Merge pull request #16221 from Security-Onion-Solutions/mreeves/kratos-soauth-network

Isolate the Kratos admin API on a dedicated soauth docker network

setup/so-functions

@@ -276,9 +276,20 @@ collect_dockernet() {
 			whiptail_invalid_input
 			whiptail_dockernet_sosnet "$DOCKERNET"
 		done
+
+		whiptail_authnet_sosnet "$(adjacent_net "$DOCKERNET")"
+
+		while ! valid_ip4 "$AUTHNET" || [[ $AUTHNET =~ "172.17.0." ]] || [[ "$AUTHNET" == "$DOCKERNET" ]]; do
+			whiptail_invalid_input
+			whiptail_authnet_sosnet "$AUTHNET"
+		done
 	fi
 }
 
+adjacent_net() {
+	echo "$1" | awk -F'.' '{ printf "%s.%s.%s.%s", $1, $2, ($3 + 1) % 256, $4 }'
+}
+
 collect_gateway() {
 	whiptail_management_interface_gateway
 
@@ -1399,6 +1410,15 @@ docker_pillar() {
 			"docker:"\
 			"  range: '$DOCKERNET/24'"\
 			"  gateway: '$DOCKERGATEWAY'" > $docker_pillar_file
+
+		if [ ! -z "$AUTHNET" ]; then
+			AUTHGATEWAY=$(echo $AUTHNET | awk -F'.' '{print $1,$2,$3,1}' OFS='.')
+			printf '%s\n'\
+				"  networks:"\
+				"    soauth:"\
+				"      range: '$AUTHNET/24'"\
+				"      gateway: '$AUTHGATEWAY'" >> $docker_pillar_file
+		fi
 	fi
 }
 

setup/so-whiptail

@@ -365,6 +365,18 @@ whiptail_dockernet_sosnet() {
 
 }
 
+whiptail_authnet_sosnet() {
+
+	[ -n "$TESTING" ] && return
+
+	AUTHNET=$(whiptail --title "$whiptail_title" --inputbox \
+	"\nEnter a second /24 size network range WITHOUT the /24 suffix. The authentication services are isolated on their own network so that the identity provider is not reachable from other containers. It must not overlap the range you just entered, and any range within 172.17.0.0/24 cannot be used." 13 65 "$1" 3>&1 1>&2 2>&3)
+
+	local exitstatus=$?
+	whiptail_check_exitstatus $exitstatus
+
+}
+
 whiptail_end_settings() {
 	[ -n "$TESTING" ] && return
 
@@ -427,6 +439,7 @@ whiptail_end_settings() {
 	[[ -n $WEBUSER ]] && __append_end_msg "Web User: $WEBUSER"
 
 	[[ -n $DOCKERNET ]] && __append_end_msg "Docker network: $DOCKERNET/24"
+	[[ -n $AUTHNET ]] && __append_end_msg "Authentication network: $AUTHNET/24"
 	if [[ ${#ntp_servers[@]} -gt 0 ]]; then
 		__append_end_msg "NTP Servers:"
 		for server in "${ntp_servers[@]}"; do