@push.rocks/smartnftables 1.2.0 → 1.3.1

package/rust/src/policy.rs

@@ -0,0 +1,427 @@
+use crate::wire::{self, Attr};
+use crate::{Error, Result};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::collections::BTreeSet;
+use std::net::Ipv4Addr;
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Endpoint {
+    pub id: String,
+    pub interface_index: u32,
+    pub interface_name: String,
+    pub interface_kind: String,
+    pub source_prefixes: Vec<String>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Rule {
+    #[serde(deserialize_with = "required_nullable")]
+    pub source_endpoint: Option<String>,
+    #[serde(deserialize_with = "required_nullable")]
+    pub destination_endpoint: Option<String>,
+    pub source_prefix: String,
+    pub destination_prefix: String,
+    pub protocol: String,
+    #[serde(deserialize_with = "required_nullable")]
+    pub source_port: Option<u16>,
+    #[serde(deserialize_with = "required_nullable")]
+    pub destination_port: Option<u16>,
+}
+
+pub fn required_nullable<'de, D: serde::Deserializer<'de>, T: Deserialize<'de>>(
+    deserializer: D,
+) -> std::result::Result<Option<T>, D::Error> {
+    Option::<T>::deserialize(deserializer)
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Policy {
+    pub schema_version: u8,
+    pub revision: u64,
+    pub endpoints: Vec<Endpoint>,
+    pub rules: Vec<Rule>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Prepared {
+    pub policy: Policy,
+    pub digest: String,
+}
+
+pub fn identifier(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= 64
+        && value
+            .bytes()
+            .all(|v| v.is_ascii_alphanumeric() || b"_-".contains(&v))
+}
+
+pub fn prefix(value: &str) -> Result<(u32, u32)> {
+    let (address, bits) = value.split_once('/').ok_or(Error::Invalid)?;
+    let ip: Ipv4Addr = address.parse().map_err(|_| Error::Invalid)?;
+    let length: u32 = bits.parse().map_err(|_| Error::Invalid)?;
+    if !(1..=32).contains(&length)
+        || length.to_string() != bits
+        || ip.to_string() != address
+        || ip.is_loopback()
+        || ip.is_multicast()
+        || ip.is_unspecified()
+        || ip == Ipv4Addr::BROADCAST
+    {
+        return Err(Error::Invalid);
+    }
+    let mask = u32::MAX << (32 - length);
+    let address = u32::from(ip);
+    if address & mask != address {
+        return Err(Error::Invalid);
+    }
+    Ok((address, mask))
+}
+
+fn covers(parent: &str, child: &str) -> Result<bool> {
+    let (a, mask) = prefix(parent)?;
+    let (b, other_mask) = prefix(child)?;
+    Ok(other_mask & mask == mask && b & mask == a)
+}
+
+impl Policy {
+    pub fn prepare(mut self) -> Result<Prepared> {
+        if self.schema_version != 1
+            || self.revision == 0
+            || self.revision > 9_007_199_254_740_991
+            || self.endpoints.len() > 32
+            || self.rules.len() > 128
+        {
+            return Err(Error::Invalid);
+        }
+        let mut ids = BTreeSet::new();
+        let mut indices = BTreeSet::new();
+        let mut names = BTreeSet::new();
+        for endpoint in &mut self.endpoints {
+            if !identifier(&endpoint.id)
+                || !ids.insert(endpoint.id.clone())
+                || endpoint.interface_index == 0
+                || endpoint.interface_index > i32::MAX as u32
+                || !["veth", "tun"].contains(&endpoint.interface_kind.as_str())
+                || !indices.insert(endpoint.interface_index)
+                || endpoint.interface_name.len() > 15
+                || !identifier(&endpoint.interface_name)
+                || endpoint.interface_name == "lo"
+                || !names.insert(endpoint.interface_name.clone())
+                || endpoint.source_prefixes.is_empty()
+                || endpoint.source_prefixes.len() > 16
+            {
+                return Err(Error::Invalid);
+            }
+            endpoint.source_prefixes.sort();
+            for (index, item) in endpoint.source_prefixes.iter().enumerate() {
+                prefix(item)?;
+                for other in &endpoint.source_prefixes[..index] {
+                    if covers(item, other)? || covers(other, item)? {
+                        return Err(Error::Invalid);
+                    }
+                }
+            }
+        }
+        self.endpoints.sort_by(|a, b| a.id.cmp(&b.id));
+        for (index, endpoint) in self.endpoints.iter().enumerate() {
+            for other in &self.endpoints[..index] {
+                for a in &endpoint.source_prefixes {
+                    for b in &other.source_prefixes {
+                        if covers(a, b)? || covers(b, a)? {
+                            return Err(Error::Invalid);
+                        }
+                    }
+                }
+            }
+        }
+        self.rules.sort();
+        if self.rules.windows(2).any(|pair| pair[0] == pair[1]) {
+            return Err(Error::Invalid);
+        }
+        for rule in &self.rules {
+            if rule.source_endpoint.is_none() && rule.destination_endpoint.is_none()
+                || !["any", "tcp", "udp"].contains(&rule.protocol.as_str())
+                || rule.destination_port == Some(0)
+                || rule.source_port == Some(0)
+                || rule.protocol == "any"
+                    && (rule.destination_port.is_some() || rule.source_port.is_some())
+            {
+                return Err(Error::Invalid);
+            }
+            for (id, cidr) in [
+                (&rule.source_endpoint, &rule.source_prefix),
+                (&rule.destination_endpoint, &rule.destination_prefix),
+            ] {
+                prefix(cidr)?;
+                if let Some(id) = id {
+                    let endpoint = self
+                        .endpoints
+                        .iter()
+                        .find(|ep| &ep.id == id)
+                        .ok_or(Error::Invalid)?;
+                    if !endpoint
+                        .source_prefixes
+                        .iter()
+                        .any(|parent| covers(parent, cidr).unwrap_or(false))
+                    {
+                        return Err(Error::Invalid);
+                    }
+                } else {
+                    // A remote/host selector cannot grant an overlapping local source
+                    // an interface-independent route through another workload's grant.
+                    for endpoint in &self.endpoints {
+                        for local in &endpoint.source_prefixes {
+                            if covers(local, cidr)? || covers(cidr, local)? {
+                                return Err(Error::Invalid);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        let digest = format!(
+            "sha256:{:x}",
+            Sha256::digest(serde_json::to_vec(&self).map_err(|_| Error::Invalid)?)
+        );
+        let prepared = Prepared {
+            policy: self,
+            digest,
+        };
+        // Compile during preparation; an oversized native batch never reaches the kernel.
+        let program = prepared.program(&format!("snft_{}", "x".repeat(59)))?;
+        // Reserve enough of the 240 KiB batch for deleting a previous maximum
+        // graph, then installing this complete graph in the same transaction.
+        if program.len() > 768
+            || program
+                .iter()
+                .map(|(_, attrs)| wire::encode_attrs(attrs).len() + 20)
+                .sum::<usize>()
+                > 100_000
+        {
+            return Err(Error::Invalid);
+        }
+        Ok(prepared)
+    }
+}
+
+fn expr(name: &str, data: Vec<Attr>) -> Attr {
+    Attr::nested(1, vec![Attr::string(1, name), Attr::nested(2, data)])
+}
+fn compare(value: Vec<u8>) -> Attr {
+    expr(
+        "cmp",
+        vec![
+            Attr::u32(1, 1),
+            Attr::u32(2, 0),
+            Attr::nested(3, vec![Attr::bytes(1, value)]),
+        ],
+    )
+}
+fn meta(key: u32, value: Vec<u8>) -> Vec<Attr> {
+    vec![
+        expr("meta", vec![Attr::u32(1, 1), Attr::u32(2, key)]),
+        compare(value),
+    ]
+}
+fn interface(endpoint: &Endpoint, incoming: bool) -> Vec<Attr> {
+    let mut result = meta(
+        if incoming { 4 } else { 5 },
+        endpoint.interface_index.to_ne_bytes().to_vec(),
+    );
+    let mut name = endpoint.interface_name.as_bytes().to_vec();
+    name.push(0);
+    result.extend(meta(if incoming { 6 } else { 7 }, name));
+    result
+}
+fn ipv4() -> Vec<Attr> {
+    meta(15, vec![libc::NFPROTO_IPV4 as u8])
+}
+fn address(cidr: &str, source: bool) -> Result<Vec<Attr>> {
+    let (address, mask) = prefix(cidr)?;
+    Ok(vec![
+        expr(
+            "payload",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, 1),
+                Attr::u32(3, if source { 12 } else { 16 }),
+                Attr::u32(4, 4),
+            ],
+        ),
+        expr(
+            "bitwise",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, 1),
+                Attr::u32(3, 4),
+                Attr::nested(4, vec![Attr::bytes(1, mask.to_be_bytes().to_vec())]),
+                Attr::nested(5, vec![Attr::bytes(1, vec![0; 4])]),
+                Attr::u32(6, 0),
+            ],
+        ),
+        compare(address.to_be_bytes().to_vec()),
+    ])
+}
+fn verdict(code: i32, chain: Option<&str>) -> Attr {
+    let mut data = vec![Attr::u32(1, code as u32)];
+    if let Some(chain) = chain {
+        data.push(Attr::string(2, chain));
+    }
+    expr(
+        "immediate",
+        vec![
+            Attr::u32(1, 0),
+            Attr::nested(2, vec![Attr::nested(2, data)]),
+        ],
+    )
+}
+
+impl Prepared {
+    pub fn validate(&self) -> Result<()> {
+        if self.policy.clone().prepare()? != *self {
+            return Err(Error::Invalid);
+        }
+        Ok(())
+    }
+    pub fn validate_interfaces(&self) -> Result<()> {
+        wire::verify_interfaces(self.policy.endpoints.iter().map(|endpoint| {
+            (
+                endpoint.interface_index,
+                endpoint.interface_name.as_str(),
+                endpoint.interface_kind.as_str(),
+            )
+        }))
+    }
+    /// Only typed policy can create these private UAPI messages. No raw command API exists.
+    pub fn program(&self, table: &str) -> Result<Vec<(u16, Vec<Attr>)>> {
+        let mut program = Vec::new();
+        let mut ordinal = 0;
+        let mut rule =
+            |chain: &str, expressions: Vec<Attr>, program: &mut Vec<(u16, Vec<Attr>)>| {
+                let stamp = format!("snft1:{}:{}:{ordinal}", self.policy.revision, self.digest);
+                ordinal += 1;
+                program.push((
+                    6,
+                    vec![
+                        Attr::string(1, table),
+                        Attr::string(2, chain),
+                        Attr::nested(4, expressions),
+                        Attr::bytes(7, stamp.into_bytes()),
+                    ],
+                ));
+            };
+        for (chain, hook) in [("input", 1), ("forward", 2), ("output", 3)] {
+            program.push((
+                3,
+                vec![
+                    Attr::string(1, table),
+                    Attr::string(3, chain),
+                    Attr::nested(4, vec![Attr::u32(1, hook), Attr::u32(2, (-150_i32) as u32)]),
+                    Attr::u32(5, 1),
+                    Attr::string(7, "filter"),
+                    Attr::u32(10, 1),
+                ],
+            ));
+        }
+        for (index, endpoint) in self.policy.endpoints.iter().enumerate() {
+            for incoming in [true, false] {
+                let name = format!("guard_{index}_{}", if incoming { "in" } else { "out" });
+                program.push((3, vec![Attr::string(1, table), Attr::string(3, &name)]));
+                for cidr in &endpoint.source_prefixes {
+                    let mut expressions = ipv4();
+                    expressions.extend(address(cidr, incoming)?);
+                    expressions.push(verdict(-5, None));
+                    rule(&name, expressions, &mut program);
+                }
+                rule(&name, vec![verdict(0, None)], &mut program);
+            }
+        }
+        for chain in ["input", "forward", "output"] {
+            for (index, endpoint) in self.policy.endpoints.iter().enumerate() {
+                for incoming in [true, false] {
+                    if (chain == "input" && !incoming) || (chain == "output" && incoming) {
+                        continue;
+                    }
+                    let name = format!("guard_{index}_{}", if incoming { "in" } else { "out" });
+                    let mut expressions = interface(endpoint, incoming);
+                    expressions.push(verdict(-3, Some(&name)));
+                    rule(chain, expressions, &mut program);
+                }
+            }
+            for grant in &self.policy.rules {
+                if chain == "input" && grant.destination_endpoint.is_some()
+                    || chain == "output" && grant.source_endpoint.is_some()
+                    || chain == "forward"
+                        && (grant.source_endpoint.is_none() || grant.destination_endpoint.is_none())
+                {
+                    continue;
+                }
+                let mut expressions = ipv4();
+                for (id, incoming) in [
+                    (&grant.source_endpoint, true),
+                    (&grant.destination_endpoint, false),
+                ] {
+                    if let Some(id) = id {
+                        let endpoint = self
+                            .policy
+                            .endpoints
+                            .iter()
+                            .find(|ep| &ep.id == id)
+                            .ok_or(Error::Invalid)?;
+                        expressions.extend(interface(endpoint, incoming));
+                    }
+                }
+                expressions.extend(address(&grant.source_prefix, true)?);
+                expressions.extend(address(&grant.destination_prefix, false)?);
+                if grant.protocol != "any" {
+                    expressions
+                        .extend(meta(16, vec![if grant.protocol == "tcp" { 6 } else { 17 }]));
+                }
+                for (port, offset) in [(grant.source_port, 0), (grant.destination_port, 2)] {
+                    if let Some(port) = port {
+                        expressions.push(expr(
+                            "payload",
+                            vec![
+                                Attr::u32(1, 1),
+                                Attr::u32(2, 2),
+                                Attr::u32(3, offset),
+                                Attr::u32(4, 2),
+                            ],
+                        ));
+                        expressions.push(compare(port.to_be_bytes().to_vec()));
+                    }
+                }
+                expressions.push(verdict(1, None));
+                rule(chain, expressions, &mut program);
+            }
+            for endpoint in &self.policy.endpoints {
+                for incoming in [true, false] {
+                    if (chain == "input" && !incoming) || (chain == "output" && incoming) {
+                        continue;
+                    }
+                    // Either selector matching is enough to retain denial after rename/reuse.
+                    for mut expressions in [
+                        meta(
+                            if incoming { 4 } else { 5 },
+                            endpoint.interface_index.to_ne_bytes().to_vec(),
+                        ),
+                        meta(
+                            if incoming { 6 } else { 7 },
+                            [endpoint.interface_name.as_bytes(), &[0]].concat(),
+                        ),
+                    ] {
+                        expressions.push(verdict(0, None));
+                        rule(chain, expressions, &mut program);
+                    }
+                }
+            }
+        }
+        Ok(program)
+    }
+}

package/rust/src/tests.rs

@@ -0,0 +1,97 @@
+use crate::{decode, policy::Policy, wire, Error};
+
+fn policy() -> Policy {
+    serde_json::from_str(r#"{"schemaVersion":1,"revision":1,"endpoints":[{"id":"a","interfaceIndex":2,"interfaceName":"worka","interfaceKind":"veth","sourcePrefixes":["10.81.0.2/32"]},{"id":"b","interfaceIndex":3,"interfaceName":"workb","interfaceKind":"veth","sourcePrefixes":["10.81.0.3/32"]}],"rules":[{"sourceEndpoint":"a","destinationEndpoint":"b","sourcePrefix":"10.81.0.2/32","destinationPrefix":"10.81.0.3/32","protocol":"udp","sourcePort":null,"destinationPort":53}]}"#).unwrap()
+}
+
+#[test]
+fn canonical_policy_rejects_ambiguous_or_unbound_grants() {
+    let prepared = policy().prepare().unwrap();
+    let mut reordered = policy();
+    reordered.endpoints.reverse();
+    assert_eq!(reordered.prepare().unwrap(), prepared);
+    let mut altered = prepared.clone();
+    altered.policy.revision += 1;
+    assert_eq!(altered.validate(), Err(Error::Invalid));
+    let mut value = policy();
+    value.rules[0].source_endpoint = None;
+    assert_eq!(value.prepare(), Err(Error::Invalid));
+    let mut value = policy();
+    value.rules[0].source_prefix = "10.81.0.3/32".into();
+    assert_eq!(value.prepare(), Err(Error::Invalid));
+    let mut value = policy();
+    value.endpoints[1].source_prefixes = vec!["10.81.0.0/24".into()];
+    assert_eq!(value.prepare(), Err(Error::Invalid));
+    let mut value = policy();
+    value.rules.push(value.rules[0].clone());
+    assert_eq!(value.prepare(), Err(Error::Invalid));
+    let mut value = policy();
+    value.rules[0].protocol = "any".into();
+    assert_eq!(value.prepare(), Err(Error::Invalid));
+}
+
+#[test]
+fn raw_input_rejects_duplicates_unknown_fields_and_omitted_nulls() {
+    for json in [
+        r#"{"schemaVersion":1,"schemaVersion":1,"revision":1,"endpoints":[],"rules":[]}"#,
+        r#"{"schemaVersion":1,"revision":1,"endpoints":[],"rules":[],"commands":[]}"#,
+    ] {
+        assert!(
+            decode::<Policy>(serde_json::value::RawValue::from_string(json.into()).unwrap())
+                .is_err()
+        );
+    }
+    let mut value = serde_json::to_value(policy()).unwrap();
+    value["rules"][0]
+        .as_object_mut()
+        .unwrap()
+        .remove("sourcePort");
+    assert!(serde_json::from_value::<Policy>(value).is_err());
+    let prepared = policy().prepare().unwrap();
+    assert!(serde_json::from_value::<crate::owner::Transition>(
+        serde_json::json!({"target":prepared})
+    )
+    .is_err());
+}
+
+#[test]
+fn protocol_rejects_malformed_attributes_and_noncanonical_prefixes() {
+    for cidr in [
+        "0.0.0.0/0",
+        "127.0.0.1/32",
+        "224.0.0.0/4",
+        "10.1.0.1/24",
+        "10.1.0.0/024",
+        "::1/128",
+    ] {
+        assert_eq!(crate::policy::prefix(cidr), Err(Error::Invalid));
+    }
+    for bytes in [vec![0], vec![3, 0, 1, 0], vec![12, 0, 1, 0, 0, 0, 0, 0]] {
+        assert_eq!(wire::attrs(&bytes), Err(Error::Protocol));
+    }
+    let value = vec![wire::Attr::string(1, "exact"), wire::Attr::u32(2, 42)];
+    assert_eq!(wire::attrs(&wire::encode_attrs(&value)).unwrap(), value);
+    assert_eq!(
+        wire::number(&[wire::Attr::u32(1, 1), wire::Attr::u32(1, 2)], 1),
+        Err(Error::Protocol)
+    );
+}
+
+#[test]
+fn compiler_bounds_full_policy_and_keeps_directed_port_grants() {
+    let prepared = policy().prepare().unwrap();
+    let program = prepared.program("snft_test").unwrap();
+    assert_eq!(program.iter().filter(|(kind, _)| *kind == 3).count(), 7);
+    assert!(program.iter().all(|(kind, _)| [3, 6].contains(kind)));
+    for (_, attributes) in program {
+        let encoded = wire::encode_attrs(&attributes);
+        assert!(encoded.len() < 65_535);
+        assert_eq!(wire::attrs(&encoded).unwrap(), attributes);
+    }
+    let mut value = policy();
+    value.endpoints[0].interface_name = "lo".into();
+    assert_eq!(value.prepare(), Err(Error::Invalid));
+    let mut value = policy();
+    value.revision = 9_007_199_254_740_992;
+    assert_eq!(value.prepare(), Err(Error::Invalid));
+}