Deployment readiness: deception metrics, real-service DNAT, hardening + systemd #98

Merged

vxfemboy merged 3 commits from sp-deploy-readiness into main

2026-07-04 06:45:55 +00:00

vxfemboy commented

2026-07-04 06:39:15 +00:00

(Migrated from github.com)

A push to make Blackwall actually deployable end to end. Three related pieces:

1. Deception `/metrics` + live in-flight gauge

blackwalld run previously ignored metrics_listen — the deception engine exposed no metrics at all. Now it serves /metrics with blackwall_deception_sessions_active (a live in-flight count tracked by an RAII drop-guard in serve(), covering success/error/timeout/panic) plus the session/audit/detection DB totals. MetricsSources.collector is now optional (deception has no sFlow collector).

2. Real-service DNAT (`nat:` targets)

Declared real services with a fixed backend (allow tcp 443 nat:10.0.0.9:8443) were only accepted and never forwarded to the backend — real services behind a nat: target silently didn't work. Added a separate nat prerouting chain (dstnat priority) with a per-service dnat to <ip>:<port> rule. host:/incus: keep the plain accept; cross-family targets are skipped. Verified renders + applies via nft -j.

3. Deployment hardening + artifacts

Black-holing-on-partial-apply fixed: if the TPROXY policy route fails to install after the nft ruleset is applied, apply() now tears the whole dataplane back down instead of leaving a table that diverts deception traffic to an unreachable socket.
Interface footgun fixed: blackwalld apply/run fail fast if the config's interface doesn't exist (a wrong iifname otherwise silently classifies no traffic).
systemd units (deploy/blackwalld-{deception,flow}.service) — correct caps, SIGTERM graceful stop, Restart=always.
docs/deployment.md — install → dress-rehearse → staged enable → observe → stop/emergency → security → not-yet-implemented.
README — corrected the flowtable/"fast path" overclaims (no flowtable/XDP exists yet); noted real-service DNAT now works.

Verification

fmt/clippy --workspace --all-targets --deny warnings clean; cargo test --workspace 46 suites (incl. 2 new DNAT render tests); coverage 95.10%; nft snapshot updated.
DNAT + the render changes verified applying cleanly via nft -j.

🤖 Generated with Claude Code

A push to make Blackwall actually deployable end to end. Three related pieces: ## 1. Deception `/metrics` + live in-flight gauge `blackwalld run` previously **ignored `metrics_listen`** — the deception engine exposed no metrics at all. Now it serves `/metrics` with `blackwall_deception_sessions_active` (a live in-flight count tracked by an RAII drop-guard in `serve()`, covering success/error/timeout/panic) plus the session/audit/detection DB totals. `MetricsSources.collector` is now optional (deception has no sFlow collector). ## 2. Real-service DNAT (`nat:` targets) Declared real services with a fixed backend (`allow tcp 443 nat:10.0.0.9:8443`) were only `accept`ed and **never forwarded to the backend** — real services behind a `nat:` target silently didn't work. Added a separate `nat` prerouting chain (dstnat priority) with a per-service `dnat to <ip>:<port>` rule. `host:`/`incus:` keep the plain accept; cross-family targets are skipped. **Verified renders + applies via `nft -j`.** ## 3. Deployment hardening + artifacts - **Black-holing-on-partial-apply fixed**: if the TPROXY policy route fails to install *after* the nft ruleset is applied, `apply()` now tears the whole dataplane back down instead of leaving a table that diverts deception traffic to an unreachable socket. - **Interface footgun fixed**: `blackwalld apply`/`run` fail fast if the config's `interface` doesn't exist (a wrong `iifname` otherwise silently classifies no traffic). - **systemd units** (`deploy/blackwalld-{deception,flow}.service`) — correct caps, SIGTERM graceful stop, `Restart=always`. - **`docs/deployment.md`** — install → dress-rehearse → staged enable → observe → stop/emergency → security → not-yet-implemented. - **README** — corrected the flowtable/"fast path" overclaims (no flowtable/XDP exists yet); noted real-service DNAT now works. ## Verification - `fmt`/`clippy --workspace --all-targets --deny warnings` clean; `cargo test --workspace` 46 suites (incl. 2 new DNAT render tests); coverage **95.10%**; nft snapshot updated. - DNAT + the render changes verified applying cleanly via `nft -j`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)