655 lines
24 KiB
Go
655 lines
24 KiB
Go
|
package main
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"crypto/ecdh"
|
||
|
|
"crypto/sha256"
|
||
|
|
"encoding/base64"
|
||
|
|
"encoding/json"
|
||
|
|
"errors"
|
||
|
|
"fmt"
|
||
|
|
"os"
|
||
|
|
"os/exec"
|
||
|
|
"os/user"
|
||
|
|
"path/filepath"
|
||
|
|
"strconv"
|
||
|
|
"strings"
|
||
|
|
"time"
|
||
|
|
)
|
||
|
|
|
||
|
|
const (
|
||
|
|
webAllowStateDirectory = "/var/lib/oci-l4-relay/web-allow"
|
||
|
|
smtpDenyStateDirectory = "/var/lib/oci-l4-relay/smtp-deny"
|
||
|
|
interfaceName = "wg-oci0"
|
||
|
|
logIngestTokenPath = "/etc/oci-l4-relay/log-ingest.token"
|
||
|
|
telemetrySnapshotPath = "/run/oci-l4-relay-telemetry/current.json"
|
||
|
|
privateKeyPath = "/etc/oci-l4-relay/private.key"
|
||
|
|
logIngestGroup = "oci-l4-relay-logs"
|
||
|
|
)
|
||
|
|
|
||
|
|
func bootstrap(ctx context.Context, configuration config) error {
|
||
|
|
publicInterface, err := defaultInterface()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
fmt.Println("bootstrap_stage=fail_closed_firewall")
|
||
|
|
if err := configureHost(ctx, configuration, publicInterface); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := restoreAdmission(ctx, configuration); err != nil {
|
||
|
|
fmt.Printf("bootstrap_stage=cached_admission cache_restored=false\n")
|
||
|
|
} else {
|
||
|
|
fmt.Printf("bootstrap_stage=cached_admission cache_restored=true\n")
|
||
|
|
}
|
||
|
|
if configuration.MailRelayAddress != "" {
|
||
|
|
if err := restoreSMTPDeny(ctx, configuration); err != nil {
|
||
|
|
fmt.Printf("bootstrap_stage=cached_smtp_deny cache_restored=false\n")
|
||
|
|
} else {
|
||
|
|
fmt.Printf("bootstrap_stage=cached_smtp_deny cache_restored=true\n")
|
||
|
|
}
|
||
|
|
} else if configuration.mailConfigurationError != "" {
|
||
|
|
fmt.Printf("bootstrap_stage=mail_configuration active=false reason=%q\n", configuration.mailConfigurationError)
|
||
|
|
}
|
||
|
|
if fileExists(privateKeyPath) {
|
||
|
|
if err := configureTunnel(ctx, configuration); err != nil {
|
||
|
|
fmt.Printf("bootstrap_stage=cached_tunnel cache_restored=false\n")
|
||
|
|
} else {
|
||
|
|
fmt.Printf("bootstrap_stage=cached_tunnel cache_restored=true\n")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
fmt.Println("bootstrap_stage=instance_identity")
|
||
|
|
clients, err := newOCIClients()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := configureIdentityAndTunnel(ctx, clients, configuration); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
fmt.Println("bootstrap_stage=wireguard_handshake")
|
||
|
|
if err := waitForHandshake(ctx, 60*time.Second); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
fmt.Println("bootstrap_stage=fresh_admission")
|
||
|
|
if err := updateAdmissionWithClients(ctx, clients, configuration); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if configuration.MailRelayAddress != "" {
|
||
|
|
if err := updateSMTPDenyWithClients(ctx, clients, configuration); err != nil {
|
||
|
|
fmt.Println("bootstrap_stage=smtp_deny current_available=false")
|
||
|
|
} else {
|
||
|
|
fmt.Println("bootstrap_stage=smtp_deny current_available=true")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if err := updateLogCredentialWithClients(ctx, clients, configuration); err != nil {
|
||
|
|
fmt.Println("bootstrap_stage=log_ingest credential_available=false")
|
||
|
|
} else {
|
||
|
|
fmt.Println("bootstrap_stage=log_ingest credential_available=true")
|
||
|
|
}
|
||
|
|
fmt.Println("bootstrap_stage=complete")
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func reconcile(ctx context.Context, configuration config) error {
|
||
|
|
clients, err := newOCIClients()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := configureIdentityAndTunnel(ctx, clients, configuration); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := waitForHandshake(ctx, 180*time.Second); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := updateAdmissionWithClients(ctx, clients, configuration); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if configuration.MailRelayAddress != "" {
|
||
|
|
if err := updateSMTPDenyWithClients(ctx, clients, configuration); err != nil {
|
||
|
|
fmt.Println("reconcile_stage=smtp_deny current_available=false")
|
||
|
|
} else {
|
||
|
|
fmt.Println("reconcile_stage=smtp_deny current_available=true")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if err := updateLogCredentialWithClients(ctx, clients, configuration); err != nil {
|
||
|
|
fmt.Println("reconcile_stage=log_ingest credential_available=false")
|
||
|
|
} else {
|
||
|
|
fmt.Println("reconcile_stage=log_ingest credential_available=true")
|
||
|
|
}
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func configureHost(ctx context.Context, configuration config, publicInterface string) error {
|
||
|
|
if err := os.MkdirAll("/etc/oci-l4-relay", 0700); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
groupID, err := logIngestGroupID()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := os.Chown("/etc/oci-l4-relay", 0, groupID); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := os.Chmod("/etc/oci-l4-relay", 0710); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := os.MkdirAll(webAllowStateDirectory, 0700); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if configuration.MailRelayAddress != "" {
|
||
|
|
if err := os.MkdirAll(smtpDenyStateDirectory, 0700); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if err := writeAtomic("/etc/sysctl.d/90-oci-l4-relay.conf", []byte("net.ipv4.ip_forward = 1\nnet.ipv4.tcp_syncookies = 1\nnet.netfilter.nf_conntrack_acct = 1\nnet.netfilter.nf_conntrack_max = 262144\nnet.netfilter.nf_conntrack_timestamp = 1\n"), 0644); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
ruleset := renderRuleset(configuration, publicInterface)
|
||
|
|
if err := writeAtomic("/etc/sysconfig/nftables.conf", []byte(ruleset), 0600); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
settings := []string{
|
||
|
|
"net.ipv4.ip_forward=1",
|
||
|
|
"net.ipv4.tcp_syncookies=1",
|
||
|
|
"net.netfilter.nf_conntrack_acct=1",
|
||
|
|
"net.netfilter.nf_conntrack_max=262144",
|
||
|
|
"net.netfilter.nf_conntrack_timestamp=1",
|
||
|
|
}
|
||
|
|
for _, setting := range settings {
|
||
|
|
if err := run(ctx, "/usr/sbin/sysctl", "--write", setting); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if err := run(ctx, "/usr/sbin/nft", "--check", "--file", "/etc/sysconfig/nftables.conf"); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
return run(ctx, "/usr/sbin/nft", "--file", "/etc/sysconfig/nftables.conf")
|
||
|
|
}
|
||
|
|
|
||
|
|
func configureIdentityAndTunnel(ctx context.Context, clients ociClients, configuration config) error {
|
||
|
|
seed, err := clients.getSecret(ctx, configuration.WireGuardSeedSecretOCID)
|
||
|
|
if err != nil {
|
||
|
|
return fmt.Errorf("retrieve WireGuard seed: %w", err)
|
||
|
|
}
|
||
|
|
privateKey, publicKey, err := deriveWireGuardKey(seed)
|
||
|
|
for index := range seed {
|
||
|
|
seed[index] = 0
|
||
|
|
}
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
defer func() {
|
||
|
|
for index := range privateKey {
|
||
|
|
privateKey[index] = 0
|
||
|
|
}
|
||
|
|
}()
|
||
|
|
encodedPrivateKey := []byte(base64.StdEncoding.EncodeToString(privateKey) + "\n")
|
||
|
|
if err := writeAtomic(privateKeyPath, encodedPrivateKey, 0600); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
for index := range encodedPrivateKey {
|
||
|
|
encodedPrivateKey[index] = 0
|
||
|
|
}
|
||
|
|
encodedPublicKey := base64.StdEncoding.EncodeToString(publicKey)
|
||
|
|
if err := clients.publishSecret(ctx, configuration.PublicKeySecretOCID, []byte(encodedPublicKey)); err != nil {
|
||
|
|
return fmt.Errorf("publish WireGuard public key: %w", err)
|
||
|
|
}
|
||
|
|
return configureTunnel(ctx, configuration)
|
||
|
|
}
|
||
|
|
|
||
|
|
func configureTunnel(ctx context.Context, configuration config) error {
|
||
|
|
if err := ensureWireGuardInterface(ctx); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := run(ctx, "/usr/bin/wg", "set", interfaceName, "listen-port", strconv.Itoa(configuration.WireGuardListenPort), "private-key", privateKeyPath, "peer", configuration.HomeWireGuardPublicKey, "allowed-ips", "0.0.0.0/0"); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
commands := [][]string{
|
||
|
|
{"/usr/sbin/ip", "address", "replace", configuration.RelayTunnelAddress, "dev", interfaceName},
|
||
|
|
{"/usr/sbin/ip", "link", "set", "dev", interfaceName, "mtu", strconv.Itoa(configuration.RelayTunnelMTU), "up"},
|
||
|
|
{"/usr/sbin/ip", "route", "replace", configuration.GatewayRelayAddress + "/32", "dev", interfaceName},
|
||
|
|
}
|
||
|
|
if configuration.MailRelayAddress != "" {
|
||
|
|
commands = append(commands, []string{"/usr/sbin/ip", "route", "replace", configuration.MailRelayAddress + "/32", "dev", interfaceName})
|
||
|
|
}
|
||
|
|
for _, command := range commands {
|
||
|
|
if err := run(ctx, command[0], command[1:]...); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
}
|
||
|
|
clearTrafficControl(ctx)
|
||
|
|
for _, command := range trafficControlCommands(configuration) {
|
||
|
|
if err := run(ctx, command[0], command[1:]...); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func clearTrafficControl(ctx context.Context) {
|
||
|
|
// Oracle Linux cannot replace an existing HTB root qdisc; deletion also clears partial bootstrap state.
|
||
|
|
_ = exec.CommandContext(ctx, "/usr/sbin/tc", "qdisc", "delete", "dev", interfaceName, "root").Run()
|
||
|
|
}
|
||
|
|
|
||
|
|
func trafficControlCommands(configuration config) [][]string {
|
||
|
|
rate := strconv.Itoa(configuration.RateLimitMbit) + "mbit"
|
||
|
|
webRate := strconv.Itoa(max(1, configuration.RateLimitMbit*40/100)) + "mbit"
|
||
|
|
smtpRate := strconv.Itoa(max(1, configuration.RateLimitMbit*10/100)) + "mbit"
|
||
|
|
authRate := strconv.Itoa(max(1, configuration.RateLimitMbit*20/100)) + "mbit"
|
||
|
|
defaultRate := strconv.Itoa(max(1, configuration.RateLimitMbit*10/100)) + "mbit"
|
||
|
|
commands := [][]string{
|
||
|
|
{"/usr/sbin/tc", "qdisc", "add", "dev", interfaceName, "root", "handle", "1:", "htb", "default", "40"},
|
||
|
|
{"/usr/sbin/tc", "class", "replace", "dev", interfaceName, "parent", "1:", "classid", "1:1", "htb", "rate", rate, "ceil", rate},
|
||
|
|
{"/usr/sbin/tc", "class", "replace", "dev", interfaceName, "parent", "1:1", "classid", "1:10", "htb", "rate", webRate, "ceil", rate},
|
||
|
|
{"/usr/sbin/tc", "class", "replace", "dev", interfaceName, "parent", "1:1", "classid", "1:20", "htb", "rate", smtpRate, "ceil", rate},
|
||
|
|
{"/usr/sbin/tc", "class", "replace", "dev", interfaceName, "parent", "1:1", "classid", "1:30", "htb", "rate", authRate, "ceil", rate},
|
||
|
|
{"/usr/sbin/tc", "class", "replace", "dev", interfaceName, "parent", "1:1", "classid", "1:40", "htb", "rate", defaultRate, "ceil", rate},
|
||
|
|
{"/usr/sbin/tc", "qdisc", "replace", "dev", interfaceName, "parent", "1:10", "handle", "10:", "fq_codel"},
|
||
|
|
{"/usr/sbin/tc", "qdisc", "replace", "dev", interfaceName, "parent", "1:20", "handle", "20:", "fq_codel"},
|
||
|
|
{"/usr/sbin/tc", "qdisc", "replace", "dev", interfaceName, "parent", "1:30", "handle", "30:", "fq_codel"},
|
||
|
|
{"/usr/sbin/tc", "qdisc", "replace", "dev", interfaceName, "parent", "1:40", "handle", "40:", "fq_codel"},
|
||
|
|
}
|
||
|
|
priority := 10
|
||
|
|
addFilter := func(address string, port int, classID string) {
|
||
|
|
commands = append(commands, []string{
|
||
|
|
"/usr/sbin/tc", "filter", "replace", "dev", interfaceName,
|
||
|
|
"protocol", "ip", "parent", "1:", "prio", strconv.Itoa(priority),
|
||
|
|
"flower", "dst_ip", address, "ip_proto", "tcp",
|
||
|
|
"dst_port", strconv.Itoa(port), "classid", classID,
|
||
|
|
})
|
||
|
|
priority++
|
||
|
|
}
|
||
|
|
addFilter(configuration.GatewayRelayAddress, 80, "1:10")
|
||
|
|
addFilter(configuration.GatewayRelayAddress, 443, "1:10")
|
||
|
|
if configuration.MailRelayAddress != "" {
|
||
|
|
addFilter(configuration.MailRelayAddress, 25, "1:20")
|
||
|
|
for _, port := range []int{465, 993} {
|
||
|
|
addFilter(configuration.MailRelayAddress, port, "1:30")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return commands
|
||
|
|
}
|
||
|
|
|
||
|
|
func ensureWireGuardInterface(ctx context.Context) error {
|
||
|
|
if exec.CommandContext(ctx, "/usr/sbin/ip", "link", "show", "dev", interfaceName).Run() == nil {
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
return run(ctx, "/usr/sbin/ip", "link", "add", "dev", interfaceName, "type", "wireguard")
|
||
|
|
}
|
||
|
|
|
||
|
|
func deriveWireGuardKey(seed []byte) ([]byte, []byte, error) {
|
||
|
|
digest := sha256.Sum256(seed)
|
||
|
|
privateKey := append([]byte(nil), digest[:]...)
|
||
|
|
privateKey[0] &= 248
|
||
|
|
privateKey[31] &= 127
|
||
|
|
privateKey[31] |= 64
|
||
|
|
key, err := ecdh.X25519().NewPrivateKey(privateKey)
|
||
|
|
if err != nil {
|
||
|
|
return nil, nil, err
|
||
|
|
}
|
||
|
|
return privateKey, key.PublicKey().Bytes(), nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func updateAdmission(ctx context.Context, configuration config) error {
|
||
|
|
clients, err := newOCIClients()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
return updateAdmissionWithClients(ctx, clients, configuration)
|
||
|
|
}
|
||
|
|
|
||
|
|
func updateSMTPDeny(ctx context.Context, configuration config) error {
|
||
|
|
clients, err := newOCIClients()
|
||
|
|
if err != nil {
|
||
|
|
return completeSMTPDenyRefresh(err)
|
||
|
|
}
|
||
|
|
return updateSMTPDenyWithClients(ctx, clients, configuration)
|
||
|
|
}
|
||
|
|
|
||
|
|
func updateLogCredential(ctx context.Context, configuration config) error {
|
||
|
|
clients, err := newOCIClients()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
return updateLogCredentialWithClients(ctx, clients, configuration)
|
||
|
|
}
|
||
|
|
|
||
|
|
func updateLogCredentialWithClients(ctx context.Context, clients ociClients, configuration config) error {
|
||
|
|
token, err := clients.getSecret(ctx, configuration.LogIngestSecretOCID)
|
||
|
|
if err != nil {
|
||
|
|
return fmt.Errorf("retrieve log ingestion credential: %w", err)
|
||
|
|
}
|
||
|
|
defer func() {
|
||
|
|
for index := range token {
|
||
|
|
token[index] = 0
|
||
|
|
}
|
||
|
|
}()
|
||
|
|
if !validLogIngestToken(token) {
|
||
|
|
return errors.New("log ingestion credential is invalid")
|
||
|
|
}
|
||
|
|
groupID, err := logIngestGroupID()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
return writeAtomicOwned(logIngestTokenPath, token, 0640, 0, groupID)
|
||
|
|
}
|
||
|
|
|
||
|
|
func logIngestGroupID() (int, error) {
|
||
|
|
group, err := user.LookupGroup(logIngestGroup)
|
||
|
|
if err != nil {
|
||
|
|
return 0, fmt.Errorf("look up log ingestion group: %w", err)
|
||
|
|
}
|
||
|
|
groupID, err := strconv.Atoi(group.Gid)
|
||
|
|
if err != nil {
|
||
|
|
return 0, fmt.Errorf("parse log ingestion group ID: %w", err)
|
||
|
|
}
|
||
|
|
return groupID, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func validLogIngestToken(token []byte) bool {
|
||
|
|
if len(token) < 32 || len(token) > 256 {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
for _, value := range token {
|
||
|
|
if !validLogIngestTokenByte(value) {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
|
||
|
|
func validLogIngestTokenByte(value byte) bool {
|
||
|
|
switch {
|
||
|
|
case value >= 'a' && value <= 'z', value >= 'A' && value <= 'Z', value >= '0' && value <= '9':
|
||
|
|
return true
|
||
|
|
default:
|
||
|
|
return value == '-' || value == '_' || value == '.'
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func updateAdmissionWithClients(ctx context.Context, clients ociClients, configuration config) error {
|
||
|
|
path, cleanup, err := clients.downloadAdmission(ctx, configuration)
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
defer cleanup()
|
||
|
|
publicInterface, err := defaultInterface()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
return runAdmission(ctx, configuration, "apply", "--input", path, "--public-interface", publicInterface)
|
||
|
|
}
|
||
|
|
|
||
|
|
func restoreAdmission(ctx context.Context, configuration config) error {
|
||
|
|
publicInterface, err := defaultInterface()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
return runAdmission(ctx, configuration, "restore", "--public-interface", publicInterface)
|
||
|
|
}
|
||
|
|
|
||
|
|
func runAdmission(ctx context.Context, configuration config, arguments ...string) error {
|
||
|
|
arguments = append(arguments,
|
||
|
|
"--state-directory", webAllowStateDirectory,
|
||
|
|
"--minimum-admitted-addresses", strconv.FormatUint(configuration.Admission.MinimumAddresses, 10),
|
||
|
|
"--maximum-admitted-addresses", strconv.FormatUint(configuration.Admission.MaximumAddresses, 10),
|
||
|
|
"--minimum-admitted-intervals", strconv.Itoa(configuration.Admission.MinimumIntervals),
|
||
|
|
)
|
||
|
|
for _, address := range configuration.MonitoringSourceIPv4 {
|
||
|
|
arguments = append(arguments, "--static-exception-ipv4", address)
|
||
|
|
}
|
||
|
|
return run(ctx, configuration.AdmissionHelper, arguments...)
|
||
|
|
}
|
||
|
|
|
||
|
|
func updateSMTPDenyWithClients(ctx context.Context, clients ociClients, configuration config) (operationErr error) {
|
||
|
|
defer func() {
|
||
|
|
operationErr = completeSMTPDenyRefresh(operationErr)
|
||
|
|
}()
|
||
|
|
path, cleanup, err := clients.downloadSMTPDeny(ctx, configuration)
|
||
|
|
if err != nil {
|
||
|
|
return errors.Join(err, restoreSMTPDeny(ctx, configuration))
|
||
|
|
}
|
||
|
|
defer cleanup()
|
||
|
|
publicInterface, err := defaultInterface()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
return runSMTPDeny(ctx, configuration, "apply", "--input", path, "--public-interface", publicInterface)
|
||
|
|
}
|
||
|
|
|
||
|
|
func restoreSMTPDeny(ctx context.Context, configuration config) error {
|
||
|
|
publicInterface, err := defaultInterface()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
return runSMTPDeny(ctx, configuration, "restore", "--public-interface", publicInterface)
|
||
|
|
}
|
||
|
|
|
||
|
|
func runSMTPDeny(ctx context.Context, configuration config, arguments ...string) error {
|
||
|
|
if configuration.SMTPDeny == nil || configuration.SMTPDenyHelper == "" {
|
||
|
|
return errors.New("SMTP deny configuration is inactive")
|
||
|
|
}
|
||
|
|
arguments = append(arguments,
|
||
|
|
"--state-directory", smtpDenyStateDirectory,
|
||
|
|
"--minimum-observations", strconv.FormatUint(configuration.SMTPDeny.MinimumObservations, 10),
|
||
|
|
"--maximum-addresses", strconv.FormatUint(configuration.SMTPDeny.MaximumAddresses, 10),
|
||
|
|
"--maximum-intervals", strconv.Itoa(configuration.SMTPDeny.MaximumIntervals),
|
||
|
|
"--maximum-lifetime", strconv.Itoa(configuration.SMTPDeny.MaximumLifetimeSeconds)+"s",
|
||
|
|
"--maximum-observation-window", strconv.Itoa(configuration.SMTPDeny.MaximumObservationWindow)+"s",
|
||
|
|
)
|
||
|
|
return run(ctx, configuration.SMTPDenyHelper, arguments...)
|
||
|
|
}
|
||
|
|
|
||
|
|
func waitForHandshake(ctx context.Context, maximumAge time.Duration) error {
|
||
|
|
ticker := time.NewTicker(5 * time.Second)
|
||
|
|
defer ticker.Stop()
|
||
|
|
for {
|
||
|
|
latest, err := latestHandshake(ctx)
|
||
|
|
if err == nil && latest > 0 && time.Since(time.Unix(latest, 0)) <= maximumAge {
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
select {
|
||
|
|
case <-ctx.Done():
|
||
|
|
return fmt.Errorf("wait for WireGuard handshake: %w", ctx.Err())
|
||
|
|
case <-ticker.C:
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func latestHandshake(ctx context.Context) (int64, error) {
|
||
|
|
output, err := exec.CommandContext(ctx, "/usr/bin/wg", "show", interfaceName, "latest-handshakes").Output()
|
||
|
|
if err != nil {
|
||
|
|
return 0, err
|
||
|
|
}
|
||
|
|
fields := strings.Fields(string(output))
|
||
|
|
if len(fields) < 2 {
|
||
|
|
return 0, errors.New("WireGuard peer handshake is absent")
|
||
|
|
}
|
||
|
|
return strconv.ParseInt(fields[1], 10, 64)
|
||
|
|
}
|
||
|
|
|
||
|
|
func defaultInterface() (string, error) {
|
||
|
|
contents, err := os.ReadFile("/proc/net/route")
|
||
|
|
if err != nil {
|
||
|
|
return "", err
|
||
|
|
}
|
||
|
|
for _, line := range strings.Split(string(contents), "\n") {
|
||
|
|
fields := strings.Fields(line)
|
||
|
|
if len(fields) >= 4 && fields[1] == "00000000" {
|
||
|
|
flags, err := strconv.ParseUint(fields[3], 16, 16)
|
||
|
|
if err == nil && flags&1 != 0 {
|
||
|
|
return fields[0], nil
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return "", errors.New("default IPv4 interface not found")
|
||
|
|
}
|
||
|
|
|
||
|
|
func writeAtomic(path string, contents []byte, mode os.FileMode) error {
|
||
|
|
return writeAtomicOwned(path, contents, mode, -1, -1)
|
||
|
|
}
|
||
|
|
|
||
|
|
func writeAtomicOwned(path string, contents []byte, mode os.FileMode, ownerID, groupID int) error {
|
||
|
|
if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
file, err := os.CreateTemp(filepath.Dir(path), ".write-")
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
temporaryPath := file.Name()
|
||
|
|
defer func() { _ = os.Remove(temporaryPath) }()
|
||
|
|
if err := file.Chmod(mode); err != nil {
|
||
|
|
_ = file.Close()
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if ownerID >= 0 || groupID >= 0 {
|
||
|
|
if err := file.Chown(ownerID, groupID); err != nil {
|
||
|
|
_ = file.Close()
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if _, err := file.Write(contents); err != nil {
|
||
|
|
_ = file.Close()
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := file.Sync(); err != nil {
|
||
|
|
_ = file.Close()
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := file.Close(); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
return os.Rename(temporaryPath, path)
|
||
|
|
}
|
||
|
|
|
||
|
|
func run(ctx context.Context, path string, arguments ...string) error {
|
||
|
|
command := exec.CommandContext(ctx, path, arguments...)
|
||
|
|
output, err := command.CombinedOutput()
|
||
|
|
if err != nil {
|
||
|
|
return fmt.Errorf("%s: %w: %s", filepath.Base(path), err, strings.TrimSpace(string(output)))
|
||
|
|
}
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
type status struct {
|
||
|
|
ConntrackCount int64 `json:"conntrack_count"`
|
||
|
|
ConntrackMaximum int64 `json:"conntrack_maximum"`
|
||
|
|
HandshakeAgeSecond int64 `json:"handshake_age_seconds"`
|
||
|
|
NftablesActive bool `json:"nftables_active"`
|
||
|
|
SMTPDenyActive bool `json:"smtp_deny_active"`
|
||
|
|
SMTPDenyActiveSource string `json:"smtp_deny_active_source,omitempty"`
|
||
|
|
SMTPDenyBundleAgeSeconds int64 `json:"smtp_deny_bundle_age_seconds"`
|
||
|
|
SMTPDenyBundleRemainingSeconds int64 `json:"smtp_deny_bundle_remaining_seconds"`
|
||
|
|
SMTPDenyCached bool `json:"smtp_deny_cached"`
|
||
|
|
SMTPDenyPolicyValid bool `json:"smtp_deny_policy_valid"`
|
||
|
|
SMTPDenyRefreshCompletedAgeSeconds int64 `json:"smtp_deny_refresh_completed_age_seconds"`
|
||
|
|
SMTPDenyRefreshSuccessful bool `json:"smtp_deny_refresh_successful"`
|
||
|
|
SMTPDenyRemoteCurrentAgeSeconds int64 `json:"smtp_deny_remote_current_age_seconds"`
|
||
|
|
WebAllowActive bool `json:"web_allow_active"`
|
||
|
|
WebAllowCached bool `json:"web_allow_cached"`
|
||
|
|
WireGuardActive bool `json:"wireguard_active"`
|
||
|
|
}
|
||
|
|
|
||
|
|
type telemetryFile struct {
|
||
|
|
GeneratedAt time.Time `json:"generated_at"`
|
||
|
|
Status status `json:"status"`
|
||
|
|
}
|
||
|
|
|
||
|
|
func currentStatus(configuration config) status {
|
||
|
|
result := status{
|
||
|
|
SMTPDenyBundleAgeSeconds: -1,
|
||
|
|
SMTPDenyBundleRemainingSeconds: -1,
|
||
|
|
SMTPDenyRefreshCompletedAgeSeconds: -1,
|
||
|
|
SMTPDenyRemoteCurrentAgeSeconds: -1,
|
||
|
|
}
|
||
|
|
result.NftablesActive = exec.Command("/usr/sbin/nft", "list", "table", "inet", "oci_l4_relay").Run() == nil
|
||
|
|
result.WebAllowActive = exec.Command("/usr/sbin/nft", "list", "table", "inet", "oci_l4_relay_web_allow").Run() == nil
|
||
|
|
result.SMTPDenyActive = exec.Command("/usr/sbin/nft", "list", "table", "inet", "oci_l4_relay_smtp_deny").Run() == nil
|
||
|
|
result.WireGuardActive = exec.Command("/usr/sbin/ip", "link", "show", "dev", interfaceName).Run() == nil
|
||
|
|
result.WebAllowCached = fileExists(filepath.Join(webAllowStateDirectory, "last-good.json.gz"))
|
||
|
|
if configuration.MailRelayAddress != "" {
|
||
|
|
now := time.Now().UTC()
|
||
|
|
if active, err := readSMTPDenyActiveState(smtpDenyStateDirectory); err == nil {
|
||
|
|
result.SMTPDenyActiveSource = active.Source
|
||
|
|
result.SMTPDenyPolicyValid = active.validAt(now, time.Duration(configuration.SMTPDeny.MaximumLifetimeSeconds)*time.Second)
|
||
|
|
result.SMTPDenyCached = result.SMTPDenyPolicyValid && fileExists(filepath.Join(smtpDenyStateDirectory, "last-good.json.gz"))
|
||
|
|
if !active.BundleGeneratedAt.IsZero() {
|
||
|
|
result.SMTPDenyBundleAgeSeconds = max(0, int64(now.Sub(active.BundleGeneratedAt).Seconds()))
|
||
|
|
}
|
||
|
|
if !active.BundleExpiresAt.IsZero() {
|
||
|
|
result.SMTPDenyBundleRemainingSeconds = int64(active.BundleExpiresAt.Sub(now).Seconds())
|
||
|
|
}
|
||
|
|
if !active.LastRemoteCurrentAt.IsZero() {
|
||
|
|
result.SMTPDenyRemoteCurrentAgeSeconds = max(0, int64(now.Sub(active.LastRemoteCurrentAt).Seconds()))
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if refresh, err := readSMTPDenyRefreshState(smtpDenyStateDirectory); err == nil && !refresh.CompletedAt.IsZero() && !refresh.CompletedAt.After(now.Add(5*time.Minute)) {
|
||
|
|
result.SMTPDenyRefreshCompletedAgeSeconds = max(0, int64(now.Sub(refresh.CompletedAt).Seconds()))
|
||
|
|
result.SMTPDenyRefreshSuccessful = refresh.Successful && refresh.ActiveSource == "current"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
result.ConntrackCount = readInteger("/proc/sys/net/netfilter/nf_conntrack_count")
|
||
|
|
result.ConntrackMaximum = readInteger("/proc/sys/net/netfilter/nf_conntrack_max")
|
||
|
|
if latest, err := latestHandshake(context.Background()); err == nil && latest > 0 {
|
||
|
|
result.HandshakeAgeSecond = max(0, time.Now().Unix()-latest)
|
||
|
|
} else {
|
||
|
|
result.HandshakeAgeSecond = -1
|
||
|
|
}
|
||
|
|
return result
|
||
|
|
}
|
||
|
|
|
||
|
|
func reportStatus(configuration config, requireHealthy bool) error {
|
||
|
|
result := currentStatus(configuration)
|
||
|
|
encoded, err := json.Marshal(result)
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
fmt.Println(string(encoded))
|
||
|
|
mailPolicyUnhealthy := configuration.MailRelayAddress != "" && (!result.SMTPDenyActive || !result.SMTPDenyPolicyValid)
|
||
|
|
if requireHealthy && (!result.NftablesActive || !result.WebAllowActive || !result.WebAllowCached || !result.WireGuardActive || mailPolicyUnhealthy || result.HandshakeAgeSecond < 0 || result.HandshakeAgeSecond > 180) {
|
||
|
|
return errors.New("relay is unhealthy")
|
||
|
|
}
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func reportTelemetry(ctx context.Context, configuration config) error {
|
||
|
|
result := currentStatus(configuration)
|
||
|
|
generatedAt := time.Now().UTC()
|
||
|
|
snapshot, err := json.Marshal(telemetryFile{GeneratedAt: generatedAt, Status: result})
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if err := writeAtomic(telemetrySnapshotPath, append(snapshot, '\n'), 0644); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
fmt.Printf("oci_l4_relay_telemetry timestamp=%s conntrack_count=%d conntrack_max=%d wireguard_handshake_age_seconds=%d web_allow_cached=%t smtp_deny_cached=%t smtp_deny_policy_valid=%t smtp_deny_active_source=%s smtp_deny_bundle_age_seconds=%d smtp_deny_bundle_remaining_seconds=%d smtp_deny_remote_current_age_seconds=%d smtp_deny_refresh_successful=%t smtp_deny_refresh_completed_age_seconds=%d nftables_active=%t wireguard_active=%t\n", generatedAt.Format(time.RFC3339), result.ConntrackCount, result.ConntrackMaximum, result.HandshakeAgeSecond, result.WebAllowCached, result.SMTPDenyCached, result.SMTPDenyPolicyValid, result.SMTPDenyActiveSource, result.SMTPDenyBundleAgeSeconds, result.SMTPDenyBundleRemainingSeconds, result.SMTPDenyRemoteCurrentAgeSeconds, result.SMTPDenyRefreshSuccessful, result.SMTPDenyRefreshCompletedAgeSeconds, result.NftablesActive, result.WireGuardActive)
|
||
|
|
for _, command := range [][]string{
|
||
|
|
{"/usr/sbin/nft", "-j", "list", "counters"},
|
||
|
|
{"/usr/sbin/tc", "-s", "-j", "qdisc", "show", "dev", interfaceName},
|
||
|
|
{"/usr/sbin/ip", "-s", "-j", "link", "show", "dev", interfaceName},
|
||
|
|
} {
|
||
|
|
output, err := exec.CommandContext(ctx, command[0], command[1:]...).Output()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
fmt.Printf("oci_l4_relay_telemetry detail=%s\n", strings.TrimSpace(string(output)))
|
||
|
|
}
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func fileExists(path string) bool {
|
||
|
|
_, err := os.Stat(path)
|
||
|
|
return err == nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func readInteger(path string) int64 {
|
||
|
|
contents, err := os.ReadFile(path)
|
||
|
|
if err != nil {
|
||
|
|
return -1
|
||
|
|
}
|
||
|
|
value, err := strconv.ParseInt(strings.TrimSpace(string(contents)), 10, 64)
|
||
|
|
if err != nil {
|
||
|
|
return -1
|
||
|
|
}
|
||
|
|
return value
|
||
|
|
}
|