fix: read conntrack over ctnetlink; stop reporting an unreadable table as empty (closes #1)

[chicohaager]

Closes #1.

The Connections tab could never work on ZimaOS

ZFW read the connection table from /proc/net/nf_conntrack, falling back to conntrack(8). A stock ZimaOS kernel is built with:

CONFIG_NF_CONNTRACK=y
# CONFIG_NF_CONNTRACK_PROCFS is not set     <- the file never appears
CONFIG_NF_CT_NETLINK=y                      <- this is what it offers instead

and the image ships no conntrack binary. Both sources were therefore unavailable — on a host that was tracking 877 flows when measured. @benhaube's own diagnosis in the issue was right on both counts (and ZFW never used lsmod, so that half of his hypothesis was moot).

ZFW now reads ctnetlink (NETLINK_NETFILTER / IPCTNL_MSG_CT_GET with NLM_F_DUMP) in pure Go via syscall — no new dependency, go.mod still has none. Only CTA_TUPLE_ORIG is decoded, matching the original-direction-only rule of the existing parser. /proc and conntrack(8) stay as fall-throughs for hosts that have them.

Attribute headers are host byte order; payloads (ports, CTA_TIMEOUT) are network order. Each is decoded explicitly, and a test fails if a port is ever read little-endian — that mix-up is the classic ctnetlink bug.

The silent 200 that misdirected the report

The handler did if err != nil { entries = []Entry{} } and answered HTTP 200, so "cannot read the table" was indistinguishable from "no connections". The UI then said the kernel conntrack module was unavailable — on a host where it was running fine. That message is what sent the reporter looking at lsmod and modules.builtin.

Now: an unreadable table is a 503 naming every source that failed, logged at ERROR, and the UI prints that reason. The stale panel hint is gone.

connection table unreadable: ctnetlink: netlink: operation not permitted
/proc/net/nf_conntrack: open /proc/net/nf_conntrack: no such file or directory
conntrack(8): exec: "conntrack": executable file not found in $PATH

Tests

testdata/ctnetlink_dump.bin holds 40 real ctnetlink messages captured from a live ZimaOS 1.6.2 host (kernel 6.18.9). Only the IP addresses were rewritten in place, to documentation ranges — every length, offset and nesting is the kernel's own, so the parser is tested against reality rather than against my idea of the wire format.

Covered: TCP + UDP + IPv6 records, TCP state mapping, big-endian ports, truncation at every byte offset (must not panic), the dump limit across buffers, NLMSG_DONE, and NLMSG_ERROR (EPERM) surfacing as an error rather than an empty list. Each new guard was confirmed to fail against the pre-fix code first.

Live verification (192.168.1.143, ZimaOS 1.6.2)

• Connections tab lists live flows: SYN_SENT, TIME_WAIT, ESTABLISHED, CLOSE_WAIT, stateless UDP, IPv6 (fe80::…:5353 → ff02::fb), and an unknown L4 protocol rendered as PROTO-2 instead of being dropped.
• Failure path forced, not assumed: CAP_NET_ADMIN was removed from the daemon via a temporary systemd drop-in. The UI showed the reason, the daemon logged it at ERROR, HTTP was 503. The drop-in was then removed and the daemon restored.

🤖 Generated with Claude Code