feat: initial commit

internal/server/ufw.go

@@ -0,0 +1,119 @@
+package server
+
+import (
+	"fmt"
+	"log"
+	"os/exec"
+	"strings"
+)
+
+// ufwManager integrates with the host firewall (ufw) when it is installed and
+// active. Opening a forward port in the panel also opens it in ufw; the created
+// rules are tracked so they can be listed and revoked from Settings.
+//
+// ufw requires root, so this only works when the server process can run ufw
+// (e.g. running as root). When it cannot, integration is simply inactive.
+type ufwManager struct {
+	db         *DB
+	tunnelPort int
+}
+
+func newUfwManager(db *DB, tunnelPort int) *ufwManager {
+	return &ufwManager{db: db, tunnelPort: tunnelPort}
+}
+
+// status reports whether ufw is installed, active, and runnable by this process.
+func (u *ufwManager) status() (installed, active, runnable bool) {
+	path, err := exec.LookPath("ufw")
+	if err != nil {
+		return false, false, false
+	}
+	installed = true
+	out, err := exec.Command(path, "status").CombinedOutput()
+	if err != nil {
+		// Typically a permission error (not root) -> not runnable.
+		return true, false, false
+	}
+	runnable = true
+	active = strings.Contains(string(out), "Status: active")
+	return installed, active, runnable
+}
+
+// available reports whether we can and should drive ufw now.
+func (u *ufwManager) available() bool {
+	if !u.db.UfwEnabled() {
+		return false
+	}
+	installed, active, runnable := u.status()
+	return installed && active && runnable
+}
+
+// allow opens port/proto in ufw (if integration is available) and records it,
+// bound to the given forward rule id (0 = shared/manual).
+func (u *ufwManager) allow(port int, proto string, ruleID int64) {
+	if !u.available() {
+		return
+	}
+	if u.db.HasUfwRule(port, proto) {
+		return
+	}
+	spec := fmt.Sprintf("%d/%s", port, proto)
+	if out, err := exec.Command("ufw", "allow", spec).CombinedOutput(); err != nil {
+		log.Printf("ufw allow %s: %v: %s", spec, err, strings.TrimSpace(string(out)))
+		return
+	}
+	_ = u.db.AddUfwRule(port, proto, ruleID)
+	log.Printf("ufw: allowed %s", spec)
+}
+
+// revokeRule deletes one tracked ufw rule from ufw and the tracking table.
+func (u *ufwManager) revokeRule(r UfwRule) {
+	spec := fmt.Sprintf("%d/%s", r.Port, r.Proto)
+	if out, err := exec.Command("ufw", "delete", "allow", spec).CombinedOutput(); err != nil {
+		log.Printf("ufw delete allow %s: %v: %s", spec, err, strings.TrimSpace(string(out)))
+	} else {
+		log.Printf("ufw: revoked %s", spec)
+	}
+	_ = u.db.DeleteUfwRule(r.ID)
+}
+
+// revoke removes a ufw rule by its tracking id (manual revoke from Settings).
+func (u *ufwManager) revoke(id int64) {
+	r, err := u.db.GetUfwRule(id)
+	if err != nil || r == nil {
+		return
+	}
+	u.revokeRule(*r)
+}
+
+// revokeForRule removes the ufw rules bound to a specific forward rule. The
+// shared tunnel port (rule_id 0) is left alone, since other forwards use it.
+func (u *ufwManager) revokeForRule(ruleID int64) {
+	rules, err := u.db.ListUfwRulesByRule(ruleID)
+	if err != nil {
+		return
+	}
+	for _, r := range rules {
+		u.revokeRule(r)
+	}
+}
+
+// allowForward opens the host ports a forward rule needs: its host port (bound
+// to the rule so it is revoked with it) plus the shared 8446 tunnel port for
+// direct tcp/udp modes (bound to 0 — shared across rules).
+func (u *ufwManager) allowForward(rule ForwardRule) {
+	switch rule.Proto {
+	case "udp":
+		u.allow(rule.HostPort, "udp", rule.ID)
+		if u.tunnelPort > 0 {
+			u.allow(u.tunnelPort, "udp", 0)
+		}
+	case "tcp":
+		u.allow(rule.HostPort, "tcp", rule.ID)
+		if u.tunnelPort > 0 {
+			u.allow(u.tunnelPort, "tcp", 0)
+		}
+	default: // http long-poll listener is TCP
+		u.allow(rule.HostPort, "tcp", rule.ID)
+	}
+}