mesh-sdk/go/catalogue/adoption.go

package catalogue

import (
	"fmt"
	"strings"
)

// AdoptionPrefix is the id prefix of what the mesh declares of its own on an adopted node. It is
// never a module's, so none of it is ever held as found.
const AdoptionPrefix = "adoption."

// Where an opening admits from, on the wire.
const (
	OpeningFromEverywhere = "everywhere"
	OpeningFromMesh       = "mesh"
)

// The two paths a packet reaches a port by: received by the machine, or forwarded to a
// container that publishes it.
const (
	PathIncoming  = "incoming"
	PathForwarded = "forwarded"
)

// Guard resources: the refusal-only table, the unit that loads it, and that unit running.
const (
	GuardPath = "/etc/mesh/guard.nft"
	GuardUnit = "mesh-guard.service"
	// GuardUnitPath is where the unit is written.
	GuardUnitPath = "/etc/systemd/system/" + GuardUnit
)

// GuardPackage is the package that carries nft.
const GuardPackage = "nftables"

// Published is every port the given containers publish on the machine, by protocol and machine
// port, mapped to the container's own port. A mapping bound to loopback is left out: nothing off
// the machine reaches it, forwarded or not.
func Published(resources []map[string]any) map[string]map[int]int {
	out := map[string]map[int]int{}
	for _, r := range resources {
		if fmt.Sprint(r["type"]) != "container" {
			continue
		}
		listed, _ := r["ports"].([]any)
		for _, entry := range listed {
			written := strings.TrimSpace(fmt.Sprint(entry))
			protocol := "tcp"
			if cut := strings.LastIndex(written, "/"); cut >= 0 {
				protocol = written[cut+1:]
			}
			// Indexed from the end, so an IPv6 address's own colons never shift the ports.
			outer, inner, address, ok := mapping(written)
			if !ok {
				continue
			}
			switch strings.Trim(address, "[]") {
			case "127.0.0.1", "localhost", "::1":
				continue
			}
			if out[protocol] == nil {
				out[protocol] = map[int]int{}
			}
			out[protocol][outer] = inner
		}
	}
	return out
}