@push.rocks/smartnftables 1.2.1 → 1.4.0

package/rust/src/owner.rs

@@ -0,0 +1,604 @@
+use crate::policy::{identifier, Prepared};
+use crate::wire::{self, Attr, Socket};
+use crate::{Error, Result};
+use serde::{Deserialize, Serialize};
+use std::os::unix::fs::MetadataExt;
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Options {
+    pub owner_id: String,
+    pub instance_id: String,
+    pub table_name: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Identity {
+    pub owner_id: String,
+    pub instance_id: String,
+    pub table_name: String,
+    pub boot_id: String,
+    pub namespace_device: String,
+    pub namespace_inode: String,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Receipt {
+    pub identity: Identity,
+    pub table_handle: String,
+    pub revision: u64,
+    pub digest: String,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Applied {
+    pub receipt: Receipt,
+    pub prepared: Prepared,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Transition {
+    #[serde(deserialize_with = "crate::policy::required_nullable")]
+    pub previous: Option<Applied>,
+    pub target: Prepared,
+}
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Status {
+    pub identity: Identity,
+    pub state: String,
+    pub enforced: bool,
+    pub applied: Option<Applied>,
+    pub pending: Option<Transition>,
+    pub error: Option<String>,
+}
+
+struct Graph {
+    generation: u32,
+    table: Vec<Attr>,
+    chains: Vec<Vec<Attr>>,
+    rules: Vec<Vec<Attr>>,
+}
+pub struct Owner {
+    identity: Identity,
+    socket: Option<Socket>,
+    applied: Option<Applied>,
+    pending: Option<Transition>,
+    error: Option<Error>,
+    released: bool,
+}
+
+fn context() -> Result<(String, String, String)> {
+    let boot = std::fs::read_to_string("/proc/sys/kernel/random/boot_id")
+        .map_err(|_| Error::Unavailable)?
+        .trim()
+        .to_string();
+    if boot.len() != 36 || !boot.bytes().all(|c| c.is_ascii_hexdigit() || c == b'-') {
+        return Err(Error::Unavailable);
+    }
+    let namespace =
+        std::fs::metadata("/proc/thread-self/ns/net").map_err(|_| Error::Unavailable)?;
+    Ok((
+        boot,
+        namespace.dev().to_string(),
+        namespace.ino().to_string(),
+    ))
+}
+fn kernel_floor() -> Result<()> {
+    let mut name: libc::utsname = unsafe { std::mem::zeroed() };
+    if unsafe { libc::uname(&mut name) } != 0 {
+        return Err(Error::Unavailable);
+    }
+    let release = unsafe { std::ffi::CStr::from_ptr(name.release.as_ptr()) }
+        .to_str()
+        .map_err(|_| Error::Unsupported)?;
+    let mut parts = release.split('.');
+    let major: u32 = parts
+        .next()
+        .ok_or(Error::Unsupported)?
+        .parse()
+        .map_err(|_| Error::Unsupported)?;
+    let minor: u32 = parts
+        .next()
+        .ok_or(Error::Unsupported)?
+        .parse()
+        .map_err(|_| Error::Unsupported)?;
+    if major < 6 || major == 6 && minor < 9 {
+        return Err(Error::Unsupported);
+    }
+    Ok(())
+}
+
+impl Owner {
+    pub fn new(options: Options) -> Result<Self> {
+        if !identifier(&options.owner_id)
+            || !identifier(&options.instance_id)
+            || options.instance_id.len() < 16
+            || !identifier(&options.table_name)
+            || !options.table_name.starts_with("snft_")
+        {
+            return Err(Error::Invalid);
+        }
+        let (boot_id, namespace_device, namespace_inode) = context()?;
+        Ok(Self {
+            identity: Identity {
+                owner_id: options.owner_id,
+                instance_id: options.instance_id,
+                table_name: options.table_name,
+                boot_id,
+                namespace_device,
+                namespace_inode,
+            },
+            socket: None,
+            applied: None,
+            pending: None,
+            error: None,
+            released: false,
+        })
+    }
+    fn socket(&mut self) -> Result<&mut Socket> {
+        kernel_floor()?;
+        if context()?
+            != (
+                self.identity.boot_id.clone(),
+                self.identity.namespace_device.clone(),
+                self.identity.namespace_inode.clone(),
+            )
+        {
+            return Err(Error::Conflict);
+        }
+        if self.socket.is_none() {
+            self.socket = Some(Socket::open()?);
+        }
+        Ok(self.socket.as_mut().unwrap())
+    }
+    fn userdata(&self) -> Vec<u8> {
+        format!(
+            "smartnftables1:{}:{}",
+            self.identity.owner_id, self.identity.instance_id
+        )
+        .into_bytes()
+    }
+    fn graph(&mut self) -> Result<Option<Graph>> {
+        let table_name = self.identity.table_name.clone();
+        let socket = self.socket()?;
+        for _ in 0..3 {
+            let generation = socket.generation()?;
+            let table = match socket.query(1, vec![Attr::string(1, &table_name)], false) {
+                Ok(mut rows) if rows.len() == 1 => rows.remove(0),
+                Err(Error::Absent) => return Ok(None),
+                Err(error) => return Err(error),
+                _ => return Err(Error::Protocol),
+            };
+            let chains = socket.query(4, vec![Attr::string(1, &table_name)], true)?;
+            let rules = socket.query(7, vec![Attr::string(1, &table_name)], true)?;
+            // The managed compiler never creates any of these. Foreign objects reject.
+            for operation in [10, 19, 23] {
+                if !socket
+                    .query(operation, vec![Attr::string(1, &table_name)], true)?
+                    .is_empty()
+                {
+                    return Err(Error::Conflict);
+                }
+            }
+            if generation == socket.generation()? {
+                return Ok(Some(Graph {
+                    generation,
+                    table,
+                    chains,
+                    rules,
+                }));
+            }
+        }
+        Err(Error::Conflict)
+    }
+    fn binding(&self, graph: &Graph, expected: Option<&Applied>) -> Result<()> {
+        if wire::text(&graph.table, 1)? != self.identity.table_name
+            || wire::one(&graph.table, 6)?.value != self.userdata()
+            || ![4, 6].contains(&wire::number(&graph.table, 2)?)
+            || graph
+                .table
+                .iter()
+                .any(|attr| ![1, 2, 3, 4, 5, 6, 7].contains(&attr.id()))
+        {
+            return Err(Error::Conflict);
+        }
+        if let Some(expected) = expected {
+            self.validate_receipt(expected)?;
+            if expected.receipt.table_handle != wire::handle(&graph.table, 4)?.to_string() {
+                return Err(Error::Conflict);
+            }
+        }
+        Ok(())
+    }
+    fn validate_receipt(&self, expected: &Applied) -> Result<()> {
+        expected.prepared.validate()?;
+        let handle: u64 = expected
+            .receipt
+            .table_handle
+            .parse()
+            .map_err(|_| Error::Invalid)?;
+        if handle == 0
+            || handle.to_string() != expected.receipt.table_handle
+            || expected.receipt.identity != self.identity
+            || expected.receipt.revision != expected.prepared.policy.revision
+            || expected.receipt.digest != expected.prepared.digest
+        {
+            return Err(Error::Conflict);
+        }
+        Ok(())
+    }
+    fn matches(&self, graph: &Graph, prepared: &Prepared) -> Result<bool> {
+        let program = prepared.program(&self.identity.table_name)?;
+        let expected_chains: Vec<_> = program
+            .iter()
+            .filter(|(kind, _)| *kind == 3)
+            .map(|(_, attrs)| chain_identity(attrs))
+            .collect::<Result<_>>()?;
+        let actual_chains: Vec<_> = graph
+            .chains
+            .iter()
+            .map(|attrs| chain_identity(attrs))
+            .collect::<Result<_>>()?;
+        let mut expected_chains = expected_chains;
+        let mut actual_chains = actual_chains;
+        expected_chains.sort();
+        actual_chains.sort();
+        let expected_rules: Vec<_> = program
+            .iter()
+            .filter(|(kind, _)| *kind == 6)
+            .map(|(_, attrs)| rule_identity(attrs))
+            .collect::<Result<_>>()?;
+        let actual_rules: Vec<_> = graph
+            .rules
+            .iter()
+            .map(|attrs| rule_identity(attrs))
+            .collect::<Result<_>>()?;
+        // Dumps order chains differently; preserve order within each chain.
+        let regroup = |rules: Vec<(String, Vec<u8>)>| {
+            let mut result = std::collections::BTreeMap::<String, Vec<Vec<u8>>>::new();
+            for (chain, rule) in rules {
+                result.entry(chain).or_default().push(rule);
+            }
+            result
+        };
+        Ok(expected_chains == actual_chains && regroup(expected_rules) == regroup(actual_rules))
+    }
+    fn adopt(&mut self, graph: Graph, transition: &Transition) -> Result<Graph> {
+        self.binding(&graph, transition.previous.as_ref())?;
+        if !self.matches(&graph, &transition.target)?
+            && !transition
+                .previous
+                .as_ref()
+                .map(|prior| self.matches(&graph, &prior.prepared))
+                .transpose()?
+                .unwrap_or(false)
+        {
+            return Err(Error::Conflict);
+        }
+        let port = self.socket()?.port;
+        if wire::number(&graph.table, 2)? == 6 {
+            if wire::number(&graph.table, 7)? != port {
+                return Err(Error::ForeignOwner);
+            }
+            return Ok(graph);
+        }
+        let handle = wire::handle(&graph.table, 4)?;
+        let table_name = self.identity.table_name.clone();
+        self.socket()?.batch(
+            graph.generation,
+            vec![(0, 0, vec![Attr::string(1, &table_name), Attr::u32(2, 6)])],
+        )?;
+        // Postclaim proof is essential: generation IDs wrap. Now other sockets
+        // cannot mutate this graph between verification and the following batch.
+        let after = self.graph()?.ok_or(Error::Conflict)?;
+        self.binding(&after, transition.previous.as_ref())?;
+        if wire::handle(&after.table, 4)? != handle
+            || wire::number(&after.table, 2)? != 6
+            || wire::number(&after.table, 7)? != port
+            || !self.matches(&after, &transition.target)?
+                && !transition
+                    .previous
+                    .as_ref()
+                    .map(|prior| self.matches(&after, &prior.prepared))
+                    .transpose()?
+                    .unwrap_or(false)
+        {
+            // Only drop this socket's acquired ownership, never the persistent graph.
+            self.socket = None;
+            return Err(Error::Conflict);
+        }
+        Ok(after)
+    }
+    fn applied(&self, graph: &Graph, prepared: Prepared) -> Result<Applied> {
+        Ok(Applied {
+            receipt: Receipt {
+                identity: self.identity.clone(),
+                table_handle: wire::handle(&graph.table, 4)?.to_string(),
+                revision: prepared.policy.revision,
+                digest: prepared.digest.clone(),
+            },
+            prepared,
+        })
+    }
+    pub fn reconcile(&mut self, transition: Transition) -> Result<Applied> {
+        if self.released {
+            return Err(Error::Conflict);
+        }
+        transition.target.validate()?;
+        if let Some(pending) = &self.pending {
+            if pending != &transition {
+                return Err(Error::Conflict);
+            }
+        }
+        if let Some(previous) = &transition.previous {
+            self.validate_receipt(previous)?;
+            if transition.target.policy.revision <= previous.prepared.policy.revision {
+                return Err(Error::Conflict);
+            }
+        }
+        // Reject known unsupported privilege/kernel states before admitting a target.
+        self.socket()?.generation()?;
+        transition.target.validate_interfaces()?;
+        self.pending = Some(transition.clone());
+        let result = self.reconcile_inner(&transition);
+        match &result {
+            Ok(applied) => {
+                self.applied = Some(applied.clone());
+                self.pending = None;
+                self.error = None;
+            }
+            Err(error) => self.error = Some(*error),
+        }
+        result
+    }
+    fn reconcile_inner(&mut self, transition: &Transition) -> Result<Applied> {
+        let table_name = self.identity.table_name.clone();
+        let graph = self.graph()?;
+        let mut operations = Vec::new();
+        let generation = if let Some(graph) = graph {
+            let graph = self.adopt(graph, transition)?;
+            if self.matches(&graph, &transition.target)? {
+                transition.target.validate_interfaces()?;
+                return self.applied(&graph, transition.target.clone());
+            }
+            let previous = transition.previous.as_ref().ok_or(Error::Conflict)?;
+            if !self.matches(&graph, &previous.prepared)? {
+                return Err(Error::Conflict);
+            }
+            for rule in &graph.rules {
+                operations.push((
+                    8,
+                    0,
+                    vec![
+                        Attr::string(1, &table_name),
+                        Attr::string(2, &wire::text(rule, 2)?),
+                        Attr::u64(3, wire::handle(rule, 3)?),
+                    ],
+                ));
+            }
+            for chain in &graph.chains {
+                operations.push((
+                    5,
+                    0,
+                    vec![
+                        Attr::string(1, &table_name),
+                        Attr::u64(2, wire::handle(chain, 2)?),
+                    ],
+                ));
+            }
+            graph.generation
+        } else {
+            if transition.previous.is_some() || self.applied.is_some() {
+                return Err(Error::Conflict);
+            }
+            operations.push((
+                0,
+                0x600,
+                vec![
+                    Attr::string(1, &table_name),
+                    Attr::u32(2, 6),
+                    Attr::bytes(6, self.userdata()),
+                ],
+            ));
+            self.socket()?.generation()?
+        };
+        for (operation, attributes) in transition.target.program(&table_name)? {
+            operations.push((
+                operation,
+                if operation == 3 { 0x600 } else { 0xc00 },
+                attributes,
+            ));
+        }
+        self.socket()?.batch(generation, operations)?;
+        let graph = self.graph()?.ok_or(Error::Conflict)?;
+        self.binding(&graph, transition.previous.as_ref())?;
+        if wire::number(&graph.table, 2)? != 6
+            || wire::number(&graph.table, 7)? != self.socket()?.port
+            || !self.matches(&graph, &transition.target)?
+        {
+            return Err(Error::Conflict);
+        }
+        transition.target.validate_interfaces()?;
+        self.applied(&graph, transition.target.clone())
+    }
+    pub fn inspect(&mut self) -> Status {
+        let mut enforced = false;
+        if let Some(applied) = self.applied.clone().filter(|_| !self.released) {
+            match self.graph().and_then(|graph| {
+                let graph = graph.ok_or(Error::Conflict)?;
+                self.binding(&graph, Some(&applied))?;
+                if wire::number(&graph.table, 2)? != 6
+                    || wire::number(&graph.table, 7)? != self.socket()?.port
+                    || !self.matches(&graph, &applied.prepared)?
+                {
+                    return Err(Error::Conflict);
+                }
+                applied.prepared.validate_interfaces()?;
+                Ok(())
+            }) {
+                Ok(()) => enforced = self.pending.is_none() && self.error.is_none(),
+                Err(error) => self.error = Some(error),
+            }
+        }
+        Status {
+            identity: self.identity.clone(),
+            state: if self.released {
+                "released"
+            } else if self.error.is_some() || self.pending.is_some() {
+                "failed-owned"
+            } else if enforced {
+                "applied"
+            } else {
+                "idle"
+            }
+            .into(),
+            enforced,
+            applied: self.applied.clone(),
+            pending: self.pending.clone(),
+            error: self.error.map(|error| error.code().into()),
+        }
+    }
+    pub fn release(&mut self, expected: Applied) -> Result<()> {
+        self.validate_receipt(&expected)?;
+        if self.pending.is_some() {
+            return Err(Error::Conflict);
+        }
+        if self.released {
+            return if self.applied.as_ref() == Some(&expected) {
+                Ok(())
+            } else {
+                Err(Error::Conflict)
+            };
+        }
+        let result = (|| {
+            let Some(graph) = self.graph()? else {
+                // The exact caller-retained boot/namespace receipt is validated.
+                // Absence also confirms cleanup after a lost ACK and full restart.
+                return Ok(());
+            };
+            // Recovery on a fresh owner is explicit and validates this exact snapshot.
+            let transition = Transition {
+                previous: Some(expected.clone()),
+                target: expected.prepared.clone(),
+            };
+            let graph = self.adopt(graph, &transition)?;
+            if !self.matches(&graph, &expected.prepared)? {
+                return Err(Error::Conflict);
+            }
+            // Retain qualified ownership before deletion; a lost delete ACK can
+            // subsequently prove this exact table absent without inventing success.
+            self.applied = Some(expected.clone());
+            self.socket()?.batch(
+                graph.generation,
+                vec![(2, 0, vec![Attr::u64(4, wire::handle(&graph.table, 4)?)])],
+            )?;
+            if let Some(after) = self.graph()? {
+                if wire::handle(&after.table, 4)? == wire::handle(&graph.table, 4)? {
+                    return Err(Error::Conflict);
+                }
+            }
+            Ok(())
+        })();
+        match result {
+            Ok(()) => {
+                self.released = true;
+                self.applied = Some(expected);
+                self.error = None;
+                self.socket = None;
+                Ok(())
+            }
+            Err(error) => {
+                self.error = Some(error);
+                Err(error)
+            }
+        }
+    }
+    pub fn close(&mut self) -> Result<()> {
+        if self.released {
+            return Ok(());
+        }
+        if let Some(applied) = self.applied.clone() {
+            return self.release(applied);
+        }
+        if self.socket.is_some()
+            && (self.pending.is_some() || self.error.is_some())
+            && self.graph()?.is_some()
+        {
+            return Err(Error::Conflict);
+        }
+        self.pending = None;
+        self.error = None;
+        self.socket = None;
+        self.released = true;
+        Ok(())
+    }
+}
+
+fn chain_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
+    let mut identity = Vec::new();
+    for attribute in attributes {
+        match attribute.id() {
+            2 | 6 | 9 => {} // Kernel handle, use count and alignment padding.
+            4 => identity.push(Attr::nested(4, wire::attrs(&attribute.value)?)),
+            1 | 3 | 5 | 7 | 10 => identity.push(attribute.clone()),
+            _ => return Err(Error::Conflict),
+        }
+    }
+    serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
+}
+fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
+    let chain = wire::text(attributes, 2)?;
+    if attributes
+        .iter()
+        .any(|attribute| ![1, 2, 3, 4, 6, 7, 8].contains(&attribute.id()))
+    {
+        return Err(Error::Conflict);
+    }
+    let expressions = wire::attrs(&wire::one(attributes, 4)?.value)?;
+    let mut result = Vec::new();
+    for expression in expressions {
+        if expression.id() != 1 {
+            return Err(Error::Conflict);
+        }
+        let fields = wire::attrs(&expression.value)?;
+        if fields.len() != 2 {
+            return Err(Error::Conflict);
+        }
+        let name = wire::text(&fields, 1)?;
+        let mut data = wire::attrs(&wire::one(&fields, 2)?.value)?;
+        let nested: &[u16] = match name.as_str() {
+            "immediate" => &[2],
+            "cmp" => &[3],
+            "bitwise" => &[4, 5],
+            "meta" | "payload" => &[],
+            _ => return Err(Error::Conflict),
+        };
+        for attribute in &mut data {
+            if nested.contains(&attribute.id()) {
+                let mut inner = wire::attrs(&attribute.value)?;
+                if name == "immediate" {
+                    for entry in &mut inner {
+                        if entry.id() == 2 {
+                            entry.kind |= 0x8000;
+                        }
+                    }
+                }
+                *attribute = Attr::nested(attribute.id(), inner);
+            }
+        }
+        result.push((name, wire::canonical(&data, false)?));
+    }
+    let encoded = serde_json::to_vec(&(
+        wire::text(attributes, 1)?,
+        result,
+        &wire::one(attributes, 7)?.value,
+    ))
+    .map_err(|_| Error::Protocol)?;
+    Ok((chain, encoded))
+}
+
+#[cfg(test)]
+#[path = "owner_tests.rs"]
+mod native_tests;