Add SQLite persistence and write-through gRPC mutations
Database (internal/db) stores listeners, routes, and firewall rules with WAL mode, foreign keys, and idempotent migrations. First run seeds from TOML config; subsequent runs load from DB as source of truth. gRPC admin API now writes to the database before updating in-memory state (write-through cache pattern). Adds snapshot command for VACUUM INTO backups. Refactors firewall.New to accept raw rule slices instead of config struct for flexibility. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -10,12 +10,17 @@ import (
|
||||
|
||||
type Config struct {
|
||||
Listeners []Listener `toml:"listeners"`
|
||||
Database Database `toml:"database"`
|
||||
GRPC GRPC `toml:"grpc"`
|
||||
Firewall Firewall `toml:"firewall"`
|
||||
Proxy Proxy `toml:"proxy"`
|
||||
Log Log `toml:"log"`
|
||||
}
|
||||
|
||||
type Database struct {
|
||||
Path string `toml:"path"`
|
||||
}
|
||||
|
||||
type GRPC struct {
|
||||
Addr string `toml:"addr"`
|
||||
TLSCert string `toml:"tls_cert"`
|
||||
@@ -80,18 +85,15 @@ func Load(path string) (*Config, error) {
|
||||
}
|
||||
|
||||
func (c *Config) validate() error {
|
||||
if len(c.Listeners) == 0 {
|
||||
return fmt.Errorf("at least one listener is required")
|
||||
if c.Database.Path == "" {
|
||||
return fmt.Errorf("database.path is required")
|
||||
}
|
||||
|
||||
// Validate listeners if provided (used for seeding on first run).
|
||||
for i, l := range c.Listeners {
|
||||
if l.Addr == "" {
|
||||
return fmt.Errorf("listener %d: addr is required", i)
|
||||
}
|
||||
if len(l.Routes) == 0 {
|
||||
return fmt.Errorf("listener %d (%s): at least one route is required", i, l.Addr)
|
||||
}
|
||||
|
||||
seen := make(map[string]bool)
|
||||
for j, r := range l.Routes {
|
||||
if r.Hostname == "" {
|
||||
|
||||
@@ -11,6 +11,9 @@ func TestLoadValid(t *testing.T) {
|
||||
path := filepath.Join(dir, "test.toml")
|
||||
|
||||
data := `
|
||||
[database]
|
||||
path = "/tmp/test.db"
|
||||
|
||||
[[listeners]]
|
||||
addr = ":443"
|
||||
|
||||
@@ -49,11 +52,37 @@ level = "info"
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadNoListeners(t *testing.T) {
|
||||
func TestLoadNoDatabasePath(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
path := filepath.Join(dir, "test.toml")
|
||||
|
||||
data := `
|
||||
[[listeners]]
|
||||
addr = ":443"
|
||||
|
||||
[[listeners.routes]]
|
||||
hostname = "example.com"
|
||||
backend = "127.0.0.1:8443"
|
||||
`
|
||||
if err := os.WriteFile(path, []byte(data), 0600); err != nil {
|
||||
t.Fatalf("write config: %v", err)
|
||||
}
|
||||
|
||||
_, err := Load(path)
|
||||
if err == nil {
|
||||
t.Fatal("expected error for missing database path")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadNoListenersValid(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
path := filepath.Join(dir, "test.toml")
|
||||
|
||||
// No listeners is valid — DB may already have them.
|
||||
data := `
|
||||
[database]
|
||||
path = "/tmp/test.db"
|
||||
|
||||
[log]
|
||||
level = "info"
|
||||
`
|
||||
@@ -62,26 +91,8 @@ level = "info"
|
||||
}
|
||||
|
||||
_, err := Load(path)
|
||||
if err == nil {
|
||||
t.Fatal("expected error for missing listeners")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadNoRoutes(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
path := filepath.Join(dir, "test.toml")
|
||||
|
||||
data := `
|
||||
[[listeners]]
|
||||
addr = ":443"
|
||||
`
|
||||
if err := os.WriteFile(path, []byte(data), 0600); err != nil {
|
||||
t.Fatalf("write config: %v", err)
|
||||
}
|
||||
|
||||
_, err := Load(path)
|
||||
if err == nil {
|
||||
t.Fatal("expected error for missing routes")
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -90,6 +101,9 @@ func TestLoadDuplicateHostnames(t *testing.T) {
|
||||
path := filepath.Join(dir, "test.toml")
|
||||
|
||||
data := `
|
||||
[database]
|
||||
path = "/tmp/test.db"
|
||||
|
||||
[[listeners]]
|
||||
addr = ":443"
|
||||
|
||||
@@ -116,6 +130,9 @@ func TestLoadGeoIPRequiredWithCountries(t *testing.T) {
|
||||
path := filepath.Join(dir, "test.toml")
|
||||
|
||||
data := `
|
||||
[database]
|
||||
path = "/tmp/test.db"
|
||||
|
||||
[[listeners]]
|
||||
addr = ":443"
|
||||
|
||||
@@ -141,6 +158,9 @@ func TestLoadMultipleListeners(t *testing.T) {
|
||||
path := filepath.Join(dir, "test.toml")
|
||||
|
||||
data := `
|
||||
[database]
|
||||
path = "/tmp/test.db"
|
||||
|
||||
[[listeners]]
|
||||
addr = ":443"
|
||||
|
||||
|
||||
63
internal/db/db.go
Normal file
63
internal/db/db.go
Normal file
@@ -0,0 +1,63 @@
|
||||
package db
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
_ "modernc.org/sqlite"
|
||||
)
|
||||
|
||||
// Store wraps a SQLite database connection for mc-proxy persistence.
|
||||
type Store struct {
|
||||
db *sql.DB
|
||||
}
|
||||
|
||||
// Open opens (or creates) the SQLite database at path with WAL mode,
|
||||
// foreign keys, and a busy timeout. The file is created with 0600 permissions.
|
||||
func Open(path string) (*Store, error) {
|
||||
// Ensure the file has restrictive permissions if it doesn't exist.
|
||||
if _, err := os.Stat(path); os.IsNotExist(err) {
|
||||
f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0600)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("creating database file: %w", err)
|
||||
}
|
||||
f.Close()
|
||||
}
|
||||
|
||||
db, err := sql.Open("sqlite", path)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("opening database: %w", err)
|
||||
}
|
||||
|
||||
// Apply connection pragmas.
|
||||
pragmas := []string{
|
||||
"PRAGMA journal_mode = WAL",
|
||||
"PRAGMA foreign_keys = ON",
|
||||
"PRAGMA busy_timeout = 5000",
|
||||
}
|
||||
for _, p := range pragmas {
|
||||
if _, err := db.Exec(p); err != nil {
|
||||
db.Close()
|
||||
return nil, fmt.Errorf("setting pragma %q: %w", p, err)
|
||||
}
|
||||
}
|
||||
|
||||
return &Store{db: db}, nil
|
||||
}
|
||||
|
||||
// Close closes the database connection.
|
||||
func (s *Store) Close() error {
|
||||
return s.db.Close()
|
||||
}
|
||||
|
||||
// IsEmpty returns true if the listeners table has no rows.
|
||||
// Used to determine if the database needs seeding from config.
|
||||
func (s *Store) IsEmpty() (bool, error) {
|
||||
var count int
|
||||
err := s.db.QueryRow("SELECT COUNT(*) FROM listeners").Scan(&count)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
return count == 0, nil
|
||||
}
|
||||
331
internal/db/db_test.go
Normal file
331
internal/db/db_test.go
Normal file
@@ -0,0 +1,331 @@
|
||||
package db
|
||||
|
||||
import (
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"git.wntrmute.dev/kyle/mc-proxy/internal/config"
|
||||
)
|
||||
|
||||
func openTestDB(t *testing.T) *Store {
|
||||
t.Helper()
|
||||
dir := t.TempDir()
|
||||
store, err := Open(filepath.Join(dir, "test.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open: %v", err)
|
||||
}
|
||||
if err := store.Migrate(); err != nil {
|
||||
t.Fatalf("migrate: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { store.Close() })
|
||||
return store
|
||||
}
|
||||
|
||||
func TestMigrate(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
// Running migrate again should be idempotent.
|
||||
if err := store.Migrate(); err != nil {
|
||||
t.Fatalf("second migrate: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIsEmpty(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
empty, err := store.IsEmpty()
|
||||
if err != nil {
|
||||
t.Fatalf("is empty: %v", err)
|
||||
}
|
||||
if !empty {
|
||||
t.Fatal("expected empty database")
|
||||
}
|
||||
|
||||
if _, err := store.CreateListener(":443"); err != nil {
|
||||
t.Fatalf("create listener: %v", err)
|
||||
}
|
||||
|
||||
empty, err = store.IsEmpty()
|
||||
if err != nil {
|
||||
t.Fatalf("is empty: %v", err)
|
||||
}
|
||||
if empty {
|
||||
t.Fatal("expected non-empty database")
|
||||
}
|
||||
}
|
||||
|
||||
func TestListenerCRUD(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
id, err := store.CreateListener(":443")
|
||||
if err != nil {
|
||||
t.Fatalf("create: %v", err)
|
||||
}
|
||||
if id == 0 {
|
||||
t.Fatal("expected non-zero ID")
|
||||
}
|
||||
|
||||
listeners, err := store.ListListeners()
|
||||
if err != nil {
|
||||
t.Fatalf("list: %v", err)
|
||||
}
|
||||
if len(listeners) != 1 {
|
||||
t.Fatalf("got %d listeners, want 1", len(listeners))
|
||||
}
|
||||
if listeners[0].Addr != ":443" {
|
||||
t.Fatalf("got addr %q, want %q", listeners[0].Addr, ":443")
|
||||
}
|
||||
|
||||
l, err := store.GetListenerByAddr(":443")
|
||||
if err != nil {
|
||||
t.Fatalf("get by addr: %v", err)
|
||||
}
|
||||
if l.ID != id {
|
||||
t.Fatalf("got ID %d, want %d", l.ID, id)
|
||||
}
|
||||
|
||||
if err := store.DeleteListener(id); err != nil {
|
||||
t.Fatalf("delete: %v", err)
|
||||
}
|
||||
|
||||
listeners, err = store.ListListeners()
|
||||
if err != nil {
|
||||
t.Fatalf("list after delete: %v", err)
|
||||
}
|
||||
if len(listeners) != 0 {
|
||||
t.Fatalf("got %d listeners after delete, want 0", len(listeners))
|
||||
}
|
||||
}
|
||||
|
||||
func TestListenerDuplicateAddr(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
if _, err := store.CreateListener(":443"); err != nil {
|
||||
t.Fatalf("first create: %v", err)
|
||||
}
|
||||
if _, err := store.CreateListener(":443"); err == nil {
|
||||
t.Fatal("expected error for duplicate addr")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRouteCRUD(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
listenerID, err := store.CreateListener(":443")
|
||||
if err != nil {
|
||||
t.Fatalf("create listener: %v", err)
|
||||
}
|
||||
|
||||
routeID, err := store.CreateRoute(listenerID, "example.com", "127.0.0.1:8443")
|
||||
if err != nil {
|
||||
t.Fatalf("create route: %v", err)
|
||||
}
|
||||
if routeID == 0 {
|
||||
t.Fatal("expected non-zero route ID")
|
||||
}
|
||||
|
||||
routes, err := store.ListRoutes(listenerID)
|
||||
if err != nil {
|
||||
t.Fatalf("list routes: %v", err)
|
||||
}
|
||||
if len(routes) != 1 {
|
||||
t.Fatalf("got %d routes, want 1", len(routes))
|
||||
}
|
||||
if routes[0].Hostname != "example.com" {
|
||||
t.Fatalf("got hostname %q, want %q", routes[0].Hostname, "example.com")
|
||||
}
|
||||
|
||||
if err := store.DeleteRoute(listenerID, "example.com"); err != nil {
|
||||
t.Fatalf("delete route: %v", err)
|
||||
}
|
||||
|
||||
routes, err = store.ListRoutes(listenerID)
|
||||
if err != nil {
|
||||
t.Fatalf("list after delete: %v", err)
|
||||
}
|
||||
if len(routes) != 0 {
|
||||
t.Fatalf("got %d routes after delete, want 0", len(routes))
|
||||
}
|
||||
}
|
||||
|
||||
func TestRouteDuplicateHostname(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
listenerID, _ := store.CreateListener(":443")
|
||||
if _, err := store.CreateRoute(listenerID, "example.com", "127.0.0.1:8443"); err != nil {
|
||||
t.Fatalf("first create: %v", err)
|
||||
}
|
||||
if _, err := store.CreateRoute(listenerID, "example.com", "127.0.0.1:9443"); err == nil {
|
||||
t.Fatal("expected error for duplicate hostname on same listener")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRouteCascadeDelete(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
listenerID, _ := store.CreateListener(":443")
|
||||
store.CreateRoute(listenerID, "a.example.com", "127.0.0.1:8443")
|
||||
store.CreateRoute(listenerID, "b.example.com", "127.0.0.1:9443")
|
||||
|
||||
if err := store.DeleteListener(listenerID); err != nil {
|
||||
t.Fatalf("delete listener: %v", err)
|
||||
}
|
||||
|
||||
routes, err := store.ListRoutes(listenerID)
|
||||
if err != nil {
|
||||
t.Fatalf("list routes: %v", err)
|
||||
}
|
||||
if len(routes) != 0 {
|
||||
t.Fatalf("got %d routes after cascade delete, want 0", len(routes))
|
||||
}
|
||||
}
|
||||
|
||||
func TestFirewallRuleCRUD(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
id, err := store.CreateFirewallRule("ip", "192.0.2.1")
|
||||
if err != nil {
|
||||
t.Fatalf("create: %v", err)
|
||||
}
|
||||
if id == 0 {
|
||||
t.Fatal("expected non-zero ID")
|
||||
}
|
||||
|
||||
if _, err := store.CreateFirewallRule("cidr", "198.51.100.0/24"); err != nil {
|
||||
t.Fatalf("create cidr: %v", err)
|
||||
}
|
||||
if _, err := store.CreateFirewallRule("country", "CN"); err != nil {
|
||||
t.Fatalf("create country: %v", err)
|
||||
}
|
||||
|
||||
rules, err := store.ListFirewallRules()
|
||||
if err != nil {
|
||||
t.Fatalf("list: %v", err)
|
||||
}
|
||||
if len(rules) != 3 {
|
||||
t.Fatalf("got %d rules, want 3", len(rules))
|
||||
}
|
||||
|
||||
if err := store.DeleteFirewallRule("ip", "192.0.2.1"); err != nil {
|
||||
t.Fatalf("delete: %v", err)
|
||||
}
|
||||
|
||||
rules, err = store.ListFirewallRules()
|
||||
if err != nil {
|
||||
t.Fatalf("list after delete: %v", err)
|
||||
}
|
||||
if len(rules) != 2 {
|
||||
t.Fatalf("got %d rules after delete, want 2", len(rules))
|
||||
}
|
||||
}
|
||||
|
||||
func TestFirewallRuleDuplicate(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
if _, err := store.CreateFirewallRule("ip", "192.0.2.1"); err != nil {
|
||||
t.Fatalf("first create: %v", err)
|
||||
}
|
||||
if _, err := store.CreateFirewallRule("ip", "192.0.2.1"); err == nil {
|
||||
t.Fatal("expected error for duplicate rule")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSeed(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
listeners := []config.Listener{
|
||||
{
|
||||
Addr: ":443",
|
||||
Routes: []config.Route{
|
||||
{Hostname: "a.example.com", Backend: "127.0.0.1:8443"},
|
||||
{Hostname: "b.example.com", Backend: "127.0.0.1:9443"},
|
||||
},
|
||||
},
|
||||
{
|
||||
Addr: ":8443",
|
||||
Routes: []config.Route{
|
||||
{Hostname: "c.example.com", Backend: "127.0.0.1:18443"},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
fw := config.Firewall{
|
||||
BlockedIPs: []string{"192.0.2.1"},
|
||||
BlockedCIDRs: []string{"198.51.100.0/24"},
|
||||
BlockedCountries: []string{"cn", "KP"},
|
||||
}
|
||||
|
||||
if err := store.Seed(listeners, fw); err != nil {
|
||||
t.Fatalf("seed: %v", err)
|
||||
}
|
||||
|
||||
dbListeners, err := store.ListListeners()
|
||||
if err != nil {
|
||||
t.Fatalf("list listeners: %v", err)
|
||||
}
|
||||
if len(dbListeners) != 2 {
|
||||
t.Fatalf("got %d listeners, want 2", len(dbListeners))
|
||||
}
|
||||
|
||||
routes, err := store.ListRoutes(dbListeners[0].ID)
|
||||
if err != nil {
|
||||
t.Fatalf("list routes: %v", err)
|
||||
}
|
||||
if len(routes) != 2 {
|
||||
t.Fatalf("got %d routes for listener 0, want 2", len(routes))
|
||||
}
|
||||
|
||||
rules, err := store.ListFirewallRules()
|
||||
if err != nil {
|
||||
t.Fatalf("list firewall rules: %v", err)
|
||||
}
|
||||
if len(rules) != 4 {
|
||||
t.Fatalf("got %d firewall rules, want 4", len(rules))
|
||||
}
|
||||
}
|
||||
|
||||
func TestSnapshot(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
store.CreateListener(":443")
|
||||
|
||||
dest := filepath.Join(t.TempDir(), "backup.db")
|
||||
if err := store.Snapshot(dest); err != nil {
|
||||
t.Fatalf("snapshot: %v", err)
|
||||
}
|
||||
|
||||
// Open the snapshot and verify.
|
||||
backup, err := Open(dest)
|
||||
if err != nil {
|
||||
t.Fatalf("open backup: %v", err)
|
||||
}
|
||||
defer backup.Close()
|
||||
|
||||
if err := backup.Migrate(); err != nil {
|
||||
t.Fatalf("migrate backup: %v", err)
|
||||
}
|
||||
|
||||
listeners, err := backup.ListListeners()
|
||||
if err != nil {
|
||||
t.Fatalf("list from backup: %v", err)
|
||||
}
|
||||
if len(listeners) != 1 {
|
||||
t.Fatalf("backup has %d listeners, want 1", len(listeners))
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeleteNonexistent(t *testing.T) {
|
||||
store := openTestDB(t)
|
||||
|
||||
if err := store.DeleteListener(999); err == nil {
|
||||
t.Fatal("expected error deleting nonexistent listener")
|
||||
}
|
||||
|
||||
if err := store.DeleteRoute(999, "example.com"); err == nil {
|
||||
t.Fatal("expected error deleting nonexistent route")
|
||||
}
|
||||
|
||||
if err := store.DeleteFirewallRule("ip", "1.2.3.4"); err == nil {
|
||||
t.Fatal("expected error deleting nonexistent firewall rule")
|
||||
}
|
||||
}
|
||||
57
internal/db/firewall.go
Normal file
57
internal/db/firewall.go
Normal file
@@ -0,0 +1,57 @@
|
||||
package db
|
||||
|
||||
import "fmt"
|
||||
|
||||
// FirewallRule is a database firewall rule record.
|
||||
type FirewallRule struct {
|
||||
ID int64
|
||||
Type string // "ip", "cidr", "country"
|
||||
Value string
|
||||
}
|
||||
|
||||
// ListFirewallRules returns all firewall rules.
|
||||
func (s *Store) ListFirewallRules() ([]FirewallRule, error) {
|
||||
rows, err := s.db.Query("SELECT id, type, value FROM firewall_rules ORDER BY type, value")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("querying firewall rules: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var rules []FirewallRule
|
||||
for rows.Next() {
|
||||
var r FirewallRule
|
||||
if err := rows.Scan(&r.ID, &r.Type, &r.Value); err != nil {
|
||||
return nil, fmt.Errorf("scanning firewall rule: %w", err)
|
||||
}
|
||||
rules = append(rules, r)
|
||||
}
|
||||
return rules, rows.Err()
|
||||
}
|
||||
|
||||
// CreateFirewallRule inserts a firewall rule and returns its ID.
|
||||
func (s *Store) CreateFirewallRule(ruleType, value string) (int64, error) {
|
||||
result, err := s.db.Exec(
|
||||
"INSERT INTO firewall_rules (type, value) VALUES (?, ?)",
|
||||
ruleType, value,
|
||||
)
|
||||
if err != nil {
|
||||
return 0, fmt.Errorf("inserting firewall rule: %w", err)
|
||||
}
|
||||
return result.LastInsertId()
|
||||
}
|
||||
|
||||
// DeleteFirewallRule deletes a firewall rule by type and value.
|
||||
func (s *Store) DeleteFirewallRule(ruleType, value string) error {
|
||||
result, err := s.db.Exec(
|
||||
"DELETE FROM firewall_rules WHERE type = ? AND value = ?",
|
||||
ruleType, value,
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("deleting firewall rule: %w", err)
|
||||
}
|
||||
n, _ := result.RowsAffected()
|
||||
if n == 0 {
|
||||
return fmt.Errorf("firewall rule (%s, %s) not found", ruleType, value)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
61
internal/db/listeners.go
Normal file
61
internal/db/listeners.go
Normal file
@@ -0,0 +1,61 @@
|
||||
package db
|
||||
|
||||
import "fmt"
|
||||
|
||||
// Listener is a database listener record.
|
||||
type Listener struct {
|
||||
ID int64
|
||||
Addr string
|
||||
}
|
||||
|
||||
// ListListeners returns all listeners.
|
||||
func (s *Store) ListListeners() ([]Listener, error) {
|
||||
rows, err := s.db.Query("SELECT id, addr FROM listeners ORDER BY id")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("querying listeners: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var listeners []Listener
|
||||
for rows.Next() {
|
||||
var l Listener
|
||||
if err := rows.Scan(&l.ID, &l.Addr); err != nil {
|
||||
return nil, fmt.Errorf("scanning listener: %w", err)
|
||||
}
|
||||
listeners = append(listeners, l)
|
||||
}
|
||||
return listeners, rows.Err()
|
||||
}
|
||||
|
||||
// CreateListener inserts a listener and returns its ID.
|
||||
func (s *Store) CreateListener(addr string) (int64, error) {
|
||||
result, err := s.db.Exec("INSERT INTO listeners (addr) VALUES (?)", addr)
|
||||
if err != nil {
|
||||
return 0, fmt.Errorf("inserting listener: %w", err)
|
||||
}
|
||||
return result.LastInsertId()
|
||||
}
|
||||
|
||||
// DeleteListener deletes a listener by ID. Routes are cascade-deleted.
|
||||
func (s *Store) DeleteListener(id int64) error {
|
||||
result, err := s.db.Exec("DELETE FROM listeners WHERE id = ?", id)
|
||||
if err != nil {
|
||||
return fmt.Errorf("deleting listener: %w", err)
|
||||
}
|
||||
n, _ := result.RowsAffected()
|
||||
if n == 0 {
|
||||
return fmt.Errorf("listener %d not found", id)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetListenerByAddr returns a listener by its address.
|
||||
func (s *Store) GetListenerByAddr(addr string) (Listener, error) {
|
||||
var l Listener
|
||||
err := s.db.QueryRow("SELECT id, addr FROM listeners WHERE addr = ?", addr).
|
||||
Scan(&l.ID, &l.Addr)
|
||||
if err != nil {
|
||||
return Listener{}, fmt.Errorf("querying listener by addr %q: %w", addr, err)
|
||||
}
|
||||
return l, nil
|
||||
}
|
||||
93
internal/db/migrations.go
Normal file
93
internal/db/migrations.go
Normal file
@@ -0,0 +1,93 @@
|
||||
package db
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
type migration struct {
|
||||
version int
|
||||
name string
|
||||
fn func(tx *sql.Tx) error
|
||||
}
|
||||
|
||||
var migrations = []migration{
|
||||
{1, "create_core_tables", migrate001CreateCoreTables},
|
||||
}
|
||||
|
||||
// Migrate runs all unapplied migrations sequentially.
|
||||
func (s *Store) Migrate() error {
|
||||
// Ensure the migration tracking table exists.
|
||||
_, err := s.db.Exec(`
|
||||
CREATE TABLE IF NOT EXISTS schema_migrations (
|
||||
version INTEGER PRIMARY KEY,
|
||||
applied TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))
|
||||
)
|
||||
`)
|
||||
if err != nil {
|
||||
return fmt.Errorf("creating schema_migrations table: %w", err)
|
||||
}
|
||||
|
||||
var current int
|
||||
err = s.db.QueryRow("SELECT COALESCE(MAX(version), 0) FROM schema_migrations").Scan(¤t)
|
||||
if err != nil {
|
||||
return fmt.Errorf("querying current migration version: %w", err)
|
||||
}
|
||||
|
||||
for _, m := range migrations {
|
||||
if m.version <= current {
|
||||
continue
|
||||
}
|
||||
|
||||
tx, err := s.db.Begin()
|
||||
if err != nil {
|
||||
return fmt.Errorf("beginning migration %d (%s): %w", m.version, m.name, err)
|
||||
}
|
||||
|
||||
if err := m.fn(tx); err != nil {
|
||||
tx.Rollback()
|
||||
return fmt.Errorf("running migration %d (%s): %w", m.version, m.name, err)
|
||||
}
|
||||
|
||||
if _, err := tx.Exec("INSERT INTO schema_migrations (version) VALUES (?)", m.version); err != nil {
|
||||
tx.Rollback()
|
||||
return fmt.Errorf("recording migration %d (%s): %w", m.version, m.name, err)
|
||||
}
|
||||
|
||||
if err := tx.Commit(); err != nil {
|
||||
return fmt.Errorf("committing migration %d (%s): %w", m.version, m.name, err)
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func migrate001CreateCoreTables(tx *sql.Tx) error {
|
||||
stmts := []string{
|
||||
`CREATE TABLE IF NOT EXISTS listeners (
|
||||
id INTEGER PRIMARY KEY,
|
||||
addr TEXT NOT NULL UNIQUE
|
||||
)`,
|
||||
`CREATE TABLE IF NOT EXISTS routes (
|
||||
id INTEGER PRIMARY KEY,
|
||||
listener_id INTEGER NOT NULL REFERENCES listeners(id) ON DELETE CASCADE,
|
||||
hostname TEXT NOT NULL,
|
||||
backend TEXT NOT NULL,
|
||||
UNIQUE(listener_id, hostname)
|
||||
)`,
|
||||
`CREATE INDEX IF NOT EXISTS idx_routes_listener ON routes(listener_id)`,
|
||||
`CREATE TABLE IF NOT EXISTS firewall_rules (
|
||||
id INTEGER PRIMARY KEY,
|
||||
type TEXT NOT NULL CHECK(type IN ('ip', 'cidr', 'country')),
|
||||
value TEXT NOT NULL,
|
||||
UNIQUE(type, value)
|
||||
)`,
|
||||
}
|
||||
|
||||
for _, stmt := range stmts {
|
||||
if _, err := tx.Exec(stmt); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
61
internal/db/routes.go
Normal file
61
internal/db/routes.go
Normal file
@@ -0,0 +1,61 @@
|
||||
package db
|
||||
|
||||
import "fmt"
|
||||
|
||||
// Route is a database route record.
|
||||
type Route struct {
|
||||
ID int64
|
||||
ListenerID int64
|
||||
Hostname string
|
||||
Backend string
|
||||
}
|
||||
|
||||
// ListRoutes returns all routes for a listener.
|
||||
func (s *Store) ListRoutes(listenerID int64) ([]Route, error) {
|
||||
rows, err := s.db.Query(
|
||||
"SELECT id, listener_id, hostname, backend FROM routes WHERE listener_id = ? ORDER BY hostname",
|
||||
listenerID,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("querying routes: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var routes []Route
|
||||
for rows.Next() {
|
||||
var r Route
|
||||
if err := rows.Scan(&r.ID, &r.ListenerID, &r.Hostname, &r.Backend); err != nil {
|
||||
return nil, fmt.Errorf("scanning route: %w", err)
|
||||
}
|
||||
routes = append(routes, r)
|
||||
}
|
||||
return routes, rows.Err()
|
||||
}
|
||||
|
||||
// CreateRoute inserts a route and returns its ID.
|
||||
func (s *Store) CreateRoute(listenerID int64, hostname, backend string) (int64, error) {
|
||||
result, err := s.db.Exec(
|
||||
"INSERT INTO routes (listener_id, hostname, backend) VALUES (?, ?, ?)",
|
||||
listenerID, hostname, backend,
|
||||
)
|
||||
if err != nil {
|
||||
return 0, fmt.Errorf("inserting route: %w", err)
|
||||
}
|
||||
return result.LastInsertId()
|
||||
}
|
||||
|
||||
// DeleteRoute deletes a route by listener ID and hostname.
|
||||
func (s *Store) DeleteRoute(listenerID int64, hostname string) error {
|
||||
result, err := s.db.Exec(
|
||||
"DELETE FROM routes WHERE listener_id = ? AND hostname = ?",
|
||||
listenerID, hostname,
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("deleting route: %w", err)
|
||||
}
|
||||
n, _ := result.RowsAffected()
|
||||
if n == 0 {
|
||||
return fmt.Errorf("route %q not found on listener %d", hostname, listenerID)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
56
internal/db/seed.go
Normal file
56
internal/db/seed.go
Normal file
@@ -0,0 +1,56 @@
|
||||
package db
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"git.wntrmute.dev/kyle/mc-proxy/internal/config"
|
||||
)
|
||||
|
||||
// Seed populates the database from TOML config data. Only called when the
|
||||
// database is empty (first run).
|
||||
func (s *Store) Seed(listeners []config.Listener, fw config.Firewall) error {
|
||||
tx, err := s.db.Begin()
|
||||
if err != nil {
|
||||
return fmt.Errorf("beginning seed transaction: %w", err)
|
||||
}
|
||||
defer tx.Rollback()
|
||||
|
||||
for _, l := range listeners {
|
||||
result, err := tx.Exec("INSERT INTO listeners (addr) VALUES (?)", l.Addr)
|
||||
if err != nil {
|
||||
return fmt.Errorf("seeding listener %q: %w", l.Addr, err)
|
||||
}
|
||||
listenerID, _ := result.LastInsertId()
|
||||
|
||||
for _, r := range l.Routes {
|
||||
_, err := tx.Exec(
|
||||
"INSERT INTO routes (listener_id, hostname, backend) VALUES (?, ?, ?)",
|
||||
listenerID, strings.ToLower(r.Hostname), r.Backend,
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("seeding route %q on listener %q: %w", r.Hostname, l.Addr, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for _, ip := range fw.BlockedIPs {
|
||||
if _, err := tx.Exec("INSERT INTO firewall_rules (type, value) VALUES ('ip', ?)", ip); err != nil {
|
||||
return fmt.Errorf("seeding blocked IP %q: %w", ip, err)
|
||||
}
|
||||
}
|
||||
|
||||
for _, cidr := range fw.BlockedCIDRs {
|
||||
if _, err := tx.Exec("INSERT INTO firewall_rules (type, value) VALUES ('cidr', ?)", cidr); err != nil {
|
||||
return fmt.Errorf("seeding blocked CIDR %q: %w", cidr, err)
|
||||
}
|
||||
}
|
||||
|
||||
for _, code := range fw.BlockedCountries {
|
||||
if _, err := tx.Exec("INSERT INTO firewall_rules (type, value) VALUES ('country', ?)", strings.ToUpper(code)); err != nil {
|
||||
return fmt.Errorf("seeding blocked country %q: %w", code, err)
|
||||
}
|
||||
}
|
||||
|
||||
return tx.Commit()
|
||||
}
|
||||
12
internal/db/snapshot.go
Normal file
12
internal/db/snapshot.go
Normal file
@@ -0,0 +1,12 @@
|
||||
package db
|
||||
|
||||
import "fmt"
|
||||
|
||||
// Snapshot creates a consistent backup of the database using VACUUM INTO.
|
||||
func (s *Store) Snapshot(destPath string) error {
|
||||
_, err := s.db.Exec("VACUUM INTO ?", destPath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("snapshot to %q: %w", destPath, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -8,7 +8,6 @@ import (
|
||||
|
||||
"github.com/oschwald/maxminddb-golang"
|
||||
|
||||
"git.wntrmute.dev/kyle/mc-proxy/internal/config"
|
||||
)
|
||||
|
||||
type geoIPRecord struct {
|
||||
@@ -27,15 +26,15 @@ type Firewall struct {
|
||||
mu sync.RWMutex // protects all mutable state
|
||||
}
|
||||
|
||||
// New creates a Firewall from the given configuration.
|
||||
func New(cfg config.Firewall) (*Firewall, error) {
|
||||
// New creates a Firewall from raw rule lists and an optional GeoIP database path.
|
||||
func New(geoIPPath string, ips, cidrs, countries []string) (*Firewall, error) {
|
||||
f := &Firewall{
|
||||
blockedIPs: make(map[netip.Addr]struct{}),
|
||||
blockedCountries: make(map[string]struct{}),
|
||||
geoDBPath: cfg.GeoIPDB,
|
||||
geoDBPath: geoIPPath,
|
||||
}
|
||||
|
||||
for _, ip := range cfg.BlockedIPs {
|
||||
for _, ip := range ips {
|
||||
addr, err := netip.ParseAddr(ip)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("invalid blocked IP %q: %w", ip, err)
|
||||
@@ -43,7 +42,7 @@ func New(cfg config.Firewall) (*Firewall, error) {
|
||||
f.blockedIPs[addr] = struct{}{}
|
||||
}
|
||||
|
||||
for _, cidr := range cfg.BlockedCIDRs {
|
||||
for _, cidr := range cidrs {
|
||||
prefix, err := netip.ParsePrefix(cidr)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("invalid blocked CIDR %q: %w", cidr, err)
|
||||
@@ -51,12 +50,12 @@ func New(cfg config.Firewall) (*Firewall, error) {
|
||||
f.blockedCIDRs = append(f.blockedCIDRs, prefix)
|
||||
}
|
||||
|
||||
for _, code := range cfg.BlockedCountries {
|
||||
for _, code := range countries {
|
||||
f.blockedCountries[strings.ToUpper(code)] = struct{}{}
|
||||
}
|
||||
|
||||
if len(f.blockedCountries) > 0 {
|
||||
if err := f.loadGeoDB(cfg.GeoIPDB); err != nil {
|
||||
if len(f.blockedCountries) > 0 && geoIPPath != "" {
|
||||
if err := f.loadGeoDB(geoIPPath); err != nil {
|
||||
return nil, fmt.Errorf("loading GeoIP database: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,12 +3,10 @@ package firewall
|
||||
import (
|
||||
"net/netip"
|
||||
"testing"
|
||||
|
||||
"git.wntrmute.dev/kyle/mc-proxy/internal/config"
|
||||
)
|
||||
|
||||
func TestEmptyFirewall(t *testing.T) {
|
||||
fw, err := New(config.Firewall{})
|
||||
fw, err := New("", nil, nil, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
@@ -24,9 +22,7 @@ func TestEmptyFirewall(t *testing.T) {
|
||||
}
|
||||
|
||||
func TestIPBlocking(t *testing.T) {
|
||||
fw, err := New(config.Firewall{
|
||||
BlockedIPs: []string{"192.0.2.1", "2001:db8::dead"},
|
||||
})
|
||||
fw, err := New("", []string{"192.0.2.1", "2001:db8::dead"}, nil, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
@@ -51,9 +47,7 @@ func TestIPBlocking(t *testing.T) {
|
||||
}
|
||||
|
||||
func TestCIDRBlocking(t *testing.T) {
|
||||
fw, err := New(config.Firewall{
|
||||
BlockedCIDRs: []string{"198.51.100.0/24", "2001:db8::/32"},
|
||||
})
|
||||
fw, err := New("", nil, []string{"198.51.100.0/24", "2001:db8::/32"}, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
@@ -79,15 +73,12 @@ func TestCIDRBlocking(t *testing.T) {
|
||||
}
|
||||
|
||||
func TestIPv4MappedIPv6(t *testing.T) {
|
||||
fw, err := New(config.Firewall{
|
||||
BlockedIPs: []string{"192.0.2.1"},
|
||||
})
|
||||
fw, err := New("", []string{"192.0.2.1"}, nil, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
defer fw.Close()
|
||||
|
||||
// IPv4-mapped IPv6 representation of 192.0.2.1.
|
||||
addr := netip.MustParseAddr("::ffff:192.0.2.1")
|
||||
if !fw.Blocked(addr) {
|
||||
t.Fatal("expected IPv4-mapped IPv6 address to be blocked")
|
||||
@@ -95,28 +86,21 @@ func TestIPv4MappedIPv6(t *testing.T) {
|
||||
}
|
||||
|
||||
func TestInvalidIP(t *testing.T) {
|
||||
_, err := New(config.Firewall{
|
||||
BlockedIPs: []string{"not-an-ip"},
|
||||
})
|
||||
_, err := New("", []string{"not-an-ip"}, nil, nil)
|
||||
if err == nil {
|
||||
t.Fatal("expected error for invalid IP")
|
||||
}
|
||||
}
|
||||
|
||||
func TestInvalidCIDR(t *testing.T) {
|
||||
_, err := New(config.Firewall{
|
||||
BlockedCIDRs: []string{"not-a-cidr"},
|
||||
})
|
||||
_, err := New("", nil, []string{"not-a-cidr"}, nil)
|
||||
if err == nil {
|
||||
t.Fatal("expected error for invalid CIDR")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCombinedRules(t *testing.T) {
|
||||
fw, err := New(config.Firewall{
|
||||
BlockedIPs: []string{"10.0.0.1"},
|
||||
BlockedCIDRs: []string{"192.168.0.0/16"},
|
||||
})
|
||||
fw, err := New("", []string{"10.0.0.1"}, []string{"192.168.0.0/16"}, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
@@ -126,10 +110,10 @@ func TestCombinedRules(t *testing.T) {
|
||||
addr string
|
||||
blocked bool
|
||||
}{
|
||||
{"10.0.0.1", true}, // IP match
|
||||
{"10.0.0.2", false}, // no match
|
||||
{"192.168.1.1", true}, // CIDR match
|
||||
{"172.16.0.1", false}, // no match
|
||||
{"10.0.0.1", true},
|
||||
{"10.0.0.2", false},
|
||||
{"192.168.1.1", true},
|
||||
{"172.16.0.1", false},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
@@ -139,3 +123,30 @@ func TestCombinedRules(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRuntimeMutation(t *testing.T) {
|
||||
fw, err := New("", nil, nil, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
defer fw.Close()
|
||||
|
||||
addr := netip.MustParseAddr("10.0.0.1")
|
||||
if fw.Blocked(addr) {
|
||||
t.Fatal("should not be blocked initially")
|
||||
}
|
||||
|
||||
if err := fw.AddIP("10.0.0.1"); err != nil {
|
||||
t.Fatalf("add IP: %v", err)
|
||||
}
|
||||
if !fw.Blocked(addr) {
|
||||
t.Fatal("should be blocked after AddIP")
|
||||
}
|
||||
|
||||
if err := fw.RemoveIP("10.0.0.1"); err != nil {
|
||||
t.Fatalf("remove IP: %v", err)
|
||||
}
|
||||
if fw.Blocked(addr) {
|
||||
t.Fatal("should not be blocked after RemoveIP")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -8,6 +8,7 @@ import (
|
||||
"log/slog"
|
||||
"net"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"google.golang.org/grpc"
|
||||
"google.golang.org/grpc/codes"
|
||||
@@ -17,6 +18,7 @@ import (
|
||||
|
||||
pb "git.wntrmute.dev/kyle/mc-proxy/gen/mc-proxy/v1"
|
||||
"git.wntrmute.dev/kyle/mc-proxy/internal/config"
|
||||
"git.wntrmute.dev/kyle/mc-proxy/internal/db"
|
||||
"git.wntrmute.dev/kyle/mc-proxy/internal/server"
|
||||
)
|
||||
|
||||
@@ -24,11 +26,12 @@ import (
|
||||
type AdminServer struct {
|
||||
pb.UnimplementedProxyAdminServer
|
||||
srv *server.Server
|
||||
store *db.Store
|
||||
logger *slog.Logger
|
||||
}
|
||||
|
||||
// New creates a gRPC server with TLS and optional mTLS.
|
||||
func New(cfg config.GRPC, srv *server.Server, logger *slog.Logger) (*grpc.Server, net.Listener, error) {
|
||||
func New(cfg config.GRPC, srv *server.Server, store *db.Store, logger *slog.Logger) (*grpc.Server, net.Listener, error) {
|
||||
cert, err := tls.LoadX509KeyPair(cfg.TLSCert, cfg.TLSKey)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("loading TLS keypair: %w", err)
|
||||
@@ -39,7 +42,6 @@ func New(cfg config.GRPC, srv *server.Server, logger *slog.Logger) (*grpc.Server
|
||||
MinVersion: tls.VersionTLS13,
|
||||
}
|
||||
|
||||
// mTLS: require and verify client certificates.
|
||||
if cfg.ClientCA != "" {
|
||||
caCert, err := os.ReadFile(cfg.ClientCA)
|
||||
if err != nil {
|
||||
@@ -58,6 +60,7 @@ func New(cfg config.GRPC, srv *server.Server, logger *slog.Logger) (*grpc.Server
|
||||
|
||||
admin := &AdminServer{
|
||||
srv: srv,
|
||||
store: store,
|
||||
logger: logger,
|
||||
}
|
||||
pb.RegisterProxyAdminServer(grpcServer, admin)
|
||||
@@ -90,7 +93,7 @@ func (a *AdminServer) ListRoutes(_ context.Context, req *pb.ListRoutesRequest) (
|
||||
return resp, nil
|
||||
}
|
||||
|
||||
// AddRoute adds a route to a listener's route table.
|
||||
// AddRoute writes to the database first, then updates in-memory state.
|
||||
func (a *AdminServer) AddRoute(_ context.Context, req *pb.AddRouteRequest) (*pb.AddRouteResponse, error) {
|
||||
if req.Route == nil {
|
||||
return nil, status.Error(codes.InvalidArgument, "route is required")
|
||||
@@ -104,15 +107,23 @@ func (a *AdminServer) AddRoute(_ context.Context, req *pb.AddRouteRequest) (*pb.
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if err := ls.AddRoute(req.Route.Hostname, req.Route.Backend); err != nil {
|
||||
hostname := strings.ToLower(req.Route.Hostname)
|
||||
|
||||
// Write-through: DB first, then memory.
|
||||
if _, err := a.store.CreateRoute(ls.ID, hostname, req.Route.Backend); err != nil {
|
||||
return nil, status.Errorf(codes.AlreadyExists, "%v", err)
|
||||
}
|
||||
|
||||
a.logger.Info("route added", "listener", ls.Addr, "hostname", req.Route.Hostname, "backend", req.Route.Backend)
|
||||
if err := ls.AddRoute(hostname, req.Route.Backend); err != nil {
|
||||
// DB succeeded but memory failed (should not happen since DB enforces uniqueness).
|
||||
a.logger.Error("inconsistency: DB write succeeded but memory update failed", "error", err)
|
||||
}
|
||||
|
||||
a.logger.Info("route added", "listener", ls.Addr, "hostname", hostname, "backend", req.Route.Backend)
|
||||
return &pb.AddRouteResponse{}, nil
|
||||
}
|
||||
|
||||
// RemoveRoute removes a route from a listener's route table.
|
||||
// RemoveRoute writes to the database first, then updates in-memory state.
|
||||
func (a *AdminServer) RemoveRoute(_ context.Context, req *pb.RemoveRouteRequest) (*pb.RemoveRouteResponse, error) {
|
||||
if req.Hostname == "" {
|
||||
return nil, status.Error(codes.InvalidArgument, "hostname is required")
|
||||
@@ -123,11 +134,17 @@ func (a *AdminServer) RemoveRoute(_ context.Context, req *pb.RemoveRouteRequest)
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if err := ls.RemoveRoute(req.Hostname); err != nil {
|
||||
hostname := strings.ToLower(req.Hostname)
|
||||
|
||||
if err := a.store.DeleteRoute(ls.ID, hostname); err != nil {
|
||||
return nil, status.Errorf(codes.NotFound, "%v", err)
|
||||
}
|
||||
|
||||
a.logger.Info("route removed", "listener", ls.Addr, "hostname", req.Hostname)
|
||||
if err := ls.RemoveRoute(hostname); err != nil {
|
||||
a.logger.Error("inconsistency: DB delete succeeded but memory update failed", "error", err)
|
||||
}
|
||||
|
||||
a.logger.Info("route removed", "listener", ls.Addr, "hostname", hostname)
|
||||
return &pb.RemoveRouteResponse{}, nil
|
||||
}
|
||||
|
||||
@@ -158,61 +175,74 @@ func (a *AdminServer) GetFirewallRules(_ context.Context, _ *pb.GetFirewallRules
|
||||
return &pb.GetFirewallRulesResponse{Rules: rules}, nil
|
||||
}
|
||||
|
||||
// AddFirewallRule adds a firewall rule.
|
||||
// AddFirewallRule writes to the database first, then updates in-memory state.
|
||||
func (a *AdminServer) AddFirewallRule(_ context.Context, req *pb.AddFirewallRuleRequest) (*pb.AddFirewallRuleResponse, error) {
|
||||
if req.Rule == nil {
|
||||
return nil, status.Error(codes.InvalidArgument, "rule is required")
|
||||
}
|
||||
|
||||
fw := a.srv.Firewall()
|
||||
switch req.Rule.Type {
|
||||
case pb.FirewallRuleType_FIREWALL_RULE_TYPE_IP:
|
||||
if err := fw.AddIP(req.Rule.Value); err != nil {
|
||||
return nil, status.Errorf(codes.InvalidArgument, "%v", err)
|
||||
}
|
||||
case pb.FirewallRuleType_FIREWALL_RULE_TYPE_CIDR:
|
||||
if err := fw.AddCIDR(req.Rule.Value); err != nil {
|
||||
return nil, status.Errorf(codes.InvalidArgument, "%v", err)
|
||||
}
|
||||
case pb.FirewallRuleType_FIREWALL_RULE_TYPE_COUNTRY:
|
||||
if req.Rule.Value == "" {
|
||||
return nil, status.Error(codes.InvalidArgument, "country code is required")
|
||||
}
|
||||
fw.AddCountry(req.Rule.Value)
|
||||
default:
|
||||
return nil, status.Error(codes.InvalidArgument, "unknown rule type")
|
||||
ruleType, err := protoRuleTypeToString(req.Rule.Type)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
a.logger.Info("firewall rule added", "type", req.Rule.Type, "value", req.Rule.Value)
|
||||
if req.Rule.Value == "" {
|
||||
return nil, status.Error(codes.InvalidArgument, "value is required")
|
||||
}
|
||||
|
||||
// Write-through: DB first, then memory.
|
||||
if _, err := a.store.CreateFirewallRule(ruleType, req.Rule.Value); err != nil {
|
||||
return nil, status.Errorf(codes.AlreadyExists, "%v", err)
|
||||
}
|
||||
|
||||
fw := a.srv.Firewall()
|
||||
switch ruleType {
|
||||
case "ip":
|
||||
if err := fw.AddIP(req.Rule.Value); err != nil {
|
||||
a.logger.Error("inconsistency: DB write succeeded but memory update failed", "error", err)
|
||||
}
|
||||
case "cidr":
|
||||
if err := fw.AddCIDR(req.Rule.Value); err != nil {
|
||||
a.logger.Error("inconsistency: DB write succeeded but memory update failed", "error", err)
|
||||
}
|
||||
case "country":
|
||||
fw.AddCountry(req.Rule.Value)
|
||||
}
|
||||
|
||||
a.logger.Info("firewall rule added", "type", ruleType, "value", req.Rule.Value)
|
||||
return &pb.AddFirewallRuleResponse{}, nil
|
||||
}
|
||||
|
||||
// RemoveFirewallRule removes a firewall rule.
|
||||
// RemoveFirewallRule writes to the database first, then updates in-memory state.
|
||||
func (a *AdminServer) RemoveFirewallRule(_ context.Context, req *pb.RemoveFirewallRuleRequest) (*pb.RemoveFirewallRuleResponse, error) {
|
||||
if req.Rule == nil {
|
||||
return nil, status.Error(codes.InvalidArgument, "rule is required")
|
||||
}
|
||||
|
||||
fw := a.srv.Firewall()
|
||||
switch req.Rule.Type {
|
||||
case pb.FirewallRuleType_FIREWALL_RULE_TYPE_IP:
|
||||
if err := fw.RemoveIP(req.Rule.Value); err != nil {
|
||||
return nil, status.Errorf(codes.InvalidArgument, "%v", err)
|
||||
}
|
||||
case pb.FirewallRuleType_FIREWALL_RULE_TYPE_CIDR:
|
||||
if err := fw.RemoveCIDR(req.Rule.Value); err != nil {
|
||||
return nil, status.Errorf(codes.InvalidArgument, "%v", err)
|
||||
}
|
||||
case pb.FirewallRuleType_FIREWALL_RULE_TYPE_COUNTRY:
|
||||
if req.Rule.Value == "" {
|
||||
return nil, status.Error(codes.InvalidArgument, "country code is required")
|
||||
}
|
||||
fw.RemoveCountry(req.Rule.Value)
|
||||
default:
|
||||
return nil, status.Error(codes.InvalidArgument, "unknown rule type")
|
||||
ruleType, err := protoRuleTypeToString(req.Rule.Type)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
a.logger.Info("firewall rule removed", "type", req.Rule.Type, "value", req.Rule.Value)
|
||||
if err := a.store.DeleteFirewallRule(ruleType, req.Rule.Value); err != nil {
|
||||
return nil, status.Errorf(codes.NotFound, "%v", err)
|
||||
}
|
||||
|
||||
fw := a.srv.Firewall()
|
||||
switch ruleType {
|
||||
case "ip":
|
||||
if err := fw.RemoveIP(req.Rule.Value); err != nil {
|
||||
a.logger.Error("inconsistency: DB delete succeeded but memory update failed", "error", err)
|
||||
}
|
||||
case "cidr":
|
||||
if err := fw.RemoveCIDR(req.Rule.Value); err != nil {
|
||||
a.logger.Error("inconsistency: DB delete succeeded but memory update failed", "error", err)
|
||||
}
|
||||
case "country":
|
||||
fw.RemoveCountry(req.Rule.Value)
|
||||
}
|
||||
|
||||
a.logger.Info("firewall rule removed", "type", ruleType, "value", req.Rule.Value)
|
||||
return &pb.RemoveFirewallRuleResponse{}, nil
|
||||
}
|
||||
|
||||
@@ -244,3 +274,16 @@ func (a *AdminServer) findListener(addr string) (*server.ListenerState, error) {
|
||||
}
|
||||
return nil, status.Errorf(codes.NotFound, "listener %q not found", addr)
|
||||
}
|
||||
|
||||
func protoRuleTypeToString(t pb.FirewallRuleType) (string, error) {
|
||||
switch t {
|
||||
case pb.FirewallRuleType_FIREWALL_RULE_TYPE_IP:
|
||||
return "ip", nil
|
||||
case pb.FirewallRuleType_FIREWALL_RULE_TYPE_CIDR:
|
||||
return "cidr", nil
|
||||
case pb.FirewallRuleType_FIREWALL_RULE_TYPE_COUNTRY:
|
||||
return "country", nil
|
||||
default:
|
||||
return "", status.Error(codes.InvalidArgument, "unknown rule type")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -19,6 +19,7 @@ import (
|
||||
|
||||
// ListenerState holds the mutable state for a single proxy listener.
|
||||
type ListenerState struct {
|
||||
ID int64 // database primary key
|
||||
Addr string
|
||||
routes map[string]string // lowercase hostname → backend addr
|
||||
mu sync.RWMutex
|
||||
@@ -75,6 +76,13 @@ func (ls *ListenerState) lookupRoute(hostname string) (string, bool) {
|
||||
return backend, ok
|
||||
}
|
||||
|
||||
// ListenerData holds the data needed to construct a ListenerState.
|
||||
type ListenerData struct {
|
||||
ID int64
|
||||
Addr string
|
||||
Routes map[string]string // lowercase hostname → backend
|
||||
}
|
||||
|
||||
// Server is the mc-proxy server. It manages listeners, firewall evaluation,
|
||||
// SNI-based routing, and bidirectional proxying.
|
||||
type Server struct {
|
||||
@@ -82,27 +90,19 @@ type Server struct {
|
||||
fw *firewall.Firewall
|
||||
listeners []*ListenerState
|
||||
logger *slog.Logger
|
||||
wg sync.WaitGroup // tracks active connections
|
||||
wg sync.WaitGroup
|
||||
startedAt time.Time
|
||||
version string
|
||||
}
|
||||
|
||||
// New creates a Server from the given configuration.
|
||||
func New(cfg *config.Config, logger *slog.Logger, version string) (*Server, error) {
|
||||
fw, err := firewall.New(cfg.Firewall)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("initializing firewall: %w", err)
|
||||
}
|
||||
|
||||
// New creates a Server from pre-loaded data.
|
||||
func New(cfg *config.Config, fw *firewall.Firewall, listenerData []ListenerData, logger *slog.Logger, version string) *Server {
|
||||
var listeners []*ListenerState
|
||||
for _, lcfg := range cfg.Listeners {
|
||||
routes := make(map[string]string, len(lcfg.Routes))
|
||||
for _, r := range lcfg.Routes {
|
||||
routes[strings.ToLower(r.Hostname)] = r.Backend
|
||||
}
|
||||
for _, ld := range listenerData {
|
||||
listeners = append(listeners, &ListenerState{
|
||||
Addr: lcfg.Addr,
|
||||
routes: routes,
|
||||
ID: ld.ID,
|
||||
Addr: ld.Addr,
|
||||
routes: ld.Routes,
|
||||
})
|
||||
}
|
||||
|
||||
@@ -112,7 +112,7 @@ func New(cfg *config.Config, logger *slog.Logger, version string) (*Server, erro
|
||||
listeners: listeners,
|
||||
logger: logger,
|
||||
version: version,
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
// Firewall returns the server's firewall for use by the gRPC admin API.
|
||||
@@ -162,23 +162,19 @@ func (s *Server) Run(ctx context.Context) error {
|
||||
netListeners = append(netListeners, ln)
|
||||
}
|
||||
|
||||
// Start accept loops.
|
||||
for i, ln := range netListeners {
|
||||
ln := ln
|
||||
ls := s.listeners[i]
|
||||
go s.serve(ctx, ln, ls)
|
||||
}
|
||||
|
||||
// Block until shutdown signal.
|
||||
<-ctx.Done()
|
||||
s.logger.Info("shutting down")
|
||||
|
||||
// Stop accepting new connections.
|
||||
for _, ln := range netListeners {
|
||||
ln.Close()
|
||||
}
|
||||
|
||||
// Wait for in-flight connections with a timeout.
|
||||
done := make(chan struct{})
|
||||
go func() {
|
||||
s.wg.Wait()
|
||||
|
||||
Reference in New Issue
Block a user