Names beside inside addresses

Reverse lookups (internal/names, POST /names) put a name beside each
inside address in connections, the log, quota usage, the dashboard's
quotas and the statistics' devices and blocked sources, in the web UI
and hc (--no-names to leave them out). Only inside addresses are looked
up: an inside zone's networks, and private ones outside the external
zones'. Names are cached (names.cache, 10m) and never stored;
names.resolver picks the DNS server.

Also: hc stats top devices listed each device twice; the dashboard's
quotas named the rule's ID twice.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_traffic.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"net/netip"
 	"sort"
 	"strconv"
 	"strings"
@@ -88,6 +89,83 @@ func (s *Server) listConnections(w http.ResponseWriter, r *http.Request, p *auth
 	return nil
 }
 
+// lookupNames finds the names of the inside addresses asked about
+// (docs/configuration.md#names), waiting at most a second for lookups.
+func (s *Server) lookupNames(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	if err := require(p, auth.ResLog, false); err != nil {
+		return err
+	}
+	var in api.NamesInput
+	if err := decodeJSON(r, &in); err != nil {
+		return err
+	}
+	if len(in.Addresses) > maxNames {
+		return badRequest("ask for at most %d addresses at once", maxNames)
+	}
+	out := api.Names{Enabled: s.cfg.Names != nil, Names: map[string]string{}}
+	if s.cfg.Names == nil {
+		writeJSON(w, http.StatusOK, out)
+		return nil
+	}
+	inside := s.insideNetworks(s.eng.State())
+	asked := map[netip.Addr][]string{}
+	var addrs []netip.Addr
+	for _, a := range in.Addresses {
+		ad, err := netip.ParseAddr(a)
+		if err != nil || !inside(ad.Unmap()) {
+			continue
+		}
+		ad = ad.Unmap()
+		if _, ok := asked[ad]; !ok {
+			addrs = append(addrs, ad)
+		}
+		asked[ad] = append(asked[ad], a)
+	}
+	for a, n := range s.cfg.Names.Names(r.Context(), addrs, time.Second) {
+		for _, as := range asked[a] {
+			out.Names[as] = n
+		}
+	}
+	writeJSON(w, http.StatusOK, out)
+	return nil
+}
+
+// maxNames is the most addresses one POST /names may ask about.
+const maxNames = 2000
+
+// insideNetworks tells inside addresses: in a network connected to an
+// inside zone's interface, or private and not in an external zone's.
+func (s *Server) insideNetworks(st *model.State) func(netip.Addr) bool {
+	external := map[string]bool{}
+	for _, z := range st.Zones {
+		external[z.Name] = z.External
+	}
+	var in, out []netip.Prefix
+	for p, zone := range s.connected(st) {
+		if external[zone] {
+			out = append(out, p)
+		} else {
+			in = append(in, p)
+		}
+	}
+	return func(a netip.Addr) bool {
+		if a.IsLoopback() || a.IsUnspecified() || a.IsMulticast() || a.IsLinkLocalUnicast() {
+			return false
+		}
+		for _, p := range in {
+			if p.Contains(a) {
+				return true
+			}
+		}
+		for _, p := range out {
+			if p.Contains(a) {
+				return false
+			}
+		}
+		return a.IsPrivate()
+	}
+}
+
 // closeConnections deletes tracking entries: the rules check those
 // connections again with their next packet.
 func (s *Server) closeConnections(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {

internal/server/routes.go

@@ -41,6 +41,7 @@ func (s *Server) routes() {
 	m.HandleFunc("GET "+p+"/quotas", s.authed(s.listQuotas))
 	m.HandleFunc("GET "+p+"/connections", s.authed(s.listConnections))
 	m.HandleFunc("POST "+p+"/connections/close", s.authed(s.closeConnections))
+	m.HandleFunc("POST "+p+"/names", s.authed(s.lookupNames))
 	m.HandleFunc("GET "+p+"/trace", s.authed(s.getTrace))
 	m.HandleFunc("POST "+p+"/trace", s.authed(s.startTrace))
 	m.HandleFunc("DELETE "+p+"/trace", s.authed(s.stopTrace))

internal/server/server.go

@@ -23,6 +23,7 @@ import (
 	"housecarl/internal/certs"
 	"housecarl/internal/engine"
 	"housecarl/internal/model"
+	"housecarl/internal/names"
 	"housecarl/internal/nft"
 	"housecarl/internal/render"
 	"housecarl/internal/stats"
@@ -51,6 +52,8 @@ type Config struct {
 	// after or before, for the status.
 	Shadow         bool
 	ShadowPosition string
+	// Names looks up inside addresses' names (nil: names are off).
+	Names *names.Resolver
 }
 
 // Interfaces lists the host's interfaces with their addresses, and

internal/server/server_test.go

@@ -12,6 +12,7 @@ import (
 	"net/http/httptest"
 	"net/netip"
 	"os"
+	"reflect"
 	"strings"
 	"sync"
 	"testing"
@@ -21,6 +22,7 @@ import (
 	"housecarl/internal/auth"
 	"housecarl/internal/engine"
 	"housecarl/internal/model"
+	"housecarl/internal/names"
 	"housecarl/internal/nft"
 	"housecarl/internal/render"
 	"housecarl/internal/stats"
@@ -982,6 +984,41 @@ func TestConnections(t *testing.T) {
 	}
 }
 
+// TestNames: names only for inside addresses (an inside zone's network,
+// or private outside the external zones'), under the address as asked.
+func TestNames(t *testing.T) {
+	var asked []string
+	var mu sync.Mutex
+	e := newEnvWith(t, Config{Names: names.NewFunc(func(_ context.Context, a string) ([]string, error) {
+		mu.Lock()
+		asked = append(asked, a)
+		mu.Unlock()
+		return []string{"host-" + strings.ReplaceAll(a, ".", "-") + ".example.net."}, nil
+	}, time.Hour)})
+	e.call(e.token, "POST", "/zones", model.Zone{Name: "wan", Interfaces: []string{"wan"}, External: true}, nil)
+	e.call(e.token, "POST", "/zones", model.Zone{Name: "lan", Interfaces: []string{"eth1"}}, nil)
+	var out api.Names
+	e.call(e.token, "POST", "/names", api.NamesInput{Addresses: []string{"10.0.10.5", "::ffff:10.0.10.5", "192.168.7.7", "217.155.8.194", "8.8.8.8", "fe80::1", "nonsense"}}, &out)
+	want := map[string]string{"10.0.10.5": "host-10-0-10-5.example.net", "::ffff:10.0.10.5": "host-10-0-10-5.example.net", "192.168.7.7": "host-192-168-7-7.example.net"}
+	if !out.Enabled || !reflect.DeepEqual(out.Names, want) {
+		t.Errorf("names: %+v", out)
+	}
+	if len(asked) != 2 {
+		t.Errorf("looked up %v, want the two inside addresses once each", asked)
+	}
+	var tok api.Token
+	e.call(e.token, "POST", "/me/tokens", api.TokenInput{Name: "monitor", Role: "log"}, &tok)
+	var one, none api.Names
+	if code := e.call(tok.Secret, "POST", "/names", api.NamesInput{Addresses: []string{"10.0.10.5"}}, &one); code != 200 || len(one.Names) != 1 {
+		t.Errorf("with log:read: %d %+v", code, one)
+	}
+	off := newEnv(t)
+	off.call(off.token, "POST", "/names", api.NamesInput{Addresses: []string{"10.0.10.5"}}, &none)
+	if none.Enabled || len(none.Names) != 0 {
+		t.Errorf("names off: %+v", none)
+	}
+}
+
 // TestTrace: a trace runs with the filter's table, collects packets named
 // after Housecarl's objects, and stops when asked; one at a time.
 func TestTrace(t *testing.T) {