15 Commits

Include renames

Author	SHA1	Message	Date
mesh-tools	52600ec7bd	Take the node-engine's parser from mesh-sdk: remaining imports (issue 1392)	2026-10-20 11:17:14 +00:00
jschoubben	b94e0f9a77	The mesh's own ban chain is a ban wherever it hangs; the front end's record is cited as 0180 (hq ADR 0186) ... The legacy reader required every path into a chain of refusals to come from a built-in whose policy accepts. The home server's ban chain hangs off the container runtime's user chain, whose forward policy the runtime set to DROP, so the machine reported the mesh's own intrusion prevention as a rule set the mesh did not write. A chain is a ban when every refusal names its sources and the chain accepts nothing — the rule the nftables side already used. A chain that accepts anything is still not a ban. Fixture captured from the machine. The citations for the uninstalled front end move to ADR 0180, which another session's renumber had left pointing at an unrelated record.	2026-10-02 18:42:16 +02:00
jschoubben	f57386cdea	A package may be declared absent, and an uninstalled front end is retired for good (hq ADR 0175) ... absent: true on a package has the host remove it through the machine's own package manager when it is installed and leave alone a machine that never had it; read back either way. Undeclaring a package still removes nothing. A found firewall whose command is gone is recorded as removed, said once, and asked nothing of.	2026-10-02 16:28:27 +02:00
jschoubben	627ac97d4f	The host says what filters the machine, with owners, and keeps the found firewall retired on every converged apply (hq ADR 0168) ... Every table and chain that refuses traffic is reported with whose it is: the mesh's, the found firewall's, the container runtime's own, a ban, or other — the runtime's user chain is other, which is where both predecessors kept their rules, in the legacy filter on one machine and invisible to the mesh. Adoption's threshold does not move; a converged machine's report grows by its filters and its found firewall's state. Convergence is a state the host keeps: a found firewall enabled again is retired again and said; a reconcile that finds it inactive records that it was found so, never that the mesh did it; a step skipped after a failed apply is said. A retirement the mesh began and did not finish is finished. Fixtures are rulesets captured from three machines of the first mesh.	2026-10-02 11:58:16 +02:00
jschoubben	b4c21b4f67	Read a machine's iptables rules when it has no nft, instead of calling it unfiltered (hq ADR 0100)	2026-09-22 19:59:22 +02:00
jschoubben	9839006d48	Retire the found firewall only once the mesh's own filter is loaded on the machine (hq ADR 0100)	2026-09-22 19:54:43 +02:00
jschoubben	232ed74940	gofmt the ufw rule's direction field	2026-09-22 19:52:40 +02:00
jschoubben	d3f2595968	Read a ufw rule's direction: an outgoing rule answers no opening, and incoming is the default ufw merges on (hq ADR 0103)	2026-09-22 19:51:35 +02:00
jschoubben	444ad8f3cf	Record the forward policies before disabling ufw, so a retried retirement restores them (hq ADR 0100)	2026-09-22 18:33:09 +02:00
jschoubben	b531c47486	Refuse an opening ufw would merge into a found rule that does other than a plain allow, and read log types in either place (hq ADR 0103)	2026-09-22 18:29:06 +02:00
jschoubben	52e139d96f	Add no opening a found ufw rule already answers, since ufw takes rules differing only in comment for one, as captured on a lab machine (hq ADR 0103)	2026-09-22 18:06:47 +02:00
jschoubben	da65f84c45	Read fail2ban's bans as no firewall, and an iptables-nft reject as a refusal, from rulesets captured on a lab machine (hq ADR 0100)	2026-09-22 18:04:48 +02:00
jschoubben	8e2f75454d	Put back the forward policy ufw disable opens when the found firewall is retired, as measured on a lab machine (hq ADR 0100)	2026-09-22 18:03:30 +02:00
jschoubben	3e0e6e6b7e	Delete a forwarded opening the way ufw accepts it, and read a fresh machine's resolver as not in use — both measured on a lab machine (hq ADR 0100)	2026-09-22 17:37:01 +02:00
jschoubben	3c90d155b3	Converge openings through the firewall an adopted node was found with, and retire it only when the node converges (hq ADR 0100)	2026-09-22 17:19:49 +02:00