@chain305/x-security 0.1.0

package/bin/scripts/writ-resolve.sh

@@ -0,0 +1,223 @@
+#!/bin/sh
+# writ-resolve.sh — deploy-time DNS resolver for Writ firewall rules.
+#
+# Reads an iptables-save-format ruleset containing @@WRIT_RESOLVE:<fqdn>@@
+# tokens (produced by `lazy generate --target firewall`) and rewrites
+# each token into one or more concrete `-d <addr>` clauses by resolving the
+# FQDN against the host's system resolver.
+#
+# Generated by Writ — DO NOT EDIT in place. If you need to customize
+# behavior, override via the environment variables documented in the
+# accompanying README.md.
+#
+# Security notes (read these):
+#   - We use the system resolver via /etc/resolv.conf. The operator is
+#     responsible for ensuring that resolver is trustworthy (DNSSEC,
+#     internal-only DNS, etc.). A poisoned resolver can punch holes in the
+#     allowlist.
+#   - Allowlist mode only: this script emits *additional* ACCEPT lines for
+#     resolved addresses. It NEVER emits REJECT and NEVER weakens the
+#     default-deny terminator that the generator placed at the tail of the
+#     ruleset. Fail-closed is preserved.
+#   - On total resolution failure (no FQDN resolves), the script exits
+#     non-zero WITHOUT writing output. Combined with the refresh wrapper's
+#     hold-previous-rules behavior, this yields fail-closed semantics
+#     against the allowlist (no allowed destinations === everything drops).
+#   - The log is append-only with ISO-8601 timestamps. Rotation is expected
+#     via the provided logrotate.d snippet.
+#
+# Usage:
+#   writ-resolve.sh [--rules-file PATH] [--out PATH] [--lenient]
+#   ... | writ-resolve.sh > resolved.rules
+#
+# Exit codes:
+#   0  success — all tokens resolved
+#   1  hard failure — at least one FQDN failed to resolve (strict mode)
+#   2  total failure — no FQDN resolved (even in --lenient mode)
+#   3  usage error
+
+set -eu
+
+LOG_FILE="${WRIT_LOG:-/var/log/writ-resolve.log}"
+LENIENT=0
+RULES_FILE=""
+OUT_FILE=""
+
+log() {
+  # ISO-8601 UTC timestamp; append-only.
+  ts=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  printf '%s %s\n' "$ts" "$*" >> "$LOG_FILE" 2>/dev/null || \
+    printf '%s %s\n' "$ts" "$*" >&2
+}
+
+usage() {
+  cat >&2 <<'EOF'
+writ-resolve.sh [--rules-file PATH] [--out PATH] [--lenient]
+
+  --rules-file PATH   Read template from PATH instead of stdin.
+  --out PATH          Write resolved ruleset to PATH instead of stdout.
+  --lenient           Continue if some (but not all) FQDNs fail to resolve.
+                      Default is strict: any failed resolution => exit 1.
+
+Environment:
+  WRIT_LOG      Override log path (default /var/log/writ-resolve.log)
+EOF
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --rules-file) RULES_FILE="$2"; shift 2 ;;
+    --out)        OUT_FILE="$2";   shift 2 ;;
+    --lenient)    LENIENT=1;        shift ;;
+    -h|--help)    usage; exit 0 ;;
+    *)            usage; exit 3 ;;
+  esac
+done
+
+# Pick a resolver. getent ahosts gives us A + AAAA + canonicalization in one
+# call and respects /etc/nsswitch.conf — preferred. Fall back to `dig +short`
+# if getent is unavailable (some minimal containers strip glibc tooling).
+resolve_fqdn() {
+  fqdn="$1"
+  if command -v getent >/dev/null 2>&1; then
+    # getent ahosts emits lines like: "1.2.3.4 STREAM hostname"
+    # We deduplicate addresses since ahosts repeats them per socktype.
+    getent ahosts "$fqdn" 2>/dev/null | awk '{print $1}' | sort -u
+  elif command -v dig >/dev/null 2>&1; then
+    {
+      dig +short +time=2 +tries=2 A    "$fqdn" 2>/dev/null
+      dig +short +time=2 +tries=2 AAAA "$fqdn" 2>/dev/null
+    } | grep -E '^[0-9a-fA-F:.]+$' | sort -u
+  else
+    log "ERROR: neither getent nor dig is available; cannot resolve $fqdn"
+    return 1
+  fi
+}
+
+# Read input
+if [ -n "$RULES_FILE" ]; then
+  [ -r "$RULES_FILE" ] || { log "ERROR: cannot read $RULES_FILE"; exit 3; }
+  INPUT=$(cat "$RULES_FILE")
+else
+  INPUT=$(cat)
+fi
+
+# Pass 1: extract every @@WRIT_RESOLVE:<fqdn>@@ token. Skip comment
+# lines (the generator's header documents the token format with a literal
+# `@@WRIT_RESOLVE:<fqdn>@@` example — we must not try to resolve
+# `<fqdn>` as a real hostname).
+FQDNS=$(printf '%s\n' "$INPUT" \
+  | grep -v '^[[:space:]]*#' \
+  | grep -oE '@@WRIT_RESOLVE:[^@]+@@' \
+  | sed -e 's/^@@WRIT_RESOLVE://' -e 's/@@$//' \
+  | sort -u)
+
+TOTAL=0
+RESOLVED=0
+FAILED=0
+
+# Build a sed script that, for each FQDN, expands the placeholder line into
+# one resolved line per address. We do this by emitting newline-delimited
+# replacement text using a tab-separated address list, then awk does the
+# multi-line expansion.
+
+# Stage 1: build an address-map file. Format: <fqdn>\t<addr>
+TMP_MAP=$(mktemp)
+trap 'rm -f "$TMP_MAP"' EXIT
+
+if [ -n "$FQDNS" ]; then
+  echo "$FQDNS" | while IFS= read -r fqdn; do
+    [ -z "$fqdn" ] && continue
+    TOTAL=$((TOTAL + 1))
+    addrs=$(resolve_fqdn "$fqdn" || true)
+    if [ -z "$addrs" ]; then
+      log "WARN: failed to resolve $fqdn"
+      printf '%s\t__WRIT_UNRESOLVED__\n' "$fqdn" >> "$TMP_MAP"
+    else
+      log "INFO: resolved $fqdn -> $(echo "$addrs" | tr '\n' ' ')"
+      echo "$addrs" | while IFS= read -r addr; do
+        [ -z "$addr" ] && continue
+        printf '%s\t%s\n' "$fqdn" "$addr" >> "$TMP_MAP"
+      done
+    fi
+  done
+fi
+
+# Recompute counts (the while-subshell can't update parent vars portably).
+# Note: `grep -c` on zero matches prints "0" AND exits 1, so we can't pair
+# it with `|| echo 0` (that would emit two lines). Use a wc-based count and
+# always trim to a single integer.
+TOTAL=$(printf '%s\n' "$FQDNS" | grep -v '^$' | wc -l | tr -d ' \n')
+FAILED=$(grep -c '__WRIT_UNRESOLVED__' "$TMP_MAP" 2>/dev/null | head -n 1 | tr -d ' \n')
+[ -z "$FAILED" ] && FAILED=0
+RESOLVED=$((TOTAL - FAILED))
+
+# Strict / lenient gating.
+if [ "$TOTAL" -gt 0 ] && [ "$RESOLVED" -eq 0 ]; then
+  log "FATAL: zero of $TOTAL FQDNs resolved; refusing to emit ruleset"
+  exit 2
+fi
+if [ "$FAILED" -gt 0 ] && [ "$LENIENT" -eq 0 ]; then
+  log "FATAL: $FAILED/$TOTAL FQDNs failed (strict mode); refusing to emit ruleset"
+  exit 1
+fi
+
+# Pass 2: substitute. For every line containing a @@WRIT_RESOLVE:X@@
+# token, emit one copy per resolved address (with `-d <addr>` replacing the
+# token). Lines for unresolved FQDNs are dropped (in lenient mode), which is
+# fail-closed: those destinations remain unreachable.
+OUTPUT=$(printf '%s\n' "$INPUT" | awk -v mapfile="$TMP_MAP" '
+  BEGIN {
+    while ((getline line < mapfile) > 0) {
+      n = split(line, f, "\t")
+      if (n < 2) continue
+      if (f[2] == "__WRIT_UNRESOLVED__") {
+        unresolved[f[1]] = 1
+        continue
+      }
+      # NOTE: do not use `(f[1] in addrs ? ... : ...)` — busybox awk
+      # treats the `in` check as a key-creating side-effect under some
+      # builds, leading to a phantom empty entry being concatenated on
+      # first insert (split() then yields a stray empty element). Track
+      # presence via a separate flag instead.
+      if (seen[f[1]]) {
+        addrs[f[1]] = addrs[f[1]] "\n" f[2]
+      } else {
+        addrs[f[1]] = f[2]
+        seen[f[1]] = 1
+      }
+    }
+    close(mapfile)
+  }
+  {
+    if (match($0, /@@WRIT_RESOLVE:[^@]+@@/)) {
+      token = substr($0, RSTART, RLENGTH)
+      fqdn = token
+      sub(/^@@WRIT_RESOLVE:/, "", fqdn)
+      sub(/@@$/, "", fqdn)
+      if (fqdn in unresolved) {
+        # Drop the rule — fail-closed.
+        next
+      }
+      if (fqdn in addrs) {
+        m = split(addrs[fqdn], a, "\n")
+        for (i = 1; i <= m; i++) {
+          line = $0
+          sub(/@@WRIT_RESOLVE:[^@]+@@/, "-d " a[i], line)
+          print line
+        }
+        next
+      }
+    }
+    print $0
+  }
+')
+
+if [ -n "$OUT_FILE" ]; then
+  printf '%s\n' "$OUTPUT" > "$OUT_FILE"
+  log "INFO: wrote resolved ruleset to $OUT_FILE ($RESOLVED/$TOTAL FQDNs)"
+else
+  printf '%s\n' "$OUTPUT"
+fi
+
+exit 0

package/bin/scripts/writ.logrotate

@@ -0,0 +1,13 @@
+# /etc/logrotate.d/writ — sample logrotate config for Writ refresh log.
+# Copy to /etc/logrotate.d/writ and adjust paths/retention to taste.
+/var/log/writ-resolve.log {
+    weekly
+    rotate 8
+    compress
+    delaycompress
+    missingok
+    notifempty
+    create 0640 root adm
+    # Append-only integrity hint: do NOT use copytruncate — it allows
+    # in-place rewrites. Rotation + recreate preserves append-only.
+}