Fix inconsistent firewall rules

data_safe_haven/functions/__init__.py

@@ -1,11 +1,7 @@
-from .miscellaneous import (
-    allowed_dns_lookups,
-    ordered_private_dns_zones,
-    time_as_string,
-)
 from .strings import (
     alphanumeric,
     b64encode,
+    next_occurrence,
     password,
     replace_separators,
     sanitise_sre_name,
@@ -15,15 +11,13 @@
 )
 
 __all__ = [
-    "allowed_dns_lookups",
     "alphanumeric",
     "b64encode",
-    "ordered_private_dns_zones",
+    "next_occurrence",
     "password",
     "replace_separators",
     "sanitise_sre_name",
     "seeded_uuid",
     "sha256hash",
-    "time_as_string",
     "truncate_tokens",
 ]

data_safe_haven/functions/strings.py

@@ -1,11 +1,16 @@
 import base64
+import datetime
 import hashlib
 import random
 import secrets
 import string
 import uuid
 from collections.abc import Sequence
 
+import pytz
+
+from data_safe_haven.exceptions import DataSafeHavenInputError
+
 
 def alphanumeric(input_string: str) -> str:
     """Strip any characters that are not letters or numbers from a string."""
@@ -21,6 +26,29 @@ def b64encode(input_string: str) -> str:
     return base64.b64encode(input_string.encode("utf-8")).decode()
 
 
+def next_occurrence(hour: int, minute: int, timezone: str) -> str:
+    """
+    Get an ISO-formatted string representing the next occurence in UTC of a daily
+    repeating time in the local timezone.
+    """
+    try:
+        local_tz = pytz.timezone(timezone)
+        local_dt = datetime.datetime.now(local_tz).replace(
+            hour=hour,
+            minute=minute,
+            second=0,
+            microsecond=0,
+        ) + datetime.timedelta(days=1)
+        utc_dt = local_dt.astimezone(pytz.utc)
+        return utc_dt.isoformat()
+    except pytz.exceptions.UnknownTimeZoneError as exc:
+        msg = f"Timezone '{timezone}' was not recognised.\n{exc}"
+        raise DataSafeHavenInputError(msg) from exc
+    except ValueError as exc:
+        msg = f"Time '{hour}:{minute}' was not recognised.\n{exc}"
+        raise DataSafeHavenInputError(msg) from exc
+
+
 def password(length: int) -> str:
     """
     Generate a string of 'length' random alphanumeric characters.

data_safe_haven/infrastructure/common/__init__.py

@@ -1,4 +1,3 @@
-from .enums import FirewallPriorities, NetworkingPriorities, Ports
 from .ip_ranges import SREDnsIpRanges, SREIpRanges
 from .transformations import (
     get_available_ips_from_subnet,
@@ -14,7 +13,6 @@
 )
 
 __all__ = [
-    "FirewallPriorities",
     "get_available_ips_from_subnet",
     "get_id_from_rg",
     "get_id_from_subnet",
@@ -25,8 +23,6 @@
     "get_name_from_subnet",
     "get_name_from_vnet",
     "get_subscription_id_from_rg",
-    "NetworkingPriorities",
-    "Ports",
     "SREDnsIpRanges",
     "SREIpRanges",
 ]

data_safe_haven/infrastructure/programs/shm/firewall.py

@@ -5,13 +5,15 @@
 from pulumi import ComponentResource, Input, Output, ResourceOptions
 from pulumi_azure_native import network
 
-from data_safe_haven.functions import allowed_dns_lookups
 from data_safe_haven.infrastructure.common import (
-    FirewallPriorities,
-    Ports,
     SREIpRanges,
     get_id_from_subnet,
 )
+from data_safe_haven.types import (
+    FirewallPriorities,
+    PermittedDomains,
+    Ports,
+)
 
 
 class SHMFirewallProps:
@@ -58,13 +60,6 @@ def __init__(
             "216.239.35.8",
             "216.239.35.12",
         ]
-        ntp_fqdns = [
-            "time.google.com",
-            "time1.google.com",
-            "time2.google.com",
-            "time3.google.com",
-            "time4.google.com",
-        ]
         sre_identity_server_subnets = [
             str(SREIpRanges(idx).identity_containers)
             for idx in range(1, SREIpRanges.max_index)
@@ -132,7 +127,7 @@ def __init__(
                                 )
                             ],
                             source_addresses=["*"],
-                            target_fqdns=ntp_fqdns,
+                            target_fqdns=PermittedDomains.TIME_SERVERS,
                         ),
                     ],
                 ),
@@ -151,10 +146,7 @@ def __init__(
                                 )
                             ],
                             source_addresses=sre_identity_server_subnets,
-                            target_fqdns=[
-                                "graph.microsoft.com",
-                                "login.microsoftonline.com",
-                            ],
+                            target_fqdns=PermittedDomains.MICROSOFT_IDENTITY,
                         ),
                     ],
                 ),
@@ -173,7 +165,7 @@ def __init__(
                                 )
                             ],
                             source_addresses=sre_package_repositories_subnets,
-                            target_fqdns=["cran.r-project.org"],
+                            target_fqdns=PermittedDomains.SOFTWARE_REPOSITORIES_R,
                         ),
                         network.AzureFirewallApplicationRuleArgs(
                             description="Allow external PyPI package requests",
@@ -185,7 +177,7 @@ def __init__(
                                 )
                             ],
                             source_addresses=sre_package_repositories_subnets,
-                            target_fqdns=["files.pythonhosted.org", "pypi.org"],
+                            target_fqdns=PermittedDomains.SOFTWARE_REPOSITORIES_PYTHON,
                         ),
                     ],
                 ),
@@ -204,7 +196,7 @@ def __init__(
                                 )
                             ],
                             source_addresses=sre_remote_desktop_gateway_subnets,
-                            target_fqdns=["login.microsoftonline.com"],
+                            target_fqdns=PermittedDomains.MICROSOFT_LOGIN,
                         ),
                     ],
                 ),
@@ -227,7 +219,7 @@ def __init__(
                                 ),
                             ],
                             source_addresses=sre_apt_proxy_servers,
-                            target_fqdns=allowed_dns_lookups("apt_repositories"),
+                            target_fqdns=PermittedDomains.APT_REPOSITORIES,
                         ),
                     ],
                 ),
@@ -250,11 +242,7 @@ def __init__(
                                 ),
                             ],
                             source_addresses=sre_workspaces_subnets,
-                            target_fqdns=[
-                                "current.cvd.clamav.net",
-                                "database.clamav.net.cdn.cloudflare.net",
-                                "database.clamav.net",
-                            ],
+                            target_fqdns=PermittedDomains.CLAMAV_UPDATES,
                         ),
                         network.AzureFirewallApplicationRuleArgs(
                             description="Allow external Linux ClamAV update requests",
@@ -266,9 +254,7 @@ def __init__(
                                 ),
                             ],
                             source_addresses=sre_workspaces_subnets,
-                            target_fqdns=[
-                                "keyserver.ubuntu.com",
-                            ],
+                            target_fqdns=PermittedDomains.UBUNTU_KEYSERVER,
                         ),
                     ],
                 ),
@@ -342,7 +328,7 @@ def __init__(
 
         # Register outputs
         self.external_dns_resolver = external_dns_resolver
-        self.ntp_fqdns = ntp_fqdns
+        self.ntp_fqdns = PermittedDomains.TIME_SERVERS
         self.ntp_ip_addresses = ntp_ip_addresses
         self.public_ip_id = public_ip.id