Sets from Jarl: sets holding the addresses of names in Jarl

A set can take its addresses from Jarl: every A and AAAA record of its
names (NAME@VIEW), CNAMEs followed within Jarl's zones in the same view.
housecarld reads them every jarl.refresh and after each change, keeps
only the addresses within the zones and networks the set allows, and
keeps what it last read (saved in the database and the boot ruleset)
while Jarl can't be reached. A change of the addresses applies the
ruleset again without a history entry and is audited (set.jarl).

hc set add --jarl --within, hc set jarl; the kind "from Jarl" and
Addresses… on the Sets page; GET /sets/{name}/jarl and /jarl/refresh;
validation codes set_jarl_*, status warnings jarl_*; docs/jarl.md.
e2e phase with scripts/fakejarl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/render/render.go

@@ -52,6 +52,9 @@ type Options struct {
 	DeviceSets map[string][]Element
 	// Bans are the ban lists' active bans, added to their sets.
 	Bans []Ban
+	// JarlSets are the Jarl sets' addresses (set name → addresses, both
+	// families), as Jarl gave them and within allows.
+	JarlSets map[string][]string
 	// Shadow renders for shadow mode: nothing is blocked, rejected,
 	// translated or changed (see the package comment).
 	Shadow bool
@@ -186,6 +189,10 @@ func (r *renderer) sets() {
 			}
 			continue
 		}
+		if s.Jarl != nil {
+			r.jarlSet(s)
+			continue
+		}
 		has4, has6 := s.Families()
 		for _, v6 := range []bool{false, true} {
 			if v6 && !has6 || !v6 && !has4 {
@@ -197,6 +204,26 @@ func (r *renderer) sets() {
 	}
 }
 
+// jarlSet declares a Jarl set's two sets with the addresses it has now
+// (none yet: empty, so its rules match nothing).
+func (r *renderer) jarlSet(s *model.AddressSet) {
+	for _, v6 := range []bool{false, true} {
+		var elems []string
+		for _, e := range r.opt.JarlSets[s.Name] {
+			if a, err := model.ParseAddress(e); err == nil && a.IsV6() == v6 {
+				elems = append(elems, a.String())
+			}
+		}
+		if len(elems) == 0 {
+			r.w.emit("set "+s.Name, "\tset %s { type %s; }", setName(s.Name, v6), addrType(v6))
+			continue
+		}
+		// Single addresses: no interval flag, so they stay as they are
+		// (auto-merge would join neighbours into ranges).
+		r.w.emit("set "+s.Name, "\tset %s { type %s; elements = { %s } }", setName(s.Name, v6), addrType(v6), strings.Join(elems, ", "))
+	}
+}
+
 func (r *renderer) elements() {
 	names := make([]string, 0, len(r.opt.Elements))
 	for n := range r.opt.Elements {

internal/render/render_test.go

@@ -35,6 +35,8 @@ func router() *model.State {
 		{ID: next(), Name: "wg_admins", Entries: []string{"10.50.50.3", "10.50.50.6"}},
 		{ID: next(), Name: "dns_servers", Entries: []string{"10.0.10.5", "217.155.8.194", "fdab:abab:abab:10::5", "2a02:8013:7f3d:10::5"}},
 		{ID: next(), Name: "guests", Dynamic: true, Timeout: 3600},
+		{ID: next(), Name: "nas", Jarl: &model.JarlSource{Names: []model.JarlName{{Name: "nas.example.com", View: "internal"}}, Within: []string{"lan"}}},
+		{ID: next(), Name: "printers", Jarl: &model.JarlSource{Names: []model.JarlName{{Name: "printer.example.com"}}, Within: []string{"lan"}}},
 	}
 	st.Services = []*model.Service{
 		{ID: next(), Name: "jarl", Entries: []string{"tcp/8053"}},
@@ -67,6 +69,7 @@ func router() *model.State {
 	rule(model.ChainForward, model.Rule{Match: model.Match{InZones: []string{"wan"}}, Action: model.ActionDrop, Comment: "nothing else in"})
 	rule(model.ChainForward, model.Rule{Match: model.Match{Destinations: []string{"wg_net"}}, Action: model.ActionDrop})
 	rule(model.ChainForward, model.Rule{Match: model.Match{Services: []string{"ping"}}})
+	rule(model.ChainForward, model.Rule{Match: model.Match{InZones: []string{"wg"}, Destinations: []string{"nas", "printers"}}, Comment: "from Jarl"})
 	rule(model.ChainForward, model.Rule{Match: model.Match{Sources: []string{"wg_net", "trusted", "guests"}}})
 	// Bandwidth: a byte rate, per destination; per /24; quotas, total and
 	// per device.
@@ -106,6 +109,9 @@ func router() *model.State {
 	return st
 }
 
+// jarlOptions are the Jarl sets' addresses.
+var jarlOptions = map[string][]string{"nas": {"10.0.10.20", "10.0.10.21", "2a02:8013:7f3d:10::20"}, "printers": {}}
+
 // banOptions are active bans in each ban list, of every port and of one.
 func banOptions(st *model.State) []Ban {
 	var out []Ban
@@ -137,13 +143,19 @@ func quotaOptions(st *model.State) (map[string]int64, map[string][]Element) {
 func TestRenderRouter(t *testing.T) {
 	st := router()
 	q, qs := quotaOptions(st)
-	rs := Render(st, Options{Elements: map[string][]Element{"guests": {{Addr: "10.0.30.5", Timeout: 1700}}}, Quotas: q, QuotaSets: qs})
+	rs := Render(st, Options{Elements: map[string][]Element{"guests": {{Addr: "10.0.30.5", Timeout: 1700}}}, Quotas: q, QuotaSets: qs, JarlSets: jarlOptions})
 	text := rs.Text
 	for _, want := range []string{
 		"table inet housecarl {}\ndelete table inet housecarl\ntable inet housecarl {",
 		`set trusted_v4 { type ipv4_addr; flags interval; auto-merge; elements = { 10.0.10.0/24, 10.20.30.0/24, 10.50.50.0/24 } }`,
 		`set trusted_v6 { type ipv6_addr; flags interval; auto-merge; elements = { 2a02:8013:7f3d:10::/64 } }`,
 		`set guests_v4 { type ipv4_addr; flags timeout; timeout 3600s; }`,
+		// Jarl sets: their addresses now, or empty.
+		`set nas_v4 { type ipv4_addr; elements = { 10.0.10.20, 10.0.10.21 } }`,
+		`set nas_v6 { type ipv6_addr; elements = { 2a02:8013:7f3d:10::20 } }`,
+		"set printers_v4 { type ipv4_addr; }\n",
+		`iifname "wg0" ip daddr @nas_v4 counter accept`,
+		`iifname "wg0" ip6 daddr @printers_v6 counter accept`,
 		`iifname "wan" ip saddr { 0.0.0.0/8,`,
 		`iifname "wan" ip6 saddr { ::1/128, ::/128, fc00::/7, 2001:db8::/32, ff00::/8, 2a02:8013:7f3d::/48 } counter drop`,
 		`oifname "wan" tcp flags syn tcp option maxseg size set rt mtu comment "hc:b-mss-clamp"`,
@@ -278,7 +290,7 @@ func TestRenderedRulesetPassesNft(t *testing.T) {
 		for _, mode := range []Options{{}, {Shadow: true}, {Shadow: true, ShadowBefore: true}} {
 			opt := Options{Elements: map[string][]Element{"guests": {{Addr: "10.0.30.5", Timeout: 1700}, {Addr: "2a02:8013:7f3d:30::5"}}}, Quotas: q, QuotaSets: qs, Bans: banOptions(st),
 				DeviceSets: map[string][]Element{"stats_up_v4": {{Addr: "10.0.10.5", Timeout: 3000, Packets: 7, Bytes: 7000}}, "stats_down_v6": {{Addr: "2001:db8:1:2::", Packets: 1, Bytes: 100}}},
-				Shadow:     mode.Shadow, ShadowBefore: mode.ShadowBefore}
+				JarlSets:   jarlOptions, Shadow: mode.Shadow, ShadowBefore: mode.ShadowBefore}
 			nftCheck(t, cmd, fmt.Sprintf("%s (shadow %v, before %v)", name, mode.Shadow, mode.ShadowBefore), Render(st, opt).Text)
 		}
 	}