Add changesets, bandwidth limits and quotas; generic examples

Changesets, as in Jarl: configuration changes are operations that can be staged in a changeset, checked as they are added (validation and nft -c), reviewed with the diff of the ruleset, and applied together as one history entry, then on probation like any change made over the network. The web UI collects edits for review by default (pending rows, a bar with Review and Apply now, a Changes page, a switch for live edits); hc stages with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has hc changeset create/list/show/diff/apply/discard/remove. Undo, import and takeover refuse a changeset. --dry-run shows the ruleset's diff. Bandwidth and quotas: rate limits in bytes, per source or destination; quotas per rule or per address that reset daily, weekly, monthly on a day, or by hand, with their usage carried across reloads, saved for reboots, shown by hc quotas and on the rules page, and reset with hc rule reset-quota. Rules that count traffic are checked before established connections are accepted (so they see every packet) and can't accept. Per-address limits group IPv6 by /64 by default (--group-v4/-v6). Per-source rate meters use update. The importer turns meters, byte rates and quotas into these fields. The examples in the web UI, hc's help and the docs use documentation addresses and generic names instead of the maintainer's network. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-19 11:18:54 +01:00
1 parent ebec2cfcca
commit 2880f7ddc9
@@ -5,6 +5,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/cookiejar"
@@ -35,6 +36,7 @@ type fakeFW struct {
 	applyErr error
 	deleted  []string
 	restored []string
+	resets   []string
 }

 func (f *fakeFW) Check(_ context.Context, st *model.State) error { return nil }
@@ -88,6 +90,12 @@ func (f *fakeFW) DeleteTable(_ context.Context, fam, name string) error {
 	f.deleted = append(f.deleted, fam+" "+name)
 	return nil
 }
+func (f *fakeFW) ResetQuota(_ context.Context, id int64, perAddress bool) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.resets = append(f.resets, fmt.Sprintf("r%d:%v", id, perAddress))
+	return nil
+}
 func (f *fakeFW) TableText(_ context.Context, fam, name string) (string, error) {
 	return "table " + fam + " " + name + " {}", nil
 }
@@ -538,3 +546,179 @@ func TestImportAndTakeover(t *testing.T) {
 		t.Errorf("taking over Housecarl's own table: %d", code)
 	}
 }
+
+// TestChangesets: changes staged in a changeset are checked as they are
+// added, shown in reads that name the changeset, previewed with the
+// ruleset's diff, and applied together as one history entry, on
+// probation; another user can't use the changeset.
+func TestChangesets(t *testing.T) {
+	e := newEnv(t)
+	e.srv.probationFor = 5 * time.Second
+	e.call(e.token, "POST", "/zones", model.Zone{Name: "lan", Interfaces: []string{"eth1"}}, nil)
+	e.call(e.token, "POST", "/confirm", nil, nil)
+	applied := len(e.fw.applied)
+	var cs model.Changeset
+	if code := e.call(e.token, "POST", "/changesets", api.ChangesetInput{Description: "trusted ssh"}, &cs); code != 201 || cs.Status != "open" {
+		t.Fatalf("create: %d %+v", code, cs)
+	}
+	q := "?changeset=" + itoa(cs.ID)
+	// A rule naming a set the changeset hasn't made yet is refused.
+	var eb api.ErrorBody
+	rule := model.Rule{Chain: "input", Match: model.Match{Sources: []string{"trusted"}, Services: []string{"ssh"}}, Action: "accept"}
+	if code := e.call(e.token, "POST", "/rules"+q, rule, &eb); code != 422 || eb.Error.Code != "validation" {
+		t.Errorf("staging an invalid rule: %d %+v", code, eb)
+	}
+	var mr api.MutationResponse
+	if code := e.call(e.token, "POST", "/sets"+q, model.AddressSet{Name: "trusted", Entries: []string{"10.0.10.0/24"}}, &mr); code != 200 || !mr.Staged || mr.Applied {
+		t.Fatalf("stage set: %d %+v", code, mr)
+	}
+	if code := e.call(e.token, "POST", "/rules"+q, rule, &mr); code != 200 || !mr.Staged || len(mr.Changeset.Ops) != 2 {
+		t.Fatalf("stage rule: %d %+v", code, mr)
+	}
+	var created model.Rule
+	json.Unmarshal(mr.Object, &created)
+	// Later operations can name what the changeset made.
+	if code := e.call(e.token, "PATCH", "/rules/"+itoa(created.ID)+q, map[string]any{"comment": "SSH from home"}, &mr); code != 200 || len(mr.Changeset.Ops) != 3 {
+		t.Fatalf("stage update: %d %+v", code, mr)
+	}
+	if code := e.call(e.token, "DELETE", "/zones/lan"+q, nil, &mr); code != 200 {
+		t.Fatalf("stage delete: %d %+v", code, mr)
+	}
+	// Nothing applied yet.
+	if len(e.fw.applied) != applied || len(e.eng.State().Sets) != 0 {
+		t.Fatalf("staging applied something")
+	}
+	// Reads naming the changeset show it, marked.
+	var zones []map[string]any
+	e.call(e.token, "GET", "/zones"+q, nil, &zones)
+	if len(zones) != 1 || zones[0]["pending"] != "deleted" {
+		t.Errorf("zones in the changeset: %+v", zones)
+	}
+	var rules []map[string]any
+	e.call(e.token, "GET", "/rules"+q+"&chain=input", nil, &rules)
+	if len(rules) != 1 || rules[0]["pending"] != "new" || rules[0]["comment"] != "SSH from home" {
+		t.Errorf("rules in the changeset: %+v", rules)
+	}
+	var plain []map[string]any
+	e.call(e.token, "GET", "/zones", nil, &plain)
+	if len(plain) != 1 || plain[0]["pending"] != nil {
+		t.Errorf("zones without the changeset: %+v", plain)
+	}
+	// The preview: valid, with the ruleset's diff.
+	var pv api.ChangesetPreview
+	e.call(e.token, "GET", "/changesets/"+itoa(cs.ID)+"/preview", nil, &pv)
+	if !pv.Valid || !strings.Contains(pv.Diff, "+\t\tip saddr @trusted_v4 tcp dport 22 counter accept") || !strings.Contains(pv.Diff, "--- ruleset.nft (now)") {
+		t.Errorf("preview: %+v", pv)
+	}
+	// Another user can't stage into it, apply or discard it.
+	ctx := context.Background()
+	other := &model.User{Username: "sam", Grants: auth.Roles["operator"]}
+	e.srv.store.CreateUser(ctx, other)
+	otok, pid, sh := auth.NewToken()
+	e.srv.store.CreateToken(ctx, &model.Token{UserID: other.ID, Name: "t", PublicID: pid, SecretHash: sh})
+	if code := e.call(otok, "POST", "/changesets/"+itoa(cs.ID)+"/apply", nil, &eb); code != 403 || !strings.Contains(eb.Error.Message, "admin's") {
+		t.Errorf("another user's apply: %d %+v", code, eb)
+	}
+	// Removing an operation; then the changeset is applied as one change.
+	var after model.Changeset
+	if code := e.call(e.token, "DELETE", "/changesets/"+itoa(cs.ID)+"/ops/4", nil, &after); code != 200 || len(after.Ops) != 3 {
+		t.Fatalf("remove op: %d %+v", code, after)
+	}
+	if code := e.call(e.token, "POST", "/changesets/"+itoa(cs.ID)+"/apply", nil, &mr); code != 200 || !mr.Applied || mr.ConfirmBy == nil || mr.Changeset.Status != "applied" {
+		t.Fatalf("apply: %d %+v", code, mr)
+	}
+	if len(e.fw.applied) != applied+1 || len(e.eng.State().Rules) != 1 || len(e.eng.State().Zones) != 1 {
+		t.Errorf("applied: %d rulesets, state %+v", len(e.fw.applied)-applied, e.eng.State())
+	}
+	h, _ := e.srv.store.GetHistory(ctx, mr.HistoryID)
+	if h.Description != "trusted ssh" || len(h.Changes) != 2 {
+		t.Errorf("history: %+v", h)
+	}
+	// An applied changeset takes no more.
+	if code := e.call(e.token, "POST", "/sets"+q, model.AddressSet{Name: "x", Entries: []string{"10.0.0.1"}}, &eb); code != 409 || !strings.Contains(eb.Error.Message, "is applied") {
+		t.Errorf("staging into an applied changeset: %d %+v", code, eb)
+	}
+	// A changeset that no longer applies names the operation.
+	var cs2 model.Changeset
+	e.call(e.token, "POST", "/changesets", nil, &cs2)
+	e.call(e.token, "PATCH", "/rules/"+itoa(created.ID)+"?changeset="+itoa(cs2.ID), map[string]any{"comment": "x"}, nil)
+	e.call(e.token, "DELETE", "/rules/"+itoa(created.ID), nil, nil)
+	e.call(e.token, "GET", "/changesets/"+itoa(cs2.ID)+"/preview", nil, &pv)
+	if pv.Valid || pv.Error == nil || pv.Error.Op != 1 || !strings.Contains(pv.Error.Message, "operation 1") {
+		t.Errorf("stale preview: %+v", pv)
+	}
+	if code := e.call(e.token, "POST", "/changesets/"+itoa(cs2.ID)+"/discard", nil, &after); code != 200 || after.Status != "discarded" {
+		t.Errorf("discard: %d %+v", code, after)
+	}
+	// A dry run shows the ruleset's diff.
+	if code := e.call(e.token, "POST", "/sets?dry_run=1", model.AddressSet{Name: "y", Entries: []string{"10.0.0.2"}}, &mr); code != 200 || !strings.Contains(mr.Diff, "+\tset y_v4") {
+		t.Errorf("dry run diff: %d %q", code, mr.Diff)
+	}
+}
+
+func TestQuotaPeriods(t *testing.T) {
+	at := func(s string) time.Time { v, _ := time.ParseInLocation("2006-01-02 15:04", s, time.Local); return v }
+	for _, c := range []struct {
+		now, reset string
+		day        int
+		start      string
+		next       string
+	}{
+		{"2026-10-19 10:00", "daily", 0, "2026-10-19 00:00", "2026-10-20 00:00"},
+		{"2026-10-19 10:00", "weekly", 0, "2026-10-19 00:00", "2026-10-26 00:00"}, // a Monday
+		{"2026-10-25 23:59", "weekly", 0, "2026-10-19 00:00", "2026-10-26 00:00"}, // a Sunday
+		{"2026-10-19 10:00", "monthly", 15, "2026-10-15 00:00", "2026-11-15 00:00"},
+		{"2026-10-10 10:00", "monthly", 15, "2026-09-15 00:00", "2026-10-15 00:00"},
+		{"2026-02-28 10:00", "monthly", 31, "2026-02-28 00:00", "2026-03-31 00:00"}, // February has no 31st
+		{"2026-03-15 10:00", "monthly", 31, "2026-02-28 00:00", "2026-03-31 00:00"},
+		{"2026-01-01 00:00", "monthly", 0, "2026-01-01 00:00", "2026-02-01 00:00"},
+	} {
+		now := at(c.now)
+		if got := periodStart(now, c.reset, c.day); !got.Equal(at(c.start)) {
+			t.Errorf("%s %s %d: period from %s, want %s", c.now, c.reset, c.day, got.Format("2006-01-02 15:04"), c.start)
+		}
+		if got := nextReset(now, c.reset, c.day); !got.Equal(at(c.next)) {
+			t.Errorf("%s %s %d: next reset %s, want %s", c.now, c.reset, c.day, got.Format("2006-01-02 15:04"), c.next)
+		}
+	}
+	if !periodStart(time.Now(), "", 0).IsZero() {
+		t.Error("a quota reset by hand has no period")
+	}
+}
+
+// TestQuotaResets: a quota starts its period when first seen, is reset
+// when the next one starts, and by hand.
+func TestQuotaResets(t *testing.T) {
+	e := newEnv(t)
+	ctx := context.Background()
+	now := time.Date(2026, 10, 19, 23, 50, 0, 0, time.Local)
+	e.srv.nowFn = func() time.Time { return now }
+	var mr api.MutationResponse
+	rule := model.Rule{Chain: "forward", Action: "drop", Quota: &model.Quota{Bytes: 5 << 30, Over: true, PerSource: true, Reset: "daily"}}
+	if code := e.call(e.token, "POST", "/rules", rule, &mr); code != 201 {
+		t.Fatalf("rule: %d %+v", code, mr)
+	}
+	var created model.Rule
+	json.Unmarshal(mr.Object, &created)
+	e.srv.checkQuotas(ctx)
+	if len(e.fw.resets) != 0 {
+		t.Fatalf("reset on first sight: %v", e.fw.resets)
+	}
+	now = now.Add(5 * time.Minute) // the same day
+	e.srv.checkQuotas(ctx)
+	now = now.Add(10 * time.Minute) // past midnight
+	e.srv.checkQuotas(ctx)
+	e.srv.checkQuotas(ctx)
+	want := fmt.Sprintf("r%d:true", created.ID)
+	if strings.Join(e.fw.resets, ",") != want {
+		t.Errorf("resets %v, want one %s", e.fw.resets, want)
+	}
+	var qs []api.QuotaInfo
+	e.call(e.token, "GET", "/quotas", nil, &qs)
+	if len(qs) != 1 || qs[0].NextReset == nil || qs[0].NextReset.Day() != 21 {
+		t.Errorf("quotas %+v", qs)
+	}
+	if code := e.call(e.token, "POST", "/rules/"+itoa(created.ID)+"/reset-quota", nil, nil); code != 200 || len(e.fw.resets) != 2 {
+		t.Errorf("reset by hand: %d %v", code, e.fw.resets)
+	}
+}