mirror of
https://github.com/mirage/qubes-mirage-firewall.git
synced 2025-04-18 22:35:54 -04:00
qualify all return with Lwt, use Lwt.return_unit where possible
This commit is contained in:
parent
0f476c4d7b
commit
3fc418e80c
@ -23,7 +23,7 @@ let writev eth dst proto fillfn =
|
||||
(* Usually Netback_shutdown, because the client disconnected *)
|
||||
Log.err (fun f -> f "uncaught exception trying to send to client: @[%s@]"
|
||||
(Printexc.to_string ex));
|
||||
Lwt.return ()
|
||||
Lwt.return_unit
|
||||
)
|
||||
|
||||
class client_iface eth ~domid ~gateway_ip ~client_ip client_mac : client_link =
|
||||
@ -48,10 +48,10 @@ let input_arp ~fixed_arp ~iface request =
|
||||
match Arp_packet.decode request with
|
||||
| Error e ->
|
||||
Log.warn (fun f -> f "Ignored unknown ARP message: %a" Arp_packet.pp_error e);
|
||||
Lwt.return ()
|
||||
Lwt.return_unit
|
||||
| Ok arp ->
|
||||
match Client_eth.ARP.input fixed_arp arp with
|
||||
| None -> return ()
|
||||
| None -> Lwt.return_unit
|
||||
| Some response ->
|
||||
iface#writev `ARP (fun b -> Arp_packet.encode_into response b; Arp_packet.size)
|
||||
|
||||
@ -60,8 +60,8 @@ let input_ipv4 get_ts cache ~iface ~router packet =
|
||||
match Nat_packet.of_ipv4_packet cache ~now:(get_ts ()) packet with
|
||||
| Error e ->
|
||||
Log.warn (fun f -> f "Ignored unknown IPv4 message: %a" Nat_packet.pp_error e);
|
||||
Lwt.return ()
|
||||
| Ok None -> Lwt.return ()
|
||||
Lwt.return_unit
|
||||
| Ok None -> Lwt.return_unit
|
||||
| Ok (Some packet) ->
|
||||
let `IPv4 (ip, _) = packet in
|
||||
let src = ip.Ipv4_packet.src in
|
||||
@ -69,7 +69,7 @@ let input_ipv4 get_ts cache ~iface ~router packet =
|
||||
else (
|
||||
Log.warn (fun f -> f "Incorrect source IP %a in IP packet from %a (dropping)"
|
||||
Ipaddr.V4.pp src Ipaddr.V4.pp iface#other_ip);
|
||||
return ()
|
||||
Lwt.return_unit
|
||||
)
|
||||
|
||||
(** Connect to a new client's interface and listen for incoming frames. *)
|
||||
@ -92,12 +92,12 @@ let add_vif get_ts { Dao.ClientVif.domid; device_id } ~client_ip ~router ~cleanu
|
||||
Cstruct.hexdump_pp frame
|
||||
);
|
||||
Lwt.return_unit
|
||||
| Error err -> Log.warn (fun f -> f "Invalid Ethernet frame: %s" err); return ()
|
||||
| Error err -> Log.warn (fun f -> f "Invalid Ethernet frame: %s" err); Lwt.return_unit
|
||||
| Ok (eth, payload) ->
|
||||
match eth.Ethernet_packet.ethertype with
|
||||
| `ARP -> input_arp ~fixed_arp ~iface payload
|
||||
| `IPv4 -> input_ipv4 get_ts fragment_cache ~iface ~router payload
|
||||
| `IPv6 -> return () (* TODO: oh no! *)
|
||||
| `IPv6 -> Lwt.return_unit (* TODO: oh no! *)
|
||||
)
|
||||
>|= or_raise "Listen on client interface" Netback.pp_error
|
||||
|
||||
@ -112,7 +112,7 @@ let add_client get_ts ~router vif client_ip =
|
||||
(fun ex ->
|
||||
Log.warn (fun f -> f "Error with client %a: %s"
|
||||
Dao.ClientVif.pp vif (Printexc.to_string ex));
|
||||
return ()
|
||||
Lwt.return_unit
|
||||
)
|
||||
);
|
||||
cleanup_tasks
|
||||
|
@ -30,8 +30,8 @@ let main =
|
||||
package "netchannel" ~min:"1.11.0";
|
||||
package "mirage-net-xen";
|
||||
package "ipaddr" ~min:"4.0.0";
|
||||
package "mirage-qubes";
|
||||
package "mirage-nat" ~min:"1.2.0";
|
||||
package "mirage-qubes" ~min:"0.8.0";
|
||||
package "mirage-nat" ~min:"2.0.0";
|
||||
package "mirage-logs";
|
||||
package "mirage-xen" ~min:"5.0.0";
|
||||
]
|
||||
|
7
dao.ml
7
dao.ml
@ -3,7 +3,6 @@
|
||||
|
||||
open Lwt.Infix
|
||||
open Qubes
|
||||
open Fw_utils
|
||||
open Astring
|
||||
|
||||
let src = Logs.Src.create "dao" ~doc:"QubesDB data access"
|
||||
@ -68,13 +67,13 @@ let watch_clients fn =
|
||||
begin Lwt.catch
|
||||
(fun () -> directory ~handle backend_vifs)
|
||||
(function
|
||||
| Xs_protocol.Enoent _ -> return []
|
||||
| ex -> fail ex)
|
||||
| Xs_protocol.Enoent _ -> Lwt.return []
|
||||
| ex -> Lwt.fail ex)
|
||||
end >>= fun items ->
|
||||
Lwt_list.map_p (vifs ~handle) items >>= fun items ->
|
||||
fn (List.concat items |> VifMap.of_list);
|
||||
(* Wait for further updates *)
|
||||
fail Xs_protocol.Eagain
|
||||
Lwt.fail Xs_protocol.Eagain
|
||||
)
|
||||
|
||||
type network_config = {
|
||||
|
25
firewall.ml
25
firewall.ml
@ -1,7 +1,6 @@
|
||||
(* Copyright (C) 2015, Thomas Leonard <thomas.leonard@unikernel.com>
|
||||
See the README file for details. *)
|
||||
|
||||
open Fw_utils
|
||||
open Packet
|
||||
open Lwt.Infix
|
||||
|
||||
@ -32,7 +31,7 @@ let transmit_ipv4 packet iface =
|
||||
Log.warn (fun f -> f "Failed to write packet to %a: %s"
|
||||
Ipaddr.V4.pp iface#other_ip
|
||||
(Printexc.to_string ex));
|
||||
Lwt.return ()
|
||||
Lwt.return_unit
|
||||
)
|
||||
)
|
||||
(fun ex ->
|
||||
@ -40,7 +39,7 @@ let transmit_ipv4 packet iface =
|
||||
(Printexc.to_string ex)
|
||||
Nat_packet.pp packet
|
||||
);
|
||||
Lwt.return ()
|
||||
Lwt.return_unit
|
||||
)
|
||||
|
||||
let forward_ipv4 t packet =
|
||||
@ -127,19 +126,19 @@ let add_nat_and_forward_ipv4 t packet =
|
||||
| Ok packet -> forward_ipv4 t packet
|
||||
| Error e ->
|
||||
Log.warn (fun f -> f "Failed to add NAT rewrite rule: %s (%a)" e pp_header packet);
|
||||
Lwt.return ()
|
||||
Lwt.return_unit
|
||||
|
||||
(* Add a NAT rule to redirect this conversation to [host:port] instead of us. *)
|
||||
let nat_to t ~host ~port packet =
|
||||
match Router.resolve t host with
|
||||
| Ipaddr.V6 _ -> Log.warn (fun f -> f "Cannot NAT with IPv6"); Lwt.return ()
|
||||
| Ipaddr.V6 _ -> Log.warn (fun f -> f "Cannot NAT with IPv6"); Lwt.return_unit
|
||||
| Ipaddr.V4 target ->
|
||||
let xl_host = t.Router.uplink#my_ip in
|
||||
My_nat.add_nat_rule_and_translate t.Router.nat ~xl_host (`Redirect (target, port)) packet >>= function
|
||||
| Ok packet -> forward_ipv4 t packet
|
||||
| Error e ->
|
||||
Log.warn (fun f -> f "Failed to add NAT redirect rule: %s (%a)" e pp_header packet);
|
||||
Lwt.return ()
|
||||
Lwt.return_unit
|
||||
|
||||
(* Handle incoming packets *)
|
||||
|
||||
@ -150,12 +149,12 @@ let apply_rules t rules ~dst info =
|
||||
| `Accept, (`External _ | `NetVM) -> transmit_ipv4 packet t.Router.uplink
|
||||
| `Accept, `Firewall ->
|
||||
Log.warn (fun f -> f "Bad rule: firewall can't accept packets %a" (pp_packet t) info);
|
||||
return ()
|
||||
Lwt.return_unit
|
||||
| `NAT, _ -> add_nat_and_forward_ipv4 t packet
|
||||
| `NAT_to (host, port), _ -> nat_to t packet ~host ~port
|
||||
| `Drop reason, _ ->
|
||||
Log.info (fun f -> f "Dropped packet (%s) %a" reason (pp_packet t) info);
|
||||
return ()
|
||||
Lwt.return_unit
|
||||
|
||||
let handle_low_memory t =
|
||||
match Memory_pressure.status () with
|
||||
@ -167,7 +166,7 @@ let handle_low_memory t =
|
||||
|
||||
let ipv4_from_client t ~src packet =
|
||||
handle_low_memory t >>= function
|
||||
| `Memory_critical -> return ()
|
||||
| `Memory_critical -> Lwt.return_unit
|
||||
| `Ok ->
|
||||
(* Check for existing NAT entry for this packet *)
|
||||
translate t packet >>= function
|
||||
@ -177,23 +176,23 @@ let ipv4_from_client t ~src packet =
|
||||
let `IPv4 (ip, _transport) = packet in
|
||||
let dst = Router.classify t (Ipaddr.V4 ip.Ipv4_packet.dst) in
|
||||
match classify ~src:(resolve_client src) ~dst:(resolve_host dst) packet with
|
||||
| None -> return ()
|
||||
| None -> Lwt.return_unit
|
||||
| Some info -> apply_rules t Rules.from_client ~dst info
|
||||
|
||||
let ipv4_from_netvm t packet =
|
||||
handle_low_memory t >>= function
|
||||
| `Memory_critical -> return ()
|
||||
| `Memory_critical -> Lwt.return_unit
|
||||
| `Ok ->
|
||||
let `IPv4 (ip, _transport) = packet in
|
||||
let src = Router.classify t (Ipaddr.V4 ip.Ipv4_packet.src) in
|
||||
let dst = Router.classify t (Ipaddr.V4 ip.Ipv4_packet.dst) in
|
||||
match classify ~src ~dst:(resolve_host dst) packet with
|
||||
| None -> return ()
|
||||
| None -> Lwt.return_unit
|
||||
| Some info ->
|
||||
match src with
|
||||
| `Client _ | `Firewall ->
|
||||
Log.warn (fun f -> f "Frame from NetVM has internal source IP address! %a" (pp_packet t) info);
|
||||
return ()
|
||||
Lwt.return_unit
|
||||
| `External _ | `NetVM as src ->
|
||||
translate t packet >>= function
|
||||
| Some frame -> forward_ipv4 t frame
|
||||
|
@ -41,9 +41,6 @@ let error fmt =
|
||||
let err s = Failure s in
|
||||
Printf.ksprintf err fmt
|
||||
|
||||
let return = Lwt.return
|
||||
let fail = Lwt.fail
|
||||
|
||||
let or_raise msg pp = function
|
||||
| Ok x -> x
|
||||
| Error e -> failwith (Fmt.strf "%s: %a" msg pp e)
|
||||
|
@ -46,7 +46,7 @@ module Main (Clock : Mirage_clock_lwt.MCLOCK) = struct
|
||||
(fun `Cant_happen -> assert false)
|
||||
(fun ex ->
|
||||
Log.warn (fun f -> f "GUI thread failed: %s" (Printexc.to_string ex));
|
||||
return ()
|
||||
Lwt.return_unit
|
||||
)
|
||||
)
|
||||
|
||||
@ -70,7 +70,7 @@ module Main (Clock : Mirage_clock_lwt.MCLOCK) = struct
|
||||
(* Watch for shutdown requests from Qubes *)
|
||||
let shutdown_rq =
|
||||
OS.Lifecycle.await_shutdown_request () >>= fun (`Poweroff | `Reboot) ->
|
||||
return () in
|
||||
Lwt.return_unit in
|
||||
(* Set up networking *)
|
||||
let max_entries = Key_gen.nat_table_size () in
|
||||
My_nat.create ~max_entries >>= fun nat ->
|
||||
|
@ -46,12 +46,12 @@ module Make(Clock : Mirage_clock_lwt.MCLOCK) = struct
|
||||
Lwt.return_unit
|
||||
| Error e ->
|
||||
Log.warn (fun f -> f "Ignored unknown IPv4 message from uplink: %a" Nat_packet.pp_error e);
|
||||
Lwt.return ()
|
||||
Lwt.return_unit
|
||||
| Ok None -> Lwt.return_unit
|
||||
| Ok (Some packet) ->
|
||||
Firewall.ipv4_from_netvm router packet
|
||||
)
|
||||
~ipv6:(fun _ip -> return ())
|
||||
~ipv6:(fun _ip -> Lwt.return_unit)
|
||||
frame
|
||||
) >|= or_raise "Uplink listen loop" Netif.pp_error
|
||||
|
||||
@ -70,5 +70,5 @@ module Make(Clock : Mirage_clock_lwt.MCLOCK) = struct
|
||||
~my_ip:ip
|
||||
~other_ip:config.Dao.uplink_netvm_ip in
|
||||
let fragments = Fragments.Cache.create (256 * 1024) in
|
||||
return { net; eth; arp; interface ; fragments }
|
||||
Lwt.return { net; eth; arp; interface ; fragments }
|
||||
end
|
||||
|
Loading…
x
Reference in New Issue
Block a user