Denozordec
43f5ac2525
- Added support for managing desired L4 port ACL rules for Linux agents, allowing for open/close actions on specified ports. - Introduced a new endpoint for CRUD operations on port rules, enhancing the API's capabilities for agent management. - Implemented functionality to collect and report host firewall snapshots, capturing observed rules and listeners for better monitoring. - Updated the agent detail view to include tabs for managing port ACLs and viewing host firewall data, improving user experience. - Enhanced documentation to reflect the new features and API changes, ensuring clarity for users and developers. These changes significantly improve the management and visibility of firewall rules and port access control for agents.
38 lines
2.1 KiB
Markdown
38 lines
2.1 KiB
Markdown
# Архитектура EvoFirewall
|
|
|
|
Централизованный control plane для firewall-агентов (Linux nft/ipset, MikroTik address-list).
|
|
|
|
## Компоненты
|
|
|
|
| Компонент | Путь | Роль |
|
|
|-----------|------|------|
|
|
| Web SPA | `apps/web` | ReUI Frame, TanStack Router/Query |
|
|
| API | `apps/api` | Fastify 5, JWT + agent tokens |
|
|
| DB | `packages/db` | Drizzle + SQLite WAL |
|
|
| Shared | `packages/shared` | Zod-контракты, RBAC helpers |
|
|
| UI | `packages/ui` | shadcn primitives `@evofw/ui` |
|
|
| Agents | `apps/api/src/agent-scripts` | install.sh, sync, MikroTik RSC |
|
|
|
|
## Потоки
|
|
|
|
1. **Enroll** — `POST /v1/agent/enroll` + `X-EvoFW-Seed` → pending agent
|
|
2. **Approve** — UI/API → status approved
|
|
3. **Policy** — `GET /v1/agent/policy` → deny/allow CIDRs + `default_action` + optional `port_rules` + hash (`apply_version: 3`)
|
|
4. **Apply** — agent пишет kernel rules (L3 + L4 port ACL на nft), `POST /v1/agent/apply-report` + stats + optional `host_firewall` snapshot
|
|
5. **Lists refresh** — cron каждые 5 мин (json_url / domains / evobgp_community)
|
|
|
|
## Политика
|
|
|
|
- Именованные **наборы правил** (`policy_sets`); агенту назначается **M:N** через `agent_policy_sets`
|
|
- Правило в наборе: `action: deny | allow` + ровно один источник — IP-список (`list_id`), CIDR или DNS-имя (`hostname` → A/AAAA, кэш в `policy_rule_resolved`)
|
|
- Evaluate: правила всех назначенных enabled-наборов (sort + priority) + `ip_overrides`
|
|
- Цепочка ядра **всегда**: deny → allow → `default_action` (`accept` | `drop` на агенте)
|
|
- На Linux nft: после allow — **Port ACL** (`close` drop, затем `open` accept) из `agent_port_rules`
|
|
- Exact overlap: `allow \ deny` (`conflicts_dropped`); deny wins
|
|
- Overrides, смена наборов, `default_action`, Port ACL и refresh DNS/lists бампят `policy_generation`
|
|
|
|
## Auth
|
|
|
|
- Portal SSO app id **`fw`**, permissions `fw:*`
|
|
- Agent bearer token (sha256 hash в БД)
|