feat(api, web): implement per-IP blocked stats for agents

- Added functionality to report per-IP drop counters in the `evofw-firewall.sh` script, capturing the top 200 IPs with packet counts.
- Introduced new API endpoints to retrieve blocked IP statistics and reset these stats for agents, enhancing monitoring capabilities.
- Updated the agent detail view to display blocked IPs, improving user visibility into agent performance.
- Enhanced database schema and repositories to support the storage and management of IP block statistics.

These changes provide a comprehensive view of blocked IPs, improving the overall management and monitoring of agents.

apps/api/src/agent-scripts/evofw-firewall.sh

@@ -7,6 +7,7 @@ LOG_FILE=/var/log/evofw-firewall.log
 STATE_DIR=/var/lib/evofw
 HASH_FILE="${STATE_DIR}/last_hash"
 POLICY_FILE="${STATE_DIR}/last_policy.json"
+IP_HITS_TOP=200
 
 log() { echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $*" | tee -a "$LOG_FILE"; }
 
@@ -97,6 +98,7 @@ PACKETS_DROPPED=0
 PACKETS_ACCEPTED=0
 KERNEL_METHOD=""
 APPLIED=0
+IP_HITS_JSON="[]"
 
 nft_join() {
   local out="" p
@@ -116,6 +118,20 @@ nft_add_chunk() {
   }
 }
 
+# Ensure inet set exists with interval + counter (recreate if missing counter).
+ensure_nft_set() {
+  local table=$1 name=$2 setname=$3
+  local def
+  def=$(nft -a list set "$table" "$name" "$setname" 2>/dev/null || true)
+  if [[ -n "$def" ]] && [[ "$def" == *"counter"* ]]; then
+    return 0
+  fi
+  if [[ -n "$def" ]]; then
+    nft delete set "$table" "$name" "$setname" 2>>"$LOG_FILE" || true
+  fi
+  nft add set "$table" "$name" "$setname" '{ type ipv4_addr; flags interval; counter; }' 2>>"$LOG_FILE"
+}
+
 collect_nft_stats() {
   PACKETS_DROPPED=0; PACKETS_ACCEPTED=0
   local line n
@@ -135,6 +151,62 @@ collect_nft_stats() {
   done < <(nft list chain inet evofw input 2>/dev/null || true)
 }
 
+# Parse nft set / ipset listing → top-N JSON [{"ip":"...","packets":N},...]
+build_ip_hits_json() {
+  local text="$1"
+  if command -v python3 >/dev/null 2>&1; then
+    IP_HITS_JSON=$(IP_HITS_TOP="$IP_HITS_TOP" python3 -c '
+import json, os, re, sys
+text = sys.stdin.read()
+top = int(os.environ.get("IP_HITS_TOP", "200"))
+hits = {}
+# nft: "1.2.3.4 counter packets 10 bytes 100" or "1.2.3.0/24 packets 5 bytes 20"
+for m in re.finditer(r"([0-9]{1,3}(?:\.[0-9]{1,3}){3}(?:/[0-9]{1,2})?)\s+(?:counter\s+)?packets\s+(\d+)", text):
+    ip, pkts = m.group(1), int(m.group(2))
+    if pkts > 0:
+        hits[ip] = max(hits.get(ip, 0), pkts)
+# ipset list Members: "1.2.3.4 packets 10 bytes 100"
+for m in re.finditer(r"^([0-9]{1,3}(?:\.[0-9]{1,3}){3}(?:/[0-9]{1,2})?)\s+packets\s+(\d+)", text, re.M):
+    ip, pkts = m.group(1), int(m.group(2))
+    if pkts > 0:
+        hits[ip] = max(hits.get(ip, 0), pkts)
+items = [{"ip": k, "packets": v} for k, v in hits.items()]
+items.sort(key=lambda x: x["packets"], reverse=True)
+print(json.dumps(items[:top], separators=(",", ":")))
+' <<<"$text" 2>/dev/null) || IP_HITS_JSON="[]"
+    return
+  fi
+  if command -v jq >/dev/null 2>&1; then
+    # Fallback without python: empty (jq alone cannot easily top-N from free text)
+    IP_HITS_JSON="[]"
+    return
+  fi
+  IP_HITS_JSON="[]"
+}
+
+collect_nft_ip_hits() {
+  local text
+  text=$(nft list set inet evofw deny_v4 2>/dev/null || true)
+  build_ip_hits_json "$text"
+}
+
+collect_ipset_ip_hits() {
+  local text
+  text=$(ipset list evofw_deny_v4 2>/dev/null || true)
+  build_ip_hits_json "$text"
+}
+
+collect_ip_hits() {
+  IP_HITS_JSON="[]"
+  if [[ "${KERNEL_METHOD:-}" == "nft" ]] || { [[ -z "${KERNEL_METHOD:-}" || "${KERNEL_METHOD:-}" == "auto" ]] && command -v nft >/dev/null 2>&1 && nft list set inet evofw deny_v4 >/dev/null 2>&1; }; then
+    collect_nft_ip_hits
+    return
+  fi
+  if command -v ipset >/dev/null 2>&1 && ipset list evofw_deny_v4 >/dev/null 2>&1; then
+    collect_ipset_ip_hits
+  fi
+}
+
 apply_nft() {
   local table=inet name=evofw
   local deny_v4=() allow_v4=() p
@@ -142,10 +214,8 @@ apply_nft() {
   for p in "${ALLOW[@]+"${ALLOW[@]}"}"; do [[ "$p" == *:* ]] && continue; allow_v4+=("$p"); done
 
   nft list table "$table" "$name" >/dev/null 2>&1 || nft add table "$table" "$name"
-  nft list set "$table" "$name" deny_v4 >/dev/null 2>&1 || \
-    nft add set "$table" "$name" deny_v4 '{ type ipv4_addr; flags interval; }'
-  nft list set "$table" "$name" allow_v4 >/dev/null 2>&1 || \
-    nft add set "$table" "$name" allow_v4 '{ type ipv4_addr; flags interval; }'
+  ensure_nft_set "$table" "$name" deny_v4
+  ensure_nft_set "$table" "$name" allow_v4
   nft flush set "$table" "$name" deny_v4
   nft flush set "$table" "$name" allow_v4
 
@@ -182,10 +252,25 @@ apply_nft() {
   APPLIED=$((${#deny_v4[@]} + ${#allow_v4[@]}))
 }
 
+ensure_ipset_counters() {
+  local name=$1
+  if ! ipset list "$name" >/dev/null 2>&1; then
+    ipset create "$name" hash:net family inet counters
+    return
+  fi
+  # Recreate once if set has no packet counters (Header lacks "counters").
+  local header
+  header=$(ipset list "$name" 2>/dev/null | head -n 5 || true)
+  if [[ "$header" != *"counters"* && "$header" != *"packet"* ]]; then
+    ipset destroy "$name" 2>>"$LOG_FILE" || true
+    ipset create "$name" hash:net family inet counters
+  fi
+}
+
 apply_ipset() {
   local dset=evofw_deny_v4 aset=evofw_allow_v4
-  ipset list "$dset" >/dev/null 2>&1 || ipset create "$dset" hash:net family inet
-  ipset list "$aset" >/dev/null 2>&1 || ipset create "$aset" hash:net family inet
+  ensure_ipset_counters "$dset"
+  ensure_ipset_counters "$aset"
   ipset flush "$dset"; ipset flush "$aset"
   local p n=0
   for p in "${DENY[@]+"${DENY[@]}"}"; do [[ "$p" == *:* ]] && continue; ipset add "$dset" "$p" -exist; n=$((n+1)); done
@@ -210,9 +295,12 @@ send_report() {
       collect_nft_stats
     fi
   fi
+  if [[ -z "${IP_HITS_CAPTURED:-}" ]]; then
+    collect_ip_hits
+  fi
   local report
-  report=$(printf '{"status":"ok","prefix_count":%s,"packets_dropped":%s,"packets_accepted":%s,"kernel_method":"%s","source":"agent"}' \
-    "${APPLIED:-0}" "${PACKETS_DROPPED:-0}" "${PACKETS_ACCEPTED:-0}" "${KERNEL_METHOD:-$BACKEND}")
+  report=$(printf '{"status":"ok","prefix_count":%s,"packets_dropped":%s,"packets_accepted":%s,"kernel_method":"%s","source":"agent","ip_hits":%s}' \
+    "${APPLIED:-0}" "${PACKETS_DROPPED:-0}" "${PACKETS_ACCEPTED:-0}" "${KERNEL_METHOD:-$BACKEND}" "${IP_HITS_JSON:-[]}")
   curl -fsS -X POST "${EVOFW_CP_URL%/}/v1/agent/apply-report" \
     -H "Authorization: Bearer ${CLIENT_TOKEN}" \
     -H "Content-Type: application/json" \
@@ -225,15 +313,36 @@ send_report() {
 
 if [[ -f "$HASH_FILE" && "$(tr -d '\r\n' <"$HASH_FILE")" == "$HASH" && -n "$HASH" ]]; then
   log "unchanged hash $HASH — skip apply"
-  KERNEL_METHOD="${BACKEND}"
+  if command -v nft >/dev/null 2>&1 && nft list table inet evofw >/dev/null 2>&1; then
+    KERNEL_METHOD=nft
+  elif command -v ipset >/dev/null 2>&1 && ipset list evofw_deny_v4 >/dev/null 2>&1; then
+    KERNEL_METHOD=ipset
+  else
+    KERNEL_METHOD="${BACKEND}"
+  fi
+  # Count applied prefixes from live sets when skipping apply.
+  if [[ "$KERNEL_METHOD" == "nft" ]]; then
+    APPLIED=$(nft list set inet evofw deny_v4 2>/dev/null | grep -cE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' || true)
+    local_allow=$(nft list set inet evofw allow_v4 2>/dev/null | grep -cE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' || true)
+    APPLIED=$((APPLIED + local_allow))
+  elif [[ "$KERNEL_METHOD" == "ipset" ]]; then
+    APPLIED=$(ipset list evofw_deny_v4 2>/dev/null | awk '/^[0-9]/{c++} END{print c+0}')
+    local_allow=$(ipset list evofw_allow_v4 2>/dev/null | awk '/^[0-9]/{c++} END{print c+0}')
+    APPLIED=$((APPLIED + local_allow))
+  fi
   send_report
   exit 0
 fi
 
-# Capture counters BEFORE recreate (nft delete chain zeroes them).
-if command -v nft >/dev/null 2>&1; then
+# Capture counters BEFORE recreate (nft delete chain / flush set zeroes them).
+if command -v nft >/dev/null 2>&1 && nft list table inet evofw >/dev/null 2>&1; then
   collect_nft_stats
+  collect_nft_ip_hits
   STATS_CAPTURED=1
+  IP_HITS_CAPTURED=1
+elif command -v ipset >/dev/null 2>&1 && ipset list evofw_deny_v4 >/dev/null 2>&1; then
+  collect_ipset_ip_hits
+  IP_HITS_CAPTURED=1
 fi
 
 case "$BACKEND" in

apps/api/src/routes/agent.ts

@@ -221,6 +221,9 @@ export const agentRoutes: FastifyPluginAsync<{ config: AppConfig }> = async (
       kernelMethod: body.kernel_method ?? null,
       recordedAt: now,
     })
+    if (body.ip_hits?.length) {
+      repos.upsertIpBlockStats(app.db, agentId, body.ip_hits, now)
+    }
     return { ok: true }
   })
 

apps/api/src/routes/stats.ts

@@ -23,6 +23,22 @@ export const statsRoutes: FastifyPluginAsync<{ config: AppConfig }> = async (
     })),
   }))
 
+  app.get<{ Params: { id: string } }>(
+    '/agents/:id/blocked-ips',
+    async (req) => {
+      const agent = repos.getAgent(app.db, req.params.id)
+      if (!agent) throw new AppError('NOT_FOUND', 'Agent not found', 404)
+      return {
+        items: repos.listIpBlockStats(app.db, agent.id).map((s) => ({
+          ip: s.ip,
+          packets: s.packets,
+          first_seen_at: s.firstSeenAt,
+          last_seen_at: s.lastSeenAt,
+        })),
+      }
+    },
+  )
+
   app.post<{ Params: { id: string } }>(
     '/agents/:id/stats/reset',
     async (req) => {
@@ -35,6 +51,7 @@ export const statsRoutes: FastifyPluginAsync<{ config: AppConfig }> = async (
         totalPacketsAccepted: 0,
       })
       repos.deleteStatsSamplesForAgent(app.db, agent.id)
+      repos.deleteIpBlockStatsForAgent(app.db, agent.id)
       auditMutation(app, config, req, {
         action: 'agent.stats_reset',
         severity: 'info',

apps/api/src/services/ip-block-stats.test.ts

@@ -0,0 +1,188 @@
+import { describe, it, expect, afterAll } from 'vitest'
+import { buildApp } from '../app.js'
+import type { AppConfig } from '../config.js'
+
+const testConfig: AppConfig = {
+  databaseUrl: 'sqlite::memory:',
+  jwtSecret: 'test',
+  jwtTtlHours: 24,
+  serverPort: 8080,
+  staticDir: null,
+  logLevel: 'error',
+  authRequired: false,
+  authIssuer: 'https://auth.test',
+  authPortalUrl: 'http://localhost:5175',
+  publicBaseUrl: 'https://fw.example.com',
+  enrollSeed: 'test-seed',
+}
+
+async function enrollApprovedLinux(
+  app: Awaited<ReturnType<typeof buildApp>>,
+  name: string,
+  token: string,
+) {
+  const created = await app.inject({
+    method: 'POST',
+    url: '/api/v1/install-links',
+    payload: { name, platform: 'linux' },
+  })
+  expect(created.statusCode).toBe(201)
+  const link = created.json() as { id: string; agent_id: string }
+
+  const enroll = await app.inject({
+    method: 'POST',
+    url: '/v1/agent/enroll',
+    headers: {
+      'content-type': 'application/json',
+      'x-evofw-seed': 'test-seed',
+    },
+    payload: {
+      name,
+      platform: 'linux',
+      token,
+      install_link_id: link.id,
+    },
+  })
+  expect(enroll.statusCode).toBe(201)
+
+  await app.inject({
+    method: 'POST',
+    url: `/api/v1/agents/${link.agent_id}/approve`,
+  })
+
+  return { agentId: link.agent_id, token }
+}
+
+describe('apply-report ip_hits / blocked-ips', () => {
+  const appPromise = buildApp({ memory: true, config: testConfig })
+
+  afterAll(async () => {
+    const app = await appPromise
+    await app.close()
+  })
+
+  it('upserts ip_hits with delta accumulation and clears on reset', async () => {
+    const app = await appPromise
+    await app.ready()
+
+    const { agentId, token } = await enrollApprovedLinux(
+      app,
+      'ip-hits-01',
+      'evofw_ip_hits_token_abcdefghij',
+    )
+
+    const report1 = await app.inject({
+      method: 'POST',
+      url: '/v1/agent/apply-report',
+      headers: {
+        authorization: `Bearer ${token}`,
+        'content-type': 'application/json',
+      },
+      payload: {
+        status: 'ok',
+        prefix_count: 2,
+        packets_dropped: 15,
+        packets_accepted: 1,
+        kernel_method: 'nft',
+        source: 'agent',
+        ip_hits: [
+          { ip: '203.0.113.10', packets: 10 },
+          { ip: '198.51.100.0/24', packets: 5 },
+        ],
+      },
+    })
+    expect(report1.statusCode).toBe(200)
+
+    const list1 = await app.inject({
+      method: 'GET',
+      url: `/api/v1/agents/${agentId}/blocked-ips`,
+    })
+    expect(list1.statusCode).toBe(200)
+    const body1 = list1.json() as {
+      items: { ip: string; packets: number; last_seen_at: string }[]
+    }
+    expect(body1.items).toHaveLength(2)
+    expect(body1.items[0]?.ip).toBe('203.0.113.10')
+    expect(body1.items[0]?.packets).toBe(10)
+    expect(body1.items[1]?.ip).toBe('198.51.100.0/24')
+    expect(body1.items[1]?.packets).toBe(5)
+
+    const report2 = await app.inject({
+      method: 'POST',
+      url: '/v1/agent/apply-report',
+      headers: {
+        authorization: `Bearer ${token}`,
+        'content-type': 'application/json',
+      },
+      payload: {
+        status: 'ok',
+        prefix_count: 2,
+        packets_dropped: 25,
+        packets_accepted: 1,
+        kernel_method: 'nft',
+        source: 'agent',
+        ip_hits: [
+          { ip: '203.0.113.10', packets: 18 },
+          { ip: '198.51.100.0/24', packets: 5 },
+        ],
+      },
+    })
+    expect(report2.statusCode).toBe(200)
+
+    const list2 = await app.inject({
+      method: 'GET',
+      url: `/api/v1/agents/${agentId}/blocked-ips`,
+    })
+    const body2 = list2.json() as {
+      items: { ip: string; packets: number }[]
+    }
+    // 10 + (18-10) = 18; /24 unchanged (delta 0) stays 5
+    expect(body2.items.find((i) => i.ip === '203.0.113.10')?.packets).toBe(18)
+    expect(body2.items.find((i) => i.ip === '198.51.100.0/24')?.packets).toBe(5)
+
+    const reset = await app.inject({
+      method: 'POST',
+      url: `/api/v1/agents/${agentId}/stats/reset`,
+    })
+    expect(reset.statusCode).toBe(200)
+
+    const list3 = await app.inject({
+      method: 'GET',
+      url: `/api/v1/agents/${agentId}/blocked-ips`,
+    })
+    expect(
+      (list3.json() as { items: unknown[] }).items,
+    ).toEqual([])
+  })
+
+  it('rejects ip_hits longer than 200', async () => {
+    const app = await appPromise
+    await app.ready()
+
+    const { token } = await enrollApprovedLinux(
+      app,
+      'ip-hits-max',
+      'evofw_ip_hits_max_token_abcdef',
+    )
+
+    const hits = Array.from({ length: 201 }, (_, i) => ({
+      ip: `203.0.113.${(i % 254) + 1}`,
+      packets: 1,
+    }))
+
+    const report = await app.inject({
+      method: 'POST',
+      url: '/v1/agent/apply-report',
+      headers: {
+        authorization: `Bearer ${token}`,
+        'content-type': 'application/json',
+      },
+      payload: {
+        status: 'ok',
+        packets_dropped: 201,
+        ip_hits: hits,
+      },
+    })
+    expect(report.statusCode).toBeGreaterThanOrEqual(400)
+  })
+})