289 lines
7.6 KiB
Go
289 lines
7.6 KiB
Go
package app
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"sort"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
// ---------------------------------------------------------------------
|
|
// traffic audit (sanity checks / duplicates / nft consistency)
|
|
// ---------------------------------------------------------------------
|
|
//
|
|
// EN: Provides a pragmatic sanity-check endpoint for troubleshooting.
|
|
// EN: We check:
|
|
// EN: - traffic mode health (evaluateTrafficMode)
|
|
// EN: - runtime marks duplicates (target+app_key)
|
|
// EN: - nft chain consistency (state <-> output_apps rules)
|
|
// RU: Практичный sanity-check эндпоинт для диагностики.
|
|
// RU: Проверяем:
|
|
// RU: - health traffic mode (evaluateTrafficMode)
|
|
// RU: - дубли runtime marks (target+app_key)
|
|
// RU: - консистентность nft chain (state <-> output_apps rules)
|
|
|
|
func handleTrafficAudit(w http.ResponseWriter, r *http.Request) {
|
|
if r.Method != http.MethodGet {
|
|
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
|
return
|
|
}
|
|
|
|
now := time.Now().UTC().Format(time.RFC3339)
|
|
|
|
// 1) Traffic mode status (includes route probe).
|
|
traffic := evaluateTrafficMode(loadTrafficModeState())
|
|
|
|
// 2) Profiles (persistent) duplicates by (target, app_key).
|
|
profiles := listTrafficAppProfiles()
|
|
profDups := findProfileDuplicates(profiles)
|
|
|
|
// 3) Runtime marks state + duplicates.
|
|
_ = pruneExpiredAppMarks()
|
|
appMarksMu.Lock()
|
|
marksSt := loadAppMarksState()
|
|
appMarksMu.Unlock()
|
|
|
|
markDups := findMarkDuplicates(marksSt.Items)
|
|
|
|
// 4) nft output_apps rules check (state <-> nft).
|
|
nftIssues, nftSummary := auditNftAppMarks(marksSt.Items)
|
|
|
|
issues := []string{}
|
|
if !traffic.Healthy {
|
|
issues = append(issues, "traffic_mode_unhealthy: "+strings.TrimSpace(traffic.Message))
|
|
}
|
|
for _, d := range profDups {
|
|
issues = append(issues, "profile_duplicate: "+d)
|
|
}
|
|
for _, d := range markDups {
|
|
issues = append(issues, "mark_duplicate: "+d)
|
|
}
|
|
issues = append(issues, nftIssues...)
|
|
|
|
ok := true
|
|
for _, it := range issues {
|
|
if strings.HasPrefix(it, "traffic_mode_unhealthy:") ||
|
|
strings.HasPrefix(it, "nft_error:") ||
|
|
strings.HasPrefix(it, "nft_missing_rule:") {
|
|
ok = false
|
|
break
|
|
}
|
|
}
|
|
|
|
pretty := buildTrafficAuditPretty(now, traffic, profiles, marksSt.Items, issues, nftSummary)
|
|
|
|
writeJSON(w, http.StatusOK, map[string]any{
|
|
"ok": ok,
|
|
"now": now,
|
|
"message": "ok",
|
|
"pretty": pretty,
|
|
"traffic": traffic,
|
|
"counts": map[string]any{
|
|
"profiles": len(profiles),
|
|
"marks": len(marksSt.Items),
|
|
},
|
|
"issues": issues,
|
|
"nft": nftSummary,
|
|
})
|
|
}
|
|
|
|
func findProfileDuplicates(profiles []TrafficAppProfile) []string {
|
|
seen := map[string]int{}
|
|
for _, p := range profiles {
|
|
tgt := strings.ToLower(strings.TrimSpace(p.Target))
|
|
key := strings.TrimSpace(p.AppKey)
|
|
if tgt == "" || key == "" {
|
|
continue
|
|
}
|
|
seen[tgt+"|"+key]++
|
|
}
|
|
var out []string
|
|
for k, n := range seen {
|
|
if n > 1 {
|
|
out = append(out, fmt.Sprintf("%s x%d", k, n))
|
|
}
|
|
}
|
|
sort.Strings(out)
|
|
return out
|
|
}
|
|
|
|
func findMarkDuplicates(items []appMarkItem) []string {
|
|
seen := map[string]int{}
|
|
for _, it := range items {
|
|
tgt := strings.ToLower(strings.TrimSpace(it.Target))
|
|
key := strings.TrimSpace(it.AppKey)
|
|
if tgt == "" || key == "" {
|
|
continue
|
|
}
|
|
seen[tgt+"|"+key]++
|
|
}
|
|
var out []string
|
|
for k, n := range seen {
|
|
if n > 1 {
|
|
out = append(out, fmt.Sprintf("%s x%d", k, n))
|
|
}
|
|
}
|
|
sort.Strings(out)
|
|
return out
|
|
}
|
|
|
|
func auditNftAppMarks(state []appMarkItem) (issues []string, summary map[string]any) {
|
|
summary = map[string]any{
|
|
"output_jump_ok": false,
|
|
"output_apps_ok": false,
|
|
"state_items": len(state),
|
|
"nft_rules": 0,
|
|
"missing_rules": 0,
|
|
"orphan_rules": 0,
|
|
"missing_rule_ids": []string{},
|
|
"orphan_rule_ids": []string{},
|
|
}
|
|
|
|
// Check output -> jump output_apps.
|
|
outOutput, _, codeOut, errOut := runCommandTimeout(3*time.Second, "nft", "list", "chain", "inet", appMarksTable, "output")
|
|
if errOut != nil || codeOut != 0 {
|
|
issues = append(issues, "nft_error: failed to read chain output")
|
|
} else {
|
|
ok := strings.Contains(outOutput, "jump "+appMarksChain)
|
|
summary["output_jump_ok"] = ok
|
|
if !ok {
|
|
issues = append(issues, "nft_missing_jump: output -> output_apps")
|
|
}
|
|
}
|
|
|
|
outApps, _, codeApps, errApps := runCommandTimeout(3*time.Second, "nft", "-a", "list", "chain", "inet", appMarksTable, appMarksChain)
|
|
if errApps != nil || codeApps != 0 {
|
|
issues = append(issues, "nft_error: failed to read chain output_apps")
|
|
return issues, summary
|
|
}
|
|
summary["output_apps_ok"] = true
|
|
|
|
rules := parseAppMarkRules(outApps)
|
|
summary["nft_rules"] = len(rules)
|
|
|
|
stateIDs := map[string]struct{}{}
|
|
for _, it := range state {
|
|
tgt := strings.ToLower(strings.TrimSpace(it.Target))
|
|
if tgt != "vpn" && tgt != "direct" {
|
|
continue
|
|
}
|
|
if it.ID == 0 {
|
|
continue
|
|
}
|
|
stateIDs[fmt.Sprintf("%s:%d", tgt, it.ID)] = struct{}{}
|
|
}
|
|
|
|
ruleIDs := map[string]struct{}{}
|
|
for _, k := range rules {
|
|
ruleIDs[k] = struct{}{}
|
|
}
|
|
|
|
missing := []string{}
|
|
for k := range stateIDs {
|
|
if _, ok := ruleIDs[k]; !ok {
|
|
missing = append(missing, k)
|
|
}
|
|
}
|
|
orphan := []string{}
|
|
for k := range ruleIDs {
|
|
if _, ok := stateIDs[k]; !ok {
|
|
orphan = append(orphan, k)
|
|
}
|
|
}
|
|
sort.Strings(missing)
|
|
sort.Strings(orphan)
|
|
|
|
summary["missing_rules"] = len(missing)
|
|
summary["orphan_rules"] = len(orphan)
|
|
summary["missing_rule_ids"] = missing
|
|
summary["orphan_rule_ids"] = orphan
|
|
|
|
for _, k := range missing {
|
|
issues = append(issues, "nft_missing_rule: "+k)
|
|
}
|
|
for _, k := range orphan {
|
|
issues = append(issues, "nft_orphan_rule: "+k)
|
|
}
|
|
|
|
return issues, summary
|
|
}
|
|
|
|
// parseAppMarkRules extracts "target:id" keys from output_apps chain dump.
|
|
func parseAppMarkRules(out string) []string {
|
|
var keys []string
|
|
for _, line := range strings.Split(out, "\n") {
|
|
// comment "svpn_appmark:vpn:123"
|
|
i := strings.Index(line, appMarkCommentPrefix+":")
|
|
if i < 0 {
|
|
continue
|
|
}
|
|
rest := line[i:]
|
|
end := len(rest)
|
|
for j := 0; j < len(rest); j++ {
|
|
ch := rest[j]
|
|
if ch == '"' || ch == ' ' || ch == '\t' {
|
|
end = j
|
|
break
|
|
}
|
|
}
|
|
tag := rest[:end]
|
|
parts := strings.Split(tag, ":")
|
|
if len(parts) != 3 {
|
|
continue
|
|
}
|
|
tgt := strings.ToLower(strings.TrimSpace(parts[1]))
|
|
idRaw := strings.TrimSpace(parts[2])
|
|
if tgt != "vpn" && tgt != "direct" {
|
|
continue
|
|
}
|
|
id, err := strconv.ParseUint(idRaw, 10, 64)
|
|
if err != nil || id == 0 {
|
|
continue
|
|
}
|
|
keys = append(keys, fmt.Sprintf("%s:%d", tgt, id))
|
|
}
|
|
sort.Strings(keys)
|
|
// Dedup.
|
|
outKeys := keys[:0]
|
|
var last string
|
|
for _, k := range keys {
|
|
if k == last {
|
|
continue
|
|
}
|
|
outKeys = append(outKeys, k)
|
|
last = k
|
|
}
|
|
return outKeys
|
|
}
|
|
|
|
func buildTrafficAuditPretty(now string, traffic TrafficModeStatusResponse, profiles []TrafficAppProfile, marks []appMarkItem, issues []string, nft map[string]any) string {
|
|
var b strings.Builder
|
|
b.WriteString("Traffic audit\n")
|
|
b.WriteString("now=" + now + "\n\n")
|
|
|
|
b.WriteString("traffic: desired=" + string(traffic.DesiredMode) + " applied=" + string(traffic.AppliedMode) + " iface=" + strings.TrimSpace(traffic.ActiveIface) + " healthy=" + strconv.FormatBool(traffic.Healthy) + "\n")
|
|
if strings.TrimSpace(traffic.Message) != "" {
|
|
b.WriteString("traffic_message: " + strings.TrimSpace(traffic.Message) + "\n")
|
|
}
|
|
b.WriteString("\n")
|
|
|
|
b.WriteString(fmt.Sprintf("profiles=%d marks=%d\n", len(profiles), len(marks)))
|
|
if nft != nil {
|
|
b.WriteString(fmt.Sprintf("nft: rules=%v missing=%v orphan=%v jump_ok=%v\n",
|
|
nft["nft_rules"], nft["missing_rules"], nft["orphan_rules"], nft["output_jump_ok"]))
|
|
}
|
|
b.WriteString("\n")
|
|
|
|
if len(issues) == 0 {
|
|
b.WriteString("issues: none\n")
|
|
return b.String()
|
|
}
|
|
b.WriteString("issues:\n")
|
|
for _, it := range issues {
|
|
b.WriteString("- " + it + "\n")
|
|
}
|
|
return b.String()
|
|
}
|