Shadow mode: Housecarl beside the firewall in force, changing nothing

shadow.enabled in housecarl.yaml loads Housecarl's ruleset so that it
blocks, rejects and translates nothing: drops and rejects count and
accept (an accept only ends Housecarl's chain), policies accept and log
what they would drop, NAT only counts, MSS clamping and the flowtable
are left out, and raw rules that do more than accept, drop or reject are
left out with a warning. Comments mark what would happen ([would drop]).
Filter chains run after the other firewall's (+10) or before (-10); NAT
chains always first. Every change is checked by nftables in both forms.
No probation; takeovers and closing connections are refused. The boot
fallback filters nothing. internal/tablewatch puts the table back after
a flush ruleset. Mode in status, healthz, whoami, the web UI, the log
and the tracer; hc ruleset --enforcing. docs/shadow.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/trace/trace.go

@@ -194,8 +194,21 @@ func (t *Tracer) Line(line string) {
 	}
 }
 
-// decide notes a packet's fate: the first drop (or reject) ends it.
+// wouldRe finds shadow mode's marker in a rule's comment (render.Would):
+// "[would drop]", "[would reject]".
+var wouldRe = regexp.MustCompile(`"hc:\S+ \[would (drop|reject)\]|"\[would (drop|reject)\]`)
+
+// decide notes a packet's fate: the first drop (or reject) ends it. In
+// shadow mode Housecarl's rules accept what they would drop: that is
+// noted apart, and decides nothing.
 func decide(p *api.TracePacket, s api.TraceStep) {
+	if s.Kind == "rule" && wouldRe.MatchString(s.Rule) {
+		if p.WouldDrop == nil && p.Verdict != "dropped" {
+			step := s
+			p.WouldDrop = &step
+		}
+		return
+	}
 	if p.Verdict == "dropped" {
 		return
 	}

internal/trace/trace_test.go

@@ -87,3 +87,34 @@ func TestScript(t *testing.T) {
 		t.Error("ICMP with a port")
 	}
 }
+
+// In shadow mode Housecarl's rules accept what they would drop: the
+// packet's fate is the other table's, and the would-be drop is noted.
+func TestShadowTrace(t *testing.T) {
+	var tr Tracer
+	for _, l := range strings.Split(`trace id 9 ip main input packet: iif "wan" ip saddr 198.51.100.7 ip daddr 203.0.113.10 tcp sport 4000 tcp dport 9999 tcp flags == syn
+trace id 9 ip main input rule tcp dport 9999 accept (verdict accept)
+trace id 9 inet housecarl input rule tcp dport 9999 counter packets 1 bytes 60 accept comment "hc:r12 [would drop] block 9999" (verdict accept)
+trace id 10 ip main input packet: iif "wan" ip saddr 198.51.100.7 ip daddr 203.0.113.10 tcp sport 4001 tcp dport 7000 tcp flags == syn
+trace id 10 ip main input rule tcp dport 7000 accept (verdict accept)
+trace id 10 inet housecarl input rule counter packets 1 bytes 60 comment "hc:p-input [would drop]" (verdict continue)
+trace id 10 inet housecarl input policy accept
+trace id 11 ip main input packet: iif "wan" ip saddr 198.51.100.7 ip daddr 203.0.113.10 tcp sport 4002 tcp dport 22 tcp flags == syn
+trace id 11 ip main input rule tcp dport 22 accept (verdict accept)
+trace id 11 inet housecarl input rule tcp dport 22 counter packets 1 bytes 60 accept comment "hc:r3 ssh" (verdict accept)`, "\n") {
+		tr.Line(l)
+	}
+	ps := tr.Packets()
+	if len(ps) != 3 {
+		t.Fatalf("packets: %+v", ps)
+	}
+	if p := ps[0]; p.Verdict != "accepted" || p.WouldDrop == nil || p.WouldDrop.Mark != "r12" || p.DecidedBy.Table != "ip main" {
+		t.Errorf("first: %+v", p)
+	}
+	if p := ps[1]; p.Verdict != "accepted" || p.WouldDrop == nil || p.WouldDrop.Mark != "p-input" {
+		t.Errorf("second: %+v", p)
+	}
+	if p := ps[2]; p.WouldDrop != nil || p.DecidedBy.Mark != "r3" {
+		t.Errorf("third: %+v", p)
+	}
+}