abrown38andClaude Opus 5.5
2880f7ddc9
Changesets, as in Jarl: configuration changes are operations that can be staged in a changeset, checked as they are added (validation and nft -c), reviewed with the diff of the ruleset, and applied together as one history entry, then on probation like any change made over the network. The web UI collects edits for review by default (pending rows, a bar with Review and Apply now, a Changes page, a switch for live edits); hc stages with -C ID or HOUSECARL_CHANGESET (checked like JARL_CHANGESET) and has hc changeset create/list/show/diff/apply/discard/remove. Undo, import and takeover refuse a changeset. --dry-run shows the ruleset's diff. Bandwidth and quotas: rate limits in bytes, per source or destination; quotas per rule or per address that reset daily, weekly, monthly on a day, or by hand, with their usage carried across reloads, saved for reboots, shown by hc quotas and on the rules page, and reset with hc rule reset-quota. Rules that count traffic are checked before established connections are accepted (so they see every packet) and can't accept. Per-address limits group IPv6 by /64 by default (--group-v4/-v6). Per-source rate meters use update. The importer turns meters, byte rates and quotas into these fields. The examples in the web UI, hc's help and the docs use documentation addresses and generic names instead of the maintainer's network. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
64 lines
4.0 KiB
JavaScript
64 lines
4.0 KiB
JavaScript
// Settings: policies, built-ins, antispoofing, flowtable, probation.
|
|
import { h, mount, field, select, checkbox, input, errorBox, readOnly } from "../ui.js";
|
|
import { get, change, can } from "../api.js";
|
|
import { rerender } from "../app.js";
|
|
import { listEditor, fmtSeconds, parseSeconds } from "../widgets.js";
|
|
|
|
const builtinText = [
|
|
["loopback", "Accept everything on lo"],
|
|
["established", "Accept established and related connections (input and forward)"],
|
|
["drop_invalid", "Drop invalid packets (input and forward)"],
|
|
["icmpv6", "Accept the ICMPv6 IPv6 needs: errors, echo, neighbour discovery, MLD (RFC 4890)"],
|
|
["ping_internal", "Accept ping to the firewall from internal zones"],
|
|
["dhcpv6_client", "Accept DHCPv6 replies on external zones (your ISP's prefix delegation)"],
|
|
["antispoof", "Drop impossible sources arriving on external zones (below)"],
|
|
["mss_clamp", "Clamp TCP MSS to the route MTU on external zones (needed with PPPoE)"],
|
|
];
|
|
|
|
export async function render(el) {
|
|
const [s, ifs] = await Promise.all([get("/settings"), get("/interfaces")]);
|
|
const write = can("config", true);
|
|
const pol = (v) => select([["drop", "drop"], ["accept", "accept"]], v);
|
|
const input_ = pol(s.input_policy), forward = pol(s.forward_policy), output = pol(s.output_policy);
|
|
const logDrops = checkbox("log what the input and forward policies drop (rate-limited; the Log page)", s.log_policy_drops);
|
|
const bis = builtinText.map(([k, text]) => [k, checkbox(text, s.builtins[k])]);
|
|
const own = listEditor(s.own_prefixes, { placeholder: "2001:db8::/48", addLabel: "Add prefix" });
|
|
const v4 = listEditor(s.antispoof_v4, { addLabel: "Add" });
|
|
const v6 = listEditor(s.antispoof_v6, { addLabel: "Add" });
|
|
const flow = listEditor(s.flowtable_devices, { suggestions: ifs.map((i) => i.name), placeholder: "wan", addLabel: "Add device" });
|
|
const probation = input({ value: fmtSeconds(s.probation_seconds || 120), class: "short" });
|
|
const err = h("div");
|
|
const save = async (dry) => {
|
|
mount(err);
|
|
const p = parseSeconds(probation.value);
|
|
if (p === null) { mount(err, h("div", { class: "msg err" }, "Write the probation as 2m or 90s.")); return; }
|
|
const builtins = {};
|
|
for (const [k, c] of bis) builtins[k] = c.input.checked;
|
|
try {
|
|
const r = await change("PATCH", "/settings", { input_policy: input_.value, forward_policy: forward.value, output_policy: output.value,
|
|
log_policy_drops: logDrops.input.checked, builtins, own_prefixes: own.value(), antispoof_v4: v4.value(), antispoof_v6: v6.value(),
|
|
flowtable_devices: flow.value(), probation_seconds: p === 120 ? 0 : p }, { query: dry ? { dry_run: 1 } : undefined });
|
|
if (!dry && (r.applied || r.staged)) rerender();
|
|
} catch (e) { mount(err, errorBox(e)); }
|
|
};
|
|
mount(el,
|
|
h("div", { class: "page-head" }, h("div", { class: "grow" }, h("h1", null, "Settings and built-ins"),
|
|
h("div", { class: "muted" }, "What happens to packets no rule decided, and the rules Housecarl adds before yours."))),
|
|
h("div", { class: "panel" }, h("div", { class: "form-grid" },
|
|
field("Input policy", input_, "Traffic to the firewall itself."),
|
|
field("Forward policy", forward, "Traffic through it."),
|
|
field("Output policy", output, "Traffic from it."),
|
|
h("label"), logDrops,
|
|
field("Built-ins", h("div", { class: "checks" }, bis.map(([, c]) => c))),
|
|
field("Your prefixes", own, "Your public prefixes (your delegated IPv6 /48): they can't come from outside."),
|
|
field("Antispoof IPv4", v4),
|
|
field("Antispoof IPv6", v6),
|
|
field("Flowtable", flow, "Forwarded TCP and UDP between these devices skip the rules once established (fast path). Exact names; none: off."),
|
|
field("Probation", probation, "How long a change made here has to be confirmed before it is rolled back.")),
|
|
err,
|
|
write ? h("div", { class: "actions form-actions" },
|
|
h("button", { class: "primary", onclick: () => save(false) }, "Save"),
|
|
h("button", { onclick: () => save(true), title: "Check without saving" }, "Check")) : null));
|
|
if (!write) readOnly(el.querySelector(".panel"));
|
|
}
|