Denozordec
1f7273f38d
- Updated `evofw-firewall.sh` and related scripts to replace `policy_mode` with `default_action`, enhancing clarity and consistency in policy management. - Adjusted agent routes and evaluation logic to accommodate the new default action structure, ensuring backward compatibility with legacy modes. - Enhanced tests to validate the new default action behavior and its integration within the agent policy framework. - Refactored related components in the web interface to align with the updated policy handling, improving user experience and reducing confusion around policy modes.
37 lines
1.9 KiB
Markdown
37 lines
1.9 KiB
Markdown
# Архитектура EvoFirewall
|
|
|
|
Централизованный control plane для firewall-агентов (Linux nft/ipset, MikroTik address-list).
|
|
|
|
## Компоненты
|
|
|
|
| Компонент | Путь | Роль |
|
|
|-----------|------|------|
|
|
| Web SPA | `apps/web` | ReUI Frame, TanStack Router/Query |
|
|
| API | `apps/api` | Fastify 5, JWT + agent tokens |
|
|
| DB | `packages/db` | Drizzle + SQLite WAL |
|
|
| Shared | `packages/shared` | Zod-контракты, RBAC helpers |
|
|
| UI | `packages/ui` | shadcn primitives `@evofw/ui` |
|
|
| Agents | `apps/api/src/agent-scripts` | install.sh, sync, MikroTik RSC |
|
|
|
|
## Потоки
|
|
|
|
1. **Enroll** — `POST /v1/agent/enroll` + `X-EvoFW-Seed` → pending agent
|
|
2. **Approve** — UI/API → status approved
|
|
3. **Policy** — `GET /v1/agent/policy` → deny/allow CIDRs + `default_action` + hash (`apply_version: 2`)
|
|
4. **Apply** — agent пишет kernel rules, `POST /v1/agent/apply-report` + stats sample
|
|
5. **Lists refresh** — cron каждые 5 мин (json_url / domains / evobgp_community)
|
|
|
|
## Политика
|
|
|
|
- Именованные **наборы правил** (`policy_sets`); агенту назначается **M:N** через `agent_policy_sets`
|
|
- Правило в наборе: `action: deny | allow` + ровно один источник — IP-список (`list_id`), CIDR или DNS-имя (`hostname` → A/AAAA, кэш в `policy_rule_resolved`)
|
|
- Evaluate: правила всех назначенных enabled-наборов (sort + priority) + `ip_overrides`
|
|
- Цепочка ядра **всегда**: deny → allow → `default_action` (`accept` | `drop` на агенте)
|
|
- Exact overlap: `allow \ deny` (`conflicts_dropped`); deny wins
|
|
- Overrides, смена наборов, `default_action` и refresh DNS/lists бампят `policy_generation`
|
|
|
|
## Auth
|
|
|
|
- Portal SSO app id **`fw`**, permissions `fw:*`
|
|
- Agent bearer token (sha256 hash в БД)
|