host-iptables-rules.ts

import execa from 'execa';
import { logger } from './logger';
import { API_PROXY_PORTS } from './types';
import { DEFAULT_DNS_SERVERS } from './dns-resolver';
import {
  AWF_NETWORK_GATEWAY,
  CHAIN_NAME,
  CHAIN_NAME_V6,
  NETWORK_NAME,
  addDnsRules,
  disableIpv6ViaSysctl,
  getDockerBridgeGateway,
  getNetworkBridgeName,
  isIp6tablesAvailable,
} from './host-iptables-shared';

/**
 * Configuration for host access rules in the FW_WRAPPER chain.
 * When enabled, allows container traffic to reach the Docker host gateway
 * (needed for Playwright localhost testing, MCP servers, etc.).
 */
export interface HostAccessConfig {
  enabled: boolean;
  allowHostPorts?: string;
  allowHostServicePorts?: string;
}

/**
 * Configuration for the CLI proxy's connection to an external DIFC proxy on the host.
 */
export interface CliProxyHostConfig {
  /** CLI proxy container IP on awf-net (e.g., 172.30.0.50) */
  ip: string;
  /** DIFC proxy port on the host (e.g., 18443) */
  difcProxyPort: number;
}

/**
 * Validates a port specification string.
 * Accepts a single port (1-65535) or a port range ("N-M" where both are valid ports and N <= M).
 */
export function isValidPortSpec(spec: string): boolean {
  const rangeMatch = spec.match(/^(\d+)-(\d+)$/);
  if (rangeMatch) {
    const start = parseInt(rangeMatch[1], 10);
    const end = parseInt(rangeMatch[2], 10);
    if (String(start) !== rangeMatch[1] || String(end) !== rangeMatch[2]) return false;
    return start >= 1 && start <= 65535 && end >= 1 && end <= 65535 && start <= end;
  }
  const port = parseInt(spec, 10);
  return !isNaN(port) && String(port) === spec && port >= 1 && port <= 65535;
}

/**
 * Sets up host-level iptables rules using DOCKER-USER chain
 * This ensures ALL containers on the firewall network are subject to egress filtering.
 *
 * Simplified security model: only localhost, Squid proxy, and DNS forwarding are allowed.
 * Containers use Docker's embedded DNS (127.0.0.11) as their only nameserver.
 * Docker's DNS proxy forwards queries to upstream servers configured via docker-compose dns: field.
 * These forwarded queries traverse the Docker bridge and must be allowed in DOCKER-USER.
 * Squid resolves DNS internally for all HTTP/HTTPS traffic.
 *
 * @param squidIp - IP address of the Squid proxy
 * @param squidPort - Port number of the Squid proxy
 * @param apiProxyIp - Optional IP address of the API proxy sidecar
 * @param dnsServers - Upstream DNS servers that Docker embedded DNS forwards to
 * @param hostAccess - Optional host access configuration for localhost/Playwright support
 * @param cliProxyConfig - Optional CLI proxy config for DIFC proxy host access
 */
export async function setupHostIptables(squidIp: string, squidPort: number, dnsServers: string[], apiProxyIp?: string, dohProxyIp?: string, hostAccess?: HostAccessConfig, cliProxyConfig?: CliProxyHostConfig): Promise<void> {
  logger.info('Setting up host-level iptables rules...');

  // Get the bridge interface name
  const bridgeName = await getNetworkBridgeName();
  if (!bridgeName) {
    throw new Error(`Failed to get bridge name for network '${NETWORK_NAME}'`);
  }

  logger.debug(`Bridge interface: ${bridgeName}`);

  // Check if we have permission to run iptables commands
  try {
    await execa('iptables', ['-t', 'filter', '-L', 'DOCKER-USER', '-n'], { timeout: 5000 });
  } catch (error: any) {
    if (error.stderr && error.stderr.includes('Permission denied')) {
      throw new Error(
        'Permission denied: iptables commands require root privileges. ' +
        'Please run this command with sudo.'
      );
    }
    // DOCKER-USER chain doesn't exist (shouldn't happen, but handle it)
    logger.warn('DOCKER-USER chain does not exist, which is unexpected. Attempting to create it...');
    try {
      await execa('iptables', ['-t', 'filter', '-N', 'DOCKER-USER']);
    } catch {
      throw new Error(
        'Failed to create DOCKER-USER chain. This may indicate a permission or Docker installation issue.'
      );
    }
  }

  // Create dedicated chains for our rules to make cleanup easier
  // Use CHAIN_NAME for IPv4 and CHAIN_NAME_V6 for IPv6
  logger.debug(`Creating dedicated chain '${CHAIN_NAME}'...`);

  // Remove chain if it exists (cleanup from previous runs)
  try {
    // Check if chain exists first
    const { exitCode } = await execa('iptables', ['-t', 'filter', '-L', CHAIN_NAME, '-n'], { reject: false });
    if (exitCode === 0) {
      logger.debug(`Chain '${CHAIN_NAME}' already exists, cleaning up...`);

      // First, remove any references from DOCKER-USER
      const { stdout } = await execa('iptables', [
        '-t', 'filter', '-L', 'DOCKER-USER', '-n', '--line-numbers',
      ], { reject: false });

      const lines = stdout.split('\n');
      const lineNumbers: number[] = [];
      for (const line of lines) {
        if (line.includes(CHAIN_NAME)) {
          const match = line.match(/^(\d+)/);
          if (match) {
            lineNumbers.push(parseInt(match[1], 10));
          }
        }
      }

      // Delete rules in reverse order
      for (const lineNum of lineNumbers.reverse()) {
        logger.debug(`Removing reference to ${CHAIN_NAME} from DOCKER-USER line ${lineNum}`);
        await execa('iptables', [
          '-t', 'filter', '-D', 'DOCKER-USER', lineNum.toString(),
        ], { reject: false });
      }

      // Then flush and delete the chain
      await execa('iptables', ['-t', 'filter', '-F', CHAIN_NAME], { reject: false });
      await execa('iptables', ['-t', 'filter', '-X', CHAIN_NAME], { reject: false });
    }
  } catch (error) {
    // Ignore errors
    logger.debug('Error during chain cleanup:', error);
  }

  // Create the chain
  await execa('iptables', ['-t', 'filter', '-N', CHAIN_NAME]);

  // Build rules in our dedicated chain
  // 1. Allow all traffic FROM the Squid proxy (it needs unrestricted outbound access)
  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-s', squidIp,
    '-j', 'ACCEPT',
  ]);

  // 1b. Allow HTTPS traffic FROM the DoH proxy (it needs to reach the DoH resolver directly)
  if (dohProxyIp) {
    logger.debug(`Allowing HTTPS traffic from DoH proxy at ${dohProxyIp}`);
    await execa('iptables', [
      '-t', 'filter', '-A', CHAIN_NAME,
      '-s', dohProxyIp, '-p', 'tcp', '--dport', '443',
      '-j', 'ACCEPT',
    ]);
  }

  // Note: API proxy sidecar (when enabled) does NOT get a firewall exemption.
  // It routes through Squid via HTTP_PROXY/HTTPS_PROXY environment variables,
  // ensuring domain whitelisting is enforced by Squid ACLs.

  // 2. Allow established and related connections (return traffic)
  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-m', 'conntrack', '--ctstate', 'ESTABLISHED,RELATED',
    '-j', 'ACCEPT',
  ]);

  // 3. Allow localhost traffic
  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-o', 'lo',
    '-j', 'ACCEPT',
  ]);

  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-d', '127.0.0.0/8',
    '-j', 'ACCEPT',
  ]);

  // 4. Check ip6tables availability and disable IPv6 if unavailable
  const ip6tablesAvailable = await isIp6tablesAvailable();
  if (!ip6tablesAvailable) {
    logger.warn('ip6tables is not available, disabling IPv6 via sysctl to prevent unfiltered bypass');
    await disableIpv6ViaSysctl();
  }

  // 4b. Allow DNS forwarding to upstream servers
  // Docker's embedded DNS (127.0.0.11) proxies queries to upstream servers configured
  // via docker-compose dns: field. These forwarded queries traverse the Docker bridge
  // and need to be allowed here. Only the configured upstream servers are permitted.
  const upstreamDns = dnsServers && dnsServers.length > 0 ? dnsServers : DEFAULT_DNS_SERVERS;
  logger.debug(`Allowing DNS forwarding to upstream servers: ${upstreamDns.join(', ')}`);

  // Create IPv6 chain if needed (only when IPv6 DNS servers are configured)
  const hasIpv6Dns = upstreamDns.some(s => s.includes(':'));
  if (hasIpv6Dns && ip6tablesAvailable) {
    logger.debug(`Creating dedicated IPv6 chain '${CHAIN_NAME_V6}' for IPv6 DNS rules...`);
    try {
      const { exitCode: v6ChainExists } = await execa('ip6tables', ['-t', 'filter', '-L', CHAIN_NAME_V6, '-n'], { reject: false });
      if (v6ChainExists === 0) {
        logger.debug(`Chain '${CHAIN_NAME_V6}' already exists, cleaning up...`);
        await execa('ip6tables', ['-t', 'filter', '-F', CHAIN_NAME_V6], { reject: false });
        await execa('ip6tables', ['-t', 'filter', '-X', CHAIN_NAME_V6], { reject: false });
      }
    } catch (error) {
      logger.debug('Error during IPv6 chain cleanup:', error);
    }
    await execa('ip6tables', ['-t', 'filter', '-N', CHAIN_NAME_V6]);
  }

  for (const dnsServer of upstreamDns) {
    // IPv6 DNS servers must use ip6tables, IPv4 uses iptables
    const isV6 = dnsServer.includes(':');
    if (isV6) {
      if (ip6tablesAvailable) {
        await addDnsRules('ip6tables', CHAIN_NAME_V6, dnsServer);
      }
    } else {
      await addDnsRules('iptables', CHAIN_NAME, dnsServer);
    }
  }

  // 5. Allow traffic to Squid proxy
  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-p', 'tcp', '-d', squidIp, '--dport', squidPort.toString(),
    '-j', 'ACCEPT',
  ]);

  // 5a. Allow DNS traffic to DoH proxy sidecar (when enabled)
  if (dohProxyIp) {
    logger.debug(`Allowing DNS traffic to DoH proxy sidecar at ${dohProxyIp}:53`);
    await addDnsRules('iptables', CHAIN_NAME, dohProxyIp);
  }

  // 5b. Allow traffic to API proxy sidecar (when enabled)
  // Allow all API proxy ports (OpenAI, Anthropic, GitHub Copilot, OpenCode).
  // The sidecar itself routes through Squid, so domain whitelisting is still enforced.
  if (apiProxyIp) {
    const allPorts = Object.values(API_PROXY_PORTS);
    const minPort = Math.min(...allPorts);
    const maxPort = Math.max(...allPorts);
    logger.debug(`Allowing traffic to API proxy sidecar at ${apiProxyIp}:${minPort}-${maxPort}`);
    await execa('iptables', [
      '-t', 'filter', '-A', CHAIN_NAME,
      '-p', 'tcp', '-d', apiProxyIp, '--dport', `${minPort}:${maxPort}`,
      '-j', 'ACCEPT',
    ]);
  }

  // 5b2. Allow CLI proxy container to reach host DIFC proxy (when enabled)
  // The cli-proxy container needs to TCP-tunnel to the external DIFC proxy on the host.
  // Only the cli-proxy IP is allowed to reach the host gateway on the DIFC port.
  if (cliProxyConfig) {
    const { ip: cliProxyIp, difcProxyPort } = cliProxyConfig;
    const gatewayIp = await getDockerBridgeGateway();
    const gatewayIps = [AWF_NETWORK_GATEWAY];
    if (gatewayIp) {
      gatewayIps.push(gatewayIp);
    }
    for (const gwIp of gatewayIps) {
      logger.debug(`Allowing CLI proxy (${cliProxyIp}) → host gateway (${gwIp}):${difcProxyPort}`);
      await execa('iptables', [
        '-t', 'filter', '-A', CHAIN_NAME,
        '-p', 'tcp', '-s', cliProxyIp, '-d', gwIp, '--dport', difcProxyPort.toString(),
        '-j', 'ACCEPT',
      ]);
    }
    logger.info(`CLI proxy host access enabled: ${cliProxyIp} → host gateway:${difcProxyPort}`);
  }

  // 5c. Allow traffic to host gateway when host access is enabled
  // This is needed for Playwright localhost testing, MCP servers, etc.
  if (hostAccess?.enabled) {
    const gatewayIp = await getDockerBridgeGateway();
    const gatewayIps = [AWF_NETWORK_GATEWAY];
    if (gatewayIp) {
      gatewayIps.push(gatewayIp);
    }

    // Default: allow HTTP (80) and HTTPS (443)
    const defaultPorts = ['80', '443'];

    // Parse additional custom ports
    const customPorts: string[] = [];
    if (hostAccess.allowHostPorts) {
      for (const entry of hostAccess.allowHostPorts.split(',')) {
        const trimmed = entry.trim();
        if (trimmed) {
          if (!isValidPortSpec(trimmed)) {
            logger.warn(`Skipping invalid port spec: ${trimmed}`);
            continue;
          }
          customPorts.push(trimmed);
        }
      }
    }

    // Also include host service ports (--allow-host-service-ports)
    // These intentionally bypass dangerous port restrictions since traffic is host-gateway-only
    if (hostAccess.allowHostServicePorts) {
      for (const entry of hostAccess.allowHostServicePorts.split(',')) {
        const trimmed = entry.trim();
        if (trimmed) {
          if (!isValidPortSpec(trimmed)) {
            logger.warn(`Skipping invalid host service port spec: ${trimmed}`);
            continue;
          }
          customPorts.push(trimmed);
        }
      }
    }

    const allPorts = [...new Set([...defaultPorts, ...customPorts])];

    for (const gwIp of gatewayIps) {
      for (const port of allPorts) {
        // Port ranges (e.g., "3000-3010") use --dport with range syntax
        logger.debug(`Allowing host gateway traffic: ${gwIp}:${port}`);
        await execa('iptables', [
          '-t', 'filter', '-A', CHAIN_NAME,
          '-p', 'tcp', '-d', gwIp, '--dport', port,
          '-j', 'ACCEPT',
        ]);
      }
    }
    logger.info(`Host access enabled: allowing traffic to gateway IPs ${gatewayIps.join(', ')} on ports ${allPorts.join(', ')}`);
  }

  // 6. Block multicast and link-local traffic
  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-m', 'addrtype', '--dst-type', 'MULTICAST',
    '-j', 'REJECT', '--reject-with', 'icmp-port-unreachable',
  ]);

  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-d', '169.254.0.0/16',
    '-j', 'REJECT', '--reject-with', 'icmp-port-unreachable',
  ]);

  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-d', '224.0.0.0/4',
    '-j', 'REJECT', '--reject-with', 'icmp-port-unreachable',
  ]);

  // 7. Block all other UDP traffic (DNS to whitelisted servers already allowed above)
  // This catches DNS exfiltration attempts to unauthorized servers
  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-p', 'udp',
    '-j', 'LOG', '--log-prefix', '[FW_BLOCKED_UDP] ', '--log-level', '4',
  ]);

  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-p', 'udp',
    '-j', 'REJECT', '--reject-with', 'icmp-port-unreachable',
  ]);

  // 8. Default deny all other traffic
  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-j', 'LOG', '--log-prefix', '[FW_BLOCKED_OTHER] ', '--log-level', '4',
  ]);

  await execa('iptables', [
    '-t', 'filter', '-A', CHAIN_NAME,
    '-j', 'REJECT', '--reject-with', 'icmp-port-unreachable',
  ]);

  // Now insert a rule in DOCKER-USER that jumps to our chain for traffic FROM the firewall bridge
  // Note: We use -i (input interface) to match egress traffic FROM containers on the bridge
  // Check if rule already exists
  const { stdout: existingRules } = await execa('iptables', [
    '-t', 'filter', '-L', 'DOCKER-USER', '-n', '--line-numbers',
  ]);

  if (!existingRules.includes(`-i ${bridgeName}`)) {
    logger.debug(`Inserting rule in DOCKER-USER to jump to ${CHAIN_NAME} for bridge ${bridgeName}...`);
    await execa('iptables', [
      '-t', 'filter', '-I', 'DOCKER-USER', '1',
      '-i', bridgeName,
      '-j', CHAIN_NAME,
    ]);
  } else {
    logger.debug(`Rule for bridge ${bridgeName} already exists in DOCKER-USER`);
  }

  logger.success('Host-level iptables rules configured successfully');

  // Show the rules for debugging
  logger.debug('DOCKER-USER chain:');
  const { stdout: dockerUserRules } = await execa('iptables', [
    '-t', 'filter', '-L', 'DOCKER-USER', '-n', '-v',
  ]);
  logger.debug(dockerUserRules);

  logger.debug(`${CHAIN_NAME} chain:`);
  const { stdout: fwWrapperRules } = await execa('iptables', [
    '-t', 'filter', '-L', CHAIN_NAME, '-n', '-v',
  ]);
  logger.debug(fwWrapperRules);
}