Add per-device config compiler and agent config endpoint
Project the fleet-global model through a device's bindings into a rendered,
interface-agnostic config: rules compile to saddr/daddr forward matches with no
iif/oif so they are correct under FRR/ECMP. Firewalls always enforce; routers
enforce only when their fabric opts into defense-in-depth. Referenced address
groups are emitted as named sets carrying their source (static CIDRs, dns FQDNs,
or asn numbers) so membership churns out-of-band without a rule reload. Wire
GET /devices/{name}/config to compile and serve YAML, generation-stamped. Add
portgroups/policies/settings store methods and portgroup CRUD. Pure Render is
unit-tested for enforcement gating, ASN set emission, and resolver precedence.
This commit is contained in:
benvin
@@ -0,0 +1,313 @@
|
||||
// Package compiler projects the fleet-global model through a device's binding
|
||||
// table into a rendered, interface-agnostic config the tomswall agent applies.
|
||||
//
|
||||
// Rules are compiled to address-matched (saddr/daddr) forward rules with no
|
||||
// iif/oif, which is what makes them correct under FRR/ECMP: any device on any
|
||||
// path permits the 5-tuple and each device's own conntrack handles the return.
|
||||
// Firewalls always enforce; routers enforce only when their fabric opts in.
|
||||
package compiler
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"sort"
|
||||
|
||||
"gopkg.in/yaml.v3"
|
||||
|
||||
"git.unkin.net/unkin/tomswallapi/internal/model"
|
||||
"git.unkin.net/unkin/tomswallapi/internal/store"
|
||||
)
|
||||
|
||||
// Input is the fully-resolved model needed to render one device. Keeping Render
|
||||
// pure (no store access) makes it unit-testable without a database.
|
||||
type Input struct {
|
||||
Generation int64
|
||||
Settings model.Settings
|
||||
Device model.Device
|
||||
Fabric *model.Fabric
|
||||
Zones map[string]model.Zone
|
||||
Groups map[string]model.AddressGroup
|
||||
PortGroups map[string]model.PortGroup
|
||||
Rules []model.Rule
|
||||
Policies []model.Policy
|
||||
Bindings []model.Binding
|
||||
}
|
||||
|
||||
// RenderedConfig is the per-device output served to the agent.
|
||||
type RenderedConfig struct {
|
||||
Generation int64 `yaml:"generation" json:"generation"`
|
||||
Device string `yaml:"device" json:"device"`
|
||||
Class model.DeviceClass `yaml:"class" json:"class"`
|
||||
Enforcing bool `yaml:"enforcing" json:"enforcing"`
|
||||
Settings RenderedSettings `yaml:"settings" json:"settings"`
|
||||
Resolver []string `yaml:"resolver,omitempty" json:"resolver,omitempty"`
|
||||
Bindings map[string][]string `yaml:"bindings,omitempty" json:"bindings,omitempty"` // zone -> interfaces
|
||||
Sets []RenderedSet `yaml:"sets,omitempty" json:"sets,omitempty"`
|
||||
Rules []RenderedRule `yaml:"rules,omitempty" json:"rules,omitempty"`
|
||||
Policies []model.Policy `yaml:"policies,omitempty" json:"policies,omitempty"`
|
||||
}
|
||||
|
||||
// RenderedSettings is the effective settings after per-device overrides.
|
||||
type RenderedSettings struct {
|
||||
AddressFamily string `yaml:"address_family" json:"address_family"`
|
||||
LogLevel string `yaml:"log_level" json:"log_level"`
|
||||
IPForwarding bool `yaml:"ip_forwarding" json:"ip_forwarding"`
|
||||
TableName string `yaml:"table_name" json:"table_name"`
|
||||
}
|
||||
|
||||
// RenderedSet is an nftables named set the agent must materialize. Members carry
|
||||
// the concrete elements when the API knows them (static, or asn once expanded);
|
||||
// dns and unexpanded asn sets carry their source so the agent/expander can
|
||||
// populate them out-of-band without a rule reload.
|
||||
type RenderedSet struct {
|
||||
Name string `yaml:"name" json:"name"`
|
||||
Kind model.AddressGroupType `yaml:"kind" json:"kind"`
|
||||
Members []string `yaml:"members,omitempty" json:"members,omitempty"` // static CIDRs / expanded prefixes
|
||||
FQDNs []string `yaml:"fqdns,omitempty" json:"fqdns,omitempty"` // dns: names to resolve on-device
|
||||
ASNs []string `yaml:"asns,omitempty" json:"asns,omitempty"` // asn: source ASNs
|
||||
Refresh string `yaml:"refresh,omitempty" json:"refresh,omitempty"`
|
||||
}
|
||||
|
||||
// RenderedMatch is one OR'd element of a rule direction: the zone's subnets
|
||||
// AND, optionally, a named set to intersect with.
|
||||
type RenderedMatch struct {
|
||||
Zone string `yaml:"zone" json:"zone"`
|
||||
Subnets []string `yaml:"subnets,omitempty" json:"subnets,omitempty"`
|
||||
Set string `yaml:"set,omitempty" json:"set,omitempty"`
|
||||
}
|
||||
|
||||
// RenderedRule is an interface-agnostic forward rule.
|
||||
type RenderedRule struct {
|
||||
Action string `yaml:"action" json:"action"`
|
||||
Source []RenderedMatch `yaml:"source" json:"source"`
|
||||
Dest []RenderedMatch `yaml:"dest" json:"dest"`
|
||||
Proto string `yaml:"proto,omitempty" json:"proto,omitempty"`
|
||||
Ports []string `yaml:"ports,omitempty" json:"ports,omitempty"`
|
||||
Log string `yaml:"log,omitempty" json:"log,omitempty"`
|
||||
Comment string `yaml:"comment,omitempty" json:"comment,omitempty"`
|
||||
}
|
||||
|
||||
// Marshal serializes the rendered config to YAML.
|
||||
func (c *RenderedConfig) Marshal() ([]byte, error) { return yaml.Marshal(c) }
|
||||
|
||||
// enforces reports whether the device applies rules: firewalls always do; routers
|
||||
// only when their fabric opts into defense-in-depth.
|
||||
func enforces(dev model.Device, fabric *model.Fabric) bool {
|
||||
if dev.Class == model.ClassFirewall {
|
||||
return true
|
||||
}
|
||||
return dev.Class == model.ClassRouter && fabric != nil && fabric.EnforceOnRouters
|
||||
}
|
||||
|
||||
// setNameFor resolves a rule's selector reference (as written after + or &) to a
|
||||
// concrete nft set name. A reference may be a group's bare name or its computed
|
||||
// set name (e.g. an asn group "cloudflare" whose set is "asn_cloudflare").
|
||||
func setNameFor(groups map[string]model.AddressGroup, ref string) (model.AddressGroup, bool) {
|
||||
if g, ok := groups[ref]; ok {
|
||||
return g, true
|
||||
}
|
||||
for _, g := range groups {
|
||||
if g.SetName() == ref {
|
||||
return g, true
|
||||
}
|
||||
}
|
||||
return model.AddressGroup{}, false
|
||||
}
|
||||
|
||||
// Render projects the model into a device config. It is pure and deterministic.
|
||||
func Render(in Input) (*RenderedConfig, error) {
|
||||
out := &RenderedConfig{
|
||||
Generation: in.Generation,
|
||||
Device: in.Device.Name,
|
||||
Class: in.Device.Class,
|
||||
Enforcing: enforces(in.Device, in.Fabric),
|
||||
Settings: renderSettings(in),
|
||||
Resolver: effectiveResolver(in),
|
||||
Bindings: map[string][]string{},
|
||||
}
|
||||
for _, b := range in.Bindings {
|
||||
out.Bindings[b.Zone] = b.Interfaces
|
||||
}
|
||||
|
||||
usedSets := map[string]model.AddressGroup{}
|
||||
|
||||
if out.Enforcing {
|
||||
for _, rule := range in.Rules {
|
||||
rr, err := renderRule(in, rule, usedSets)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("rule %d: %w", rule.ID, err)
|
||||
}
|
||||
out.Rules = append(out.Rules, rr)
|
||||
}
|
||||
out.Policies = in.Policies
|
||||
}
|
||||
|
||||
// Emit a set definition for every address group any rule referenced.
|
||||
names := make([]string, 0, len(usedSets))
|
||||
for n := range usedSets {
|
||||
names = append(names, n)
|
||||
}
|
||||
sort.Strings(names)
|
||||
for _, n := range names {
|
||||
out.Sets = append(out.Sets, renderSet(usedSets[n]))
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func renderSettings(in Input) RenderedSettings {
|
||||
s := RenderedSettings{
|
||||
AddressFamily: in.Settings.AddressFamily,
|
||||
LogLevel: in.Settings.LogLevel,
|
||||
IPForwarding: in.Settings.IPForwarding,
|
||||
TableName: in.Settings.TableName,
|
||||
}
|
||||
// Per-device string overrides.
|
||||
if v, ok := in.Device.Settings["address_family"]; ok {
|
||||
s.AddressFamily = v
|
||||
}
|
||||
if v, ok := in.Device.Settings["log_level"]; ok {
|
||||
s.LogLevel = v
|
||||
}
|
||||
if v, ok := in.Device.Settings["table_name"]; ok {
|
||||
s.TableName = v
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
func effectiveResolver(in Input) []string {
|
||||
if len(in.Device.Resolver) > 0 {
|
||||
return in.Device.Resolver
|
||||
}
|
||||
return in.Settings.DefaultResolver
|
||||
}
|
||||
|
||||
func renderRule(in Input, rule model.Rule, usedSets map[string]model.AddressGroup) (RenderedRule, error) {
|
||||
src, err := renderMatches(in, rule.Source, usedSets)
|
||||
if err != nil {
|
||||
return RenderedRule{}, fmt.Errorf("source: %w", err)
|
||||
}
|
||||
dst, err := renderMatches(in, rule.Dest, usedSets)
|
||||
if err != nil {
|
||||
return RenderedRule{}, fmt.Errorf("dest: %w", err)
|
||||
}
|
||||
proto, ports := resolvePorts(in, rule)
|
||||
return RenderedRule{
|
||||
Action: rule.Action,
|
||||
Source: src,
|
||||
Dest: dst,
|
||||
Proto: proto,
|
||||
Ports: ports,
|
||||
Log: rule.Log,
|
||||
Comment: rule.Comment,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func renderMatches(in Input, list []string, usedSets map[string]model.AddressGroup) ([]RenderedMatch, error) {
|
||||
elems, err := model.ParseElements(list)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out := make([]RenderedMatch, 0, len(elems))
|
||||
for _, e := range elems {
|
||||
m := RenderedMatch{Zone: e.Zone}
|
||||
if z, ok := in.Zones[e.Zone]; ok {
|
||||
m.Subnets = z.Subnets
|
||||
}
|
||||
if e.Selector != model.SelNone {
|
||||
g, ok := setNameFor(in.Groups, e.Ref)
|
||||
if !ok {
|
||||
return nil, fmt.Errorf("unknown address group %q", e.Ref)
|
||||
}
|
||||
m.Set = g.SetName()
|
||||
usedSets[g.SetName()] = g
|
||||
}
|
||||
out = append(out, m)
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func resolvePorts(in Input, rule model.Rule) (proto string, ports []string) {
|
||||
if rule.PortGroup != "" {
|
||||
if pg, ok := in.PortGroups[rule.PortGroup]; ok {
|
||||
return pg.Proto, pg.Ports
|
||||
}
|
||||
}
|
||||
return rule.Proto, rule.Ports
|
||||
}
|
||||
|
||||
func renderSet(g model.AddressGroup) RenderedSet {
|
||||
rs := RenderedSet{Name: g.SetName(), Kind: g.Type, Refresh: g.Refresh}
|
||||
switch g.Type {
|
||||
case model.GroupStatic:
|
||||
rs.Members = g.Members
|
||||
case model.GroupDNS:
|
||||
rs.FQDNs = g.Members
|
||||
case model.GroupASN:
|
||||
rs.ASNs = g.Members // expanded prefixes are attached out-of-band by the ASN expander
|
||||
}
|
||||
return rs
|
||||
}
|
||||
|
||||
// Compile fetches the model for a device from the store and renders its config.
|
||||
func Compile(ctx context.Context, s *store.Store, device string) (*RenderedConfig, error) {
|
||||
dev, err := s.GetDevice(ctx, device)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
gen, err := s.Generation(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
settings, err := s.GetSettings(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
in := Input{Generation: gen, Settings: settings, Device: dev}
|
||||
|
||||
if dev.Fabric != "" {
|
||||
f, err := s.GetFabric(ctx, dev.Fabric)
|
||||
if err == nil {
|
||||
in.Fabric = &f
|
||||
} else if err != store.ErrNotFound {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
zones, err := s.ListZones(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
in.Zones = make(map[string]model.Zone, len(zones))
|
||||
for _, z := range zones {
|
||||
in.Zones[z.Name] = z
|
||||
}
|
||||
|
||||
groups, err := s.ListAddressGroups(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
in.Groups = make(map[string]model.AddressGroup, len(groups))
|
||||
for _, g := range groups {
|
||||
in.Groups[g.Name] = g
|
||||
}
|
||||
|
||||
pgs, err := s.ListPortGroups(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
in.PortGroups = make(map[string]model.PortGroup, len(pgs))
|
||||
for _, p := range pgs {
|
||||
in.PortGroups[p.Name] = p
|
||||
}
|
||||
|
||||
if in.Rules, err = s.ListRules(ctx); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if in.Policies, err = s.ListPolicies(ctx); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if in.Bindings, err = s.ListBindings(ctx, device); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return Render(in)
|
||||
}
|
||||
Reference in New Issue
Block a user