diff --git a/README.md b/README.md deleted file mode 100644 index 41dad29..0000000 --- a/README.md +++ /dev/null @@ -1,45 +0,0 @@ -# FRIwall - -Web application for managing the main firewall at FRI. - -## Operation - -The firewall consists of two servers (or “bricks”) in active–backup configuration, using weighted BGP routes for failover. Traffic filtering and VPN are done with nftables and WireGuard. Both are configured exactly the same on both servers. The settings are managed with this application. - -On each configuration change, a tarball of relevant files in `/etc` is generated and pushed via SSH to both nodes. This happens for instance each time an IP set or a forwarding rule is modified, or a VPN key is added or removed. Firewall nodes and the current configuration version for each are stored in `nodes.json`. - -## IP sets - -Names and IP prefixes for physical networks are configured in NetBox and stored in `networks.json`, which is never modified by the application. Custom IP sets used for forwarding rules may be defined at `/ipsets`, as well as NAT addresse and VPN access for all networks. These settings are stored in `ipsets.json` and added to static definitions in `networks.json` when generating firewall configuration. - -## Rules - -Forwarding rules are configured at `/rules` and toggled at `/rules/manage`. Enabled rules are included directly in the nftables configuration. For each rule, one or more manager groups can be set; users in these AD groups may toggle the rule without admin access. This is used for instance to allow teachers to disable Internet access in classrooms. - -## VPN - -WireGuard is used for remote access. Domain users can self‐register new keys at `/vpn`. The key database `wireguard.json` is a dictionary of entries like - - "10.0.0.26": { - "key": "ABC…XYZ=", - "ip6": "aaaa:bbbb:cccc:dddd:1a::/80", - "time": 1682166836.88937, - "name": "machine1", - "user": "user@domain" - } - -IP addresses for new keys are assigned automatically from the subnets defined in `wg_net` and `wg_net6` settings. When generating firewall configuration, each IP is placed in the nftables sets based on its user’s group and settings in `ipsets.json`. - -### Custom keys - -Administrators can define custom keys with access to specified networks at `/vpn/custom`. These keys are used to connect machines into secure networks where users are not allowed to attach arbitrary devices themselves. - -Custom keys are stored in the same database, but with a `networks` entry in place of `user`, for instance - - "10.0.0.27": { - "key": "FOO…BAR=", - "ip6": "aaaa:bbbb:cccc:dddd:1b::/80", - "time": 1682166836.88937, - "name": "machine2", - "networks": ["net1", "net2"] - } diff --git a/web/__init__.py b/web/__init__.py index 966e54e..92da140 100644 --- a/web/__init__.py +++ b/web/__init__.py @@ -25,7 +25,7 @@ def create_app(test_config=None): 'wg_endpoint': '', 'wg_port': '51820', 'wg_allowed_nets': '', - 'wg_dns': '', + 'wg_dns': False, 'wg_key': '', 'wg_net': '', 'wg_net6': '', diff --git a/web/static/vpn.js b/web/static/vpn.js deleted file mode 100644 index 5a846bd..0000000 --- a/web/static/vpn.js +++ /dev/null @@ -1,92 +0,0 @@ -function delKey(key) { - fetch('del', { - credentials: 'include', - method: 'POST', - headers: { 'Content-Type': 'application/json' }, - body: JSON.stringify({ pubkey: key }) - }) - .then(response => { - if (!response.ok) - throw new Error('deleting key failed'); - return response.text(); - }) - .then(data => { - fetchKeys(); - }) - .catch(error => console.error(error)); -} - -function fetchKeys() { - fetch(endpoint, { - credentials: 'include' - }) - .then(response => { - if (!response.ok) - throw new Error('fetching keys failed'); - return response.json(); - }) - .then(data => { - update(Object.values(data)); - }) - .catch(error => console.error(error)); -} - -window.addEventListener('load', fetchKeys); - -const form = document.querySelector('form#request'); -form.addEventListener('submit', event => { - event.preventDefault(); - - const inputs = Array.from(document.querySelectorAll('form input')); - const settings = document.querySelector('section#settings'); - const submit = document.querySelector('button#submit'); - - const key = wireguard.generateKeypair(); - const options = Object.fromEntries(inputs.map(e => [e.name, e.type === 'checkbox' ? e.checked : e.value])); - const networks = Array.from(document.querySelectorAll('select#networks option:checked')).map(e => e.value); - - submit.innerHTML = 'Obdelovanje…'; - submit.disabled = true; - fetch('new', { - credentials: 'include', - method: 'POST', - headers: { 'Content-Type': 'application/json' }, - body: JSON.stringify({ - pubkey: key.publicKey, - options: options, - networks: networks, - }) - }) - .then(response => { - if (!response.ok) { - response.text().then(text => { - settings.innerHTML = response.status + ' ' + response.statusText + ': ' + text; - }); - } else { - return response.text(); - } - }) - .then(text => { - const config = text.replace(/PrivateKey = .*/, "PrivateKey = "+key.privateKey).trim(); - document.querySelector('code#config').innerHTML = config; - - const blob = new Blob([config], { type: 'text/plain;charset=utf-8' }); - const link = document.getElementById('download'); - link.download = 'wg-fri.conf'; - link.href = window.URL.createObjectURL(blob); - - const qr = qrcode(0, 'L'); - qr.addData(config.replace(/#.*\n/g, '')); - qr.make(); - document.getElementById('qr').innerHTML = qr.createSvgTag(3); - - fetchKeys(); - }) - .catch(error => { - settings.innerHTML = error; - }) - .finally(() => { - form.style.display = 'none'; - settings.style.display = 'unset'; - }); -}); diff --git a/web/system.py b/web/system.py index 1bde640..3bb66b9 100644 --- a/web/system.py +++ b/web/system.py @@ -77,24 +77,17 @@ def save_config(): settings = db.read('settings') version = settings['version'] = int(settings.get('version') or '0') + 1 - # Find networks accessible to VPN users for each AD group. - vpn_groups = {e['vpn'] for e in ipsets.values() if e.get('vpn')} + # Update IP sets with VPN addresses based on AD group membership. + vpn_groups = set([e['vpn'] for e in ipsets.values() if e.get('vpn')]) group_networks = { group: [name for name, data in ipsets.items() if data['vpn'] == group] for group in vpn_groups } - - # Add VPN addresses to IP sets. for ip, key in wireguard.items(): - # Find all networks this IP should belong to: - # - manually specified networks for custom keys, - # - networks accessible to any of the user’s groups. - key_networks = set(key.get('networks', ())) for group in user_groups.get(key.get('user', ''), ()): - key_networks |= set(group_networks.get(group, ())) - for network in key_networks: - ipsets[network]['ip'].append(f'{ip}/32') - if ip6 := key.get('ip6'): - ipsets[network]['ip6'].append(ip6) + for network in group_networks.get(group, ()): + ipsets[network]['ip'].append(f'{ip}/32') + if ip6 := key.get('ip6'): + ipsets[network]['ip6'].append(ip6) # Create config files. output = pathlib.Path.home() / 'config' / f'{version}' diff --git a/web/templates/base.html b/web/templates/base.html index 7b0832c..add9ed1 100644 --- a/web/templates/base.html +++ b/web/templates/base.html @@ -9,8 +9,7 @@ body { margin: 1em auto; } code { - background-color: #f8f8f8; - padding: 0.1em 0.25em; + background-color: #eeeeee; } details { margin: 0.5em 1em; @@ -32,22 +31,18 @@ input:read-only { border-style: dotted; } pre { - background-color: #f8f8f8; + background-color: #eeeeee; border: 1px solid #cccccc; padding: 0.5em; } -table { - border-spacing: 0 0.1em; -} th { text-align: left; } th, td { padding-right: 1em; - vertical-align: middle; } -tbody > tr:hover { - background-color: #f8f8f8; +th { + border-bottom: 1px solid black; } ul.keys { margin: 0 0.5em 0.5em; diff --git a/web/templates/index.html b/web/templates/index.html index 80ea4a6..01320ba 100644 --- a/web/templates/index.html +++ b/web/templates/index.html @@ -3,7 +3,7 @@
VPN -
urejanje ključev za oddaljeni dostop +
urejanje ključev za WireGuard VPN
Pravila
vklop / izklop pravil za požarni zid
@@ -20,8 +20,6 @@
pravila za posredovanje prometa
Netmap
statične 1:1 preslikave naslovov za strežniška omrežja -
VPN po meri -
urejanje ključev za oddaljeni dostop do posebnih omrežij
Nastavitve
nastavitve aplikacije FRIwall diff --git a/web/templates/vpn/custom.html b/web/templates/vpn/custom.html deleted file mode 100644 index d03398a..0000000 --- a/web/templates/vpn/custom.html +++ /dev/null @@ -1,68 +0,0 @@ -{% extends 'base.html' %} -{% block header %} - -{% endblock %} - -{% block content %} -

-Urejate ključe WireGuard s posebnimi dostopi. - - - - -
KljučIPIPv6NapravaOmrežja -
- -

-

Nov ključ

-
-

-
- -

-
- -

- -

- - -
- - - - - -{% endblock %} diff --git a/web/templates/vpn/index.html b/web/templates/vpn/index.html index c47b61c..473704d 100644 --- a/web/templates/vpn/index.html +++ b/web/templates/vpn/index.html @@ -2,7 +2,10 @@ {% block content %}

-Za VPN oziroma oddeljano povezavo v omrežje FRI uporabljamo WireGuard. Za priklop v omrežje ustvarite nov ključ in prenesite izpisano datoteko. Nato sledite napotkom za posamezni sistem. +Za VPN oziroma oddeljano povezavo v omrežje FRI uporabljamo WireGuard. Več informacij o uporabi in nastavitvah VPN najdete v dokumentaciji. + +

+Za priklop v omrežje spodaj ustvarite nov ključ in prenesite izpisano datoteko. Nato sledite napotkom za posamezni sistem.

Windows / Mac @@ -40,14 +43,14 @@ Na vsaki napravi, ki jo želite povezati v omrežje FRI, ustvarite nov ključ. P

- - + +
- - + +

-Če vklopite prvo opcijo, bo vaš računalnik čez VPN usmerjal ves promet. Če izklopite drugo opcijo, bodo nekateri strežniki dostopni le prek naslova IP. Če ste v dvomih, pustite privzete nastavitve. Več informacij o uporabi in nastavitvah VPN najdemo v dokumentaciji. +Če vklopite prvo opcijo, bo vaš računalnik čez VPN usmerjal ves promet. Če izklopite drugo opcijo, bodo nekateri strežniki dostopni le prek naslova IP. Če ste v dvomih, pustite privzete nastavitve.

- {% endblock %} diff --git a/web/templates/vpn/wg-fri.conf b/web/templates/vpn/wg-fri.conf index 136490b..09bbf9c 100644 --- a/web/templates/vpn/wg-fri.conf +++ b/web/templates/vpn/wg-fri.conf @@ -1,5 +1,5 @@ [Interface] -# {{ timestamp }} {{ user }} {{ name }} +# {{ timestamp }} {{ current_user['username'] }} {{ name }} # PublicKey = {{ pubkey }} PrivateKey = # paste private key here Address = {{ ip }}{% if ip6 %}, {{ ip6 }}{% endif %} diff --git a/web/vpn.py b/web/vpn.py index 876fc50..ce82fe4 100644 --- a/web/vpn.py +++ b/web/vpn.py @@ -18,46 +18,23 @@ wgkey_regex = re.compile(r'^[A-Za-z0-9/+=]{44}$') def index(): return flask.render_template('vpn/index.html') -@blueprint.route('/custom') -@flask_login.login_required -def custom(): - if not flask_login.current_user.is_admin: - return flask.Response('forbidden', status=403, mimetype='text/plain') - with db.locked(): - keys = {ip: data for ip, data in db.read('wireguard').items() if data.get('networks') and not data.get('user')} - ipsets = db.read('networks') | db.read('ipsets') - return flask.render_template('vpn/custom.html', keys=keys, ipsets=ipsets.keys()) - @blueprint.route('/list') @flask_login.login_required def list(): - # Return logged-in user’s keys, marking the key used for current connection (if any). user = flask_login.current_user.get_id() - return flask.jsonify([ - data | {'ip': ip, 'active': flask.request.remote_addr in (ip, data.get('ip6'))} - for ip, data in db.load('wireguard').items() if data.get('user') == user - ]) - -@blueprint.route('/list-custom') -@flask_login.login_required -def list_custom(): - # Return all custom keys. - if not flask_login.current_user.is_admin: - return flask.Response('forbidden', status=403, mimetype='text/plain') - return flask.jsonify([ - data | {'ip': ip, 'active': flask.request.remote_addr in (ip, data.get('ip6'))} - for ip, data in db.load('wireguard').items() if data.get('networks') and not data.get('user') - ]) + return flask.jsonify( + {k: v | {'active': flask.request.remote_addr in (v.get('ip'), v.get('ip6'))} + for k, v in db.load('wireguard').items() if v.get('user') == user}) @blueprint.route('/new', methods=('POST',)) @flask_login.login_required def new(): - # Each key is assigned a new IPv4 address from the pool settings['wg_net']. - # Each key is then assigned a corresponding IPv6 subnet, depending on the amount of surplus addresses available. + # Each key is associated with a new IPv4 address from the pool settings['wg_net']. + # Each key gets an IPv6 subnet depending on the amount of surplus addresses available. # For wg_net 10.10.0.0/18 and wg_net6 1234:5678:90ab:cdef::/64, # the key for 10.10.0.10/32 would get 1234:5678:90ab:cdef:a::/80. def ipv4to6(net4, ip4, net6): - # Calculate the address and prefix length for the IPv6 network that can be assigned to this key. + # Calculate the address and prefix length for the assigned IPv6 network. len4 = (net4.max_prefixlen - net4.prefixlen) len6 = (net6.max_prefixlen - net6.prefixlen) # Make sure the network address ends at a colon. Wastes some addresses but IPv6. @@ -66,42 +43,35 @@ def new(): return ip6 + '/' + str(net6.max_prefixlen - assigned) pubkey = flask.request.json.get('pubkey', '') - options = flask.request.json.get('options', {}) if not re.match(wgkey_regex, pubkey): return flask.Response('invalid key', status=400, mimetype='text/plain') - # Read server’s private key and find the corresponding public key. settings = db.load('settings') server_pubkey = subprocess.run([f'wg pubkey'], input=settings.get('wg_key'), text=True, capture_output=True, shell=True).stdout.strip() - now = datetime.datetime.utcnow() - key = { - 'key': pubkey, - 'time': now.timestamp(), - 'name': re.sub('[^-._A-Za-z0-9]', '', options.get('name', '')), - } - - # Determine IPv4 and IPv6 addresses for the new key. host = ipaddress.ip_interface(settings.get('wg_net') or '10.0.0.1/24') - key['ip6'] = None + ip6 = None with db.locked(): # Find a free address for the new key. keys = db.read('wireguard') for index, ip in enumerate(host.network.hosts(), start=1): if ip != host.ip and str(ip) not in keys: if wg_net6 := settings.get('wg_net6'): - key['ip6'] = ipv4to6(host.network, ip, ipaddress.ip_interface(wg_net6).network) + ip6 = ipv4to6(host.network, ip, ipaddress.ip_interface(wg_net6).network) break else: return flask.Response('no more available IP addresses', status=500, mimetype='text/plain') + now = datetime.datetime.utcnow() + name = re.sub('[^-._A-Za-z0-9]', '', flask.request.json.get('name', '')) - # Add remaining attributes to new key and update key database. - if flask_login.current_user.is_admin and flask.request.json.get('networks'): - key['networks'] = flask.request.json.get('networks') - else: - key['user'] = flask_login.current_user.get_id() - keys[str(ip)] = key + keys[str(ip)] = { + 'key': pubkey, + 'ip6': str(ip6) if ip6 else None, + 'time': now.timestamp(), + 'user': flask_login.current_user.get_id(), + 'name': name, + } db.write('wireguard', keys) # Generate a new config archive for firewall nodes. @@ -113,14 +83,13 @@ def new(): 'port': settings.get('wg_port') or '51820', 'server_key': server_pubkey, 'pubkey': pubkey, - 'timestamp': now, 'ip': str(ip), - 'ip6': key['ip6'], - 'name': key['name'], - 'user': key.get('user', 'custom'), - 'dns': settings.get('wg_dns', '') if options.get('use-dns', True) else False, + 'ip6': str(ip6) if ip6 else None, + 'timestamp': now, + 'name': name, + 'dns': settings.get('wg_dns') if flask.request.json.get('use_dns', True) else False, 'allowed_nets': settings.get('wg_allowed_nets', ''), - 'add_default': options.get('add-default', False), + 'add_default': flask.request.json.get('add_default', False), } return flask.render_template('vpn/wg-fri.conf', **args) @@ -133,10 +102,7 @@ def delete(): with db.locked(): user = flask_login.current_user.get_id() - keys = { - ip: data for ip, data in db.read('wireguard').items() - if not (data.get('key') == pubkey and (data.get('user') == user or flask_login.current_user.is_admin)) - } + keys = {k: v for k, v in db.read('wireguard').items() if v.get('user') != user or v.get('key') != pubkey} db.write('wireguard', keys) system.run(system.save_config)