ARCHIVE/sashimono
1
0
Fork 0
mirror of https://github.com/EvernodeXRPL/sashimono.git synced 2026-08-21 18:30:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

added DNS check to the firewall (checking if its within the local LAN)

Browse Source
This commit is contained in:
gadget78
2025-08-12 04:47:42 +01:00
parent 9da5ea9c3c
commit b4e7824550
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
dependencies/user-install.sh vendored
View File

@@ -1,7 +1,7 @@
#!/bin/bash
# Sashimono contract instance user installation script.
# This is intended to be called by Sashimono agent.
version=1.6
version=1.9
# Check for user cpu and memory quotas.
cpu=$1
@@ -470,6 +470,17 @@ if [[ "$local_ip" != "$public_hostname_ip" ]]; then
if [ -z "$lan_subnet" ]; then
echo "Error: Could not detect LAN subnet."
else
local_dns=$(grep '^nameserver' /etc/resolv.conf | awk 'NR==1 {print $2}')
if [ -z "$local_dns" ]; then
echo "Warning: Could not detect local DNS IP."
else
if [ "$(echo "$local_dns" | cut -d'.' -f1-2)" = "$(echo "$lan_subnet" | cut -d'.' -f1-2)" ]; then
echo "detected local DNS IP as $local_dns, allowing. (as within the lan subnet of $lan_subnet)"
nft add rule ip docker_filter_$user_id OUTPUT meta skuid $user_id ip daddr $local_dns accept
else
echo "detected local DNS IP as $local_dns, not part of lan subnet of $lan_subnet"
fi
fi
echo "detected lan subnet ip to $lan_subnet, blocking/dropping"
nft add rule ip docker_filter_$user_id OUTPUT meta skuid $user_id ip daddr $lan_subnet drop
fi