Add iptables rules to block requests to the supervisor API from all interfaces except vpn, docker and local

Dockerfile.amd64

@@ -11,6 +11,7 @@ RUN apt-get -q update \
 		btrfs-tools \
 		ca-certificates \
 		curl \
+		iptables \
 		rsync \
 		supervisor \
 		--no-install-recommends \

Dockerfile.armel

@@ -11,6 +11,7 @@ RUN apt-get -q update \
 		btrfs-tools \
 		ca-certificates \
 		curl \
+		iptables \
 		rsync \
 		supervisor \
 		--no-install-recommends \

Dockerfile.armv7hf

@@ -11,6 +11,7 @@ RUN apt-get -q update \
 		btrfs-tools \
 		ca-certificates \
 		curl \
+		iptables \
 		rsync \
 		supervisor \
 		--no-install-recommends \

Dockerfile.i386

@@ -11,6 +11,7 @@ RUN apt-get -q update \
 		btrfs-tools \
 		ca-certificates \
 		curl \
+		iptables \
 		rsync \
 		supervisor \
 		--no-install-recommends \

Dockerfile.rpi

@@ -11,6 +11,7 @@ RUN apt-get -q update \
 		btrfs-tools \
 		ca-certificates \
 		curl \
+		iptables \
 		rsync \
 		supervisor \
 		--no-install-recommends \

src/app.coffee

@@ -24,8 +24,10 @@ knex.init.then ->
 		device = require './device'
 
 		console.log('Starting API server..')
-		apiServer = api(application).listen(config.listenPort)
+		utils.createIpTablesRules()
-		apiServer.timeout = config.apiTimeout
+		.then ->
+			apiServer = api(application).listen(config.listenPort)
+			apiServer.timeout = config.apiTimeout
 
 		bootstrap.done
 		.then ->

src/utils.coffee

@@ -11,6 +11,7 @@ randomHexString = require './lib/random-hex-string'
 request = Promise.promisifyAll require 'request'
 logger = require './lib/logger'
 TypedError = require 'typed-error'
+execAsync = Promise.promisify(require('child_process').exec)
 
 # Parses package.json and returns resin-supervisor's version
 version = require('../package.json').version
@@ -279,3 +280,10 @@ exports.validateKeys = (options, validSet) ->
 		return if !options?
 		invalidKeys = _.keys(_.omit(options, validSet))
 		throw new Error("Using #{invalidKeys.join(', ')} is not allowed.") if !_.isEmpty(invalidKeys)
+
+exports.createIpTablesRules = ->
+	allowedInterfaces = ['tun0', 'docker0', 'lo']
+	Promise.each allowedInterfaces, (iface) ->
+		execAsync("iptables -A INPUT -p tcp --dport #{config.listenPort} -i #{iface} -j ACCEPT")
+	.then ->
+		execAsync("iptables -A INPUT -p tcp --dport #{config.listenPort} -j REJECT")