umbermark-cli 1.0.0rc1__py3-none-any.whl

umbermark/core/firewall.py

@@ -0,0 +1,713 @@
+"""Host-firewall model: parse nft / iptables / ufw, answer "is port P reachable?".
+
+One parser, one evaluator, shared by every check that needs to judge exposure
+(listen_vs_firewall_delta, public_listen_anomalies, and the AccessContext
+reachability detector).
+
+The question answered is: *would a new inbound tcp/udp connection to port P,
+arriving on a public interface from an arbitrary internet address, be accepted
+by the host firewall?* "Public interface" means anything that is not loopback
+and not a VPN-overlay device (tailscale0, wg0, ...), see `is_overlay_iface`.
+
+Supported syntax (enough for real-world rulesets, not a full nft/iptables VM):
+
+* nft: tables/chains, base-chain `hook input` + `policy`, `jump`/`goto`,
+  `iif`/`iifname` (single, `!=`, sets, `*` wildcards), `tcp|udp|th dport`
+  (single, ranges, `{ 80, 443 }` sets, named `@sets`), `meta l4proto`,
+  `ip protocol`, `ct state`, `saddr` restrictions. Unknown match expressions
+  never grant exposure by themselves: an `accept` guarded by something we do
+  not understand is reported as RESTRICTED, never as ACCEPTED.
+* iptables -S: `-P INPUT`, `-N`, `-A`, `-p`, `-i`, `-s`, `--dport`,
+  `-m multiport --dports`, conntrack/state, jumps to user chains.
+* ufw status [verbose]: default incoming policy + ALLOW/DENY/REJECT/LIMIT rows.
+
+Limits (documented, not hidden): ip6tables is not collected; nft `ip daddr`
+and `fib` expressions are treated as unknown conditions; evaluation is for NEW
+connections only (established/related rules never match).
+
+When nothing could be read, `Firewall.evaluate` returns UNKNOWN. UNKNOWN is
+never promoted to "safe" by callers.
+"""
+from __future__ import annotations
+
+import fnmatch
+import ipaddress
+import re
+import shlex
+from dataclasses import dataclass, field
+from enum import Enum
+
+# Interface-name prefixes of VPN / overlay devices. Traffic arriving on these
+# is authenticated by the overlay, so it is not "public" exposure.
+_OVERLAY_PREFIXES = ("tailscale", "wg", "zt", "nebula", "tun", "tap", "wt", "utun")
+PUBLIC_SENTINEL = "<public>"
+
+
+def is_overlay_iface(name: str) -> bool:
+    return name.lower().startswith(_OVERLAY_PREFIXES)
+
+
+def is_loopback_iface(name: str) -> bool:
+    return name == "lo" or name.startswith("lo:")
+
+
+# --------------------------------------------------------------------------- #
+# Address classification (shared with core.access)
+# --------------------------------------------------------------------------- #
+_CGNAT = ipaddress.ip_network("100.64.0.0/10")
+_ULA = ipaddress.ip_network("fc00::/7")
+
+
+def classify_address(addr: str) -> str:
+    """Return 'loopback' | 'linklocal' | 'private' | 'cgnat' | 'public' | 'unknown'.
+
+    Deliberately simple: RFC1918 / ULA are 'private', 100.64/10 is 'cgnat'
+    (tailnet-style overlays live here), everything else routable is 'public'.
+    RFC 5737 documentation ranges count as public so scrubbed fixtures work.
+    """
+    try:
+        ip = ipaddress.ip_address(addr.split("%")[0])
+    except ValueError:
+        return "unknown"
+    if ip.is_loopback:
+        return "loopback"
+    if ip.is_link_local:
+        return "linklocal"
+    if ip.is_unspecified:
+        return "unknown"
+    if ip.version == 4:
+        if ip in _CGNAT:
+            return "cgnat"
+        if any(ip in ipaddress.ip_network(n) for n in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")):
+            return "private"
+    else:
+        if ip in _ULA:
+            return "private"
+    return "public"
+
+
+def sources_are_private(sources: list[str]) -> bool:
+    """True iff every source CIDR/address is private, CGNAT, loopback or link-local."""
+    if not sources:
+        return False
+    for s in sources:
+        base = s.split("/")[0].strip()
+        if classify_address(base) not in ("private", "cgnat", "loopback", "linklocal"):
+            return False
+    return True
+
+
+# --------------------------------------------------------------------------- #
+# Model
+# --------------------------------------------------------------------------- #
+class Exposure(Enum):
+    ACCEPTED = "accepted"      # new connection from a public iface is accepted
+    BLOCKED = "blocked"        # dropped (policy or rule) from every public iface
+    RESTRICTED = "restricted"  # accepted only for specific source addresses / unknown guards
+    UNKNOWN = "unknown"        # no readable firewall
+
+
+@dataclass
+class PortVerdict:
+    state: Exposure
+    explicit: bool = False                     # accepted by an explicit rule (not just policy accept)
+    sources: list[str] = field(default_factory=list)  # for RESTRICTED
+    detail: str = ""
+
+
+@dataclass
+class Rule:
+    ifaces: list[str] | None = None            # None = any
+    iface_negate: bool = False
+    protos: set[str] | None = None             # None = any L4 proto
+    dports: list[tuple[int, int]] | None = None
+    dport_negate: bool = False
+    new_ok: bool = True                        # False when ct/state excludes NEW
+    sources: list[str] = field(default_factory=list)
+    unknown: bool = False                      # a condition we could not interpret
+    action: str | None = None                  # accept|drop|return|jump|None (no-op)
+    target: str | None = None                  # jump target chain
+
+
+@dataclass
+class Chain:
+    name: str
+    table: str = ""
+    hook: str | None = None                    # 'input' for base input chains
+    policy: str = "accept"
+    rules: list[Rule] = field(default_factory=list)
+    source: str = ""                           # nft | iptables | ufw
+    family: str = "inet"                       # inet (v4+v6) | ip (v4) | ip6 (v6)
+
+
+def _ports_match(rule: Rule, port: int) -> bool | None:
+    if rule.dports is None:
+        return True
+    inside = any(lo <= port <= hi for lo, hi in rule.dports)
+    return (not inside) if rule.dport_negate else inside
+
+
+def _iface_match(rule: Rule, iface: str) -> bool:
+    if rule.ifaces is None:
+        return True
+    hit = any(fnmatch.fnmatchcase(iface, pat) for pat in rule.ifaces)
+    return (not hit) if rule.iface_negate else hit
+
+
+def _classify_match(rule: Rule, port: int, proto: str, iface: str) -> str:
+    """'no' | 'yes' | 'partial' (matches but guarded by source/unknown condition)."""
+    if not rule.new_ok:
+        return "no"
+    if rule.protos is not None and proto not in rule.protos:
+        return "no"
+    if not _iface_match(rule, iface):
+        return "no"
+    if rule.dports is not None and not _ports_match(rule, port):
+        return "no"
+    if rule.unknown or rule.sources:
+        return "partial"
+    return "yes"
+
+
+@dataclass
+class _Decision:
+    kind: str                      # accept | drop | return
+    explicit: bool = False
+    restricted: list[str] = field(default_factory=list)
+    restricted_unknown: bool = False
+
+
+def _eval_chain(chains: dict[tuple[str, str], Chain], chain: Chain, port: int, proto: str,
+                iface: str, depth: int = 0) -> _Decision:
+    restricted: list[str] = []
+    r_unknown = False
+    if depth > 16:  # jump loops in hostile/odd rulesets
+        return _Decision("return")
+    for rule in chain.rules:
+        m = _classify_match(rule, port, proto, iface)
+        if m == "no" or rule.action is None:
+            continue
+        if rule.action in ("jump", "goto"):
+            tgt = chains.get((chain.table, rule.target or ""))
+            if tgt is None:
+                continue
+            sub = _eval_chain(chains, tgt, port, proto, iface, depth + 1)
+            restricted += sub.restricted
+            r_unknown = r_unknown or sub.restricted_unknown
+            if sub.kind in ("return", "policy"):
+                # `jump` resumes the calling chain. `goto` (or a nested goto that
+                # fell through) does NOT: the base-chain policy applies instead.
+                if m == "yes" and (rule.action == "goto" or sub.kind == "policy"):
+                    return _Decision("policy", False, restricted, r_unknown)
+                continue
+            if m == "partial":
+                if sub.kind == "accept":
+                    restricted += rule.sources
+                    r_unknown = r_unknown or rule.unknown
+                continue
+            return _Decision(sub.kind, sub.explicit, restricted, r_unknown)
+        if m == "partial":
+            if rule.action == "accept":
+                restricted += rule.sources
+                r_unknown = r_unknown or rule.unknown
+            continue
+        if rule.action == "return":
+            return _Decision("return", False, restricted, r_unknown)
+        return _Decision(rule.action, True, restricted, r_unknown)
+    return _Decision("return", False, restricted, r_unknown)
+
+
+# --------------------------------------------------------------------------- #
+# nft parser
+# --------------------------------------------------------------------------- #
+def _parse_port_spec(spec: str, sets: dict[str, list[tuple[int, int]]]) -> list[tuple[int, int]] | None:
+    spec = spec.strip()
+    if spec.startswith("@"):
+        return sets.get(spec[1:])
+    spec = spec.strip("{} ")
+    out: list[tuple[int, int]] = []
+    for part in re.split(r"[,\s]+", spec):
+        if not part:
+            continue
+        m = re.fullmatch(r"(\d+)(?:[-:](\d+))?", part)
+        if not m:
+            return None
+        lo = int(m.group(1))
+        out.append((lo, int(m.group(2) or lo)))
+    return out or None
+
+
+def _parse_str_set(spec: str) -> list[str]:
+    return [s for s in re.findall(r'"([^"]*)"|([\w*.-]+)', spec.strip("{} "))
+            for s in [s[0] or s[1]] if s]
+
+
+_LOG_RE = re.compile(r'\blog\b(?:\s+prefix\s+"[^"]*")?(?:\s+level\s+\w+)?(?:\s+group\s+\d+)?(?:\s+flags\s+\w+)?')
+_COUNTER_RE = re.compile(r"\bcounter\b(?:\s+packets\s+\d+\s+bytes\s+\d+)?")
+_IIF_RE = re.compile(r'(?:meta\s+)?\bi(?:ifname|if)\s+(!=\s*)?(\{[^}]*\}|"[^"]*"|\S+)')
+_DPORT_RE = re.compile(r"(?:\b(tcp|udp|th|sctp|dccp)\s+)?\bdport\s+(!=\s*)?(\{[^}]*\}|@\w+|[\d:-]+)")
+_L4_RE = re.compile(r"(?:meta\s+l4proto|ip\s+protocol|ip6\s+nexthdr)\s+(\{[^}]*\}|\S+)")
+_CT_RE = re.compile(r"\bct\s+state\s+(\{[^}]*\}|[\w,]+)")
+_SADDR_RE = re.compile(r"\b(?:ip6?)\s+saddr\s+(!=\s*)?(\{[^}]*\}|\S+)")
+_ACTION_RE = re.compile(r"\b(accept|drop|reject|return|continue)\b(?:\s+with\s+\S+(?:\s+type\s+\S+)?)?")
+_JUMP_RE = re.compile(r"\b(jump|goto)\s+(\S+)")
+# nft rule comments are free text: strip them BEFORE any keyword matching.
+_NFT_COMMENT_RE = re.compile(r'\bcomment\s+"(?:[^"\\]|\\.)*"')
+
+
+def _parse_nft_rule(line: str, sets: dict[str, list[tuple[int, int]]]) -> Rule:
+    rule = Rule()
+    s = _COUNTER_RE.sub(" ", line)
+    s = _LOG_RE.sub(" ", s)
+
+    m = _JUMP_RE.search(s)
+    if m:
+        rule.action, rule.target = m.group(1), m.group(2).rstrip(";")
+        s = s[:m.start()] + " " + s[m.end():]
+    else:
+        m = _ACTION_RE.search(s)
+        if m:
+            kw = m.group(1)
+            rule.action = {"accept": "accept", "drop": "drop", "reject": "drop",
+                           "return": "return", "continue": None}[kw]
+            s = s[:m.start()] + " " + s[m.end():]
+
+    def take(rx: re.Pattern[str]) -> re.Match[str] | None:
+        nonlocal s
+        mm = rx.search(s)
+        if mm:
+            s = s[:mm.start()] + " " + s[mm.end():]
+        return mm
+
+    mm = take(_IIF_RE)
+    if mm:
+        rule.iface_negate = bool(mm.group(1))
+        rule.ifaces = _parse_str_set(mm.group(2)) or None
+        if rule.ifaces is None:
+            rule.unknown = True
+
+    mm = take(_DPORT_RE)
+    if mm:
+        proto = mm.group(1)
+        if proto in ("tcp", "udp"):
+            rule.protos = {proto}
+        elif proto in ("sctp", "dccp"):
+            rule.protos = {proto}
+        ports = _parse_port_spec(mm.group(3), sets)
+        if ports is None:
+            rule.unknown = True
+        else:
+            rule.dports = ports
+            rule.dport_negate = bool(mm.group(2))
+
+    mm = take(_L4_RE)
+    if mm:
+        names = set(re.findall(r"[a-z0-9-]+", mm.group(1).lower()))
+        names = {"icmp" if n == "ipv6-icmp" else n for n in names}
+        rule.protos = names if rule.protos is None else (rule.protos & names)
+
+    mm = take(_CT_RE)
+    if mm:
+        states = set(re.findall(r"[a-z]+", mm.group(1).lower()))
+        rule.new_ok = "new" in states
+
+    mm = take(_SADDR_RE)
+    if mm:
+        if mm.group(1):  # '!=' form: restricts, but not to a positive list
+            rule.unknown = True
+        else:
+            rule.sources += re.findall(r"[0-9a-fA-F:.]+(?:/\d+)?", mm.group(2))
+
+    leftover = re.sub(r"[;\s]+", " ", s).strip()
+    if leftover and not leftover.startswith(("comment",)):
+        # e.g. `meta mark & 0xff == 0x4 accept`, `limit rate 5/second`, `fib ...`
+        rule.unknown = True
+    return rule
+
+
+def parse_nft(text: str) -> dict[tuple[str, str], Chain]:
+    """Parse `nft list ruleset` into {(table_key, chain_name): Chain}.
+
+    table_key is "<family> <name>", so a `jump` resolves within its own table.
+    """
+    chains: dict[tuple[str, str], Chain] = {}
+    sets: dict[str, list[tuple[int, int]]] = {}
+    table = ""
+    family = "inet"
+    chain: Chain | None = None
+    set_name: str | None = None
+    set_buf: list[str] = []
+
+    def _finish_set(name: str, body: str) -> None:
+        m = re.search(r"elements\s*=\s*\{([^}]*)\}", body)
+        sets[name] = (_parse_port_spec(m.group(1), {}) or []) if m else []
+
+    for raw in text.splitlines():
+        line = _NFT_COMMENT_RE.sub(" ", raw).split("#", 1)[0].strip()
+        if not line:
+            continue
+        if set_name is not None:
+            if line == "}":
+                _finish_set(set_name, " ".join(set_buf))
+                set_name, set_buf = None, []
+            else:
+                set_buf.append(line)
+            continue
+        m = re.match(r"table\s+(\S+)\s+(\S+)\s*\{", line)
+        if m:
+            table = f"{m.group(1)} {m.group(2)}"
+            family = m.group(1)
+            continue
+        m = re.match(r"set\s+(\S+)\s*\{(.*)$", line)
+        if m:
+            rest = m.group(2).strip()
+            if rest.endswith("}"):          # single-line set definition
+                _finish_set(m.group(1), rest[:-1])
+            else:
+                set_name, set_buf = m.group(1), [rest] if rest else []
+            continue
+        m = re.match(r"chain\s+(\S+)\s*\{", line)
+        if m and chain is None:
+            chain = Chain(name=m.group(1), table=table, source="nft", family=family)
+            chains[(table, chain.name)] = chain
+            continue
+        if line == "}":
+            if chain is not None:
+                chain = None
+            else:
+                table = ""
+            continue
+        if chain is None:
+            continue
+        mt = re.match(r"type\s+\S+\s+hook\s+(\S+)\s+priority\s+\S+;?\s*(?:policy\s+(\w+);)?", line)
+        if mt:
+            chain.hook = mt.group(1)
+            chain.policy = (mt.group(2) or "accept").lower()
+            continue
+        chain.rules.append(_parse_nft_rule(line, sets))
+    return chains
+
+
+# --------------------------------------------------------------------------- #
+# iptables parser
+# --------------------------------------------------------------------------- #
+_BENIGN_MODULES = {"tcp", "udp", "comment", "addrtype"}
+
+
+def parse_iptables(text: str, family: str = "ip") -> dict[tuple[str, str], Chain]:
+    chains: dict[tuple[str, str], Chain] = {}
+
+    def get(name: str) -> Chain:
+        return chains.setdefault(("", name), Chain(name=name, source="iptables", family=family))
+
+    for line in text.splitlines():
+        line = line.strip()
+        if line.startswith("-P "):
+            parts = line.split()
+            if len(parts) >= 3:
+                c = get(parts[1])
+                c.policy = "drop" if parts[2] in ("DROP", "REJECT") else "accept"
+                if parts[1] == "INPUT":
+                    c.hook = "input"
+        elif line.startswith("-N "):
+            get(line.split()[1])
+        elif line.startswith("-A "):
+            try:
+                toks = shlex.split(line)
+            except ValueError:
+                continue
+            c = get(toks[1])
+            c.rules.append(_parse_iptables_rule(toks[2:], chains))
+    return chains
+
+
+def _parse_iptables_rule(toks: list[str], chains: dict[tuple[str, str], Chain]) -> Rule:
+    rule = Rule()
+    neg = False
+    i = 0
+    module: str | None = None
+    while i < len(toks):
+        t = toks[i]
+        nxt = toks[i + 1] if i + 1 < len(toks) else ""
+        if t == "!":
+            neg = True
+            i += 1
+            continue
+        if t in ("-p", "--protocol"):
+            rule.protos = {nxt} if not neg and nxt != "all" else (None if nxt == "all" else rule.protos)
+            if neg:
+                rule.unknown = True
+            i += 2
+        elif t in ("-i", "--in-interface"):
+            rule.ifaces = [nxt.replace("+", "*")]
+            rule.iface_negate = neg
+            i += 2
+        elif t in ("-o", "--out-interface", "-d", "--destination"):
+            rule.unknown = True
+            i += 2
+        elif t in ("-s", "--source"):
+            if neg:
+                rule.unknown = True
+            else:
+                rule.sources.append(nxt)
+            i += 2
+        elif t == "-m":
+            module = nxt
+            if nxt not in _BENIGN_MODULES | {"multiport", "conntrack", "state"}:
+                rule.unknown = True
+            i += 2
+        elif t in ("--dport", "--destination-port"):
+            rule.dports = _parse_port_spec(nxt, {})
+            rule.dport_negate = neg
+            if rule.dports is None:
+                rule.unknown = True
+            i += 2
+        elif t in ("--dports", "--destination-ports"):
+            rule.dports = _parse_port_spec(nxt, {})
+            rule.dport_negate = neg
+            if rule.dports is None:
+                rule.unknown = True
+            i += 2
+        elif t in ("--ctstate", "--state"):
+            rule.new_ok = "NEW" in nxt.upper().split(",")
+            i += 2
+        elif t == "--dst-type":
+            # `-m addrtype --dst-type LOCAL` is true for traffic addressed to this host.
+            if nxt.upper() != "LOCAL" or neg:
+                rule.unknown = True
+            i += 2
+        elif t == "--comment":
+            i += 2
+        elif t in ("-j", "-g"):
+            tgt = nxt
+            if tgt in ("ACCEPT",):
+                rule.action = "accept"
+            elif tgt in ("DROP", "REJECT"):
+                rule.action = "drop"
+            elif tgt == "RETURN":
+                rule.action = "return"
+            elif ("", tgt) in chains:
+                rule.action, rule.target = ("goto" if t == "-g" else "jump"), tgt
+            else:
+                # Non-terminating targets (LOG, MARK, ...) or a chain declared
+                # later: forward references are legal only for -N-declared
+                # chains, which parse_iptables registers first.
+                rule.action = None
+            break
+        else:
+            # Unknown option: assume it takes one value and flag the rule.
+            rule.unknown = True
+            i += 2 if not nxt.startswith("-") else 1
+            continue
+        neg = False
+    # (module var kept for readability of future extensions)
+    _ = module
+    return rule
+
+
+# --------------------------------------------------------------------------- #
+# ufw parser
+# --------------------------------------------------------------------------- #
+_UFW_ROW = re.compile(
+    r"^(?P<to>.+?)\s{2,}(?P<action>ALLOW|DENY|REJECT|LIMIT)(?:\s+(?P<dir>IN|OUT|FWD))?\s+(?P<from>.+?)\s*$"
+)
+
+
+def parse_ufw(text: str) -> tuple[bool, dict[tuple[str, str], Chain]]:
+    """Return (active, chains). Chains is empty when ufw is inactive."""
+    if not re.search(r"^Status:\s*active", text, re.M | re.I):
+        return False, {}
+    policy = "drop"  # ufw's shipped default
+    m = re.search(r"^Default:\s*(\w+)\s*\(incoming\)", text, re.M | re.I)
+    if m:
+        policy = "accept" if m.group(1).lower() == "allow" else "drop"
+    # ufw lists IPv6 rows as "(v6)"; without any, assume IPv6 is not managed.
+    fam = "inet" if "(v6)" in text else "ip"
+    chain = Chain(name="ufw", hook="input", policy=policy, source="ufw", family=fam)
+    in_rows = False
+    for line in text.splitlines():
+        if line.startswith("--"):
+            in_rows = True
+            continue
+        if not in_rows:
+            continue
+        mm = _UFW_ROW.match(line.rstrip())
+        if not mm or (mm.group("dir") or "IN") != "IN":
+            continue
+        to = re.sub(r"\s*\(v6\)", "", mm.group("to")).strip()
+        frm = re.sub(r"\s*\(v6\)", "", mm.group("from")).strip()
+        rule = Rule(action="accept" if mm.group("action") in ("ALLOW", "LIMIT") else "drop")
+        iface = None
+        mi = re.search(r"\s+on\s+(\S+)$", to)
+        if mi:
+            iface, to = mi.group(1), to[:mi.start()].strip()
+        if iface:
+            rule.ifaces = [iface]
+        if to.lower() != "anywhere":
+            mp = re.fullmatch(r"([\d,:]+)(?:/(tcp|udp))?", to)
+            if not mp:
+                rule.unknown = True
+            else:
+                rule.dports = _parse_port_spec(mp.group(1).replace(":", "-"), {})
+                if mp.group(2):
+                    rule.protos = {mp.group(2)}
+        if frm.lower() != "anywhere":
+            fm = re.match(r"(\S+)(?:\s+on\s+(\S+))?$", frm)
+            if fm and fm.group(1).lower() != "anywhere":
+                rule.sources.append(fm.group(1))
+            elif fm and fm.group(2) and rule.ifaces is None:
+                rule.ifaces = [fm.group(2)]
+            else:
+                rule.unknown = True
+        chain.rules.append(rule)
+    return True, {("", "ufw"): chain}
+
+
+# --------------------------------------------------------------------------- #
+# Facade
+# --------------------------------------------------------------------------- #
+class Firewall:
+    """Parsed host firewall, built from the raw outputs of the collector commands.
+
+    Pass ``None`` for a command that failed/was unavailable and the raw text
+    (possibly empty) for one that succeeded. ``public_ifaces`` are candidate
+    internet-facing interface names (from `ip -o addr`); rule-referenced names
+    are added automatically, plus a sentinel so unscoped rules are evaluated.
+
+    Address families: a port is only reported BLOCKED when the drop is proven
+    for IPv4 AND for IPv6 (an `inet` table, or matching `ip` + `ip6` base
+    chains, or iptables + ip6tables). ``ipv6`` says whether the host has a
+    global IPv6 address: False = IPv6 need not be proven, True/None = it must.
+    A family with no readable rules yields UNKNOWN, never BLOCKED.
+    """
+
+    def __init__(self, nft: str | None = None, iptables: str | None = None,
+                 ufw: str | None = None, public_ifaces: list[str] | None = None,
+                 ip6tables: str | None = None, ipv6: bool | None = None) -> None:
+        self.sets: list[dict[tuple[str, str], Chain]] = []
+        self.sources: list[str] = []
+        self.nft_read = nft is not None
+        self.ipt_read = False
+        self.ip6t_read = False
+        if nft is not None:
+            self.sets.append(parse_nft(nft))
+            self.sources.append("nft")
+        if iptables is not None and re.search(r"^-P\s+INPUT\s", iptables, re.M):
+            self.sets.append(parse_iptables(iptables, "ip"))
+            self.sources.append("iptables")
+            self.ipt_read = True
+        if ip6tables is not None and re.search(r"^-P\s+INPUT\s", ip6tables, re.M):
+            self.sets.append(parse_iptables(ip6tables, "ip6"))
+            self.sources.append("ip6tables")
+            self.ip6t_read = True
+        if ufw is not None:
+            active, uc = parse_ufw(ufw)
+            if active:
+                self.sets.append(uc)
+                self.sources.append("ufw")
+        self._ifaces = list(public_ifaces or [])
+        self.ipv6 = ipv6
+
+    @property
+    def readable(self) -> bool:
+        return bool(self.sources)
+
+    def base_chains(self) -> list[tuple[dict[tuple[str, str], Chain], Chain]]:
+        out = []
+        for chains in self.sets:
+            out += [(chains, c) for c in chains.values() if c.hook == "input"]
+        return out
+
+    @property
+    def has_filtering(self) -> bool:
+        """True iff some input hook chain drops by policy or contains any rule."""
+        return any(c.policy == "drop" or c.rules for _, c in self.base_chains())
+
+    def known_ifaces(self) -> set[str]:
+        names = set(self._ifaces)
+        for chains in self.sets:
+            for c in chains.values():
+                for r in c.rules:
+                    for n in r.ifaces or []:
+                        if "*" not in n:
+                            names.add(n)
+        return names
+
+    def overlay_ifaces(self) -> list[str]:
+        return sorted(n for n in self.known_ifaces() if is_overlay_iface(n))
+
+    def public_candidates(self) -> list[str]:
+        names = {n for n in self.known_ifaces()
+                 if not is_loopback_iface(n) and not is_overlay_iface(n)}
+        return sorted(names) + [PUBLIC_SENTINEL]
+
+    def _families(self) -> list[str]:
+        return ["ip"] if self.ipv6 is False else ["ip", "ip6"]
+
+    def _known_open(self, fam: str) -> bool:
+        """No base chain covers `fam`, yet every place such rules could live was read."""
+        return self.nft_read and (self.ipt_read if fam == "ip" else self.ip6t_read)
+
+    def _eval_family(self, port: int, proto: str, iface: str, fam: str) -> PortVerdict | None:
+        bases = [(chains, c) for chains, c in self.base_chains() if c.family in (fam, "inet")]
+        if not bases:
+            return None
+        explicit_any = False
+        for chains, base in bases:
+            d = _eval_chain(chains, base, port, proto, iface)
+            kind = d.kind if d.kind in ("accept", "drop") else base.policy
+            if kind == "accept":
+                explicit_any = explicit_any or d.explicit
+                continue
+            if d.restricted or d.restricted_unknown:
+                return PortVerdict(Exposure.RESTRICTED, sources=sorted(set(d.restricted)),
+                                   detail=f"{base.source} {base.name}: accepted only for specific sources")
+            reason = "rule" if d.explicit else f"default policy {base.policy}"
+            return PortVerdict(Exposure.BLOCKED, detail=f"{base.source} {base.name} drops via {reason}")
+        return PortVerdict(Exposure.ACCEPTED, explicit_any,
+                           detail="accepted by explicit rule" if explicit_any else "accepted by default policy")
+
+    def evaluate_iface(self, port: int, proto: str, iface: str) -> PortVerdict:
+        if not self.readable:
+            return PortVerdict(Exposure.UNKNOWN, detail="no readable firewall")
+        results: list[PortVerdict] = []
+        uncovered: list[str] = []
+        for fam in self._families():
+            v = self._eval_family(port, proto, iface, fam)
+            if v is not None:
+                results.append(v)
+            elif self._known_open(fam):
+                results.append(PortVerdict(Exposure.ACCEPTED, False, detail="no input filtering configured"))
+            else:
+                uncovered.append("IPv4" if fam == "ip" else "IPv6")
+        for v in results:
+            if v.state == Exposure.ACCEPTED:
+                return v
+        if uncovered:
+            return PortVerdict(
+                Exposure.UNKNOWN,
+                detail=f"no readable {'/'.join(uncovered)} filtering rules; a drop in the other family proves nothing",
+            )
+        for v in results:
+            if v.state == Exposure.RESTRICTED:
+                return v
+        return results[0]
+
+    def evaluate(self, port: int, proto: str = "tcp") -> PortVerdict:
+        """Is a NEW inbound connection to port from any public interface accepted?"""
+        if not self.readable:
+            return PortVerdict(Exposure.UNKNOWN, detail="no readable firewall")
+        results = [self.evaluate_iface(port, proto, i) for i in self.public_candidates()]
+        for want in (Exposure.ACCEPTED, Exposure.UNKNOWN, Exposure.RESTRICTED):
+            hits = [r for r in results if r.state == want]
+            if hits:
+                if want == Exposure.RESTRICTED:
+                    srcs = sorted({s for r in hits for s in r.sources})
+                    return PortVerdict(want, sources=srcs, detail=hits[0].detail)
+                return hits[0]
+        return results[0]
+
+    def reachable_via_overlay(self, port: int, proto: str = "tcp") -> list[str]:
+        """Overlay interfaces on which the port is accepted."""
+        return [i for i in self.overlay_ifaces()
+                if self.evaluate_iface(port, proto, i).state == Exposure.ACCEPTED]