@push.rocks/smartnftables 1.3.1 → 1.5.0

package/rust/src/owner_namespace_tests.rs

@@ -0,0 +1,242 @@
+use super::{empty, in_namespace, ip, isolated, options};
+use crate::owner::{Applied, Owner, Transition};
+use serde_json::{json, Value};
+use std::fs::{self, File};
+use std::io::{BufRead, BufReader, Read, Write};
+use std::os::fd::AsRawFd;
+use std::os::unix::fs::MetadataExt;
+use std::os::unix::process::CommandExt;
+use std::process::{Child, Command, Stdio};
+use std::sync::mpsc::{self, Receiver};
+use std::thread::{self, JoinHandle};
+use std::time::{Duration, Instant};
+
+fn command(namespace: &File) -> Command {
+    let fd = namespace.as_raw_fd();
+    let mut command = Command::new("/bin/managed");
+    command
+        .args(["--management", "--network-namespace-fd", "3"])
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::inherit());
+    unsafe {
+        command.pre_exec(move || {
+            if libc::dup2(fd, 3) < 0 || libc::fcntl(3, libc::F_SETFD, 0) < 0 {
+                return Err(std::io::Error::last_os_error());
+            }
+            Ok(())
+        });
+    }
+    command
+}
+
+struct NativeOwner {
+    child: Child,
+    messages: Receiver<Value>,
+    reader: Option<JoinHandle<()>>,
+}
+impl NativeOwner {
+    fn start(namespace: &File) -> Self {
+        let mut child = command(namespace).spawn().unwrap();
+        let output = child.stdout.take().unwrap();
+        let (send, messages) = mpsc::channel();
+        let reader = thread::spawn(move || {
+            for line in BufReader::new(output.take(1024 * 1024)).lines() {
+                let Ok(line) = line else { break };
+                if line.len() > 262_144 {
+                    break;
+                }
+                let Ok(value) = serde_json::from_str(&line) else {
+                    break;
+                };
+                if send.send(value).is_err() {
+                    break;
+                }
+            }
+        });
+        let owner = Self {
+            child,
+            messages,
+            reader: Some(reader),
+        };
+        assert_eq!(
+            owner.messages.recv_timeout(Duration::from_secs(5)).unwrap()["event"],
+            "ready"
+        );
+        owner
+    }
+    fn response(&mut self, method: &str, params: Value) -> Value {
+        writeln!(
+            self.child.stdin.as_mut().unwrap(),
+            "{}",
+            json!({"id":method,"method":method,"params":params})
+        )
+        .unwrap();
+        let response = self.messages.recv_timeout(Duration::from_secs(5)).unwrap();
+        assert_eq!(response["id"], method);
+        response
+    }
+    fn call(&mut self, method: &str, params: Value) -> Value {
+        let response = self.response(method, params);
+        assert_eq!(response["success"], true, "{response}");
+        response["result"].clone()
+    }
+}
+impl Drop for NativeOwner {
+    fn drop(&mut self) {
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+        if let Some(reader) = self.reader.take() {
+            let _ = reader.join();
+        }
+    }
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn inherited_namespace_binds_policy_and_persistent_recovery() {
+    isolated();
+    ip(&["netns", "add", "fdtarget"]);
+    let namespace = File::open("/run/netns/fdtarget").unwrap();
+    let metadata = namespace.metadata().unwrap();
+    let initial = fs::metadata("/proc/thread-self/ns/net").unwrap();
+    assert_ne!(metadata.ino(), initial.ino());
+    let mut child = NativeOwner::start(&namespace);
+    let pid = child.child.id();
+    let status = child.call("openOwner", serde_json::to_value(options("nsfd")).unwrap());
+    assert_eq!(
+        status["identity"]["namespaceDevice"],
+        metadata.dev().to_string()
+    );
+    assert_eq!(
+        status["identity"]["namespaceInode"],
+        metadata.ino().to_string()
+    );
+    assert_eq!(
+        fs::read_dir(format!("/proc/{pid}/task")).unwrap().count(),
+        1
+    );
+    let target_link = fs::read_link(format!("/proc/{pid}/ns/net")).unwrap();
+    for fd in fs::read_dir(format!("/proc/{pid}/fd")).unwrap() {
+        if let Ok(target) = fs::read_link(fd.unwrap().path()) {
+            assert_ne!(
+                target, target_link,
+                "child namespace descriptor must be closed"
+            );
+        }
+    }
+    let first = child.call(
+        "reconcilePolicy",
+        serde_json::to_value(Transition {
+            previous: None,
+            target: empty(1),
+        })
+        .unwrap(),
+    );
+    assert!(Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_none());
+    assert!(in_namespace("fdtarget", || Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_some()));
+    assert_eq!(
+        unsafe { libc::ioctl(namespace.as_raw_fd(), libc::NS_GET_NSTYPE) },
+        libc::CLONE_NEWNET
+    );
+    drop(child); // PERSIST must retain the target graph after native process loss.
+    assert!(!std::path::Path::new(&format!("/proc/{pid}")).exists());
+    assert!(in_namespace("fdtarget", || Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_some()));
+
+    let previous: Applied = serde_json::from_value(first).unwrap();
+    let transition = serde_json::to_value(Transition {
+        previous: Some(previous),
+        target: empty(2),
+    })
+    .unwrap();
+    let wrong_namespace = File::open("/proc/thread-self/ns/net").unwrap();
+    let mut wrong = NativeOwner::start(&wrong_namespace);
+    wrong.call("openOwner", serde_json::to_value(options("nsfd")).unwrap());
+    let denied = wrong.response("reconcilePolicy", transition.clone());
+    assert_eq!(denied["success"], false);
+    assert_eq!(denied["errorCode"], "CONFLICT");
+    assert!(Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_none());
+    drop(wrong);
+    assert!(in_namespace("fdtarget", || Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_some()));
+
+    let mut recovered = NativeOwner::start(&namespace);
+    recovered.call("openOwner", serde_json::to_value(options("nsfd")).unwrap());
+    drop(namespace); // The entered child keeps membership; caller capability is not consumed by it.
+    let applied = recovered.call("reconcilePolicy", transition);
+    assert_eq!(applied["receipt"]["revision"], 2);
+    assert_eq!(
+        applied["receipt"]["identity"]["namespaceInode"],
+        metadata.ino().to_string()
+    );
+    assert_eq!(recovered.call("inspectPolicy", json!({}))["enforced"], true);
+    assert_eq!(recovered.call("closeOwner", json!({}))["released"], true);
+    drop(recovered);
+    assert!(in_namespace("fdtarget", || Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_none()));
+    assert!(Owner::new(options("nsfd"))
+        .unwrap()
+        .graph()
+        .unwrap()
+        .is_none());
+    assert_eq!(
+        fs::metadata("/proc/thread-self/ns/net").unwrap().ino(),
+        initial.ino()
+    );
+    ip(&["netns", "delete", "fdtarget"]);
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn valid_descriptor_without_entry_permission_never_becomes_ready() {
+    isolated();
+    let namespace = File::open("/proc/thread-self/ns/net").unwrap();
+    let mut child = command(&namespace)
+        .uid(65534)
+        .gid(65534)
+        .stdin(Stdio::null())
+        .stderr(Stdio::piped())
+        .spawn()
+        .unwrap();
+    let deadline = Instant::now() + Duration::from_secs(5);
+    while child.try_wait().unwrap().is_none() {
+        if Instant::now() >= deadline {
+            let _ = child.kill();
+            let _ = child.wait();
+            panic!("denied namespace entry did not exit");
+        }
+        thread::sleep(Duration::from_millis(10));
+    }
+    let output = child.wait_with_output().unwrap();
+    assert_eq!(output.status.code(), Some(1));
+    assert!(output.stdout.is_empty());
+    assert!(String::from_utf8(output.stderr)
+        .unwrap()
+        .contains("network namespace entry failed"));
+    assert_eq!(
+        unsafe { libc::ioctl(namespace.as_raw_fd(), libc::NS_GET_NSTYPE) },
+        libc::CLONE_NEWNET
+    );
+}

package/rust/src/owner_packet_fixture.rs

@@ -0,0 +1,200 @@
+//! Guest-only Ethernet observation/injection for packet-path qualifications.
+use super::*;
+use std::os::fd::{AsRawFd, FromRawFd, OwnedFd};
+use std::time::{Duration, Instant};
+
+pub(super) struct PacketSocket {
+    fd: OwnedFd,
+    index: i32,
+}
+impl PacketSocket {
+    pub(super) fn open(name: &str) -> Self {
+        guest_guard();
+        let name = std::ffi::CString::new(name).unwrap();
+        let index = unsafe { libc::if_nametoindex(name.as_ptr()) } as i32;
+        assert!(index > 0);
+        let raw = unsafe {
+            libc::socket(
+                libc::AF_PACKET,
+                libc::SOCK_DGRAM | libc::SOCK_CLOEXEC,
+                i32::from((libc::ETH_P_IP as u16).to_be()),
+            )
+        };
+        assert!(
+            raw >= 0,
+            "packet socket: {}",
+            std::io::Error::last_os_error()
+        );
+        let fd = unsafe { OwnedFd::from_raw_fd(raw) };
+        let mut address: libc::sockaddr_ll = unsafe { std::mem::zeroed() };
+        address.sll_family = libc::AF_PACKET as u16;
+        address.sll_protocol = (libc::ETH_P_IP as u16).to_be();
+        address.sll_ifindex = index;
+        assert_eq!(
+            unsafe {
+                libc::bind(
+                    raw,
+                    (&address as *const libc::sockaddr_ll).cast(),
+                    std::mem::size_of_val(&address) as _,
+                )
+            },
+            0
+        );
+        Self { fd, index }
+    }
+    pub(super) fn send(&self, mac: [u8; 6], packet: &[u8]) {
+        let mut address: libc::sockaddr_ll = unsafe { std::mem::zeroed() };
+        address.sll_family = libc::AF_PACKET as u16;
+        address.sll_protocol = (libc::ETH_P_IP as u16).to_be();
+        address.sll_ifindex = self.index;
+        address.sll_halen = 6;
+        address.sll_addr[..6].copy_from_slice(&mac);
+        assert_eq!(
+            unsafe {
+                libc::sendto(
+                    self.fd.as_raw_fd(),
+                    packet.as_ptr().cast(),
+                    packet.len(),
+                    0,
+                    (&address as *const libc::sockaddr_ll).cast(),
+                    std::mem::size_of_val(&address) as _,
+                )
+            },
+            packet.len() as isize
+        );
+    }
+    pub(super) fn matching(&self, mut matches: impl FnMut(&[u8]) -> bool) -> Option<Vec<u8>> {
+        let deadline = Instant::now() + Duration::from_millis(500);
+        loop {
+            let remaining = deadline
+                .saturating_duration_since(Instant::now())
+                .as_millis();
+            if remaining == 0 {
+                return None;
+            }
+            let mut poll = libc::pollfd {
+                fd: self.fd.as_raw_fd(),
+                events: libc::POLLIN,
+                revents: 0,
+            };
+            let ready = unsafe { libc::poll(&mut poll, 1, remaining as i32) };
+            assert!(ready >= 0);
+            if ready == 0 {
+                return None;
+            }
+            let mut packet = vec![0; 65536];
+            let size = unsafe {
+                libc::recv(
+                    self.fd.as_raw_fd(),
+                    packet.as_mut_ptr().cast(),
+                    packet.len(),
+                    libc::MSG_TRUNC,
+                )
+            };
+            assert!(size >= 0 && (size as usize) <= packet.len());
+            packet.truncate(size as usize);
+            if matches(&packet) {
+                return Some(packet);
+            }
+        }
+    }
+}
+pub(super) fn mac(name: &str) -> [u8; 6] {
+    let output = std::process::Command::new("/bin/ip")
+        .args(["-j", "link", "show", "dev", name])
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let value = serde_json::from_slice::<serde_json::Value>(&output.stdout).unwrap();
+    value[0]["address"]
+        .as_str()
+        .unwrap()
+        .split(':')
+        .map(|byte| u8::from_str_radix(byte, 16).unwrap())
+        .collect::<Vec<_>>()
+        .try_into()
+        .unwrap()
+}
+fn checksum(bytes: &[u8]) -> u16 {
+    let mut sum: u32 = bytes
+        .chunks(2)
+        .map(|bytes| u32::from(bytes[0]) * 256 + u32::from(*bytes.get(1).unwrap_or(&0)))
+        .sum();
+    while sum >> 16 != 0 {
+        sum = (sum & 0xffff) + (sum >> 16);
+    }
+    !(sum as u16)
+}
+pub(super) fn tcp(
+    source: [u8; 4],
+    destination: [u8; 4],
+    source_port: u16,
+    destination_port: u16,
+    flags: u8,
+) -> Vec<u8> {
+    let mut packet = vec![0; 40];
+    packet[0] = 0x45;
+    packet[2..4].copy_from_slice(&40_u16.to_be_bytes());
+    packet[8] = 64;
+    packet[9] = 6;
+    packet[12..16].copy_from_slice(&source);
+    packet[16..20].copy_from_slice(&destination);
+    let sum = checksum(&packet[..20]);
+    packet[10..12].copy_from_slice(&sum.to_be_bytes());
+    packet[20..22].copy_from_slice(&source_port.to_be_bytes());
+    packet[22..24].copy_from_slice(&destination_port.to_be_bytes());
+    packet[24..28].copy_from_slice(&100_u32.to_be_bytes());
+    packet[32] = 0x50;
+    packet[33] = flags;
+    packet[34..36].copy_from_slice(&65535_u16.to_be_bytes());
+    let mut pseudo = Vec::new();
+    pseudo.extend(source);
+    pseudo.extend(destination);
+    pseudo.extend([0, 6, 0, 20]);
+    pseudo.extend(&packet[20..]);
+    let sum = checksum(&pseudo);
+    packet[36..38].copy_from_slice(&sum.to_be_bytes());
+    packet
+}
+
+pub(super) fn udp(
+    source: [u8; 4],
+    destination: [u8; 4],
+    source_port: u16,
+    destination_port: u16,
+) -> Vec<u8> {
+    let mut packet = vec![0; 32];
+    packet[0] = 0x45;
+    packet[2..4].copy_from_slice(&32_u16.to_be_bytes());
+    packet[8] = 64;
+    packet[9] = 17;
+    packet[12..16].copy_from_slice(&source);
+    packet[16..20].copy_from_slice(&destination);
+    let sum = checksum(&packet[..20]);
+    packet[10..12].copy_from_slice(&sum.to_be_bytes());
+    packet[20..22].copy_from_slice(&source_port.to_be_bytes());
+    packet[22..24].copy_from_slice(&destination_port.to_be_bytes());
+    packet[24..26].copy_from_slice(&12_u16.to_be_bytes());
+    packet[28..].copy_from_slice(b"frag");
+    packet
+}
+pub(super) fn fragments(packet: &[u8], id: u16) -> [Vec<u8>; 2] {
+    assert_eq!(packet.len(), 32);
+    assert_eq!(packet[0], 0x45);
+    let fragment = |body: &[u8], offset: u16| {
+        let mut result = packet[..20].to_vec();
+        result.extend(body);
+        let length = result.len() as u16;
+        result[2..4].copy_from_slice(&length.to_be_bytes());
+        result[4..6].copy_from_slice(&id.to_be_bytes());
+        result[6..8].copy_from_slice(&offset.to_be_bytes());
+        result[10..12].fill(0);
+        let sum = checksum(&result[..20]);
+        result[10..12].copy_from_slice(&sum.to_be_bytes());
+        result
+    };
+    [
+        fragment(&packet[20..28], 0x2000),
+        fragment(&packet[28..], 1),
+    ]
+}

package/rust/src/owner_tests.rs

@@ -1,6 +1,30 @@
 use super::*;
 
-fn isolated() {
+#[path = "owner_namespace_tests.rs"]
+mod namespace_tests;
+
+#[path = "owner_egress_identity_tests.rs"]
+mod egress_identity_tests;
+
+#[path = "owner_link_tests.rs"]
+mod link_tests;
+
+#[path = "owner_egress_tests.rs"]
+mod egress_tests;
+
+#[path = "owner_egress_traffic_tests.rs"]
+mod egress_traffic_tests;
+
+#[path = "owner_packet_fixture.rs"]
+mod packet_fixture;
+
+#[path = "owner_host_traffic_tests.rs"]
+mod host_traffic_tests;
+
+#[path = "owner_coexistence_tests.rs"]
+mod coexistence_tests;
+
+fn guest_guard() {
     assert_eq!(
         std::env::var("SMARTNFTABLES_ISOLATED_NATIVE").as_deref(),
         Ok("qemu-6.18.35")
@@ -9,6 +33,10 @@ fn isolated() {
         .unwrap()
         .contains("smartnftables_qualification=1"));
     assert_eq!(unsafe { libc::geteuid() }, 0);
+}
+
+fn isolated() {
+    guest_guard();
     let initial = context().unwrap();
     assert_eq!(
         unsafe { libc::unshare(libc::CLONE_NEWNET | libc::CLONE_NEWNS) },
@@ -276,7 +304,7 @@ fn native_interface_ipv4_directed_grants_and_spoof_denial() {
     assert_eq!(
         owner.reconcile(Transition {
             previous: None,
-            target: invalid_pair.prepare().unwrap()
+            target: invalid_pair.prepare().unwrap().into()
         }),
         Err(Error::Conflict)
     );
@@ -286,7 +314,7 @@ fn native_interface_ipv4_directed_grants_and_spoof_denial() {
     assert_eq!(
         owner.reconcile(Transition {
             previous: None,
-            target: policy.clone().prepare().unwrap()
+            target: policy.clone().prepare().unwrap().into()
         }),
         Err(Error::Conflict)
     );
@@ -295,7 +323,7 @@ fn native_interface_ipv4_directed_grants_and_spoof_denial() {
     let current = owner
         .reconcile(Transition {
             previous: None,
-            target: policy.clone().prepare().unwrap(),
+            target: policy.clone().prepare().unwrap().into(),
         })
         .expect("apply interface policy");
     assert!(owner.inspect().enforced);
@@ -333,7 +361,7 @@ fn native_interface_ipv4_directed_grants_and_spoof_denial() {
     let revoked = owner
         .reconcile(Transition {
             previous: Some(current),
-            target: denied.prepare().unwrap(),
+            target: denied.prepare().unwrap().into(),
         })
         .expect("atomic complete deny");
     udp(&client, &server, false);
@@ -361,6 +389,7 @@ fn empty(revision: u64) -> Prepared {
     }
     .prepare()
     .unwrap()
+    .into()
 }
 
 #[test]
@@ -696,14 +725,14 @@ fn native_tun_forwarding_binds_remote_ingress_and_rejects_tap() {
     assert_eq!(
         owner.reconcile(Transition {
             previous: None,
-            target: invalid.prepare().unwrap()
+            target: invalid.prepare().unwrap().into()
         }),
         Err(Error::Conflict)
     );
     let applied = owner
         .reconcile(Transition {
             previous: None,
-            target: policy.prepare().unwrap(),
+            target: policy.prepare().unwrap().into(),
         })
         .unwrap();
     send_tunnel(&mut device, true);