2 | Join the project community on our server!
3 |
4 |
5 |
6 |
7 |
9 | 10 |
11 | 
12 |
13 | 
14 | 
15 |
", user.Verification) + 46 | fmt.Sprintf("The address %s tried to login to your shieldwall account, "+ 47 | "if that wasn't you, you should change your credentials immediately.", client) 48 | 49 | if err = api.sendmail.Send(api.mail.From, user.Email, emailSubject, emailBody); err != nil { 50 | log.Error("error sending verification email to %s: %v", user.Email, err) 51 | ERROR(w, http.StatusInternalServerError, fmt.Errorf("error sending verification email")) 52 | return 53 | } else { 54 | log.Debug("verification email sent to %s (%s)", user.Email, user.Verification) 55 | } 56 | } 57 | 58 | JSON(w, http.StatusOK, UserResponse{ 59 | Token: token, 60 | User: user, 61 | Address: client, 62 | }) 63 | } 64 | } 65 | 66 | func (api *API) authorizedForStep2(w http.ResponseWriter, r *http.Request) *database.User { 67 | client := clientIP(r) 68 | tokenHeader := reqToken(r) 69 | if tokenHeader == "" { 70 | log.Debug("unauthenticated request from %s", client) 71 | ERROR(w, http.StatusUnauthorized, ErrUnauthorized) 72 | return nil 73 | } 74 | 75 | claims, err := api.validateToken(tokenHeader) 76 | if err != nil && err != ErrToken2FA { 77 | log.Warning("token error for %s: %v", client, err) 78 | ERROR(w, http.StatusUnauthorized, ErrUnauthorized) 79 | return nil 80 | } 81 | 82 | log.Debug("user claims for step2: %#v", claims) 83 | user, err := database.FindUserByID(int(claims["user_id"].(float64))) 84 | if err != nil { 85 | ERROR(w, http.StatusUnauthorized, err) 86 | return nil 87 | } else if user == nil { 88 | log.Warning("client %s tried to authenticated with unknown claims '%v'", client, claims) 89 | ERROR(w, http.StatusUnauthorized, ErrUnauthorized) 90 | return nil 91 | } 92 | 93 | user.Address = client 94 | return user 95 | } 96 | 97 | func (api *API) UserSecondStep(w http.ResponseWriter, r *http.Request) { 98 | if user := api.authorizedForStep2(w, r); user != nil { 99 | var req Step2Request 100 | 101 | defer r.Body.Close() 102 | 103 | client := clientIP(r) 104 | reader := io.LimitReader(r.Body, api.config.ReqMaxSize) 105 | decoder := json.NewDecoder(reader) 106 | 107 | err := decoder.Decode(&req) 108 | if err != nil { 109 | log.Warning("[%s] error decoding user step2 request: %v", client, err) 110 | JSON(w, http.StatusBadRequest, nil) 111 | return 112 | } 113 | 114 | if req.Code != user.Verification { 115 | log.Warning("[%s] wrong code %s", client, req.Code) 116 | JSON(w, http.StatusForbidden, nil) 117 | return 118 | } 119 | 120 | if token, err := api.tokenFor(user, true); err != nil { 121 | log.Error("error creating token for user %d: %v", user.ID, err) 122 | ERROR(w, http.StatusInternalServerError, err) 123 | return 124 | } else { 125 | JSON(w, http.StatusOK, UserResponse{ 126 | Token: token, 127 | User: user, 128 | Address: client, 129 | }) 130 | } 131 | } else { 132 | JSON(w, http.StatusForbidden, nil) 133 | } 134 | } 135 | -------------------------------------------------------------------------------- /api/user_register.go: -------------------------------------------------------------------------------- 1 | package api 2 | 3 | import ( 4 | "encoding/json" 5 | "fmt" 6 | "github.com/evilsocket/islazy/log" 7 | "github.com/evilsocket/shieldwall/database" 8 | "io" 9 | "net/http" 10 | ) 11 | 12 | func (api *API) UserRegister(w http.ResponseWriter, r *http.Request) { 13 | if api.config.AllowNewUsers == false { 14 | ERROR(w, http.StatusLocked, fmt.Errorf("apologies, registrations are closed at the moment")) 15 | return 16 | } 17 | 18 | var req UserRegisterRequest 19 | 20 | defer r.Body.Close() 21 | 22 | client := clientIP(r) 23 | reader := io.LimitReader(r.Body, api.config.ReqMaxSize) 24 | decoder := json.NewDecoder(reader) 25 | 26 | err := decoder.Decode(&req) 27 | if err != nil { 28 | log.Warning("[%s] error decoding user registration request: %v", client, err) 29 | JSON(w, http.StatusBadRequest, nil) 30 | return 31 | } 32 | 33 | user, err := database.RegisterUser(client, req.Email, req.Password) 34 | if err != nil { 35 | log.Debug("[%s] %v", client, err) 36 | ERROR(w, http.StatusBadRequest, err) 37 | return 38 | } 39 | 40 | log.Info("[%s] registered new user %s", user.Address, user.Email) 41 | 42 | // prepare and send verification email 43 | link := fmt.Sprintf("%s/#/verify/%s", api.config.URL, user.Verification) 44 | 45 | emailSubject := "shieldwall.me account verification" 46 | emailBody := "Follow this link to complete your registration.
" + 47 | fmt.Sprintf("%s", link, link) 48 | 49 | if err = api.sendmail.Send(api.mail.From, user.Email, emailSubject, emailBody); err != nil { 50 | log.Error("error sending verification email to %s: %v", user.Email, err) 51 | } else { 52 | log.Debug("verification email sent to %s (%s)", user.Email, user.Verification) 53 | } 54 | 55 | JSON(w, http.StatusOK, "registration successful, proceed to email verification") 56 | } -------------------------------------------------------------------------------- /api/user_update.go: -------------------------------------------------------------------------------- 1 | package api 2 | 3 | import ( 4 | "encoding/json" 5 | "github.com/evilsocket/islazy/log" 6 | "github.com/evilsocket/shieldwall/database" 7 | "io" 8 | "net/http" 9 | ) 10 | 11 | 12 | func (api *API) UserUpdate(w http.ResponseWriter, r *http.Request) { 13 | if user := api.authorized(w, r); user != nil { 14 | defer r.Body.Close() 15 | 16 | var req UserUpdateRequest 17 | 18 | client := clientIP(r) 19 | reader := io.LimitReader(r.Body, api.config.ReqMaxSize) 20 | decoder := json.NewDecoder(reader) 21 | 22 | if err := decoder.Decode(&req); err != nil { 23 | log.Warning("[%s] error decoding user update request: %v", client, err) 24 | JSON(w, http.StatusBadRequest, nil) 25 | return 26 | } 27 | 28 | if _, err := database.UpdateUser(user, client, req.NewPassword, req.Use2FA); err != nil { 29 | log.Debug("[%s] %v", client, err) 30 | ERROR(w, http.StatusBadRequest, err) 31 | return 32 | } 33 | 34 | token, err := api.tokenFor(user, !user.Use2FA) 35 | if err != nil { 36 | log.Error("error updating token for user %d: %v", user.ID, err) 37 | } 38 | 39 | JSON(w, http.StatusOK, UserResponse{ 40 | Token: token, 41 | User: user, 42 | Address: client, 43 | }) 44 | } else { 45 | JSON(w, http.StatusForbidden, nil) 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /api/user_verify.go: -------------------------------------------------------------------------------- 1 | package api 2 | 3 | import ( 4 | "github.com/evilsocket/shieldwall/database" 5 | "github.com/go-chi/chi" 6 | "net/http" 7 | ) 8 | 9 | func (api *API) UserVerify(w http.ResponseWriter, r *http.Request) { 10 | code := chi.URLParam(r, "verification") 11 | if code == "" { 12 | JSON(w, http.StatusBadRequest, nil) 13 | return 14 | } 15 | 16 | if err := database.VerifyUser(code); err != nil { 17 | JSON(w, http.StatusBadRequest, err) 18 | return 19 | } 20 | 21 | JSON(w, http.StatusOK, "user successfully verified") 22 | } -------------------------------------------------------------------------------- /api/utils.go: -------------------------------------------------------------------------------- 1 | package api 2 | 3 | import ( 4 | "encoding/json" 5 | "errors" 6 | "net/http" 7 | "strconv" 8 | "strings" 9 | 10 | "github.com/evilsocket/islazy/log" 11 | ) 12 | 13 | var ( 14 | ErrEmpty = errors.New("") 15 | ErrUnauthorized = errors.New("unauthorized") 16 | ErrMessageNotFound = errors.New("record not found") 17 | ) 18 | 19 | func strParam(r *http.Request, name string, def string) string { 20 | param := r.URL.Query().Get(name) 21 | if param != "" { 22 | return param 23 | } 24 | return def 25 | } 26 | 27 | func floatParam(r *http.Request, name string, def float32) float32 { 28 | param := r.URL.Query().Get(name) 29 | if param != "" { 30 | if v, err := strconv.ParseFloat(param, 32); err != nil { 31 | log.Warning("can't parse %s parameter from value '%s'", name, param) 32 | } else { 33 | return float32(v) 34 | } 35 | } 36 | return def 37 | } 38 | 39 | func boolParam(r *http.Request, name string, def bool) bool { 40 | param := r.URL.Query().Get(name) 41 | if param != "" { 42 | if v, err := strconv.ParseBool(param); err != nil { 43 | log.Warning("can't parse %s parameter from value '%s'", name, param) 44 | } else { 45 | return v 46 | } 47 | } 48 | return def 49 | } 50 | 51 | func intParam(r *http.Request, name string, def int) int { 52 | param := r.URL.Query().Get(name) 53 | if param != "" { 54 | if v, err := strconv.ParseInt(param, 10, 32); err != nil { 55 | log.Warning("can't parse %s parameter from value '%s'", name, param) 56 | } else { 57 | return int(v) 58 | } 59 | } 60 | return def 61 | } 62 | 63 | func clientIP(r *http.Request) string { 64 | address := strings.Split(r.RemoteAddr, ":")[0] 65 | if forwardedFor := r.Header.Get("X-Forwarded-For"); forwardedFor != "" { 66 | address = forwardedFor 67 | } 68 | // https://support.cloudflare.com/hc/en-us/articles/206776727-What-is-True-Client-IP- 69 | if trueClient := r.Header.Get("True-Client-IP"); trueClient != "" { 70 | address = trueClient 71 | } 72 | // handle multiple IPs case 73 | return strings.Trim(strings.Split(address, ",")[0], " ") 74 | } 75 | 76 | func reqToken(r *http.Request) string { 77 | keys := r.URL.Query() 78 | token := keys.Get("token") 79 | if token != "" { 80 | return token 81 | } 82 | bearerToken := r.Header.Get("Authorization") 83 | if parts := strings.Split(bearerToken, " "); len(parts) == 2 { 84 | return parts[1] 85 | } 86 | return "" 87 | } 88 | 89 | func pageNum(r *http.Request) (int, error) { 90 | pageParam := r.URL.Query().Get("p") 91 | if pageParam == "" { 92 | pageParam = "1" 93 | } 94 | return strconv.Atoi(pageParam) 95 | } 96 | 97 | func JSON(w http.ResponseWriter, statusCode int, data interface{}) { 98 | js, err := json.Marshal(data) 99 | if err != nil { 100 | http.Error(w, err.Error(), http.StatusInternalServerError) 101 | return 102 | } 103 | 104 | w.Header().Set("Content-Type", "application/json") 105 | w.WriteHeader(statusCode) 106 | 107 | if _, err = w.Write(js); err != nil { 108 | log.Error("error sending response: %v", err) 109 | } else { 110 | // log.Debug("sent %d bytes of json response", sent) 111 | } 112 | } 113 | 114 | func ERROR(w http.ResponseWriter, statusCode int, err error) { 115 | if err != nil { 116 | JSON(w, statusCode, struct { 117 | Error string `json:"error"` 118 | }{ 119 | Error: err.Error(), 120 | }) 121 | return 122 | } 123 | JSON(w, http.StatusBadRequest, nil) 124 | } 125 | -------------------------------------------------------------------------------- /cmd/agent/api.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "encoding/json" 5 | "fmt" 6 | "github.com/evilsocket/islazy/log" 7 | "github.com/evilsocket/shieldwall/firewall" 8 | "github.com/evilsocket/shieldwall/version" 9 | "net/http" 10 | "runtime" 11 | "strings" 12 | "time" 13 | ) 14 | 15 | // API client 16 | type API struct { 17 | config APIConfig 18 | } 19 | 20 | func NewAPI(config APIConfig) *API { 21 | return &API{ 22 | config: config, 23 | } 24 | } 25 | 26 | func (a API) FetchRules() ([]firewall.Rule, error) { 27 | client := &http.Client{} 28 | if a.config.Timeout > 0 { 29 | client.Timeout = time.Duration(a.config.Timeout) * time.Second 30 | } 31 | 32 | if strings.Index(a.config.Server, "://") == -1 { 33 | a.config.Server = "https://" + a.config.Server 34 | } 35 | url := fmt.Sprintf("%s/api/v1/rules", a.config.Server) 36 | 37 | log.Debug("polling %s", url) 38 | 39 | req, err := http.NewRequest("GET", url, nil) 40 | if err != nil { 41 | return nil, err 42 | } 43 | 44 | // agent authentication 45 | req.Header.Set("X-ShieldWall-Agent-Token", a.config.Token) 46 | req.Header.Set("User-Agent", fmt.Sprintf( 47 | "ShieldWall Agent v%s (%s %s)", 48 | version.Version, 49 | runtime.GOOS, 50 | runtime.GOARCH)) 51 | 52 | res, err := client.Do(req) 53 | if err != nil { 54 | return nil, err 55 | } 56 | defer res.Body.Close() 57 | 58 | if res.StatusCode != http.StatusOK { 59 | return nil, fmt.Errorf("%d (%s)", res.StatusCode, res.Status) 60 | } 61 | 62 | var rules []firewall.Rule 63 | if err = json.NewDecoder(res.Body).Decode(&rules); err != nil { 64 | return nil, err 65 | } 66 | 67 | return rules, nil 68 | } 69 | -------------------------------------------------------------------------------- /cmd/agent/config.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "github.com/evilsocket/shieldwall/firewall" 5 | "gopkg.in/yaml.v2" 6 | "io/ioutil" 7 | ) 8 | 9 | type APIConfig struct { 10 | // api server hostname 11 | Server string `yaml:"server"` 12 | // auth token 13 | Token string `yaml:"token"` 14 | // api polling period 15 | Period int `yaml:"period"` 16 | // api timeout 17 | Timeout int `yaml:"timeout"` 18 | } 19 | 20 | type Config struct { 21 | // TODO: refactor to support different firewalls 22 | IPTablesPath string `yaml:"iptables"` 23 | // where lists are stored 24 | DataPath string `yaml:"data"` 25 | // list of addresses to pre allow 26 | Allow []string `yaml:"allow"` 27 | // check for newer versions and self update the agent 28 | Update bool `yaml:"update"` 29 | // dropped packet logging 30 | Drops firewall.DropConfig `yaml:"drops"` 31 | // api config 32 | API APIConfig `yaml:"api"` 33 | } 34 | 35 | func LoadAgentConfig(fileName string) (*Config, error) { 36 | raw, err := ioutil.ReadFile(fileName) 37 | if err != nil { 38 | return nil, err 39 | } 40 | 41 | conf := Config{} 42 | 43 | err = yaml.Unmarshal(raw, &conf) 44 | if err != nil { 45 | return nil, err 46 | } 47 | 48 | return &conf, nil 49 | } 50 | -------------------------------------------------------------------------------- /cmd/agent/main.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "crypto/sha256" 5 | "encoding/json" 6 | "flag" 7 | "fmt" 8 | "github.com/evilsocket/islazy/log" 9 | "github.com/evilsocket/shieldwall/firewall" 10 | "github.com/evilsocket/shieldwall/version" 11 | "os" 12 | "os/signal" 13 | "sort" 14 | "syscall" 15 | "time" 16 | ) 17 | 18 | var ( 19 | err = (error)(nil) 20 | conf = (* Config)(nil) 21 | state = (*State)(nil) 22 | signals = make(chan os.Signal, 1) 23 | ) 24 | 25 | func signalHandler() { 26 | signal.Notify(signals, syscall.SIGINT, syscall.SIGTERM) 27 | s := <-signals 28 | log.Raw("\n") 29 | log.Warning("RECEIVED SIGNAL: %s", s) 30 | os.Exit(1) 31 | } 32 | 33 | func addAllowRules(s *State) { 34 | for _, address := range conf.Allow { 35 | state.Rules = append(state.Rules, firewall.Rule{ 36 | Type: firewall.RuleAllow, 37 | Address: address, 38 | Protocol: firewall.ProtoAll, 39 | Ports: []string{firewall.AllPorts}, 40 | }) 41 | } 42 | } 43 | 44 | func hashObject(v interface{}) (string, error) { 45 | if raw, err := json.Marshal(v); err != nil { 46 | return "", err 47 | } else { 48 | return fmt.Sprintf("%x", sha256.Sum256(raw)), nil 49 | } 50 | } 51 | 52 | func rulesHash(rules []firewall.Rule) string { 53 | // make sure the order is always the same 54 | sort.Slice(rules, func(i, j int) bool { 55 | return rules[i].CreatedAt.Before(rules[j].CreatedAt) 56 | }) 57 | hash, err := hashObject(rules) 58 | if err != nil { 59 | log.Warning("can't hash rules: %v", err) 60 | } 61 | return hash 62 | } 63 | 64 | func main() { 65 | flag.Parse() 66 | 67 | if showVersion { 68 | fmt.Printf("shiedwall agent v%s\n", version.Version) 69 | return 70 | } 71 | 72 | setupLogging() 73 | go signalHandler() 74 | 75 | log.Info("shieldwall agent v%s", version.Version) 76 | 77 | // load configuration 78 | if conf, err = LoadAgentConfig(confFile); err != nil { 79 | log.Fatal("error reading %s: %v", confFile, err) 80 | } 81 | 82 | // initialize firewall 83 | if err = firewall.SetPath(conf.IPTablesPath); err != nil { 84 | log.Fatal("%v", err) 85 | } 86 | 87 | // load saved state and run rules 88 | if state, err = LoadState(conf.DataPath); err != nil { 89 | log.Warning("%v", err) 90 | } 91 | 92 | // new state, add the entries allowed by configuration 93 | if len(state.Rules) == 0 && len(conf.Allow) > 0 { 94 | addAllowRules(state) 95 | } 96 | 97 | // apply previous rules from the saved state 98 | if err = firewall.Apply(state.Rules, conf.Drops); err != nil { 99 | log.Fatal("%v", err) 100 | } 101 | 102 | if conf.Update { 103 | go updater() 104 | } 105 | 106 | api := NewAPI(conf.API) 107 | // main loop 108 | for { 109 | prevHash := rulesHash(state.Rules) 110 | if rules, err := api.FetchRules(); err != nil { 111 | log.Error("error polling api: %v", err) 112 | } else { 113 | state.Rules = rules 114 | if len(conf.Allow) > 0 { 115 | addAllowRules(state) 116 | } 117 | newHash := rulesHash(state.Rules) 118 | if prevHash != newHash { 119 | log.Info("applying %d rules", len(state.Rules)) 120 | if err = firewall.Apply(state.Rules, conf.Drops); err != nil { 121 | log.Fatal("%v", err) 122 | } 123 | } else { 124 | log.Debug("no changes") 125 | } 126 | } 127 | 128 | if err = state.Save(conf.DataPath); err != nil { 129 | log.Error("error saving state to %s: %v", conf.DataPath, err) 130 | } else { 131 | log.Debug("state saved to %s", conf.DataPath) 132 | } 133 | 134 | time.Sleep(time.Second * time.Duration(conf.API.Period)) 135 | } 136 | } 137 | -------------------------------------------------------------------------------- /cmd/agent/setup.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "flag" 5 | "github.com/evilsocket/islazy/log" 6 | "github.com/evilsocket/shieldwall/firewall" 7 | "time" 8 | ) 9 | 10 | var ( 11 | confFile = "" 12 | debug = false 13 | showVersion = false 14 | logfile = "" 15 | updateCheckPeriod = time.Duration(10) * time.Minute 16 | ) 17 | 18 | func init() { 19 | flag.StringVar(&confFile, "config", "/etc/shieldwall/config.yaml", "YAML configuration file.") 20 | flag.BoolVar(&debug, "debug", debug, "Enable debug logs.") 21 | flag.StringVar(&logfile, "log", logfile, "Log messages to this file instead of standard error.") 22 | flag.DurationVar(&updateCheckPeriod, "update-check-period", updateCheckPeriod, "Self update polling period.") 23 | 24 | flag.BoolVar(&showVersion, "version", showVersion, "Show version and exit.") 25 | flag.BoolVar(&firewall.DryRun, "dry-run", firewall.DryRun, "Do not execute firewall commands.") 26 | } 27 | 28 | func setupLogging() { 29 | if logfile != "" { 30 | log.Output = logfile 31 | } 32 | 33 | if debug == true { 34 | log.Level = log.DEBUG 35 | } else { 36 | log.Level = log.INFO 37 | } 38 | 39 | log.DateFormat = "06-Jan-02" 40 | log.TimeFormat = "15:04:05" 41 | log.DateTimeFormat = "2006-01-02 15:04:05" 42 | log.Format = "{datetime} {level:color}{level:name}{reset} {message}" 43 | 44 | if err := log.Open(); err != nil { 45 | panic(err) 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /cmd/agent/state.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "encoding/json" 5 | "fmt" 6 | "github.com/evilsocket/islazy/fs" 7 | "github.com/evilsocket/islazy/log" 8 | "github.com/evilsocket/shieldwall/firewall" 9 | "io/ioutil" 10 | "os" 11 | "path/filepath" 12 | "time" 13 | ) 14 | 15 | const stateFileName = "state.json" 16 | 17 | type State struct { 18 | UpdatedAt time.Time `json:"updated_at"` 19 | Rules []firewall.Rule `json:"rules"` 20 | } 21 | 22 | func LoadState(path string) (*State, error) { 23 | state := State { 24 | UpdatedAt: time.Now(), 25 | } 26 | 27 | if !fs.Exists(path) { 28 | log.Info("creating %s", path) 29 | if err := os.MkdirAll(path, os.ModePerm); err != nil { 30 | return &state, err 31 | } 32 | } 33 | 34 | fileName := filepath.Join(path, stateFileName) 35 | if !fs.Exists(fileName) { 36 | log.Debug("%s doesn't exist, returning initial state", fileName) 37 | return &state, nil 38 | } 39 | 40 | log.Debug("loading state from %s ...", fileName) 41 | 42 | raw, err := ioutil.ReadFile(fileName) 43 | if err != nil { 44 | return &state, fmt.Errorf("error reading %s: %v", fileName, err) 45 | } 46 | 47 | if err = json.Unmarshal(raw, &state); err != nil { 48 | return &state, fmt.Errorf("error decoding %s: %v", fileName, err) 49 | } 50 | 51 | return &state, nil 52 | } 53 | 54 | func (s *State) Save(path string) error { 55 | s.UpdatedAt = time.Now() 56 | raw, err := json.MarshalIndent(s, "", " ") 57 | if err != nil { 58 | return err 59 | } 60 | return ioutil.WriteFile(filepath.Join(path, stateFileName), raw, os.ModePerm) 61 | } -------------------------------------------------------------------------------- /cmd/agent/updater.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "archive/tar" 5 | "compress/gzip" 6 | "fmt" 7 | "github.com/evilsocket/islazy/log" 8 | "github.com/evilsocket/shieldwall/version" 9 | "io" 10 | "net/http" 11 | "os" 12 | "os/exec" 13 | "path/filepath" 14 | "regexp" 15 | "runtime" 16 | "syscall" 17 | "time" 18 | ) 19 | 20 | // Untar takes a destination path and a reader; a tar reader loops over the tarfile 21 | // creating the file structure at 'dst' along the way, and writing any files 22 | // credits to https://medium.com/@skdomino/taring-untaring-files-in-go-6b07cf56bc07 23 | func Untar(dst string, r io.Reader) error { 24 | 25 | gzr, err := gzip.NewReader(r) 26 | if err != nil { 27 | return err 28 | } 29 | defer gzr.Close() 30 | 31 | tr := tar.NewReader(gzr) 32 | 33 | for { 34 | header, err := tr.Next() 35 | 36 | switch { 37 | 38 | // if no more files are found return 39 | case err == io.EOF: 40 | return nil 41 | 42 | // return any other error 43 | case err != nil: 44 | return err 45 | 46 | // if the header is nil, just skip it (not sure how this happens) 47 | case header == nil: 48 | continue 49 | } 50 | 51 | // the target location where the dir/file should be created 52 | target := filepath.Join(dst, header.Name) 53 | 54 | // the following switch could also be done using fi.Mode(), not sure if there 55 | // a benefit of using one vs. the other. 56 | // fi := header.FileInfo() 57 | 58 | // check the file type 59 | switch header.Typeflag { 60 | 61 | // if its a dir and it doesn't exist create it 62 | case tar.TypeDir: 63 | if _, err := os.Stat(target); err != nil { 64 | if err := os.MkdirAll(target, 0755); err != nil { 65 | return err 66 | } 67 | } 68 | 69 | // if it's a file create it 70 | case tar.TypeReg: 71 | f, err := os.OpenFile(target, os.O_CREATE|os.O_RDWR, os.FileMode(header.Mode)) 72 | if err != nil { 73 | return err 74 | } 75 | 76 | // copy over contents 77 | if _, err := io.Copy(f, tr); err != nil { 78 | return err 79 | } 80 | 81 | // manually close here after each file operation; defering would cause each file close 82 | // to wait until all operations have completed. 83 | f.Close() 84 | } 85 | } 86 | } 87 | 88 | var ( 89 | repo = "evilsocket/shieldwall" 90 | extractTo = "/tmp/shieldwall/" 91 | installer = filepath.Join(extractTo, "update.sh") 92 | versionParser = regexp.MustCompile("^https://github\\.com/" + repo + "/releases/tag/v([\\d\\.a-z]+)$") 93 | ) 94 | 95 | func updater() { 96 | log.Info("update checker started with a %s period", updateCheckPeriod) 97 | 98 | noRedirectClient := &http.Client{ 99 | CheckRedirect: func(req *http.Request, via []*http.Request) error { 100 | return http.ErrUseLastResponse 101 | }, 102 | } 103 | 104 | url := "https://github.com/" + repo + "/releases/latest" 105 | for { 106 | log.Debug("checking for updates %s", url) 107 | 108 | req, _ := http.NewRequest("GET", url, nil) 109 | resp, err := noRedirectClient.Do(req) 110 | if err != nil { 111 | log.Error("error while checking latest version: %v", err) 112 | continue 113 | } 114 | defer resp.Body.Close() 115 | 116 | location := resp.Header.Get("Location") 117 | 118 | log.Debug("location header = '%s'", location) 119 | 120 | m := versionParser.FindStringSubmatch(location) 121 | if len(m) == 2 { 122 | latest := m[1] 123 | log.Debug("latest version is '%s'", latest) 124 | if version.Version != latest { 125 | filename := fmt.Sprintf("shieldwall-agent_%s_linux_%s.tar.gz", 126 | latest, 127 | runtime.GOARCH) 128 | 129 | update := fmt.Sprintf("https://github.com/%s/releases/download/v%s/%s", 130 | repo, 131 | latest, 132 | filename) 133 | 134 | log.Important("downloading update to %s from %s", latest, update) 135 | 136 | tmpFileName := filepath.Join("/tmp/", filename) 137 | out, err := os.Create(tmpFileName) 138 | if err != nil { 139 | log.Error("error creating %s: %v", tmpFileName, err) 140 | continue 141 | } 142 | 143 | start := time.Now() 144 | resp, err := http.Get(update) 145 | defer resp.Body.Close() 146 | if err != nil { 147 | out.Close() 148 | log.Error("error downloading %s: %v", tmpFileName, err) 149 | continue 150 | } 151 | 152 | written, err := io.Copy(out, resp.Body) 153 | out.Close() 154 | 155 | if err != nil { 156 | log.Error("error writing to %s: %v", tmpFileName, err) 157 | continue 158 | } 159 | 160 | log.Debug("downloaded %d bytes to %s in %s", written, tmpFileName, time.Since(start)) 161 | 162 | start = time.Now() 163 | 164 | if out, err = os.Open(tmpFileName); err != nil { 165 | log.Error("error opening %s: %v", tmpFileName, err) 166 | continue 167 | } else if err = os.MkdirAll(extractTo, os.ModePerm); err != nil { 168 | out.Close() 169 | log.Error("error creating folder %s: %v", extractTo, err) 170 | continue 171 | } else if err = Untar(extractTo, out); err != nil { 172 | out.Close() 173 | log.Error("error extracting %s to %s: %v", tmpFileName, extractTo, err) 174 | continue 175 | } 176 | out.Close() 177 | 178 | log.Debug("extracted in %s", time.Since(start)) 179 | 180 | log.Info("running installer at %s", installer) 181 | 182 | cmd := exec.Command(installer) 183 | cmd.Dir = extractTo 184 | cmd.Env = os.Environ() 185 | // https://stackoverflow.com/questions/33165530/prevent-ctrlc-from-interrupting-exec-command-in-golang 186 | cmd.SysProcAttr = &syscall.SysProcAttr{ 187 | Setpgid: true, 188 | Pgid: 0, 189 | } 190 | if err = cmd.Start(); err != nil { 191 | log.Error("error starting the installer: %v", err) 192 | } else { 193 | log.Info("installer running as pid %d", cmd.Process.Pid) 194 | } 195 | } else { 196 | log.Debug("no updates available") 197 | } 198 | } else { 199 | log.Debug("unexpected location header: '%s'", location) 200 | } 201 | 202 | time.Sleep(updateCheckPeriod) 203 | } 204 | } 205 | -------------------------------------------------------------------------------- /cmd/api/config.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "github.com/evilsocket/shieldwall/api" 5 | "github.com/evilsocket/shieldwall/database" 6 | "github.com/ilyakaznacheev/cleanenv" 7 | ) 8 | 9 | type Config struct { 10 | Api api.Config `yaml:"api"` 11 | Email api.EmailConfig `yaml:"mail"` 12 | Database database.Config `yaml:"database"` 13 | } 14 | 15 | func LoadConfig(path string) (*Config, error) { 16 | config := Config{} 17 | 18 | if err := cleanenv.ReadConfig(path, &config); err != nil { 19 | return nil, err 20 | } 21 | 22 | return &config, nil 23 | } 24 | -------------------------------------------------------------------------------- /cmd/api/main.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "flag" 5 | "github.com/evilsocket/islazy/log" 6 | "github.com/evilsocket/shieldwall/api" 7 | "github.com/evilsocket/shieldwall/database" 8 | "github.com/evilsocket/shieldwall/mailer" 9 | "github.com/evilsocket/shieldwall/version" 10 | ) 11 | 12 | var ( 13 | err = (error)(nil) 14 | conf = (* Config)(nil) 15 | mail = (*mailer.Mailer)(nil) 16 | ) 17 | 18 | func main() { 19 | flag.Parse() 20 | 21 | setupLogging() 22 | 23 | log.Info("shieldwall api v%s", version.Version) 24 | 25 | if conf, err = LoadConfig(confFile); err != nil { 26 | log.Fatal("error reading %s: %v", confFile, err) 27 | } 28 | 29 | if mail, err = mailer.New(conf.Email.SMTP); err != nil { 30 | log.Fatal("error creating mailer: %v", err) 31 | } 32 | 33 | if err = database.Setup(conf.Database); err != nil { 34 | log.Fatal("error connecting to database: %v", err) 35 | } 36 | 37 | server := api.Setup(conf.Api, conf.Email, mail) 38 | 39 | server.Run() 40 | } 41 | -------------------------------------------------------------------------------- /cmd/api/setup.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "flag" 5 | "github.com/evilsocket/islazy/log" 6 | ) 7 | 8 | var ( 9 | confFile = "" 10 | debug = false 11 | logfile = "" 12 | ) 13 | 14 | func init() { 15 | flag.StringVar(&confFile, "config", "/etc/shieldwall/config.yaml", "YAML configuration file.") 16 | flag.BoolVar(&debug, "debug", debug, "Enable debug logs.") 17 | flag.StringVar(&logfile, "log", logfile, "Log messages to this file instead of standard error.") 18 | 19 | } 20 | 21 | func setupLogging() { 22 | if logfile != "" { 23 | log.Output = logfile 24 | } 25 | 26 | if debug == true { 27 | log.Level = log.DEBUG 28 | } else { 29 | log.Level = log.INFO 30 | } 31 | 32 | log.DateFormat = "06-Jan-02" 33 | log.TimeFormat = "15:04:05" 34 | log.DateTimeFormat = "2006-01-02 15:04:05" 35 | log.Format = "{datetime} {level:color}{level:name}{reset} {message}" 36 | 37 | if err := log.Open(); err != nil { 38 | panic(err) 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /database.example.env: -------------------------------------------------------------------------------- 1 | POSTGRES_USER=shieldwall 2 | POSTGRES_PASSWORD=shieldwall 3 | POSTGRES_DB=shieldwall -------------------------------------------------------------------------------- /database/agent.go: -------------------------------------------------------------------------------- 1 | package database 2 | 3 | import ( 4 | "errors" 5 | "fmt" 6 | "gorm.io/datatypes" 7 | "gorm.io/gorm" 8 | "time" 9 | ) 10 | 11 | type Agent struct { 12 | ID uint `gorm:"primarykey" json:"id"` 13 | CreatedAt time.Time `gorm:"index" json:"created_at"` 14 | UpdatedAt time.Time `gorm:"index" json:"updated_at"` 15 | SeenAt time.Time `gorm:"index" json:"seen_at"` 16 | DeletedAt gorm.DeletedAt `gorm:"index" json:"-"` 17 | UserID uint `gorm:"index" json:"-"` 18 | AlertAfter uint `gorm:"index" json:"alert_after"` 19 | AlertPeriod uint `gorm:"index" json:"alert_period"` 20 | AlertAt time.Time `gorm:"index" json:"alert_at"` 21 | Name string `json:"name"` 22 | Rules datatypes.JSON `sql:"type:jsonb" json:"rules"` 23 | Token string `gorm:"index" json:"token"` 24 | Address string `json:"address"` 25 | UserAgent string `json:"user_agent"` 26 | } 27 | 28 | func (a *Agent) Save() error { 29 | return db.Save(a).Error 30 | } 31 | 32 | func FindAgentByToken(token string) (*Agent, error) { 33 | var found Agent 34 | if err := db.Where("token=?", token).First(&found).Error; errors.Is(err, gorm.ErrRecordNotFound) { 35 | return nil, nil 36 | } else if err == nil { 37 | return &found, nil 38 | } else { 39 | return nil, err 40 | } 41 | } 42 | 43 | func FindAgentsForAlert() ([]*Agent, error) { 44 | var agents []*Agent 45 | query := "SELECT * FROM agents WHERE deleted_at IS NULL AND alert_after > 0 AND (seen_at IS NULL OR EXTRACT(EPOCH FROM current_timestamp-seen_at) >= alert_after)" 46 | err := db.Raw(query).Find(&agents).Error 47 | return agents, err 48 | } 49 | 50 | func RegisterAgent(fields *AgentWritableFields) (*Agent, error) { 51 | if err := fields.Validate(); err != nil { 52 | return nil, err 53 | } 54 | 55 | for i := range fields.Rules { 56 | fields.Rules[i].CreatedAt = time.Now() 57 | } 58 | 59 | newAgent := Agent{ 60 | UserID: fields.User.ID, 61 | Name: fields.Name, 62 | Token: makeRandomToken(), 63 | Rules: ToJSONB(fields.Rules), 64 | AlertAfter: fields.AlertAfter, 65 | AlertPeriod: fields.AlertPeriod, 66 | } 67 | 68 | if err := db.Create(&newAgent).Error; err != nil { 69 | return nil, fmt.Errorf("error creating new agent: %v", err) 70 | } 71 | 72 | return &newAgent, nil 73 | } 74 | 75 | func UpdateAgent(agent *Agent, fields *AgentWritableFields) error { 76 | // just to be sure 77 | fields.ID = agent.ID 78 | if err := fields.Validate(); err != nil { 79 | return err 80 | } 81 | 82 | for i, rule := range fields.Rules { 83 | if rule.TTL > 0 && rule.CreatedAt.IsZero() { 84 | fields.Rules[i].CreatedAt = time.Now() 85 | } 86 | } 87 | 88 | agent.Name = fields.Name 89 | agent.Rules = ToJSONB(fields.Rules) 90 | agent.UpdatedAt = time.Now() 91 | agent.AlertAfter = fields.AlertAfter 92 | agent.AlertPeriod = fields.AlertPeriod 93 | 94 | return db.Save(agent).Error 95 | } 96 | -------------------------------------------------------------------------------- /database/agent_fields.go: -------------------------------------------------------------------------------- 1 | package database 2 | 3 | import ( 4 | "fmt" 5 | "github.com/evilsocket/islazy/str" 6 | "github.com/evilsocket/shieldwall/firewall" 7 | ) 8 | 9 | const MinAgentNameLength = 3 10 | const MaxAgentRules = 100 11 | 12 | const MinAlertAfter = 30 // 30 seconds 13 | const MaxAlertAfter = 21600 // 6 hours 14 | 15 | const MinAlertPeriod = 1800 // 30 minutes 16 | const MaxAlertPeriod = 10800 // 3 hours 17 | 18 | type AgentWritableFields struct { 19 | ID uint 20 | Name string 21 | Rules []*firewall.Rule 22 | User *User 23 | AlertAfter uint 24 | AlertPeriod uint 25 | } 26 | 27 | func (f *AgentWritableFields) Validate() error { 28 | if f.Name = str.Trim(f.Name); len(f.Name) < MinAgentNameLength { 29 | return fmt.Errorf("agent name must be at least %d characters long", MinAgentNameLength) 30 | } 31 | 32 | if len(f.Rules) > MaxAgentRules { 33 | return fmt.Errorf("max %d rules per agent are allowed", MaxAgentRules) 34 | } 35 | 36 | if f.AlertAfter != 0 { 37 | if f.AlertAfter < MinAlertAfter { 38 | return fmt.Errorf("alert trigger time must be at least %d seconds", MinAlertAfter) 39 | } else if f.AlertAfter > MaxAlertAfter { 40 | return fmt.Errorf("alert trigger time must be at most %d seconds", MaxAlertAfter) 41 | } 42 | 43 | if f.AlertPeriod != 0 { 44 | if f.AlertPeriod < MinAlertPeriod { 45 | return fmt.Errorf("alert notification period must be at least %d seconds", MinAlertPeriod) 46 | } else if f.AlertPeriod > MaxAlertPeriod { 47 | return fmt.Errorf("alert notification period must be at most %d seconds", MaxAlertPeriod) 48 | } 49 | } 50 | } 51 | 52 | for _, rule := range f.Rules { 53 | if err := rule.Validate(); err != nil { 54 | return err 55 | } 56 | } 57 | 58 | var found Agent 59 | 60 | if f.ID == 0 { 61 | err := db.Where("name=?", f.Name).Where("user_id=?", f.User.ID).First(&found).Error 62 | if err == nil { 63 | return fmt.Errorf("agent name already used") 64 | } 65 | } else { 66 | err := db.Where("name=?", f.Name).Where("id != ?", f.ID).First(&found).Error 67 | if err == nil { 68 | return fmt.Errorf("agent name already used") 69 | } 70 | } 71 | 72 | return nil 73 | } 74 | -------------------------------------------------------------------------------- /database/config.go: -------------------------------------------------------------------------------- 1 | package database 2 | 3 | type Config struct { 4 | Hostname string `yaml:"host"` 5 | Port int `yaml:"port"` 6 | User string `yaml:"user"` 7 | Password string `yaml:"password"` 8 | Name string `yaml:"name"` 9 | } -------------------------------------------------------------------------------- /database/jsonb.go: -------------------------------------------------------------------------------- 1 | package database 2 | 3 | import ( 4 | "database/sql/driver" 5 | "encoding/json" 6 | "gorm.io/datatypes" 7 | ) 8 | 9 | type JSONB map[string]interface{} 10 | 11 | func (j JSONB) Value() (driver.Value, error) { 12 | valueString, err := json.Marshal(j) 13 | return string(valueString), err 14 | } 15 | 16 | func (j *JSONB) Scan(value interface{}) error { 17 | if err := json.Unmarshal([]byte(value.(string)), &j); err != nil { 18 | return err 19 | } 20 | return nil 21 | } 22 | 23 | func ToJSONB(v interface{}) datatypes.JSON { 24 | data, _ := json.Marshal(v) 25 | return datatypes.JSON(data) 26 | } -------------------------------------------------------------------------------- /database/setup.go: -------------------------------------------------------------------------------- 1 | package database 2 | 3 | import ( 4 | "fmt" 5 | "github.com/evilsocket/islazy/log" 6 | 7 | "gorm.io/driver/postgres" 8 | "gorm.io/gorm" 9 | "gorm.io/gorm/logger" 10 | ) 11 | 12 | var ( 13 | db = (*gorm.DB)(nil) 14 | ) 15 | 16 | func Setup(config Config) (err error) { 17 | connString := fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s sslmode=disable", 18 | config.Hostname, 19 | config.Port, 20 | config.User, 21 | config.Password, 22 | config.Name) 23 | db, err = gorm.Open(postgres.Open(connString), &gorm.Config{ 24 | Logger: logger.Default.LogMode(logger.Silent), 25 | }) 26 | if err == nil { 27 | log.Info("connected to database") 28 | if err = db.Debug().AutoMigrate(&Agent{}); err != nil { 29 | return 30 | } else if err = db.Debug().AutoMigrate(&User{}); err != nil { 31 | return 32 | } 33 | } 34 | return 35 | } 36 | 37 | func Delete(v interface{}) error { 38 | return db.Delete(v).Error 39 | } 40 | 41 | func Save(v interface{}) error { 42 | return db.Save(v).Error 43 | } -------------------------------------------------------------------------------- /database/user.go: -------------------------------------------------------------------------------- 1 | package database 2 | 3 | import ( 4 | "crypto/rand" 5 | "crypto/sha256" 6 | "encoding/hex" 7 | "fmt" 8 | "github.com/badoux/checkmail" 9 | "github.com/evilsocket/islazy/log" 10 | "github.com/evilsocket/islazy/str" 11 | "golang.org/x/crypto/bcrypt" 12 | "gorm.io/gorm" 13 | "strconv" 14 | "time" 15 | ) 16 | 17 | const MinPasswordLength = 8 18 | 19 | type User struct { 20 | ID uint `gorm:"primarykey" json:"-""` 21 | CreatedAt time.Time `gorm:"index" json:"created_at"` 22 | UpdatedAt time.Time `gorm:"index" json:"updated_at"` 23 | DeletedAt gorm.DeletedAt `gorm:"index" json:"-"` 24 | Email string `gorm:"uniqueIndex" json:"email"` 25 | Verification string `gorm:"index" json:"-"` 26 | Verified bool `gorm:"index" json:"-"` 27 | Use2FA bool `gorm:"default:true" json:"use_2fa"` // i know it's not 2fa yet 28 | Hash string `json:"-"` 29 | Address string `json:"address"` 30 | Agents []Agent `json:"-"` 31 | } 32 | 33 | func makeRandomToken() string { 34 | randomShit := make([]byte, 128) 35 | rand.Read(randomShit) 36 | 37 | data := append( 38 | []byte(strconv.FormatInt(time.Now().UnixNano(), 10)), 39 | randomShit...) 40 | 41 | hash := sha256.Sum256(data) 42 | return hex.EncodeToString(hash[:]) 43 | } 44 | 45 | func RegisterUser(address, email, password string) (*User, error) { 46 | if err := checkmail.ValidateFormat(email); err != nil { 47 | return nil, err 48 | } else if password = str.Trim(password); len(password) < MinPasswordLength { 49 | return nil, fmt.Errorf("minimum password length is %d", MinPasswordLength) 50 | } 51 | 52 | var found User 53 | if err := db.Where("email=?", email).First(&found).Error; err == nil { 54 | return nil, fmt.Errorf("email address already used") 55 | } else if err != gorm.ErrRecordNotFound { 56 | log.Error("error searching email '%s': %v", email, err) 57 | return nil, err 58 | } 59 | 60 | hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost) 61 | if err != nil { 62 | return nil, fmt.Errorf("error generating password hash: %v", err) 63 | } 64 | 65 | newUser := User{ 66 | Email: email, 67 | Verification: makeRandomToken(), 68 | Hash: string(hashedPassword), 69 | Address: address, 70 | } 71 | 72 | if err = db.Create(&newUser).Error; err != nil { 73 | return nil, fmt.Errorf("error creating new user: %v", err) 74 | } 75 | 76 | return &newUser, nil 77 | } 78 | 79 | func VerifyUser(verification string) error { 80 | var found User 81 | if err := db.Where("verification=?", verification).First(&found).Error; err != nil { 82 | return err 83 | } else if found.Verified == true { 84 | return fmt.Errorf("user already verified") 85 | } else { 86 | found.Verified = true 87 | return db.Save(&found).Error 88 | } 89 | } 90 | 91 | func LoginUser(address, email, password string) (*User, error) { 92 | var found User 93 | if err := db.Where("email=?", email).First(&found).Error; err == gorm.ErrRecordNotFound { 94 | return nil, nil 95 | } else if err != nil { 96 | return nil, err 97 | } else if found.Verified == false { 98 | return nil, fmt.Errorf("account not verified") 99 | } else if err = bcrypt.CompareHashAndPassword([]byte(found.Hash), []byte(password)); err != nil { 100 | return nil, nil 101 | } 102 | 103 | if found.Use2FA { 104 | found.Verification = makeRandomToken() 105 | } 106 | 107 | found.Address = address 108 | found.UpdatedAt = time.Now() 109 | if err := db.Save(&found).Error; err != nil { 110 | log.Error("error updating logged in user: %v", err) 111 | } 112 | 113 | return &found, nil 114 | } 115 | 116 | func UpdateUser(user *User, ip string, newPassword string, use2FA bool) (*User, error) { 117 | if newPassword = str.Trim(newPassword); newPassword != "" && len(newPassword) < MinPasswordLength { 118 | return nil, fmt.Errorf("minimum password length is %d", MinPasswordLength) 119 | } 120 | 121 | if newPassword != "" { 122 | hashedPassword, err := bcrypt.GenerateFromPassword([]byte(newPassword), bcrypt.DefaultCost) 123 | if err != nil { 124 | return nil, fmt.Errorf("error generating password hash: %v", err) 125 | } 126 | user.Hash = string(hashedPassword) 127 | } 128 | 129 | user.Use2FA = use2FA 130 | user.UpdatedAt = time.Now() 131 | user.Address = ip 132 | 133 | return user, db.Save(user).Error 134 | } 135 | 136 | func FindUserByID(id int) (*User, error) { 137 | var found User 138 | 139 | err := db.Preload("Agents", func(db *gorm.DB) *gorm.DB { 140 | return db.Order("agents.updated_at DESC") 141 | }).Find(&found, id).Error 142 | 143 | if err == gorm.ErrRecordNotFound { 144 | return nil, nil 145 | } else if err != nil { 146 | return nil, err 147 | } 148 | return &found, nil 149 | } 150 | -------------------------------------------------------------------------------- /docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '3' 2 | services: 3 | 4 | database: 5 | image: "postgres" 6 | env_file: 7 | - database.env 8 | ports: 9 | - 5432:5432 10 | volumes: 11 | # persist data even if container shuts down 12 | - db:/var/lib/postgresql/data/ 13 | networks: 14 | - shieldwall 15 | 16 | # shieldwall_api: 17 | # container_name: shieldwall_api 18 | # image: shieldwall_api:latest 19 | # build: 20 | # context: ./ 21 | # dockerfile: Dockerfile 22 | # depends_on: 23 | # - database 24 | # ports: 25 | # - 8666:8666 26 | # volumes: 27 | # - ./api.yaml:/etc/shieldwall/config.yaml 28 | # restart: unless-stopped 29 | # networks: 30 | # - shieldwall 31 | 32 | volumes: 33 | db: 34 | data: 35 | 36 | networks: 37 | shieldwall: 38 | driver: bridge -------------------------------------------------------------------------------- /firewall/logic.go: -------------------------------------------------------------------------------- 1 | package firewall 2 | 3 | import ( 4 | "fmt" 5 | "github.com/evilsocket/islazy/log" 6 | "github.com/evilsocket/islazy/str" 7 | "github.com/evilsocket/islazy/tui" 8 | "os/exec" 9 | "strconv" 10 | "strings" 11 | "sync" 12 | ) 13 | 14 | // TODO: implement factory pattern with generic interface in order to support more firewalls 15 | 16 | const ( 17 | swInputChain = "SHIELDWALL" 18 | swLogDropChain = "LOGNDROP" 19 | ) 20 | 21 | var DryRun = false 22 | 23 | type DropConfig struct { 24 | Log bool `yaml:"log"` 25 | Limit string `yaml:"limit"` 26 | Prefix string `yaml:"prefix"` 27 | Level int `yaml:"level"` 28 | } 29 | 30 | var lock = sync.Mutex{} 31 | 32 | func cmd(bin string, args ...string) (string, error) { 33 | log.Debug("# %s %s", bin, args) 34 | if DryRun { 35 | log.Info("%s %s %s", tui.Dim("
3 |
59 |
60 |
64 |
65 |
66 |
89 |
--------------------------------------------------------------------------------
/frontend/src/main.js:
--------------------------------------------------------------------------------
1 | import Vue from 'vue';
2 | import App from './App.vue';
3 | import {router} from './router';
4 | import store from './store';
5 | import 'bootstrap';
6 | import 'bootstrap/dist/css/bootstrap.min.css';
7 | import VeeValidate from 'vee-validate';
8 | import Vuex from 'vuex';
9 | import {library} from '@fortawesome/fontawesome-svg-core';
10 |
11 | import {FontAwesomeIcon} from '@fortawesome/vue-fontawesome';
12 | import {faDesktop, faHome, faSignInAlt, faSignOutAlt, faTerminal, faAnchor, faArchive, faUser, faUserPlus} from '@fortawesome/free-solid-svg-icons';
13 | import VueTimeago from 'vue-timeago'
14 |
15 | library.add(faHome, faUser, faDesktop, faUserPlus, faTerminal, faArchive, faAnchor, faSignInAlt, faSignOutAlt);
16 |
17 | Vue.config.productionTip = false;
18 |
19 | Vue.use(VeeValidate);
20 | Vue.component('font-awesome-icon', FontAwesomeIcon);
21 |
22 | Vue.use(Vuex);
23 |
24 | Vue.use(VueTimeago, {
25 | name: 'Timeago', // Component name, `Timeago` by default
26 | locale: 'en' // Default locale
27 | });
28 |
29 |
30 | new Vue({
31 | router,
32 | store,
33 | render: h => h(App)
34 | }).$mount('#app');
35 |
--------------------------------------------------------------------------------
/frontend/src/models/agent.js:
--------------------------------------------------------------------------------
1 | export default class Agent {
2 | constructor(name, rules) {
3 | this.name = name;
4 | this.rules = rules;
5 | this.alert_after = 0;
6 | this.alert_period = 0;
7 | }
8 | }
--------------------------------------------------------------------------------
/frontend/src/models/rule.js:
--------------------------------------------------------------------------------
1 | export default class Rule {
2 | constructor(type, address, protocol, ports, ttl, comment) {
3 | this.type = type;
4 | this.address = address;
5 | this.protocol = protocol;
6 | this.ports = ports;
7 | this.ttl = ttl;
8 | this.comment = comment;
9 | }
10 | }
--------------------------------------------------------------------------------
/frontend/src/models/user.js:
--------------------------------------------------------------------------------
1 | export default class User {
2 | constructor(email, password) {
3 | this.email = email;
4 | this.password = password;
5 | this.use_2fa = false;
6 | this.user_agent = '';
7 | }
8 | }
--------------------------------------------------------------------------------
/frontend/src/router.js:
--------------------------------------------------------------------------------
1 | import Vue from 'vue';
2 | import Router from 'vue-router';
3 | import Home from './views/Home.vue';
4 | import Login from './views/Login.vue';
5 | import Register from './views/Register.vue';
6 | import Verify from './views/Verify.vue';
7 |
8 | Vue.use(Router);
9 |
10 | export const router = new Router({
11 | mode: 'hash',
12 | routes: [
13 | {
14 | path: '/',
15 | name: 'home',
16 | component: Home
17 | },
18 | {
19 | path: '/login',
20 | component: Login
21 | },
22 | {
23 | path: '/register',
24 | component: Register
25 | },
26 | {
27 | path: '/verify/:code',
28 | component: Verify,
29 | params: true
30 | },
31 | {
32 | path: '/2step',
33 | name: '2step',
34 | // lazy-loaded
35 | component: () => import('./views/2Step.vue')
36 | },
37 | {
38 | path: '/profile',
39 | name: 'profile',
40 | // lazy-loaded
41 | component: () => import('./views/Profile.vue')
42 | },
43 | {
44 | path: '/agents',
45 | name: 'agents',
46 | // lazy-loaded
47 | component: () => import('./views/Agents.vue')
48 | },
49 | {
50 | path: '/agents/new',
51 | name: 'agent-new',
52 | // lazy-loaded
53 | component: () => import('./views/Agent.vue')
54 | },
55 | {
56 | path: '/agent/:id',
57 | name: 'agent-edit',
58 | // lazy-loaded
59 | component: () => import('./views/Agent.vue')
60 | },
61 | ]
62 | });
63 |
64 | // router.beforeEach((to, from, next) => {
65 | // const publicPages = ['/login', '/register', '/home'];
66 | // const authRequired = !publicPages.includes(to.path);
67 | // const loggedIn = localStorage.getItem('user');
68 |
69 | // // trying to access a restricted page + not logged in
70 | // // redirect to login page
71 | // if (authRequired && !loggedIn) {
72 | // next('/login');
73 | // } else {
74 | // next();
75 | // }
76 | // });
77 |
--------------------------------------------------------------------------------
/frontend/src/services/api.js:
--------------------------------------------------------------------------------
1 | var apiDev, apiProto, apiHost, apiPort;
2 |
3 | if (process.env.NODE_ENV === 'development') {
4 | apiDev = true;
5 | apiProto = 'http';
6 | apiHost = 'localhost';
7 | apiPort = 8080;
8 | } else {
9 | apiDev = false;
10 | apiProto = 'https';
11 | apiHost = 'shieldwall.me';
12 | apiPort = 443;
13 | }
14 |
15 | export const API_DEV = apiDev;
16 |
17 | export const API_PROTO = apiProto;
18 | export const API_HOST = apiHost;
19 | export const API_PORT = apiPort;
20 |
21 | export const API_BASE_URL = API_PROTO + '://' + API_HOST + ':' + API_PORT + '/api/v1';
22 |
23 | export const API_LOGIN_URL = API_BASE_URL + '/user/login';
24 | export const API_2STEP_URL = API_BASE_URL + '/user/2step';
25 | export const API_REGISTER_URL = API_BASE_URL + '/user/register';
26 | export const API_VERIFICATION_URL = API_BASE_URL + '/user/verify';
27 |
28 | export const API_USER_UPDATE_URL = API_BASE_URL + '/user/';
29 |
30 | export const API_AGENTS_URL = API_BASE_URL + '/user/agents';
31 | export const API_NEW_AGENT_URL = API_AGENTS_URL + '/new';
32 |
33 | export const API_SUBNETS_URL = API_BASE_URL + '/subnets';
34 |
--------------------------------------------------------------------------------
/frontend/src/services/auth-header.js:
--------------------------------------------------------------------------------
1 |
2 | export default function authHeader() {
3 | let user = JSON.parse(localStorage.getItem('user'));
4 | if(!user) {
5 | user = JSON.parse(localStorage.getItem('user2fa'));
6 | }
7 |
8 | if (user && user.token) {
9 | return { Authorization: 'Bearer ' + user.token };
10 | } else {
11 | return {};
12 | }
13 | }
14 |
--------------------------------------------------------------------------------
/frontend/src/services/auth.service.js:
--------------------------------------------------------------------------------
1 | import axios from 'axios';
2 | import {API_2STEP_URL, API_LOGIN_URL, API_REGISTER_URL, API_VERIFICATION_URL} from './api';
3 | import authHeader from './auth-header';
4 |
5 | class AuthService {
6 | login(user) {
7 | return axios
8 | .post(API_LOGIN_URL, {
9 | email: user.email,
10 | password: user.password
11 | })
12 | .then(response => {
13 | if (response.data.token) {
14 | if (!response.data.data.use_2fa) {
15 | window.console.log("saving user to user", response.data);
16 | localStorage.setItem('user', JSON.stringify(response.data));
17 | } else {
18 | window.console.log("saving user to user2fa", response.data);
19 | localStorage.setItem('user2fa', JSON.stringify(response.data));
20 | }
21 | }
22 | return response.data;
23 | });
24 | }
25 |
26 | step2(code) {
27 | return axios
28 | .post(API_2STEP_URL, {
29 | code: code
30 | }, { headers: authHeader() })
31 | .then(response => {
32 | if (response.data.token) {
33 | window.console.log("finalizing user to user", response.data);
34 | localStorage.setItem('user', JSON.stringify(response.data));
35 | localStorage.removeItem('user2fa');
36 | }
37 | return response.data;
38 | });
39 | }
40 |
41 | logout() {
42 | localStorage.removeItem('user');
43 | localStorage.removeItem('user2fa');
44 | }
45 |
46 | register(user) {
47 | return axios.post(API_REGISTER_URL, {
48 | email: user.email,
49 | password: user.password
50 | });
51 | }
52 |
53 | verify(code) {
54 | return axios.get(API_VERIFICATION_URL + '/' + code);
55 | }
56 | }
57 |
58 | export default new AuthService();
59 |
--------------------------------------------------------------------------------
/frontend/src/services/user.service.js:
--------------------------------------------------------------------------------
1 | import axios from 'axios';
2 | import authHeader from './auth-header';
3 | import {API_AGENTS_URL, API_USER_UPDATE_URL, API_NEW_AGENT_URL, API_SUBNETS_URL} from "@/services/api";
4 |
5 | class UserService {
6 | getUserAgents() {
7 | return axios.get(API_AGENTS_URL, { headers: authHeader() });
8 | }
9 |
10 | update(new_password, use_2fa) {
11 | return axios.post(API_USER_UPDATE_URL, {
12 | password: new_password,
13 | use_2fa: use_2fa
14 | }, { headers: authHeader() });
15 | }
16 |
17 | getAgent(id) {
18 | return axios.get(API_AGENTS_URL + '/' + id, { headers: authHeader() });
19 | }
20 |
21 | deleteAgent(id) {
22 | return axios.delete(API_AGENTS_URL + '/' + id, { headers: authHeader() });
23 | }
24 |
25 | createAgent(agent) {
26 | return axios.put(API_NEW_AGENT_URL, agent, { headers: authHeader() });
27 | }
28 |
29 | updateAgent(agent) {
30 | return axios.put(API_AGENTS_URL + '/' + agent.id, agent, { headers: authHeader() });
31 | }
32 |
33 | getCloudFlareSubnets() {
34 | return axios.get(API_SUBNETS_URL + '/cloudflare', { headers: authHeader() });
35 | }
36 | }
37 |
38 | export default new UserService();
39 |
--------------------------------------------------------------------------------
/frontend/src/store/auth.module.js:
--------------------------------------------------------------------------------
1 | import AuthService from '../services/auth.service';
2 |
3 | const user = JSON.parse(localStorage.getItem('user'));
4 | const initialState = user
5 | ? { status: { loggedIn: true }, user }
6 | : { status: { loggedIn: false }, user: null };
7 |
8 | export const auth = {
9 | namespaced: true,
10 | state: initialState,
11 | actions: {
12 | login({ commit }, user) {
13 | return AuthService.login(user).then(
14 | user => {
15 | commit('loginSuccess', user);
16 | return Promise.resolve(user);
17 | },
18 | error => {
19 | commit('loginFailure');
20 | return Promise.reject(error);
21 | }
22 | );
23 | },
24 | step2({ commit }, code) {
25 | return AuthService.step2(code).then(
26 | user => {
27 | commit('step2Success', user);
28 | return Promise.resolve(user);
29 | },
30 | error => {
31 | commit('loginFailure');
32 | return Promise.reject(error);
33 | }
34 | );
35 | },
36 | logout({ commit }) {
37 | AuthService.logout();
38 | commit('logout');
39 | },
40 | register({ commit }, user) {
41 | return AuthService.register(user).then(
42 | response => {
43 | commit('registerSuccess');
44 | return Promise.resolve(response.data);
45 | },
46 | error => {
47 | commit('registerFailure');
48 | return Promise.reject(error);
49 | }
50 | );
51 | },
52 | verify({ commit }, code) {
53 | return AuthService.verify(code).then(
54 | response => {
55 | commit('verifySuccess');
56 | return Promise.resolve(response.data);
57 | },
58 | error => {
59 | commit('verifyFailure');
60 | return Promise.reject(error);
61 | }
62 | );
63 | }
64 | },
65 | mutations: {
66 | loginSuccess(state, user) {
67 | state.status.loggedIn = !user.data.use_2fa;
68 | state.user = user;
69 | },
70 | step2Success(state, user) {
71 | state.status.loggedIn = true;
72 | state.user = user;
73 | },
74 | loginFailure(state) {
75 | state.status.loggedIn = false;
76 | state.user = null;
77 | },
78 | logout(state) {
79 | state.status.loggedIn = false;
80 | state.user = null;
81 | },
82 | registerSuccess(state) {
83 | state.status.loggedIn = false;
84 | },
85 | registerFailure(state) {
86 | state.status.loggedIn = false;
87 | },
88 | verifySuccess() {
89 |
90 | },
91 | verifyFailure(state) {
92 | state.status.loggedIn = false;
93 | state.user = null;
94 | }
95 | }
96 | };
97 |
--------------------------------------------------------------------------------
/frontend/src/store/index.js:
--------------------------------------------------------------------------------
1 | import Vue from 'vue';
2 | import Vuex from 'vuex';
3 |
4 | import { auth } from './auth.module';
5 |
6 | Vue.use(Vuex);
7 |
8 | export default new Vuex.Store({
9 | modules: {
10 | auth
11 | }
12 | });
13 |
--------------------------------------------------------------------------------
/frontend/src/views/2Step.vue:
--------------------------------------------------------------------------------
1 |
2 |
61 |
63 |
3 |
43 |
44 |
45 |
108 |
109 |
--------------------------------------------------------------------------------
/frontend/src/views/Agent.vue:
--------------------------------------------------------------------------------
1 |
2 |
4 | 
9 |
10 |
40 |
41 |
42 |
9 |
10 |
40 |
3 |
4 |
7 | 8 | 252 | 253 |
254 |
255 |
256 |
257 |
388 |
389 |
--------------------------------------------------------------------------------
/frontend/src/views/Agents.vue:
--------------------------------------------------------------------------------
1 |
2 | {{ editing ? 'Edit' : 'New' }} Agent
5 | 6 |7 | 8 | 252 | 253 |
3 |
4 |
9 | new agent
10 |
11 |
12 |
13 | 14 |
22 |
23 |
73 |
74 |
75 |
76 |
77 |
145 |
146 |
--------------------------------------------------------------------------------
/frontend/src/views/Home.vue:
--------------------------------------------------------------------------------
1 |
2 | 13 | 14 |
15 | No agents yet, create the first one!
16 |
17 |
18 | {{ message }}
19 | {{ error }}
20 |
21 | | Created | 25 |Last Seen | 26 |Name | 27 |Address | 28 |Version | 29 |Rules | 30 |31 | |
|---|---|---|---|---|---|---|
|
37 |
38 | |
41 |
42 |
43 | |
48 | 49 | 50 | {{ agent.name }} 51 | 52 | | 53 |54 | {{ agent.address }} 55 | not seen yet 56 | | 57 |58 | {{ agent.user_agent.replace('ShieldWall Agent ', '') }} 59 | not seen yet 60 | | 61 |62 | {{ agent.rules.length }} 63 | none 64 | | 65 |66 | 67 | x 68 | 69 | | 70 |
3 |
61 |
62 |
63 |
77 |
78 |
--------------------------------------------------------------------------------
/frontend/src/views/Login.vue:
--------------------------------------------------------------------------------
1 |
2 |
4 |
17 | 18 |
60 |
5 |
6 |
9 |
10 | 11 |
15 |
16 |
6 |
7 | shieldwall
8 |
9 | 10 | 11 |
12 | Helps you secure your most private servers! 13 |
14 |17 | 18 |
19 | ShieldWall embraces the zero-trust principle and instruments your server firewall to block inbound 20 | connections from every IP on any port, by default. 21 |
22 |23 | This website allows you to push policies to your agents and temporarily unlock certain ports from your IP. 24 |
25 | 26 |
27 |
58 |
59 |
28 |
57 |
29 |
42 |
30 |
41 |
31 | Free API
32 |
33 |
39 |
40 |
43 |
56 |
44 |
55 |
45 | Host it Yourself
46 |
47 |
48 |
53 |
54 | Host the backend and API service yourself for a more discreet setup.
49 | 50 | Code Repository 51 | 52 |
3 |
65 | Don't have an account?
66 | Sign up for free! 67 |
68 |
69 |
70 |
71 |
146 |
147 |
--------------------------------------------------------------------------------
/frontend/src/views/Profile.vue:
--------------------------------------------------------------------------------
1 |
2 |
4 |
9 |
10 |
62 |
63 |
64 |
9 |
10 |
62 | 66 | Sign up for free! 67 |
3 |
4 |
70 |
71 |
72 |
73 |
74 |
139 |
140 |
--------------------------------------------------------------------------------
/frontend/src/views/Register.vue:
--------------------------------------------------------------------------------
1 |
2 |
3 |
72 | Already have an account?
73 | Login in here! 74 |
75 |
76 |
77 |
78 |
147 |
148 |
--------------------------------------------------------------------------------
/frontend/src/views/Verify.vue:
--------------------------------------------------------------------------------
1 |
2 |
4 |
9 |
62 |
63 |
70 |
71 |
9 |
62 |
63 | {{ message }}
68 |
69 | 73 | Login in here! 74 |
3 |
7 |
8 |
9 |
46 |
47 |
--------------------------------------------------------------------------------
/frontend/vue.config.js:
--------------------------------------------------------------------------------
1 | module.exports = {
2 | devServer: {
3 | port: 8081
4 | }
5 | }
--------------------------------------------------------------------------------
/go.mod:
--------------------------------------------------------------------------------
1 | module github.com/evilsocket/shieldwall
2 |
3 | go 1.15
4 |
5 | require (
6 | github.com/badoux/checkmail v1.2.1
7 | github.com/dgrijalva/jwt-go v3.2.0+incompatible
8 | github.com/elazarl/go-bindata-assetfs v1.0.1
9 | github.com/evilsocket/islazy v1.10.6
10 | github.com/go-bindata/go-bindata v3.1.2+incompatible // indirect
11 | github.com/go-chi/chi v1.5.1
12 | github.com/go-chi/cors v1.1.1
13 | github.com/go-chi/httprate v0.4.0
14 | github.com/ilyakaznacheev/cleanenv v1.2.5
15 | golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
16 | gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
17 | gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
18 | gopkg.in/yaml.v2 v2.4.0
19 | gorm.io/datatypes v1.0.0
20 | gorm.io/driver/postgres v1.0.5
21 | gorm.io/gorm v1.20.5
22 | )
23 |
--------------------------------------------------------------------------------
/go.sum:
--------------------------------------------------------------------------------
1 | github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
2 | github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
3 | github.com/badoux/checkmail v1.2.1 h1:TzwYx5pnsV6anJweMx2auXdekBwGr/yt1GgalIx9nBQ=
4 | github.com/badoux/checkmail v1.2.1/go.mod h1:XroCOBU5zzZJcLvgwU15I+2xXyCdTWXyR9MGfRhBYy0=
5 | github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
6 | github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
7 | github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
8 | github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
9 | github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
10 | github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
11 | github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
12 | github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
13 | github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
14 | github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
15 | github.com/denisenkom/go-mssqldb v0.0.0-20200428022330-06a60b6afbbc h1:VRRKCwnzqk8QCaRC4os14xoKDdbHqqlJtJA0oc1ZAjg=
16 | github.com/denisenkom/go-mssqldb v0.0.0-20200428022330-06a60b6afbbc/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
17 | github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
18 | github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
19 | github.com/elazarl/go-bindata-assetfs v1.0.1 h1:m0kkaHRKEu7tUIUFVwhGGGYClXvyl4RE03qmvRTNfbw=
20 | github.com/elazarl/go-bindata-assetfs v1.0.1/go.mod h1:v+YaWX3bdea5J/mo8dSETolEo7R71Vk1u8bnjau5yw4=
21 | github.com/evilsocket/islazy v1.10.6 h1:MFq000a1ByoumoJWlytqg0qon0KlBeUfPsDjY0hK0bo=
22 | github.com/evilsocket/islazy v1.10.6/go.mod h1:OrwQGYg3DuZvXUfmH+KIZDjwTCbrjy48T24TUpGqVVw=
23 | github.com/go-bindata/go-bindata v1.0.0 h1:DZ34txDXWn1DyWa+vQf7V9ANc2ILTtrEjtlsdJRF26M=
24 | github.com/go-bindata/go-bindata v3.1.2+incompatible h1:5vjJMVhowQdPzjE1LdxyFF7YFTXg5IgGVW4gBr5IbvE=
25 | github.com/go-bindata/go-bindata v3.1.2+incompatible/go.mod h1:xK8Dsgwmeed+BBsSy2XTopBn/8uK2HWuGSnA11C3Joo=
26 | github.com/go-chi/chi v1.5.1 h1:kfTK3Cxd/dkMu/rKs5ZceWYp+t5CtiE7vmaTv3LjC6w=
27 | github.com/go-chi/chi v1.5.1/go.mod h1:REp24E+25iKvxgeTfHmdUoL5x15kBiDBlnIl5bCwe2k=
28 | github.com/go-chi/cors v1.1.1 h1:eHuqxsIw89iXcWnWUN8R72JMibABJTN/4IOYI5WERvw=
29 | github.com/go-chi/cors v1.1.1/go.mod h1:K2Yje0VW/SJzxiyMYu6iPQYa7hMjQX2i/F491VChg1I=
30 | github.com/go-chi/httprate v0.4.0 h1:M2qVV0w6ksgLs6L8lTrvqNeaVm0ZJNVdbYM8u2T8HaE=
31 | github.com/go-chi/httprate v0.4.0/go.mod h1:7e7qjQtHzEbdyW5TYQrl4X2uNRCnlTajictc7B4ftgc=
32 | github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs=
33 | github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
34 | github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
35 | github.com/gofrs/uuid v3.2.0+incompatible h1:y12jRkkFxsd7GpqdSZ+/KCs/fJbqpEXSGd4+jfEaewE=
36 | github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
37 | github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
38 | github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
39 | github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
40 | github.com/ilyakaznacheev/cleanenv v1.2.5 h1:/SlcF9GaIvefWqFJzsccGG/NJdoaAwb7Mm7ImzhO3DM=
41 | github.com/ilyakaznacheev/cleanenv v1.2.5/go.mod h1:/i3yhzwZ3s7hacNERGFwvlhwXMDcaqwIzmayEhbRplk=
42 | github.com/jackc/chunkreader v1.0.0 h1:4s39bBR8ByfqH+DKm8rQA3E1LHZWB9XWcrz8fqaZbe0=
43 | github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
44 | github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
45 | github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
46 | github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
47 | github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
48 | github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
49 | github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
50 | github.com/jackc/pgconn v1.4.0/go.mod h1:Y2O3ZDF0q4mMacyWV3AstPJpeHXWGEetiFttmq5lahk=
51 | github.com/jackc/pgconn v1.5.0/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
52 | github.com/jackc/pgconn v1.5.1-0.20200601181101-fa742c524853/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
53 | github.com/jackc/pgconn v1.7.0 h1:pwjzcYyfmz/HQOQlENvG1OcDqauTGaqlVahq934F0/U=
54 | github.com/jackc/pgconn v1.7.0/go.mod h1:sF/lPpNEMEOp+IYhyQGdAvrG20gWf6A1tKlr0v7JMeA=
55 | github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
56 | github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
57 | github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2 h1:JVX6jT/XfzNqIjye4717ITLaNwV9mWbJx0dLCpcRzdA=
58 | github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
59 | github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
60 | github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
61 | github.com/jackc/pgproto3 v1.1.0 h1:FYYE4yRw+AgI8wXIinMlNjBbp/UitDJwfj5LqqewP1A=
62 | github.com/jackc/pgproto3 v1.1.0/go.mod h1:eR5FA3leWg7p9aeAqi37XOTgTIbkABlvcPB3E5rlc78=
63 | github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190420180111-c116219b62db/go.mod h1:bhq50y+xrl9n5mRYyCBFKkpRVTLYJVWeCc+mEAI3yXA=
64 | github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190609003834-432c2951c711/go.mod h1:uH0AWtUmuShn0bcesswc4aBTWGvw0cAxIJp+6OB//Wg=
65 | github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
66 | github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
67 | github.com/jackc/pgproto3/v2 v2.0.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
68 | github.com/jackc/pgproto3/v2 v2.0.5 h1:NUbEWPmCQZbMmYlTjVoNPhc0CfnYyz2bfUAh6A5ZVJM=
69 | github.com/jackc/pgproto3/v2 v2.0.5/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
70 | github.com/jackc/pgservicefile v0.0.0-20200307190119-3430c5407db8/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
71 | github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b h1:C8S2+VttkHFdOOCXJe+YGfa4vHYwlt4Zx+IVXQ97jYg=
72 | github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
73 | github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
74 | github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
75 | github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
76 | github.com/jackc/pgtype v1.2.0/go.mod h1:5m2OfMh1wTK7x+Fk952IDmI4nw3nPrvtQdM0ZT4WpC0=
77 | github.com/jackc/pgtype v1.3.1-0.20200510190516-8cd94a14c75a/go.mod h1:vaogEUkALtxZMCH411K+tKzNpwzCKU+AnPzBKZ+I+Po=
78 | github.com/jackc/pgtype v1.3.1-0.20200606141011-f6355165a91c/go.mod h1:cvk9Bgu/VzJ9/lxTO5R5sf80p0DiucVtN7ZxvaC4GmQ=
79 | github.com/jackc/pgtype v1.5.0 h1:jzBqRk2HFG2CV4AIwgCI2PwTgm6UUoCAK2ofHHRirtc=
80 | github.com/jackc/pgtype v1.5.0/go.mod h1:JCULISAZBFGrHaOXIIFiyfzW5VY0GRitRr8NeJsrdig=
81 | github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
82 | github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
83 | github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
84 | github.com/jackc/pgx/v4 v4.5.0/go.mod h1:EpAKPLdnTorwmPUUsqrPxy5fphV18j9q3wrfRXgo+kA=
85 | github.com/jackc/pgx/v4 v4.6.1-0.20200510190926-94ba730bb1e9/go.mod h1:t3/cdRQl6fOLDxqtlyhe9UWgfIi9R8+8v8GKV5TRA/o=
86 | github.com/jackc/pgx/v4 v4.6.1-0.20200606145419-4e5062306904/go.mod h1:ZDaNWkt9sW1JMiNn0kdYBaLelIhw7Pg4qd+Vk6tw7Hg=
87 | github.com/jackc/pgx/v4 v4.9.0 h1:6STjDqppM2ROy5p1wNDcsC7zJTjSHeuCsguZmXyzx7c=
88 | github.com/jackc/pgx/v4 v4.9.0/go.mod h1:MNGWmViCgqbZck9ujOOBN63gK9XVGILXWCvKLGKmnms=
89 | github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
90 | github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
91 | github.com/jackc/puddle v1.1.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
92 | github.com/jackc/puddle v1.1.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
93 | github.com/jackc/puddle v1.1.2/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
94 | github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
95 | github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
96 | github.com/jinzhu/now v1.1.1 h1:g39TucaRWyV3dwDO++eEc6qf8TVIQ/Da48WmqjZ3i7E=
97 | github.com/jinzhu/now v1.1.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
98 | github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
99 | github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
100 | github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
101 | github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
102 | github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
103 | github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
104 | github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
105 | github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
106 | github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
107 | github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
108 | github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
109 | github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
110 | github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
111 | github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
112 | github.com/lib/pq v1.3.0 h1:/qkRGz8zljWiDcFvgpwUpwIAPu3r07TDvs3Rws+o/pU=
113 | github.com/lib/pq v1.3.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
114 | github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
115 | github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
116 | github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
117 | github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
118 | github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
119 | github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
120 | github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
121 | github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
122 | github.com/mattn/go-sqlite3 v1.14.3 h1:j7a/xn1U6TKA/PHHxqZuzh64CdtRc7rU9M+AvkOl5bA=
123 | github.com/mattn/go-sqlite3 v1.14.3/go.mod h1:WVKg1VTActs4Qso6iwGbiFih2UIHo0ENGwNd0Lj+XmI=
124 | github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
125 | github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
126 | github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
127 | github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
128 | github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
129 | github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
130 | github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
131 | github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
132 | github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
133 | github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
134 | github.com/shopspring/decimal v0.0.0-20200227202807-02e2044944cc h1:jUIKcSPO9MoMJBbEoyE/RJoE8vz7Mb8AjvifMMwSyvY=
135 | github.com/shopspring/decimal v0.0.0-20200227202807-02e2044944cc/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
136 | github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
137 | github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
138 | github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
139 | github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
140 | github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
141 | github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
142 | github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
143 | github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
144 | github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
145 | github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
146 | github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
147 | go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
148 | go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
149 | go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
150 | go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
151 | go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
152 | go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
153 | go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
154 | go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
155 | golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
156 | golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
157 | golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
158 | golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
159 | golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
160 | golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
161 | golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
162 | golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
163 | golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
164 | golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
165 | golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
166 | golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
167 | golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
168 | golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
169 | golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7 h1:fHDIZ2oxGnUZRN6WgWFCbYBjH9uqVPRCUVUDhs0wnbA=
170 | golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
171 | golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
172 | golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
173 | golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
174 | golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
175 | golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
176 | golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
177 | golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
178 | golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
179 | golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
180 | golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
181 | golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae h1:/WDfKMnPU+m5M4xB+6x4kaepxRw6jWvR5iDRdvjHgy8=
182 | golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
183 | golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
184 | golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
185 | golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
186 | golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
187 | golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
188 | golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
189 | golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
190 | golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
191 | golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
192 | golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
193 | golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
194 | golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
195 | golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
196 | golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
197 | golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
198 | golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
199 | gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
200 | gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
201 | gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
202 | gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
203 | gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
204 | gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
205 | gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df h1:n7WqCuqOuCbNr617RXOY0AWRXxgwEyPp2z+p0+hgMuE=
206 | gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df/go.mod h1:LRQQ+SO6ZHR7tOkpBDuZnXENFzX8qRjMDMyPD6BRkCw=
207 | gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
208 | gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
209 | gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
210 | gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
211 | gorm.io/datatypes v1.0.0 h1:5rDW3AnqXaacuQn6nB/ZNAIfTCIvmL5oKGa/TtCoBFA=
212 | gorm.io/datatypes v1.0.0/go.mod h1:aKpJ+RNhLXWeF5OAdxfzBwT1UPw1wseSchF0AY3/lSw=
213 | gorm.io/driver/mysql v1.0.3 h1:+JKBYPfn1tygR1/of/Fh2T8iwuVwzt+PEJmKaXzMQXg=
214 | gorm.io/driver/mysql v1.0.3/go.mod h1:twGxftLBlFgNVNakL7F+P/x9oYqoymG3YYT8cAfI9oI=
215 | gorm.io/driver/postgres v1.0.5 h1:raX6ezL/ciUmaYTvOq48jq1GE95aMC0CmxQYbxQ4Ufw=
216 | gorm.io/driver/postgres v1.0.5/go.mod h1:qrD92UurYzNctBMVCJ8C3VQEjffEuphycXtxOudXNCA=
217 | gorm.io/driver/sqlite v1.1.3 h1:BYfdVuZB5He/u9dt4qDpZqiqDJ6KhPqs5QUqsr/Eeuc=
218 | gorm.io/driver/sqlite v1.1.3/go.mod h1:AKDgRWk8lcSQSw+9kxCJnX/yySj8G3rdwYlU57cB45c=
219 | gorm.io/driver/sqlserver v1.0.5 h1:n5knSvyaEwufxl0aROEW90pn+aLoV9h+vahYJk1x5l4=
220 | gorm.io/driver/sqlserver v1.0.5/go.mod h1:WI/bfZ+s9TigYXe3hb3XjNaUP0TqmTdXl11pECyLATs=
221 | gorm.io/gorm v1.20.1/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
222 | gorm.io/gorm v1.20.2/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
223 | gorm.io/gorm v1.20.4/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
224 | gorm.io/gorm v1.20.5 h1:g3tpSF9kggASzReK+Z3dYei1IJODLqNUbOjSuCczY8g=
225 | gorm.io/gorm v1.20.5/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
226 | honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
227 | olympos.io/encoding/edn v0.0.0-20200308123125-93e3b8dd0e24 h1:sreVOrDp0/ezb0CHKVek/l7YwpxPJqv+jT3izfSphA4=
228 | olympos.io/encoding/edn v0.0.0-20200308123125-93e3b8dd0e24/go.mod h1:oVgVk4OWVDi43qWBEyGhXgYxt7+ED4iYNpTngSLX2Iw=
229 |
--------------------------------------------------------------------------------
/install.sh:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env bash
2 | service shieldwall-agent stop || true
3 | cp shieldwall-agent /usr/bin/
4 | mkdir -p /etc/shieldwall/
5 | test -s /etc/shieldwall/config.yaml || cp agent.example.yaml /etc/shieldwall/config.yaml
6 | cp shieldwall-agent.service /etc/systemd/system/
7 | systemctl daemon-reload
8 |
--------------------------------------------------------------------------------
/mailer/config.go:
--------------------------------------------------------------------------------
1 | package mailer
2 |
3 | type Config struct {
4 | Address string `yaml:"address"`
5 | Port int `yaml:"port"`
6 | Username string `yaml:"username"`
7 | Password string `yaml:"password"`
8 | }
9 |
10 |
--------------------------------------------------------------------------------
/mailer/mailer.go:
--------------------------------------------------------------------------------
1 | package mailer
2 |
3 | import (
4 | "github.com/evilsocket/islazy/log"
5 | "gopkg.in/gomail.v2"
6 | "sync"
7 | )
8 |
9 | type Mailer struct {
10 | sync.Mutex
11 | conf Config
12 | dialer *gomail.Dialer
13 | }
14 |
15 | func New(conf Config) (*Mailer, error) {
16 | return &Mailer{
17 | conf: conf,
18 | dialer: gomail.NewDialer(conf.Address, conf.Port, conf.Username, conf.Password),
19 | }, nil
20 | }
21 |
22 | func (m *Mailer) Send(from, to, subject, body string) error {
23 | m.Lock()
24 | defer m.Unlock()
25 |
26 | log.Debug("sending email to %s via %s:%d, from=%s ...", to, m.conf.Address, m.conf.Port, from)
27 |
28 | msg := gomail.NewMessage()
29 |
30 | msg.SetHeader("From", from)
31 | msg.SetHeader("To", to)
32 | msg.SetHeader("Subject", subject)
33 |
34 | msg.SetBody("text/html", body)
35 |
36 | return m.dialer.DialAndSend(msg)
37 | }
--------------------------------------------------------------------------------
/mock-firewall.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 |
3 | echo "iptables $@"
--------------------------------------------------------------------------------
/release.stork:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env stork -f
2 | git:changelog
3 |
4 | version:file "version/version.go"
5 | version:from_user
6 |
7 | git:create_tag $VERSION
8 |
9 |
--------------------------------------------------------------------------------
/shieldwall-agent.service:
--------------------------------------------------------------------------------
1 | [Unit]
2 | Description=shieldwall agent service
3 | Documentation=https://shieldwall.me/
4 | Wants=network.target
5 | After=network.target
6 |
7 | [Service]
8 | Type=simple
9 | PermissionsStartOnly=true
10 | ExecStart=/usr/bin/shieldwall-agent -log /var/log/shieldwall.log
11 | Restart=always
12 | RestartSec=30
13 | KillMode=process
14 |
15 | [Install]
16 | WantedBy=multi-user.target
--------------------------------------------------------------------------------
/shieldwall-api.service:
--------------------------------------------------------------------------------
1 | [Unit]
2 | Description=shieldwall api service
3 | Documentation=https://shieldwall.me/
4 | Wants=network.target
5 | After=network.target
6 |
7 | [Service]
8 | Type=simple
9 | PermissionsStartOnly=true
10 | ExecStart=/usr/bin/shieldwall-api -log /var/log/shieldwall.log
11 | Restart=always
12 | RestartSec=30
13 |
14 | [Install]
15 | WantedBy=multi-user.target
--------------------------------------------------------------------------------
/update.sh:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env bash
2 | service shieldwall-agent stop || true
3 | cp shieldwall-agent /usr/bin/
4 | cp -n shieldwall-agent.service /etc/systemd/system/
5 | systemctl daemon-reload
6 | service shieldwall-agent start
--------------------------------------------------------------------------------
/version/version.go:
--------------------------------------------------------------------------------
1 | package version
2 |
3 | const Version = "1.2.1"
--------------------------------------------------------------------------------
{{ status }}
4 | {{ message }}
5 | {{ error }}
6 |