Add support for individual timeout overrides in ressources

Author: mbuesch

doc/CONFIGURATION.md

@@ -241,6 +241,9 @@ If a `users` list is given, then only these users can knock the port open.
 The `users` list is just a comma separated list of user identifiers.
 See `[KEYS]` section above for more information about user identifiers.
 
+Optionally a resource specific `timeout` override can be specified.
+The `timeout` is specified in seconds and will override the default timeout from `[NFTABLES] timeout=...`.
+
 If a client wants to knock a port open on a server, the client and the server must share a compatible resource entry for the port.
 
 Example resources:
@@ -260,6 +263,9 @@ Example resources:
 
 # Resource: TCP and UDP port 1234. Only for users 00000005 and 00000006
 00000001 = port: 1234 / tcp,udp / users: 00000005,00000006
+
+# Resource: TCP port 1234. Timeout 42 seconds instead of default timeout.
+00000001 = port: 1234, timeout: 42
 ```
 
 # Server specific configuration parts
@@ -326,7 +332,7 @@ This option has no default and must be specified in the server configuration.
 
 ### `timeout`
 
-The `timeout` option specifies the knock-open firewall rule timeout, in seconds.
+The `timeout` option specifies the default knock-open firewall rule timeout, in seconds.
 Knocked-open ports will be closed again this many seconds after the knocking.
 
 This is the time you have to connect to the opened port.
@@ -337,4 +343,6 @@ Established connections will stay active when the port is closed.
 
 It is recommended to set this to a small duration of e.g. one minute `timeout=60` or ten minutes `timeout=600`.
 
+This timeout can be overridden in the individual `[RESOURCES]`.
+
 This option defaults to `timeout=600`, if it is absent from the configuration.

letmein-conf/src/lib.rs

@@ -130,6 +130,7 @@ pub enum Resource {
         port: u16,
         tcp: bool,
         udp: bool,
+        timeout: Option<Duration>,
         users: Vec<UserId>,
     },
 }
@@ -339,6 +340,7 @@ fn extract_resource_port(
     map: &Map,
 ) -> ah::Result<()> {
     let mut port: Option<u16> = None;
+    let mut timeout: Option<Duration> = None;
     let mut users: Vec<String> = vec![];
     let mut tcp = false;
     let mut udp = false;
@@ -355,6 +357,15 @@ fn extract_resource_port(
                     } else {
                         return Err(err!("[RESOURCE] invalid 'port' option"));
                     }
+                } else if k == "timeout" {
+                    if vs.len() == 1 {
+                        if timeout.is_some() {
+                            return Err(err!("[RESOURCE] multiple 'timeout' values"));
+                        }
+                        timeout = Some(parse_duration(&vs[0]).context("[RESOURCES] timeout")?);
+                    } else {
+                        return Err(err!("[RESOURCE] invalid 'timeout' option"));
+                    }
                 } else if k == "users" {
                     if !users.is_empty() {
                         return Err(err!("[RESOURCE] multiple 'users' values"));
@@ -409,6 +420,7 @@ fn extract_resource_port(
             port,
             tcp,
             udp,
+            timeout,
             users,
         },
     );
@@ -847,6 +859,7 @@ mod tests {
                 port: 4096,
                 tcp: true,
                 udp: false,
+                timeout: None,
                 users: vec![]
             }
         );
@@ -861,6 +874,7 @@ mod tests {
                 port: 4096,
                 tcp: true,
                 udp: false,
+                timeout: None,
                 users: vec![]
             }
         );
@@ -875,12 +889,13 @@ mod tests {
                 port: 4096,
                 tcp: false,
                 udp: true,
+                timeout: None,
                 users: vec![1.into(), 2.into(), 3.into()]
             }
         );
 
         let mut ini = Ini::new();
-        ini.parse_str("[RESOURCES]\n9876ABCD = port : 4096 / udp, tcp / users: 4\n")
+        ini.parse_str("[RESOURCES]\n9876ABCD = port : 4096 / udp, tcp / users: 4 / timeout:42\n")
             .unwrap();
         let resources = get_resources(&ini).unwrap();
         assert_eq!(
@@ -889,6 +904,7 @@ mod tests {
                 port: 4096,
                 tcp: true,
                 udp: true,
+                timeout: Some(Duration::from_secs(42)),
                 users: vec![4.into()]
             }
         );

letmeind/letmeind.conf

@@ -65,8 +65,9 @@ family = inet
 table = filter
 chain-input = LETMEIN-INPUT
 
-# Timeout of installed knock-open rules.
+# Default timeout of installed knock-open rules.
 # Knocked-open ports will be closed again this many seconds after the knocking.
+# This timeout can be overridden in the individual RESSOURCES (see below).
 timeout = 600
 
 
@@ -102,3 +103,6 @@ timeout = 600
 
 # Open port 6500 for TCP and UDP.
 #0000001E = port: 6500 / tcp,udp
+
+# Open port 7500 for TCP and override the default timeout with 60 seconds.
+#0000001F = port: 7500 / timeout: 60

letmeinfwd/src/firewall.rs

@@ -10,7 +10,11 @@ pub mod nftables;
 
 use anyhow as ah;
 use letmein_conf::Config;
-use std::{collections::HashMap, net::IpAddr, time::Instant};
+use std::{
+    collections::HashMap,
+    net::IpAddr,
+    time::{Duration, Instant},
+};
 
 /// TCP and/or UDP port number.
 #[derive(Clone, Copy, PartialEq, Eq, Hash)]
@@ -61,7 +65,7 @@ struct Lease {
 
 impl Lease {
     /// Create a new lease with maximum timeout.
-    pub fn new(conf: &Config, addr: IpAddr, port: LeasePort) -> Self {
+    pub fn new(conf: &Config, addr: IpAddr, port: LeasePort, timeout: Option<Duration>) -> Self {
         // The upper layers must never give us a lease request for the control port.
         assert_ne!(
             conf.port().port,
@@ -71,7 +75,7 @@ impl Lease {
                 LeasePort::TcpUdp(p) => p,
             }
         );
-        let timeout = Instant::now() + conf.nft_timeout();
+        let timeout = Instant::now() + timeout.unwrap_or_else(|| conf.nft_timeout());
         Self {
             addr,
             port,
@@ -154,6 +158,7 @@ pub trait FirewallOpen {
         conf: &Config,
         remote_addr: IpAddr,
         port: LeasePort,
+        timeout: Option<Duration>,
     ) -> ah::Result<()>;
 }
 

letmeinfwd/src/firewall/nftables.rs

@@ -20,7 +20,7 @@ use nftables::{
     stmt::{Match, Operator, Statement},
     types::NfFamily,
 };
-use std::{borrow::Cow, fmt::Write as _, net::IpAddr};
+use std::{borrow::Cow, fmt::Write as _, net::IpAddr, time::Duration};
 
 const NFTNL_UDATA_COMMENT_MAXLEN: usize = 128;
 
@@ -474,13 +474,14 @@ impl FirewallOpen for NftFirewall {
         conf: &Config,
         remote_addr: IpAddr,
         port: LeasePort,
+        timeout: Option<Duration>,
     ) -> ah::Result<()> {
         assert!(!self.shutdown);
         let id = (remote_addr, port);
         if let Some(lease) = self.leases.get_mut(&id) {
             lease.refresh_timeout(conf);
         } else {
-            let lease = Lease::new(conf, remote_addr, port);
+            let lease = Lease::new(conf, remote_addr, port, timeout);
             self.nftables_add_lease(conf, &lease).await?;
             self.leases.insert(id, lease);
             self.print_total_rule_count(conf);

letmeinfwd/src/server.rs

@@ -158,9 +158,14 @@ impl FirewallConnection {
                 let resource = self.get_resource(conf, &msg).await?;
 
                 // Get the port information.
-                let lease_port;
-                match resource {
-                    Resource::Port { port, tcp, udp, .. } => {
+                let (lease_port, timeout) = match resource {
+                    Resource::Port {
+                        port,
+                        tcp,
+                        udp,
+                        timeout,
+                        users: _,
+                    } => {
                         // Don't allow the user to manage the control port.
                         if port == conf.port().port {
                             // Whoops, letmeind should never send us a request for the
@@ -170,7 +175,7 @@ impl FirewallConnection {
                             return self.send_result(res).await;
                         }
 
-                        lease_port = match (tcp, udp) {
+                        let lease_port = match (tcp, udp) {
                             (true, false) => LeasePort::Tcp(port),
                             (false, true) => LeasePort::Udp(port),
                             (true, true) => LeasePort::TcpUdp(port),
@@ -179,11 +184,17 @@ impl FirewallConnection {
                                 return self.send_result(res).await;
                             }
                         };
+
+                        (lease_port, timeout)
                     }
-                }
+                };
 
                 // Open the firewall.
-                let res = fw.lock().await.open_port(conf, addr, lease_port).await;
+                let res = fw
+                    .lock()
+                    .await
+                    .open_port(conf, addr, lease_port, timeout)
+                    .await;
                 self.send_result(res).await
             }
             FirewallOperation::Ack | FirewallOperation::Nack => {