From fc5551b90f4317ccdf2d8c6b6a331647d676e138 Mon Sep 17 00:00:00 2001 From: Johannes Stoelp Date: Tue, 3 Jan 2023 14:35:21 +0100 Subject: firewall: move from iptables to firewalld (nftables) --- roles/git/files/runner-zola/webhook.sh | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) (limited to 'roles/git/files/runner-zola/webhook.sh') diff --git a/roles/git/files/runner-zola/webhook.sh b/roles/git/files/runner-zola/webhook.sh index 1c10685..b874233 100755 --- a/roles/git/files/runner-zola/webhook.sh +++ b/roles/git/files/runner-zola/webhook.sh @@ -18,9 +18,24 @@ while true; do REF=${REF:-main} if [ ! -d blog ]; then - # Use non-redirected port as redirection is handled via PREROUTING - # iptables rules and if this hook runs on the same machine the request - # packages will not go through the routing chain. + # Use non-redirected port to clone repository as the runner executes on + # the same machine as the webserver. + # + # We use a NAT:PREROUTING chain to implement the redirection (dnat). + # However as described by the netfilter packet flow and the connection + # tracking system (CONNTRACK), the NAT hooks are only traversed for NEW + # connections. + # For packages originating from the local machine, the connection will + # be seen as NEW by the CONNTRACK system on the OUTPUT path and hence + # the NAT:OUTPUT hooks will be traversed. + # Once the package is looped-back and arrives at the PREROUTING path, + # the NAT:PREROUTING rules wont be traversed as the package is already + # known to the CONNTRACK system (not NEW). + # + # We could additionally implement dnat for lo interface on the OUTPUT + # path as described here, but we dont do it and just use the actual + # port here :^) + # https://unix.stackexchange.com/questions/618229/nftables-destination-nat-block-local-access-to-port git clone https://git.memzero.de:8443/blog fi git -C blog submodule init -- cgit v1.2.3