Denozordec
1f7273f38d
- Updated `evofw-firewall.sh` and related scripts to replace `policy_mode` with `default_action`, enhancing clarity and consistency in policy management. - Adjusted agent routes and evaluation logic to accommodate the new default action structure, ensuring backward compatibility with legacy modes. - Enhanced tests to validate the new default action behavior and its integration within the agent policy framework. - Refactored related components in the web interface to align with the updated policy handling, improving user experience and reducing confusion around policy modes.
65 lines
2.3 KiB
SQL
65 lines
2.3 KiB
SQL
-- Replace exclusive blacklist/whitelist with default_action (accept|drop).
|
|
-- Unified kernel chain: deny → allow → default_action.
|
|
|
|
PRAGMA foreign_keys = OFF;
|
|
|
|
CREATE TABLE agents_v3 (
|
|
id TEXT PRIMARY KEY,
|
|
name TEXT NOT NULL,
|
|
hostname TEXT,
|
|
platform TEXT NOT NULL DEFAULT 'linux',
|
|
token_prefix TEXT NOT NULL,
|
|
token_hash TEXT NOT NULL,
|
|
status TEXT NOT NULL DEFAULT 'pending',
|
|
default_action TEXT NOT NULL DEFAULT 'accept',
|
|
policy_generation INTEGER NOT NULL DEFAULT 1,
|
|
last_seen_at TEXT,
|
|
last_seen_ip TEXT,
|
|
last_apply_at TEXT,
|
|
last_apply_status TEXT,
|
|
last_apply_error TEXT,
|
|
last_apply_prefix_count INTEGER DEFAULT 0,
|
|
last_apply_packets_dropped INTEGER NOT NULL DEFAULT 0,
|
|
last_apply_packets_accepted INTEGER NOT NULL DEFAULT 0,
|
|
last_apply_kernel_method TEXT,
|
|
client_version TEXT,
|
|
settings_json TEXT NOT NULL DEFAULT '{}',
|
|
created_by_user_id TEXT,
|
|
created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
|
|
approved_at TEXT,
|
|
revoked_at TEXT,
|
|
CHECK (status IN ('invited', 'pending', 'approved', 'revoked')),
|
|
CHECK (platform IN ('linux', 'mikrotik')),
|
|
CHECK (default_action IN ('accept', 'drop')),
|
|
CHECK (length(trim(name)) > 0)
|
|
);
|
|
|
|
INSERT INTO agents_v3 (
|
|
id, name, hostname, platform, token_prefix, token_hash, status, default_action,
|
|
policy_generation, last_seen_at, last_seen_ip, last_apply_at, last_apply_status,
|
|
last_apply_error, last_apply_prefix_count, last_apply_packets_dropped,
|
|
last_apply_packets_accepted, last_apply_kernel_method, client_version,
|
|
settings_json, created_by_user_id, created_at, approved_at, revoked_at
|
|
)
|
|
SELECT
|
|
id, name, hostname, platform, token_prefix, token_hash, status,
|
|
CASE
|
|
WHEN policy_mode = 'whitelist' THEN 'drop'
|
|
WHEN policy_mode = 'drop' THEN 'drop'
|
|
WHEN policy_mode = 'accept' THEN 'accept'
|
|
ELSE 'accept'
|
|
END,
|
|
policy_generation, last_seen_at, last_seen_ip, last_apply_at, last_apply_status,
|
|
last_apply_error, last_apply_prefix_count, last_apply_packets_dropped,
|
|
last_apply_packets_accepted, last_apply_kernel_method, client_version,
|
|
settings_json, created_by_user_id, created_at, approved_at, revoked_at
|
|
FROM agents;
|
|
|
|
DROP TABLE agents;
|
|
ALTER TABLE agents_v3 RENAME TO agents;
|
|
|
|
CREATE UNIQUE INDEX IF NOT EXISTS idx_agents_token_hash ON agents (token_hash);
|
|
CREATE INDEX IF NOT EXISTS idx_agents_status ON agents (status);
|
|
|
|
PRAGMA foreign_keys = ON;
|