Zone matrix: what the rules do between zones

internal/matrix walks each pair's rules in order, as nftables would, for
new connections: zone → zone (forward), zone → the firewall (input) and
back (output), with the built-ins that act on new connections. A rule
for the whole pair decides it; one for part of its traffic (addresses,
services, times, rates, a quota) is an exception; the rest falls to the
policy. Rules whose addresses all lie in networks connected to other
zones are left out of a pair. GET /matrix (with ?changeset, pending
changes), hc matrix [FROM TO], and a Matrix page whose cells open their
rules.

e2e: 166 checks, among them the matrix of the maintainer's imported
ruleset.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_config.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+	"net/netip"
 	"sort"
 	"strings"
 
@@ -12,6 +13,7 @@ import (
 	"housecarl/internal/api"
 	"housecarl/internal/auth"
 	"housecarl/internal/engine"
+	"housecarl/internal/matrix"
 	"housecarl/internal/model"
 	"housecarl/internal/store"
 )
@@ -416,6 +418,41 @@ func (s *Server) updateSettings(w http.ResponseWriter, r *http.Request, p *auth.
 	return s.change(w, r, p, model.Op{Op: model.OpSettings, Data: data})
 }
 
+// ---- the zone matrix
+
+// zoneMatrix answers what the rules do to new connections between zones
+// (internal/matrix); with a changeset named, as it will make them.
+func (s *Server) zoneMatrix(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	if err := require(p, auth.ResConfig, false); err != nil {
+		return err
+	}
+	_, st, _, err := s.viewState(w, r)
+	if err != nil {
+		return err
+	}
+	writeJSON(w, http.StatusOK, matrix.Build(st, matrix.Options{Connected: s.connected(st)}))
+	return nil
+}
+
+// connected maps the networks on the firewall's interfaces (link-local
+// and loopback aside) to their zones.
+func (s *Server) connected(st *model.State) map[netip.Prefix]string {
+	out := map[netip.Prefix]string{}
+	for _, i := range s.hostInterfaces(st) {
+		if i.Zone == "" {
+			continue
+		}
+		for _, a := range i.Addresses {
+			p, err := netip.ParsePrefix(a)
+			if err != nil || p.Addr().IsLinkLocalUnicast() || p.Addr().IsLoopback() {
+				continue
+			}
+			out[p.Masked()] = i.Zone
+		}
+	}
+	return out
+}
+
 // ---- the ruleset
 
 func (s *Server) ruleset(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {

internal/server/routes.go

@@ -63,6 +63,7 @@ func (s *Server) routes() {
 	m.HandleFunc("DELETE "+p+"/{kind}/{ref}", s.authed(s.deleteObject))
 	m.HandleFunc("POST "+p+"/{kind}/{ref}/move", s.authed(s.moveObject))
 	m.HandleFunc("GET "+p+"/ruleset", s.authed(s.ruleset))
+	m.HandleFunc("GET "+p+"/matrix", s.authed(s.zoneMatrix))
 	m.HandleFunc("GET "+p+"/history", s.authed(s.listHistory))
 	m.HandleFunc("GET "+p+"/history/{id}", s.authed(s.getHistory))
 	m.HandleFunc("POST "+p+"/history/{id}/revert", s.authed(s.revertHistory))

internal/server/server_test.go

@@ -848,6 +848,34 @@ func TestStagedUndo(t *testing.T) {
 	}
 }
 
+// TestMatrix: the zone matrix, now and as a changeset will make it.
+func TestMatrixEndpoint(t *testing.T) {
+	e := newEnv(t)
+	e.call(e.token, "POST", "/zones", model.Zone{Name: "lan", Interfaces: []string{"eth1"}}, nil)
+	e.call(e.token, "POST", "/zones", model.Zone{Name: "wan", Interfaces: []string{"wan"}, External: true}, nil)
+	var m api.Matrix
+	e.call(e.token, "GET", "/matrix", nil, &m)
+	cell := func(from, to string) api.MatrixCell {
+		for _, c := range m.Cells {
+			if c.From == from && c.To == to {
+				return c
+			}
+		}
+		return api.MatrixCell{}
+	}
+	if c := cell("lan", "wan"); c.Verdict != "blocked" || c.DecidedBy != "forward policy" {
+		t.Errorf("lan → wan: %+v", c)
+	}
+	var cs model.Changeset
+	e.call(e.token, "POST", "/changesets", nil, &cs)
+	q := "?changeset=" + itoa(cs.ID)
+	e.call(e.token, "POST", "/rules"+q, model.Rule{Chain: "forward", Match: model.Match{InZones: []string{"lan"}, OutZones: []string{"wan"}}, Action: "accept"}, nil)
+	e.call(e.token, "GET", "/matrix"+q, nil, &m)
+	if c := cell("lan", "wan"); c.Verdict != "allowed" {
+		t.Errorf("lan → wan with the changeset: %+v", c)
+	}
+}
+
 // TestHostProblems: an enabled nftables.service, and an imported table
 // still in force, are warned about.
 func TestHostProblems(t *testing.T) {