feat(network): use Tailnet identities and guarded host firewall

2026-11-04 12:13:09 +08:00
parent 7d7a69e686
commit 62ef4b458c
4 changed files with 280 additions and 7 deletions
--- a/firewall.sh
+++ b/firewall.sh
@@ -0,0 +1,224 @@
+#!/usr/bin/env bash
+# Own one nftables table. Never flush Docker, Tailscale or the host ruleset.
+set -euo pipefail
+export LC_ALL=C
+fail() { printf 'ERROR: %s\n' "$*" >&2; return 1; }
+validate_policy() {
+  jq -e '
+    def ip:
+      type == "string" and test("^(0|[1-9][0-9]{0,2})(\\.(0|[1-9][0-9]{0,2})){3}$") and
+      (split(".") | all(.[]; tonumber <= 255));
+    def tailip: ip and (split(".") | map(tonumber) | .[0] == 100 and .[1] >= 64 and .[1] <= 127);
+    def ports: type == "array" and all(.[]; type == "number" and . == floor and . >= 1 and . <= 65535);
+    (keys == ["hostname","management","public_tcp","public_udp","tailnet","version"]) and .version == 1 and
+    (.hostname | type == "string" and length <= 63 and test("^(dev|test|stage|prod)-[a-z][a-z0-9]{0,15}-[a-z][a-z0-9]{0,15}(-[a-z][a-z0-9]{0,15})?-(0[1-9]|[1-9][0-9])$")) and
+    (.public_tcp | ports) and (.public_udp | ports) and
+    (.management | keys == ["port","sources"]) and ([.management.port] | ports) and
+    (.management.sources | type == "array" and all(.[]; ip and (tailip | not))) and
+    (.tailnet | type == "array" and all(.[];
+      keys == ["sources","tcp","udp"] and (.sources | type == "array" and length > 0 and all(.[]; tailip)) and
+      (.tcp | ports) and (.udp | ports) and ((.tcp + .udp) | length > 0))) and
+    ((.management.sources | length > 0) or
+      ( .management.port as $ssh | any(.tailnet[]; .tcp | index($ssh) != null))) and
+    (.management.port as $ssh | (.public_tcp | index($ssh) == null))
+  ' "$1" >/dev/null || { fail 'Invalid firewall policy: exact IPv4 sources, ports, hostname and an explicit SSH path required'; return 1; }
+}
+render_policy() {
+  local policy=$1 ports row sources protocol
+  validate_policy "$policy" || return 1
+  cat <<'NFT'
+add table inet platform_host
+delete table inet platform_host
+table inet platform_host {
+  chain input {
+    type filter hook input priority 10; policy drop;
+    iifname "lo" accept
+    iifname != "tailscale0" ip saddr 100.64.0.0/10 drop
+    ct state invalid drop
+    ct state established,related accept
+    meta l4proto icmp accept
+    meta l4proto ipv6-icmp accept
+    udp sport 67 udp dport 68 accept
+    ip6 saddr fe80::/10 udp sport 547 udp dport 546 accept
+NFT
+  sources=$(jq -r '.management.sources | join(", ")' "$policy")
+  if [[ -n "$sources" ]]; then
+    printf '    iifname != "tailscale0" ip saddr { %s } tcp dport %s accept\n' "$sources" "$(jq -r .management.port "$policy")"
+  fi
+  for row in tcp udp; do
+    ports=$(jq -r --arg field "public_$row" '.[$field] | unique | map(tostring) | join(", ")' "$policy")
+    if [[ -n "$ports" ]]; then printf '    iifname != "tailscale0" %s dport { %s } accept\n' "$row" "$ports"; fi
+  done
+  # Match the decrypted interface AND Headscale-assigned source; no LAN spoofing.
+  while IFS= read -r row; do
+    sources=$(jq -r '.sources | unique | join(", ")' <<< "$row")
+    for protocol in tcp udp; do
+      ports=$(jq -r --arg protocol "$protocol" '.[$protocol] | unique | map(tostring) | join(", ")' <<< "$row")
+      if [[ -n "$ports" ]]; then printf '    iifname "tailscale0" ip saddr { %s } %s dport { %s } accept\n' "$sources" "$protocol" "$ports"; fi
+    done
+  done < <(jq -c '.tailnet[]' "$policy")
+  cat <<'NFT'
+  }
+  chain forward {
+    type filter hook forward priority 10; policy accept;
+    iifname "tailscale0" drop
+    oifname "tailscale0" drop
+  }
+}
+NFT
+}
+trusted_path() {
+  local path=$1
+  [[ "$path" == /* && "$path" != *'/../'* && "$path" != *'/./'* ]] || { fail 'Absolute trusted path required'; return 1; }
+  while [[ "$path" != / ]]; do
+    [[ ! -L "$path" ]] || { fail 'Symlink in firewall path'; return 1; }
+    if [[ -e "$path" ]]; then
+      [[ $(stat -c %u "$path") == 0 ]] && (( (8#$(stat -c %a "$path") & 0022) == 0 )) || { fail 'Firewall path must be root owned without group/other write permission'; return 1; }
+    fi
+    path=$(dirname -- "$path")
+  done
+}
+save_boot_gate() {
+  local state=$1 file
+  install -d -m 0700 "$state/boot"
+  for file in platform-firewall.service docker.service.d/20-platform-firewall.conf tailscaled.service.d/20-platform-firewall.conf; do
+    trusted_path "/etc/systemd/system/$file"
+    install -d -m 0700 "$state/boot/$(dirname -- "$file")"
+    if [[ -f "/etc/systemd/system/$file" ]]; then
+      cp -p -- "/etc/systemd/system/$file" "$state/boot/$file"
+    else rm -f -- "$state/boot/$file"; fi
+  done
+  rm -f -- "$state/boot/changed" "$state/boot/enabled" "$state/boot/active"
+  if systemctl is-enabled --quiet platform-firewall.service; then touch "$state/boot/enabled"; fi
+  if systemctl is-active --quiet platform-firewall.service; then touch "$state/boot/active"; fi
+}
+install_boot_gate() {
+  local directory
+  for directory in /etc/platform-firewall /etc/systemd/system/docker.service.d /etc/systemd/system/tailscaled.service.d; do
+    trusted_path "$directory"; install -d -m 0755 "$directory"
+  done
+  trusted_path /etc/systemd/system/platform-firewall.service
+  cat > /etc/systemd/system/platform-firewall.service <<'UNIT'
+[Unit]
+Description=Platform host service firewall
+After=nftables.service
+Before=docker.service tailscaled.service
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/sbin/nft -f /etc/platform-firewall/active.nft
+ExecReload=/usr/sbin/nft -f /etc/platform-firewall/active.nft
+[Install]
+WantedBy=multi-user.target
+UNIT
+  for directory in docker tailscaled; do
+    trusted_path "/etc/systemd/system/$directory.service.d/20-platform-firewall.conf"
+    cat > "/etc/systemd/system/$directory.service.d/20-platform-firewall.conf" <<'UNIT'
+[Unit]
+Requires=platform-firewall.service
+After=platform-firewall.service
+UNIT
+  done
+  systemctl daemon-reload
+  systemctl enable platform-firewall.service >/dev/null
+  systemctl restart platform-firewall.service
+}
+main() {
+  local action='' policy='' expected='' state=/run/platform-firewall task digest previous connection
+  while (($#)); do
+    case "$1" in
+      --help|-h) echo 'Usage: bash firewall.sh --render|--check|--apply --policy ROOT_0600_JSON | --confirm --sha256 SHA'; return 0;;
+      --render|--check|--apply|--confirm) [[ -z "$action" ]] || return 1; action=$1; shift;;
+      --policy|--sha256) (($# >= 2)) || return 1; case "$1" in --policy) policy=$2;; --sha256) expected=$2;; esac; shift 2;;
+      *) fail "Unknown argument: $1"; return 1;;
+    esac
+  done
+  if [[ "$action" == --render ]]; then render_policy "$policy"; return; fi
+  umask 077
+  [[ $EUID == 0 && -d /run/systemd/system ]] || { fail 'Native root systemd host required'; return 1; }
+  for task in nft jq sha256sum flock systemctl systemd-run; do command -v "$task" >/dev/null || { fail "Missing command: $task"; return 1; }; done
+  trusted_path "$state"; install -d -m 0700 "$state"
+  trusted_path "$state/lock"
+  exec 9>>"$state/lock"; flock -n 9 || { fail 'Firewall operation in progress'; return 1; }
+  if [[ "$action" == --confirm ]]; then
+    [[ "$expected" =~ ^[a-f0-9]{64}$ && -f "$state/pending.nft" ]] || { fail 'Exact pending policy digest required'; return 1; }
+    digest=$(sha256sum "$state/pending.nft"); digest=${digest%% *}
+    [[ "$expected" == "$digest" ]] || { fail 'Pending policy differs'; return 1; }
+    connection=${SSH_CONNECTION:-}
+    [[ -n "$connection" && "$connection" != "$(cat "$state/original-ssh")" ]] || { fail 'Confirm from a new SSH transport after checking allowed and denied ports'; return 1; }
+    nft -s list table inet platform_host > "$state/current.nft"
+    cmp -s "$state/current.nft" "$state/applied.nft" || { fail 'Active policy changed after apply'; return 1; }
+    trusted_path /etc/platform-firewall/active.nft
+    trusted_path /etc/platform-firewall/active.nft.pending
+    install -d -m 0755 /etc/platform-firewall
+    install -m 0600 "$state/pending.nft" /etc/platform-firewall/active.nft.pending
+    mv -fT /etc/platform-firewall/active.nft.pending /etc/platform-firewall/active.nft
+    touch "$state/boot/changed"
+    install_boot_gate
+    rm -f -- "$state/pending.nft"
+    systemctl stop platform-firewall-rollback.timer
+    echo 'Firewall confirmed and persisted; Docker/Tailscale startup now requires it.'
+    return
+  fi
+  [[ "$action" == --check || "$action" == --apply ]] || { fail 'Choose render, check, apply or confirm'; return 1; }
+  trusted_path "$policy"
+  [[ -f "$policy" && $(stat -c %a "$policy") == 600 ]] || { fail 'Use a root-owned 0600 JSON policy file'; return 1; }
+  validate_policy "$policy"
+  [[ $(jq -r .hostname "$policy") == "$(hostname)" ]] || { fail 'Policy belongs to another host'; return 1; }
+  task=$(mktemp -d "$state/check-XXXXXXXX")
+  local cleanup
+  printf -v cleanup 'rm -rf -- %q' "$task"; trap "$cleanup" EXIT
+  render_policy "$policy" > "$task/rules.nft"
+  nft --check --file "$task/rules.nft"
+  digest=$(sha256sum "$task/rules.nft"); digest=${digest%% *}
+  if [[ "$action" == --check ]]; then echo "Firewall policy checked: $digest"; return; fi
+  [[ ! -f "$state/pending.nft" ]] || { fail 'A policy is pending confirmation; inspect it or wait for rollback'; return 1; }
+  # Rollback only our table, preserving concurrent native Tailscale/Docker rules.
+  printf 'add table inet platform_host\ndelete table inet platform_host\n' > "$task/rollback.nft"
+  if nft list table inet platform_host >/dev/null 2>&1; then nft -s list table inet platform_host >> "$task/rollback.nft"; fi
+  install -m 0600 "$task/rollback.nft" "$state/rollback.nft"
+  # Save the durable version too, in case confirmation fails midway.
+  trusted_path /etc/platform-firewall/active.nft
+  if [[ -f /etc/platform-firewall/active.nft ]]; then
+    install -m 0600 /etc/platform-firewall/active.nft "$state/previous.nft"
+  else rm -f -- "$state/previous.nft"; fi
+  save_boot_gate "$state"
+  cat > "$state/rollback.sh" <<'ROLLBACK'
+#!/usr/bin/env bash
+set -euo pipefail
+exec 9>>/run/platform-firewall/lock
+flock 9
+test -f /run/platform-firewall/pending.nft || exit 0
+if test -f /run/platform-firewall/previous.nft; then
+  install -m 0600 /run/platform-firewall/previous.nft /etc/platform-firewall/active.nft
+else
+  rm -f /etc/platform-firewall/active.nft
+fi
+if test -f /run/platform-firewall/boot/changed; then
+  if ! test -f /run/platform-firewall/boot/active; then systemctl stop platform-firewall.service; fi
+  if ! test -f /run/platform-firewall/boot/enabled; then systemctl disable platform-firewall.service; fi
+  for file in platform-firewall.service docker.service.d/20-platform-firewall.conf tailscaled.service.d/20-platform-firewall.conf; do
+    if test -f "/run/platform-firewall/boot/$file"; then
+      cp -p -- "/run/platform-firewall/boot/$file" "/etc/systemd/system/$file"
+    else rm -f -- "/etc/systemd/system/$file"; fi
+  done
+  systemctl daemon-reload
+  if test -f /run/platform-firewall/boot/enabled; then systemctl enable platform-firewall.service; fi
+  if test -f /run/platform-firewall/boot/active; then systemctl start platform-firewall.service; fi
+fi
+/usr/sbin/nft -f /run/platform-firewall/rollback.nft
+rm -f /run/platform-firewall/pending.nft
+ROLLBACK
+  chmod 0700 "$state/rollback.sh"
+  install -m 0600 "$task/rules.nft" "$state/pending.nft"
+  printf '%s\n' "${SSH_CONNECTION:-}" > "$state/original-ssh"
+  systemctl stop platform-firewall-rollback.timer platform-firewall-rollback.service 2>/dev/null || true
+  systemctl reset-failed platform-firewall-rollback.service 2>/dev/null || true
+  if ! systemd-run --quiet --collect --unit=platform-firewall-rollback --on-active=180s /bin/bash "$state/rollback.sh"; then
+    rm -f -- "$state/pending.nft"; fail 'Rollback timer could not be armed; no rules changed'; return 1
+  fi
+  nft --file "$state/pending.nft"
+  nft -s list table inet platform_host > "$state/applied.nft"
+  printf 'Policy applied temporarily. Confirm from a NEW SSH connection within 180 seconds: --confirm --sha256 %s\n' "$digest"
+}
+if [[ ${BASH_SOURCE[0]:-} == "$0" || -z ${BASH_SOURCE[0]:-} ]]; then main "$@"; fi