benvin
59e8320dda
Map the rendered hosts/providers/routes/routing_rules sections into native tomswall config (config.Host/Provider/StaticRoute/RoutingRule). The route's egress interface (oif) maps to StaticRoute.Device.
142 lines
7.1 KiB
Go
142 lines
7.1 KiB
Go
// Package agent implements `tomswall agent`: it pulls a device's compiled config
|
|
// from tomswallapi, differentially applies it, and reports the applied generation.
|
|
// It never fails closed — if the control plane is unreachable it keeps the last
|
|
// known-good config running.
|
|
package agent
|
|
|
|
// RenderedConfig is the per-device document served by tomswallapi at
|
|
// GET /api/v1/devices/{name}/config. It mirrors the control plane's compiler
|
|
// output: interface-agnostic, address-matched rules plus named sets.
|
|
type RenderedConfig struct {
|
|
Generation int64 `yaml:"generation" json:"generation"`
|
|
Device string `yaml:"device" json:"device"`
|
|
Class string `yaml:"class" json:"class"`
|
|
Enforcing bool `yaml:"enforcing" json:"enforcing"`
|
|
Settings RenderedSettings `yaml:"settings" json:"settings"`
|
|
Resolver []string `yaml:"resolver,omitempty" json:"resolver,omitempty"`
|
|
Bindings map[string][]string `yaml:"bindings,omitempty" json:"bindings,omitempty"` // zone -> interfaces
|
|
Sets []RenderedSet `yaml:"sets,omitempty" json:"sets,omitempty"`
|
|
Rules []RenderedRule `yaml:"rules,omitempty" json:"rules,omitempty"`
|
|
Policies []RenderedPolicy `yaml:"policies,omitempty" json:"policies,omitempty"`
|
|
SNAT []RenderedSNAT `yaml:"snat,omitempty" json:"snat,omitempty"`
|
|
Netmap []RenderedNetmap `yaml:"netmap,omitempty" json:"netmap,omitempty"`
|
|
NAT []RenderedNAT `yaml:"nat,omitempty" json:"nat,omitempty"`
|
|
Hosts []RenderedHost `yaml:"hosts,omitempty" json:"hosts,omitempty"`
|
|
Providers []RenderedProvider `yaml:"providers,omitempty" json:"providers,omitempty"`
|
|
Routes []RenderedRoute `yaml:"routes,omitempty" json:"routes,omitempty"`
|
|
RoutingRules []RenderedRoutingRule `yaml:"routing_rules,omitempty" json:"routing_rules,omitempty"`
|
|
}
|
|
|
|
type RenderedHost struct {
|
|
Zone string `yaml:"zone" json:"zone"`
|
|
Interface string `yaml:"interface" json:"interface"`
|
|
Addresses []string `yaml:"addresses,omitempty" json:"addresses,omitempty"`
|
|
Exclusions []string `yaml:"exclusions,omitempty" json:"exclusions,omitempty"`
|
|
Dynamic bool `yaml:"dynamic,omitempty" json:"dynamic,omitempty"`
|
|
}
|
|
|
|
type RenderedProvider struct {
|
|
Name string `yaml:"name" json:"name"`
|
|
Number int `yaml:"number" json:"number"`
|
|
Mark int `yaml:"mark,omitempty" json:"mark,omitempty"`
|
|
Duplicate string `yaml:"duplicate,omitempty" json:"duplicate,omitempty"`
|
|
Interface string `yaml:"interface" json:"interface"`
|
|
Gateway string `yaml:"gateway,omitempty" json:"gateway,omitempty"`
|
|
Copy []string `yaml:"copy,omitempty" json:"copy,omitempty"`
|
|
}
|
|
|
|
type RenderedRoute struct {
|
|
Provider string `yaml:"provider,omitempty" json:"provider,omitempty"`
|
|
Dest string `yaml:"dest" json:"dest"`
|
|
Gateway string `yaml:"gateway,omitempty" json:"gateway,omitempty"`
|
|
Oif string `yaml:"oif,omitempty" json:"oif,omitempty"`
|
|
Persistent bool `yaml:"persistent,omitempty" json:"persistent,omitempty"`
|
|
Comment string `yaml:"comment,omitempty" json:"comment,omitempty"`
|
|
}
|
|
|
|
type RenderedRoutingRule struct {
|
|
Source string `yaml:"source,omitempty" json:"source,omitempty"`
|
|
Dest string `yaml:"dest,omitempty" json:"dest,omitempty"`
|
|
Provider string `yaml:"provider" json:"provider"`
|
|
Priority int `yaml:"priority,omitempty" json:"priority,omitempty"`
|
|
Persistent bool `yaml:"persistent,omitempty" json:"persistent,omitempty"`
|
|
Mark string `yaml:"mark,omitempty" json:"mark,omitempty"`
|
|
Comment string `yaml:"comment,omitempty" json:"comment,omitempty"`
|
|
}
|
|
|
|
// RenderedSNAT is a resolved SNAT/masquerade rule (egress carries interface names).
|
|
type RenderedSNAT struct {
|
|
Action string `yaml:"action" json:"action"`
|
|
Source []string `yaml:"source,omitempty" json:"source,omitempty"`
|
|
Egress []string `yaml:"egress" json:"egress"`
|
|
Address string `yaml:"address,omitempty" json:"address,omitempty"`
|
|
Probability *float64 `yaml:"probability,omitempty" json:"probability,omitempty"`
|
|
Comment string `yaml:"comment,omitempty" json:"comment,omitempty"`
|
|
}
|
|
|
|
// RenderedNetmap is a resolved network-to-network mapping on one interface.
|
|
type RenderedNetmap struct {
|
|
Type string `yaml:"type" json:"type"`
|
|
FromNet string `yaml:"from_net" json:"from_net"`
|
|
ToNet string `yaml:"to_net" json:"to_net"`
|
|
Interface string `yaml:"interface,omitempty" json:"interface,omitempty"`
|
|
Comment string `yaml:"comment,omitempty" json:"comment,omitempty"`
|
|
}
|
|
|
|
// RenderedNAT is a resolved one-to-one static NAT on one interface.
|
|
type RenderedNAT struct {
|
|
External string `yaml:"external" json:"external"`
|
|
Internal string `yaml:"internal" json:"internal"`
|
|
Interface string `yaml:"interface,omitempty" json:"interface,omitempty"`
|
|
Comment string `yaml:"comment,omitempty" json:"comment,omitempty"`
|
|
}
|
|
|
|
type RenderedSettings struct {
|
|
AddressFamily string `yaml:"address_family" json:"address_family"`
|
|
LogLevel string `yaml:"log_level" json:"log_level"`
|
|
IPForwarding bool `yaml:"ip_forwarding" json:"ip_forwarding"`
|
|
TableName string `yaml:"table_name" json:"table_name"`
|
|
}
|
|
|
|
// RenderedSet is an address group's nftables set. Members carries the concrete
|
|
// elements the control plane knows (static CIDRs, expanded ASN prefixes); FQDNs
|
|
// are resolved on-device; ASNs are informational (already expanded into Members).
|
|
type RenderedSet struct {
|
|
Name string `yaml:"name" json:"name"`
|
|
Kind string `yaml:"kind" json:"kind"` // static | dns | asn
|
|
Members []string `yaml:"members,omitempty" json:"members,omitempty"`
|
|
FQDNs []string `yaml:"fqdns,omitempty" json:"fqdns,omitempty"`
|
|
ASNs []string `yaml:"asns,omitempty" json:"asns,omitempty"`
|
|
Refresh string `yaml:"refresh,omitempty" json:"refresh,omitempty"`
|
|
}
|
|
|
|
// RenderedMatch is one OR'd element of a rule direction: a zone's subnets AND,
|
|
// optionally, a named set to intersect with.
|
|
type RenderedMatch struct {
|
|
Zone string `yaml:"zone" json:"zone"`
|
|
Subnets []string `yaml:"subnets,omitempty" json:"subnets,omitempty"`
|
|
Set string `yaml:"set,omitempty" json:"set,omitempty"`
|
|
}
|
|
|
|
type RenderedRule struct {
|
|
Action string `yaml:"action" json:"action"`
|
|
Source []RenderedMatch `yaml:"source" json:"source"`
|
|
Dest []RenderedMatch `yaml:"dest" json:"dest"`
|
|
Proto string `yaml:"proto,omitempty" json:"proto,omitempty"`
|
|
Ports []string `yaml:"ports,omitempty" json:"ports,omitempty"`
|
|
Log string `yaml:"log,omitempty" json:"log,omitempty"`
|
|
Comment string `yaml:"comment,omitempty" json:"comment,omitempty"`
|
|
}
|
|
|
|
type RenderedPolicy struct {
|
|
Priority int `yaml:"priority" json:"priority"`
|
|
Source string `yaml:"source" json:"source"`
|
|
Dest string `yaml:"dest" json:"dest"`
|
|
Action string `yaml:"action" json:"action"`
|
|
Log string `yaml:"log,omitempty" json:"log,omitempty"`
|
|
}
|
|
|
|
// setMembers returns the concrete address elements for a set: static/asn use
|
|
// Members; dns is resolved separately and merged in before translation.
|
|
func (s RenderedSet) staticMembers() []string { return s.Members }
|