denozord/EvoFirewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat(api, test, web): enhance IP hit tracking and reset logic for agents
Build and Push EvoFirewall Docker Image / build-and-push (push) Successful in 2m26s
Details
Build and Push EvoFirewall Docker Image / create-release (push) Skipped
Details

Browse Source 
- Implemented a reset mechanism for per-IP baselines in the agent routes, ensuring accurate tracking after policy application.
- Updated tests to simulate traffic flush scenarios, verifying that IP hit statistics reset correctly and accumulate as expected.
- Modified the UI to reflect changes in terminology from "Sync windows" to "Hits" for better clarity in agent details.
- Enhanced documentation to explain the new behavior of IP hit tracking and baseline resets, improving user understanding.

These changes improve the accuracy and usability of IP hit tracking for agents, particularly in scenarios involving policy changes.
This commit is contained in:
Denozordec
2026-08-07 15:44:27 +07:00
parent 3815575799
commit 402182195f
6 changed files with 171 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/agents.md
+5 -4
View File
@@ -61,8 +61,9 @@ Linux agent reports optional `ip_hits` in `POST /v1/agent/apply-report`:
- Upgrade path: on install-link re-run, `last_hash` is cleared once so sets can be recreated (chain deleted before set replace).
- **ipset:** prefers `hash:net … counters` on create; existing sets without counters are left as-is.
- Payload: only entries with `packets > 0`, **top 200** by packets.
- Control plane: `agent_ip_block_stats`, `GET /api/v1/agents/:id/blocked-ips`, reset via `POST …/stats/reset`.
- UI: agent detail → **Blocked IPs**.
- Control plane: `agent_ip_block_stats`, accumulates **deltas** of absolute kernel counters (как Traffic ↓). После flush set/chain (policy apply) CP сбрасывает per-IP baseline (`last_reported`), иначе вторая эпоха счётчиков теряется (Traffic растёт, Blocked IPs — нет).
- `GET /api/v1/agents/:id/blocked-ips`, reset via `POST …/stats/reset`.
- UI: agent detail → **Blocked IPs**. Sum of Blocked IPs ≈ Traffic ↓ для deny (при default accept); default-drop / allow в Traffic считаются отдельно.
IPv6 skipped.
@@ -92,9 +93,9 @@ Traffic ↓/↑ в UI — сумма `packets` с `evofw-deny-drop-*` / `evofw-a
1. `evofw-deny-hit-input/forward` — `add-src-to-address-list` → `EVOFW_HITS`, `address-list-timeout=1h` (passthrough).
2. `evofw-deny-drop-input/forward` — `drop` по `EVOFW_DENY`.
В `EVOFW_HITS` попадают реальные src **/32**. Policy rebuild **не** чистит HITS (только DENY/ALLOW). Sync шлёт top-200 в `ip_hits`; CP mode **presence**: `last_seen` каждый report, `packets` = число sync-окон (~минут), пока IP в HITS.
В `EVOFW_HITS` попадают реальные src **/32**. Policy rebuild **не** чистит HITS (только DENY/ALLOW). Sync шлёт top-200 в `ip_hits`; CP mode **presence**: `last_seen` обновляется, пока IP в HITS; `packets` (Hits) увеличивается только при первом появлении или **повторном входе** после исчезновения из списка (~>2.5 мин без report), а не на каждый sync.
UI: agent detail → **Blocked IPs** (колонка Sync windows).
UI: agent detail → **Blocked IPs** (колонка Hits).
**Default action** задаётся на **агенте** (`default_action: accept | drop`):