@push.rocks/smartnftables 1.2.1 → 1.4.0

package/rust/src/main.rs

@@ -0,0 +1,159 @@
+mod namespace;
+mod owner;
+mod policy;
+#[cfg(test)]
+mod tests;
+mod wire;
+
+use serde::Deserialize;
+use std::io::{BufRead, Read, Write};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Error {
+    Invalid,
+    Unsupported,
+    Permission,
+    ForeignOwner,
+    Conflict,
+    Absent,
+    Protocol,
+    Unavailable,
+}
+pub type Result<T> = std::result::Result<T, Error>;
+impl Error {
+    pub fn code(self) -> &'static str {
+        match self {
+            Self::Invalid => "INVALID",
+            Self::Unsupported => "UNSUPPORTED_KERNEL",
+            Self::Permission => "PERMISSION",
+            Self::ForeignOwner => "FOREIGN_OWNER",
+            Self::Conflict => "CONFLICT",
+            Self::Absent => "ABSENT",
+            Self::Protocol => "PROTOCOL",
+            Self::Unavailable => "UNAVAILABLE",
+        }
+    }
+    pub fn kernel(code: i32) -> Self {
+        match -code {
+            libc::ENOENT => Self::Absent,
+            libc::EPERM | libc::EACCES => Self::Permission,
+            libc::EEXIST | libc::EBUSY | libc::ERESTART => Self::Conflict,
+            libc::EOPNOTSUPP => Self::Unsupported,
+            _ => Self::Unavailable,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Request {
+    id: String,
+    method: String,
+    params: Box<serde_json::value::RawValue>,
+}
+fn decode<T: serde::de::DeserializeOwned>(value: Box<serde_json::value::RawValue>) -> Result<T> {
+    serde_json::from_str(value.get()).map_err(|_| Error::Invalid)
+}
+fn encode(value: impl serde::Serialize) -> Result<serde_json::Value> {
+    serde_json::to_value(value).map_err(|_| Error::Protocol)
+}
+fn dispatch(owner: &mut Option<owner::Owner>, request: Request) -> Result<serde_json::Value> {
+    match request.method.as_str() {
+        "preparePolicy" => encode(decode::<policy::Policy>(request.params)?.prepare()?),
+        "openOwner" => {
+            if owner.is_some() {
+                return Err(Error::Conflict);
+            }
+            *owner = Some(owner::Owner::new(decode(request.params)?)?);
+            encode(owner.as_mut().unwrap().inspect())
+        }
+        "reconcilePolicy" => encode(
+            owner
+                .as_mut()
+                .ok_or(Error::Conflict)?
+                .reconcile(decode(request.params)?)?,
+        ),
+        "inspectPolicy" => {
+            if decode::<serde_json::Value>(request.params)? != serde_json::json!({}) {
+                return Err(Error::Invalid);
+            }
+            encode(owner.as_mut().ok_or(Error::Conflict)?.inspect())
+        }
+        "releasePolicy" => {
+            owner
+                .as_mut()
+                .ok_or(Error::Conflict)?
+                .release(decode(request.params)?)?;
+            Ok(serde_json::json!({"released":true}))
+        }
+        "closeOwner" => {
+            if decode::<serde_json::Value>(request.params)? != serde_json::json!({}) {
+                return Err(Error::Invalid);
+            }
+            owner.as_mut().ok_or(Error::Conflict)?.close()?;
+            Ok(serde_json::json!({"released":true}))
+        }
+        _ => Err(Error::Invalid),
+    }
+}
+
+fn main() {
+    let arguments = std::env::args().skip(1).collect::<Vec<_>>();
+    let descriptor = match arguments.as_slice() {
+        [management] if management == "--management" => None,
+        [management, option, fd]
+            if management == "--management" && option == "--network-namespace-fd" =>
+        {
+            match fd.parse::<i32>() {
+                Ok(value) => Some(value),
+                Err(_) => std::process::exit(2),
+            }
+        }
+        _ => std::process::exit(2),
+    };
+    if let Some(fd) = descriptor {
+        if let Err(error) = namespace::enter(fd) {
+            eprintln!("Network namespace startup failed: {error}");
+            std::process::exit(1);
+        }
+    }
+    // The single native owner must enter before readiness, context capture or sockets.
+    let mut output = std::io::stdout().lock();
+    writeln!(output, "{{\"event\":\"ready\",\"data\":{{}}}}").unwrap();
+    output.flush().unwrap();
+    let mut input = std::io::stdin().lock();
+    let mut owner = None;
+    loop {
+        let mut bytes = Vec::new();
+        let read = std::io::Read::by_ref(&mut input)
+            .take(262_145)
+            .read_until(b'\n', &mut bytes);
+        if matches!(read, Ok(0)) {
+            break;
+        }
+        if read.is_err() || bytes.len() > 262_144 || bytes.last() != Some(&b'\n') {
+            std::process::exit(2);
+        }
+        let request: Request = match serde_json::from_slice(&bytes) {
+            Ok(request) => request,
+            Err(_) => std::process::exit(2),
+        };
+        if request.id.is_empty() || request.id.len() > 128 {
+            std::process::exit(2);
+        }
+        let id = request.id.clone();
+        let response = match dispatch(&mut owner, request) {
+            Ok(result) => serde_json::json!({"id":id,"success":true,"result":result}),
+            Err(error) => {
+                serde_json::json!({"id":id,"success":false,"error":"Managed policy operation failed.","errorCode":error.code()})
+            }
+        };
+        if writeln!(output, "{response}")
+            .and_then(|_| output.flush())
+            .is_err()
+        {
+            break;
+        }
+    }
+    // EOF/process loss only drops socket ownership. PERSIST retains packet policy.
+}

package/rust/src/namespace.rs

@@ -0,0 +1,51 @@
+//! Startup-only entry. No thread, runtime, socket or ready event may precede it.
+use std::io;
+
+#[cfg(target_os = "linux")]
+pub fn enter(fd: i32) -> io::Result<()> {
+    use std::os::fd::{AsRawFd, FromRawFd, OwnedFd};
+
+    // Only an explicitly inherited extra descriptor is accepted. Never consume IPC.
+    if fd < 3 {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "network namespace descriptor must be at least 3",
+        ));
+    }
+    if unsafe { libc::fcntl(fd, libc::F_GETFD) } < 0 {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "network namespace descriptor is not open",
+        ));
+    }
+    // Startup is single-threaded; this is the child's owned copy, not the parent's.
+    let descriptor = unsafe { OwnedFd::from_raw_fd(fd) };
+    let namespace_type = unsafe { libc::ioctl(descriptor.as_raw_fd(), libc::NS_GET_NSTYPE) };
+    if namespace_type != libc::CLONE_NEWNET {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "descriptor is not a Linux network namespace",
+        ));
+    }
+    if unsafe { libc::setns(descriptor.as_raw_fd(), libc::CLONE_NEWNET) } != 0 {
+        return Err(io::Error::new(
+            io::ErrorKind::PermissionDenied,
+            format!(
+                "network namespace entry failed: {}",
+                io::Error::last_os_error()
+            ),
+        ));
+    }
+    // Close the inherited capability before creating threads. Namespace membership
+    // itself keeps the namespace alive until the complete process has exited.
+    drop(descriptor);
+    Ok(())
+}
+
+#[cfg(not(target_os = "linux"))]
+pub fn enter(_fd: i32) -> io::Result<()> {
+    Err(io::Error::new(
+        io::ErrorKind::Unsupported,
+        "network namespace entry requires Linux",
+    ))
+}