[bug#48975] New firewall service

[Solene Rapenne via Guix-patches via <guix-patches@gnu.org>]

Hello,

I wrote a new firewall service, I already wrote an email to guix-devel
about it and I've been suggested to submit it here.

The idea is to propose an easy way to manage your firewall. On a
personal computer or a server with no fancy network, you certainly want
to block access from the outside to all the ports except a few ones.

The configuration looks like this, currently it only supports TCP and
UDP ports. Maybe NAT could be added later or other feature, I'm opened
to suggestions.

(service firewall-service-type
  (firewall-configuration
    (udp '(53))
    (tcp '(22 70 1965))))


Here is the code, I took bits from iptables as a base and then used the
Tor service way to generate the configuration file.

diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 87b3d754a3..d311f95448 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -221,7 +221,11 @@
 
             keepalived-configuration
             keepalived-configuration?
-            keepalived-service-type))
+            keepalived-service-type
+
+            firewall-service-type
+            firewall-configuration
+            firewall-configuration?))
 
 ;;; Commentary:
 ;;;
@@ -2190,4 +2194,76 @@ of the IPFS peer-to-peer storage network.")))
                  "Run @uref{https://www.keepalived.org/, Keepalived}
 routing software.")))
 
+\f
+;;;
+;;; Firewall
+;;;
+
+(define-record-type* <firewall-configuration>
+  firewall-configuration make-firewall-configuration
+  firewall-configuration?
+  (tcp firewall-configuration-tcp
+       (default '()))
+  (udp firewall-configuration-udp
+       (default '())))
+
+(define (firewall-configuration->file tcp udp)
+  "Return the iptables rules from the ports list"
+  (computed-file
+   "firewall-generated-rules"
+   (with-imported-modules '((guix build utils))
+     #~(begin
+         (use-modules (guix build utils)
+                      (ice-9 match))
+         (call-with-output-file #$output
+           (lambda (out)
+             (display "\
+*filter
+:INPUT DROP
+:FORWARD DROP
+:OUTPUT ACCEPT
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\n" out)
+
+             ;; tcp rules
+             (when (not (null? (list #$@tcp)))
+               (format out "\
+~{-A INPUT -p tcp --dport ~a -j ACCEPT~%~}"
+                       (list #$@tcp)))
+
+             ;; udp rules
+             (when (not (null? (list #$@udp)))
+               (format out "\
+~{-A INPUT -p udp --dport ~a -j ACCEPT~%~}"
+                       (list #$@udp)))
+
+             (display "COMMIT\n" out)
+             #t))))))
+
+(define firewall-shepherd-service
+  (match-lambda
+    (($ <firewall-configuration> tcp udp)
+     (let* ((iptables-restore (file-append iptables "/sbin/iptables-restore"))
+            (ip6tables-restore (file-append iptables "/sbin/ip6tables-restore"))
+            (ruleset (firewall-configuration->file tcp udp)))
+       (shepherd-service
+        (documentation "Easy firewall management")
+        (provision '(firewall))
+        (start #~(lambda _
+                   (invoke #$iptables-restore  #$ruleset)
+                   (invoke #$ip6tables-restore #$ruleset)))
+        (stop #~(lambda _
+                  (invoke #$iptables-restore #$ruleset)
+                  (invoke #$ip6tables-restore #$ruleset))))))))
+
+(define firewall-service-type
+  (service-type
+   (name 'firewall)
+   (description
+    "Run @command{iptables-restore}, setting up the specified rules.")
+   (extensions
+    (list (service-extension shepherd-root-service-type
+                             (compose list firewall-shepherd-service))))))
+
+
 ;;; networking.scm ends here