nftables: per-rule logging and a live firewall-log view

[edimarlnx]

Adds the OPNsense-style logging model to the nftables backend: mark a rule to be logged, and watch the logged rules fire in a live view.

Per-rule logging (l)

• A rule the tool owns is replaced in place with nft replace rule … log prefix "tui:<chain> <verdict> " …, keeping its handle and position. nft rules are immutable, so a log statement can only be added or removed by replacing the whole rule.
• The replacement is rebuilt from the rule's own modelled match and previewed like every other mutation. A rule the model does not hold in full (an unmodeled match, a NAT translation, an unsupported verdict) is refused rather than rewritten from a display rendering.
• The log/nflog statement (prefix, level, group) now round-trips through the reader; the prefix keeps its own trailing space so it round-trips to nft. A reject rule keeps the answer it sends.
• A logged rule carries a LOG marker in its row and a LOG column.

Live log (w)

• A read-only stream of the kernel firewall log, filtered to the tool's own tui: prefix, read with journalctl --kernel --follow --output=short-iso. A machine without journald is told so plainly.
• Each event parses into time, direction (from the chain, falling back to the interfaces), action, source, destination, port and prefix; shown newest-last, pausable, with the retained lines capped.
• --demo plays a synthetic feed so the view animates with no journald and no root.
• --check/--report note how many owned rules log and whether the live source is readable.

Boundary

Exec for the stream stays inside internal/nftables/ (the backend package), so check-exec.sh is unchanged. Every mutation is still a previewed runner.Command.

Validation (no lab)

• make check green: fmt, vet, golangci (incl. gosec), exec boundary, tests, tidy.
• Against real nft v1.1.1 in unshare -rn: the replace … log prefix … and its reverse are accepted, reject with tcp reset + log is accepted, and the log statement round-trips through nft -j. A logging drop rule fires (counter increments) but the rootless netns does not deliver its kernel-log line, so the parser is proven on the documented nf_log line format as labelled fixtures.
• Fuzz: new FuzzParseKernelLogLine (45s) plus FuzzDecodeExprs (35s) and FuzzParseRuleset (30s) with new log/nflog/reject seeds — no crashes.

Lab acceptance still owed (item 10's lab twin, for later)

Mark a drop-with-log rule through the real TUI, generate blocked traffic against the router, and see the live view show the event with the correct direction and source — on the multi-VM lab where the init-namespace kernel log and journald deliver the line.

🤖 Generated with Claude Code