Archive for March, 2016

Control DropBox access with iptables

Thursday, March 24th, 2016

I have a few VMs on my network which do not require internet access. However I received a requirement to allow dropbox on them.
My iptables rules are configured to either allow full internet, or one at all.
So After some poking around, I managed to set up forward rules so that specific VMs get dropbox. from here: http://superuser.com/a/1056155/70234
a basic iptables for this scneario looks like this:

*filter
:partinet - [0:0]
:dropbox - [0:0]
-A partinet -p icmp -j ACCEPT

-A dropbox -p tcp -d 162.125.32.129 -j ACCEPT
-A dropbox -p tcp -s 162.125.32.129 -j ACCEPT
-A dropbox -p tcp -d 162.125.17.131 -j ACCEPT
-A dropbox -p tcp -s 162.125.17.131 -j ACCEPT

-A FORWARD -s 192.168.1.x -j partinet
-A FORWARD -d 192.168.1.x -j partinet
-A FORWARD -s 192.168.1.x -j dropbox
-A FORWARD -d 192.168.1.x -j dropbox

COMMIT

and in order to properly support all/most dropbox IPs, I found this blog: https://blog.varonis.com/detect-dropbox-network/ which pointed me to http://whois.arin.net/rest/org/DROPB/nets
so I computed the following iptables rules for my dropbox chain (the list needs to be maintained, of course. I may or may not write a script to automate the creation of these rules based on the arin.net page):

-A dropbox -i eth1 -o eth0 -p tcp -d 162.125.0.0/16 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 162.125.0.0/16 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 199.47.216.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 162.47.216.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 199.47.217.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 162.47.217.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 199.47.218.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 162.47.218.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 199.47.219.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 162.47.219.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.160.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.160.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.161.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.161.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.162.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.162.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.163.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.163.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.164.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.164.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.165.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.165.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.166.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.166.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.167.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.167.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.168.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.168.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.169.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.169.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.170.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.170.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.171.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.171.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.172.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.172.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.173.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.173.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.174.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.174.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.175.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.175.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 205.189.0.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 205.189.0.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 209.99.70.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 209.99.70.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.64.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.64.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.65.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.65.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.66.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.66.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.67.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.67.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.68.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.68.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.69.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.69.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.70.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.70.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.71.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.71.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.72.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.72.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.73.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.73.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.74.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.74.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.75.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.75.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.76.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.76.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.77.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.77.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.78.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.78.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.79.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.79.0/24 -j ACCEPT

Related posts

FireDAC MsSQL server compound field/column

Thursday, March 17th, 2016

So I bumped into this problem with firedac (8.0.x) where I had a table like


CREATE TABLE test(
col1 integer,
col2 integer,
col3 AS ISNULL(col1, col2)
)

and when inserting or updating the col1 or col2 fields, the dataset would not update the col3.
I did quite some debugging and found that there is no support in FireDAC for mssql server for compound fields. There is some in firebird though.
So spending some more time in debugging, I managed to find a workaround by subclassing the dataset like this:


type
TADQuery = class(uADCompClient.TADQuery)
private
FOnAfterInitFieldDefs: TNotifyEvent;
protected
procedure InternalInitFieldDefs; override;
public
property OnAfterInitFieldDefs: TNotifyEvent read FOnAfterInitFieldDefs write FOnAfterInitFieldDefs;
end;

procedure TADQuery.InternalInitFieldDefs;
begin
inherited;

if Assigned(FOnAfterInitFieldDefs) then
FOnAfterInitFieldDefs(self);
end;

... in formcreate or wherever ...

qrySomething.OnAfterInitFieldDefs := DoAfterInitFieldDefs;

procedure TForm1.DoAfterInitFieldDefs(Sender: TObject);
var i: integer;
col: TADDatSColumn;
begin
for i := 0 to TDataSet(Sender).FieldDefs.Count - 1 do
if TDataSet(Sender).FieldDefs[i].Name = 'col3' then
begin
col := TADDataSet(Sender).Table.Columns.ColumnByName('col3');
col.Options := col.Options + [coAfterInsChanges, coAfterUpdChanged];
col.Attributes := col.Attributes + [caDefault];
end;
end;

Enjoy.

Related posts