@underpostnet/cyberia 3.2.90 → 3.3.73

package/src/server/{dns.js → network/dns.js}

@@ -1,19 +1,17 @@
 /**
  * Provides a comprehensive set of DNS and IP management utilities,
  * primarily focused on dynamic DNS (DDNS) updates and network checks.
- * @module src/server/dns.js
+ * @module src/server/network/dns.js
  * @namespace UnderpostDns
  */
 import axios from 'axios';
-import fs from 'fs';
 import validator from 'validator';
-import { loggerFactory } from './logger.js';
+import { loggerFactory } from '../ops/logger.js';
 import dns from 'node:dns';
 import os from 'node:os';
-import { shellExec, pbcopy } from './process.js';
-import Underpost from '../index.js';
-import { writeEnv, readConfJson, loadCronDeployEnv } from './conf.js';
-import { resolveDeployId } from './cron.js';
+import { shellExec, pbcopy } from '../runtime/process.js';
+import Underpost from '../../index.js';
+import { readConfJson } from '../runtime/conf.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -271,6 +269,206 @@ class Dns {
     logger.info('Cleared all egress bans.');
   }
 
+  /**
+   * Blocks all outbound traffic from this host, except for established/related connections.
+   * This is useful for security purposes, especially in a dynamic DNS context where you want to prevent
+   * any new outbound connections while still allowing existing ones (like SSH) to continue.
+   * @static
+   * @memberof UnderpostDns
+   */
+  static ensureFilterChains(chains = ['output', 'forward']) {
+    // A stock RHEL 9 host with firewalld keeps its rules in `inet firewalld`;
+    // there is no `inet filter` table, so every policy command below fails with
+    // "No such file or directory". They used to fail silently, which is the
+    // worst possible outcome for this subsystem: the caller logged a successful
+    // block, the bandwidth guard latched, and the overage it exists to stop
+    // kept accruing against a host that was never blocked.
+    //
+    // Creating our own base chains is additive rather than a firewalld
+    // takeover — nftables evaluates every table, so a drop here still wins.
+    const ran = (command) => shellExec(command, { silent: true, silentOnError: true })?.code === 0;
+    const chainExists = (chain) => ran(`sudo nft list chain inet filter ${chain}`);
+    const missing = chains.filter((chain) => !chainExists(chain));
+    if (missing.length === 0) return true;
+    if (!ran(`sudo nft add table inet filter`)) return false;
+    for (const chain of missing) {
+      const hook = chain === 'input' ? 'input' : chain;
+      if (!ran(`sudo nft add chain inet filter ${chain} '{ type filter hook ${hook} priority 0; policy accept; }'`))
+        return false;
+    }
+    return chains.every(chainExists);
+  }
+
+  /**
+   * Whether a chain currently carries the given policy.
+   * @static
+   * @param {string} chain - Chain name in `inet filter`.
+   * @param {string} policy - `accept` or `drop`.
+   * @returns {boolean} True when the chain reports that policy.
+   * @memberof UnderpostDns
+   */
+  static chainPolicyIs(chain, policy) {
+    const listing = shellExec(`sudo nft list chain inet filter ${chain}`, {
+      silent: true,
+      stdout: true,
+      silentOnError: true,
+    });
+    return `${listing || ''}`.includes(`policy ${policy}`);
+  }
+
+  static blockAllEgress() {
+    if (!Dns.ensureFilterChains(['output', 'forward']))
+      throw new Error('[dns] could not create the inet filter chains; egress is NOT blocked');
+
+    // Clear any existing egress rules.
+    shellExec(`sudo nft flush chain inet filter output`, { silent: true });
+    shellExec(`sudo nft flush chain inet filter forward`, { silent: true });
+
+    // Allow return traffic for established/related connections.
+    //    This keeps existing inbound connections such as SSH alive.
+    shellExec(`sudo nft add rule inet filter output ct state established,related counter accept`, { silent: true });
+
+    // Block all new outbound connections from this host and forwarded traffic.
+    shellExec(`sudo nft chain inet filter output '{ policy drop; }'`, { silent: true });
+    shellExec(`sudo nft chain inet filter forward '{ policy drop; }'`, { silent: true });
+
+    // Read the policy back. The caller latches on this command's exit code, so
+    // reporting a block that did not land is what lets an overage run unbounded.
+    for (const chain of ['output', 'forward'])
+      if (!Dns.chainPolicyIs(chain, 'drop'))
+        throw new Error(`[dns] inet filter ${chain} is not 'policy drop'; egress is NOT blocked`);
+
+    logger.info('All outbound traffic blocked.');
+  }
+
+  /**
+   * Unblocks all outbound traffic from this host and forwarded interfaces.
+   * Restores default output and forward chain policies to ACCEPT and clears egress rules.
+   * @static
+   * @memberof UnderpostDns
+   */
+  static unblockAllEgress() {
+    // Nothing to restore when the chains were never created — that host was
+    // never blocked, and saying so beats failing on a missing table.
+    if (!Dns.ensureFilterChains(['output', 'forward'])) {
+      logger.info('No inet filter chains on this host; egress was never blocked.');
+      return;
+    }
+
+    // Restore default chain policies to accept all traffic.
+    shellExec(`sudo nft chain inet filter output '{ policy accept; }'`, { silent: true });
+    shellExec(`sudo nft chain inet filter forward '{ policy accept; }'`, { silent: true });
+
+    // Clear any existing egress blocking rules.
+    shellExec(`sudo nft flush chain inet filter output`, { silent: true });
+    shellExec(`sudo nft flush chain inet filter forward`, { silent: true });
+
+    for (const chain of ['output', 'forward'])
+      if (!Dns.chainPolicyIs(chain, 'accept'))
+        throw new Error(`[dns] inet filter ${chain} is still not 'policy accept'; egress remains blocked`);
+
+    logger.info('All outbound traffic unblocked and restored to default ACCEPT policy.');
+  }
+
+  /**
+   * Ensures the chain every ingress rule is installed into exists.
+   *
+   * `inet filter` can be present with no `input` chain — a firewalld host keeps
+   * its rules in `inet firewalld` and never creates one — and every ingress
+   * command below then fails on a table that looks like it is there. Creating it
+   * with an accept policy and no rules changes nothing by itself.
+   * @static
+   * @memberof UnderpostDns
+   */
+  static ensureIngressChain() {
+    shellExec(`sudo nft add table inet filter`, { silent: true });
+    shellExec(`sudo nft add chain inet filter input '{ type filter hook input priority 0; policy accept; }'`, {
+      silent: true,
+    });
+  }
+
+  /**
+   * Blocks all new inbound traffic to this host, except for established/related connections.
+   * This prevents any new incoming connections while keeping existing sessions (like SSH) alive.
+   * @static
+   * @memberof UnderpostDns
+   */
+  static blockAllIngress() {
+    Dns.ensureIngressChain();
+    // Clear any existing ingress rules.
+    shellExec(`sudo nft flush chain inet filter input`, { silent: true });
+
+    // Allow return traffic for established/related connections.
+    // This keeps active inbound/outbound sessions alive.
+    shellExec(`sudo nft add rule inet filter input ct state established,related counter accept`, { silent: true });
+
+    // Block all new inbound connections to this host.
+    shellExec(`sudo nft chain inet filter input '{ policy drop; }'`, { silent: true });
+
+    logger.info('All new inbound traffic blocked.');
+  }
+
+  /**
+   * Blocks new inbound traffic to specific TCP ports, leaving every other port
+   * reachable.
+   *
+   * Unlike {@link UnderpostDns.blockAllIngress}, the management path survives:
+   * blocking the public edge ports takes published services down while the host
+   * can still be reached to put them back. That is the only form of induced
+   * ingress outage a remote operator can recover from.
+   * @static
+   * @param {string} ports - Comma-separated TCP ports.
+   * @memberof UnderpostDns
+   */
+  static blockIngressPort(ports) {
+    Dns.ensureIngressChain();
+    for (const port of Dns.portListFactory(ports))
+      shellExec(`sudo nft insert rule inet filter input tcp dport ${port} counter drop`, { silent: true });
+    logger.info('Inbound traffic blocked on ports', { ports: Dns.portListFactory(ports) });
+  }
+
+  /**
+   * Withdraws the port rules {@link UnderpostDns.blockIngressPort} installed.
+   * @static
+   * @param {string} ports - Comma-separated TCP ports.
+   * @memberof UnderpostDns
+   */
+  static unblockIngressPort(ports) {
+    Dns.ensureIngressChain();
+    for (const port of Dns.portListFactory(ports))
+      shellExec(
+        `sudo sh -c "nft -a list chain inet filter input | awk '/tcp dport ${port} .*drop/ {print \\$NF}' | ` +
+          `xargs -r -n1 nft delete rule inet filter input handle"`,
+        { silent: true },
+      );
+    logger.info('Inbound traffic unblocked on ports', { ports: Dns.portListFactory(ports) });
+  }
+
+  /** Parses a comma-separated port list, keeping only valid TCP ports. */
+  static portListFactory(ports = '') {
+    return `${ports || ''}`
+      .split(',')
+      .map((port) => Number(`${port}`.trim()))
+      .filter((port) => Number.isInteger(port) && port > 0 && port <= 65535);
+  }
+
+  /**
+   * Unblocks all inbound traffic to this host.
+   * Restores default input chain policy to ACCEPT and clears ingress rules.
+   * @static
+   * @memberof UnderpostDns
+   */
+  static unblockAllIngress() {
+    Dns.ensureIngressChain();
+    // Restore default chain policy to accept all incoming traffic.
+    shellExec(`sudo nft chain inet filter input '{ policy accept; }'`, { silent: true });
+
+    // Clear any existing ingress blocking rules.
+    shellExec(`sudo nft flush chain inet filter input`, { silent: true });
+
+    logger.info('All inbound traffic unblocked and restored to default ACCEPT policy.');
+  }
+
   /**
    * Performs the dynamic DNS update logic.
    * It checks if the public IP has changed and, if so, updates the configured DNS records.
@@ -281,8 +479,6 @@ class Dns {
    * @returns {Promise<void>}
    */
   static async callback(deployList) {
-    // loadCronDeployEnv();
-
     const isOnline = await Dns.isInternetConnection();
 
     if (!isOnline) return;
@@ -295,11 +491,11 @@ class Dns {
       logger.error(error, { testIp, stack: error.stack });
     }
 
-    const currentIp = Underpost.env.get('ip');
+    const currentIp = Underpost.host.store.get('ip');
 
-    if (validator.isIP(testIp) && currentIp !== testIp) {
+    if (testIp && validator.isIP(testIp) && currentIp !== testIp) {
       logger.info(`New IP detected`, testIp);
-      Underpost.env.set('monitor-input', 'pause');
+      Underpost.host.store.set('monitor-input', 'pause');
 
       for (const _deployId of deployList.split(',')) {
         const deployId = _deployId.trim();
@@ -342,8 +538,8 @@ class Dns {
           logger.info(ipUrlTest + ' verify ip', verifyIp);
           if (verifyIp === testIp) {
             logger.info('IP updated successfully and verified', testIp);
-            Underpost.env.set('ip', testIp);
-            Underpost.env.delete('monitor-input');
+            Underpost.host.store.set('ip', testIp);
+            Underpost.host.store.delete('monitor-input');
           } else {
             logger.error('IP not updated or verification failed', { expected: testIp, received: verifyIp });
           }
@@ -440,6 +636,12 @@ class Dns {
    * @property {boolean} [options.banEgressClear=false] - Clear all banned egress IPs.
    * @property {boolean} [options.banBothAdd=false] - Ban IPs from both ingress and egress.
    * @property {boolean} [options.banBothRemove=false] - Unban IPs from both ingress and egress.
+   * @property {boolean} [options.blockAllEgress=false] - Block all outbound traffic from this host.
+   * @property {boolean} [options.unblockAllEgress=false] - Unblock all outbound traffic.
+   * @property {boolean} [options.blockAllIngress=false] - Block all new inbound traffic to this host.
+   * @property {boolean} [options.unblockAllIngress=false] - Unblock all inbound traffic.
+   * @property {string} [options.blockIngressPort=''] - Comma-separated TCP ports to block inbound.
+   * @property {string} [options.unblockIngressPort=''] - Comma-separated TCP ports to unblock inbound.
    * @property {boolean} [options.dhcp=false] - Get local DHCP IP instead of public IP.
    * @property {boolean} [options.copy=false] - Copy the public IP to clipboard.
    * @return {Promise<string|void>} The public IP if no ban/unban action is taken.
@@ -457,6 +659,12 @@ class Dns {
       banEgressClear: false,
       banBothAdd: false,
       banBothRemove: false,
+      blockAllEgress: false,
+      unblockAllEgress: false,
+      blockAllIngress: false,
+      unblockAllIngress: false,
+      blockIngressPort: '',
+      unblockIngressPort: '',
       copy: false,
       dhcp: false,
     },
@@ -507,6 +715,25 @@ class Dns {
       });
     }
 
+    if (options.blockAllEgress) {
+      return Dns.blockAllEgress();
+    }
+    if (options.unblockAllEgress) {
+      return Dns.unblockAllEgress();
+    }
+    if (options.blockIngressPort) {
+      return Dns.blockIngressPort(options.blockIngressPort);
+    }
+    if (options.unblockIngressPort) {
+      return Dns.unblockIngressPort(options.unblockIngressPort);
+    }
+    if (options.blockAllIngress) {
+      return Dns.blockAllIngress();
+    }
+    if (options.unblockAllIngress) {
+      return Dns.unblockAllIngress();
+    }
+
     if (options.mac) {
       const mac = Dns.getMainInterfaceMac();
       console.log(mac);