@kvbox/server 0.5.9 → 0.5.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kvbox/server",
-  "version": "0.5.9",
+  "version": "0.5.10",
   "description": "kvbox host daemon: owns Firecracker microVMs on a Linux host and serves the kvbox API. Managed with the @kvbox/cli CLI.",
   "type": "module",
   "license": "MIT",

package/scripts/net-setup.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # Host networking for kvbox: bridge kvbox0 (172.30.0.1/24), IP forwarding, NAT to the
 # default route, and FORWARD accept rules for the bridge (Docker sets FORWARD's policy
-# to DROP, so NAT alone is not enough). Needs root; re-execs itself with sudo.
+# to DROP, so NAT alone is not enough), and the guard around boxes: no box to box, box to
+# host, box to private networks or outbound mail. Needs root; re-execs itself with sudo.
 # Idempotent. The bridge and the rules vanish on host reboot, so this runs from
 # install-server.sh once and from kvbox-server at start whenever the bridge is missing.
 #
@@ -21,6 +22,7 @@
 #                                         keep the tunnel to the relay up, now and after reboots (wg-quick@kvbox), and
 #                                         let the control plane's HTTPS port (default 7777) in on the tunnel interface
 #                                         (a host firewall such as ufw would otherwise drop it; box ports are forwarded)
+#   net-setup.sh relay restart            redial the tunnel (kvbox-server does it when the relay stops answering)
 #   net-setup.sh relay down               take the tunnel down and remove the conf
 #   net-setup.sh relay status             is the tunnel up, when did the relay last answer
 #
@@ -51,10 +53,10 @@ case "$action" in
   proxy) [[ "$px_op" =~ ^(add|rm)$ && "$px_box" =~ ^[a-z0-9][a-z0-9._-]{0,14}$ && "$px_ip" =~ ^[0-9]{1,3}(\.[0-9]{1,3}){3}$ \
             && "$px_hport" =~ ^[0-9]{1,5}$ && "$px_gport" =~ ^[0-9]{1,5}$ && "$px_hport" -ne 22 && "$px_proto" =~ ^(tcp|udp)$ ]] \
            || fail "usage: $0 proxy add|rm <box-id> <box-ip> <host-port> <guest-port> [tcp|udp]  (host port is never 22)" ;;
-  relay) if [[ ! "$relay_op" =~ ^(up|down|status)$ ]] || { [[ "$relay_op" == up ]] && [[ -z "$relay_conf" ]]; } || [[ ! "$relay_port" =~ ^[0-9]{1,5}$ ]]; then
-           fail "usage: $0 relay up <conf> [port] | relay down | relay status"
+  relay) if [[ ! "$relay_op" =~ ^(up|restart|down|status)$ ]] || { [[ "$relay_op" == up ]] && [[ -z "$relay_conf" ]]; } || [[ ! "$relay_port" =~ ^[0-9]{1,5}$ ]]; then
+           fail "usage: $0 relay up <conf> [port] | relay restart | relay down | relay status"
          fi ;;
-  *) fail "usage: $0 [up|down|status|tap add|attach|del <name>|proxy add|rm ...|relay up|down|status]" ;;
+  *) fail "usage: $0 [up|down|status|tap add|attach|del <name>|proxy add|rm ...|relay up|restart|down|status]" ;;
 esac
 for bin in ip iptables sysctl; do command -v "$bin" >/dev/null 2>&1 || fail "$bin not found"; done
 if [[ "$action" == relay ]]; then
@@ -78,6 +80,11 @@ fi
 # ── rule set ─────────────────────────────────────────────────────────────────
 # RULE_DESC[i] is what we tell the user; RULE_SPEC[i] is "<table> <chain> <rule...>".
 # Added with -I (ahead of Docker's chains), checked with -C, found again by the comment tag.
+# Each rule is inserted at the top, so a later entry ends up above an earlier one: the replies
+# accept comes last so it sits above the drops, and the drops sit above the general accept.
+# Boxes are strangers to each other and to this host (box to box is cut at the bridge, see
+# do_tap_attach): a box reaches the internet only, never the host, its LAN or cloud metadata.
+PRIVATE_NETS=(10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 100.64.0.0/10 169.254.0.0/16)
 RULE_DESC=(
   "NAT: boxes reach the internet using this host's address"
   "firewall: traffic from boxes may leave through $BRIDGE"
@@ -88,6 +95,22 @@ RULE_SPEC=(
   "filter FORWARD -i $BRIDGE -m comment --comment $TAG -j ACCEPT"
   "filter FORWARD -o $BRIDGE -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment $TAG -j ACCEPT"
 )
+for net in "${PRIVATE_NETS[@]}"; do
+  RULE_DESC+=("firewall: boxes cannot reach private network $net (this host's LAN, provider networks, cloud metadata)")
+  RULE_SPEC+=("filter FORWARD -i $BRIDGE -d $net -m comment --comment $TAG -j DROP")
+done
+RULE_DESC+=(
+  "firewall: boxes cannot send mail directly (port 25), so spam never gets this host's address blocked"
+  "firewall: boxes may answer connections made to them (published ports, the relay)"
+  "firewall: boxes cannot reach this host itself"
+  "firewall: this host may still talk to its boxes"
+)
+RULE_SPEC+=(
+  "filter FORWARD -i $BRIDGE -p tcp --dport 25 -m comment --comment $TAG -j DROP"
+  "filter FORWARD -i $BRIDGE -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment $TAG -j ACCEPT"
+  "filter INPUT -i $BRIDGE -m comment --comment $TAG -j DROP"
+  "filter INPUT -i $BRIDGE -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment $TAG -j ACCEPT"
+)
 has_rule()  { local t=$1 c=$2; shift 2; iptables -t "$t" -C "$c" "$@" 2>/dev/null; }
 add_rule()  { local t=$1 c=$2; shift 2; iptables -t "$t" -I "$c" 1 "$@"; }
 del_rule()  { local t=$1 c=$2; shift 2; while iptables -t "$t" -C "$c" "$@" 2>/dev/null; do iptables -t "$t" -D "$c" "$@"; done; }
@@ -104,11 +127,24 @@ do_up() {
   if bridge_has_ip; then skip "$BRIDGE already has address $GATEWAY"; else ip addr add "$GATEWAY/$PREFIX" dev "$BRIDGE"; ok "gave this host address $GATEWAY on $BRIDGE (boxes use it as their gateway)"; fi
   if bridge_is_up; then skip "$BRIDGE is already up"; else ip link set "$BRIDGE" up; ok "brought $BRIDGE up"; fi
   if [[ "$(sysctl -n net.ipv4.ip_forward)" == 1 ]]; then skip "IP forwarding already enabled"; else sysctl -q -w net.ipv4.ip_forward=1; ok "enabled IP forwarding (this host routes for the boxes)"; fi
-  local i
+  local i missing=0 present=()
   for i in "${!RULE_SPEC[@]}"; do
     # shellcheck disable=SC2086  # the rule is a word list by design
-    if has_rule ${RULE_SPEC[$i]}; then skip "${RULE_DESC[$i]} (already set)"; else add_rule ${RULE_SPEC[$i]}; ok "${RULE_DESC[$i]}"; fi
+    if has_rule ${RULE_SPEC[$i]}; then present[i]=1; else missing=1; fi
   done
+  # Order matters (accepts above drops), and a rule inserted alone would land on top of the others:
+  # when anything is missing, take the set out and put it all back in order.
+  if [[ $missing -eq 1 ]]; then
+    # shellcheck disable=SC2086
+    for i in "${!RULE_SPEC[@]}"; do del_rule ${RULE_SPEC[$i]}; done
+  fi
+  for i in "${!RULE_SPEC[@]}"; do
+    # shellcheck disable=SC2086
+    [[ $missing -eq 1 ]] && add_rule ${RULE_SPEC[$i]}
+    if [[ -n "${present[i]:-}" ]]; then skip "${RULE_DESC[$i]} (already set)"; else ok "${RULE_DESC[$i]}"; fi
+  done
+  local tap
+  for tap in $(taps_on_bridge); do isolate_tap "$tap"; done
   echo
   ok "host network ready: boxes get addresses in $SUBNET on $BRIDGE, gateway $GATEWAY, internet via NAT"
 }
@@ -152,6 +188,8 @@ do_status() {
   done
   local taps; taps="$(taps_on_bridge)"
   if [[ -z "$taps" ]]; then skip "no boxes attached to $BRIDGE yet"; else ok "boxes attached to $BRIDGE: $taps"; fi
+  local tap
+  for tap in $taps; do tap_isolated "$tap" || bad "box on $tap can reach other boxes (tap not isolated)"; done
   local fwds; fwds="$(proxy_summary)"
   if [[ -z "$fwds" ]]; then skip "no box ports published on this host"; else ok "box ports published on this host:"; printf '%s\n' "$fwds"; fi
   if [[ $missing -eq 0 ]]; then echo; ok "host network is ready"; else echo; printf '%s✗%s host network incomplete; run: kvbox-server net up\n' "$RED" "$NC"; fi
@@ -180,8 +218,13 @@ do_tap_attach() {
   local tap=$1
   [[ -d "/sys/class/net/$tap" ]] || fail "tap $tap does not exist"
   ip link set "$tap" master "$BRIDGE" up
+  isolate_tap "$tap"
   ok "tap $tap plugged into $BRIDGE"
 }
+# An isolated bridge port talks to the host (the gateway) but never to another isolated port:
+# one box cannot see another box's ports, whoever owns them.
+isolate_tap() { ip link set dev "$1" type bridge_slave isolated on; }
+tap_isolated() { ip -d link show dev "$1" 2>/dev/null | grep -q "isolated on"; }
 do_tap_del() {
   local tap=$1
   if [[ -d "/sys/class/net/$tap" ]]; then ip link del "$tap"; ok "deleted tap $tap"; else skip "tap $tap does not exist"; fi
@@ -268,6 +311,13 @@ do_relay_up() {
     eval "iptables -t filter -D $rule" && ok "firewall: closed the tunnel's old port $(sed -E 's/.*--dport ([0-9]+) .*/\1/' <<<"$rule")"
   done < <(relay_input_rules)
 }
+# A new process dials from a new UDP port, which a home router maps afresh: the way out of a mapping
+# that went stale while the relay rebooted (the relay hears us but cannot answer).
+do_relay_restart() {
+  [[ -f "$relay_target" ]] || fail "no relay tunnel configured on this host"
+  systemctl restart "$relay_unit" || fail "could not restart the tunnel (journalctl -u $relay_unit)"
+  ok "tunnel $RELAY_IF restarted"
+}
 do_relay_down() {
   local rule n=0
   while IFS= read -r rule; do
@@ -312,6 +362,7 @@ case "$action" in
          esac ;;
   relay) case "$relay_op" in
            up) do_relay_up "$relay_conf" "$relay_port" ;;
+           restart) do_relay_restart ;;
            down) do_relay_down ;;
            status) do_relay_status ;;
          esac ;;