Merge branch 'feature/firewall' into develop

9 files changed, 73 insertions, 5 deletions

diff --git a/lib/leap_cli/macros/stunnel.rb b/lib/leap_cli/macros/stunnel.rb
index f16308c7..821bda38 100644
--- a/lib/leap_cli/macros/stunnel.rb
+++ b/lib/leap_cli/macros/stunnel.rb
@@ -49,12 +49,14 @@ module LeapCli
       result = Config::ObjectList.new
       node_list.each_node do |node|
         if node.name != self.name || options[:include_self]
+          s_port = stunnel_port(port)
           result["#{node.name}_#{port}"] = Config::Object[
             'accept_port', @next_stunnel_port,
             'connect', node.domain.internal,
-            'connect_port', stunnel_port(port),
+            'connect_port', s_port,
             'original_port', port
           ]
+          manager.connections.add(:from => @node.ip_address, :to => node.ip_address, :port => s_port)
           @next_stunnel_port += 1
         end
       end
@@ -76,6 +78,15 @@ module LeapCli
       }
     end
 
+    #
+    # lists the ips that connect to this node, on particular ports.
+    #
+    def stunnel_firewall
+      manager.connections.select {|connection|
+        connection['to'] == @node.ip_address
+      }
+    end
+
     private
 
     #
diff --git a/provider_base/common.json b/provider_base/common.json
index e968dd27..9cc7875a 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -50,6 +50,14 @@
     "clients": {},
     "servers": {}
   },
+  "firewall": {
+    "ssh": {
+      "from": "sysadmin",
+      "to": "= ip_address",
+      "port": "= ssh.port"
+    },
+    "stunnel": "=> stunnel_firewall"
+  },
   "platform": {
     "version": "= Leap::Platform.version.to_s",
     "major_version": "= Leap::Platform.major_version"
diff --git a/provider_base/services/dns.json b/provider_base/services/dns.json
index 677d9b2c..67948ef8 100644
--- a/provider_base/services/dns.json
+++ b/provider_base/services/dns.json
@@ -3,5 +3,12 @@
     "public":  "= nodes['dns.public' => true].fields('domain.name', 'dns.aliases', 'ip_address')",
     "private": "= nodes['dns.public' => false].fields('domain.name', 'dns.aliases', 'ip_address')"
   },
-  "service_type": "public_service"
+  "service_type": "public_service",
+  "firewall": {
+    "dns": {
+      "from": "*",
+      "to": "= ip_address",
+      "port": "53"
+    }
+  }
 }
\ No newline at end of file
diff --git a/provider_base/services/monitor.json b/provider_base/services/monitor.json
index 10d5ac81..28fb837c 100644
--- a/provider_base/services/monitor.json
+++ b/provider_base/services/monitor.json
@@ -18,5 +18,12 @@
     "ca_cert": "= file :ca_cert, :missing => 'provider CA. Run `leap cert ca`'",
     "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`'",
     "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`'"
+  },
+  "firewall": {
+    "monitor": {
+      "from": "sysadmin",
+      "to": "= ip_address",
+      "port": [443, 80]
+    }
   }
 }
diff --git a/provider_base/services/mx.json b/provider_base/services/mx.json
index 4d1b3dad..d6e9fff9 100644
--- a/provider_base/services/mx.json
+++ b/provider_base/services/mx.json
@@ -31,5 +31,12 @@
     "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`'",
     "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`'"
   },
-  "service_type": "user_service"
+  "service_type": "user_service",
+  "firewall": {
+    "mx": {
+      "from": "*",
+      "to": "= ip_address",
+      "port": [25, 465]
+    }
+  }
 }
diff --git a/provider_base/services/openvpn.json b/provider_base/services/openvpn.json
index 11cb0dc2..6f73e31c 100644
--- a/provider_base/services/openvpn.json
+++ b/provider_base/services/openvpn.json
@@ -34,5 +34,12 @@
       "port" : "= rand_range('scramblesuit_port_'+name, 18000..32000)"
     },
     "gateway_address": "= openvpn.gateway_address"
+  },
+  "firewall": {
+    "vpn": {
+      "from": "*",
+      "to": "= openvpn.gateway_address",
+      "port": "= openvpn.ports + [obfsproxy.scramblesuit.port]"
+    }
   }
 }
diff --git a/provider_base/services/soledad.json b/provider_base/services/soledad.json
index ed6fbc9f..76f7155f 100644
--- a/provider_base/services/soledad.json
+++ b/provider_base/services/soledad.json
@@ -8,5 +8,12 @@
       "salt": "= hex_secret :couch_soledad_password_salt, 128"
     }
   },
-  "service_type": "public_service"
+  "service_type": "public_service",
+  "firewall": {
+    "soledad": {
+      "from": "*",
+      "to": "= ip_address",
+      "port": "= soledad.port"
+    }
+  }
 }
diff --git a/provider_base/services/static.json b/provider_base/services/static.json
index d9f52b36..2f408ec1 100644
--- a/provider_base/services/static.json
+++ b/provider_base/services/static.json
@@ -9,5 +9,12 @@
       "client_version": "= static.bootstrap_files.enabled ? provider.client_version : nil"
     }
   },
-  "service_type": "public_service"
+  "service_type": "public_service",
+  "firewall": {
+    "static": {
+      "from": "*",
+      "to": "= ip_address",
+      "port": [80, 443]
+    }
+  }
 }
\ No newline at end of file
diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json
index 039b1c0b..9e3d751b 100644
--- a/provider_base/services/webapp.json
+++ b/provider_base/services/webapp.json
@@ -76,5 +76,12 @@
     "ca_cert": "= file :ca_cert, :missing => 'provider CA. Run `leap cert ca`'",
     "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`.'",
     "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`.'"
+  },
+  "firewall": {
+    "webapp": {
+      "from": "*",
+      "to": "= ip_address",
+      "port": "= [api.port, 443, 80, nickserver.port]"
+    }
   }
 }