rc/friwall
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Always combine IP set data with static network definitions from NetBox

Browse source 
Before we relied on the combined data being present in ipsets.json
when generating a new config, but ipsets.json is only updated through
the form at /ipsets. So submitting any other form after changing
NetBox definitions might crash when trying to find an entry from
networks.json in ipsets.json.

Now we introduce a helper functon to always read both files and
combine the prefixes fron networks.json with ipsets.json. This way it
is not necessary to save a new ipsets.json before other changes.

Also don’t crash when enumerating networks for each VPN group.
This commit is contained in:
Timotej Lazar 2024-08-14 11:25:07 +02:00
parent b6c191e2ce
commit 048195c45c
5 changed files with 41 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

10
README.md
View file

@ -8,9 +8,17 @@ The firewall consists of two servers (or “bricks”) in active–backup config
On each configuration change, a tarball of relevant files in `/etc` is generated and pushed via SSH to both nodes. This happens for instance each time an IP set or a forwarding rule is modified, or a VPN key is added or removed. Firewall nodes and the current configuration version for each are stored in `nodes.json`.
## Database
Application data is stored in a number of JSON files in the home directory of the user the application runs as. The `db` module defines utility functions to ensure consistency when manipulating data:
- `lock(name)` and `unlock(name)` acquire or release the lock for a given file or all files with no argument;
- `read(name)` and `write(name, data)` retrieve or store a dictionary in the given file, which should be locked;
- `load(name)` and `save(name, data)` do the same but lock the file first.
## IP sets
Names and IP prefixes for physical networks are configured in NetBox and stored in `networks.json`, which is never modified by the application. Custom IP sets used for forwarding rules may be defined at `/ipsets`, as well as NAT addresse and VPN access for all networks. These settings are stored in `ipsets.json` and added to static definitions in `networks.json` when generating firewall configuration.
Names and IP prefixes for physical networks are configured in NetBox and stored in `networks.json`, which is never modified by the application. Custom IP sets used for forwarding rules may be defined at `/ipsets`, as well as NAT addresse and VPN access for all networks. These settings are stored in `ipsets.json`. To read and combine data from both files, the `ipsets.read` utility function should be used. Combined data may then be modified and written back to `ipsets.json`, as with all other files.
## Rules