Report firewall reality, and implement the managed-SHA flag apply already calls - #16
Merged
Conversation
…lled Two halves of NetGuard have been finished on the server for months and unreachable from a node the whole time. The reality panel showed 35 machines as "never reported" because nothing ever posted a snapshot: the agent had no collector. And the apply script the server generates calls `lattice-agent --guard-managed-sha` to record what it installed — a flag this binary did not implement, so every NetGuard apply came back without the canonical hash the server needs and the drift anchor could never be anything but unknown. The collector reads /proc rather than shelling out to ss or lsof, which are not installed on a minimal box: listening TCP and UDP sockets with their owning process where /proc/<pid>/fd is readable, interfaces with their addresses, the live managed table's canonical hash, the foreign nftables tables that are in force but not ours, and the nft version. All of it is read-only and best-effort — a host without nft or without root still reports listeners and interfaces, because a partial snapshot is what distinguishes "I can see this machine but not its ruleset" from a machine that is gone. The canonical hash strips handle numbers, trailing whitespace and blank lines before hashing, and keeps rule order, which is what makes drift mean anything: nft reassigns handles on every reload, so hashing them raw would report drift on a table nobody touched. --guard-managed-sha and the periodic report compute it with the same function, so the value recorded at apply time is comparable with the value observed later by construction. Tested: address decoding (little-endian per word, v4-mapped v6, garbage rejected), LISTEN-only filtering for TCP versus every bound UDP socket, a missing /proc file reading as no sockets, handle-insensitive but rule-sensitive canonicalization, and the exact wire shape the server's handler decodes. Full agent suite green. Not-tested: against a live nftables ruleset (this host has no nft; the release verification on a fleet node covers it).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the agent-side gap behind NetGuard: a /proc-based collector (listeners with owning process, interfaces, canonical managed-table hash, foreign tables, nft version) posted every poll to /api/agent/guard-reality, plus the
--guard-managed-shaone-shot the server's apply script has always invoked but the agent never implemented. Canonicalization ignores nft handle renumbering so drift means a real change. Agent version 0.3.4. Full suite green.