reyes 1.2.0 → 1.2.1

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    ODc4ZmM1OTU4ZGRhOGYyMmYxZjRiMDRiNGZjMzJlNTc3OTA3MTNjZA==
+    YjY2OTM2MzJiMTg1MTJjYzkzY2JiZjU4YzFhOTc5MmUxNWY4MDZlZQ==
   data.tar.gz: !binary |-
-    ZDVjMzczNjlmNDJmMjE4YTk0NTY0YzFkN2Y3NmIzMTM2N2I1MDQ1MA==
+    NzJiNTU1ODI2MmU5NTljOWRiMTA0OTRlMzFkZTkyMmZmMDU2ZTIzYQ==
 SHA512:
   metadata.gz: !binary |-
-    ZTNhMTk3OWVhYjg0MmE5ZTIwMmE0Y2ZmYmNhNzQ1NDE5MGE2NGU5NjczMGI1
-    NTAwYzQzYjAxNTMyMThhNGJlNTU2ZGYxOGZmNjg1M2U4N2I3NjMwMjUyODMy
-    YWRiMDVjZWE5NjU1NThhZDI5MTY3OTkxNzFmYTZiNzhhNDMyMGQ=
+    ZDRjNmVjZjczZmY1NjZkNWY5YjMyNjA3ODc3NTA4ZDZjMzExZDI3NmYyYTMy
+    OTVmYjMzZjZmZjQ4M2I3MjNkYjljNTAxN2E1NTg2NmE4YzQ4ZTgyY2YwOGIz
+    OWRhNjkwOTg4NTJiM2Q5ZjI2YzE0MTc4ZWZkYThjZjRhYmM0YWI=
   data.tar.gz: !binary |-
-    Zjc3NDlhNmNmZDBlNWY5Mzc3OWQ4NDdlYjg5OTYwMjc0YjRmMTczNDA1YzI4
-    NTdiZDc1NzJkMWUyNDk5NzU3N2Y5MzcyYTAyYmU3ZmYxMzdiODI2ZjU4MWUz
-    ZTRjNWZiMDJmNmZhNzNiNDVhNDY0OTk0YTEwNjFlZjE5NDk4MTc=
+    ZDgzYTdkZjRmN2YyMTliNDZlYmQzYmYzY2RkNzQ1ZmQ4NDg3YjdmZDc1NGY1
+    YmRjZDVlNmZmMjdiNDMwZGNhOTMzYWQyN2ZiMTZkMjY2NGY3OTUwYzYxNThl
+    ZmE0ZGY0YzAxODVkNzEyNGZhNGQ2OTQ1ZTVjZjgxZmZhNTljOGM=

data/lib/reyes/group_manager.rb

@@ -1,4 +1,5 @@
 require 'ipaddr'
+require 'socket'
 
 module Reyes
 
@@ -47,6 +48,16 @@ module Reyes
       fake_aws.instance(@region, @instance_id)
     end
 
+    # List IPv4 addresses of the current host.
+    #
+    # @return [Array<IPAddr>]
+    #
+    def local_ipv4_addresses
+      Socket.ip_address_list.find_all(&:ipv4?).map {|a|
+        IPAddr.new(a.ip_address)
+      }
+    end
+
     # @return [Hash]
     def our_groups(skip_excluded=true)
       data = fake_aws.security_groups_for_instance(@region, @instance_id)
@@ -230,17 +241,7 @@ module Reyes
         # filter all remote CIDR blocks through reyes
         fake_aws.remote_cidr_blocks(vpc_id).map do |cidr|
 
-          # make sure cidr block can be parsed as an IPAddr
-          IPAddr.new(cidr)
-
-          # safeguard against accidentally including our own CIDR block
-          if cidr == fake_aws.vpcs.fetch(vpc_id).fetch('cidr_block')
-            log.error('Somehow remote_cidr_blocks includes our cidr_block')
-            log.error("Our VPC: #{vpc_id.inspect}")
-            log.error("Our CIDR block: #{cidr.inspect}")
-            raise ArgumentError.new(
-              "Refusing to filter CIDR block for self VPC")
-          end
+          check_cidr_ok_for_reyes(cidr)
 
           "-A INPUT -s #{cidr} -j #{ReyesInputChain}"
         end
@@ -344,6 +345,54 @@ module Reyes
 
     private
 
+    # Reyes should never filter incoming traffic that would natively be covered
+    # by security groups. Our paranoia here stems from a desire not to
+    # accidentally lock ourselves out of large groups of instances.
+    #
+    # Ensure that the passed CIDR block is not the block for the current VPC
+    # and does not include the current hosts's local IP addresses.
+    #
+    # @param [String, IPAddr] cidr_block
+    #
+    # @raise [Reyes::Error] If the cidr block is found to be invalid for Reyes.
+    #
+    def check_cidr_ok_for_reyes(cidr_block)
+      case cidr_block
+      when String
+        cidr_block = IPAddr.new(cidr_block)
+      when IPAddr
+      else
+        raise ArgumentError.new("Invalid CIDR block: #{cidr_block.inspect}")
+      end
+
+      self_vpc_block = fake_aws.vpcs.fetch(vpc_id).fetch('cidr_block')
+
+      # safeguard against accidentally including our own CIDR block
+      if cidr_block == IPAddr.new(self_vpc_block)
+        log.error('Somehow remote_cidr_blocks includes our cidr_block')
+        log.error("Our VPC: #{vpc_id.inspect}")
+        log.error("Our VPC CIDR block: #{self_vpc_block.inspect}")
+        raise Error.new('Refusing to filter CIDR block for self VPC')
+      end
+
+      # Safeguard against accidentally including a CIDR block overlapping a
+      # local address
+      unless cidr_block.ipv4?
+        raise Error.new("Cannot handle non-IPv4 address #{cidr_block.inspect}")
+      end
+
+      local_ipv4_addresses.each do |addr|
+        if cidr_block.include?(addr)
+          log.error('Somehow remote_cidr_blocks include local IP addr')
+          log.error("Local IP address: #{addr.inspect}")
+          log.error("Overlapping CIDR block: #{cidr_block.inspect}")
+          raise Error.new('Refusing to filter CIDR block over local addr')
+        end
+      end
+
+      true
+    end
+
     def dynamic_rules_from_data(data)
       log.info("Generating dynamic iptables rules")
 

data/lib/reyes/version.rb

@@ -1,6 +1,6 @@
 module Reyes
   # The Reyes version number
-  VERSION = '1.2.0' unless defined?(self::VERSION)
+  VERSION = '1.2.1' unless defined?(self::VERSION)
 
   # Number defining the JSON serialization format
   JSON_FORMAT_VERSION = 2 unless defined?(self::JSON_FORMAT_VERSION)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: reyes
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Andy Brody
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-04 00:00:00.000000000 Z
+date: 2015-03-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk