|
| 1 | +#!/usr/bin/env bash |
| 2 | +# ============================================================================= |
| 3 | +# NFTBan v1.100 PR-P2-3 — CI kernel/service snapshot helper |
| 4 | +# ============================================================================= |
| 5 | +# SPDX-License-Identifier: MPL-2.0 |
| 6 | +# meta:name="ci-snapshot-kernel-service" |
| 7 | +# meta:type="script" |
| 8 | +# meta:version="1.100.0" |
| 9 | +# meta:owner="Antonios Voulvoulis <contact@nftban.com>" |
| 10 | +# meta:created_date="2026-04-20" |
| 11 | +# meta:description="Emit stable before/after snapshot of nft tables + firewall-adjacent service states" |
| 12 | +# meta:inventory.files="scripts/ci-snapshot-kernel-service.sh" |
| 13 | +# meta:inventory.binaries="" |
| 14 | +# meta:inventory.env_vars="" |
| 15 | +# meta:inventory.config_files="" |
| 16 | +# meta:inventory.systemd_units="nftband.service, ufw.service, firewalld.service, csf.service, lfd.service, iptables.service" |
| 17 | +# meta:inventory.network="" |
| 18 | +# meta:inventory.privileges="root" |
| 19 | +# ============================================================================= |
| 20 | +# |
| 21 | +# Prints a deterministic, line-oriented snapshot of: |
| 22 | +# |
| 23 | +# 1. Kernel nftables tables (`nft list tables`, sorted) |
| 24 | +# 2. Firewall-adjacent systemd unit states (nftband + every external |
| 25 | +# firewall unit the lifecycle may interact with) |
| 26 | +# |
| 27 | +# Used by CI gates to assert that dry-run paths leave kernel and |
| 28 | +# service state unchanged. The caller captures the output twice |
| 29 | +# (before + after the dry-run) and fails CI if the two snapshots |
| 30 | +# differ. |
| 31 | +# |
| 32 | +# Degrades gracefully on container environments that lack nft or |
| 33 | +# systemctl — both sides of the comparison emit the same placeholder, |
| 34 | +# so diff remains empty for environments that cannot probe. |
| 35 | +# |
| 36 | +# Contract (PR-P2-3, frozen 2026-04-20): |
| 37 | +# - Output is stable (sorted) and purely from read-only probes. |
| 38 | +# - Never invokes nft / systemctl with mutation verbs. |
| 39 | +# - Never writes to the filesystem. |
| 40 | +# - Exit code 0 always; the CALLER decides whether differences fail. |
| 41 | +# |
| 42 | +# ============================================================================= |
| 43 | +set -Eeuo pipefail |
| 44 | + |
| 45 | +# PR-P2-3 monitored-units: every unit that is either owned by nftban or |
| 46 | +# represents an external firewall the lifecycle code touches. Kept in |
| 47 | +# lockstep with internal/installer/extfw/detect.go so the CI gate and |
| 48 | +# the production detector agree on "what counts as a firewall service." |
| 49 | +UNITS=( |
| 50 | + nftband.service |
| 51 | + ufw.service |
| 52 | + firewalld.service |
| 53 | + csf.service |
| 54 | + lfd.service |
| 55 | + iptables.service |
| 56 | +) |
| 57 | + |
| 58 | +echo "## kernel-nft-tables" |
| 59 | +if command -v nft >/dev/null 2>&1; then |
| 60 | + # Redirect stderr so a missing kernel module doesn't pollute the |
| 61 | + # snapshot with different messages across before/after invocations. |
| 62 | + sudo nft list tables 2>/dev/null | sort || echo "nft:exec_failed" |
| 63 | +else |
| 64 | + echo "nft:not_installed" |
| 65 | +fi |
| 66 | + |
| 67 | +echo "## service-states" |
| 68 | +if command -v systemctl >/dev/null 2>&1 && systemctl --version >/dev/null 2>&1; then |
| 69 | + for u in "${UNITS[@]}"; do |
| 70 | + # Always emit "unit=state" for every monitored unit — even |
| 71 | + # inactive/missing — so both sides of the before/after diff |
| 72 | + # produce the same lines unless state actually changes. |
| 73 | + # `is-active` exits non-zero for inactive; we capture the |
| 74 | + # string and swallow the exit code intentionally. |
| 75 | + state=$(systemctl is-active "$u" 2>&1 || true) |
| 76 | + echo "$u=$state" |
| 77 | + done |
| 78 | +else |
| 79 | + echo "systemctl:not_available" |
| 80 | +fi |
0 commit comments