git init

agent/src/firewall.rs

@@ -0,0 +1,68 @@
+use crate::command;
+use serde::Serialize;
+use serde_json::Value;
+use std::time::Duration;
+
+#[derive(Debug, Serialize)]
+pub struct FirewallStatus {
+    pub backend: String,
+    pub management_enabled: bool,
+    pub managed_table: String,
+    pub ruleset: Value,
+    pub warning: Option<String>,
+}
+
+pub async fn status(timeout: Duration) -> FirewallStatus {
+    if command::run("nft", &["--version"], timeout).await.is_ok() {
+        return match command::run("nft", &["--json", "list", "ruleset"], timeout).await {
+            Ok(output) => FirewallStatus {
+                backend: "nftables".into(),
+                management_enabled: false,
+                managed_table: "inet vps_control".into(),
+                ruleset: serde_json::from_str(&output.stdout).unwrap_or(Value::Null),
+                warning: None,
+            },
+            Err(error) => FirewallStatus {
+                backend: "nftables".into(),
+                management_enabled: false,
+                managed_table: "inet vps_control".into(),
+                ruleset: Value::Null,
+                warning: Some(format!("rules unavailable: {error}")),
+            },
+        };
+    }
+
+    for (program, backend) in [
+        ("iptables-nft", "iptables-nft"),
+        ("iptables", "iptables-legacy"),
+    ] {
+        if let Ok(version) = command::run(program, &["--version"], timeout).await {
+            let detected = if version.stdout.contains("nf_tables") {
+                "iptables-nft"
+            } else {
+                backend
+            };
+            let rules = command::run(program, &["-S"], timeout)
+                .await
+                .ok()
+                .map(|v| v.stdout);
+            return FirewallStatus {
+                backend: detected.into(),
+                management_enabled: false,
+                managed_table: "inet vps_control".into(),
+                ruleset: rules.map(Value::String).unwrap_or(Value::Null),
+                warning: Some(
+                    "legacy-compatible firewall view is read-only and has limited structure".into(),
+                ),
+            };
+        }
+    }
+
+    FirewallStatus {
+        backend: "unavailable".into(),
+        management_enabled: false,
+        managed_table: "inet vps_control".into(),
+        ruleset: Value::Null,
+        warning: Some("no supported firewall userspace utility found".into()),
+    }
+}