@push.rocks/smartnftables 1.3.1 → 1.5.0

package/rust/src/owner_egress_traffic_tests.rs

@@ -0,0 +1,470 @@
+use super::*;
+use crate::egress;
+use serde_json::{json, Value};
+use std::io::{Read, Write};
+use std::net::{SocketAddr, TcpListener, TcpStream, UdpSocket};
+use std::os::fd::AsRawFd;
+use std::time::Duration;
+
+const WORK: &str = "v2work";
+const ROUTER: &str = "v2router";
+const HOST: &str = "v2host";
+const PEER: &str = "v2peer";
+
+pub(super) fn ns_ip(namespace: &str, args: &[&str]) {
+    let mut command = vec!["-n", namespace];
+    command.extend(args);
+    ip(&command);
+}
+pub(super) fn connect(a: &str, aname: &str, aip: &str, b: &str, bname: &str, bip: &str) {
+    ip(&["link", "add", aname, "type", "veth", "peer", "name", bname]);
+    ip(&["link", "set", aname, "netns", a]);
+    ip(&["link", "set", bname, "netns", b]);
+    for (ns, name, address) in [(a, aname, aip), (b, bname, bip)] {
+        ns_ip(ns, &["address", "add", address, "dev", name]);
+        ns_ip(ns, &["link", "set", name, "up"]);
+    }
+}
+fn binding(name: &str, address: &str, kind: &str) -> Value {
+    let output = std::process::Command::new("/bin/ip")
+        .args(["-j", "-d", "link", "show", "dev", name])
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let observed = serde_json::from_slice::<Value>(&output.stdout).unwrap()[0].clone();
+    json!({"interfaceIndex":observed["ifindex"],"interfaceName":name,"interfaceKind":kind,
+        "macAddress":if kind=="tun" {Value::Null} else {observed["address"].clone()},
+        "interfaceLinkIndex":if kind=="tun" {observed["ifindex"].clone()} else {observed["link_index"].clone()},
+        "requiredIpv4Addresses":[address]})
+}
+fn protection() -> Value {
+    json!({"authorityDigest":format!("sha256:{}","b".repeat(64)),"prefixes":["10.0.0.0/8","192.0.2.0/24"],
+        "platformEndpoints":[{"id":"dns","address":"192.0.2.3","protocol":"udp","port":5300},
+            {"id":"mail","address":"192.0.2.3","protocol":"tcp","port":3000}]})
+}
+fn allocation() -> Value {
+    json!({"lease":{"id":"lease-a","generation":1,"digest":format!("sha256:{}","a".repeat(64))},
+        "transitSourceAddress":"10.240.0.2","sourcePortRanges":[{"protocol":"udp","first":10000,"last":10015},
+            {"protocol":"tcp","first":10016,"last":10031}]})
+}
+fn router_policy() -> egress::Policy {
+    let mut value = egress::tests::router();
+    value["scope"]["links"] = json!([
+        binding("work", "10.241.0.1", "veth"),
+        binding("vpn", "10.242.0.1", "tun")
+    ]);
+    value["scope"]["handoff"] = binding("handoff", "10.240.0.2", "veth");
+    for index in 0..2 {
+        value["scope"]["endpoints"][index]["interfaceIndex"] =
+            value["scope"]["links"][index]["interfaceIndex"].clone();
+    }
+    value["scope"]["protection"] = protection();
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    generation["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"203.0.113.2/32"},
+            "protocol":"udp","sourcePort":null,"destinationPort":42000,"sourcePortRange":{"first":10000,"last":10015}},
+        {"sourceEndpoint":null,"sourcePrefix":"10.240.0.2/32","destination":{"kind":"platform","endpointId":"dns"},
+            "protocol":"udp","sourcePort":null,"destinationPort":5300,"sourcePortRange":{"first":10000,"last":10015}},
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"platform","endpointId":"mail"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":3000,"sourcePortRange":{"first":10016,"last":10031}},
+        {"sourceEndpoint":null,"sourcePrefix":"10.240.0.2/32","destination":{"kind":"platform","endpointId":"mail"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":3000,"sourcePortRange":{"first":10016,"last":10031}}
+    ]);
+    value["scope"]["generations"] = json!([generation]);
+    value["scope"]["rules"].as_array_mut().unwrap().push(json!({
+        "sourceEndpoint":"vpn","destinationEndpoint":"work","sourcePrefix":"10.242.0.2/32","destinationPrefix":"10.241.0.2/32",
+        "protocol":"udp","sourcePort":null,"destinationPort":53}));
+    serde_json::from_value(value).unwrap()
+}
+pub(super) fn host_policy() -> egress::Policy {
+    let mut value = egress::tests::host();
+    value["scope"]["protection"] = protection();
+    value["scope"]["handoffs"][0]["link"] = binding("router", "10.240.0.1", "veth");
+    value["scope"]["handoffs"][0]["allocations"] = json!([allocation()]);
+    value["scope"]["uplink"] = binding("uplink", "192.0.2.2", "veth");
+    serde_json::from_value(value).unwrap()
+}
+pub(super) fn socket(ns: &str, address: &'static str) -> UdpSocket {
+    let socket = in_namespace(ns, move || UdpSocket::bind(address).unwrap());
+    socket
+        .set_read_timeout(Some(Duration::from_millis(250)))
+        .unwrap();
+    socket
+}
+pub(super) fn roundtrip(source: &UdpSocket, target: &UdpSocket) -> SocketAddr {
+    source
+        .send_to(b"query", target.local_addr().unwrap())
+        .unwrap();
+    let mut bytes = [0; 64];
+    let (size, observed) = target
+        .recv_from(&mut bytes)
+        .expect("authorized request delivery");
+    assert_eq!(&bytes[..size], b"query");
+    target.send_to(b"reply", observed).unwrap();
+    assert_eq!(source.recv(&mut bytes).expect("labelled reply delivery"), 5);
+    assert_eq!(&bytes[..5], b"reply");
+    observed
+}
+pub(super) fn denied(source: &UdpSocket, target: &UdpSocket, local: bool) {
+    let sent = source.send_to(b"denied", target.local_addr().unwrap());
+    if local {
+        assert_eq!(sent.unwrap_err().raw_os_error(), Some(libc::EPERM));
+    } else {
+        assert_eq!(sent.unwrap(), 6);
+    }
+    let error = target.recv(&mut [0; 64]).unwrap_err();
+    assert!(matches!(
+        error.kind(),
+        std::io::ErrorKind::WouldBlock | std::io::ErrorKind::TimedOut
+    ));
+}
+fn tun() -> std::fs::File {
+    let file = std::fs::OpenOptions::new()
+        .read(true)
+        .write(true)
+        .open("/dev/net/tun")
+        .unwrap();
+    let mut request: libc::ifreq = unsafe { std::mem::zeroed() };
+    for (slot, byte) in request.ifr_name.iter_mut().zip(b"vpn") {
+        *slot = *byte as libc::c_char;
+    }
+    request.ifr_ifru.ifru_flags = (libc::IFF_TUN | libc::IFF_NO_PI) as libc::c_short;
+    assert_eq!(
+        unsafe { libc::ioctl(file.as_raw_fd(), libc::TUNSETIFF, &request) },
+        0
+    );
+    file
+}
+fn inject(device: &mut std::fs::File, destination: [u8; 4], port: u16) {
+    let mut packet = vec![0; 32];
+    packet[0] = 0x45;
+    packet[2..4].copy_from_slice(&32_u16.to_be_bytes());
+    packet[8] = 64;
+    packet[9] = 17;
+    packet[12..16].copy_from_slice(&[10, 242, 0, 2]);
+    packet[16..20].copy_from_slice(&destination);
+    let sum: u32 = packet[..20]
+        .chunks_exact(2)
+        .map(|part| u16::from_be_bytes(part.try_into().unwrap()) as u32)
+        .sum();
+    let sum = (sum & 0xffff) + (sum >> 16);
+    packet[10..12].copy_from_slice(&(!(sum as u16)).to_be_bytes());
+    packet[20..22].copy_from_slice(&23456_u16.to_be_bytes());
+    packet[22..24].copy_from_slice(&port.to_be_bytes());
+    packet[24..26].copy_from_slice(&12_u16.to_be_bytes());
+    packet[28..].copy_from_slice(b"test");
+    device.write_all(&packet).unwrap();
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_four_namespace_private_tun_local_dns_egress_and_revocation() {
+    isolated();
+    for name in [WORK, ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        WORK,
+        "client",
+        "10.241.0.2/24",
+        ROUTER,
+        "work",
+        "10.241.0.1/24",
+    );
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(WORK, &["route", "add", "default", "via", "10.241.0.1"]);
+    ns_ip(ROUTER, &["route", "add", "default", "via", "10.240.0.1"]);
+    ns_ip(
+        HOST,
+        &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
+    );
+    ns_ip(PEER, &["address", "add", "203.0.113.2/32", "dev", "lo"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    ns_ip(ROUTER, &["tuntap", "add", "dev", "vpn", "mode", "tun"]);
+    ns_ip(ROUTER, &["address", "add", "10.242.0.1/24", "dev", "vpn"]);
+    ns_ip(ROUTER, &["link", "set", "vpn", "up"]);
+    let mut device = in_namespace(ROUTER, tun);
+    let (host_owner, host_applied) = in_namespace(HOST, || {
+        let mut owner = Owner::new(options("host_packets")).unwrap();
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target: host_policy().prepare().unwrap().into(),
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
+    let (router_owner, router_applied, router_policy) = in_namespace(ROUTER, || {
+        let policy = router_policy();
+        let mut owner = Owner::new(options("router_packets")).unwrap();
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target: policy.clone().prepare().unwrap().into(),
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied, policy)
+    });
+    let work = socket(WORK, "10.241.0.2:40001");
+    let local = socket(ROUTER, "10.240.0.2:40002");
+    let private_dns = socket(ROUTER, "10.241.0.1:53");
+    let public = socket(PEER, "203.0.113.2:42000");
+    let upstream = socket(PEER, "192.0.2.3:5300");
+    let tunnel_target = socket(WORK, "10.241.0.2:53");
+    let observer = in_namespace(HOST, || packet_fixture::PacketSocket::open("router"));
+    assert_eq!(
+        roundtrip(&work, &private_dns).ip().to_string(),
+        "10.241.0.2"
+    );
+    let outer = roundtrip(&work, &public);
+    assert_eq!(outer.ip().to_string(), "192.0.2.2");
+    assert!((10000..=10015).contains(&outer.port()));
+    let inner = observer
+        .matching(|packet| {
+            packet.len() >= 28
+                && packet[9] == 17
+                && packet[12..16] == [10, 240, 0, 2]
+                && packet[22..24] == 42000_u16.to_be_bytes()
+        })
+        .unwrap();
+    assert!((10000..=10015).contains(&u16::from_be_bytes(inner[20..22].try_into().unwrap())));
+    let dns_outer = roundtrip(&local, &upstream);
+    assert_eq!(dns_outer.ip().to_string(), "192.0.2.2");
+    assert!((10000..=10015).contains(&dns_outer.port()));
+    // A real TCP socket exercises the same ranged handoff and labelled reply path.
+    in_namespace(WORK, || {
+        std::fs::write("/proc/sys/net/ipv4/tcp_ecn", "1").unwrap()
+    });
+    let listener = in_namespace(PEER, || TcpListener::bind("192.0.2.3:3000").unwrap());
+    let mut client = in_namespace(WORK, || {
+        TcpStream::connect_timeout(
+            &"192.0.2.3:3000".parse().unwrap(),
+            Duration::from_secs(1),
+        )
+        .unwrap()
+    });
+    let (mut server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.ip().to_string(), "192.0.2.2");
+    assert!((10016..=10031).contains(&peer.port()));
+    client
+        .set_read_timeout(Some(Duration::from_secs(1)))
+        .unwrap();
+    server
+        .set_read_timeout(Some(Duration::from_secs(1)))
+        .unwrap();
+    client.write_all(b"mail").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"okay").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    let syn = observer
+        .matching(|packet| {
+            packet.len() >= 40
+                && packet[9] == 6
+                && packet[12..16] == [10, 240, 0, 2]
+                && packet[33] & 0x17 == 2
+        })
+        .unwrap();
+    assert_eq!(syn[33] & 0xc0, 0xc0);
+    assert!((10016..=10031).contains(&u16::from_be_bytes(syn[20..22].try_into().unwrap())));
+    let mut local_tcp = in_namespace(ROUTER, || {
+        TcpStream::connect_timeout(
+            &"192.0.2.3:3000".parse().unwrap(),
+            Duration::from_secs(1),
+        )
+        .unwrap()
+    });
+    let (mut local_peer, local_outer) = listener.accept().unwrap();
+    assert!((10016..=10031).contains(&local_outer.port()));
+    local_tcp
+        .set_read_timeout(Some(Duration::from_secs(1)))
+        .unwrap();
+    local_peer
+        .set_read_timeout(Some(Duration::from_secs(1)))
+        .unwrap();
+    local_tcp.write_all(b"relay").unwrap();
+    local_peer.read_exact(&mut [0; 5]).unwrap();
+    local_peer.write_all(b"ready").unwrap();
+    local_tcp.read_exact(&mut [0; 5]).unwrap();
+    // An unlabelled opening ACK/RST must not acquire the current generation.
+    let injector = in_namespace(WORK, || packet_fixture::PacketSocket::open("client"));
+    let router_mac = in_namespace(ROUTER, || packet_fixture::mac("work"));
+    for (port, flags) in [(40050, 0x10), (40051, 0x04), (40052, 0x12)] {
+        injector.send(
+            router_mac,
+            &packet_fixture::tcp([10, 241, 0, 2], [192, 0, 2, 3], port, 3000, flags),
+        );
+        assert!(observer
+            .matching(|packet| packet.len() >= 40
+                && packet[9] == 6
+                && packet[12..16] == [10, 240, 0, 2]
+                && packet[33] == flags
+                && packet[24..28] == 100_u32.to_be_bytes())
+            .is_none());
+    }
+    injector.send(
+        router_mac,
+        &packet_fixture::tcp([10, 241, 0, 2], [192, 0, 2, 3], 40053, 3000, 0xc2),
+    );
+    assert!(observer
+        .matching(|packet| packet.len() >= 40
+            && packet[9] == 6
+            && packet[12..16] == [10, 240, 0, 2]
+            && packet[33] == 0xc2
+            && packet[24..28] == 100_u32.to_be_bytes())
+        .is_some());
+    // Reassembly must apply the same directed grant; a noninitial fragment alone
+    // cannot obtain an independent path around transport/zone classification.
+    let fragments = packet_fixture::fragments(
+        &packet_fixture::udp([10, 241, 0, 2], [203, 0, 113, 2], 40001, 42000),
+        100,
+    );
+    injector.send(router_mac, &fragments[1]);
+    assert!(public.recv(&mut [0; 64]).is_err());
+    injector.send(router_mac, &fragments[0]);
+    let mut received = [0; 64];
+    assert_eq!(public.recv(&mut received).unwrap(), 4);
+    assert_eq!(&received[..4], b"frag");
+    for fragment in packet_fixture::fragments(
+        &packet_fixture::udp([10, 241, 0, 2], [192, 0, 2, 3], 40001, 5300),
+        101,
+    ) {
+        injector.send(router_mac, &fragment);
+    }
+    assert!(upstream.recv(&mut [0; 64]).is_err());
+    // Exhaust the whole 16-port UDP range to the same remote tuple. No mapping
+    // may escape the lease; the next flow must fail closed in source NAT.
+    let mut held = Vec::new();
+    let mut observed_ports = std::collections::BTreeSet::from([outer.port()]);
+    for source_port in 40100..40115 {
+        let source = in_namespace(WORK, move || {
+            UdpSocket::bind(format!("10.241.0.2:{source_port}")).unwrap()
+        });
+        source
+            .set_read_timeout(Some(Duration::from_millis(250)))
+            .unwrap();
+        assert!(observed_ports.insert(roundtrip(&source, &public).port()));
+        held.push(source);
+    }
+    assert_eq!(observed_ports, (10000..=10015).collect());
+    let exhausted = socket(WORK, "10.241.0.2:40115");
+    denied(&exhausted, &public, false);
+    denied(&work, &upstream, false);
+    denied(&local, &public, true);
+    inject(&mut device, [10, 241, 0, 2], 53);
+    assert_eq!(tunnel_target.recv(&mut [0; 64]).unwrap(), 4);
+    inject(&mut device, [203, 0, 113, 2], 42000);
+    assert!(public.recv(&mut [0; 64]).is_err());
+    let (owner, applied, template) = in_namespace(ROUTER, move || {
+        let mut owner = router_owner;
+        let mut revoked = router_policy.clone();
+        revoked.revision = 2;
+        let egress::Scope::RouterEgress(scope) = &mut revoked.scope else {
+            panic!()
+        };
+        scope.generations.clear();
+        let applied = owner
+            .reconcile(Transition {
+                previous: Some(router_applied),
+                target: revoked.prepare().unwrap().into(),
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied, router_policy)
+    });
+    public.send_to(b"retired", outer).unwrap();
+    assert!(work.recv(&mut [0; 64]).is_err());
+    denied(&work, &public, false);
+    denied(&local, &upstream, true);
+    roundtrip(&work, &private_dns);
+    inject(&mut device, [10, 241, 0, 2], 53);
+    assert_eq!(tunnel_target.recv(&mut [0; 64]).unwrap(), 4);
+    // Retain the old host allocation, install a disjoint new range, then enable
+    // the new router generation. No conntrack drainage or reuse is asserted.
+    let (host_owner, host_applied) = in_namespace(HOST, move || {
+        let mut owner = host_owner;
+        let mut policy = host_policy();
+        policy.revision = 2;
+        let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+            panic!()
+        };
+        let mut next = scope.handoffs[0].allocations[0].clone();
+        next.lease.generation = 2;
+        next.lease.digest = format!("sha256:{}", "d".repeat(64));
+        for range in &mut next.source_port_ranges {
+            range.first += 1000;
+            range.last += 1000;
+        }
+        scope.handoffs[0].allocations.push(next);
+        let applied = owner
+            .reconcile(Transition {
+                previous: Some(host_applied),
+                target: policy.prepare().unwrap().into(),
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
+    let (mut owner, applied) = in_namespace(ROUTER, move || {
+        let mut owner = owner;
+        let mut policy = template;
+        policy.revision = 3;
+        let egress::Scope::RouterEgress(scope) = &mut policy.scope else {
+            panic!()
+        };
+        let generation = &mut scope.generations[0];
+        generation.lease.generation = 2;
+        generation.lease.digest = format!("sha256:{}", "d".repeat(64));
+        generation.conntrack_zone = 18;
+        generation.conntrack_label = "f".repeat(32);
+        for range in &mut generation.source_port_ranges {
+            range.first += 1000;
+            range.last += 1000;
+        }
+        for grant in &mut generation.grants {
+            grant.source_port_range.first += 1000;
+            grant.source_port_range.last += 1000;
+        }
+        let applied = owner
+            .reconcile(Transition {
+                previous: Some(applied),
+                target: policy.prepare().unwrap().into(),
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
+    let current_outer = roundtrip(&work, &public);
+    assert!((11000..=11015).contains(&current_outer.port()));
+    roundtrip(&local, &upstream);
+    public.send_to(b"retired", outer).unwrap();
+    assert!(work.recv(&mut [0; 64]).is_err());
+    in_namespace(ROUTER, move || owner.release(applied).unwrap());
+    in_namespace(HOST, move || {
+        let mut owner = host_owner;
+        owner.release(host_applied).unwrap();
+    });
+    println!("V2_PACKET_PROOF private_dns=true tun_private=true tun_public_denied=true workload_public=true local_dns_and_tcp=true handoff_udp_tcp_ranges=true ecn_syn=true opening_ack_rst_denied=true fragments_checked=true range_exhaustion_denied=true protected_grant_denied=true ungranted_local_denied=true retired_replies_denied=true revoked_egress_denied=true disjoint_generation_restored=true flows_drained=false reusable=false");
+}