Different blocking for different devices: steps and client groups
Client groups put devices (addresses, networks, or ACLs of them) at a blocking step: off (only your rules), normal (the default), or steps added above it, each including the lists of the steps below. Lists start at a step. In each view, a gate policy zone in front of a step's lists lets the devices below that step through (rpz-client-ip triggers with rpz-passthru), so every list is still loaded once. The IPv6 part of a gate leaves the IPv4-mapped range out: named matches IPv4 clients as ::ffff:a.b.c.d. Web UI: a Devices panel on the Blocking page and a step on each list. CLI: jarl block step, jarl block group, jarl blocklist --step. API: /blocking/steps, /blocking/groups. Database schema 8. Also: copying the state kept empty lists as empty (not nil), so reverting a changeset no longer adds restore operations for unchanged blocklists, rules and views. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
adamandClaude Opus 5.5 committed
1 parent
5b8f681e2a
commit
76aaaf3ef5
33 files changed
+2096
-55
No files matched your search
@@ -0,0 +1,271 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"io"
|
||||
"net/url"
|
||||
"strings"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
|
||||
"jarl/internal/api"
|
||||
)
|
||||
|
||||
// Blocking steps and client groups (docs/blocking.md).
|
||||
|
||||
func blockStepCmd() *cobra.Command {
|
||||
cmd := &cobra.Command{Use: "step", Aliases: []string{"steps"}, Short: "Blocking steps: which lists apply to which client groups",
|
||||
Long: `Steps decide which blocklists a client group gets. Each step includes the
|
||||
lists of the steps below it, plus its own:
|
||||
|
||||
off only your rules (built in)
|
||||
normal your rules + the normal lists; clients not in a group (built in)
|
||||
strict normal + the lists at step strict (a step you add)
|
||||
...
|
||||
|
||||
Lists start at a step ('jarl blocklist update LIST --step strict'), client
|
||||
groups are at one ('jarl block group add kids 10.10.0.50 --step strict').`}
|
||||
list := &cobra.Command{
|
||||
Use: "list",
|
||||
Short: "List the steps, lowest first",
|
||||
Args: cobra.NoArgs,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c, err := newClient()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
var steps []api.BlockStep
|
||||
if err := c.Get(ctx(), "/blocking/steps", nil, &steps); err != nil {
|
||||
return err
|
||||
}
|
||||
return output(steps, func(w io.Writer) {
|
||||
fmt.Fprintln(w, "STEP\tLISTS\tGROUPS\tCOMMENT")
|
||||
fmt.Fprintln(w, "off\t-\t(built in)\tonly your rules")
|
||||
fmt.Fprintln(w, "normal\t-\t(built in)\tthe default")
|
||||
for _, s := range steps {
|
||||
fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", s.Name, orDash(strings.Join(s.Lists, ", ")), orDash(strings.Join(s.Groups, ", ")), s.Comment)
|
||||
}
|
||||
})
|
||||
},
|
||||
}
|
||||
var comment string
|
||||
add := &cobra.Command{
|
||||
Use: "add NAME",
|
||||
Short: "Add a step above the existing ones",
|
||||
Args: cobra.ExactArgs(1),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c, err := newClient()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
resp, err := c.Mutate(ctx(), "POST", "/blocking/steps", nil, map[string]any{"name": args[0], "comment": comment})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return report(resp)
|
||||
},
|
||||
}
|
||||
add.Flags().StringVar(&comment, "comment", "", "comment")
|
||||
rename := &cobra.Command{
|
||||
Use: "rename STEP NEW-NAME",
|
||||
Short: "Rename a step",
|
||||
Args: cobra.ExactArgs(2),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c, err := newClient()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
resp, err := c.Mutate(ctx(), "PATCH", "/blocking/steps/"+url.PathEscape(args[0]), nil, map[string]any{"name": args[1]})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return report(resp)
|
||||
},
|
||||
}
|
||||
order := &cobra.Command{
|
||||
Use: "order STEP...",
|
||||
Short: "Set the order of the steps above normal, lowest first",
|
||||
Example: " jarl block step order strict very-strict",
|
||||
Args: cobra.MinimumNArgs(1),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c, err := newClient()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
resp, err := c.Mutate(ctx(), "POST", "/blocking/steps/order", nil, map[string]any{"steps": args})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return report(resp)
|
||||
},
|
||||
}
|
||||
del := &cobra.Command{
|
||||
Use: "delete STEP",
|
||||
Short: "Delete a step (refused while lists or groups use it)",
|
||||
Args: cobra.ExactArgs(1),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c, err := newClient()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
resp, err := c.Mutate(ctx(), "DELETE", "/blocking/steps/"+url.PathEscape(args[0]), nil, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return report(resp)
|
||||
},
|
||||
}
|
||||
cmd.AddCommand(list, add, rename, order, del)
|
||||
return cmd
|
||||
}
|
||||
|
||||
func blockGroupCmd() *cobra.Command {
|
||||
cmd := &cobra.Command{Use: "group", Aliases: []string{"groups"}, Short: "Client groups: blocking steps for some devices",
|
||||
Long: `A client group puts devices at a blocking step: off (only your rules),
|
||||
normal, or a step you added ('jarl block step'). Members are addresses,
|
||||
prefixes, or ACLs made of them. Devices not in a group are at normal.
|
||||
named must see the devices' own addresses (not a router forwarding for
|
||||
them), and they need fixed addresses (DHCP reservations).`}
|
||||
list := &cobra.Command{
|
||||
Use: "list",
|
||||
Short: "List client groups",
|
||||
Args: cobra.NoArgs,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c, err := newClient()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
var groups []api.ClientGroup
|
||||
if err := c.Get(ctx(), "/blocking/groups", nil, &groups); err != nil {
|
||||
return err
|
||||
}
|
||||
return output(groups, func(w io.Writer) {
|
||||
fmt.Fprintln(w, "GROUP\tSTEP\tMEMBERS\tVIEWS\tCOMMENT")
|
||||
for _, g := range groups {
|
||||
fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", g.Name, g.Step, orDash(strings.Join(g.Members, ", ")), viewsText(g.Views, g.AutoViews), g.Comment)
|
||||
}
|
||||
})
|
||||
},
|
||||
}
|
||||
var step, comment string
|
||||
var views []string
|
||||
add := &cobra.Command{
|
||||
Use: "add NAME MEMBER...",
|
||||
Short: "Add a client group",
|
||||
Example: ` jarl block group add work 10.10.0.20 --step off
|
||||
jarl block group add kids 10.10.0.50 10.10.0.51 2001:db8:1::/64 --step strict
|
||||
jarl block group add guests guest-net --step normal # an ACL`,
|
||||
Args: cobra.MinimumNArgs(1),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c, err := newClient()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
body := map[string]any{"name": args[0], "members": args[1:], "comment": comment}
|
||||
if step != "" {
|
||||
body["step"] = step
|
||||
}
|
||||
viewsBody(body, views)
|
||||
resp, err := c.Mutate(ctx(), "POST", "/blocking/groups", nil, body)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return report(resp)
|
||||
},
|
||||
}
|
||||
add.Flags().StringVar(&step, "step", "", "the group's step: off, normal (default) or one you added")
|
||||
add.Flags().StringArrayVar(&views, "view", nil, "a view it applies in (repeat for several; default: every view with blocking)")
|
||||
add.Flags().StringVar(&comment, "comment", "", "comment")
|
||||
var addM, removeM []string
|
||||
var rename string
|
||||
update := &cobra.Command{
|
||||
Use: "update GROUP",
|
||||
Short: "Change a group's members, step, name, views or comment",
|
||||
Example: ` jarl block group update kids --add 10.10.0.52 --remove 10.10.0.50
|
||||
jarl block group update kids --step very-strict`,
|
||||
Args: cobra.ExactArgs(1),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c, err := newClient()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
body := map[string]any{}
|
||||
f := cmd.Flags()
|
||||
if len(addM) > 0 || len(removeM) > 0 {
|
||||
var g api.ClientGroup
|
||||
var all []api.ClientGroup
|
||||
if err := c.Get(ctx(), "/blocking/groups", nil, &all); err != nil {
|
||||
return err
|
||||
}
|
||||
for _, x := range all {
|
||||
if x.Name == strings.ToLower(args[0]) {
|
||||
g = x
|
||||
}
|
||||
}
|
||||
if g.ID == 0 {
|
||||
return fmt.Errorf("client group %s not found", args[0])
|
||||
}
|
||||
drop := map[string]bool{}
|
||||
for _, m := range removeM {
|
||||
drop[m] = true
|
||||
}
|
||||
members := []string{}
|
||||
for _, m := range g.Members {
|
||||
if !drop[m] {
|
||||
members = append(members, m)
|
||||
}
|
||||
}
|
||||
body["members"] = append(members, addM...)
|
||||
}
|
||||
if f.Changed("step") {
|
||||
body["step"] = step
|
||||
}
|
||||
if f.Changed("name") {
|
||||
body["name"] = rename
|
||||
}
|
||||
if f.Changed("comment") {
|
||||
body["comment"] = comment
|
||||
}
|
||||
viewsBody(body, views)
|
||||
if len(body) == 0 {
|
||||
return fmt.Errorf("nothing to change (see --help)")
|
||||
}
|
||||
resp, err := c.Mutate(ctx(), "PATCH", "/blocking/groups/"+url.PathEscape(args[0]), nil, body)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return report(resp)
|
||||
},
|
||||
}
|
||||
update.Flags().StringArrayVar(&addM, "add", nil, "add a member (repeat for several)")
|
||||
update.Flags().StringArrayVar(&removeM, "remove", nil, "remove a member (repeat for several)")
|
||||
update.Flags().StringVar(&step, "step", "", "new step")
|
||||
update.Flags().StringVar(&rename, "name", "", "new name")
|
||||
update.Flags().StringArrayVar(&views, "view", nil, `a view it applies in (repeat; "auto": every view with blocking)`)
|
||||
update.Flags().StringVar(&comment, "comment", "", "new comment")
|
||||
del := &cobra.Command{
|
||||
Use: "delete GROUP",
|
||||
Short: "Delete a client group (its devices go back to normal)",
|
||||
Args: cobra.ExactArgs(1),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c, err := newClient()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
resp, err := c.Mutate(ctx(), "DELETE", "/blocking/groups/"+url.PathEscape(args[0]), nil, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return report(resp)
|
||||
},
|
||||
}
|
||||
cmd.AddCommand(list, add, update, del)
|
||||
return cmd
|
||||
}
|
||||
|
||||
func orDash(s string) string {
|
||||
if s == "" {
|
||||
return "-"
|
||||
}
|
||||
return s
|
||||
}
|
||||
Reference in new issue
Block a user