adam/housecarl
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 34 Wiki Activity

Add changesets, bandwidth limits and quotas; generic examples

Browse Source 
Changesets, as in Jarl: configuration changes are operations that can be
staged in a changeset, checked as they are added (validation and nft -c),
reviewed with the diff of the ruleset, and applied together as one
history entry, then on probation like any change made over the network.
The web UI collects edits for review by default (pending rows, a bar with
Review and Apply now, a Changes page, a switch for live edits); hc stages
with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has
hc changeset create/list/show/diff/apply/discard/remove. Undo, import and
takeover refuse a changeset. --dry-run shows the ruleset's diff.

Bandwidth and quotas: rate limits in bytes, per source or destination;
quotas per rule or per address that reset daily, weekly, monthly on a
day, or by hand, with their usage carried across reloads, saved for
reboots, shown by hc quotas and on the rules page, and reset with hc rule
reset-quota. Rules that count traffic are checked before established
connections are accepted (so they see every packet) and can't accept.
Per-address limits group IPv6 by /64 by default (--group-v4/-v6).
Per-source rate meters use update. The importer turns meters, byte rates
and quotas into these fields.

The examples in the web UI, hc's help and the docs use documentation
addresses and generic names instead of the maintainer's network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
abrown38andClaude Opus 5.5 committed 2026-10-19 11:18:54 +01:00
1 parent ebec2cfcca
commit 2880f7ddc9
63 files changed
+4018 -385
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/api/types.go
+44
View File
@@ -26,6 +26,8 @@ type ErrorInfo struct {
Problems []validate.Problem `json:"problems,omitempty"`
// Result is the preview of a refused change.
Result json.RawMessage `json:"result,omitempty"`
// Op is the changeset operation (its seq) that couldn't be applied.
Op int `json:"op,omitempty"`
}
// Whoami describes the caller.
@@ -64,6 +66,29 @@ type MutationResponse struct {
// ConfirmBy is set when the change is on probation: unless confirmed
// (POST /confirm) by then, it is rolled back.
ConfirmBy *time.Time `json:"confirm_by,omitempty"`
// Diff is the ruleset's unified diff, for a dry run.
Diff string `json:"diff,omitempty"`
// Staged: the change was added to a changeset (Changeset), not
// applied.
Staged bool `json:"staged,omitempty"`
Changeset *model.Changeset `json:"changeset,omitempty"`
}
// ChangesetInput creates a changeset, or changes its description.
type ChangesetInput struct {
Description string `json:"description"`
}
// ChangesetPreview is what applying a changeset would do: its changes,
// the problems, nftables' check and the ruleset's diff.
type ChangesetPreview struct {
// Valid: it can be applied as it is.
Valid bool `json:"valid"`
Changes []model.Change `json:"changes"`
Warnings []validate.Problem `json:"warnings,omitempty"`
// Error says why it can't be applied (Op: which operation, if one).
Error *ErrorInfo `json:"error,omitempty"`
Diff string `json:"diff,omitempty"`
}
// HostInterface is one of the server's network interfaces, with the zone
@@ -274,3 +299,22 @@ type CertificateResponse struct {
Source string `json:"source"`
Status *CertStatus `json:"status,omitempty"`
}
// QuotaInfo is a rule's quota and what it used.
type QuotaInfo struct {
RuleID int64 `json:"rule_id"`
Rule string `json:"rule"`
Quota model.Quota `json:"quota"`
// Used is a total quota's bytes; Addresses a per-address quota's,
// each ("192.168.1.20", or "2001:db8:1::/64").
Used int64 `json:"used"`
Addresses []QuotaAddress `json:"addresses,omitempty"`
LastReset *time.Time `json:"last_reset,omitempty"`
NextReset *time.Time `json:"next_reset,omitempty"`
}
// QuotaAddress is one address's (or prefix's) use of a per-address quota.
type QuotaAddress struct {
Address string `json:"address"`
Used int64 `json:"used"`
}
internal/client/client.go
+34
View File
@@ -14,6 +14,7 @@ import (
"net/http"
"net/url"
"os"
"strconv"
"strings"
"time"
@@ -28,6 +29,29 @@ type Client struct {
HTTP *http.Client
// DryRun previews changes instead of making them.
DryRun bool
// Changeset stages configuration changes in that changeset instead
// of applying them (X-Housecarl-Changeset).
Changeset int64
// BeforeStage, if set, runs once before the first change is staged,
// and can stop it (the CLI checks HOUSECARL_CHANGESET's changeset).
BeforeStage func() error
staged bool
}
// Staged reports whether a request is a configuration change that a
// changeset takes: objects and settings, and the changes that can't be
// staged (undo, import, takeover), which the server then refuses rather
// than apply them. Changesets' own calls and dynamic set entries aren't.
func Staged(method, path string) bool {
if method == http.MethodGet || strings.Contains(path, "/elements") {
return false
}
for _, p := range []string{"/zones", "/sets", "/services", "/rules", "/forwards", "/snats", "/redirects", "/settings", "/history/", "/import/", "/takeover"} {
if strings.HasPrefix(path, p) {
return true
}
}
return false
}
// Options configure New.
@@ -107,6 +131,12 @@ func (c *Client) Do(ctx context.Context, method, path string, query url.Values,
}
query.Set("dry_run", "1")
}
stage := c.Changeset != 0 && Staged(method, path)
if stage && !c.staged && c.BeforeStage != nil {
if err := c.BeforeStage(); err != nil {
return err
}
}
u := c.BaseURL + api.Prefix + path
if len(query) > 0 {
u += "?" + query.Encode()
@@ -131,6 +161,10 @@ func (c *Client) Do(ctx context.Context, method, path string, query url.Values,
if c.Token != "" {
req.Header.Set("Authorization", "Bearer "+c.Token)
}
if stage {
req.Header.Set("X-Housecarl-Changeset", strconv.FormatInt(c.Changeset, 10))
c.staged = true
}
resp, err := c.HTTP.Do(req)
if err != nil {
if c.BaseURL == "http://housecarld" {
internal/engine/engine.go
+5 -2
View File
@@ -74,6 +74,9 @@ type Result struct {
HistoryID int64 `json:"history_id,omitempty"`
Changes []model.Change `json:"changes"`
Warnings []validate.Problem `json:"warnings,omitempty"`
// Before and After are the configurations the change goes from and
// to (After also for a dry run), for diffs and answers.
Before, After *model.State `json:"-"`
}
// Engine holds the current configuration.
@@ -166,7 +169,7 @@ func (e *Engine) commit(ctx context.Context, p *auth.Principal, description stri
Normalize(next)
next.Sort()
changes := Diff(e.state, next)
res := &Result{DryRun: opts.DryRun, Changes: changes}
res := &Result{DryRun: opts.DryRun, Changes: changes, Before: e.state.Clone(), After: next.Clone()}
if len(changes) == 0 {
return res, nil
}
@@ -370,7 +373,7 @@ func Diff(a, b *model.State) []model.Change {
return out
}
// Describe sums up changes: "create zone lan (enp2s0)", or
// Describe sums up changes: "create zone lan (eth1)", or
// "3 changes" for many.
func Describe(cs []model.Change) string {
if len(cs) == 0 {
internal/importer/importer.go
+237 -27
View File
@@ -13,6 +13,7 @@ package importer
import (
"encoding/json"
"fmt"
"net/netip"
"regexp"
"sort"
"strconv"
@@ -115,6 +116,7 @@ type importer struct {
portNames map[string]string // canonical port list → define name
ifNames map[string]string // interface → define name
used map[string]bool // sets created
meters map[string]bool // sets used as meters
noted map[string]bool
positions map[string]float64
}
@@ -199,6 +201,7 @@ func Import(in Input) (*Result, error) {
}
im.readText()
im.readDefines()
im.findMeters()
im.importSets()
im.run()
im.nameForwards()
@@ -313,6 +316,27 @@ func validIface(s string) bool {
// ---- sets
// importSets turns the table's named address sets into sets.
// findMeters notes the sets rules use as meters (set statements: "update
// @m { ip saddr limit ... }"): they hold per-address state, not
// addresses, and become the rules' per-address limits and quotas.
func (im *importer) findMeters() {
im.meters = map[string]bool{}
for _, rules := range im.rules {
for _, r := range rules {
for _, e := range r.Expr {
var x struct {
Set *struct {
Set string `json:"set"`
} `json:"set"`
}
if json.Unmarshal(e, &x) == nil && x.Set != nil {
im.meters[strings.TrimPrefix(x.Set.Set, "@")] = true
}
}
}
}
}
func (im *importer) importSets() {
names := make([]string, 0, len(im.sets))
for n := range im.sets {
@@ -320,6 +344,9 @@ func (im *importer) importSets() {
}
sort.Strings(names)
for _, n := range names {
if im.meters[n] {
continue
}
s := im.sets[n]
var typ string
json.Unmarshal(s.Type, &typ)
@@ -456,19 +483,24 @@ func values(raw json.RawMessage) []string {
// parsed is one rule, read.
type parsed struct {
inIf, outIf []string
notIn, notOut bool
src, dst []string // entries, or "@set"
notSrc, notDst bool
family string
proto string
dports []string
icmp []string
icmpProto string
ctState, ctStatus []string
hop255 bool
tcpSyn bool
limit *model.Limit
inIf, outIf []string
notIn, notOut bool
src, dst []string // entries, or "@set"
notSrc, notDst bool
family string
proto string
dports []string
icmp []string
icmpProto string
ctState, ctStatus []string
hop255 bool
tcpSyn bool
limit *model.Limit
quota *model.Quota
connLimit int
// group4, group6: a meter's key grouped by a prefix (ip saddr and
// 255.255.255.0); 0 for none.
group4, group6 int
log bool
logPrefix string
verdict string // accept, drop, reject, jump, goto, return
@@ -547,19 +579,21 @@ func (p *parsed) expr(k string, v json.RawMessage) {
json.Unmarshal(v, &x)
p.log, p.logPrefix = true, x.Prefix
case "limit":
var x struct {
Rate int `json:"rate"`
Per string `json:"per"`
Burst int `json:"burst"`
Inv bool `json:"inv"`
Unit string `json:"rate_unit"`
}
json.Unmarshal(v, &x)
if x.Unit != "" && x.Unit != "packets" {
p.bad("a byte rate limit")
l, ok := limitJSON(v)
if !ok {
p.bad("a limit Housecarl can't read")
return
}
p.limit = &model.Limit{Rate: x.Rate, Per: x.Per, Burst: x.Burst, Over: x.Inv}
p.limit = l
case "quota":
q, ok := quotaJSON(v)
if !ok {
p.bad("a quota Housecarl can't read")
return
}
p.quota = q
case "set":
p.meter(v)
case "dnat", "snat":
var x struct {
Family string `json:"family"`
@@ -625,6 +659,172 @@ func (p *parsed) expr(k string, v json.RawMessage) {
}
}
// limitJSON reads a limit: packets, or bytes (rate_unit, burst_unit).
func limitJSON(v json.RawMessage) (*model.Limit, bool) {
var x struct {
Rate int64 `json:"rate"`
Per string `json:"per"`
Burst int64 `json:"burst"`
Inv bool `json:"inv"`
Unit string `json:"rate_unit"`
BurstUnit string `json:"burst_unit"`
}
if json.Unmarshal(v, &x) != nil {
return nil, false
}
l := &model.Limit{Rate: int(x.Rate), Per: x.Per, Burst: int(x.Burst), Over: x.Inv}
if x.Unit == "" || x.Unit == "packets" {
return l, true
}
// Bytes: both in the largest unit that holds them exactly.
rm, ok1 := model.ByteUnits[x.Unit]
bu := x.BurstUnit
if bu == "" {
bu = "bytes"
}
bm, ok2 := model.ByteUnits[bu]
if !ok1 || !ok2 {
return nil, false
}
rate, burst := x.Rate*rm, x.Burst*bm
for _, u := range []string{"mbytes", "kbytes", "bytes"} {
m := model.ByteUnits[u]
if rate%m == 0 && burst%m == 0 {
l.Rate, l.Burst, l.Unit = int(rate/m), int(burst/m), u
break
}
}
return l, true
}
// quotaJSON reads a quota: {"val": 100, "val_unit": "mbytes", "inv": true}.
func quotaJSON(v json.RawMessage) (*model.Quota, bool) {
var x struct {
Val int64 `json:"val"`
Unit string `json:"val_unit"`
Inv bool `json:"inv"`
}
if json.Unmarshal(v, &x) != nil {
return nil, false
}
m, ok := model.ByteUnits[x.Unit]
if x.Unit == "" {
m, ok = 1, true
}
if !ok || x.Val < 1 {
return nil, false
}
return &model.Quota{Bytes: x.Val * m, Over: x.Inv}, true
}
// meter reads a set statement that keeps a limit, connection count or
// quota per address (a meter: "update @m { ip saddr limit rate over
// 3/minute }"), keyed by source or destination, perhaps grouped by a
// prefix.
func (p *parsed) meter(v json.RawMessage) {
var x struct {
Op string `json:"op"`
Elem json.RawMessage `json:"elem"`
Stmt []json.RawMessage `json:"stmt"`
}
if json.Unmarshal(v, &x) != nil || (x.Op != "add" && x.Op != "update") || len(x.Stmt) != 1 {
p.bad("a set statement")
return
}
// The key: ip saddr, or ip saddr and MASK.
var key map[string]json.RawMessage
json.Unmarshal(x.Elem, &key)
bits := 0
if and, ok := key["&"]; ok {
var pair []json.RawMessage
var mask string
if json.Unmarshal(and, &pair) != nil || len(pair) != 2 || json.Unmarshal(pair[1], &mask) != nil {
p.bad("a meter key")
return
}
a, err := netip.ParseAddr(mask)
if err != nil {
p.bad("a meter key")
return
}
pfx, ok := maskBits(a)
if !ok {
p.bad("a meter key with a mask that isn't a prefix")
return
}
bits = pfx
key = nil
json.Unmarshal(pair[0], &key)
}
var pl struct{ Protocol, Field string }
if raw, ok := key["payload"]; !ok || json.Unmarshal(raw, &pl) != nil || (pl.Protocol != "ip" && pl.Protocol != "ip6") || (pl.Field != "saddr" && pl.Field != "daddr") {
p.bad("a meter keyed by something other than an address")
return
}
if bits > 0 {
if pl.Protocol == "ip" {
p.group4 = bits
} else {
p.group6 = bits
}
}
if p.family == "" {
p.family = map[string]string{"ip": "ipv4", "ip6": "ipv6"}[pl.Protocol]
}
var stmt map[string]json.RawMessage
json.Unmarshal(x.Stmt[0], &stmt)
switch {
case stmt["limit"] != nil:
l, ok := limitJSON(stmt["limit"])
if !ok {
p.bad("a meter's limit")
return
}
l.PerSource, l.PerDestination = pl.Field == "saddr", pl.Field == "daddr"
p.limit = l
case stmt["ct count"] != nil:
var c struct {
Val int `json:"val"`
Inv bool `json:"inv"`
}
if json.Unmarshal(stmt["ct count"], &c) != nil || !c.Inv || pl.Field != "saddr" {
p.bad("a connection count other than over N per source")
return
}
p.connLimit = c.Val
case stmt["quota"] != nil:
q, ok := quotaJSON(stmt["quota"])
if !ok {
p.bad("a meter's quota")
return
}
q.PerSource, q.PerDestination = pl.Field == "saddr", pl.Field == "daddr"
p.quota = q
default:
p.bad("a set statement")
}
}
// maskBits is a mask's prefix length (255.255.255.0: 24), if it is one:
// ones, then only zeros.
func maskBits(a netip.Addr) (int, bool) {
n, zero := 0, false
for _, x := range a.AsSlice() {
for bit := 7; bit >= 0; bit-- {
one := x&(1<<bit) != 0
switch {
case one && zero:
return 0, false
case one:
n++
default:
zero = true
}
}
}
return n, true
}
func (p *parsed) match(m match) {
var left map[string]json.RawMessage
json.Unmarshal(m.Left, &left)
@@ -972,7 +1172,7 @@ var essentials6 = map[string]bool{"destination-unreachable": true, "packet-too-b
var nd6 = map[string]bool{"nd-router-solicit": true, "nd-router-advert": true, "nd-neighbor-solicit": true, "nd-neighbor-advert": true}
func plain(p *parsed) bool {
return len(p.unsupported) == 0 && p.limit == nil && !p.log && len(p.src) == 0 && len(p.dst) == 0 && len(p.outIf) == 0
return len(p.unsupported) == 0 && p.limit == nil && p.quota == nil && p.connLimit == 0 && !p.log && len(p.src) == 0 && len(p.dst) == 0 && len(p.outIf) == 0
}
// builtinOf names the built-in a rule is, or "".
@@ -1203,7 +1403,8 @@ func (im *importer) rule(chain string, p *parsed) {
return
}
r := &model.Rule{ID: im.newID(), Chain: chain, Position: im.nextPos(chain), Comment: p.comment, CtState: p.ctState, CtStatus: p.ctStatus,
Limit: p.limit, Log: p.log, LogPrefix: p.logPrefix, RejectWith: p.rejectWith}
Limit: p.limit, Quota: p.quota, ConnLimit: p.connLimit, GroupV4: p.group4, GroupV6: p.group6,
Log: p.log, LogPrefix: p.logPrefix, RejectWith: p.rejectWith}
switch p.verdict {
case "accept", "drop", "reject":
r.Action = p.verdict
@@ -1222,6 +1423,15 @@ func (im *importer) rule(chain string, p *parsed) {
p.bad(p.verdict)
}
m, ok := im.toMatch(p)
if r.CountsTraffic() && r.Action == model.ActionAccept {
// Housecarl checks these before established connections are
// accepted, where accepting would skip the later rules: as written.
p.bad("an accept with a quota or a byte rate")
ok = false
}
if ok && r.CountsTraffic() && chain != model.ChainEarly {
im.note("%s rule handle %d has a quota or a byte rate: Housecarl checks it before established connections are accepted, so it counts every packet of a connection", chain, p.handle)
}
if ok && !p.hop255 && !p.mss && !p.tcpSyn && !p.flowAdd && p.dnatAddr == "" && !p.masq {
r.Match = m
im.st.Rules = append(im.st.Rules, r)
@@ -1315,7 +1525,7 @@ func forwardName(comment string) string {
}
// nameForwards makes the forwards' names (from their comments) valid and
// unique: "8096 to jellyfin" becomes "fwd-8096-to-jellyfin", a second
// unique: "8080 to web" becomes "fwd-8080-to-web", a second
// "web" becomes "web-2".
func (im *importer) nameForwards() {
seen := map[string]bool{}
internal/importer/importer_test.go
+62
View File
@@ -239,3 +239,65 @@ func TestImportMaps(t *testing.T) {
}
}
}
// TestImportMeters: meters (per-address limits, connection counts and
// quotas), byte rates and quotas become rules' limits and quotas
// (testdata/meters.nft); the meters' sets aren't imported as address sets.
func TestImportMeters(t *testing.T) {
js, _ := os.ReadFile("testdata/meters.json")
txt, _ := os.ReadFile("testdata/meters.txt")
res, err := Import(Input{JSON: js, Text: string(txt)})
if err != nil {
t.Fatal(err)
}
var got []string
for _, r := range res.State.Rules {
s := r.Chain
if l := r.Limit; l != nil {
s += fmt.Sprintf(" limit %d %s/%s burst %d over=%v src=%v dst=%v", l.Rate, l.Unit, l.Per, l.Burst, l.Over, l.PerSource, l.PerDestination)
}
if r.ConnLimit > 0 {
s += fmt.Sprintf(" conn %d", r.ConnLimit)
}
if q := r.Quota; q != nil {
s += fmt.Sprintf(" quota %d over=%v src=%v", q.Bytes, q.Over, q.PerSource)
}
if r.GroupV4 != 0 || r.GroupV6 != 0 {
s += fmt.Sprintf(" group %d/%d", r.GroupV4, r.GroupV6)
}
s += " " + r.Action + r.Raw
got = append(got, s)
}
want := []string{
"input accept", // established: only in input here, so a rule
"input limit 3 /minute burst 5 over=true src=true dst=false drop",
"input limit 3 /minute burst 5 over=true src=true dst=false group 0/64 drop",
"input accept",
"forward conn 20 drop",
"forward limit 10240 kbytes/second burst 512 over=true src=false dst=false drop",
"forward quota 1048576000 over=true src=true group 24/0 drop",
"forward quota 104857600000 over=true src=false drop",
"forward accept",
}
if strings.Join(got, "\n") != strings.Join(want, "\n") {
t.Errorf("rules:\n%s\nwant:\n%s\nnotes: %v", strings.Join(got, "\n"), strings.Join(want, "\n"), res.Notes)
}
for _, s := range res.State.Sets {
if s.Name != "trusted" {
t.Errorf("a meter became a set: %s", s.Name)
}
}
if len(res.Raw) > 0 {
t.Errorf("raw rules: %v", res.Raw)
}
if ps := validate.Errors(validate.Check(res.State, nil)); len(ps) > 0 {
t.Errorf("invalid: %+v", ps)
}
if cmd := strings.Fields(os.Getenv("HOUSECARL_NFT")); len(cmd) > 0 {
c := exec.Command(cmd[0], append(cmd[1:], "-c", "-f", "/dev/stdin")...)
c.Stdin = strings.NewReader(render.Render(res.State, render.Options{}).Text)
if out, err := c.CombinedOutput(); err != nil {
t.Errorf("nft -c: %v\n%s", err, out)
}
}
}
internal/importer/testdata/meters.json
Vendored
+1
View File
@@ -0,0 +1 @@
{"nftables": [{"metainfo": {"version": "1.1.3", "release_name": "Commodore Bullmoose #4", "json_schema_version": 1}}, {"table": {"family": "inet", "name": "main", "handle": 1}}, {"chain": {"family": "inet", "table": "main", "name": "input", "handle": 1, "type": "filter", "hook": "input", "prio": 0, "policy": "drop"}}, {"chain": {"family": "inet", "table": "main", "name": "forward", "handle": 2, "type": "filter", "hook": "forward", "prio": 0, "policy": "drop"}}, {"chain": {"family": "inet", "table": "main", "name": "output", "handle": 3, "type": "filter", "hook": "output", "prio": 0, "policy": "accept"}}, {"set": {"family": "inet", "name": "ssh_meter", "table": "main", "type": "ipv4_addr", "handle": 4, "size": 65535, "flags": ["timeout", "dynamic"], "timeout": 60}}, {"set": {"family": "inet", "name": "ssh6_meter", "table": "main", "type": "ipv6_addr", "handle": 5, "size": 65535, "flags": ["timeout", "dynamic"], "timeout": 60}}, {"set": {"family": "inet", "name": "my_connlimit", "table": "main", "type": "ipv4_addr", "handle": 6, "size": 65535, "flags": ["dynamic"]}}, {"set": {"family": "inet", "name": "guest_quota", "table": "main", "type": "ipv4_addr", "handle": 7, "size": 65535, "flags": ["dynamic"]}}, {"set": {"family": "inet", "name": "trusted", "table": "main", "type": "ipv4_addr", "handle": 8, "flags": ["interval"], "elem": [{"prefix": {"addr": "10.0.10.0", "len": 24}}]}}, {"rule": {"family": "inet", "table": "main", "chain": "input", "handle": 9, "expr": [{"match": {"op": "in", "left": {"ct": {"key": "state"}}, "right": ["established", "related"]}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "main", "chain": "input", "handle": 10, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": 22}}, {"match": {"op": "in", "left": {"ct": {"key": "state"}}, "right": "new"}}, {"set": {"op": "update", "elem": {"payload": {"protocol": "ip", "field": "saddr"}}, "set": "@ssh_meter", "stmt": [{"limit": {"rate": 3, "burst": 5, "per": "minute", "inv": true}}]}}, {"counter": {"packets": 0, "bytes": 0}}, {"drop": null}]}}, {"rule": {"family": "inet", "table": "main", "chain": "input", "handle": 11, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": 22}}, {"match": {"op": "in", "left": {"ct": {"key": "state"}}, "right": "new"}}, {"set": {"op": "update", "elem": {"&": [{"payload": {"protocol": "ip6", "field": "saddr"}}, "ffff:ffff:ffff:ffff::"]}, "set": "@ssh6_meter", "stmt": [{"limit": {"rate": 3, "burst": 5, "per": "minute", "inv": true}}]}}, {"counter": {"packets": 0, "bytes": 0}}, {"drop": null}]}}, {"rule": {"family": "inet", "table": "main", "chain": "input", "handle": 12, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ip", "field": "saddr"}}, "right": "@trusted"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": 22}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "main", "chain": "forward", "handle": 13, "expr": [{"match": {"op": "in", "left": {"ct": {"key": "state"}}, "right": "new"}}, {"set": {"op": "add", "elem": {"payload": {"protocol": "ip", "field": "saddr"}}, "set": "@my_connlimit", "stmt": [{"ct count": {"val": 20, "inv": true}}]}}, {"counter": {"packets": 0, "bytes": 0}}, {"drop": null}]}}, {"rule": {"family": "inet", "table": "main", "chain": "forward", "handle": 14, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "iifname"}}, "right": "lan"}}, {"match": {"op": "==", "left": {"meta": {"key": "oifname"}}, "right": "wan"}}, {"limit": {"rate": 10, "burst": 512, "per": "second", "inv": true, "rate_unit": "mbytes", "burst_unit": "kbytes"}}, {"drop": null}]}}, {"rule": {"family": "inet", "table": "main", "chain": "forward", "handle": 15, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "iifname"}}, "right": "guest0"}}, {"match": {"op": "==", "left": {"meta": {"key": "oifname"}}, "right": "wan"}}, {"set": {"op": "add", "elem": {"&": [{"payload": {"protocol": "ip", "field": "saddr"}}, "255.255.255.0"]}, "set": "@guest_quota", "stmt": [{"quota": {"val": 1000, "val_unit": "mbytes", "inv": true}}]}}, {"drop": null}]}}, {"rule": {"family": "inet", "table": "main", "chain": "forward", "handle": 16, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "iifname"}}, "right": "lan"}}, {"match": {"op": "==", "left": {"meta": {"key": "oifname"}}, "right": "wan"}}, {"quota": {"val": 100000, "val_unit": "mbytes", "inv": true}}, {"drop": null}]}}, {"rule": {"family": "inet", "table": "main", "chain": "forward", "handle": 17, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "iifname"}}, "right": "lan"}}, {"match": {"op": "==", "left": {"meta": {"key": "oifname"}}, "right": "wan"}}, {"accept": null}]}}]}
internal/importer/testdata/meters.nft
Vendored
+46
View File
@@ -0,0 +1,46 @@
# Meters, byte rates and quotas, as hand-written rulesets use them (importer_test.go).
table inet main {
set ssh_meter {
type ipv4_addr
flags dynamic,timeout
timeout 1m
}
set ssh6_meter {
type ipv6_addr
flags dynamic,timeout
timeout 1m
}
set my_connlimit {
type ipv4_addr
size 65535
flags dynamic
}
set guest_quota {
type ipv4_addr
size 65535
flags dynamic
}
set trusted {
type ipv4_addr
flags interval
elements = { 10.0.10.0/24 }
}
chain input {
type filter hook input priority filter; policy drop;
ct state established,related accept
tcp dport 22 ct state new update @ssh_meter { ip saddr limit rate over 3/minute burst 5 packets } counter drop
tcp dport 22 ct state new update @ssh6_meter { ip6 saddr and ffff:ffff:ffff:ffff:: limit rate over 3/minute } counter drop
ip saddr @trusted tcp dport 22 accept
}
chain forward {
type filter hook forward priority filter; policy drop;
ct state new add @my_connlimit { ip saddr ct count over 20 } counter drop
iifname "lan" oifname "wan" limit rate over 10 mbytes/second burst 512 kbytes drop
iifname "guest0" oifname "wan" add @guest_quota { ip saddr and 255.255.255.0 quota over 1000 mbytes } drop
iifname "lan" oifname "wan" quota over 100000 mbytes drop
iifname "lan" oifname "wan" accept
}
chain output {
type filter hook output priority filter; policy accept;
}
}
internal/importer/testdata/meters.txt
Vendored
+54
View File
@@ -0,0 +1,54 @@
table inet main { # handle 1
set ssh_meter { # handle 4
type ipv4_addr
size 65535
flags dynamic,timeout
timeout 1m
}
set ssh6_meter { # handle 5
type ipv6_addr
size 65535
flags dynamic,timeout
timeout 1m
}
set my_connlimit { # handle 6
type ipv4_addr
size 65535
flags dynamic
}
set guest_quota { # handle 7
type ipv4_addr
size 65535
flags dynamic
}
set trusted { # handle 8
type ipv4_addr
flags interval
elements = { 10.0.10.0/24 }
}
chain input { # handle 1
type filter hook input priority filter; policy drop;
ct state established,related accept # handle 9
tcp dport 22 ct state new update @ssh_meter { ip saddr limit rate over 3/minute burst 5 packets } counter packets 0 bytes 0 drop # handle 10
tcp dport 22 ct state new update @ssh6_meter { ip6 saddr & ffff:ffff:ffff:ffff:: limit rate over 3/minute burst 5 packets } counter packets 0 bytes 0 drop # handle 11
ip saddr @trusted tcp dport 22 accept # handle 12
}
chain forward { # handle 2
type filter hook forward priority filter; policy drop;
ct state new add @my_connlimit { ip saddr ct count over 20 } counter packets 0 bytes 0 drop # handle 13
iifname "lan" oifname "wan" limit rate over 10 mbytes/second burst 512 kbytes drop # handle 14
iifname "guest0" oifname "wan" add @guest_quota { ip saddr & 255.255.255.0 quota over 1000 mbytes } drop # handle 15
iifname "lan" oifname "wan" quota over 100000 mbytes drop # handle 16
iifname "lan" oifname "wan" accept # handle 17
}
chain output { # handle 3
type filter hook output priority filter; policy accept;
}
}
internal/model/changeset.go
+56
View File
@@ -0,0 +1,56 @@
package model
import (
"encoding/json"
"time"
)
// Changeset statuses.
const (
ChangesetOpen = "open"
ChangesetApplied = "applied"
ChangesetDiscarded = "discarded"
)
// Changeset is a list of changes, staged to be reviewed and applied
// together (or discarded). Applied, it is one history entry.
type Changeset struct {
ID int64 `json:"id"`
UserID int64 `json:"user_id,omitempty"`
Username string `json:"username"`
Via string `json:"via"`
Description string `json:"description"`
Status string `json:"status"`
Ops []Op `json:"ops"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
// HistoryID is the history entry an applied changeset became.
HistoryID int64 `json:"history_id,omitempty"`
}
// Operations.
const (
OpCreate = "create"
OpUpdate = "update"
OpDelete = "delete"
OpMove = "move"
OpSettings = "settings"
)
// Op is one change, as the API received it, so it can be stored and
// replayed on whatever the configuration is when it is applied.
type Op struct {
Seq int `json:"seq"`
Op string `json:"op"` // create, update, delete, move, settings
Kind string `json:"kind,omitempty"`
// Ref names the object (ID, or name) for update, delete and move.
Ref string `json:"ref,omitempty"`
// ID is the object a create makes, given when it is staged so later
// operations can name it.
ID int64 `json:"id,omitempty"`
// Data is the object (create), the fields to change (update,
// settings) or where to move it (move).
Data json.RawMessage `json:"data,omitempty"`
Summary string `json:"summary"`
AddedAt time.Time `json:"added_at"`
}
internal/model/objects.go
+105 -10
View File
@@ -133,9 +133,17 @@ type Rule struct {
// LimitOver, beyond) a rate.
Limit *Limit `json:"limit,omitempty"`
// ConnLimit matches when a source already has more than this many
// connections (per source address).
ConnLimit int `json:"conn_limit,omitempty"`
Action string `json:"action"`
// connections (per source address, grouped as GroupV4/GroupV6 say).
ConnLimit int `json:"conn_limit,omitempty"`
// Quota, if set, is an allowance of bytes: the rule matches once it
// is used up (Over), or while it lasts.
Quota *Quota `json:"quota,omitempty"`
// GroupV4 and GroupV6 group addresses for the per-address limits,
// connection limit and quota: by prefix length (0: the default, each
// IPv4 address alone, IPv6 by /64, since one device has several).
GroupV4 int `json:"group_v4,omitempty"`
GroupV6 int `json:"group_v6,omitempty"`
Action string `json:"action"`
// RejectWith: "" (ICMP port/admin unreachable as fits) or tcp-reset.
RejectWith string `json:"reject_with,omitempty"`
Log bool `json:"log,omitempty"`
@@ -155,18 +163,105 @@ func (r *Rule) Label() string {
return fmt.Sprintf("%s #%d", r.Chain, r.ID)
}
// Limit is a rate: Rate packets per Per (second, minute, hour, day), with
// a burst.
// Limit is a rate: Rate packets (or bytes, with Unit) per Per (second,
// minute, hour, day), with a burst.
type Limit struct {
Rate int `json:"rate"`
Per string `json:"per"`
Burst int `json:"burst,omitempty"`
Rate int `json:"rate"`
Per string `json:"per"`
// Burst is in the rate's unit.
Burst int `json:"burst,omitempty"`
// Unit: "" for packets, or bytes, kbytes or mbytes for a byte rate
// (bandwidth).
Unit string `json:"unit,omitempty"`
// Over matches packets beyond the rate instead of within it (to drop
// floods).
Over bool `json:"over,omitempty"`
// PerSource counts each source address on its own (a meter), instead
// of all traffic the rule sees together.
PerSource bool `json:"per_source,omitempty"`
// of all traffic the rule sees together; PerDestination each
// destination.
PerSource bool `json:"per_source,omitempty"`
PerDestination bool `json:"per_destination,omitempty"`
}
// Byte units, as nftables writes them.
var ByteUnits = map[string]int64{"bytes": 1, "kbytes": 1 << 10, "mbytes": 1 << 20, "gbytes": 1 << 30}
// Quota is an allowance of bytes. nftables counts it; Housecarl keeps the
// count across changes and restarts, and resets it each period.
type Quota struct {
Bytes int64 `json:"bytes"`
// Over matches once the allowance is used up (to drop); otherwise the
// rule matches while it lasts (to accept).
Over bool `json:"over,omitempty"`
// PerSource gives each source address (grouped as the rule's
// GroupV4/GroupV6 say) its own allowance; PerDestination each
// destination.
PerSource bool `json:"per_source,omitempty"`
PerDestination bool `json:"per_destination,omitempty"`
// Reset: "" (only by hand), daily, weekly (on Mondays) or monthly (on
// Day, 1-31: a short month's last day when it has no such day), at
// midnight.
Reset string `json:"reset,omitempty"`
Day int `json:"day,omitempty"`
}
// Quota resets.
var QuotaResets = []string{"daily", "weekly", "monthly"}
// PerAddress reports whether a quota (or limit) counts each address on its
// own, and which: "saddr", "daddr" or "".
func (q *Quota) PerAddress() string {
switch {
case q == nil:
return ""
case q.PerSource:
return "saddr"
case q.PerDestination:
return "daddr"
}
return ""
}
// PerAddress: as Quota's.
func (l *Limit) PerAddress() string {
switch {
case l == nil:
return ""
case l.PerSource:
return "saddr"
case l.PerDestination:
return "daddr"
}
return ""
}
// CountsTraffic reports whether a rule measures traffic (a quota or a byte
// rate): it must see every packet of a connection, so it is checked before
// the built-in that accepts established connections.
func (r *Rule) CountsTraffic() bool {
if r.Raw != "" {
return false
}
if r.Quota != nil {
return true
}
if r.Limit == nil {
return false
}
_, bytes := ByteUnits[r.Limit.Unit]
return bytes
}
// Groups returns a rule's address grouping, defaults applied.
func (r *Rule) Groups() (v4, v6 int) {
v4, v6 = r.GroupV4, r.GroupV6
if v4 == 0 {
v4 = 32
}
if v6 == 0 {
v6 = 64
}
return v4, v6
}
// PortForward publishes a service on an inside host: incoming connections
internal/nft/nft.go
+120 -1
View File
@@ -196,6 +196,9 @@ type Table struct {
Counters map[string]Counter
// Elements by set name (both families together).
Elements map[string][]render.Element
// Quotas: the rules' quotas' used bytes (quota_r12), and the
// per-address quotas' entries by set (quota_r12_v4).
QuotaUsage
// Since is when the counters started (housecarld's first apply).
Since time.Time
// Tables are all the machine's tables ("inet main"), when the whole
@@ -203,6 +206,48 @@ type Table struct {
Tables []string
}
// QuotaUsage is what the quotas used: kept across reloads, and saved in
// the database so a reboot doesn't reset it.
type QuotaUsage struct {
Quotas map[string]int64 `json:"quotas,omitempty"`
QuotaSets map[string][]render.Element `json:"quota_sets,omitempty"`
}
// merge takes the larger usage of each quota and entry from o (what was
// saved before a reboot, when the kernel's count started again).
func (u *QuotaUsage) merge(o *QuotaUsage) {
if o == nil {
return
}
if u.Quotas == nil {
u.Quotas = map[string]int64{}
}
if u.QuotaSets == nil {
u.QuotaSets = map[string][]render.Element{}
}
for k, v := range o.Quotas {
if v > u.Quotas[k] {
u.Quotas[k] = v
}
}
for set, es := range o.QuotaSets {
for _, e := range es {
found := false
for i := range u.QuotaSets[set] {
if u.QuotaSets[set][i].Addr == e.Addr {
found = true
if e.Used > u.QuotaSets[set][i].Used {
u.QuotaSets[set][i].Used = e.Used
}
}
}
if !found {
u.QuotaSets[set] = append(u.QuotaSets[set], e)
}
}
}
}
// Counter is packets and bytes.
type Counter struct {
Packets uint64 `json:"packets"`
@@ -223,9 +268,25 @@ type jsonSet struct {
Elem []json.RawMessage `json:"elem"`
}
// jsonQuota is a quota's state: a named quota ({"bytes", "used"}, in
// bytes) or one in an element ({"val", "val_unit", "used", "used_unit"}).
type jsonQuota struct {
Name string `json:"name"`
Used int64 `json:"used"`
UsedUnit string `json:"used_unit"`
}
func (q jsonQuota) bytes() int64 {
if m, ok := model.ByteUnits[q.UsedUnit]; ok {
return q.Used * m
}
return q.Used
}
// ParseTable reads `nft -j list table inet housecarl`.
func ParseTable(data []byte) (*Table, error) {
t := &Table{Counters: map[string]Counter{}, Elements: map[string][]render.Element{}}
t := &Table{Counters: map[string]Counter{}, Elements: map[string][]render.Element{},
QuotaUsage: QuotaUsage{Quotas: map[string]int64{}, QuotaSets: map[string][]render.Element{}}}
if len(data) == 0 {
return t, nil
}
@@ -252,11 +313,31 @@ func ParseTable(data []byte) (*Table, error) {
}
}
}
if raw, ok := item["quota"]; ok {
var q jsonQuota
if json.Unmarshal(raw, &q) == nil && strings.HasPrefix(q.Name, "quota_r") {
t.Quotas[q.Name] = q.bytes()
}
}
if raw, ok := item["set"]; ok {
var s jsonSet
if json.Unmarshal(raw, &s) != nil {
continue
}
if strings.HasPrefix(s.Name, "quota_r") {
for _, e := range s.Elem {
var w struct {
Elem struct {
Val string `json:"val"`
Quota *jsonQuota `json:"quota"`
} `json:"elem"`
}
if json.Unmarshal(e, &w) == nil && w.Elem.Quota != nil {
t.QuotaSets[s.Name] = append(t.QuotaSets[s.Name], render.Element{Addr: w.Elem.Val, Used: w.Elem.Quota.bytes()})
}
}
continue
}
name := strings.TrimSuffix(strings.TrimSuffix(s.Name, "_v4"), "_v6")
if name == s.Name || strings.HasPrefix(s.Name, "meter_") || strings.HasPrefix(s.Name, "conn_") {
continue
@@ -307,6 +388,37 @@ type Firewall struct {
mu sync.Mutex
base map[string]Counter
since time.Time
// restore is the quota usage saved before housecarld (or the machine)
// stopped, put back by the next apply.
restore *QuotaUsage
}
// RestoreQuotas has the next apply put this saved quota usage back where
// the kernel's count is lower (after a reboot, the boot ruleset starts
// every quota at zero).
func (f *Firewall) RestoreQuotas(u *QuotaUsage) {
f.mu.Lock()
defer f.mu.Unlock()
f.restore = u
}
// ResetQuota starts a rule's quota again: the named quota, or the
// per-address quota sets (both families).
func (f *Firewall) ResetQuota(ctx context.Context, ruleID int64, perAddress bool) error {
name := render.QuotaName(ruleID)
if !perAddress {
_, err := f.Runner.run(ctx, "", "reset", "quota", "inet", render.Table, name)
return err
}
for _, fam := range []string{"_v4", "_v6"} {
if _, err := f.Runner.run(ctx, "", "flush", "set", "inet", render.Table, name+fam); err != nil {
if e, ok := err.(*Error); ok && strings.Contains(e.Output, "No such file or directory") {
continue // the rule has no such family
}
return err
}
}
return nil
}
func (f *Firewall) options() render.Options {
@@ -337,9 +449,16 @@ func (f *Firewall) Apply(ctx context.Context, st *model.State) error {
old = t
}
}
usage := QuotaUsage{}
if old != nil {
usage = old.QuotaUsage
}
usage.merge(f.restore)
opt.Quotas, opt.QuotaSets = usage.Quotas, usage.QuotaSets
if err := f.Runner.Apply(ctx, render.Render(st, opt)); err != nil {
return err
}
f.restore = nil
if f.base == nil {
f.base, f.since = map[string]Counter{}, time.Now()
}
internal/nft/nft_test.go
+83
View File
@@ -125,3 +125,86 @@ func TestFirewallInContainer(t *testing.T) {
t.Errorf("another table was touched: %s", out)
}
}
// TestQuotasInContainer: quotas keep what they used across a reload,
// reset by hand, and come back after a reboot from what was saved.
func TestQuotasInContainer(t *testing.T) {
image := os.Getenv("HOUSECARL_NFT_IMAGE")
if image == "" {
t.Skip("HOUSECARL_NFT_IMAGE not set")
}
name := "housecarl-nft-quota-test"
exec.Command("docker", "rm", "-f", name).Run()
if out, err := exec.Command("docker", "run", "-d", "--name", name, "--cap-add", "NET_ADMIN", image, "sleep", "300").CombinedOutput(); err != nil {
t.Fatalf("starting the container: %v %s", err, out)
}
t.Cleanup(func() { exec.Command("docker", "rm", "-f", name).Run() })
fw := &Firewall{Runner: &Runner{Command: []string{"docker", "exec", "-i", name, "nft"}}}
ctx := context.Background()
st := model.NewState()
// A total quota on pings to 127.0.0.2, and one per destination on
// pings to 127.0.0.3.
st.Rules = []*model.Rule{
{ID: 1, Chain: model.ChainOutput, Position: 1, Action: model.ActionDrop, Match: model.Match{Destinations: []string{"127.0.0.2"}},
Quota: &model.Quota{Bytes: 10 << 20, Over: true}},
{ID: 2, Chain: model.ChainOutput, Position: 2, Action: model.ActionDrop, Match: model.Match{Destinations: []string{"127.0.0.3"}},
Quota: &model.Quota{Bytes: 10 << 20, Over: true, PerDestination: true}},
}
if err := fw.Apply(ctx, st); err != nil {
t.Fatalf("apply: %v", err)
}
ping := func(addr string) {
exec.Command("docker", "exec", name, "ping", "-c", "3", "-s", "1000", "-W", "1", addr).Run()
}
ping("127.0.0.2")
ping("127.0.0.3")
used := func() (int64, int64) {
tb, err := fw.Table(ctx)
if err != nil {
t.Fatal(err)
}
var dev int64
for _, e := range tb.QuotaSets["quota_r2_v4"] {
if e.Addr == "127.0.0.3" {
dev = e.Used
}
}
return tb.Quotas["quota_r1"], dev
}
total, dev := used()
if total < 3000 || dev < 3000 {
t.Fatalf("used: total %d, per destination %d", total, dev)
}
// A reload (a change) keeps what was used.
st.Rules[0].Comment = "changed"
if err := fw.Apply(ctx, st); err != nil {
t.Fatal(err)
}
if t2, d2 := used(); t2 < total || d2 < dev {
t.Errorf("after a reload: total %d (was %d), per destination %d (was %d)", t2, total, d2, dev)
}
// Reset by hand.
if err := fw.ResetQuota(ctx, 1, false); err != nil {
t.Fatal(err)
}
if err := fw.ResetQuota(ctx, 2, true); err != nil {
t.Fatal(err)
}
if t3, d3 := used(); t3 != 0 || d3 != 0 {
t.Errorf("after a reset: total %d, per destination %d", t3, d3)
}
// A reboot: the table is gone (the boot ruleset has no usage); the
// saved usage comes back.
ping("127.0.0.2")
ping("127.0.0.3")
tb, _ := fw.Table(ctx)
saved := tb.QuotaUsage
exec.Command("docker", "exec", name, "nft", "delete", "table", "inet", "housecarl").Run()
fw.RestoreQuotas(&saved)
if err := fw.Apply(ctx, st); err != nil {
t.Fatal(err)
}
if t4, d4 := used(); t4 < saved.Quotas["quota_r1"] || t4 == 0 || d4 == 0 {
t.Errorf("after a reboot: total %d, per destination %d (saved %+v)", t4, d4, saved)
}
}
internal/render/render.go
+131 -18
View File
@@ -12,6 +12,7 @@ package render
import (
"fmt"
"net/netip"
"sort"
"strings"
@@ -33,14 +34,25 @@ type Options struct {
// Elements are dynamic sets' current entries, re-added in the same
// transaction so a reload keeps them: set name → entries.
Elements map[string][]Element
// Quotas are the rules' quotas' used bytes (quota name, quota_r12),
// and QuotaSets the per-address quotas' entries (set name,
// quota_r12_v4), so a reload keeps what was used.
Quotas map[string]int64
QuotaSets map[string][]Element
}
// Element is a dynamic set's entry with its remaining lifetime.
// Element is a dynamic set's entry with its remaining lifetime, or a
// per-address quota's entry with what it used.
type Element struct {
Addr string `json:"address"`
Timeout int `json:"timeout,omitempty"` // seconds left (0: none)
Used int64 `json:"used,omitempty"` // bytes
}
// QuotaName is the name of a rule's quota: the named quota of a total
// quota, and (with _v4, _v6) the sets of a per-address one.
func QuotaName(ruleID int64) string { return fmt.Sprintf("quota_r%d", ruleID) }
// Ruleset is the rendered nftables script.
type Ruleset struct {
Text string
@@ -86,7 +98,8 @@ type renderer struct {
st *model.State
opt Options
w *writer
// meters are the per-source limit and connection sets the rules need.
// meters are the per-address limit, connection and quota sets, and
// the named quotas, the rules need.
meters []string
}
@@ -238,7 +251,8 @@ func (r *renderer) early() {
r.builtin("antispoof6", "iifname %s ip6 saddr { %s } counter drop", ifaces(ext), strings.Join(v6, ", "))
}
}
r.rules(model.ChainEarly)
r.rules(model.ChainEarly, true)
r.rules(model.ChainEarly, false)
r.end()
}
@@ -265,6 +279,9 @@ func (r *renderer) input() {
if b.Loopback {
r.builtin("loopback", "iifname \"lo\" accept")
}
// Rules that count traffic see every packet: before the established
// connections are accepted.
r.rules(model.ChainInput, true)
r.connBuiltins()
ext := st.ExternalInterfaces()
if b.ICMPv6 {
@@ -282,7 +299,7 @@ func (r *renderer) input() {
if b.DHCPv6Client && len(ext) > 0 {
r.builtin("dhcpv6-client", "iifname %s ip6 saddr fe80::/10 udp dport 546 counter accept", ifaces(ext))
}
r.rules(model.ChainInput)
r.rules(model.ChainInput, false)
r.policyTail("input", st.Settings.InputPolicy)
r.end()
}
@@ -295,6 +312,7 @@ func (r *renderer) forward(flowtable bool) {
if b.MSSClamp && len(ext) > 0 {
r.builtin("mss-clamp", "oifname %s tcp flags syn tcp option maxseg size set rt mtu", ifaces(ext))
}
r.rules(model.ChainForward, true)
if flowtable {
r.builtin("flowtable", "meta l4proto { tcp, udp } flow add @ft")
}
@@ -303,7 +321,7 @@ func (r *renderer) forward(flowtable bool) {
r.builtin("icmpv6", "icmpv6 type { %s } counter accept", icmpv6Errors)
}
r.forwardAccepts()
r.rules(model.ChainForward)
r.rules(model.ChainForward, false)
r.policyTail("forward", st.Settings.ForwardPolicy)
r.end()
}
@@ -311,6 +329,7 @@ func (r *renderer) forward(flowtable bool) {
func (r *renderer) output() {
st := r.st
r.chain("output", "output", "filter", st.Settings.OutputPolicy)
r.rules(model.ChainOutput, true)
if st.Settings.OutputPolicy == model.PolicyDrop {
if st.Settings.Builtins.Loopback {
r.builtin("loopback", "oifname \"lo\" accept")
@@ -322,7 +341,7 @@ func (r *renderer) output() {
r.builtin("icmpv6", "icmpv6 type { %s, echo-request, echo-reply, %s, %s } counter accept", icmpv6Errors, icmpv6ND, icmpv6MLD)
}
}
r.rules(model.ChainOutput)
r.rules(model.ChainOutput, false)
r.policyTail("output", st.Settings.OutputPolicy)
r.end()
}
@@ -341,9 +360,11 @@ func (r *renderer) policyTail(chain, policy string) {
// ---- rules
func (r *renderer) rules(chain string) {
// rules writes a chain's rules: those that count traffic (traffic true),
// or the others.
func (r *renderer) rules(chain string, traffic bool) {
for _, rule := range r.st.Rules {
if rule.Chain != chain || rule.Disabled {
if rule.Chain != chain || rule.Disabled || rule.CountsTraffic() != traffic {
continue
}
obj := rule.Label()
@@ -370,8 +391,8 @@ func (r *renderer) rules(chain string) {
tail = append(tail, hours(rule.HourFrom, rule.HourTo))
}
verdict := r.verdict(rule, mark)
perSource := rule.ConnLimit > 0 || rule.Limit != nil && rule.Limit.PerSource
for _, line := range r.expand(rule.Match, perSource) {
perAddress := rule.ConnLimit > 0 || rule.Limit.PerAddress() != "" || rule.Quota.PerAddress() != ""
for _, line := range r.expand(rule.Match, perAddress) {
parts := append([]string{}, line.parts...)
parts = append(parts, tail...)
if l := rule.Limit; l != nil {
@@ -380,6 +401,9 @@ func (r *renderer) rules(chain string) {
if rule.ConnLimit > 0 {
parts = append(parts, r.connLimit(rule, line))
}
if rule.Quota != nil {
parts = append(parts, r.quota(rule, line))
}
parts = append(parts, verdict)
r.w.emit(obj, "\t\t%s", strings.Join(nonEmpty(parts), " "))
}
@@ -410,20 +434,51 @@ func (r *renderer) verdict(rule *model.Rule, mark string) string {
return strings.Join(v, " ")
}
// limit renders a rate limit, per source with a meter set per family.
// limit renders a rate limit: of packets or bytes; per source or
// destination with a meter set per family, whose entries are refreshed
// by each packet (update) and forgotten once a source is quiet.
func (r *renderer) limit(rule *model.Rule, line expanded, l *model.Limit) string {
rate := fmt.Sprintf("limit rate %s%d/%s", map[bool]string{true: "over ", false: ""}[l.Over], l.Rate, l.Per)
if l.Burst > 0 {
rate += fmt.Sprintf(" burst %d packets", l.Burst)
unit := ""
if _, ok := model.ByteUnits[l.Unit]; ok {
unit = " " + l.Unit
}
if !l.PerSource {
rate := fmt.Sprintf("limit rate %s%d%s/%s", map[bool]string{true: "over ", false: ""}[l.Over], l.Rate, unit, l.Per)
if l.Burst > 0 {
burstUnit := " packets"
if unit != "" {
burstUnit = unit
}
rate += fmt.Sprintf(" burst %d%s", l.Burst, burstUnit)
}
addr := l.PerAddress()
if addr == "" {
return rate
}
name := fmt.Sprintf("meter_r%d_%s", rule.ID, line.fam)
if !r.hasMeter(name) {
r.meters = append(r.meters, fmt.Sprintf("\tset %s { type %s; flags dynamic,timeout; timeout 1%s; }", name, addrType(line.fam == "v6"), map[string]string{"second": "m", "minute": "m", "hour": "h", "day": "d"}[l.Per]))
}
return fmt.Sprintf("add @%s { %s saddr %s }", name, ipKeyword(line.fam), rate)
return fmt.Sprintf("update @%s { %s %s }", name, r.addrKey(rule, line.fam, addr), rate)
}
// addrKey is what a per-address meter counts by: "ip saddr", or grouped
// by a prefix, "ip6 saddr and ffff:ffff:ffff:ffff::".
func (r *renderer) addrKey(rule *model.Rule, fam, addr string) string {
v4, v6 := rule.Groups()
bits, size := v4, 32
if fam == "v6" {
bits, size = v6, 128
}
key := ipKeyword(fam) + " " + addr
if bits >= size {
return key
}
mask := make([]byte, size/8)
for i := 0; i < bits; i++ {
mask[i/8] |= 0x80 >> (i % 8)
}
m, _ := netip.AddrFromSlice(mask)
return key + " and " + m.String()
}
func (r *renderer) connLimit(rule *model.Rule, line expanded) string {
@@ -431,12 +486,70 @@ func (r *renderer) connLimit(rule *model.Rule, line expanded) string {
if !r.hasMeter(name) {
r.meters = append(r.meters, fmt.Sprintf("\tset %s { type %s; flags dynamic; size 65535; }", name, addrType(line.fam == "v6")))
}
return fmt.Sprintf("add @%s { %s saddr ct count over %d }", name, ipKeyword(line.fam), rule.ConnLimit)
return fmt.Sprintf("add @%s { %s ct count over %d }", name, r.addrKey(rule, line.fam, "saddr"), rule.ConnLimit)
}
// quota renders a rule's quota: a named quota shared by the rule's lines
// (both families count against one allowance), or per address a set of
// quotas per family. What was used comes back from Options, so a reload
// doesn't reset it.
func (r *renderer) quota(rule *model.Rule, line expanded) string {
q := rule.Quota
amount := quotaAmount(q)
name := QuotaName(rule.ID)
addr := q.PerAddress()
if addr == "" {
if !r.hasMeter(name) {
used := ""
if u := r.opt.Quotas[name]; u > 0 {
used = fmt.Sprintf(" used %d bytes", u)
}
r.meters = append(r.meters, fmt.Sprintf("\tquota %s { %s%s }", name, amount, used))
}
return fmt.Sprintf("quota name %s", quote(name))
}
set := name + "_" + line.fam
if !r.hasMeter(set) {
var elems []string
for _, e := range r.opt.QuotaSets[set] {
a, err := netip.ParseAddr(e.Addr)
if err != nil || a.Is6() != (line.fam == "v6") {
continue
}
used := ""
if e.Used > 0 {
used = fmt.Sprintf(" used %d bytes", e.Used)
}
elems = append(elems, fmt.Sprintf("%s quota %s%s", a, amount, used))
}
list := ""
if len(elems) > 0 {
list = " elements = { " + strings.Join(elems, ", ") + " }"
}
r.meters = append(r.meters, fmt.Sprintf("\tset %s { type %s; flags dynamic; size 65535;%s }", set, addrType(line.fam == "v6"), list))
}
return fmt.Sprintf("add @%s { %s quota %s }", set, r.addrKey(rule, line.fam, addr), amount)
}
// quotaAmount writes a quota: "over 5000 mbytes" (nftables 1.1.3 has no
// gbytes).
func quotaAmount(q *model.Quota) string {
n, unit := q.Bytes, "bytes"
for _, u := range []string{"mbytes", "kbytes"} {
if n >= model.ByteUnits[u] && n%model.ByteUnits[u] == 0 {
n, unit = n/model.ByteUnits[u], u
break
}
}
if q.Over {
return fmt.Sprintf("over %d %s", n, unit)
}
return fmt.Sprintf("until %d %s", n, unit)
}
func (r *renderer) hasMeter(name string) bool {
for _, m := range r.meters {
if strings.Contains(m, "set "+name+" ") {
if strings.Contains(m, "set "+name+" ") || strings.Contains(m, "quota "+name+" ") {
return true
}
}
internal/render/render_test.go
+51 -3
View File
@@ -66,6 +66,16 @@ func router() *model.State {
rule(model.ChainForward, model.Rule{Match: model.Match{Destinations: []string{"wg_net"}}, Action: model.ActionDrop})
rule(model.ChainForward, model.Rule{Match: model.Match{Services: []string{"ping"}}})
rule(model.ChainForward, model.Rule{Match: model.Match{Sources: []string{"wg_net", "trusted", "guests"}}})
// Bandwidth: a byte rate, per destination; per /24; quotas, total and
// per device.
rule(model.ChainForward, model.Rule{Match: model.Match{OutZones: []string{"lan"}}, Action: model.ActionDrop,
Limit: &model.Limit{Rate: 5, Unit: "mbytes", Per: "second", Burst: 1, Over: true, PerDestination: true}, Comment: "5 MB/s each"})
rule(model.ChainForward, model.Rule{Match: model.Match{InZones: []string{"wan"}}, Action: model.ActionDrop, GroupV4: 24,
Limit: &model.Limit{Rate: 100, Unit: "kbytes", Per: "minute", Over: true, PerSource: true}, Comment: "per /24"})
rule(model.ChainForward, model.Rule{Match: model.Match{Sources: []string{"guests"}, OutZones: []string{"wan"}}, Action: model.ActionDrop,
Quota: &model.Quota{Bytes: 50000 << 20, Over: true, Reset: "monthly", Day: 15}, Comment: "guest quota"})
rule(model.ChainForward, model.Rule{Match: model.Match{InZones: []string{"lan"}, OutZones: []string{"wan"}}, Action: model.ActionDrop,
Quota: &model.Quota{Bytes: 5 << 30, Over: true, PerSource: true, Reset: "daily"}, Comment: "device quota"})
rule(model.ChainEarly, model.Rule{Match: model.Match{InZones: []string{"wan"}, Sources: []string{"198.51.100.0/24"}}, Action: model.ActionDrop})
rule(model.ChainOutput, model.Rule{Raw: "meta skuid 0 counter accept", Comment: "raw"})
st.Forwards = []*model.PortForward{
@@ -87,8 +97,26 @@ func router() *model.State {
return st
}
// quotaOptions carries quota usage, as a reload does: the guest quota's,
// and two devices' of the per-device quota.
func quotaOptions(st *model.State) (map[string]int64, map[string][]Element) {
q, sets := map[string]int64{}, map[string][]Element{}
for _, r := range st.Rules {
switch r.Comment {
case "guest quota":
q[QuotaName(r.ID)] = 123456
case "device quota":
sets[QuotaName(r.ID)+"_v4"] = []Element{{Addr: "10.0.10.20", Used: 1 << 20}}
sets[QuotaName(r.ID)+"_v6"] = []Element{{Addr: "2a02:8013:7f3d:10::", Used: 2048}}
}
}
return q, sets
}
func TestRenderRouter(t *testing.T) {
rs := Render(router(), Options{Elements: map[string][]Element{"guests": {{Addr: "10.0.30.5", Timeout: 1700}}}})
st := router()
q, qs := quotaOptions(st)
rs := Render(st, Options{Elements: map[string][]Element{"guests": {{Addr: "10.0.30.5", Timeout: 1700}}}, Quotas: q, QuotaSets: qs})
text := rs.Text
for _, want := range []string{
"table inet housecarl {}\ndelete table inet housecarl\ntable inet housecarl {",
@@ -108,7 +136,16 @@ func TestRenderRouter(t *testing.T) {
`ip saddr @trusted_v4 tcp dport { 22, 8053, 8067 } counter accept`,
`ip6 saddr @trusted_v6 tcp dport { 22, 8053, 8067 } counter accept`,
`iifname "enp2s0" ip6 saddr fe80::/10 udp dport 547 counter accept`,
`iifname "wan" meta nfproto ipv4 tcp dport 22 add @meter_r`,
`iifname "wan" meta nfproto ipv4 tcp dport 22 update @meter_r`,
`ip6 saddr and ffff:ffff:ffff:ffff:: limit rate over 3/minute burst 5 packets }`,
`oifname "enp2s0" meta nfproto ipv4 update @meter_r`,
`{ ip daddr limit rate over 5 mbytes/second burst 1 mbytes } counter drop comment "hc:r`,
`{ ip saddr and 255.255.255.0 limit rate over 100 kbytes/minute } counter drop`,
`quota name "quota_r`,
`{ over 50000 mbytes used 123456 bytes }`,
`flags dynamic; size 65535; elements = { 10.0.10.20 quota over 5120 mbytes used 1048576 bytes } }`,
`elements = { 2a02:8013:7f3d:10:: quota over 5120 mbytes used 2048 bytes } }`,
`{ ip6 saddr and ffff:ffff:ffff:ffff:: quota over 5120 mbytes } counter drop comment "hc:r`,
`ip saddr limit rate over 3/minute burst 5 packets } counter log prefix "hc input #`,
`tcp dport 22 add @conn_r`,
`counter reject with tcp reset comment`,
@@ -139,6 +176,16 @@ func TestRenderRouter(t *testing.T) {
t.Errorf("missing %q", want)
}
}
// Rules that count traffic see every packet: in forward, after the
// MSS clamp and before established connections are accepted.
fwd := text[strings.Index(text, "chain forward {"):]
quota, est, mss := strings.Index(fwd, `quota name "quota_r`), strings.Index(fwd, "hc:b-established"), strings.Index(fwd, "hc:b-mss-clamp")
if quota < 0 || !(mss < quota && quota < est) {
t.Errorf("the quota rule isn't between the MSS clamp and established (%d, %d, %d)", mss, quota, est)
}
if bw := strings.Index(fwd, "limit rate over 5 mbytes/second"); bw > est {
t.Error("the byte rate rule comes after established")
}
// The trusted masquerade has no IPv6 part: masquerading the IPv6 LAN
// isn't wanted (its sources are global).
if strings.Contains(text, "ip6 saddr @trusted_v6 counter masquerade") {
@@ -167,7 +214,8 @@ func TestRenderedRulesetPassesNft(t *testing.T) {
t.Skip("HOUSECARL_NFT not set")
}
for name, st := range map[string]*model.State{"router": router(), "empty": model.NewState()} {
rs := Render(st, Options{Elements: map[string][]Element{"guests": {{Addr: "10.0.30.5", Timeout: 1700}, {Addr: "2a02:8013:7f3d:30::5"}}}})
q, qs := quotaOptions(st)
rs := Render(st, Options{Elements: map[string][]Element{"guests": {{Addr: "10.0.30.5", Timeout: 1700}, {Addr: "2a02:8013:7f3d:30::5"}}}, Quotas: q, QuotaSets: qs})
c := exec.CommandContext(context.Background(), cmd[0], append(cmd[1:], "-c", "-f", "/dev/stdin")...)
c.Stdin = strings.NewReader(rs.Text)
if out, err := c.CombinedOutput(); err != nil {
internal/server/h_changesets.go
+468
View File
@@ -0,0 +1,468 @@
package server
import (
"encoding/json"
"errors"
"fmt"
"net/http"
"strconv"
"strings"
"housecarl/internal/api"
"housecarl/internal/auth"
"housecarl/internal/engine"
"housecarl/internal/model"
"housecarl/internal/store"
)
// Changesets: changes staged to be reviewed (validation, nftables' check,
// the ruleset's diff) and applied together, as one history entry, or
// discarded. The web UI stages its edits by default; the CLI and the API
// stage when a changeset is named (?changeset=ID, X-Housecarl-Changeset).
// changesetParam is the changeset a request names (0: none).
func changesetParam(r *http.Request) (int64, error) {
v := r.URL.Query().Get("changeset")
if v == "" {
v = r.Header.Get("X-Housecarl-Changeset")
}
if v == "" {
return 0, nil
}
id, err := strconv.ParseInt(v, 10, 64)
if err != nil || id <= 0 {
return 0, badRequest("invalid changeset %q", v)
}
return id, nil
}
// notStaged refuses a changeset on a change that can't be staged (undo,
// import, takeover): it would otherwise be applied at once, unexpectedly.
func notStaged(r *http.Request, what string) error {
if id, err := changesetParam(r); err != nil || id == 0 {
return err
}
return badRequest("%s can't be staged in a changeset; leave out --changeset (or unset HOUSECARL_CHANGESET) to do it now", what)
}
// openChangeset loads a changeset to change: it must be open, and the
// caller's own unless they are an administrator.
func (s *Server) openChangeset(r *http.Request, p *auth.Principal, id int64) (*model.Changeset, error) {
cs, err := s.store.GetChangeset(r.Context(), id)
if errors.Is(err, store.ErrNotFound) {
return nil, notFound("there is no changeset %d", id)
}
if err != nil {
return nil, err
}
if cs.Status != model.ChangesetOpen {
return nil, conflict("changeset %d is %s", id, cs.Status)
}
if !ownsChangeset(p, cs) && !p.IsAdmin() {
return nil, forbidden("changeset %d is %s's, not yours", id, cs.Username)
}
return cs, nil
}
func ownsChangeset(p *auth.Principal, cs *model.Changeset) bool {
if p == nil || p.User == nil {
return false
}
if p.User.ID != 0 {
return cs.UserID == p.User.ID
}
return cs.UserID == 0 && cs.Username == p.User.Username
}
// stage adds an operation to a changeset. The changeset with it must
// still be valid and pass nftables' check; nothing is applied.
func (s *Server) stage(w http.ResponseWriter, r *http.Request, p *auth.Principal, id int64, op model.Op) error {
s.csMu.Lock()
defer s.csMu.Unlock()
cs, err := s.openChangeset(r, p, id)
if err != nil {
return err
}
// The operation on its own, after the changeset so far: what it
// changes, for its summary.
before := s.eng.State()
if err := replay(before, cs.Ops); err != nil {
return conflict("changeset %d can't be applied as it is (%v); review it first", id, err)
}
after := before.Clone()
objID, err := applyOp(after, &op)
if err != nil {
return err
}
engine.Normalize(after)
after.Sort()
changes := engine.Diff(before, after)
if len(changes) == 0 {
writeJSON(w, http.StatusOK, api.MutationResponse{Changes: []model.Change{}, Changeset: cs})
return nil
}
op.Summary = engine.Describe(changes)
op.AddedAt = s.nowFn()
for _, o := range cs.Ops {
if o.Seq >= op.Seq {
op.Seq = o.Seq + 1
}
}
if op.Seq == 0 {
op.Seq = 1
}
ops := append(append([]model.Op{}, cs.Ops...), op)
dry := queryBool(r, "dry_run")
// The whole changeset, checked as it would be applied.
res, err := s.eng.Apply(r.Context(), p, "", engine.Options{DryRun: true, Via: via(r, p)}, func(st *model.State, _ func() int64) error {
return replay(st, ops)
})
if err != nil {
s.writeErr(w, r, err, res)
return nil
}
if !dry {
cs.Ops = ops
if err := s.store.UpdateChangeset(r.Context(), cs); err != nil {
return err
}
}
out := api.MutationResponse{Staged: !dry, DryRun: dry, Changes: changes, Warnings: res.Warnings, Changeset: cs}
if object := objectOf(&op, objID); object != nil {
if v := object(after); v != nil {
out.Object, _ = json.Marshal(v)
}
}
if dry {
out.Diff = s.rulesetDiff(res.Before, res.After)
}
writeJSON(w, http.StatusOK, out)
return nil
}
func (s *Server) createChangeset(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
if err := require(p, auth.ResConfig, true); err != nil {
return err
}
var in api.ChangesetInput
if r.ContentLength != 0 {
if err := decodeJSON(r, &in); err != nil {
return err
}
}
cs := &model.Changeset{Username: p.Name(), Via: via(r, p), Description: strings.TrimSpace(in.Description), Status: model.ChangesetOpen}
if p.User != nil {
cs.UserID = p.User.ID
}
if err := s.store.CreateChangeset(r.Context(), cs); err != nil {
return err
}
s.eng.Audit(r.Context(), p, "changeset.create", fmt.Sprintf("changeset %d", cs.ID), "success", cs.Description)
writeJSON(w, http.StatusCreated, cs)
return nil
}
func (s *Server) listChangesets(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
if err := require(p, auth.ResConfig, false); err != nil {
return err
}
var uid int64
if queryBool(r, "mine") {
uid = -1
if p.User != nil && p.User.ID != 0 {
uid = p.User.ID
}
}
list, err := s.store.ListChangesets(r.Context(), r.URL.Query().Get("status"), max(uid, 0), queryInt(r, "limit", 100))
if err != nil {
return err
}
if uid == -1 { // the socket's users have no user ID: by name
mine := []*model.Changeset{}
for _, cs := range list {
if ownsChangeset(p, cs) {
mine = append(mine, cs)
}
}
list = mine
}
writeJSON(w, http.StatusOK, list)
return nil
}
func (s *Server) getChangeset(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
if err := require(p, auth.ResConfig, false); err != nil {
return err
}
id, err := pathID(r, "id")
if err != nil {
return err
}
cs, err := s.store.GetChangeset(r.Context(), id)
if errors.Is(err, store.ErrNotFound) {
return notFound("there is no changeset %d", id)
}
if err != nil {
return err
}
writeJSON(w, http.StatusOK, cs)
return nil
}
func (s *Server) updateChangeset(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
if err := require(p, auth.ResConfig, true); err != nil {
return err
}
id, err := pathID(r, "id")
if err != nil {
return err
}
var in api.ChangesetInput
if err := decodeJSON(r, &in); err != nil {
return err
}
s.csMu.Lock()
defer s.csMu.Unlock()
cs, err := s.openChangeset(r, p, id)
if err != nil {
return err
}
cs.Description = strings.TrimSpace(in.Description)
if err := s.store.UpdateChangeset(r.Context(), cs); err != nil {
return err
}
writeJSON(w, http.StatusOK, cs)
return nil
}
// removeOp takes one operation out of a changeset. Later ones that
// needed it show up in the preview.
func (s *Server) removeOp(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
if err := require(p, auth.ResConfig, true); err != nil {
return err
}
id, err := pathID(r, "id")
if err != nil {
return err
}
seq, err := strconv.Atoi(r.PathValue("seq"))
if err != nil {
return badRequest("invalid operation %q", r.PathValue("seq"))
}
s.csMu.Lock()
defer s.csMu.Unlock()
cs, err := s.openChangeset(r, p, id)
if err != nil {
return err
}
kept := []model.Op{}
for _, o := range cs.Ops {
if o.Seq != seq {
kept = append(kept, o)
}
}
if len(kept) == len(cs.Ops) {
return notFound("changeset %d has no operation %d", id, seq)
}
cs.Ops = kept
if err := s.store.UpdateChangeset(r.Context(), cs); err != nil {
return err
}
writeJSON(w, http.StatusOK, cs)
return nil
}
// previewChangeset says what applying a changeset would do, without
// doing it: its changes, problems, nftables' check, the ruleset's diff.
func (s *Server) previewChangeset(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
if err := require(p, auth.ResConfig, false); err != nil {
return err
}
id, err := pathID(r, "id")
if err != nil {
return err
}
cs, err := s.store.GetChangeset(r.Context(), id)
if errors.Is(err, store.ErrNotFound) {
return notFound("there is no changeset %d", id)
}
if err != nil {
return err
}
res, err := s.eng.Apply(r.Context(), p, "", engine.Options{DryRun: true, Via: via(r, p)}, func(st *model.State, _ func() int64) error {
return replay(st, cs.Ops)
})
out := api.ChangesetPreview{Valid: err == nil && res != nil && len(res.Changes) > 0, Changes: []model.Change{}}
if res != nil {
if res.Changes != nil {
out.Changes = res.Changes
}
out.Warnings = res.Warnings
}
if err != nil {
out.Error = errorInfo(err)
} else if res != nil {
out.Diff = s.rulesetDiff(res.Before, res.After)
}
writeJSON(w, http.StatusOK, out)
return nil
}
// errorInfo is an error as the API reports it.
func errorInfo(err error) *api.ErrorInfo {
var oe *opError
if errors.As(err, &oe) {
info, _ := oe.info()
return &info
}
var he *httpError
if errors.As(err, &he) {
return &api.ErrorInfo{Code: he.code, Message: he.msg}
}
if ee, ok := engine.AsError(err); ok {
return &api.ErrorInfo{Code: ee.Kind, Message: ee.Message, Problems: ee.Problems}
}
return &api.ErrorInfo{Code: "internal", Message: err.Error()}
}
// applyChangeset applies a changeset's operations as one change: one
// history entry, and (over the network) on probation like any change.
func (s *Server) applyChangeset(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
if err := require(p, auth.ResConfig, true); err != nil {
return err
}
id, err := pathID(r, "id")
if err != nil {
return err
}
var in api.ChangesetInput
if r.ContentLength != 0 {
if err := decodeJSON(r, &in); err != nil {
return err
}
}
s.csMu.Lock()
defer s.csMu.Unlock()
cs, err := s.openChangeset(r, p, id)
if err != nil {
return err
}
if d := strings.TrimSpace(in.Description); d != "" {
cs.Description = d
}
if len(cs.Ops) == 0 {
return badRequest("changeset %d has no changes to apply", id)
}
res, err := s.eng.Apply(r.Context(), p, cs.Description, engine.Options{Via: via(r, p)}, func(st *model.State, _ func() int64) error {
return replay(st, cs.Ops)
})
if err != nil {
s.eng.Audit(r.Context(), p, "changeset.apply", fmt.Sprintf("changeset %d", id), "failure", err.Error())
s.writeErr(w, r, err, res)
return nil
}
cs.Status, cs.HistoryID = model.ChangesetApplied, res.HistoryID
if err := s.store.UpdateChangeset(r.Context(), cs); err != nil {
return err
}
s.eng.Audit(r.Context(), p, "changeset.apply", fmt.Sprintf("changeset %d", id), "success", fmt.Sprintf("history %d", res.HistoryID))
s.afterChange(r.Context(), p, res)
out := s.mutation(res, nil)
out.Changeset = cs
writeJSON(w, http.StatusOK, out)
return nil
}
func (s *Server) discardChangeset(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
if err := require(p, auth.ResConfig, true); err != nil {
return err
}
id, err := pathID(r, "id")
if err != nil {
return err
}
s.csMu.Lock()
defer s.csMu.Unlock()
cs, err := s.openChangeset(r, p, id)
if err != nil {
return err
}
cs.Status = model.ChangesetDiscarded
if err := s.store.UpdateChangeset(r.Context(), cs); err != nil {
return err
}
s.eng.Audit(r.Context(), p, "changeset.discard", fmt.Sprintf("changeset %d", id), "success", fmt.Sprintf("%d operations", len(cs.Ops)))
writeJSON(w, http.StatusOK, cs)
return nil
}
// ---- reading the configuration as a changeset will make it
// viewState is the configuration a read shows: the current one, or with
// a changeset named, as it will be once that is applied (draft true).
// A changeset that no longer applies shows the current configuration,
// with the reason in the X-Housecarl-Changeset-Error header.
func (s *Server) viewState(w http.ResponseWriter, r *http.Request) (cur, view *model.State, draft bool, err error) {
cur = s.eng.State()
id, err := changesetParam(r)
if err != nil || id == 0 {
return cur, cur, false, err
}
cs, err := s.store.GetChangeset(r.Context(), id)
if errors.Is(err, store.ErrNotFound) {
return nil, nil, false, notFound("there is no changeset %d", id)
}
if err != nil {
return nil, nil, false, err
}
if cs.Status != model.ChangesetOpen {
return cur, cur, false, nil
}
next := cur.Clone()
if err := replay(next, cs.Ops); err != nil {
w.Header().Set("X-Housecarl-Changeset-Error", err.Error())
return cur, cur, false, nil
}
engine.Normalize(next)
next.Sort()
return cur, next, true, nil
}
// withPending lists a kind's objects as a changeset will leave them, each
// marked "pending": "new", "changed" or "deleted" (deleted ones stay in
// the list, in their place).
func withPending(cur, next *model.State, kind string) []any {
was := map[int64]string{}
for _, o := range cur.Objects(kind) {
b, _ := json.Marshal(o)
was[o.GetID()] = string(b)
}
// The deleted ones go back in, so they sort into their places.
merged := next.Clone()
deleted := map[int64]bool{}
for _, o := range cur.Objects(kind) {
if merged.ByID(kind, o.GetID()) == nil {
b, _ := json.Marshal(o)
merged.Put(kind, o.GetID(), b)
deleted[o.GetID()] = true
}
}
merged.Sort()
out := []any{}
for _, o := range merged.Objects(kind) {
var m map[string]any
b, _ := json.Marshal(o)
json.Unmarshal(b, &m)
old, existed := was[o.GetID()]
switch {
case deleted[o.GetID()]:
m["pending"] = "deleted"
case !existed:
m["pending"] = "new"
case old != string(b):
m["pending"] = "changed"
}
out = append(out, m)
}
return out
}
internal/server/h_config.go
+113 -183
View File
@@ -7,6 +7,8 @@ import (
"sort"
"strings"
udiff "github.com/aymanbagabas/go-udiff"
"housecarl/internal/api"
"housecarl/internal/auth"
"housecarl/internal/engine"
@@ -14,26 +16,46 @@ import (
"housecarl/internal/store"
)
// change applies an edit through the engine and answers it; object picks
// what to return from the new state. A network change starts (or joins)
// the probation.
func (s *Server) change(w http.ResponseWriter, r *http.Request, p *auth.Principal, description string, edit engine.Edit, object func(st *model.State) any) error {
// change makes an operation: at once through the engine, or, with a
// changeset named (?changeset=ID or X-Housecarl-Changeset), staged in it.
// A network change starts (or joins) the probation.
func (s *Server) change(w http.ResponseWriter, r *http.Request, p *auth.Principal, op model.Op) error {
if err := require(p, auth.ResConfig, true); err != nil {
return err
}
res, err := s.eng.Apply(r.Context(), p, description, engine.Options{DryRun: queryBool(r, "dry_run"), Via: via(r, p)}, edit)
if op.Op == model.OpCreate && op.ID == 0 {
ids, err := s.store.AllocateIDs(r.Context(), 1)
if err != nil {
return err
}
op.ID = ids[0]
}
csID, err := changesetParam(r)
if err != nil {
return err
}
if csID != 0 {
return s.stage(w, r, p, csID, op)
}
var id int64
res, err := s.eng.Apply(r.Context(), p, "", engine.Options{DryRun: queryBool(r, "dry_run"), Via: via(r, p)}, func(st *model.State, _ func() int64) error {
var err error
id, err = applyOp(st, &op)
return err
})
if err != nil {
s.writeErr(w, r, err, res)
return nil
}
s.afterChange(r.Context(), p, res)
// POST to a collection creates; POST to an object (move) changes it.
s.respondChange(w, r, res, object, r.Method == http.MethodPost && r.PathValue("ref") == "")
writeJSON(w, s.mutationStatus(res, op.Op == model.OpCreate), s.mutation(res, objectOf(&op, id)))
return nil
}
// respondChange answers a change: 201 when it created something.
func (s *Server) respondChange(w http.ResponseWriter, r *http.Request, res *engine.Result, object func(st *model.State) any, creates bool) {
// mutation is the answer to a change: what changed, warnings, the object
// (as it is after the change), the probation, and for a dry run the
// ruleset's diff.
func (s *Server) mutation(res *engine.Result, object func(st *model.State) any) api.MutationResponse {
out := api.MutationResponse{Applied: res.Applied, DryRun: res.DryRun, HistoryID: res.HistoryID, Changes: res.Changes, Warnings: res.Warnings}
if out.Changes == nil {
out.Changes = []model.Change{}
@@ -41,16 +63,37 @@ func (s *Server) respondChange(w http.ResponseWriter, r *http.Request, res *engi
if pr := s.probationStatus(); res.Applied && (len(pr.Pending) > 0 || pr.Takeovers > 0) {
out.ConfirmBy = &pr.Deadline
}
if object != nil && (res.Applied || res.DryRun) {
if v := object(s.eng.State()); v != nil {
if object != nil && res.After != nil && (res.Applied || res.DryRun) {
if v := object(res.After); v != nil {
out.Object, _ = json.Marshal(v)
}
}
status := http.StatusOK
if res.Applied && creates {
status = http.StatusCreated
if res.DryRun && len(res.Changes) > 0 {
out.Diff = s.rulesetDiff(res.Before, res.After)
}
writeJSON(w, status, out)
return out
}
// mutationStatus is 201 for an applied create, else 200.
func (s *Server) mutationStatus(res *engine.Result, creates bool) int {
if res.Applied && creates {
return http.StatusCreated
}
return http.StatusOK
}
// respondChange answers a change made without an operation (undo).
func (s *Server) respondChange(w http.ResponseWriter, r *http.Request, res *engine.Result, object func(st *model.State) any, creates bool) {
writeJSON(w, s.mutationStatus(res, creates), s.mutation(res, object))
}
// rulesetDiff is the unified diff of the rulesets two configurations
// make: the file housecarl-ruleset.service loads, now and after.
func (s *Server) rulesetDiff(before, after *model.State) string {
if before == nil || after == nil {
return ""
}
return udiff.Unified("ruleset.nft (now)", "ruleset.nft (after)", s.fw.Render(before).Text, s.fw.Render(after).Text)
}
// kindOf maps the API's plural path names to kinds.
@@ -84,16 +127,29 @@ func (s *Server) listObjects(w http.ResponseWriter, r *http.Request, p *auth.Pri
if err != nil {
return err
}
st := s.eng.State()
cur, st, draft, err := s.viewState(w, r)
if err != nil {
return err
}
out := []any{}
q := r.URL.Query()
for _, o := range st.Objects(kind) {
if c := q.Get("chain"); c != "" {
if rule, ok := o.(*model.Rule); ok && rule.Chain != c {
c := r.URL.Query().Get("chain")
if draft {
// Marked new, changed or deleted.
for _, o := range withPending(cur, st, kind) {
if c != "" && kind == model.KindRule && o.(map[string]any)["chain"] != c {
continue
}
out = append(out, o)
}
} else {
for _, o := range st.Objects(kind) {
if c != "" {
if rule, ok := o.(*model.Rule); ok && rule.Chain != c {
continue
}
}
out = append(out, o)
}
out = append(out, o)
}
// Services: the built-in ones too, unless overridden.
if kind == model.KindService && !queryBool(r, "own") {
@@ -102,9 +158,14 @@ func (s *Server) listObjects(w http.ResponseWriter, r *http.Request, p *auth.Pri
out = append(out, b)
}
}
sort.SliceStable(out, func(i, j int) bool {
return out[i].(*model.Service).Name < out[j].(*model.Service).Name
})
name := func(x any) string {
if m, ok := x.(map[string]any); ok {
n, _ := m["name"].(string)
return n
}
return x.(*model.Service).Name
}
sort.SliceStable(out, func(i, j int) bool { return name(out[i]) < name(out[j]) })
}
writeJSON(w, http.StatusOK, out)
return nil
@@ -118,7 +179,10 @@ func (s *Server) getObject(w http.ResponseWriter, r *http.Request, p *auth.Princ
if err != nil {
return err
}
st := s.eng.State()
_, st, _, err := s.viewState(w, r)
if err != nil {
return err
}
o, err := findObject(st, kind, r.PathValue("ref"))
if err != nil && kind == model.KindService {
if b := model.BuiltinService(r.PathValue("ref")); b != nil {
@@ -235,29 +299,11 @@ func (s *Server) createObject(w http.ResponseWriter, r *http.Request, p *auth.Pr
if err := decodeJSON(r, &raw); err != nil {
return err
}
o, err := decodeObject(kind, raw)
if err != nil {
// Refuse a bad object now, not when it is applied.
if _, err := decodeObject(kind, raw); err != nil {
return err
}
if svc, ok := o.(*model.Service); ok {
svc.Builtin = false
}
if rule, ok := o.(*model.Rule); ok && rule.Action == "" {
rule.Action = model.ActionAccept
}
if f, ok := o.(*model.PortForward); ok && len(f.Protocols) == 0 {
f.Protocols = []string{"tcp"}
}
var id int64
return s.change(w, r, p, "", func(st *model.State, newID func() int64) error {
id = newID()
setID(o, id)
if pos := position(o); pos != nil && *pos == 0 {
*pos = lastPosition(st, kind, chainOf(o))
}
data, _ := json.Marshal(o)
return st.Put(kind, id, data)
}, func(st *model.State) any { return st.ByID(kind, id) })
return s.change(w, r, p, model.Op{Op: model.OpCreate, Kind: kind, Data: raw})
}
func (s *Server) updateObject(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
@@ -269,34 +315,8 @@ func (s *Server) updateObject(w http.ResponseWriter, r *http.Request, p *auth.Pr
if err := decodeJSON(r, &patch); err != nil {
return err
}
delete(patch, "id")
var id int64
return s.change(w, r, p, "", func(st *model.State, _ func() int64) error {
o, err := findObject(st, kind, r.PathValue("ref"))
if err != nil {
return err
}
id = o.GetID()
// The patch's fields over the object's.
var cur map[string]json.RawMessage
b, _ := json.Marshal(o)
json.Unmarshal(b, &cur)
for k, v := range patch {
if string(v) == "null" {
delete(cur, k)
} else {
cur[k] = v
}
}
merged, _ := json.Marshal(cur)
next, err := decodeObject(kind, merged)
if err != nil {
return err
}
setID(next, id)
data, _ := json.Marshal(next)
return st.Put(kind, id, data)
}, func(st *model.State) any { return st.ByID(kind, id) })
data, _ := json.Marshal(patch)
return s.change(w, r, p, model.Op{Op: model.OpUpdate, Kind: kind, Ref: r.PathValue("ref"), Data: data})
}
func (s *Server) deleteObject(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
@@ -304,16 +324,7 @@ func (s *Server) deleteObject(w http.ResponseWriter, r *http.Request, p *auth.Pr
if err != nil {
return err
}
return s.change(w, r, p, "", func(st *model.State, _ func() int64) error {
o, err := findObject(st, kind, r.PathValue("ref"))
if err != nil {
return err
}
if used := usedBy(st, kind, o); used != "" {
return conflict("%s %s is used by %s; change that first", kind, o.Label(), used)
}
return st.Put(kind, o.GetID(), nil)
}, nil)
return s.change(w, r, p, model.Op{Op: model.OpDelete, Kind: kind, Ref: r.PathValue("ref")})
}
// usedBy names an object that refers to o (zones, sets and services are
@@ -364,8 +375,7 @@ func usedBy(st *model.State, kind string, o model.Object) string {
return ""
}
// moveObject reorders a rule or NAT rule: before or after another, or to
// the start or end; a rule can change chain at the same time.
// moveObject reorders a rule or NAT rule (moveOp).
func (s *Server) moveObject(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
kind, err := pathKind(r)
if err != nil {
@@ -375,72 +385,8 @@ func (s *Server) moveObject(w http.ResponseWriter, r *http.Request, p *auth.Prin
if err := decodeJSON(r, &in); err != nil {
return err
}
var id int64
return s.change(w, r, p, "", func(st *model.State, _ func() int64) error {
o, err := findObject(st, kind, r.PathValue("ref"))
if err != nil {
return err
}
id = o.GetID()
pos := position(o)
if pos == nil {
return badRequest("only rules, port forwards, source NAT rules and redirects have an order")
}
if rule, ok := o.(*model.Rule); ok && in.Chain != "" {
rule.Chain = in.Chain
}
chain := chainOf(o)
// The others in order.
var others []model.Object
for _, x := range st.Objects(kind) {
if x.GetID() != id && chainOf(x) == chain {
others = append(others, x)
}
}
sort.SliceStable(others, func(i, j int) bool { return *position(others[i]) < *position(others[j]) })
place := func(i int) { // before others[i] (i == len: at the end)
switch {
case len(others) == 0:
*pos = 1
case i == 0:
*pos = *position(others[0]) - 1
case i == len(others):
*pos = *position(others[len(others)-1]) + 1
default:
*pos = (*position(others[i-1]) + *position(others[i])) / 2
}
}
index := func(ref int64) (int, error) {
for i, x := range others {
if x.GetID() == ref {
return i, nil
}
}
return 0, badRequest("%d isn't another %s of the same chain", ref, kind)
}
switch {
case in.Before != 0:
i, err := index(in.Before)
if err != nil {
return err
}
place(i)
case in.After != 0:
i, err := index(in.After)
if err != nil {
return err
}
place(i + 1)
case in.To == "start":
place(0)
case in.To == "end" || in.Chain != "":
place(len(others))
default:
return badRequest("say where: before, after, or to start or end")
}
data, _ := json.Marshal(o)
return st.Put(kind, id, data)
}, func(st *model.State) any { return st.ByID(kind, id) })
data, _ := json.Marshal(in)
return s.change(w, r, p, model.Op{Op: model.OpMove, Kind: kind, Ref: r.PathValue("ref"), Data: data})
}
// ---- settings
@@ -449,7 +395,11 @@ func (s *Server) getSettings(w http.ResponseWriter, r *http.Request, p *auth.Pri
if err := require(p, auth.ResConfig, false); err != nil {
return err
}
writeJSON(w, http.StatusOK, s.eng.State().Settings)
_, st, _, err := s.viewState(w, r)
if err != nil {
return err
}
writeJSON(w, http.StatusOK, st.Settings)
return nil
}
@@ -458,35 +408,8 @@ func (s *Server) updateSettings(w http.ResponseWriter, r *http.Request, p *auth.
if err := decodeJSON(r, &patch); err != nil {
return err
}
return s.change(w, r, p, "", func(st *model.State, _ func() int64) error {
var cur map[string]json.RawMessage
b, _ := json.Marshal(st.Settings)
json.Unmarshal(b, &cur)
for k, v := range patch {
// Built-ins merge one by one.
if k == "builtins" {
var cb, pb map[string]json.RawMessage
json.Unmarshal(cur[k], &cb)
if err := json.Unmarshal(v, &pb); err != nil {
return badRequest("builtins: %v", err)
}
for bk, bv := range pb {
cb[bk] = bv
}
v, _ = json.Marshal(cb)
}
cur[k] = v
}
merged, _ := json.Marshal(cur)
var next model.Settings
dec := json.NewDecoder(strings.NewReader(string(merged)))
dec.DisallowUnknownFields()
if err := dec.Decode(&next); err != nil {
return badRequest("settings: %v", err)
}
st.Settings = next
return nil
}, func(st *model.State) any { return st.Settings })
data, _ := json.Marshal(patch)
return s.change(w, r, p, model.Op{Op: model.OpSettings, Data: data})
}
// ---- the ruleset
@@ -495,7 +418,11 @@ func (s *Server) ruleset(w http.ResponseWriter, r *http.Request, p *auth.Princip
if err := require(p, auth.ResConfig, false); err != nil {
return err
}
rs := s.fw.Render(s.eng.State())
_, st, _, err := s.viewState(w, r)
if err != nil {
return err
}
rs := s.fw.Render(st)
w.Header().Set("Content-Type", "text/plain; charset=utf-8")
w.Write([]byte(rs.Text))
return nil
@@ -538,6 +465,9 @@ func (s *Server) revertHistory(w http.ResponseWriter, r *http.Request, p *auth.P
if err := require(p, auth.ResConfig, true); err != nil {
return err
}
if err := notStaged(r, "an undo"); err != nil {
return err
}
id, err := pathID(r, "id")
if err != nil {
return err
internal/server/h_import.go
+6
View File
@@ -18,6 +18,9 @@ func (s *Server) importNft(w http.ResponseWriter, r *http.Request, p *auth.Princ
if err := require(p, auth.ResConfig, true); err != nil {
return err
}
if err := notStaged(r, "an import"); err != nil {
return err
}
var in api.ImportInput
if err := decodeJSON(r, &in); err != nil {
return err
@@ -105,6 +108,9 @@ func (s *Server) takeover(w http.ResponseWriter, r *http.Request, p *auth.Princi
if err := requireAdmin(p); err != nil {
return err
}
if err := notStaged(r, "a takeover"); err != nil {
return err
}
var in api.TakeoverInput
if err := decodeJSON(r, &in); err != nil {
return err
internal/server/ops.go
+265
View File
@@ -0,0 +1,265 @@
package server
import (
"encoding/json"
"errors"
"fmt"
"net/http"
"sort"
"strings"
"housecarl/internal/api"
"housecarl/internal/engine"
"housecarl/internal/model"
)
// Every configuration change is an operation (model.Op): applied at once,
// or staged in a changeset and replayed when the changeset is applied.
// applyOp is the one place an operation becomes an edit.
// applyOp makes an operation's change to st. It returns the ID of the
// object it made or changed (0 for deletes and settings).
func applyOp(st *model.State, op *model.Op) (int64, error) {
switch op.Op {
case model.OpCreate:
return createOp(st, op)
case model.OpUpdate:
return updateOp(st, op)
case model.OpDelete:
return 0, deleteOp(st, op)
case model.OpMove:
return moveOp(st, op)
case model.OpSettings:
return 0, settingsOp(st, op)
}
return 0, badRequest("unknown operation %q", op.Op)
}
func createOp(st *model.State, op *model.Op) (int64, error) {
o, err := decodeObject(op.Kind, op.Data)
if err != nil {
return 0, err
}
if svc, ok := o.(*model.Service); ok {
svc.Builtin = false
}
if rule, ok := o.(*model.Rule); ok && rule.Action == "" {
rule.Action = model.ActionAccept
}
if f, ok := o.(*model.PortForward); ok && len(f.Protocols) == 0 {
f.Protocols = []string{"tcp"}
}
if st.ByID(op.Kind, op.ID) != nil {
return 0, conflict("%s %d exists already", op.Kind, op.ID)
}
setID(o, op.ID)
if pos := position(o); pos != nil && *pos == 0 {
*pos = lastPosition(st, op.Kind, chainOf(o))
}
data, _ := json.Marshal(o)
return op.ID, st.Put(op.Kind, op.ID, data)
}
func updateOp(st *model.State, op *model.Op) (int64, error) {
var patch map[string]json.RawMessage
if err := json.Unmarshal(op.Data, &patch); err != nil {
return 0, badRequest("%s: %v", op.Kind, err)
}
delete(patch, "id")
o, err := findObject(st, op.Kind, op.Ref)
if err != nil {
return 0, err
}
id := o.GetID()
// The patch's fields over the object's.
var cur map[string]json.RawMessage
b, _ := json.Marshal(o)
json.Unmarshal(b, &cur)
for k, v := range patch {
if string(v) == "null" {
delete(cur, k)
} else {
cur[k] = v
}
}
merged, _ := json.Marshal(cur)
next, err := decodeObject(op.Kind, merged)
if err != nil {
return 0, err
}
setID(next, id)
data, _ := json.Marshal(next)
return id, st.Put(op.Kind, id, data)
}
func deleteOp(st *model.State, op *model.Op) error {
o, err := findObject(st, op.Kind, op.Ref)
if err != nil {
return err
}
if used := usedBy(st, op.Kind, o); used != "" {
return conflict("%s %s is used by %s; change that first", op.Kind, o.Label(), used)
}
return st.Put(op.Kind, o.GetID(), nil)
}
// moveOp reorders a rule or NAT rule: before or after another, or to the
// start or end; a rule can change chain at the same time.
func moveOp(st *model.State, op *model.Op) (int64, error) {
var in api.MoveInput
if err := json.Unmarshal(op.Data, &in); err != nil {
return 0, badRequest("move: %v", err)
}
o, err := findObject(st, op.Kind, op.Ref)
if err != nil {
return 0, err
}
id := o.GetID()
pos := position(o)
if pos == nil {
return 0, badRequest("only rules, port forwards, source NAT rules and redirects have an order")
}
if rule, ok := o.(*model.Rule); ok && in.Chain != "" {
rule.Chain = in.Chain
}
chain := chainOf(o)
// The others in order.
var others []model.Object
for _, x := range st.Objects(op.Kind) {
if x.GetID() != id && chainOf(x) == chain {
others = append(others, x)
}
}
sort.SliceStable(others, func(i, j int) bool { return *position(others[i]) < *position(others[j]) })
place := func(i int) { // before others[i] (i == len: at the end)
switch {
case len(others) == 0:
*pos = 1
case i == 0:
*pos = *position(others[0]) - 1
case i == len(others):
*pos = *position(others[len(others)-1]) + 1
default:
*pos = (*position(others[i-1]) + *position(others[i])) / 2
}
}
index := func(ref int64) (int, error) {
for i, x := range others {
if x.GetID() == ref {
return i, nil
}
}
return 0, badRequest("%d isn't another %s of the same chain", ref, op.Kind)
}
switch {
case in.Before != 0:
i, err := index(in.Before)
if err != nil {
return 0, err
}
place(i)
case in.After != 0:
i, err := index(in.After)
if err != nil {
return 0, err
}
place(i + 1)
case in.To == "start":
place(0)
case in.To == "end" || in.Chain != "":
place(len(others))
default:
return 0, badRequest("say where: before, after, or to start or end")
}
data, _ := json.Marshal(o)
return id, st.Put(op.Kind, id, data)
}
func settingsOp(st *model.State, op *model.Op) error {
var patch map[string]json.RawMessage
if err := json.Unmarshal(op.Data, &patch); err != nil {
return badRequest("settings: %v", err)
}
var cur map[string]json.RawMessage
b, _ := json.Marshal(st.Settings)
json.Unmarshal(b, &cur)
for k, v := range patch {
// Built-ins merge one by one.
if k == "builtins" {
var cb, pb map[string]json.RawMessage
json.Unmarshal(cur[k], &cb)
if err := json.Unmarshal(v, &pb); err != nil {
return badRequest("builtins: %v", err)
}
for bk, bv := range pb {
cb[bk] = bv
}
v, _ = json.Marshal(cb)
}
cur[k] = v
}
merged, _ := json.Marshal(cur)
var next model.Settings
dec := json.NewDecoder(strings.NewReader(string(merged)))
dec.DisallowUnknownFields()
if err := dec.Decode(&next); err != nil {
return badRequest("settings: %v", err)
}
st.Settings = next
return nil
}
// replay applies a changeset's operations to st, in order. An operation
// that fails is named in the error (opError).
func replay(st *model.State, ops []model.Op) error {
for i := range ops {
if _, err := applyOp(st, &ops[i]); err != nil {
return &opError{seq: ops[i].Seq, summary: ops[i].Summary, err: err}
}
}
return nil
}
// opError: an operation of a changeset that can't be applied (the
// objects it names changed since it was staged, say).
type opError struct {
seq int
summary string
err error
}
func (e *opError) Error() string {
return fmt.Sprintf("operation %d (%s) can't be applied: %v", e.seq, e.summary, e.err)
}
func (e *opError) Unwrap() error { return e.err }
// info is the error for the API, with the inner error's status.
func (e *opError) info() (api.ErrorInfo, int) {
info := api.ErrorInfo{Code: "conflict", Message: e.Error(), Op: e.seq}
status := http.StatusConflict
var he *httpError
if errors.As(e.err, &he) {
info.Code, status = he.code, he.status
}
if ee, ok := engine.AsError(e.err); ok {
info.Code, info.Problems, status = ee.Kind, ee.Problems, engineStatus(ee.Kind)
}
return info, status
}
// objectOf picks what an operation's answer returns from a state.
func objectOf(op *model.Op, id int64) func(st *model.State) any {
switch op.Op {
case model.OpDelete:
return nil
case model.OpSettings:
return func(st *model.State) any { return st.Settings }
}
return func(st *model.State) any {
if o := st.ByID(op.Kind, id); o != nil {
return o
}
return nil
}
}
internal/server/quota.go
+263
View File
@@ -0,0 +1,263 @@
package server
import (
"context"
"encoding/json"
"fmt"
"net/http"
"sort"
"time"
"housecarl/internal/api"
"housecarl/internal/auth"
"housecarl/internal/model"
"housecarl/internal/nft"
"housecarl/internal/render"
)
// Quotas: nftables counts them, and never resets them. housecarld resets
// each at the start of its period (daily, weekly, monthly), or when asked,
// and saves what they used every few minutes and when it stops, so a
// reboot (whose boot ruleset starts them at zero) doesn't lose it.
const (
quotaResetsKey = "quota_resets" // rule mark → when its quota was last reset
QuotaUsageKey = "quota_usage" // nft.QuotaUsage, saved
)
// periodStart is when the current period of a reset began (zero for a
// quota reset only by hand), in local time.
func periodStart(now time.Time, reset string, day int) time.Time {
y, m, d := now.Date()
midnight := time.Date(y, m, d, 0, 0, 0, 0, now.Location())
switch reset {
case "daily":
return midnight
case "weekly":
back := (int(now.Weekday()) + 6) % 7 // Monday
return midnight.AddDate(0, 0, -back)
case "monthly":
if day < 1 {
day = 1
}
start := monthDay(y, m, day, now.Location())
if start.After(now) {
py, pm, _ := time.Date(y, m, 1, 0, 0, 0, 0, now.Location()).AddDate(0, -1, 0).Date()
start = monthDay(py, pm, day, now.Location())
}
return start
}
return time.Time{}
}
// monthDay is midnight on a day of a month, or on its last day when the
// month is shorter.
func monthDay(y int, m time.Month, day int, loc *time.Location) time.Time {
last := time.Date(y, m+1, 0, 0, 0, 0, 0, loc).Day()
if day > last {
day = last
}
return time.Date(y, m, day, 0, 0, 0, 0, loc)
}
// nextReset is when the period after the current one starts.
func nextReset(now time.Time, reset string, day int) time.Time {
start := periodStart(now, reset, day)
switch reset {
case "daily":
return start.AddDate(0, 0, 1)
case "weekly":
return start.AddDate(0, 0, 7)
case "monthly":
y, m, _ := start.Date()
ny, nm, _ := time.Date(y, m, 1, 0, 0, 0, 0, now.Location()).AddDate(0, 1, 0).Date()
if day < 1 {
day = 1
}
return monthDay(ny, nm, day, now.Location())
}
return time.Time{}
}
func (s *Server) quotaResets(ctx context.Context) map[string]time.Time {
out := map[string]time.Time{}
if v, err := s.store.GetMeta(ctx, quotaResetsKey); err == nil && v != "" {
json.Unmarshal([]byte(v), &out)
}
return out
}
func (s *Server) saveQuotaResets(ctx context.Context, m map[string]time.Time) {
b, _ := json.Marshal(m)
if err := s.store.SetMeta(ctx, quotaResetsKey, string(b)); err != nil {
s.log.Error("saving the quotas' reset times failed", "err", err)
}
}
// RunQuotas resets quotas when their period ends and saves their usage,
// until ctx ends (then it saves once more).
func (s *Server) RunQuotas(ctx context.Context) {
s.checkQuotas(ctx)
tick := time.NewTicker(time.Minute)
defer tick.Stop()
n := 0
for {
select {
case <-ctx.Done():
s.SaveQuotaUsage(context.Background())
return
case <-tick.C:
s.checkQuotas(ctx)
if n++; n%5 == 0 {
s.SaveQuotaUsage(ctx)
}
}
}
}
// checkQuotas resets the quotas whose period has ended since their last
// reset. A quota seen for the first time starts its period now.
func (s *Server) checkQuotas(ctx context.Context) {
st := s.eng.State()
resets := s.quotaResets(ctx)
now := s.nowFn()
changed := false
seen := map[string]bool{}
for _, r := range st.Rules {
if r.Quota == nil || r.Disabled || r.Raw != "" {
continue
}
key := fmt.Sprintf("r%d", r.ID)
seen[key] = true
last, ok := resets[key]
if !ok {
resets[key], changed = now, true
continue
}
start := periodStart(now, r.Quota.Reset, r.Quota.Day)
if start.IsZero() || !last.Before(start) {
continue
}
if err := s.fw.ResetQuota(ctx, r.ID, r.Quota.PerAddress() != ""); err != nil {
s.log.Error("resetting a quota failed", "rule", r.Label(), "err", err)
continue
}
s.log.Info("quota reset for its new period", "rule", r.Label(), "period", r.Quota.Reset)
resets[key], changed = now, true
s.forgetQuotaUsage(ctx, r.ID)
}
for key := range resets {
if !seen[key] {
delete(resets, key)
changed = true
}
}
if changed {
s.saveQuotaResets(ctx, resets)
}
}
// SaveQuotaUsage saves what the quotas used, for after a reboot.
func (s *Server) SaveQuotaUsage(ctx context.Context) {
t, err := s.fw.Table(ctx)
if err != nil {
return
}
b, _ := json.Marshal(t.QuotaUsage)
if err := s.store.SetMeta(ctx, QuotaUsageKey, string(b)); err != nil {
s.log.Error("saving the quotas' usage failed", "err", err)
}
}
// forgetQuotaUsage drops a reset quota from the saved usage, so a restart
// doesn't bring back what it used before.
func (s *Server) forgetQuotaUsage(ctx context.Context, ruleID int64) {
v, err := s.store.GetMeta(ctx, QuotaUsageKey)
if err != nil || v == "" {
return
}
var u nft.QuotaUsage
if json.Unmarshal([]byte(v), &u) != nil {
return
}
name := render.QuotaName(ruleID)
delete(u.Quotas, name)
delete(u.QuotaSets, name+"_v4")
delete(u.QuotaSets, name+"_v6")
b, _ := json.Marshal(u)
s.store.SetMeta(ctx, QuotaUsageKey, string(b))
}
// listQuotas answers what each rule's quota used.
func (s *Server) listQuotas(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
if err := require(p, auth.ResLog, false); err != nil {
return err
}
st := s.eng.State()
var usage nft.QuotaUsage
if t, err := s.fw.Table(r.Context()); err == nil {
usage = t.QuotaUsage
}
resets := s.quotaResets(r.Context())
now := s.nowFn()
out := []api.QuotaInfo{}
for _, rule := range st.Rules {
if rule.Quota == nil {
continue
}
q := api.QuotaInfo{RuleID: rule.ID, Rule: rule.Label(), Quota: *rule.Quota}
name := render.QuotaName(rule.ID)
if rule.Quota.PerAddress() == "" {
q.Used = usage.Quotas[name]
} else {
v4, v6 := rule.Groups()
for _, fam := range []string{"_v4", "_v6"} {
for _, e := range usage.QuotaSets[name+fam] {
addr := e.Addr
if fam == "_v4" && v4 < 32 {
addr = fmt.Sprintf("%s/%d", addr, v4)
} else if fam == "_v6" && v6 < 128 {
addr = fmt.Sprintf("%s/%d", addr, v6)
}
q.Addresses = append(q.Addresses, api.QuotaAddress{Address: addr, Used: e.Used})
q.Used += e.Used
}
}
sort.Slice(q.Addresses, func(i, j int) bool { return q.Addresses[i].Used > q.Addresses[j].Used })
}
if last, ok := resets[fmt.Sprintf("r%d", rule.ID)]; ok {
q.LastReset = &last
}
if next := nextReset(now, rule.Quota.Reset, rule.Quota.Day); !next.IsZero() {
q.NextReset = &next
}
out = append(out, q)
}
writeJSON(w, http.StatusOK, out)
return nil
}
// resetQuota starts a rule's quota again now.
func (s *Server) resetQuota(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
if err := require(p, auth.ResConfig, true); err != nil {
return err
}
o, err := findObject(s.eng.State(), model.KindRule, r.PathValue("ref"))
if err != nil {
return err
}
rule := o.(*model.Rule)
if rule.Quota == nil {
return badRequest("%s has no quota", rule.Label())
}
if err := s.fw.ResetQuota(r.Context(), rule.ID, rule.Quota.PerAddress() != ""); err != nil {
return err
}
resets := s.quotaResets(r.Context())
resets[fmt.Sprintf("r%d", rule.ID)] = s.nowFn()
s.saveQuotaResets(r.Context(), resets)
s.forgetQuotaUsage(r.Context(), rule.ID)
s.eng.Audit(r.Context(), p, "quota.reset", rule.Label(), "success", "")
writeJSON(w, http.StatusOK, map[string]any{"reset": rule.Label()})
return nil
}
internal/server/respond.go
+6
View File
@@ -70,6 +70,12 @@ func engineStatus(kind string) int {
// writeErr writes an error response. result, if given, is the preview of
// a refused change.
func (s *Server) writeErr(w http.ResponseWriter, r *http.Request, err error, result any) {
var oe *opError
if errors.As(err, &oe) {
info, status := oe.info()
writeJSON(w, status, api.ErrorBody{Error: info})
return
}
var he *httpError
if errors.As(err, &he) {
writeError(w, he.status, he.code, he.msg)
internal/server/routes.go
+10
View File
@@ -41,6 +41,16 @@ func (s *Server) routes() {
m.HandleFunc("GET "+p+"/sets/{ref}/elements", s.authed(s.listElements))
m.HandleFunc("POST "+p+"/sets/{ref}/elements", s.authed(s.addElement))
m.HandleFunc("DELETE "+p+"/sets/{ref}/elements/{addr}", s.authed(s.deleteElement))
m.HandleFunc("GET "+p+"/quotas", s.authed(s.listQuotas))
m.HandleFunc("POST "+p+"/rules/{ref}/reset-quota", s.authed(s.resetQuota))
m.HandleFunc("GET "+p+"/changesets", s.authed(s.listChangesets))
m.HandleFunc("POST "+p+"/changesets", s.authed(s.createChangeset))
m.HandleFunc("GET "+p+"/changesets/{id}", s.authed(s.getChangeset))
m.HandleFunc("PATCH "+p+"/changesets/{id}", s.authed(s.updateChangeset))
m.HandleFunc("GET "+p+"/changesets/{id}/preview", s.authed(s.previewChangeset))
m.HandleFunc("POST "+p+"/changesets/{id}/apply", s.authed(s.applyChangeset))
m.HandleFunc("POST "+p+"/changesets/{id}/discard", s.authed(s.discardChangeset))
m.HandleFunc("DELETE "+p+"/changesets/{id}/ops/{seq}", s.authed(s.removeOp))
m.HandleFunc("GET "+p+"/{kind}", s.authed(s.listObjects))
m.HandleFunc("POST "+p+"/{kind}", s.authed(s.createObject))
m.HandleFunc("GET "+p+"/{kind}/{ref}", s.authed(s.getObject))
internal/server/server.go
+5 -1
View File
@@ -65,6 +65,8 @@ type Firewall interface {
TableText(ctx context.Context, family, name string) (string, error)
ApplyScript(ctx context.Context, script string) error
SaveBoot(st *model.State) error
// ResetQuota starts a rule's quota again (perAddress: its sets).
ResetQuota(ctx context.Context, ruleID int64, perAddress bool) error
}
// Server is the HTTP server.
@@ -86,7 +88,9 @@ type Server struct {
probation probation
logs *logRing
nowFn func() time.Time
// csMu orders changes to changesets (staging, applying, discarding).
csMu sync.Mutex
nowFn func() time.Time
// probationFor overrides the settings' probation (tests).
probationFor time.Duration
}
internal/server/server_test.go
+184
View File
@@ -5,6 +5,7 @@ import (
"context"
"encoding/json"
"errors"
"fmt"
"io"
"net/http"
"net/http/cookiejar"
@@ -35,6 +36,7 @@ type fakeFW struct {
applyErr error
deleted []string
restored []string
resets []string
}
func (f *fakeFW) Check(_ context.Context, st *model.State) error { return nil }
@@ -88,6 +90,12 @@ func (f *fakeFW) DeleteTable(_ context.Context, fam, name string) error {
f.deleted = append(f.deleted, fam+" "+name)
return nil
}
func (f *fakeFW) ResetQuota(_ context.Context, id int64, perAddress bool) error {
f.mu.Lock()
defer f.mu.Unlock()
f.resets = append(f.resets, fmt.Sprintf("r%d:%v", id, perAddress))
return nil
}
func (f *fakeFW) TableText(_ context.Context, fam, name string) (string, error) {
return "table " + fam + " " + name + " {}", nil
}
@@ -538,3 +546,179 @@ func TestImportAndTakeover(t *testing.T) {
t.Errorf("taking over Housecarl's own table: %d", code)
}
}
// TestChangesets: changes staged in a changeset are checked as they are
// added, shown in reads that name the changeset, previewed with the
// ruleset's diff, and applied together as one history entry, on
// probation; another user can't use the changeset.
func TestChangesets(t *testing.T) {
e := newEnv(t)
e.srv.probationFor = 5 * time.Second
e.call(e.token, "POST", "/zones", model.Zone{Name: "lan", Interfaces: []string{"eth1"}}, nil)
e.call(e.token, "POST", "/confirm", nil, nil)
applied := len(e.fw.applied)
var cs model.Changeset
if code := e.call(e.token, "POST", "/changesets", api.ChangesetInput{Description: "trusted ssh"}, &cs); code != 201 || cs.Status != "open" {
t.Fatalf("create: %d %+v", code, cs)
}
q := "?changeset=" + itoa(cs.ID)
// A rule naming a set the changeset hasn't made yet is refused.
var eb api.ErrorBody
rule := model.Rule{Chain: "input", Match: model.Match{Sources: []string{"trusted"}, Services: []string{"ssh"}}, Action: "accept"}
if code := e.call(e.token, "POST", "/rules"+q, rule, &eb); code != 422 || eb.Error.Code != "validation" {
t.Errorf("staging an invalid rule: %d %+v", code, eb)
}
var mr api.MutationResponse
if code := e.call(e.token, "POST", "/sets"+q, model.AddressSet{Name: "trusted", Entries: []string{"10.0.10.0/24"}}, &mr); code != 200 || !mr.Staged || mr.Applied {
t.Fatalf("stage set: %d %+v", code, mr)
}
if code := e.call(e.token, "POST", "/rules"+q, rule, &mr); code != 200 || !mr.Staged || len(mr.Changeset.Ops) != 2 {
t.Fatalf("stage rule: %d %+v", code, mr)
}
var created model.Rule
json.Unmarshal(mr.Object, &created)
// Later operations can name what the changeset made.
if code := e.call(e.token, "PATCH", "/rules/"+itoa(created.ID)+q, map[string]any{"comment": "SSH from home"}, &mr); code != 200 || len(mr.Changeset.Ops) != 3 {
t.Fatalf("stage update: %d %+v", code, mr)
}
if code := e.call(e.token, "DELETE", "/zones/lan"+q, nil, &mr); code != 200 {
t.Fatalf("stage delete: %d %+v", code, mr)
}
// Nothing applied yet.
if len(e.fw.applied) != applied || len(e.eng.State().Sets) != 0 {
t.Fatalf("staging applied something")
}
// Reads naming the changeset show it, marked.
var zones []map[string]any
e.call(e.token, "GET", "/zones"+q, nil, &zones)
if len(zones) != 1 || zones[0]["pending"] != "deleted" {
t.Errorf("zones in the changeset: %+v", zones)
}
var rules []map[string]any
e.call(e.token, "GET", "/rules"+q+"&chain=input", nil, &rules)
if len(rules) != 1 || rules[0]["pending"] != "new" || rules[0]["comment"] != "SSH from home" {
t.Errorf("rules in the changeset: %+v", rules)
}
var plain []map[string]any
e.call(e.token, "GET", "/zones", nil, &plain)
if len(plain) != 1 || plain[0]["pending"] != nil {
t.Errorf("zones without the changeset: %+v", plain)
}
// The preview: valid, with the ruleset's diff.
var pv api.ChangesetPreview
e.call(e.token, "GET", "/changesets/"+itoa(cs.ID)+"/preview", nil, &pv)
if !pv.Valid || !strings.Contains(pv.Diff, "+\t\tip saddr @trusted_v4 tcp dport 22 counter accept") || !strings.Contains(pv.Diff, "--- ruleset.nft (now)") {
t.Errorf("preview: %+v", pv)
}
// Another user can't stage into it, apply or discard it.
ctx := context.Background()
other := &model.User{Username: "sam", Grants: auth.Roles["operator"]}
e.srv.store.CreateUser(ctx, other)
otok, pid, sh := auth.NewToken()
e.srv.store.CreateToken(ctx, &model.Token{UserID: other.ID, Name: "t", PublicID: pid, SecretHash: sh})
if code := e.call(otok, "POST", "/changesets/"+itoa(cs.ID)+"/apply", nil, &eb); code != 403 || !strings.Contains(eb.Error.Message, "admin's") {
t.Errorf("another user's apply: %d %+v", code, eb)
}
// Removing an operation; then the changeset is applied as one change.
var after model.Changeset
if code := e.call(e.token, "DELETE", "/changesets/"+itoa(cs.ID)+"/ops/4", nil, &after); code != 200 || len(after.Ops) != 3 {
t.Fatalf("remove op: %d %+v", code, after)
}
if code := e.call(e.token, "POST", "/changesets/"+itoa(cs.ID)+"/apply", nil, &mr); code != 200 || !mr.Applied || mr.ConfirmBy == nil || mr.Changeset.Status != "applied" {
t.Fatalf("apply: %d %+v", code, mr)
}
if len(e.fw.applied) != applied+1 || len(e.eng.State().Rules) != 1 || len(e.eng.State().Zones) != 1 {
t.Errorf("applied: %d rulesets, state %+v", len(e.fw.applied)-applied, e.eng.State())
}
h, _ := e.srv.store.GetHistory(ctx, mr.HistoryID)
if h.Description != "trusted ssh" || len(h.Changes) != 2 {
t.Errorf("history: %+v", h)
}
// An applied changeset takes no more.
if code := e.call(e.token, "POST", "/sets"+q, model.AddressSet{Name: "x", Entries: []string{"10.0.0.1"}}, &eb); code != 409 || !strings.Contains(eb.Error.Message, "is applied") {
t.Errorf("staging into an applied changeset: %d %+v", code, eb)
}
// A changeset that no longer applies names the operation.
var cs2 model.Changeset
e.call(e.token, "POST", "/changesets", nil, &cs2)
e.call(e.token, "PATCH", "/rules/"+itoa(created.ID)+"?changeset="+itoa(cs2.ID), map[string]any{"comment": "x"}, nil)
e.call(e.token, "DELETE", "/rules/"+itoa(created.ID), nil, nil)
e.call(e.token, "GET", "/changesets/"+itoa(cs2.ID)+"/preview", nil, &pv)
if pv.Valid || pv.Error == nil || pv.Error.Op != 1 || !strings.Contains(pv.Error.Message, "operation 1") {
t.Errorf("stale preview: %+v", pv)
}
if code := e.call(e.token, "POST", "/changesets/"+itoa(cs2.ID)+"/discard", nil, &after); code != 200 || after.Status != "discarded" {
t.Errorf("discard: %d %+v", code, after)
}
// A dry run shows the ruleset's diff.
if code := e.call(e.token, "POST", "/sets?dry_run=1", model.AddressSet{Name: "y", Entries: []string{"10.0.0.2"}}, &mr); code != 200 || !strings.Contains(mr.Diff, "+\tset y_v4") {
t.Errorf("dry run diff: %d %q", code, mr.Diff)
}
}
func TestQuotaPeriods(t *testing.T) {
at := func(s string) time.Time { v, _ := time.ParseInLocation("2006-01-02 15:04", s, time.Local); return v }
for _, c := range []struct {
now, reset string
day int
start string
next string
}{
{"2026-10-19 10:00", "daily", 0, "2026-10-19 00:00", "2026-10-20 00:00"},
{"2026-10-19 10:00", "weekly", 0, "2026-10-19 00:00", "2026-10-26 00:00"}, // a Monday
{"2026-10-25 23:59", "weekly", 0, "2026-10-19 00:00", "2026-10-26 00:00"}, // a Sunday
{"2026-10-19 10:00", "monthly", 15, "2026-10-15 00:00", "2026-11-15 00:00"},
{"2026-10-10 10:00", "monthly", 15, "2026-09-15 00:00", "2026-10-15 00:00"},
{"2026-02-28 10:00", "monthly", 31, "2026-02-28 00:00", "2026-03-31 00:00"}, // February has no 31st
{"2026-03-15 10:00", "monthly", 31, "2026-02-28 00:00", "2026-03-31 00:00"},
{"2026-01-01 00:00", "monthly", 0, "2026-01-01 00:00", "2026-02-01 00:00"},
} {
now := at(c.now)
if got := periodStart(now, c.reset, c.day); !got.Equal(at(c.start)) {
t.Errorf("%s %s %d: period from %s, want %s", c.now, c.reset, c.day, got.Format("2006-01-02 15:04"), c.start)
}
if got := nextReset(now, c.reset, c.day); !got.Equal(at(c.next)) {
t.Errorf("%s %s %d: next reset %s, want %s", c.now, c.reset, c.day, got.Format("2006-01-02 15:04"), c.next)
}
}
if !periodStart(time.Now(), "", 0).IsZero() {
t.Error("a quota reset by hand has no period")
}
}
// TestQuotaResets: a quota starts its period when first seen, is reset
// when the next one starts, and by hand.
func TestQuotaResets(t *testing.T) {
e := newEnv(t)
ctx := context.Background()
now := time.Date(2026, 10, 19, 23, 50, 0, 0, time.Local)
e.srv.nowFn = func() time.Time { return now }
var mr api.MutationResponse
rule := model.Rule{Chain: "forward", Action: "drop", Quota: &model.Quota{Bytes: 5 << 30, Over: true, PerSource: true, Reset: "daily"}}
if code := e.call(e.token, "POST", "/rules", rule, &mr); code != 201 {
t.Fatalf("rule: %d %+v", code, mr)
}
var created model.Rule
json.Unmarshal(mr.Object, &created)
e.srv.checkQuotas(ctx)
if len(e.fw.resets) != 0 {
t.Fatalf("reset on first sight: %v", e.fw.resets)
}
now = now.Add(5 * time.Minute) // the same day
e.srv.checkQuotas(ctx)
now = now.Add(10 * time.Minute) // past midnight
e.srv.checkQuotas(ctx)
e.srv.checkQuotas(ctx)
want := fmt.Sprintf("r%d:true", created.ID)
if strings.Join(e.fw.resets, ",") != want {
t.Errorf("resets %v, want one %s", e.fw.resets, want)
}
var qs []api.QuotaInfo
e.call(e.token, "GET", "/quotas", nil, &qs)
if len(qs) != 1 || qs[0].NextReset == nil || qs[0].NextReset.Day() != 21 {
t.Errorf("quotas %+v", qs)
}
if code := e.call(e.token, "POST", "/rules/"+itoa(created.ID)+"/reset-quota", nil, nil); code != 200 || len(e.fw.resets) != 2 {
t.Errorf("reset by hand: %d %v", code, e.fw.resets)
}
}
internal/store/changesets.go
+114
View File
@@ -0,0 +1,114 @@
package store
import (
"context"
"database/sql"
"encoding/json"
"errors"
"time"
"housecarl/internal/model"
)
const changesetCols = `id, user_id, username, via, description, status, ops, created_at, updated_at, history_id`
func scanChangeset(sc interface{ Scan(...any) error }) (*model.Changeset, error) {
cs := &model.Changeset{}
var uid, hid sql.NullInt64
var ops, created, updated string
if err := sc.Scan(&cs.ID, &uid, &cs.Username, &cs.Via, &cs.Description, &cs.Status, &ops, &created, &updated, &hid); err != nil {
return nil, err
}
cs.UserID, cs.HistoryID = uid.Int64, hid.Int64
cs.CreatedAt, cs.UpdatedAt = parseTS(created), parseTS(updated)
if err := json.Unmarshal([]byte(ops), &cs.Ops); err != nil {
return nil, err
}
if cs.Ops == nil {
cs.Ops = []model.Op{}
}
return cs, nil
}
// CreateChangeset saves a new changeset and sets its ID.
func (s *Store) CreateChangeset(ctx context.Context, cs *model.Changeset) error {
now := time.Now()
cs.CreatedAt, cs.UpdatedAt = now, now
if cs.Ops == nil {
cs.Ops = []model.Op{}
}
ops, _ := json.Marshal(cs.Ops)
res, err := s.db.ExecContext(ctx, `INSERT INTO changesets (user_id, username, via, description, status, ops, created_at, updated_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, nullID(cs.UserID), cs.Username, cs.Via, cs.Description, cs.Status, string(ops), ts(now), ts(now))
if err != nil {
return err
}
cs.ID, err = res.LastInsertId()
return err
}
// GetChangeset loads one changeset.
func (s *Store) GetChangeset(ctx context.Context, id int64) (*model.Changeset, error) {
cs, err := scanChangeset(s.db.QueryRowContext(ctx, `SELECT `+changesetCols+` FROM changesets WHERE id = ?`, id))
if errors.Is(err, sql.ErrNoRows) {
return nil, ErrNotFound
}
return cs, err
}
// ListChangesets lists changesets, newest first: of a status ("" any),
// and of a user (0 anyone's).
func (s *Store) ListChangesets(ctx context.Context, status string, userID int64, limit int) ([]*model.Changeset, error) {
if limit <= 0 || limit > 500 {
limit = 100
}
q := `SELECT ` + changesetCols + ` FROM changesets WHERE 1=1`
var args []any
if status != "" {
q += ` AND status = ?`
args = append(args, status)
}
if userID != 0 {
q += ` AND user_id = ?`
args = append(args, userID)
}
q += ` ORDER BY id DESC LIMIT ?`
args = append(args, limit)
rows, err := s.db.QueryContext(ctx, q, args...)
if err != nil {
return nil, err
}
defer rows.Close()
out := []*model.Changeset{}
for rows.Next() {
cs, err := scanChangeset(rows)
if err != nil {
return nil, err
}
out = append(out, cs)
}
return out, rows.Err()
}
// UpdateChangeset saves a changeset's description, status, operations and
// history entry.
func (s *Store) UpdateChangeset(ctx context.Context, cs *model.Changeset) error {
cs.UpdatedAt = time.Now()
ops, _ := json.Marshal(cs.Ops)
res, err := s.db.ExecContext(ctx, `UPDATE changesets SET description = ?, status = ?, ops = ?, updated_at = ?, history_id = ? WHERE id = ?`,
cs.Description, cs.Status, string(ops), ts(cs.UpdatedAt), nullID(cs.HistoryID), cs.ID)
if err != nil {
return err
}
if n, _ := res.RowsAffected(); n == 0 {
return ErrNotFound
}
return nil
}
func nullID(id int64) any {
if id == 0 {
return nil
}
return id
}
internal/store/store.go
+16
View File
@@ -163,6 +163,22 @@ CREATE TABLE audit (
detail TEXT NOT NULL DEFAULT ''
);
CREATE INDEX audit_time ON audit (time);
`,
// 2: changesets, staged changes to review and apply together
`
CREATE TABLE changesets (
id INTEGER PRIMARY KEY AUTOINCREMENT,
user_id INTEGER,
username TEXT NOT NULL,
via TEXT NOT NULL,
description TEXT NOT NULL DEFAULT '',
status TEXT NOT NULL,
ops TEXT NOT NULL,
created_at TEXT NOT NULL,
updated_at TEXT NOT NULL,
history_id INTEGER
);
CREATE INDEX changesets_status ON changesets (status);
`,
}
internal/validate/validate.go
+55 -2
View File
@@ -85,6 +85,23 @@ func Check(st *model.State, env *Env) []Problem {
return c.out
}
// maxByteRate is the largest byte rate per period nftables (1.1.3) can
// hold: the kernel's token bucket multiplies the rate by the period.
var maxByteRate = map[string]int64{"second": 4294967294, "minute": 307445734, "hour": 5124095, "day": 213503}
// byteSize writes bytes the way nftables reads them: "1 mbytes".
func byteSize(n int64) string {
for _, u := range []string{"mbytes", "kbytes"} {
if n >= model.ByteUnits[u] && n%model.ByteUnits[u] == 0 {
return fmt.Sprintf("%d %s", n/model.ByteUnits[u], u)
}
}
if n >= 10*model.ByteUnits["kbytes"] {
return fmt.Sprintf("%d kbytes", n/model.ByteUnits["kbytes"])
}
return fmt.Sprintf("%d bytes", n)
}
var nameRe = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9_-]{0,47}$`)
// ifaceRe: Linux interface names (15 bytes), with an optional trailing *
@@ -348,13 +365,49 @@ func (c *checker) rule(r *model.Rule) {
c.add(Error, "rule_hours", obj, "write hours as HH:MM (08:00, 17:30)")
}
if l := r.Limit; l != nil {
if l.Rate < 1 || !limitPer[l.Per] || l.Burst < 0 {
c.add(Error, "rule_limit", obj, "a rate is a number of packets per second, minute, hour or day, with an optional burst")
_, byteUnit := model.ByteUnits[l.Unit]
switch {
case l.Rate < 1 || !limitPer[l.Per] || l.Burst < 0:
c.add(Error, "rule_limit", obj, "a rate is a number of packets (or bytes, kbytes, mbytes) per second, minute, hour or day, with an optional burst")
case l.Unit != "" && l.Unit != "packets" && (!byteUnit || l.Unit == "gbytes"):
c.add(Error, "rule_limit_unit", obj, "the rate's unit is %q; use packets, bytes, kbytes or mbytes", l.Unit)
case byteUnit && int64(l.Rate)*model.ByteUnits[l.Unit] > maxByteRate[l.Per]:
perSecond := int64(l.Rate) * model.ByteUnits[l.Unit] / map[string]int64{"second": 1, "minute": 60, "hour": 3600, "day": 86400}[l.Per]
c.add(Error, "rule_limit_bytes", obj, "nftables can't hold a byte rate of %d %s per %s (at most %s per %s); give it per second: %s/second",
l.Rate, l.Unit, l.Per, byteSize(maxByteRate[l.Per]), l.Per, byteSize(perSecond))
}
if l.PerSource && l.PerDestination {
c.add(Error, "rule_limit_key", obj, "a limit is per source or per destination, not both")
}
}
if r.ConnLimit < 0 {
c.add(Error, "rule_conn_limit", obj, "the connection limit must be 1 or more")
}
if q := r.Quota; q != nil {
if q.Bytes < 1 {
c.add(Error, "rule_quota", obj, "a quota is an amount of bytes, 1 or more")
}
if q.PerSource && q.PerDestination {
c.add(Error, "rule_quota_key", obj, "a quota is per source or per destination, not both")
}
switch {
case q.Reset != "" && q.Reset != "daily" && q.Reset != "weekly" && q.Reset != "monthly":
c.add(Error, "rule_quota_reset", obj, "the quota resets %q; use daily, weekly, monthly, or nothing (only by hand)", q.Reset)
case q.Day != 0 && q.Reset != "monthly":
c.add(Error, "rule_quota_reset", obj, "a day of the month is only for a monthly reset")
case q.Day < 0 || q.Day > 31:
c.add(Error, "rule_quota_reset", obj, "the day of the month is 1 to 31 (a later day than a month has means its last day)")
}
}
if r.CountsTraffic() && r.Action == model.ActionAccept {
c.add(Error, "rule_traffic_accept", obj, "a rule with a quota or a byte rate counts every packet, before established connections are accepted, so it can only drop, reject or log; let the traffic in with a rule of its own")
}
if r.CountsTraffic() && r.Chain == model.ChainForward && len(c.st.Settings.FlowtableDevices) > 0 && !r.Disabled {
c.add(Warning, "flowtable_traffic", obj, "the flowtable's fast path skips the forward chain once a connection is established, so this quota or byte rate only counts each connection's first packets; turn the flowtable off (settings) to count all of it")
}
if r.GroupV4 < 0 || r.GroupV4 > 32 || r.GroupV6 < 0 || r.GroupV6 > 128 {
c.add(Error, "rule_group", obj, "group addresses by a prefix length: 1 to 32 for IPv4, 1 to 128 for IPv6")
}
if r.RejectWith != "" {
if r.RejectWith != "tcp-reset" {
c.add(Error, "reject_with", obj, "reject with is %q; use tcp-reset, or nothing for an ICMP error", r.RejectWith)
internal/validate/validate_test.go
+15
View File
@@ -91,6 +91,21 @@ func TestCodes(t *testing.T) {
{"rule_hours", func(st *model.State) { rule(st).HourFrom = "08:00" }},
{"rule_limit", func(st *model.State) { rule(st).Limit = &model.Limit{Rate: 10, Per: "week"} }},
{"rule_conn_limit", func(st *model.State) { rule(st).ConnLimit = -1 }},
{"rule_limit_unit", func(st *model.State) { rule(st).Limit = &model.Limit{Rate: 1, Per: "second", Unit: "gbytes"} }},
{"rule_limit_bytes", func(st *model.State) { rule(st).Limit = &model.Limit{Rate: 100, Per: "hour", Unit: "mbytes"} }},
{"rule_limit_key", func(st *model.State) {
rule(st).Limit = &model.Limit{Rate: 1, Per: "second", PerSource: true, PerDestination: true}
}},
{"rule_quota", func(st *model.State) { rule(st).Quota = &model.Quota{} }},
{"rule_quota_key", func(st *model.State) { rule(st).Quota = &model.Quota{Bytes: 1, PerSource: true, PerDestination: true} }},
{"rule_quota_reset", func(st *model.State) { rule(st).Quota = &model.Quota{Bytes: 1, Reset: "yearly"} }},
{"rule_quota_reset", func(st *model.State) { rule(st).Quota = &model.Quota{Bytes: 1, Reset: "daily", Day: 3} }},
{"rule_group", func(st *model.State) { rule(st).GroupV6 = 129 }},
{"rule_traffic_accept", func(st *model.State) { rule(st).Quota = &model.Quota{Bytes: 1 << 20} }},
{"flowtable_traffic", func(st *model.State) {
st.Settings.FlowtableDevices = []string{"wan"}
st.Rules[1].Action, st.Rules[1].Quota = model.ActionDrop, &model.Quota{Bytes: 1 << 20, Over: true}
}},
{"reject_with", func(st *model.State) { rule(st).RejectWith = "tcp-reset" }},
{"log_prefix", func(st *model.State) { rule(st).Log = true; rule(st).LogPrefix = strings.Repeat("x", 101) }},
{"forward_protocol", func(st *model.State) { st.Forwards[0].Protocols = []string{"icmp"} }},
internal/web/static/assets/api.js
+115 -7
View File
@@ -5,6 +5,8 @@ export const state = {
me: null, // whoami response
csrf: "",
catalog: null,
draft: null, // the open changeset edits are staged into
immediate: false, // apply edits immediately instead of staging them
};
export class APIError extends Error {
@@ -24,9 +26,10 @@ export function setUnauthorizedHandler(fn) { onUnauthorized = fn; }
let onChange = () => {};
export function setChangeHandler(fn) { onChange = fn; }
// api calls the REST API. opts: {body, query}.
// api calls the REST API. opts: {body, query, stage (a changeset ID)}.
export async function api(method, path, opts = {}) {
const headers = { "Accept": "application/json" };
if (opts.stage) headers["X-Housecarl-Changeset"] = String(opts.stage);
let body;
if (opts.body !== undefined) {
headers["Content-Type"] = "application/json";
@@ -51,20 +54,125 @@ export async function api(method, path, opts = {}) {
return data;
}
export const get = (path, query) => api("GET", path, { query });
// get reads; with pending changes, the configuration as they will make it
// (objects marked "pending": new, changed, deleted).
export const get = (path, query) => api("GET", path, { query: draftQuery(query) });
// change sends a configuration change and reports it: a toast with the
// history entry (to undo it from History) and one per new warning. It
// returns the response.
// draftQuery names the draft changeset in a query, unless edits are
// applied immediately.
export function draftQuery(query = {}) {
if (state.draft && !state.immediate) return { ...query, changeset: state.draft.id };
return query;
}
// ---- the draft changeset (review mode, as in Jarl)
const draftKey = () => "housecarl.draft." + (state.me ? state.me.user.username : "");
const immediateKey = () => "housecarl.immediate." + (state.me ? state.me.user.username : "");
const listeners = new Set();
export function onDraftChange(fn) { listeners.add(fn); return () => listeners.delete(fn); }
function notify() { for (const fn of listeners) fn(); }
function remember(key, value) {
try { if (value === null) localStorage.removeItem(key); else localStorage.setItem(key, value); } catch { /* private window */ }
}
function recall(key) {
try { return localStorage.getItem(key); } catch { return null; }
}
// loadDraft restores the user's draft changeset if it is still open, or
// picks up their newest open one made in the web UI.
export async function loadDraft() {
state.immediate = recall(immediateKey()) === "1";
state.draft = null;
const id = recall(draftKey());
if (id) {
try {
const cs = await api("GET", "/changesets/" + id);
if (cs.status === "open") state.draft = cs;
} catch { /* gone */ }
}
if (!state.draft) {
try {
const list = await api("GET", "/changesets", { query: { status: "open", mine: 1, limit: 20 } });
state.draft = list.find((c) => c.via === "web") || null;
} catch { /* no config access */ }
}
remember(draftKey(), state.draft ? String(state.draft.id) : null);
notify();
}
export function setImmediate(on) {
state.immediate = on;
remember(immediateKey(), on ? "1" : "0");
notify();
}
export async function refreshDraft() {
if (!state.draft) return;
try {
const cs = await api("GET", "/changesets/" + state.draft.id);
state.draft = cs.status === "open" ? cs : null;
} catch { state.draft = null; }
if (!state.draft) remember(draftKey(), null);
notify();
}
export function useDraft(cs) {
state.draft = cs;
remember(draftKey(), cs ? String(cs.id) : null);
notify();
}
async function ensureDraft() {
if (state.draft) return state.draft;
const cs = await api("POST", "/changesets", { body: { description: "" } });
cs.fresh = true;
useDraft(cs);
return cs;
}
// dropFreshDraft discards a draft made for an edit that was then refused
// (or only checked), so no empty changeset is left open.
async function dropFreshDraft(cs) {
if (!cs.fresh || (state.draft && state.draft.id !== cs.id) || (state.draft && (state.draft.ops || []).length)) return;
try { await api("POST", "/changesets/" + cs.id + "/discard"); } catch { /* leave it */ }
useDraft(null);
}
// change sends a configuration change: staged in the draft changeset, or
// applied at once in immediate mode (or with opts.immediate). It reports
// it (toasts) and returns the response.
export async function change(method, path, body, opts = {}) {
const r = await api(method, path, { body, query: opts.query });
let r;
if (state.immediate || opts.immediate) {
r = await api(method, path, { body, query: opts.query });
} else {
const cs = await ensureDraft();
try {
r = await api(method, path, { body, query: opts.query, stage: cs.id });
} catch (e) {
if (e.status === 409 && /is (applied|discarded)/.test(e.message)) {
useDraft(null);
return change(method, path, body, opts);
}
await dropFreshDraft(cs);
throw e;
}
if (r && r.staged && r.changeset) useDraft(r.changeset);
else await dropFreshDraft(cs);
}
if (!opts.quiet) report(r);
return r;
}
export function report(r) {
if (!r) return;
if (r.dry_run) toast("Checked by Housecarl and nftables: nothing was changed");
if (r.staged) {
const n = ((r.changeset || {}).ops || []).length;
toast("Staged: " + ((r.changeset.ops || [])[n - 1] || {}).summary + " — " + (n === 1 ? "1 pending change" : n + " pending changes") + " to review and apply");
} else if (r.dry_run) toast("Checked by Housecarl and nftables: nothing was changed");
else if (r.applied && r.confirm_by) toast("Applied on probation (history #" + r.history_id + "): confirm it in the banner", "warn", 6000);
else if (r.applied) toast("Applied and saved (history #" + r.history_id + ")");
else if (!(r.changes || []).length) toast("Nothing to change");
internal/web/static/assets/app.js
+61 -4
View File
@@ -1,7 +1,8 @@
// Housecarl web UI: router, layout, login and the probation banner.
import { h, mount, toast, errorBox } from "./ui.js";
import { h, mount, toast, errorBox, modal } from "./ui.js";
import { wordmark, logo } from "./brand.js";
import { api, get, state, can, setUnauthorizedHandler, setChangeHandler } from "./api.js";
import { api, get, state, can, setUnauthorizedHandler, setChangeHandler, loadDraft, onDraftChange, setImmediate, useDraft } from "./api.js";
import * as changes from "./pages/changes.js";
import * as dashboard from "./pages/dashboard.js";
import * as rules from "./pages/rules.js";
import * as nat from "./pages/nat.js";
@@ -27,6 +28,7 @@ const routes = [
{ pattern: /^log$/, page: log, nav: "log" },
{ pattern: /^settings$/, page: settings, nav: "settings" },
{ pattern: /^import$/, page: importPage, nav: "import" },
{ pattern: /^changes$/, page: changes, nav: "changes" },
{ pattern: /^history$/, page: history, nav: "history" },
{ pattern: /^history\/(\d+)$/, page: history, nav: "history", params: ["id"] },
{ pattern: /^audit$/, page: audit, nav: "audit" },
@@ -46,6 +48,7 @@ const navItems = [
["services", "#/services", "Services", "config"],
] },
["log", "#/log", "Log", "log"],
["changes", "#/changes", "Changes", "config"],
["history", "#/history", "History", "config"],
{ menu: "Server", items: [
["settings", "#/settings", "Settings and built-ins", "config"],
@@ -56,7 +59,7 @@ const navItems = [
];
const app = document.getElementById("app");
let mainEl, navEl, bannerEl, current = { key: "" }, routeGen = 0;
let mainEl, navEl, bannerEl, barEl, modeHolder, current = { key: "" }, routeGen = 0;
function parseHash() {
const raw = location.hash.replace(/^#\/?/, "");
@@ -92,6 +95,8 @@ async function loggedIn(me) {
state.me = me;
state.csrf = me.csrf_token || "";
layout();
onDraftChange(renderBar);
if (can("config", true)) await loadDraft();
window.addEventListener("hashchange", route);
await route();
}
@@ -100,6 +105,8 @@ function layout() {
navEl = h("nav", { class: "main" });
mainEl = h("main");
bannerEl = h("div", { class: "probation-banner hidden", role: "alert" });
barEl = h("div");
modeHolder = can("config", true) ? h("span") : null;
const me = state.me;
const header = h("header", { class: "top" },
h("a", { class: "brand", href: "#/", title: "Dashboard" },
@@ -107,16 +114,66 @@ function layout() {
wordmark({ rule: false, height: 17, cls: "brand-name" })),
navEl,
h("div", { class: "header-right" },
modeHolder,
menu(h("span", { class: "user", title: (me.permissions || []).join("\n") }, me.user.username), [
h("a", { href: "#/account" }, "Account"),
me.admin ? h("a", { href: "#/users" }, "Users") : null,
h("button", { type: "button", class: "menu-item", onclick: logout }, "Log out"),
], { right: true, active: ["account", "users"].includes(current.nav), label: "Account menu" })));
mount(app, h("div", { class: "shell" }, header, bannerEl, mainEl, footer(me.build)));
mount(app, h("div", { class: "shell" }, header, barEl, bannerEl, mainEl, footer(me.build)));
renderNav();
refreshProbation();
}
// ---- pending changes: edits are staged for review (as in Jarl)
// renderBar shows the pending-changes bar (while there are pending
// changes) and the Review/Live switch in the header.
function renderBar() {
if (!barEl) return;
const d = state.draft;
const n = d ? (d.ops || []).length : 0;
if (modeHolder) {
const live = state.immediate;
mount(modeHolder, h("button", {
type: "button", class: "mode-toggle" + (live ? " live" : ""), "aria-pressed": live ? "true" : "false",
title: live ? "Edits are applied right away (each on probation over the network). Click to collect them for review first."
: "Edits are collected as pending changes, reviewed with the ruleset's diff and applied together under Changes. Click to apply edits right away.",
onclick: () => { setImmediate(!live); rerender(); },
}, h("span", { class: "dot" }), live ? "Live edits" : "Review edits"));
}
mount(barEl, n > 0 && !state.immediate ? h("div", { class: "pending-bar" },
h("strong", null, n === 1 ? "1 pending change" : n + " pending changes"),
h("span", { class: "muted" }, "Collected in changeset #" + d.id + "; not in force yet."),
h("a", { class: "button small", href: "#/changes" }, "Review"),
h("button", { class: "primary small apply-now", title: "Apply the pending changes now, without reviewing them first", onclick: (ev) => applyDraft(ev.target, d) }, "Apply now")) : null);
}
// applyDraft applies the draft changeset from the bar and stays on the
// page. If it is refused, a dialog says why and leads to Changes.
export async function applyDraft(btn, d, description) {
btn.disabled = true;
const label = btn.textContent;
btn.textContent = "Applying…";
try {
const r = await api("POST", "/changesets/" + d.id + "/apply", { body: { description: description || "" } });
useDraft(null);
if (r.confirm_by) toast("Applied changeset #" + d.id + " on probation (history #" + r.history_id + "): confirm it in the banner", "warn", 8000);
else toast("Applied changeset #" + d.id + " (history #" + r.history_id + ")");
for (const w of r.warnings || []) toast(w.message + (w.object ? " (" + w.object + ")" : ""), "warn", 10000);
await refreshProbation();
return r;
} catch (e) {
btn.disabled = false;
btn.textContent = label;
const review = await modal("The changes were not applied", errorBox(e), [{ label: "Close", value: false }, { label: "Review changes", kind: "primary", value: true }], { wide: true });
if (review) location.hash = "#/changes";
return null;
} finally {
rerender();
}
}
// ---- probation: changes made here roll back unless confirmed
let probationTimer = null, deadline = 0, pending = 0;
internal/web/static/assets/pages/changes.js
+111
View File
@@ -0,0 +1,111 @@
// Changes: the pending changeset — its operations, the check, and the
// ruleset's diff — to apply together or discard. Other open changesets
// (from hc or the API) can be taken over here.
import { h, mount, table, input, toast, errorBox, confirmDialog, diffView, problemsList, time, plural, badge } from "../ui.js";
import { api, state, useDraft, refreshDraft, can } from "../api.js";
import { rerender, applyDraft } from "../app.js";
export async function render(el) {
await refreshDraft();
const open = await api("GET", "/changesets", { query: { status: "open", limit: 50 } });
const d = state.draft;
const parts = [h("div", { class: "page-head" },
h("div", { class: "grow" }, h("h1", null, "Pending changes"),
h("div", { class: "muted" }, "Edits are collected in a changeset. Nothing reaches the firewall until you apply it; then the whole changeset is checked by Housecarl and nftables and put in force in one step, as one entry in the history. Over the network it is on probation: confirm it, or it rolls back.")))];
if (state.immediate) {
parts.push(h("div", { class: "msg info" }, "Live edits are on (the switch at the top): edits are applied right away, not collected here."));
}
if (!d || !(d.ops || []).length) {
parts.push(h("div", { class: "panel" }, h("div", { class: "empty" }, "No pending changes. Edit rules, NAT, objects or settings and they show up here.")));
} else {
parts.push(draftPanel(d));
}
const others = open.filter((c) => !d || c.id !== d.id);
if (others.length) {
parts.push(h("div", { class: "panel" }, h("h2", null, "Other open changesets"),
h("p", { class: "muted small" }, "Made with hc or the API, by others, or earlier here. Switch to one to review and apply it."),
table([
{ label: "#", render: (c) => String(c.id) },
{ label: "Description", render: (c) => c.description || h("span", { class: "muted" }, "(none)") },
{ label: "Operations", render: (c) => String((c.ops || []).length) },
{ label: "By", render: (c) => [c.username, h("span", { class: "muted small" }, " via " + c.via)] },
{ label: "Updated", render: (c) => time(c.updated_at) },
can("config", true) ? { label: "", tdClass: "actions-cell", render: (c) => [
h("button", { class: "small", onclick: () => { useDraft(c); rerender(); } }, "Switch to"), " ",
h("button", { class: "small danger", onclick: async () => {
if (!(await confirmDialog("Discard", "Discard changeset #" + c.id + "?", "Discard", "danger"))) return;
try { await api("POST", "/changesets/" + c.id + "/discard"); } catch (e) { toast(e.message, "err"); }
rerender();
} }, "Discard")] } : null,
].filter(Boolean), others)));
}
mount(el, parts);
}
function draftPanel(d) {
const ops = d.ops || [];
const desc = input({ value: d.description || "", placeholder: "Describe this change (it becomes the history entry's description)", class: "wide" });
const preview = h("div", { class: "muted" }, "Checking…");
const result = h("div");
const applyBtn = h("button", { class: "primary", disabled: true }, "Apply changes");
const removeOp = async (seq) => {
try {
useDraft(await api("DELETE", "/changesets/" + d.id + "/ops/" + seq));
rerender();
} catch (e) { toast(e.message, "err", 8000); }
};
const opsTable = table([
{ label: "#", render: (o) => String(o.seq) },
{ label: "Change", render: (o) => o.summary || o.op },
{ label: "Added", render: (o) => time(o.added_at) },
{ label: "", tdClass: "actions-cell", render: (o) => h("button", { class: "small", title: "Take this operation out of the changeset", onclick: () => removeOp(o.seq) }, "Remove") },
], ops);
// failedOp marks the operation that no longer applies, and offers to
// take it out.
const failedOp = (err) => {
const i = ops.findIndex((o) => o.seq === err.op);
const rows = opsTable.querySelectorAll("tbody tr");
if (i < 0 || !rows[i]) return errorBox({ message: err.message, details: err });
rows[i].classList.add("op-failed");
return h("div", { class: "msg err" },
h("div", null, err.message),
h("div", { class: "form-actions" },
h("button", { class: "small", onclick: () => removeOp(err.op) }, "Remove operation " + err.op),
" ", h("span", { class: "muted small" }, "It is marked in the list above. Something it names changed since it was staged.")));
};
(async () => {
try {
const p = await api("GET", "/changesets/" + d.id + "/preview");
applyBtn.disabled = !p.valid;
mount(preview,
p.error ? (p.error.op ? failedOp(p.error) : errorBox({ message: p.error.message, details: p.error })) : null,
p.valid ? h("div", { class: "msg ok" }, "Valid: Housecarl's checks pass and nftables accepts the new ruleset.") : null,
!p.error && !p.valid ? h("div", { class: "msg info" }, "Together these operations change nothing.") : null,
problemsList(p.warnings),
h("h3", null, "The ruleset (/var/lib/housecarl/ruleset.nft)"),
p.valid ? diffView(p.diff) : h("div", { class: "muted" }, "No diff until the changeset can be applied."));
} catch (e) { mount(preview, errorBox(e)); }
})();
applyBtn.addEventListener("click", async () => {
mount(result);
if (desc.value !== (d.description || "")) {
try { await api("PATCH", "/changesets/" + d.id, { body: { description: desc.value } }); } catch { /* the apply says it */ }
}
const r = await applyDraft(applyBtn, d, desc.value);
if (r && r.history_id) location.hash = "#/history/" + r.history_id;
});
const discard = h("button", { class: "danger", onclick: async () => {
if (!(await confirmDialog("Discard changes", "Throw away all " + plural(ops.length, "pending change") + "?", "Discard", "danger"))) return;
try { await api("POST", "/changesets/" + d.id + "/discard"); } catch (e) { toast(e.message, "err"); }
useDraft(null);
rerender();
} }, "Discard all");
return h("div", null,
h("div", { class: "panel" },
h("h2", null, "Changeset #" + d.id + " ", badge(plural(ops.length, "operation"), "warn")),
desc,
h("div", { class: "form-actions" }, opsTable),
h("div", { class: "actions form-actions" }, applyBtn, discard),
result),
h("div", { class: "panel" }, h("h2", null, "Review"), preview));
}
internal/web/static/assets/pages/history.js
+2 -1
View File
@@ -22,7 +22,8 @@ export async function render(el, params) {
async function undo(e) {
if (!await confirmDialog("Undo change #" + e.id, "Undo “" + e.description + "”? This is recorded as a new change, which can be undone too.", "Undo")) return;
try {
await change("POST", "/history/" + e.id + "/revert");
// An undo can't be staged: it is applied at once.
await change("POST", "/history/" + e.id + "/revert", undefined, { immediate: true });
rerender();
} catch (err) { modal("Can't undo", errorBox(err)); }
}
internal/web/static/assets/pages/nat.js
+9 -9
View File
@@ -3,12 +3,12 @@
import { h, mount, table, modal, errorBox, field, input, checkbox, confirmDialog, badge } from "../ui.js";
import { get, change, can } from "../api.js";
import { rerender } from "../app.js";
import { names, matchEditor, describe, hits, counters, listEditor } from "../widgets.js";
import { names, matchEditor, describe, hits, counters, listEditor, rowClass } from "../widgets.js";
export async function render(el) {
const [fwds, snats, redirects, cs] = await Promise.all([get("/forwards"), get("/snats"), get("/redirects"), counters()]);
const write = can("config", true);
const actions = (kind, x, edit) => write ? [
const actions = (kind, x, edit) => x.pending === "deleted" ? badge("deleted", "err") : write ? [
h("button", { class: "small reveal", onclick: () => edit(x) }, "Edit"), " ",
h("button", { class: "small reveal", onclick: () => toggle(kind, x) }, x.disabled ? "Enable" : "Disable"), " ",
h("button", { class: "small reveal", onclick: () => del(kind, x) }, "Delete")] : null;
@@ -25,7 +25,7 @@ export async function render(el) {
{ label: "Hairpin", render: (f) => f.hairpin ? badge((f.hairpin_sources || []).length ? "from " + f.hairpin_sources.join(", ") : "yes", "ok") : "" },
{ label: "Hits", render: (f) => hits(cs, "f" + f.id, "f" + f.id + "-6") },
{ label: "", tdClass: "actions-cell", render: (f) => actions("forwards", f, forwardDialog) },
], fwds, { empty: "No port forwards.", rowClass: (x) => x.disabled ? "disabled" : "" })),
], fwds, { empty: "No port forwards.", rowClass })),
h("div", { class: "panel" },
h("div", { class: "panel-head" }, h("h2", null, "Source NAT"), write ? h("button", { class: "primary small", onclick: () => snatDialog(null) }, "Add source NAT") : null),
table([
@@ -35,7 +35,7 @@ export async function render(el) {
{ label: "Hits", render: (x) => hits(cs, "s" + x.id) },
{ label: "Comment", render: (x) => x.comment },
{ label: "", tdClass: "actions-cell", render: (x) => actions("snats", x, snatDialog) },
], snats, { empty: "No source NAT.", rowClass: (x) => x.disabled ? "disabled" : "" })),
], snats, { empty: "No source NAT.", rowClass })),
h("div", { class: "panel" },
h("div", { class: "panel-head" }, h("h2", null, "Redirects"), write ? h("button", { class: "primary small", onclick: () => redirectDialog(null) }, "Add redirect") : null),
table([
@@ -44,7 +44,7 @@ export async function render(el) {
{ label: "Hits", render: (x) => hits(cs, "d" + x.id) },
{ label: "Comment", render: (x) => x.comment },
{ label: "", tdClass: "actions-cell", render: (x) => actions("redirects", x, redirectDialog) },
], redirects, { empty: "No redirects.", rowClass: (x) => x.disabled ? "disabled" : "" })));
], redirects, { empty: "No redirects.", rowClass })));
}
async function toggle(kind, x) {
@@ -78,13 +78,13 @@ async function dialog(title, kind, x, fields, value) {
async function forwardDialog(f) {
const n = await names();
f = f || { protocols: ["tcp"], hairpin: true };
const name = input({ value: f.name || "", placeholder: "jellyfin" });
const name = input({ value: f.name || "", placeholder: "web" });
const tcp = checkbox("TCP", f.protocols.includes("tcp")), udp = checkbox("UDP", f.protocols.includes("udp"));
const ports = input({ value: f.ports || "", placeholder: "8096 or 7777-7780", class: "mono" });
const ports = input({ value: f.ports || "", placeholder: "8080, or a range: 27015-27030", class: "mono" });
const pub = listEditor(f.public_addresses, { suggestions: n.sets, placeholder: "your public IPv4 address, or a set", addLabel: "Add address" });
const to = input({ value: f.to || "", placeholder: "10.0.10.57", class: "mono" });
const to = input({ value: f.to || "", placeholder: "192.168.1.10", class: "mono" });
const toPort = input({ value: f.to_port || "", placeholder: "the same", class: "mono short" });
const to6 = input({ value: f.to6 || "", placeholder: "2001:db8:10::57 (optional)", class: "mono" });
const to6 = input({ value: f.to6 || "", placeholder: "2001:db8:1::10 (optional)", class: "mono" });
const src = listEditor(f.sources, { suggestions: n.sets, placeholder: "anywhere", addLabel: "Add source" });
const hairpin = checkbox("the public address also works from inside (hairpin NAT)", f.hairpin);
const hairSrc = listEditor(f.hairpin_sources, { suggestions: n.sets, placeholder: "all inside sources", addLabel: "Add source" });
internal/web/static/assets/pages/rules.js
+108 -20
View File
@@ -1,8 +1,8 @@
// Rules: each chain's rules in order, with their hits; add, edit, move.
import { h, mount, table, modal, errorBox, field, input, select, checkbox, confirmDialog, badge, textarea } from "../ui.js";
import { get, change, can } from "../api.js";
import { h, mount, table, modal, errorBox, field, input, select, checkbox, confirmDialog, badge, textarea, toast } from "../ui.js";
import { get, api, change, can } from "../api.js";
import { rerender } from "../app.js";
import { names, matchEditor, describe, hits, counters, listEditor } from "../widgets.js";
import { names, matchEditor, describe, hits, counters, listEditor, rowClass, live, fmtBytes, quotas } from "../widgets.js";
const chains = [
["input", "Input", "Traffic to the firewall itself."],
@@ -25,7 +25,9 @@ const builtins = {
export async function render(el, params, query) {
const chain = query.get("chain") || "input";
const [rules, settings, cs] = await Promise.all([get("/rules", { chain }), get("/settings"), counters()]);
const [all, settings, cs, qs] = await Promise.all([get("/rules", { chain }), get("/settings"), counters(), quotas()]);
// As nftables checks them: the rules that count traffic first.
const rules = [...all.filter(countsTraffic), ...all.filter((r) => !countsTraffic(r))];
const write = can("config", true);
const info = chains.find((c) => c[0] === chain) || chains[0];
const policy = settings[chain + "_policy"];
@@ -41,33 +43,93 @@ export async function render(el, params, query) {
bi.map(([, mark, text], i) => [i ? " · " : "", text, mark ? [" (", hits(cs, "b-" + mark), ")"] : ""]), " — ",
h("a", { href: "#/settings" }, "settings")) : null,
table([
{ label: "#", render: (r, i) => String(i + 1) },
{ label: "#", render: (r) => r.pending === "deleted" ? "" : String(live(rules).indexOf(r) + 1) },
{ label: "Match", render: (r) => r.raw ? [badge("raw", ""), " ", h("span", { class: "mono small" }, r.raw)]
: [describe(r), extras(r)] },
: [countsTraffic(r) ? [badge("every packet", "accent"), " "] : null, describe(r), extras(r, qs[r.id])] },
{ label: "Action", render: actionBadge },
{ label: "Hits", render: (r) => hits(cs, "r" + r.id) },
{ label: "Comment", render: (r) => r.comment },
write ? { label: "", tdClass: "actions-cell", render: (r, i) => [
h("button", { class: "small reveal", title: "Move up", disabled: i === 0, onclick: () => move(r, { before: rules[i - 1].id }) }, "↑"), " ",
h("button", { class: "small reveal", title: "Move down", disabled: i === rules.length - 1, onclick: () => move(r, { after: rules[i + 1].id }) }, "↓"), " ",
write ? { label: "", tdClass: "actions-cell", render: (r) => {
if (r.pending === "deleted") return badge("deleted", "err");
// Moves stay among the rules of the same kind (counting traffic,
// or not): nftables checks those first.
const rs = live(rules).filter((x) => countsTraffic(x) === countsTraffic(r)), i = rs.indexOf(r);
return [
h("button", { class: "small reveal", title: "Move up", disabled: i === 0, onclick: () => move(r, { before: rs[i - 1].id }) }, "↑"), " ",
h("button", { class: "small reveal", title: "Move down", disabled: i === rs.length - 1, onclick: () => move(r, { after: rs[i + 1].id }) }, "↓"), " ",
h("button", { class: "small reveal", onclick: () => ruleDialog(r, chain) }, "Edit"), " ",
h("button", { class: "small reveal", onclick: () => toggle(r) }, r.disabled ? "Enable" : "Disable"), " ",
h("button", { class: "small reveal", onclick: () => del(r) }, "Delete"),
] } : null,
].filter(Boolean), rules, { empty: "No rules in this chain yet.", rowClass: (r) => r.disabled ? "disabled" : "" }),
];
} } : null,
].filter(Boolean), rules, { empty: "No rules in this chain yet.", rowClass }),
rules.some(countsTraffic) ? h("div", { class: "muted small" }, "Rules marked “every packet” have a quota or a byte rate: they are checked before established connections are accepted, so they count all of a connection's traffic, not only its first packet. They can drop, reject or log, not accept.") : null,
h("div", { class: "policy small" }, "Then the policy: ", badge(policy, policy === "drop" ? "err" : "ok"),
policy === "drop" ? [" — ", hits(cs, "p-" + chain), " packets reached it"] : null)));
}
function extras(r) {
// countsTraffic: a quota or a byte rate (as model.Rule.CountsTraffic).
function countsTraffic(r) {
return !r.raw && (!!r.quota || !!(r.limit && ["bytes", "kbytes", "mbytes"].includes(r.limit.unit)));
}
function extras(r, q) {
const x = [];
if ((r.ct_state || []).length) x.push("state " + r.ct_state.join(","));
if ((r.ct_status || []).length) x.push("status " + r.ct_status.join(","));
if ((r.days || []).length) x.push(r.days.join(","));
if (r.hour_from) x.push(r.hour_from + "–" + r.hour_to);
if (r.limit) x.push((r.limit.over ? "over " : "") + r.limit.rate + "/" + r.limit.per + (r.limit.per_source ? " per source" : ""));
if (r.limit) {
const l = r.limit;
x.push((l.over ? "over " : "") + l.rate + (l.unit && l.unit !== "packets" ? " " + l.unit : "") + "/" + l.per +
(l.per_source ? " per source" : l.per_destination ? " per destination" : ""));
}
if (r.conn_limit) x.push("over " + r.conn_limit + " connections");
return x.length ? h("div", { class: "muted small" }, x.join(" · ")) : null;
const out = x.length ? [h("div", { class: "muted small" }, x.join(" · "))] : [];
if (r.quota) out.push(quotaLine(r, q));
return out;
}
// quotaLine shows a quota, and what it used: in total, or per address
// (the busiest, and the rest in a dialog).
function quotaLine(r, q) {
const qt = r.quota;
const each = qt.per_source ? " each source" : qt.per_destination ? " each destination" : "";
const resets = qt.reset === "monthly" ? "monthly on day " + (qt.day || 1) : qt.reset || "by hand";
let used = null;
if (q && !qt.per_source && !qt.per_destination) {
used = [h("strong", null, fmtBytes(q.used)), " of " + fmtBytes(qt.bytes) + " used"];
} else if (q) {
const n = (q.addresses || []).length;
used = [n === 1 ? "1 address" : n + " addresses", n ? [", busiest ", h("strong", null, fmtBytes(q.addresses[0].used))] : null, " ",
n ? h("button", { class: "small", onclick: () => usageDialog(r, q) }, "Usage…") : null];
}
return h("div", { class: "muted small" }, (qt.over ? "quota over " : "quota ") + fmtBytes(qt.bytes) + each + ", resets " + resets,
used ? [" · ", used] : null,
q && q.next_reset ? " · next reset " + new Date(q.next_reset).toLocaleString() : null,
can("config", true) && q && r.pending !== "new" ? [" ", h("button", { class: "small", onclick: () => resetQuota(r) }, "Reset")] : null);
}
async function usageDialog(r, q) {
await modal("Quota usage of " + (r.comment || "rule #" + r.id), h("div", null,
h("p", { class: "muted" }, "Each " + (r.quota.per_source ? "source" : "destination") + " has " + fmtBytes(r.quota.bytes) + "."),
table([
{ label: "Address", render: (a) => h("span", { class: "mono" }, a.address) },
{ label: "Used", render: (a) => fmtBytes(a.used) },
{ label: "", render: (a) => h("div", { class: "usage" }, h("div", { class: "usage-bar" + (a.used >= r.quota.bytes ? " full" : "") }, bar(a.used / r.quota.bytes))) },
], q.addresses)), [{ label: "Close", value: null }], { wide: true });
}
function bar(f) {
const seg = h("div", { class: "seg leased" });
seg.style.width = Math.min(100, f * 100) + "%";
return seg;
}
async function resetQuota(r) {
if (!await confirmDialog("Reset the quota", "Start the quota of " + (r.comment || "rule #" + r.id) + " again now" +
(r.quota.per_source || r.quota.per_destination ? ", for every address" : "") + "? This is done at once, not staged.", "Reset")) return;
try { await api("POST", "/rules/" + r.id + "/reset-quota"); toast("Quota reset"); rerender(); } catch (e) { modal("Not reset", errorBox(e)); }
}
async function move(r, where) {
@@ -101,14 +163,30 @@ export async function ruleDialog(r, chain) {
const hourTo = input({ value: r.hour_to || "", placeholder: "17:30", class: "short" });
const l = r.limit || {};
const rate = input({ value: l.rate || "", placeholder: "10", class: "short", type: "number", min: 1 });
const per = select(["second", "minute", "hour", "day"], l.per || "minute");
const unit = select([["", "packets"], ["bytes", "bytes"], ["kbytes", "KB"], ["mbytes", "MB"]], l.unit || "", { class: "inline" });
const per = select(["second", "minute", "hour", "day"], l.per || "minute", { class: "inline" });
const burst = input({ value: l.burst || "", placeholder: "burst", class: "short", type: "number", min: 0 });
const over = checkbox("match beyond the rate (to drop floods)", l.over);
const perSource = checkbox("per source address", l.per_source);
const over = checkbox("match beyond the rate (to drop floods, or traffic over a bandwidth)", l.over);
const keyOf = (x) => x.per_source ? "source" : x.per_destination ? "destination" : "";
const keys = [["", "for everything the rule matches"], ["source", "for each source address"], ["destination", "for each destination address"]];
const limitKey = select(keys, keyOf(l), { class: "inline" });
const qt = r.quota || {};
const gb = qt.bytes && qt.bytes % (1 << 30) === 0;
const quotaAmount = input({ value: qt.bytes ? qt.bytes / (gb ? 1 << 30 : 1 << 20) : "", placeholder: "50", class: "short", type: "number", min: 1 });
const quotaUnit = select([["mb", "MB"], ["gb", "GB"]], gb || !qt.bytes ? "gb" : "mb", { class: "inline" });
const quotaOver = checkbox("match once it is used up (to drop); otherwise while it lasts (to accept)", qt.over === undefined ? true : qt.over);
const quotaKey = select(keys, keyOf(qt), { class: "inline" });
const quotaReset = select([["", "only by hand"], ["daily", "daily, at midnight"], ["weekly", "weekly, on Mondays"], ["monthly", "monthly, on day"]], qt.reset || "", { class: "inline" });
const quotaDay = input({ value: qt.day || "", placeholder: "1", class: "short", type: "number", min: 1, max: 31 });
const showDay = () => quotaDay.classList.toggle("hidden", quotaReset.value !== "monthly");
quotaReset.addEventListener("change", showDay);
showDay();
const group4 = input({ value: r.group_v4 || "", placeholder: "32", class: "short", type: "number", min: 1, max: 32 });
const group6 = input({ value: r.group_v6 || "", placeholder: "64", class: "short", type: "number", min: 1, max: 128 });
const conn = input({ value: r.conn_limit || "", placeholder: "e.g. 20", class: "short", type: "number", min: 1 });
const log = checkbox("log matching packets (Log page)", r.log);
const logPrefix = input({ value: r.log_prefix || "", placeholder: "default: hc CHAIN #ID ACTION:" });
const raw = textarea(r.raw || "", { rows: 2, class: "mono", placeholder: "iifname != \"wan\" ct state invalid ip daddr @trusted_v4 accept" });
const raw = textarea(r.raw || "", { rows: 2, class: "mono", placeholder: "ip saddr @admins_v4 tcp dport 22 ct state new accept" });
const comment = input({ value: r.comment || "" });
const disabled = checkbox("disabled: keep the rule but don't use it", r.disabled);
const err = h("div");
@@ -121,7 +199,12 @@ export async function ruleDialog(r, chain) {
field("Connection status", statuses, "dnat: the connection was port forwarded."),
field("Days", days),
field("Hours", h("div", null, hourFrom, " to ", hourTo), "22:00 to 06:00 passes midnight."),
field("Rate limit", h("div", null, rate, " packets per ", per, " ", burst, over, perSource), "Empty: no limit."),
field("Rate limit", h("div", null, rate, " ", unit, " per ", per, " ", burst, " ", limitKey, over),
"Empty: no limit. In bytes, it is a bandwidth (KB or MB per second or minute); traffic beyond it is dropped, not queued. The burst is in the same unit."),
field("Quota", h("div", null, quotaAmount, " ", quotaUnit, " ", quotaKey, " resets ", quotaReset, " ", quotaDay, quotaOver),
"Empty: none. An allowance of traffic; Housecarl keeps the count across changes and restarts."),
field("Group addresses", h("div", null, "IPv4 /", group4, " IPv6 /", group6),
"Per-address limits, connection limits and quotas count addresses by these prefixes. Default: each IPv4 address, IPv6 by /64 (one device has several addresses)."),
field("Connection limit", conn, "Match a source that already has more than this many connections."),
field("Log", h("div", null, log, logPrefix)),
field("Raw nftables", raw, "Instead of all the above: one nftables rule, for what Housecarl can't say. Checked by nftables."),
@@ -138,7 +221,12 @@ export async function ruleDialog(r, chain) {
mount(err);
const v = { chain: ch.value, ...match.value(), action: action.value, reject_with: action.value === "reject" ? rejectWith.value : "",
ct_state: states.value(), ct_status: statuses.value(), days: days.value(), hour_from: hourFrom.value.trim(), hour_to: hourTo.value.trim(),
limit: rate.value ? { rate: parseInt(rate.value, 10), per: per.value, burst: parseInt(burst.value || "0", 10), over: over.input.checked, per_source: perSource.input.checked } : null,
limit: rate.value ? { rate: parseInt(rate.value, 10), unit: unit.value, per: per.value, burst: parseInt(burst.value || "0", 10), over: over.input.checked,
per_source: limitKey.value === "source", per_destination: limitKey.value === "destination" } : null,
quota: quotaAmount.value ? { bytes: parseInt(quotaAmount.value, 10) * (quotaUnit.value === "gb" ? 1 << 30 : 1 << 20), over: quotaOver.input.checked,
per_source: quotaKey.value === "source", per_destination: quotaKey.value === "destination",
reset: quotaReset.value, day: quotaReset.value === "monthly" ? parseInt(quotaDay.value || "1", 10) : 0 } : null,
group_v4: parseInt(group4.value || "0", 10), group_v6: parseInt(group6.value || "0", 10),
conn_limit: parseInt(conn.value || "0", 10), log: log.input.checked, log_prefix: logPrefix.value.trim(), raw: raw.value.trim(), comment: comment.value.trim() };
if (r.id) v.disabled = disabled.input.checked;
try {
internal/web/static/assets/pages/services.js
+5 -5
View File
@@ -2,7 +2,7 @@
import { h, mount, table, modal, errorBox, field, input, confirmDialog, badge } from "../ui.js";
import { get, change, can } from "../api.js";
import { rerender } from "../app.js";
import { listEditor } from "../widgets.js";
import { listEditor, rowClass } from "../widgets.js";
export async function render(el) {
const services = await get("/services");
@@ -16,11 +16,11 @@ export async function render(el) {
{ label: "Entries", render: (s) => h("span", { class: "mono small" }, s.entries.join(", ")) },
{ label: "", render: (s) => s.builtin ? badge("built in", "") : badge("yours", "accent") },
{ label: "Comment", render: (s) => s.comment },
write ? { label: "", tdClass: "actions-cell", render: (s) => s.builtin
write ? { label: "", tdClass: "actions-cell", render: (s) => s.pending === "deleted" ? badge("deleted", "err") : s.builtin
? h("button", { class: "small reveal", onclick: () => serviceDialog({ name: s.name, entries: s.entries }) }, "Change")
: [h("button", { class: "small reveal", onclick: () => serviceDialog(s) }, "Edit"), " ",
h("button", { class: "small reveal", onclick: () => del(s) }, "Delete")] } : null,
].filter(Boolean), services)));
].filter(Boolean), services, { rowClass })));
}
async function del(s) {
@@ -30,8 +30,8 @@ async function del(s) {
async function serviceDialog(s) {
s = s || { entries: [] };
const name = input({ value: s.name || "", placeholder: "jellyfin" });
const list = listEditor(s.entries, { suggestions: ["tcp/", "udp/", "icmp/echo-request", "icmpv6/echo-request"], placeholder: "tcp/8096, udp/27015-27030, icmp/echo-request", addLabel: "Add entry" });
const name = input({ value: s.name || "", placeholder: "web" });
const list = listEditor(s.entries, { suggestions: ["tcp/", "udp/", "icmp/echo-request", "icmpv6/echo-request"], placeholder: "tcp/8080, udp/27015-27030, icmp/echo-request", addLabel: "Add entry" });
const comment = input({ value: s.comment || "" });
const err = h("div");
await modal(s.id ? "Edit service " + s.name : "Add service", h("div", null, h("div", { class: "form-grid" },
internal/web/static/assets/pages/sets.js
+6 -6
View File
@@ -2,7 +2,7 @@
import { h, mount, table, modal, errorBox, field, input, checkbox, confirmDialog, badge, toast } from "../ui.js";
import { get, api, change, can } from "../api.js";
import { rerender } from "../app.js";
import { listEditor, fmtSeconds, parseSeconds } from "../widgets.js";
import { listEditor, fmtSeconds, parseSeconds, rowClass } from "../widgets.js";
export async function render(el) {
const sets = await get("/sets");
@@ -14,12 +14,12 @@ export async function render(el) {
h("div", { class: "panel" }, table([
{ label: "Name", render: (s) => h("strong", null, s.name) },
{ label: "Entries", render: (s) => s.dynamic ? [badge("dynamic", "accent"), s.timeout ? " timeout " + fmtSeconds(s.timeout) : "", " ",
h("button", { class: "small", onclick: () => entries(s) }, "Entries…")] : h("span", { class: "mono small" }, s.entries.join(", ")) },
s.pending ? null : h("button", { class: "small", onclick: () => entries(s) }, "Entries…")] : h("span", { class: "mono small" }, s.entries.join(", ")) },
{ label: "Comment", render: (s) => s.comment },
write ? { label: "", tdClass: "actions-cell", render: (s) => [
write ? { label: "", tdClass: "actions-cell", render: (s) => s.pending === "deleted" ? badge("deleted", "err") : [
h("button", { class: "small reveal", onclick: () => setDialog(s) }, "Edit"), " ",
h("button", { class: "small reveal", onclick: () => del(s) }, "Delete")] } : null,
].filter(Boolean), sets, { empty: "No sets yet." })));
].filter(Boolean), sets, { empty: "No sets yet.", rowClass })));
}
async function del(s) {
@@ -30,7 +30,7 @@ async function del(s) {
async function setDialog(s) {
s = s || { entries: [] };
const name = input({ value: s.name || "", placeholder: "trusted" });
const list = listEditor(s.entries, { placeholder: "10.0.10.0/24, 2001:db8:10::/64, 10.0.0.1-10.0.0.9", addLabel: "Add entry" });
const list = listEditor(s.entries, { placeholder: "192.168.1.0/24, 2001:db8:1::/64, 192.168.1.100-192.168.1.199", addLabel: "Add entry" });
const dynamic = checkbox("dynamic: entries are added at run time", s.dynamic);
const timeout = input({ value: s.timeout ? fmtSeconds(s.timeout) : "", placeholder: "1h, 1d (none: until removed)", class: "short" });
const comment = input({ value: s.comment || "" });
@@ -57,7 +57,7 @@ async function entries(s) {
const write = can("sets", true);
const draw = async () => {
const es = await get("/sets/" + encodeURIComponent(s.name) + "/elements");
const addr = input({ placeholder: "10.0.30.5 or 2001:db8::5", class: "mono" });
const addr = input({ placeholder: "192.168.1.50 or 2001:db8:1::50", class: "mono" });
const t = input({ placeholder: s.timeout ? fmtSeconds(s.timeout) : "none", class: "short" });
mount(body,
table([
internal/web/static/assets/pages/settings.js
+2 -2
View File
@@ -22,7 +22,7 @@ export async function render(el) {
const input_ = pol(s.input_policy), forward = pol(s.forward_policy), output = pol(s.output_policy);
const logDrops = checkbox("log what the input and forward policies drop (rate-limited; the Log page)", s.log_policy_drops);
const bis = builtinText.map(([k, text]) => [k, checkbox(text, s.builtins[k])]);
const own = listEditor(s.own_prefixes, { placeholder: "2001:db8:7f3d::/48", addLabel: "Add prefix" });
const own = listEditor(s.own_prefixes, { placeholder: "2001:db8::/48", addLabel: "Add prefix" });
const v4 = listEditor(s.antispoof_v4, { addLabel: "Add" });
const v6 = listEditor(s.antispoof_v6, { addLabel: "Add" });
const flow = listEditor(s.flowtable_devices, { suggestions: ifs.map((i) => i.name), placeholder: "wan", addLabel: "Add device" });
@@ -38,7 +38,7 @@ export async function render(el) {
const r = await change("PATCH", "/settings", { input_policy: input_.value, forward_policy: forward.value, output_policy: output.value,
log_policy_drops: logDrops.input.checked, builtins, own_prefixes: own.value(), antispoof_v4: v4.value(), antispoof_v6: v6.value(),
flowtable_devices: flow.value(), probation_seconds: p === 120 ? 0 : p }, { query: dry ? { dry_run: 1 } : undefined });
if (!dry && r.applied) rerender();
if (!dry && (r.applied || r.staged)) rerender();
} catch (e) { mount(err, errorBox(e)); }
};
mount(el,
internal/web/static/assets/pages/zones.js
+3 -3
View File
@@ -2,7 +2,7 @@
import { h, mount, table, modal, errorBox, field, input, checkbox, confirmDialog, badge } from "../ui.js";
import { get, change, can } from "../api.js";
import { rerender } from "../app.js";
import { listEditor } from "../widgets.js";
import { listEditor, rowClass } from "../widgets.js";
export async function render(el) {
const [zones, ifs] = await Promise.all([get("/zones"), get("/interfaces")]);
@@ -16,10 +16,10 @@ export async function render(el) {
{ label: "Interfaces", render: (z) => h("span", { class: "mono" }, z.interfaces.join(", ")) },
{ label: "", render: (z) => z.external ? badge("external", "warn") : badge("internal", "") },
{ label: "Comment", render: (z) => z.comment },
write ? { label: "", tdClass: "actions-cell", render: (z) => [
write ? { label: "", tdClass: "actions-cell", render: (z) => z.pending === "deleted" ? badge("deleted", "err") : [
h("button", { class: "small reveal", onclick: () => zoneDialog(z, ifs) }, "Edit"), " ",
h("button", { class: "small reveal", onclick: () => del(z) }, "Delete")] } : null,
].filter(Boolean), zones, { empty: "No zones yet: add one per network (wan, lan, guest…)." })),
].filter(Boolean), zones, { empty: "No zones yet: add one per network (wan, lan, guest…).", rowClass })),
h("div", { class: "panel" }, h("h2", null, "This machine's interfaces"), table([
{ label: "Interface", render: (i) => h("span", { class: "mono" }, i.name) },
{ label: "State", render: (i) => badge(i.up ? "up" : "down", i.up ? "ok" : "") },
internal/web/static/assets/style.css
+26
View File
@@ -383,3 +383,29 @@ input.short { width: 7em; }
.checks { display: flex; flex-direction: column; gap: 4px; }
.form-actions { margin-top: 14px; }
tr.disabled td:not(.actions-cell) { opacity: 0.55; }
/* Pending changes (as in Jarl): the bar, the Review/Live switch, rows. */
.pending-bar {
display: flex; align-items: center; gap: 12px; flex-wrap: wrap;
padding: 8px 24px; background: var(--warn-soft); border-bottom: 1px solid var(--border);
}
.pending-bar strong { color: var(--warn); }
.pending-bar .apply-now { margin-left: auto; }
.mode-toggle { display: inline-flex; align-items: center; gap: 6px; padding: 3px 10px; margin-right: 10px; border-radius: 999px; font-size: 12px; font-weight: 500; background: transparent; color: var(--muted); border: 1px solid var(--border); }
.mode-toggle:hover { color: var(--text); border-color: var(--accent); }
.mode-toggle .dot { width: 7px; height: 7px; border-radius: 50%; background: var(--muted); }
.mode-toggle.live { color: var(--warn); border-color: var(--warn); background: var(--warn-soft); }
.mode-toggle.live .dot { background: var(--warn); }
tr.pending-new td { background: var(--add); }
tr.pending-changed td { background: var(--warn-soft); }
tr.pending-deleted td { background: var(--del); color: var(--muted); }
tr.pending-deleted td:not(.actions-cell) { text-decoration: line-through; }
tr.op-failed td { background: var(--err-soft); }
input.wide { width: 100%; }
.diff { background: var(--code-bg); border-radius: var(--radius); overflow: auto; font-family: var(--mono); font-size: 12.5px; line-height: 1.4; }
.diff div { white-space: pre; padding: 0 10px; }
.diff .add { background: var(--add); color: var(--add-text); }
.diff .del { background: var(--del); color: var(--del-text); }
.diff .hunk { background: var(--hunk); color: var(--accent); }
.diff .file { font-weight: 700; padding-top: 6px; }
select.inline { width: auto; display: inline-block; }
internal/web/static/assets/ui.js
+15
View File
@@ -191,6 +191,21 @@ export function problemsList(problems) {
h("li", { class: p.severity }, h("strong", null, p.severity + ": "), p.message, p.object ? h("span", { class: "where" }, p.object) : null)));
}
// diffView shows a unified diff, lines colored.
export function diffView(text) {
if (!text) return h("div", { class: "muted" }, "The ruleset doesn't change.");
const box = h("div", { class: "diff" });
for (const line of text.replace(/\n$/, "").split("\n")) {
let cls = "";
if (line.startsWith("+++") || line.startsWith("---")) cls = "file";
else if (line.startsWith("+")) cls = "add";
else if (line.startsWith("-")) cls = "del";
else if (line.startsWith("@@")) cls = "hunk";
box.append(h("div", { class: cls }, line || " "));
}
return box;
}
// errorBox shows an API error with its problems.
export function errorBox(err) {
if (!err) return null;
internal/web/static/assets/widgets.js
+34 -1
View File
@@ -70,7 +70,7 @@ export function listEditor(values, opts = {}) {
export function matchEditor(m, n, opts = {}) {
m = m || {};
const zones = (list) => listEditor(list, { suggestions: n.zones, placeholder: "zone", mono: false, addLabel: "Add zone" });
const addrs = (list) => listEditor(list, { suggestions: n.sets, placeholder: "a set, 10.0.10.0/24, 2001:db8::/64, 10.0.0.1-10.0.0.9", addLabel: "Add" });
const addrs = (list) => listEditor(list, { suggestions: n.sets, placeholder: "a set, 192.168.1.0/24, 2001:db8:1::/64, 192.168.1.100-192.168.1.199", addLabel: "Add" });
const inZ = zones(m.in_zones), outZ = zones(m.out_zones);
const notIn = checkbox("any zone but these", m.not_in), notOut = checkbox("any zone but these", m.not_out);
const src = addrs(m.sources), dst = addrs(m.destinations);
@@ -132,3 +132,36 @@ export function hits(counters, ...marks) {
export async function counters() {
try { return (await get("/counters")).counters; } catch { return {}; }
}
// ---- pending changes
// rowClass marks a table row: pending (new, changed, deleted, while
// changes are collected for review) and disabled.
export function rowClass(x) {
return [x.pending ? "pending-" + x.pending : "", x.disabled ? "disabled" : ""].filter(Boolean).join(" ");
}
// live drops what the pending changes delete (for picking neighbours).
export function live(list) {
return list.filter((x) => x.pending !== "deleted");
}
// ---- bytes
// fmtBytes writes bytes for people: "1.8 GB".
export function fmtBytes(n) {
if (n >= 1 << 30) return (n / (1 << 30)).toFixed(1) + " GB";
if (n >= 1 << 20) return (n / (1 << 20)).toFixed(1) + " MB";
if (n >= 1 << 10) return (n / (1 << 10)).toFixed(1) + " KB";
return n + " bytes";
}
// quotas loads what the rules' quotas used, by rule ID ({} without
// log:read).
export async function quotas() {
try {
const out = {};
for (const q of await get("/quotas")) out[q.rule_id] = q;
return out;
} catch { return {}; }
}