kor-elf-shield/kor-elf-shield
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 11 Wiki Activity

Refactor: move firewall-related configurations to new config package and update references

Browse Source
This commit is contained in:
Leonid Nikitin
2026-04-27 22:07:02 +05:00
parent d2f3640b75
commit a1345bd3e1
14 changed files with 85 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/daemon/firewall/config.go → internal/daemon/firewall/config/config.go
+1 -1
View File
@@ -1,4 +1,4 @@
package firewall
package config
import (
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/types"
internal/daemon/firewall/firewall.go
+6 -5
View File
@@ -9,6 +9,7 @@ import (
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/docker_monitor"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/blocking"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/chain"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/log"
nftables "git.kor-elf.net/kor-elf-shield/go-nftables-client"
@@ -47,7 +48,7 @@ type API interface {
type firewall struct {
nft nft.NFT
logger log.Logger
config *Config
config *config.Config
blockingService blocking.API
chains chain.Chains
docker docker_monitor.Docker
@@ -58,7 +59,7 @@ func New(
pathNFT string,
blockingService blocking.API,
logger log.Logger,
config Config,
config config.Config,
docker docker_monitor.Docker,
blocklist blocklist.Blocklist,
) (API, error) {
@@ -79,7 +80,7 @@ func New(
func (f *firewall) Reload() error {
f.logger.Debug("Reload nftables rules")
if f.config.Options.ClearMode == ClearModeGlobal {
if f.config.Options.ClearMode == config.ClearModeGlobal {
if err := f.nft.Clear(); err != nil {
return err
}
@@ -129,12 +130,12 @@ func (f *firewall) ClearRules() {
f.logger.Debug("Clear nftables rules")
switch f.config.Options.ClearMode {
case ClearModeGlobal:
case config.ClearModeGlobal:
if err := f.nft.Clear(); err != nil {
f.logger.Error(fmt.Sprintf("Failed to clear rules: %s", err))
}
break
case ClearModeOwn:
case config.ClearModeOwn:
if err := f.chains.ClearRules(); err != nil {
f.logger.Error(fmt.Sprintf("Failed to clear rules: %s", err))
}
internal/daemon/firewall/reload_forward.go
+5 -2
View File
@@ -1,6 +1,9 @@
package firewall
import "git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/types"
import (
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/types"
)
func (f *firewall) reloadForward() error {
f.logger.Debug("Reloading forward chain")
@@ -64,7 +67,7 @@ func (f *firewall) reloadForwardAddIPs() error {
return nil
}
func forwardAddIP(addRuleFunc func(expr ...string) error, config ConfigIP, ipMatch string) error {
func forwardAddIP(addRuleFunc func(expr ...string) error, config config.ConfigIP, ipMatch string) error {
rule := ipMatch + " saddr " + config.IP + " iifname != \"lo\""
// There, during routing, the port changes and then the IP blocking rule will not work.
internal/daemon/firewall/reload_input.go
+2 -1
View File
@@ -5,6 +5,7 @@ import (
"net"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/chain"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/pkg"
)
@@ -313,7 +314,7 @@ func (f *firewall) reloadPortKnocking(chain chain.LocalInput) error {
return nil
}
func inputAddIP(addRuleFunc func(expr ...string) error, config ConfigIP, ipMatch string) error {
func inputAddIP(addRuleFunc func(expr ...string) error, config config.ConfigIP, ipMatch string) error {
rule := ipMatch + " saddr " + config.IP + " iifname != \"lo\""
if !config.OnlyIP {
internal/daemon/firewall/reload_output.go
+2 -1
View File
@@ -4,6 +4,7 @@ import (
"fmt"
"net"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/pkg"
)
@@ -226,7 +227,7 @@ func (f *firewall) reloadOutputAddIPs() error {
return nil
}
func outputAddIP(addRuleFunc func(expr ...string) error, config ConfigIP, ipMatch string) error {
func outputAddIP(addRuleFunc func(expr ...string) error, config config.ConfigIP, ipMatch string) error {
rule := ipMatch + " daddr " + config.IP + " oifname != \"lo\""
if !config.OnlyIP {
internal/daemon/options.go
+4 -4
View File
@@ -1,9 +1,9 @@
package daemon
import (
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/analyzer/config"
analyzerConfig "git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/analyzer/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/db"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall"
firewallConfig "git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
)
type DaemonOptions struct {
@@ -11,7 +11,7 @@ type DaemonOptions struct {
PathSocketFile string
DataDir string
PathNftables string
ConfigFirewall firewall.Config
ConfigAnalyzer config.Config
ConfigFirewall firewallConfig.Config
ConfigAnalyzer analyzerConfig.Config
Repositories db.Repositories
}
internal/setting/firewall/firewall.go
+4 -4
View File
@@ -3,7 +3,7 @@ package firewall
import (
"fmt"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/setting/validate"
"github.com/spf13/viper"
)
@@ -75,7 +75,7 @@ func (s Setting) Validate() error {
return nil
}
func (s Setting) ToPorts() (InPorts []firewall.ConfigPort, OutPorts []firewall.ConfigPort, error error) {
func (s Setting) ToPorts() (InPorts []config.ConfigPort, OutPorts []config.ConfigPort, error error) {
for _, port := range s.Ports {
addInPorts, addOutPorts, err := port.ToPorts()
if err != nil {
@@ -106,8 +106,8 @@ func (s Setting) ToIPs() (IPs IPs, error error) {
return
}
func (s Setting) ToConfigPortKnocking() ([]firewall.ConfigPortKnocking, error) {
var configPortKnocking []firewall.ConfigPortKnocking
func (s Setting) ToConfigPortKnocking() ([]config.ConfigPortKnocking, error) {
var configPortKnocking []config.ConfigPortKnocking
portKnockingNames := make(map[string]string)
internal/setting/firewall/ip.go
+9 -9
View File
@@ -3,7 +3,7 @@ package firewall
import (
"errors"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/types"
port2 "git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/pkg/ip"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/setting/validate"
@@ -23,11 +23,11 @@ func defaultIPs() []IP {
}
type IPs struct {
InIP4 []firewall.ConfigIP
OutIP4 []firewall.ConfigIP
InIP4 []config.ConfigIP
OutIP4 []config.ConfigIP
InIP6 []firewall.ConfigIP
OutIP6 []firewall.ConfigIP
InIP6 []config.ConfigIP
OutIP6 []config.ConfigIP
}
func (i *IP) ToIPs() (IPs IPs, error error) {
@@ -48,7 +48,7 @@ func (i *IP) ToIPs() (IPs IPs, error error) {
return
}
baseConfigIP := firewall.ConfigIP{
baseConfigIP := config.ConfigIP{
IP: ipNet,
Action: action,
LimitRate: i.LimitRate,
@@ -89,7 +89,7 @@ func (i *IP) validate() error {
return nil
}
func loopIP(baseConfigIP firewall.ConfigIP, directions []string, protocols []string, ports []int) (in []firewall.ConfigIP, out []firewall.ConfigIP, error error) {
func loopIP(baseConfigIP config.ConfigIP, directions []string, protocols []string, ports []int) (in []config.ConfigIP, out []config.ConfigIP, error error) {
for _, direction := range directions {
addDirection, err := port2.ToDirection(direction)
if err != nil {
@@ -136,7 +136,7 @@ func loopIP(baseConfigIP firewall.ConfigIP, directions []string, protocols []str
return
}
func loopIPProtocol(baseConfigIP firewall.ConfigIP, protocols []string, ports []int, direction types.Direction) (in []firewall.ConfigIP, out []firewall.ConfigIP, error error) {
func loopIPProtocol(baseConfigIP config.ConfigIP, protocols []string, ports []int, direction types.Direction) (in []config.ConfigIP, out []config.ConfigIP, error error) {
for _, protocol := range protocols {
addProtocol, err := port2.ToProtocol(protocol)
if err != nil {
@@ -169,7 +169,7 @@ func loopIPProtocol(baseConfigIP firewall.ConfigIP, protocols []string, ports []
return
}
func loopIPPort(baseConfigIP firewall.ConfigIP, ports []int, direction types.Direction, protocol types.Protocol) (in []firewall.ConfigIP, out []firewall.ConfigIP, error error) {
func loopIPPort(baseConfigIP config.ConfigIP, ports []int, direction types.Direction, protocol types.Protocol) (in []config.ConfigIP, out []config.ConfigIP, error error) {
for _, port := range ports {
if err := validate.Port(port, "port"); err != nil {
error = err
internal/setting/firewall/options.go
+5 -5
View File
@@ -4,7 +4,7 @@ import (
"errors"
"strings"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/setting/validate"
)
@@ -49,13 +49,13 @@ func (o options) ValidateSavesRulesPath() error {
return nil
}
func (o options) ToClearMode() (firewall.ClearMode, error) {
func (o options) ToClearMode() (config.ClearMode, error) {
switch o.ClearMode {
case "global":
return firewall.ClearModeGlobal, nil
return config.ClearModeGlobal, nil
case "own":
return firewall.ClearModeOwn, nil
return config.ClearModeOwn, nil
}
return firewall.ClearModeGlobal, errors.New("invalid option clear_mode. Must be 'global' or 'own'")
return config.ClearModeGlobal, errors.New("invalid option clear_mode. Must be 'global' or 'own'")
}
internal/setting/firewall/policy.go
+6 -6
View File
@@ -3,7 +3,7 @@ package firewall
import (
"fmt"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/types"
)
@@ -33,23 +33,23 @@ func defaultPolicy() policy {
}
}
func (p policy) ToConfigPolicy() (firewall.ConfigPolicy, error) {
func (p policy) ToConfigPolicy() (config.ConfigPolicy, error) {
inputDrop, err := p.dropToPolicyDrop(p.InputDrop, "input_drop")
if err != nil {
return firewall.ConfigPolicy{}, err
return config.ConfigPolicy{}, err
}
outputDrop, err := p.dropToPolicyDrop(p.OutputDrop, "output_drop")
if err != nil {
return firewall.ConfigPolicy{}, err
return config.ConfigPolicy{}, err
}
forwardDrop, err := p.dropToPolicyDrop(p.ForwardDrop, "forward_drop")
if err != nil {
return firewall.ConfigPolicy{}, err
return config.ConfigPolicy{}, err
}
return firewall.ConfigPolicy{
return config.ConfigPolicy{
DefaultAllowInput: p.DefaultAllowInput,
DefaultAllowOutput: p.DefaultAllowOutput,
DefaultAllowForward: p.DefaultAllowForward,
internal/setting/firewall/port.go
+3 -3
View File
@@ -3,7 +3,7 @@ package firewall
import (
"errors"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/types"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/pkg/ip"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/setting/validate"
@@ -21,7 +21,7 @@ func defaultPorts() []Port {
return []Port{}
}
func (p *Port) ToPorts() (InPorts []firewall.ConfigPort, OutPorts []firewall.ConfigPort, error error) {
func (p *Port) ToPorts() (InPorts []config.ConfigPort, OutPorts []config.ConfigPort, error error) {
if err := p.validate(); err != nil {
error = err
return
@@ -56,7 +56,7 @@ func (p *Port) ToPorts() (InPorts []firewall.ConfigPort, OutPorts []firewall.Con
return
}
addPort := firewall.ConfigPort{
addPort := config.ConfigPort{
Port: l4Port,
Action: action,
LimitRate: p.LimitRate,
internal/setting/firewall/port_knocking.go
+10 -10
View File
@@ -4,7 +4,7 @@ import (
"fmt"
"strings"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/types"
port2 "git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/pkg/ip"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/setting/validate"
@@ -22,40 +22,40 @@ func defaultPortKnocking() []portKnocking {
return []portKnocking{}
}
func (p *portKnocking) ToPortKnocking() (firewall.ConfigPortKnocking, error) {
func (p *portKnocking) ToPortKnocking() (config.ConfigPortKnocking, error) {
if len(p.Knocks) == 0 {
return firewall.ConfigPortKnocking{}, fmt.Errorf("port knocking must have at least one knock")
return config.ConfigPortKnocking{}, fmt.Errorf("port knocking must have at least one knock")
}
if err := p.validate(); err != nil {
return firewall.ConfigPortKnocking{}, err
return config.ConfigPortKnocking{}, err
}
protocol, err := port2.ToProtocol(p.Protocol)
if err != nil {
return firewall.ConfigPortKnocking{}, err
return config.ConfigPortKnocking{}, err
}
l4Port, err := types.NewL4Port(uint16(p.Port), protocol)
if err != nil {
return firewall.ConfigPortKnocking{}, err
return config.ConfigPortKnocking{}, err
}
ipVersion, err := toVersionIP(p.IPVersion)
if err != nil {
return firewall.ConfigPortKnocking{}, err
return config.ConfigPortKnocking{}, err
}
knocks := make([]*firewall.ConfigKnock, 0, len(p.Knocks))
knocks := make([]*config.ConfigKnock, 0, len(p.Knocks))
for _, knock := range p.Knocks {
knock, err := knock.ToKnock()
if err != nil {
return firewall.ConfigPortKnocking{}, err
return config.ConfigPortKnocking{}, err
}
knocks = append(knocks, &knock)
}
return firewall.ConfigPortKnocking{
return config.ConfigPortKnocking{
Name: p.Name,
Port: l4Port,
IPVersion: ipVersion,
internal/setting/firewall/port_knocking_knock.go
+7 -7
View File
@@ -3,7 +3,7 @@ package firewall
import (
"fmt"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/types"
port2 "git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/pkg/ip"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/setting/validate"
@@ -16,26 +16,26 @@ type portKnockingKnock struct {
Action string `mapstructure:"action"`
}
func (k *portKnockingKnock) ToKnock() (firewall.ConfigKnock, error) {
func (k *portKnockingKnock) ToKnock() (config.ConfigKnock, error) {
if err := k.validate(); err != nil {
return firewall.ConfigKnock{}, err
return config.ConfigKnock{}, err
}
protocol, err := port2.ToProtocol(k.Protocol)
if err != nil {
return firewall.ConfigKnock{}, err
return config.ConfigKnock{}, err
}
l4Port, err := types.NewL4Port(uint16(k.Port), protocol)
if err != nil {
return firewall.ConfigKnock{}, err
return config.ConfigKnock{}, err
}
action, err := port2.ToKnockAction(k.Action)
if err != nil {
return firewall.ConfigKnock{}, err
return config.ConfigKnock{}, err
}
return firewall.ConfigKnock{
return config.ConfigKnock{
Port: l4Port,
Action: action,
Timeout: uint32(k.Timeout),
internal/setting/other_settings_path.go
+21 -21
View File
@@ -3,10 +3,10 @@ package setting
import (
"errors"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/analyzer/config"
analyzerConfig "git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/analyzer/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/blocklist"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/docker_monitor"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall"
firewallConfig "git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/firewall/config"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/geoip"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/daemon/notifications"
"git.kor-elf.net/kor-elf-shield/kor-elf-shield/internal/i18n"
@@ -42,41 +42,41 @@ func otherSettingsPathDefault() *otherSettingsPath {
}
}
func (o *otherSettingsPath) ToFirewallConfig(dockerSupport bool) (firewall.Config, error) {
func (o *otherSettingsPath) ToFirewallConfig(dockerSupport bool) (firewallConfig.Config, error) {
setting, err := firewallSetting.InitSetting(o.Firewall)
if err != nil {
return firewall.Config{}, err
return firewallConfig.Config{}, err
}
configPolicy, err := setting.Policy.ToConfigPolicy()
if err != nil {
return firewall.Config{}, err
return firewallConfig.Config{}, err
}
inPorts, outPorts, err := setting.ToPorts()
if err != nil {
return firewall.Config{}, err
return firewallConfig.Config{}, err
}
IPs, err := setting.ToIPs()
if err != nil {
return firewall.Config{}, err
return firewallConfig.Config{}, err
}
optionClearMode, err := setting.Options.ToClearMode()
if err != nil {
return firewall.Config{}, err
return firewallConfig.Config{}, err
}
portKnocking, err := setting.ToConfigPortKnocking()
if err != nil {
return firewall.Config{}, err
return firewallConfig.Config{}, err
}
return firewall.Config{
return firewallConfig.Config{
InPorts: inPorts,
OutPorts: outPorts,
IP4: firewall.ConfigIP4{
IP4: firewallConfig.ConfigIP4{
IcmpIn: setting.IP4.IcmpIn,
IcmpInRate: setting.IP4.IcmpInRate,
IcmpOut: setting.IP4.IcmpOut,
@@ -85,13 +85,13 @@ func (o *otherSettingsPath) ToFirewallConfig(dockerSupport bool) (firewall.Confi
InIPs: IPs.InIP4,
OutIPs: IPs.OutIP4,
},
IP6: firewall.ConfigIP6{
IP6: firewallConfig.ConfigIP6{
Enable: setting.IP6.Enable,
IcmpStrict: setting.IP6.IcmpStrict,
InIPs: IPs.InIP6,
OutIPs: IPs.OutIP6,
},
Options: firewall.ConfigOptions{
Options: firewallConfig.ConfigOptions{
ClearMode: optionClearMode,
SavesRules: setting.Options.SavesRules,
SavesRulesPath: setting.Options.SavesRulesPath,
@@ -100,7 +100,7 @@ func (o *otherSettingsPath) ToFirewallConfig(dockerSupport bool) (firewall.Confi
PacketFilter: setting.Options.PacketFilter,
DockerSupport: dockerSupport,
},
MetadataNaming: firewall.ConfigMetadata{
MetadataNaming: firewallConfig.ConfigMetadata{
TableName: setting.MetadataNaming.TableName,
ChainInputName: setting.MetadataNaming.ChainInputName,
ChainOutputName: setting.MetadataNaming.ChainOutputName,
@@ -149,32 +149,32 @@ func (o *otherSettingsPath) ToNotificationsConfig() (notifications.Config, error
}, nil
}
func (o *otherSettingsPath) ToAnalyzerConfig(binaryLocations *binaryLocations) (config.Config, error) {
func (o *otherSettingsPath) ToAnalyzerConfig(binaryLocations *binaryLocations) (analyzerConfig.Config, error) {
if binaryLocations.Journalctl == "" {
return config.Config{}, errors.New(i18n.Lang.T("parameter is not specified", map[string]any{
return analyzerConfig.Config{}, errors.New(i18n.Lang.T("parameter is not specified", map[string]any{
"Parameter": "binaryLocations.journalctl",
}))
}
setting, err := analyzerSetting.InitSetting(o.Analyzer)
if err != nil {
return config.Config{}, err
return analyzerConfig.Config{}, err
}
if err := setting.Validate(); err != nil {
return config.Config{}, err
return analyzerConfig.Config{}, err
}
binPath := config.BinPath{
binPath := analyzerConfig.BinPath{
Journalctl: binaryLocations.Journalctl,
}
sources, err := setting.ToSources()
if err != nil {
return config.Config{}, err
return analyzerConfig.Config{}, err
}
return config.Config{
return analyzerConfig.Config{
BinPath: binPath,
Sources: sources,
}, nil