@push.rocks/smartnftables 1.3.1 → 1.5.0

package/rust/src/policy.rs

@@ -210,10 +210,10 @@ impl Policy {
     }
 }
 
-fn expr(name: &str, data: Vec<Attr>) -> Attr {
+pub(crate) fn expr(name: &str, data: Vec<Attr>) -> Attr {
     Attr::nested(1, vec![Attr::string(1, name), Attr::nested(2, data)])
 }
-fn compare(value: Vec<u8>) -> Attr {
+pub(crate) fn compare(value: Vec<u8>) -> Attr {
     expr(
         "cmp",
         vec![
@@ -223,7 +223,7 @@ fn compare(value: Vec<u8>) -> Attr {
         ],
     )
 }
-fn meta(key: u32, value: Vec<u8>) -> Vec<Attr> {
+pub(crate) fn meta(key: u32, value: Vec<u8>) -> Vec<Attr> {
     vec![
         expr("meta", vec![Attr::u32(1, 1), Attr::u32(2, key)]),
         compare(value),
@@ -239,7 +239,7 @@ fn interface(endpoint: &Endpoint, incoming: bool) -> Vec<Attr> {
     result.extend(meta(if incoming { 6 } else { 7 }, name));
     result
 }
-fn ipv4() -> Vec<Attr> {
+pub(crate) fn ipv4() -> Vec<Attr> {
     meta(15, vec![libc::NFPROTO_IPV4 as u8])
 }
 fn address(cidr: &str, source: bool) -> Result<Vec<Attr>> {
@@ -268,7 +268,7 @@ fn address(cidr: &str, source: bool) -> Result<Vec<Attr>> {
         compare(address.to_be_bytes().to_vec()),
     ])
 }
-fn verdict(code: i32, chain: Option<&str>) -> Attr {
+pub(crate) fn verdict(code: i32, chain: Option<&str>) -> Attr {
     let mut data = vec![Attr::u32(1, code as u32)];
     if let Some(chain) = chain {
         data.push(Attr::string(2, chain));
@@ -329,99 +329,138 @@ impl Prepared {
                 ],
             ));
         }
+        for (name, expressions) in self.guard_chains()? {
+            program.push((3, vec![Attr::string(1, table), Attr::string(3, &name)]));
+            for expressions in expressions {
+                rule(&name, expressions, &mut program);
+            }
+        }
+        for chain in ["input", "forward", "output"] {
+            let parts = self.filter_rules(chain)?;
+            for expressions in parts
+                .guards
+                .into_iter()
+                .chain(parts.grants)
+                .chain(parts.denials)
+            {
+                rule(chain, expressions, &mut program);
+            }
+        }
+        Ok(program)
+    }
+}
+
+/// Reused inside a combined router graph; order remains part of schema-v1's bytes.
+pub(crate) struct PrivateRules {
+    pub guards: Vec<Vec<Attr>>,
+    pub grants: Vec<Vec<Attr>>,
+    pub denials: Vec<Vec<Attr>>,
+}
+impl Prepared {
+    pub(crate) fn guard_chains(&self) -> Result<Vec<(String, Vec<Vec<Attr>>)>> {
+        let mut result = Vec::new();
         for (index, endpoint) in self.policy.endpoints.iter().enumerate() {
             for incoming in [true, false] {
                 let name = format!("guard_{index}_{}", if incoming { "in" } else { "out" });
-                program.push((3, vec![Attr::string(1, table), Attr::string(3, &name)]));
+                let mut rules = Vec::new();
                 for cidr in &endpoint.source_prefixes {
                     let mut expressions = ipv4();
                     expressions.extend(address(cidr, incoming)?);
                     expressions.push(verdict(-5, None));
-                    rule(&name, expressions, &mut program);
+                    rules.push(expressions);
                 }
-                rule(&name, vec![verdict(0, None)], &mut program);
+                rules.push(vec![verdict(0, None)]);
+                result.push((name, rules));
             }
         }
-        for chain in ["input", "forward", "output"] {
-            for (index, endpoint) in self.policy.endpoints.iter().enumerate() {
-                for incoming in [true, false] {
-                    if (chain == "input" && !incoming) || (chain == "output" && incoming) {
-                        continue;
-                    }
-                    let name = format!("guard_{index}_{}", if incoming { "in" } else { "out" });
-                    let mut expressions = interface(endpoint, incoming);
-                    expressions.push(verdict(-3, Some(&name)));
-                    rule(chain, expressions, &mut program);
-                }
-            }
-            for grant in &self.policy.rules {
-                if chain == "input" && grant.destination_endpoint.is_some()
-                    || chain == "output" && grant.source_endpoint.is_some()
-                    || chain == "forward"
-                        && (grant.source_endpoint.is_none() || grant.destination_endpoint.is_none())
-                {
+        Ok(result)
+    }
+    pub(crate) fn filter_rules(&self, chain: &str) -> Result<PrivateRules> {
+        if !["input", "forward", "output"].contains(&chain) {
+            return Err(Error::Invalid);
+        }
+        let mut result = PrivateRules {
+            guards: Vec::new(),
+            grants: Vec::new(),
+            denials: Vec::new(),
+        };
+        for (index, endpoint) in self.policy.endpoints.iter().enumerate() {
+            for incoming in [true, false] {
+                if (chain == "input" && !incoming) || (chain == "output" && incoming) {
                     continue;
                 }
-                let mut expressions = ipv4();
-                for (id, incoming) in [
-                    (&grant.source_endpoint, true),
-                    (&grant.destination_endpoint, false),
-                ] {
-                    if let Some(id) = id {
-                        let endpoint = self
-                            .policy
-                            .endpoints
-                            .iter()
-                            .find(|ep| &ep.id == id)
-                            .ok_or(Error::Invalid)?;
-                        expressions.extend(interface(endpoint, incoming));
-                    }
-                }
-                expressions.extend(address(&grant.source_prefix, true)?);
-                expressions.extend(address(&grant.destination_prefix, false)?);
-                if grant.protocol != "any" {
-                    expressions
-                        .extend(meta(16, vec![if grant.protocol == "tcp" { 6 } else { 17 }]));
+                let name = format!("guard_{index}_{}", if incoming { "in" } else { "out" });
+                let mut expressions = interface(endpoint, incoming);
+                expressions.push(verdict(-3, Some(&name)));
+                result.guards.push(expressions);
+            }
+        }
+        for grant in &self.policy.rules {
+            if chain == "input" && grant.destination_endpoint.is_some()
+                || chain == "output" && grant.source_endpoint.is_some()
+                || chain == "forward"
+                    && (grant.source_endpoint.is_none() || grant.destination_endpoint.is_none())
+            {
+                continue;
+            }
+            let mut expressions = ipv4();
+            for (id, incoming) in [
+                (&grant.source_endpoint, true),
+                (&grant.destination_endpoint, false),
+            ] {
+                if let Some(id) = id {
+                    let endpoint = self
+                        .policy
+                        .endpoints
+                        .iter()
+                        .find(|ep| &ep.id == id)
+                        .ok_or(Error::Invalid)?;
+                    expressions.extend(interface(endpoint, incoming));
                 }
-                for (port, offset) in [(grant.source_port, 0), (grant.destination_port, 2)] {
-                    if let Some(port) = port {
-                        expressions.push(expr(
-                            "payload",
-                            vec![
-                                Attr::u32(1, 1),
-                                Attr::u32(2, 2),
-                                Attr::u32(3, offset),
-                                Attr::u32(4, 2),
-                            ],
-                        ));
-                        expressions.push(compare(port.to_be_bytes().to_vec()));
-                    }
+            }
+            expressions.extend(address(&grant.source_prefix, true)?);
+            expressions.extend(address(&grant.destination_prefix, false)?);
+            if grant.protocol != "any" {
+                expressions.extend(meta(16, vec![if grant.protocol == "tcp" { 6 } else { 17 }]));
+            }
+            for (port, offset) in [(grant.source_port, 0), (grant.destination_port, 2)] {
+                if let Some(port) = port {
+                    expressions.push(expr(
+                        "payload",
+                        vec![
+                            Attr::u32(1, 1),
+                            Attr::u32(2, 2),
+                            Attr::u32(3, offset),
+                            Attr::u32(4, 2),
+                        ],
+                    ));
+                    expressions.push(compare(port.to_be_bytes().to_vec()));
                 }
-                expressions.push(verdict(1, None));
-                rule(chain, expressions, &mut program);
             }
-            for endpoint in &self.policy.endpoints {
-                for incoming in [true, false] {
-                    if (chain == "input" && !incoming) || (chain == "output" && incoming) {
-                        continue;
-                    }
-                    // Either selector matching is enough to retain denial after rename/reuse.
-                    for mut expressions in [
-                        meta(
-                            if incoming { 4 } else { 5 },
-                            endpoint.interface_index.to_ne_bytes().to_vec(),
-                        ),
-                        meta(
-                            if incoming { 6 } else { 7 },
-                            [endpoint.interface_name.as_bytes(), &[0]].concat(),
-                        ),
-                    ] {
-                        expressions.push(verdict(0, None));
-                        rule(chain, expressions, &mut program);
-                    }
+            expressions.push(verdict(1, None));
+            result.grants.push(expressions);
+        }
+        for endpoint in &self.policy.endpoints {
+            for incoming in [true, false] {
+                if (chain == "input" && !incoming) || (chain == "output" && incoming) {
+                    continue;
+                }
+                // Either selector matching is enough to retain denial after rename/reuse.
+                for mut expressions in [
+                    meta(
+                        if incoming { 4 } else { 5 },
+                        endpoint.interface_index.to_ne_bytes().to_vec(),
+                    ),
+                    meta(
+                        if incoming { 6 } else { 7 },
+                        [endpoint.interface_name.as_bytes(), &[0]].concat(),
+                    ),
+                ] {
+                    expressions.push(verdict(0, None));
+                    result.denials.push(expressions);
                 }
             }
         }
-        Ok(program)
+        Ok(result)
     }
 }

package/rust/src/tests.rs

@@ -1,9 +1,31 @@
 use crate::{decode, policy::Policy, wire, Error};
+use sha2::{Digest, Sha256};
 
 fn policy() -> Policy {
     serde_json::from_str(r#"{"schemaVersion":1,"revision":1,"endpoints":[{"id":"a","interfaceIndex":2,"interfaceName":"worka","interfaceKind":"veth","sourcePrefixes":["10.81.0.2/32"]},{"id":"b","interfaceIndex":3,"interfaceName":"workb","interfaceKind":"veth","sourcePrefixes":["10.81.0.3/32"]}],"rules":[{"sourceEndpoint":"a","destinationEndpoint":"b","sourcePrefix":"10.81.0.2/32","destinationPrefix":"10.81.0.3/32","protocol":"udp","sourcePort":null,"destinationPort":53}]}"#).unwrap()
 }
 
+#[test]
+fn v1_policy_and_program_bytes_remain_frozen() {
+    let prepared = policy().prepare().unwrap();
+    let mut bytes = Vec::new();
+    for (kind, attributes) in prepared.program("snft_v1_golden").unwrap() {
+        let encoded = wire::encode_attrs(&attributes);
+        bytes.extend(kind.to_be_bytes());
+        bytes.extend((encoded.len() as u32).to_be_bytes());
+        bytes.extend(encoded);
+    }
+    assert_eq!(
+        prepared.digest,
+        "sha256:13897f4e711db2111618c61eb3f0be00714ed79f2075bf7f75e16f93f26ce2db"
+    );
+    assert_eq!(bytes.len(), 11020);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(bytes)),
+        "e57215884bca4bc8e0d7bef4c975cc3a1cc9e9233e44c248502a9efd99fa5c34"
+    );
+}
+
 #[test]
 fn canonical_policy_rejects_ambiguous_or_unbound_grants() {
     let prepared = policy().prepare().unwrap();

package/rust/src/wire.links.rs

@@ -0,0 +1,268 @@
+use super::{attrs, one, text, Attr, Socket};
+use crate::{Error, Result};
+use std::collections::BTreeSet;
+use std::net::Ipv4Addr;
+use std::time::{Duration, Instant};
+
+struct Link {
+    hardware: u16,
+    flags: u32,
+    attributes: Vec<Attr>,
+}
+
+/// Current local facts only. Peer namespaces and link-generation lifetimes remain caller-owned.
+#[derive(Clone, Copy)]
+pub struct BoundInterface<'a> {
+    pub index: u32,
+    pub name: &'a str,
+    pub kind: &'a str,
+    pub mac: Option<&'a str>,
+    pub link_index: u32,
+    pub addresses: &'a [String],
+}
+
+fn read_link(socket: &mut Socket, index: u32) -> Result<Link> {
+    let sequence = socket.sequence()?;
+    let mut request = Vec::new();
+    request.extend(32_u32.to_ne_bytes());
+    request.extend(18_u16.to_ne_bytes());
+    request.extend(1_u16.to_ne_bytes());
+    request.extend(sequence.to_ne_bytes());
+    request.extend(socket.port.to_ne_bytes());
+    request.extend([0; 4]);
+    request.extend(index.to_ne_bytes());
+    request.extend([0; 8]);
+    socket.send(&request)?;
+    let until = Instant::now() + Duration::from_secs(3);
+    loop {
+        for message in socket.receive(until)? {
+            if message.sequence != sequence {
+                continue;
+            }
+            if message.kind == 2 {
+                let error = i32::from_ne_bytes(
+                    message
+                        .payload
+                        .get(..4)
+                        .ok_or(Error::Protocol)?
+                        .try_into()
+                        .unwrap(),
+                );
+                if error != 0 {
+                    return Err(Error::kernel(error));
+                }
+            } else if message.kind == 16 && message.payload.len() >= 16 {
+                if u32::from_ne_bytes(message.payload[4..8].try_into().unwrap()) != index {
+                    return Err(Error::Conflict);
+                }
+                return Ok(Link {
+                    hardware: u16::from_ne_bytes(message.payload[2..4].try_into().unwrap()),
+                    flags: u32::from_ne_bytes(message.payload[8..12].try_into().unwrap()),
+                    attributes: attrs(&message.payload[16..])?,
+                });
+            } else {
+                return Err(Error::Protocol);
+            }
+        }
+    }
+}
+fn unbridged(attributes: &[Attr]) -> Result<()> {
+    if attributes.iter().any(|attr| attr.id() == 10)
+        && one(attributes, 10)?.value != 0_u32.to_ne_bytes()
+    {
+        return Err(Error::Conflict);
+    }
+    Ok(())
+}
+fn virtual_kind(attributes: &[Attr], kind: &str) -> Result<()> {
+    let info = attrs(&one(attributes, 18)?.value)?;
+    if text(&info, 1)? != kind {
+        return Err(Error::Conflict);
+    }
+    if kind == "tun" && one(&attrs(&one(&info, 2)?.value)?, 3)?.value != [1] {
+        return Err(Error::Conflict);
+    }
+    Ok(())
+}
+/// Preserve schema-v1's local name/index/kind/master checks exactly.
+pub fn verify_interfaces<'a>(
+    interfaces: impl Iterator<Item = (u32, &'a str, &'a str)>,
+) -> Result<()> {
+    let mut socket = Socket::open_protocol(libc::NETLINK_ROUTE)?;
+    for (index, name, kind) in interfaces {
+        let link = read_link(&mut socket, index)?;
+        if text(&link.attributes, 3)? != name {
+            return Err(Error::Conflict);
+        }
+        unbridged(&link.attributes)?;
+        virtual_kind(&link.attributes, kind)?;
+    }
+    Ok(())
+}
+fn matches(link: &Link, binding: &BoundInterface<'_>) -> Result<()> {
+    if text(&link.attributes, 3)? != binding.name || link.flags & libc::IFF_LOOPBACK as u32 != 0 {
+        return Err(Error::Conflict);
+    }
+    unbridged(&link.attributes)?;
+    match binding.kind {
+        "veth" | "tun" => virtual_kind(&link.attributes, binding.kind)?,
+        "ethernet" => {
+            // Physical/VirtIO Ethernet has no IFLA_LINKINFO; bridge, VLAN, bond,
+            // dummy and other virtual kinds are not an implicit uplink role.
+            if link.attributes.iter().any(|item| item.id() == 18) {
+                return Err(Error::Conflict);
+            }
+        }
+        _ => return Err(Error::Invalid),
+    }
+    if binding.kind == "tun" {
+        if link.hardware != 65534 || binding.mac.is_some() {
+            return Err(Error::Conflict);
+        }
+    } else {
+        let mac = &one(&link.attributes, 1)?.value;
+        if link.hardware != 1
+            || mac.len() != 6
+            || mac[0] & 1 != 0
+            || mac.iter().all(|item| *item == 0)
+        {
+            return Err(Error::Conflict);
+        }
+        let actual = mac
+            .iter()
+            .map(|item| format!("{item:02x}"))
+            .collect::<Vec<_>>()
+            .join(":");
+        if binding.mac != Some(actual.as_str()) {
+            return Err(Error::Conflict);
+        }
+    }
+    let peer = if link.attributes.iter().any(|item| item.id() == 5) {
+        u32::from_ne_bytes(
+            one(&link.attributes, 5)?
+                .value
+                .as_slice()
+                .try_into()
+                .map_err(|_| Error::Protocol)?,
+        )
+    } else {
+        binding.index
+    };
+    if peer != binding.link_index {
+        return Err(Error::Conflict);
+    }
+    Ok(())
+}
+fn read_addresses(socket: &mut Socket, index: u32) -> Result<BTreeSet<String>> {
+    let sequence = socket.sequence()?;
+    let mut request = Vec::new();
+    request.extend(24_u32.to_ne_bytes());
+    request.extend(22_u16.to_ne_bytes());
+    request.extend(0x301_u16.to_ne_bytes());
+    request.extend(sequence.to_ne_bytes());
+    request.extend(socket.port.to_ne_bytes());
+    request.extend([libc::AF_INET as u8, 0, 0, 0]);
+    request.extend(index.to_ne_bytes());
+    socket.send(&request)?;
+    let until = Instant::now() + Duration::from_secs(3);
+    let mut result = BTreeSet::new();
+    let mut total = 0;
+    let mut count = 0;
+    loop {
+        for message in socket.receive(until)? {
+            if message.sequence != sequence {
+                continue;
+            }
+            if message.flags & 0x10 != 0 {
+                return Err(Error::Conflict);
+            }
+            if message.kind == 2 || message.kind == 3 {
+                if message.kind == 2 || !message.payload.is_empty() {
+                    let error = i32::from_ne_bytes(
+                        message
+                            .payload
+                            .get(..4)
+                            .ok_or(Error::Protocol)?
+                            .try_into()
+                            .unwrap(),
+                    );
+                    if error != 0 {
+                        return Err(Error::kernel(error));
+                    }
+                }
+                if message.kind == 3 {
+                    return Ok(result);
+                }
+                continue;
+            }
+            count += 1;
+            total += message.payload.len();
+            if message.kind != 20 || message.payload.len() < 8 || count > 4096 || total > 2_097_152
+            {
+                return Err(Error::Protocol);
+            }
+            if message.payload[0] != libc::AF_INET as u8 {
+                return Err(Error::Protocol);
+            }
+            if u32::from_ne_bytes(message.payload[4..8].try_into().unwrap()) != index {
+                continue;
+            }
+            let data = attrs(&message.payload[8..])?;
+            let local = if data.iter().any(|item| item.id() == 2) {
+                one(&data, 2)?
+            } else {
+                one(&data, 1)?
+            };
+            let bytes: [u8; 4] = local
+                .value
+                .as_slice()
+                .try_into()
+                .map_err(|_| Error::Protocol)?;
+            let flags = if data.iter().any(|item| item.id() == 8) {
+                u32::from_ne_bytes(
+                    one(&data, 8)?
+                        .value
+                        .as_slice()
+                        .try_into()
+                        .map_err(|_| Error::Protocol)?,
+                )
+            } else {
+                u32::from(message.payload[2])
+            };
+            // Tentative, failed or deprecated source addresses do not qualify.
+            if flags & (0x40 | 0x08 | 0x20) != 0 {
+                continue;
+            }
+            if data.iter().any(|item| item.id() == 6) {
+                let cache = &one(&data, 6)?.value;
+                if cache.len() != 16 {
+                    return Err(Error::Protocol);
+                }
+                if u32::from_ne_bytes(cache[..4].try_into().unwrap()) == 0
+                    || u32::from_ne_bytes(cache[4..8].try_into().unwrap()) == 0
+                {
+                    continue;
+                }
+            }
+            result.insert(Ipv4Addr::from(bytes).to_string());
+        }
+    }
+}
+pub fn verify_bound_interfaces<'a>(
+    interfaces: impl Iterator<Item = BoundInterface<'a>>,
+) -> Result<()> {
+    let mut socket = Socket::open_protocol(libc::NETLINK_ROUTE)?;
+    for binding in interfaces {
+        matches(&read_link(&mut socket, binding.index)?, &binding)?;
+        let addresses = read_addresses(&mut socket, binding.index)?;
+        if binding
+            .addresses
+            .iter()
+            .any(|address| !addresses.contains(address))
+        {
+            return Err(Error::Conflict);
+        }
+        matches(&read_link(&mut socket, binding.index)?, &binding)?;
+    }
+    Ok(())
+}

package/rust/src/wire.rs

@@ -123,70 +123,9 @@ pub struct Socket {
     sequence: u32,
 }
 
-/// Read-only, namespace-local RTM_GETLINK qualification. This is not a public
-/// routing or link-creation escape; only the strict native compiler calls it.
-pub fn verify_interfaces<'a>(
-    interfaces: impl Iterator<Item = (u32, &'a str, &'a str)>,
-) -> Result<()> {
-    let mut socket = Socket::open_protocol(libc::NETLINK_ROUTE)?;
-    for (index, name, kind) in interfaces {
-        let sequence = socket.sequence()?;
-        let mut request = Vec::new();
-        request.extend(32_u32.to_ne_bytes());
-        request.extend(18_u16.to_ne_bytes());
-        request.extend(1_u16.to_ne_bytes());
-        request.extend(sequence.to_ne_bytes());
-        request.extend(socket.port.to_ne_bytes());
-        request.extend([0; 4]);
-        request.extend(index.to_ne_bytes());
-        request.extend([0; 8]);
-        socket.send(&request)?;
-        let until = Instant::now() + Duration::from_secs(3);
-        let response = 'read: loop {
-            for message in socket.receive(until)? {
-                if message.sequence != sequence {
-                    continue;
-                }
-                if message.kind == 2 {
-                    let error = i32::from_ne_bytes(
-                        message
-                            .payload
-                            .get(..4)
-                            .ok_or(Error::Protocol)?
-                            .try_into()
-                            .unwrap(),
-                    );
-                    if error != 0 {
-                        return Err(Error::kernel(error));
-                    }
-                } else if message.kind == 16 && message.payload.len() >= 16 {
-                    if u32::from_ne_bytes(message.payload[4..8].try_into().unwrap()) != index {
-                        return Err(Error::Conflict);
-                    }
-                    break 'read attrs(&message.payload[16..])?;
-                } else {
-                    return Err(Error::Protocol);
-                }
-            }
-        };
-        if text(&response, 3)? != name {
-            return Err(Error::Conflict);
-        }
-        if response.iter().any(|attr| attr.id() == 10)
-            && one(&response, 10)?.value != 0_u32.to_ne_bytes()
-        {
-            return Err(Error::Conflict);
-        }
-        let info = attrs(&one(&response, 18)?.value)?;
-        if text(&info, 1)? != kind {
-            return Err(Error::Conflict);
-        }
-        if kind == "tun" && one(&attrs(&one(&info, 2)?.value)?, 3)?.value != [1] {
-            return Err(Error::Conflict);
-        }
-    }
-    Ok(())
-}
+#[path = "wire.links.rs"]
+mod links;
+pub use links::{verify_bound_interfaces, verify_interfaces, BoundInterface};
 impl Socket {
     pub fn open() -> Result<Self> {
         Self::open_protocol(libc::NETLINK_NETFILTER)

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '1.3.1',
+  version: '1.5.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }