00:00
Daniel Barlow
7e2b0068e6 nixfmt-rfc-style
There is nothing in this commit except for the changes made by
nix-shell -p nixfmt-rfc-style --run "nixfmt ."

If this has mucked up your open branches then sorry about that. You
can probably nixfmt them to match before merging
2025-02-10 21:55:08 +00:00
dan
13cc5a8992 Merge pull request 'support firewall zones: don't hardcode interface names in rules' (#16) from firescape into main
Reviewed-on: https://gti.telent.net/dan/liminix/pulls/16
2025-02-10 21:23:15 +00:00
Daniel Barlow
3f889c7119 default firewall zones in gateway profile 2025-02-10 21:21:08 +00:00
Daniel Barlow
7f17125039 firewall: update zones with interface names as they appear 2025-02-10 21:21:08 +00:00
Daniel Barlow
4bb081ffcf export anoia.svc:fileno so it can be used with event loops 2025-02-10 21:21:08 +00:00