Build Housecarl 0.1.0: the nftables firewall manager

Zones, address sets (IPv4 and IPv6 mixed, dynamic sets with timeouts) and
services, ordered rules in the early, input, forward and output chains,
port forwards with hairpin NAT and IPv6 pinholes, source NAT, redirects,
and switchable built-ins (loopback, conntrack, ICMPv6, antispoofing, MSS
clamping, DHCPv6 client, flowtable). Every change is validated, checked
with nft -c and applied in one transaction to Housecarl's own table,
inet housecarl; changes made over the network roll back unless
confirmed, and the confirmed ruleset is loaded at boot by
housecarl-ruleset.service. An empty configuration applies nothing.

Also: hit counters and the drop log (nflog), 'hc import' of an existing
nftables ruleset and 'hc takeover', the hc CLI, the REST API and the web
UI, users, scoped tokens (sets:write:NAME), the audit log, the web UI's
certificate through Jarl, Debian packages, docs, unit tests with real
nft 1.1.3, and an e2e test with real traffic (71 checks).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/model/settings.go

@@ -0,0 +1,90 @@
+package model
+
+// Settings are the firewall-wide settings: default policies and the rules
+// Housecarl adds by itself ("built-ins"), each of which can be turned off.
+type Settings struct {
+	// Policies for packets no rule decided: accept or drop.
+	InputPolicy   string `json:"input_policy"`
+	ForwardPolicy string `json:"forward_policy"`
+	OutputPolicy  string `json:"output_policy"`
+	// LogPolicyDrops logs (rate-limited) what the input and forward
+	// policies drop.
+	LogPolicyDrops bool `json:"log_policy_drops,omitempty"`
+
+	Builtins Builtins `json:"builtins"`
+
+	// AntispoofV4 and AntispoofV6 are source addresses that can't come
+	// from the internet: dropped on external zones (Builtins.Antispoof),
+	// together with OwnPrefixes.
+	AntispoofV4 []string `json:"antispoof_v4"`
+	AntispoofV6 []string `json:"antispoof_v6"`
+	// OwnPrefixes are your own public prefixes (your delegated IPv6
+	// prefix, say): traffic claiming to come from them can't arrive from
+	// outside.
+	OwnPrefixes []string `json:"own_prefixes,omitempty"`
+
+	// Flowtable devices: forwarded TCP and UDP connections between them
+	// skip the rules once established (fast path). Empty: off. Names
+	// must be exact (no wildcards).
+	FlowtableDevices []string `json:"flowtable_devices,omitempty"`
+
+	// ProbationSeconds is how long a change made over the network has to
+	// be confirmed before it is rolled back (0: the default).
+	ProbationSeconds int `json:"probation_seconds,omitempty"`
+}
+
+// Builtins are rules Housecarl adds itself, shown as "added by Housecarl".
+type Builtins struct {
+	// Loopback accepts everything on lo.
+	Loopback bool `json:"loopback"`
+	// Established accepts packets of established and related connections.
+	Established bool `json:"established"`
+	// DropInvalid drops packets conntrack finds invalid.
+	DropInvalid bool `json:"drop_invalid"`
+	// ICMPv6 accepts the ICMPv6 IPv6 needs (RFC 4890): errors, echo, and
+	// neighbour discovery and MLD on the local link.
+	ICMPv6 bool `json:"icmpv6"`
+	// PingInternal accepts ICMP echo to the firewall from internal zones.
+	PingInternal bool `json:"ping_internal"`
+	// DHCPv6Client accepts DHCPv6 replies on external zones (an ISP's
+	// prefix delegation).
+	DHCPv6Client bool `json:"dhcpv6_client"`
+	// Antispoof drops impossible source addresses arriving on external
+	// zones (AntispoofV4, AntispoofV6, OwnPrefixes).
+	Antispoof bool `json:"antispoof"`
+	// MSSClamp clamps TCP MSS to the route MTU on external zones (needed
+	// with PPPoE).
+	MSSClamp bool `json:"mss_clamp"`
+}
+
+// Policies.
+const (
+	PolicyAccept = "accept"
+	PolicyDrop   = "drop"
+)
+
+// DefaultProbation is how long a network change has to be confirmed.
+const DefaultProbation = 120
+
+// DefaultSettings are the settings of a new database: drop what isn't
+// allowed in and through, allow out, every built-in on.
+func DefaultSettings() Settings {
+	return Settings{
+		InputPolicy:   PolicyDrop,
+		ForwardPolicy: PolicyDrop,
+		OutputPolicy:  PolicyAccept,
+		Builtins: Builtins{Loopback: true, Established: true, DropInvalid: true, ICMPv6: true,
+			PingInternal: true, DHCPv6Client: true, Antispoof: true, MSSClamp: false},
+		AntispoofV4: []string{"0.0.0.0/8", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
+			"192.0.2.0/24", "192.168.0.0/16", "198.51.100.0/24", "203.0.113.0/24", "224.0.0.0/4", "240.0.0.0/4"},
+		AntispoofV6: []string{"::1/128", "::/128", "fc00::/7", "2001:db8::/32", "ff00::/8"},
+	}
+}
+
+// Probation is the probation in seconds, with its default.
+func (s Settings) Probation() int {
+	if s.ProbationSeconds > 0 {
+		return s.ProbationSeconds
+	}
+	return DefaultProbation
+}