benvin
06928bc150
The agent now maps the rendered NAT sections into native tomswall config: - snat/masquerade -> config.SNAT, expanding a rendered rule's egress interface list and source CIDRs into one native rule per (egress, source) pair (a native SNAT rule takes a single dest interface); carries address/probability. - netmap -> config.Netmap (from_net/to_net -> net1/net2 on the resolved interface). - 1:1 nat -> config.StaticNAT. Unit-tested end to end from RenderedConfig to config.Config.
101 lines
4.9 KiB
Go
101 lines
4.9 KiB
Go
// Package agent implements `tomswall agent`: it pulls a device's compiled config
|
|
// from tomswallapi, differentially applies it, and reports the applied generation.
|
|
// It never fails closed — if the control plane is unreachable it keeps the last
|
|
// known-good config running.
|
|
package agent
|
|
|
|
// RenderedConfig is the per-device document served by tomswallapi at
|
|
// GET /api/v1/devices/{name}/config. It mirrors the control plane's compiler
|
|
// output: interface-agnostic, address-matched rules plus named sets.
|
|
type RenderedConfig struct {
|
|
Generation int64 `yaml:"generation" json:"generation"`
|
|
Device string `yaml:"device" json:"device"`
|
|
Class string `yaml:"class" json:"class"`
|
|
Enforcing bool `yaml:"enforcing" json:"enforcing"`
|
|
Settings RenderedSettings `yaml:"settings" json:"settings"`
|
|
Resolver []string `yaml:"resolver,omitempty" json:"resolver,omitempty"`
|
|
Bindings map[string][]string `yaml:"bindings,omitempty" json:"bindings,omitempty"` // zone -> interfaces
|
|
Sets []RenderedSet `yaml:"sets,omitempty" json:"sets,omitempty"`
|
|
Rules []RenderedRule `yaml:"rules,omitempty" json:"rules,omitempty"`
|
|
Policies []RenderedPolicy `yaml:"policies,omitempty" json:"policies,omitempty"`
|
|
SNAT []RenderedSNAT `yaml:"snat,omitempty" json:"snat,omitempty"`
|
|
Netmap []RenderedNetmap `yaml:"netmap,omitempty" json:"netmap,omitempty"`
|
|
NAT []RenderedNAT `yaml:"nat,omitempty" json:"nat,omitempty"`
|
|
}
|
|
|
|
// RenderedSNAT is a resolved SNAT/masquerade rule (egress carries interface names).
|
|
type RenderedSNAT struct {
|
|
Action string `yaml:"action" json:"action"`
|
|
Source []string `yaml:"source,omitempty" json:"source,omitempty"`
|
|
Egress []string `yaml:"egress" json:"egress"`
|
|
Address string `yaml:"address,omitempty" json:"address,omitempty"`
|
|
Probability *float64 `yaml:"probability,omitempty" json:"probability,omitempty"`
|
|
Comment string `yaml:"comment,omitempty" json:"comment,omitempty"`
|
|
}
|
|
|
|
// RenderedNetmap is a resolved network-to-network mapping on one interface.
|
|
type RenderedNetmap struct {
|
|
Type string `yaml:"type" json:"type"`
|
|
FromNet string `yaml:"from_net" json:"from_net"`
|
|
ToNet string `yaml:"to_net" json:"to_net"`
|
|
Interface string `yaml:"interface,omitempty" json:"interface,omitempty"`
|
|
Comment string `yaml:"comment,omitempty" json:"comment,omitempty"`
|
|
}
|
|
|
|
// RenderedNAT is a resolved one-to-one static NAT on one interface.
|
|
type RenderedNAT struct {
|
|
External string `yaml:"external" json:"external"`
|
|
Internal string `yaml:"internal" json:"internal"`
|
|
Interface string `yaml:"interface,omitempty" json:"interface,omitempty"`
|
|
Comment string `yaml:"comment,omitempty" json:"comment,omitempty"`
|
|
}
|
|
|
|
type RenderedSettings struct {
|
|
AddressFamily string `yaml:"address_family" json:"address_family"`
|
|
LogLevel string `yaml:"log_level" json:"log_level"`
|
|
IPForwarding bool `yaml:"ip_forwarding" json:"ip_forwarding"`
|
|
TableName string `yaml:"table_name" json:"table_name"`
|
|
}
|
|
|
|
// RenderedSet is an address group's nftables set. Members carries the concrete
|
|
// elements the control plane knows (static CIDRs, expanded ASN prefixes); FQDNs
|
|
// are resolved on-device; ASNs are informational (already expanded into Members).
|
|
type RenderedSet struct {
|
|
Name string `yaml:"name" json:"name"`
|
|
Kind string `yaml:"kind" json:"kind"` // static | dns | asn
|
|
Members []string `yaml:"members,omitempty" json:"members,omitempty"`
|
|
FQDNs []string `yaml:"fqdns,omitempty" json:"fqdns,omitempty"`
|
|
ASNs []string `yaml:"asns,omitempty" json:"asns,omitempty"`
|
|
Refresh string `yaml:"refresh,omitempty" json:"refresh,omitempty"`
|
|
}
|
|
|
|
// RenderedMatch is one OR'd element of a rule direction: a zone's subnets AND,
|
|
// optionally, a named set to intersect with.
|
|
type RenderedMatch struct {
|
|
Zone string `yaml:"zone" json:"zone"`
|
|
Subnets []string `yaml:"subnets,omitempty" json:"subnets,omitempty"`
|
|
Set string `yaml:"set,omitempty" json:"set,omitempty"`
|
|
}
|
|
|
|
type RenderedRule struct {
|
|
Action string `yaml:"action" json:"action"`
|
|
Source []RenderedMatch `yaml:"source" json:"source"`
|
|
Dest []RenderedMatch `yaml:"dest" json:"dest"`
|
|
Proto string `yaml:"proto,omitempty" json:"proto,omitempty"`
|
|
Ports []string `yaml:"ports,omitempty" json:"ports,omitempty"`
|
|
Log string `yaml:"log,omitempty" json:"log,omitempty"`
|
|
Comment string `yaml:"comment,omitempty" json:"comment,omitempty"`
|
|
}
|
|
|
|
type RenderedPolicy struct {
|
|
Priority int `yaml:"priority" json:"priority"`
|
|
Source string `yaml:"source" json:"source"`
|
|
Dest string `yaml:"dest" json:"dest"`
|
|
Action string `yaml:"action" json:"action"`
|
|
Log string `yaml:"log,omitempty" json:"log,omitempty"`
|
|
}
|
|
|
|
// setMembers returns the concrete address elements for a set: static/asn use
|
|
// Members; dns is resolved separately and merged in before translation.
|
|
func (s RenderedSet) staticMembers() []string { return s.Members }
|