Add opt-in conntrack network activity and CrowdSec firewall counters

agent.go

@@ -145,6 +145,7 @@ type AgentUpdateManifest struct {
 
 type agentReportResponse struct {
 	Accepted       bool                 `json:"accepted"`
+	NetworkEnabled bool                 `json:"networkEnabled"`
 	TrafficEnabled bool                 `json:"trafficEnabled"`
 	Update         *AgentUpdateManifest `json:"update,omitempty"`
 	Commands       []AgentCommand       `json:"commands,omitempty"`
@@ -340,6 +341,14 @@ func runGuestAgent(opts agentOptions) error {
 			return err
 		}
 	}
+	var networkStop func()
+	stopNetwork := func() {
+		if networkStop != nil {
+			networkStop()
+			networkStop = nil
+		}
+	}
+	defer stopNetwork()
 	var trafficStop func()
 	stopTraffic := func() {
 		if trafficStop != nil {
@@ -367,6 +376,7 @@ func runGuestAgent(opts agentOptions) error {
 				fresh, enrollmentErr := enrollRemote(config, opts.EnrollmentToken)
 				if enrollmentErr == nil {
 					stopTraffic()
+					stopNetwork()
 					config = fresh
 					if saveErr := saveAgentConfig(opts.ConfigPath, config); saveErr != nil {
 						return saveErr
@@ -383,6 +393,11 @@ func runGuestAgent(opts agentOptions) error {
 			if response.StatusCode == http.StatusOK {
 				var result agentReportResponse
 				if json.Unmarshal(responseData, &result) == nil {
+					if !result.NetworkEnabled {
+						stopNetwork()
+					} else if networkStop == nil {
+						networkStop = startAgentNetwork(config)
+					}
 					if !result.TrafficEnabled {
 						stopTraffic()
 					} else if trafficStop == nil {