@push.rocks/smartnftables 1.4.0 → 1.5.0

package/rust/src/egress.rs

@@ -0,0 +1,682 @@
+use crate::{policy, Error, Result};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeSet;
+use std::net::Ipv4Addr;
+
+#[path = "egress.compile.rs"]
+mod compile;
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct LocalLink {
+    pub interface_index: u32,
+    pub interface_name: String,
+    pub interface_kind: String,
+    #[serde(deserialize_with = "policy::required_nullable")]
+    pub mac_address: Option<String>,
+    pub interface_link_index: u32,
+    pub required_ipv4_addresses: Vec<String>,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PlatformEndpoint {
+    pub id: String,
+    pub address: String,
+    pub protocol: String,
+    pub port: u16,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Protection {
+    pub authority_digest: String,
+    pub prefixes: Vec<String>,
+    pub platform_endpoints: Vec<PlatformEndpoint>,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PortRange {
+    pub protocol: String,
+    pub first: u16,
+    pub last: u16,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Lease {
+    pub id: String,
+    pub generation: u64,
+    pub digest: String,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Allocation {
+    pub lease: Lease,
+    pub transit_source_address: String,
+    pub source_port_ranges: Vec<PortRange>,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(tag = "kind", rename_all = "camelCase", deny_unknown_fields)]
+pub enum Destination {
+    Public {
+        prefix: String,
+    },
+    Platform {
+        #[serde(rename = "endpointId")]
+        endpoint_id: String,
+    },
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SelectedPortRange {
+    pub first: u16,
+    pub last: u16,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Grant {
+    #[serde(deserialize_with = "policy::required_nullable")]
+    pub source_endpoint: Option<String>,
+    pub source_prefix: String,
+    pub destination: Destination,
+    pub protocol: String,
+    #[serde(deserialize_with = "policy::required_nullable")]
+    pub source_port: Option<u16>,
+    #[serde(deserialize_with = "policy::required_nullable")]
+    pub destination_port: Option<u16>,
+    pub source_port_range: SelectedPortRange,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Generation {
+    pub lease: Lease,
+    pub transit_source_address: String,
+    pub source_port_ranges: Vec<PortRange>,
+    pub conntrack_zone: u16,
+    pub conntrack_label: String,
+    pub grants: Vec<Grant>,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RouterScope {
+    pub endpoints: Vec<policy::Endpoint>,
+    pub rules: Vec<policy::Rule>,
+    pub links: Vec<LocalLink>,
+    pub handoff: LocalLink,
+    pub protection: Protection,
+    pub generations: Vec<Generation>,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct HostHandoff {
+    pub link: LocalLink,
+    pub allocations: Vec<Allocation>,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct HostScope {
+    pub protection: Protection,
+    pub handoffs: Vec<HostHandoff>,
+    pub uplink: LocalLink,
+    pub snat_address: String,
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(tag = "kind", rename_all = "camelCase", deny_unknown_fields)]
+pub enum Scope {
+    RouterEgress(RouterScope),
+    HostTransit(HostScope),
+}
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Policy {
+    pub schema_version: u8,
+    pub revision: u64,
+    pub scope: Scope,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Prepared {
+    pub policy: Policy,
+    pub digest: String,
+}
+
+fn require(value: bool) -> Result<()> {
+    if value {
+        Ok(())
+    } else {
+        Err(Error::Invalid)
+    }
+}
+fn identifier(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= 200
+        && value.as_bytes()[0].is_ascii_alphanumeric()
+        && value
+            .bytes()
+            .all(|item| item.is_ascii_alphanumeric() || b":._-".contains(&item))
+}
+pub fn digest(value: &str) -> bool {
+    value.len() == 71
+        && value.starts_with("sha256:")
+        && value.as_bytes()[7..]
+            .iter()
+            .all(|item| item.is_ascii_digit() || (b'a'..=b'f').contains(item))
+}
+fn integer(value: u64) -> bool {
+    value > 0 && value <= 9_007_199_254_740_991
+}
+fn protocol(value: &str) -> bool {
+    ["tcp", "udp"].contains(&value)
+}
+pub fn address(value: &str) -> Result<u32> {
+    let ip: Ipv4Addr = value.parse().map_err(|_| Error::Invalid)?;
+    require(ip.to_string() == value)?;
+    Ok(u32::from(ip))
+}
+fn unicast(value: &str) -> Result<u32> {
+    let ip = address(value)?;
+    let first = ip >> 24;
+    require(first > 0 && first < 224 && first != 127)?;
+    Ok(ip)
+}
+pub fn prefix(value: &str) -> Result<(u32, u32)> {
+    let (ip, width) = value.split_once('/').ok_or(Error::Invalid)?;
+    let width: u32 = width.parse().map_err(|_| Error::Invalid)?;
+    require(width <= 32 && value == format!("{ip}/{width}"))?;
+    let base = address(ip)?;
+    let mask = if width == 0 {
+        0
+    } else {
+        u32::MAX << (32 - width)
+    };
+    require(base & mask == base)?;
+    Ok((base, mask))
+}
+pub fn covers(outer: &str, inner: &str) -> Result<bool> {
+    let (a, am) = prefix(outer)?;
+    let (b, bm) = prefix(inner)?;
+    Ok(bm & am == am && b & am == a)
+}
+fn overlaps(left: &str, right: &str) -> Result<bool> {
+    Ok(covers(left, right)? || covers(right, left)?)
+}
+fn covers_address(prefixes: &[String], ip: &str) -> Result<bool> {
+    for item in prefixes {
+        if covers(item, &format!("{ip}/32"))? {
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}
+fn normalize_link(link: &mut LocalLink) -> Result<()> {
+    require(
+        link.interface_index > 0
+            && link.interface_index <= i32::MAX as u32
+            && link.interface_link_index > 0
+            && link.interface_link_index <= i32::MAX as u32
+            && policy::identifier(&link.interface_name)
+            && link.interface_name.len() <= 15
+            && link.interface_name != "lo"
+            && ["veth", "tun", "ethernet"].contains(&link.interface_kind.as_str())
+            && link.required_ipv4_addresses.len() <= 32,
+    )?;
+    if link.interface_kind == "tun" {
+        require(link.mac_address.is_none())?;
+    } else {
+        let mac = link.mac_address.as_ref().ok_or(Error::Invalid)?;
+        let parts: Vec<_> = mac.split(':').collect();
+        require(
+            parts.len() == 6
+                && parts.iter().all(|part| {
+                    part.len() == 2
+                        && part
+                            .bytes()
+                            .all(|item| item.is_ascii_digit() || (b'a'..=b'f').contains(&item))
+                }),
+        )?;
+        let bytes: Vec<u8> = parts
+            .iter()
+            .map(|part| u8::from_str_radix(part, 16).unwrap())
+            .collect();
+        require(bytes[0] & 1 == 0 && bytes.iter().any(|item| *item != 0))?;
+    }
+    link.required_ipv4_addresses.sort();
+    for (index, ip) in link.required_ipv4_addresses.iter().enumerate() {
+        unicast(ip)?;
+        require(index == 0 || *ip != link.required_ipv4_addresses[index - 1])?;
+    }
+    Ok(())
+}
+fn unique_links<'a>(links: impl Iterator<Item = &'a LocalLink>) -> Result<()> {
+    let mut indices = BTreeSet::new();
+    let mut names = BTreeSet::new();
+    for link in links {
+        require(indices.insert(link.interface_index) && names.insert(&link.interface_name))?;
+    }
+    Ok(())
+}
+fn normalize_protection(value: &mut Protection) -> Result<()> {
+    require(
+        digest(&value.authority_digest)
+            && !value.prefixes.is_empty()
+            && value.prefixes.len() <= 128
+            && value.platform_endpoints.len() <= 96,
+    )?;
+    value.prefixes.sort();
+    for (index, item) in value.prefixes.iter().enumerate() {
+        prefix(item)?;
+        for previous in &value.prefixes[..index] {
+            require(!overlaps(item, previous)?)?;
+        }
+    }
+    value.platform_endpoints.sort_by(|a, b| a.id.cmp(&b.id));
+    let mut tuples = BTreeSet::new();
+    for (index, endpoint) in value.platform_endpoints.iter().enumerate() {
+        require(
+            identifier(&endpoint.id)
+                && protocol(&endpoint.protocol)
+                && endpoint.port > 0
+                && (index == 0 || endpoint.id != value.platform_endpoints[index - 1].id),
+        )?;
+        unicast(&endpoint.address)?;
+        require(
+            covers_address(&value.prefixes, &endpoint.address)?
+                && tuples.insert((&endpoint.address, &endpoint.protocol, endpoint.port)),
+        )?;
+    }
+    Ok(())
+}
+fn normalize_allocation(
+    lease: &Lease,
+    source: &str,
+    ranges: &mut [PortRange],
+    protection: &Protection,
+) -> Result<()> {
+    require(
+        identifier(&lease.id)
+            && integer(lease.generation)
+            && digest(&lease.digest)
+            && !ranges.is_empty()
+            && ranges.len() <= 16,
+    )?;
+    unicast(source)?;
+    require(covers_address(&protection.prefixes, source)?)?;
+    require(
+        protection
+            .platform_endpoints
+            .iter()
+            .all(|endpoint| endpoint.address != source),
+    )?;
+    ranges.sort();
+    for (index, range) in ranges.iter().enumerate() {
+        require(protocol(&range.protocol) && range.first > 0 && range.first <= range.last)?;
+        if index > 0 {
+            let previous = &ranges[index - 1];
+            require(previous.protocol != range.protocol || previous.last < range.first)?;
+        }
+    }
+    Ok(())
+}
+fn unique_allocations<'a>(
+    items: impl Iterator<Item = (&'a Lease, &'a str, &'a [PortRange])>,
+) -> Result<()> {
+    let mut leases = BTreeSet::new();
+    let mut prior: Vec<(&str, &[PortRange])> = Vec::new();
+    for (lease, source, ranges) in items {
+        require(leases.insert((&lease.id, lease.generation)))?;
+        for (other_source, other_ranges) in &prior {
+            if *other_source == source {
+                for left in ranges {
+                    for right in *other_ranges {
+                        require(
+                            left.protocol != right.protocol
+                                || left.last < right.first
+                                || right.last < left.first,
+                        )?;
+                    }
+                }
+            }
+        }
+        prior.push((source, ranges));
+    }
+    Ok(())
+}
+pub fn destination(grant: &Grant, protection: &Protection) -> Result<String> {
+    match &grant.destination {
+        Destination::Public { prefix: value } => {
+            prefix(value)?;
+            Ok(value.clone())
+        }
+        Destination::Platform { endpoint_id } => {
+            let endpoint = protection
+                .platform_endpoints
+                .iter()
+                .find(|item| item.id == *endpoint_id)
+                .ok_or(Error::Invalid)?;
+            require(
+                grant.protocol == endpoint.protocol
+                    && grant.destination_port == Some(endpoint.port),
+            )?;
+            Ok(format!("{}/32", endpoint.address))
+        }
+    }
+}
+fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
+    require(value.links.len() <= 32 && value.generations.len() <= 32)?;
+    let private = policy::Policy {
+        schema_version: 1,
+        revision,
+        endpoints: value.endpoints.clone(),
+        rules: value.rules.clone(),
+    }
+    .prepare()?;
+    value.endpoints = private.policy.endpoints;
+    value.rules = private.policy.rules;
+    normalize_protection(&mut value.protection)?;
+    normalize_link(&mut value.handoff)?;
+    require(
+        value.handoff.interface_kind == "veth"
+            && !value.handoff.required_ipv4_addresses.is_empty()
+            && value.links.len() == value.endpoints.len(),
+    )?;
+    for link in &mut value.links {
+        normalize_link(link)?;
+    }
+    value.links.sort_by_key(|link| link.interface_index);
+    unique_links(value.links.iter().chain(std::iter::once(&value.handoff)))?;
+    for endpoint in &value.endpoints {
+        require(value.links.iter().any(|link| {
+            link.interface_index == endpoint.interface_index
+                && link.interface_name == endpoint.interface_name
+                && link.interface_kind == endpoint.interface_kind
+        }))?;
+        for source in &endpoint.source_prefixes {
+            require(
+                value
+                    .protection
+                    .prefixes
+                    .iter()
+                    .any(|protected| covers(protected, source) == Ok(true)),
+            )?;
+            for exception in &value.protection.platform_endpoints {
+                require(!covers(source, &format!("{}/32", exception.address))?)?;
+            }
+        }
+    }
+    for link in value.links.iter().chain(std::iter::once(&value.handoff)) {
+        for ip in &link.required_ipv4_addresses {
+            require(
+                covers_address(&value.protection.prefixes, ip)?
+                    && value
+                        .protection
+                        .platform_endpoints
+                        .iter()
+                        .all(|endpoint| endpoint.address != *ip),
+            )?;
+        }
+    }
+    for rule in &value.rules {
+        for item in [&rule.source_prefix, &rule.destination_prefix] {
+            require(
+                value
+                    .protection
+                    .prefixes
+                    .iter()
+                    .any(|protected| covers(protected, item) == Ok(true)),
+            )?;
+        }
+    }
+    let mut zones = BTreeSet::new();
+    let mut labels = BTreeSet::new();
+    let mut classifiers: Vec<(&Grant, String)> = Vec::new();
+    let mut count = 0;
+    value
+        .generations
+        .sort_by(|a, b| (&a.lease.id, a.lease.generation).cmp(&(&b.lease.id, b.lease.generation)));
+    for generation in &mut value.generations {
+        normalize_allocation(
+            &generation.lease,
+            &generation.transit_source_address,
+            &mut generation.source_port_ranges,
+            &value.protection,
+        )?;
+        require(
+            value
+                .handoff
+                .required_ipv4_addresses
+                .contains(&generation.transit_source_address)
+                && generation.conntrack_zone > 0
+                && zones.insert(generation.conntrack_zone)
+                && generation.conntrack_label.len() == 32
+                && generation
+                    .conntrack_label
+                    .bytes()
+                    .all(|item| item.is_ascii_digit() || (b'a'..=b'f').contains(&item))
+                && generation.conntrack_label.bytes().any(|item| item != b'0')
+                && labels.insert(generation.conntrack_label.clone()),
+        )?;
+        count += generation.grants.len();
+        require(count <= 128)?;
+        generation.grants.sort();
+        for grant in &generation.grants {
+            require(
+                protocol(&grant.protocol)
+                    && grant.source_port != Some(0)
+                    && grant.destination_port != Some(0),
+            )?;
+            prefix(&grant.source_prefix)?;
+            if let Some(endpoint_id) = &grant.source_endpoint {
+                let endpoint = value
+                    .endpoints
+                    .iter()
+                    .find(|item| item.id == *endpoint_id)
+                    .ok_or(Error::Invalid)?;
+                require(
+                    endpoint.interface_kind == "veth"
+                        && endpoint
+                            .source_prefixes
+                            .iter()
+                            .any(|source| covers(source, &grant.source_prefix) == Ok(true)),
+                )?;
+            } else {
+                let (ip, mask) = prefix(&grant.source_prefix)?;
+                require(
+                    mask == u32::MAX
+                        && value
+                            .links
+                            .iter()
+                            .chain(std::iter::once(&value.handoff))
+                            .any(|link| {
+                                link.required_ipv4_addresses
+                                    .contains(&Ipv4Addr::from(ip).to_string())
+                            }),
+                )?;
+            }
+            require(generation.source_port_ranges.iter().any(|range| {
+                range.protocol == grant.protocol
+                    && range.first == grant.source_port_range.first
+                    && range.last == grant.source_port_range.last
+            }))?;
+            let target = destination(grant, &value.protection)?;
+            if let Destination::Public { .. } = &grant.destination {
+                require(
+                    !value
+                        .protection
+                        .prefixes
+                        .iter()
+                        .any(|protected| covers(protected, &target) == Ok(true)),
+                )?;
+            }
+            for (previous, previous_target) in &classifiers {
+                let same_kind = std::mem::discriminant(&previous.destination)
+                    == std::mem::discriminant(&grant.destination);
+                let ports_overlap =
+                    |a: Option<u16>, b: Option<u16>| a.is_none() || b.is_none() || a == b;
+                require(
+                    !(same_kind
+                        && previous.source_endpoint == grant.source_endpoint
+                        && previous.protocol == grant.protocol
+                        && ports_overlap(previous.source_port, grant.source_port)
+                        && ports_overlap(previous.destination_port, grant.destination_port)
+                        && overlaps(&previous.source_prefix, &grant.source_prefix)?
+                        && overlaps(previous_target, &target)?),
+                )?;
+            }
+            classifiers.push((grant, target));
+        }
+    }
+    unique_allocations(value.generations.iter().map(|item| {
+        (
+            &item.lease,
+            item.transit_source_address.as_str(),
+            item.source_port_ranges.as_slice(),
+        )
+    }))
+}
+fn normalize_host(value: &mut HostScope) -> Result<()> {
+    normalize_protection(&mut value.protection)?;
+    normalize_link(&mut value.uplink)?;
+    require(
+        value.handoffs.len() <= 32
+            && value.uplink.interface_kind != "tun"
+            && value
+                .uplink
+                .required_ipv4_addresses
+                .contains(&value.snat_address),
+    )?;
+    unicast(&value.snat_address)?;
+    value
+        .handoffs
+        .sort_by_key(|handoff| handoff.link.interface_index);
+    let mut count = 0;
+    let mut addresses = std::collections::BTreeMap::new();
+    let local_addresses: BTreeSet<_> = value
+        .handoffs
+        .iter()
+        .flat_map(|item| item.link.required_ipv4_addresses.iter().cloned())
+        .chain(value.uplink.required_ipv4_addresses.iter().cloned())
+        .collect();
+    for ip in &local_addresses {
+        require(
+            covers_address(&value.protection.prefixes, ip)?
+                && value
+                    .protection
+                    .platform_endpoints
+                    .iter()
+                    .all(|endpoint| endpoint.address != *ip),
+        )?;
+    }
+    for handoff in &mut value.handoffs {
+        normalize_link(&mut handoff.link)?;
+        require(
+            handoff.link.interface_kind == "veth"
+                && !handoff.link.required_ipv4_addresses.is_empty(),
+        )?;
+        for ip in &handoff.link.required_ipv4_addresses {
+            require(covers_address(&value.protection.prefixes, ip)?)?;
+        }
+        handoff.allocations.sort_by(|a, b| {
+            (&a.lease.id, a.lease.generation).cmp(&(&b.lease.id, b.lease.generation))
+        });
+        count += handoff.allocations.len();
+        require(count <= 32)?;
+        for allocation in &mut handoff.allocations {
+            normalize_allocation(
+                &allocation.lease,
+                &allocation.transit_source_address,
+                &mut allocation.source_port_ranges,
+                &value.protection,
+            )?;
+            require(
+                allocation.transit_source_address != value.snat_address
+                    && !local_addresses.contains(&allocation.transit_source_address),
+            )?;
+            if let Some(index) = addresses.insert(
+                allocation.transit_source_address.clone(),
+                handoff.link.interface_index,
+            ) {
+                require(index == handoff.link.interface_index)?;
+            }
+        }
+    }
+    unique_links(
+        value
+            .handoffs
+            .iter()
+            .map(|item| &item.link)
+            .chain(std::iter::once(&value.uplink)),
+    )?;
+    unique_allocations(
+        value
+            .handoffs
+            .iter()
+            .flat_map(|item| item.allocations.iter())
+            .map(|item| {
+                (
+                    &item.lease,
+                    item.transit_source_address.as_str(),
+                    item.source_port_ranges.as_slice(),
+                )
+            }),
+    )
+}
+
+#[cfg(test)]
+#[path = "egress_tests.rs"]
+pub(crate) mod tests;
+impl Policy {
+    pub fn prepare(self) -> Result<Prepared> {
+        use sha2::{Digest, Sha256};
+        let policy = self.normalize()?;
+        let mut hash = Sha256::new();
+        hash.update(b"smartnftables/managed-policy-v2\0");
+        hash.update(serde_json::to_vec(&policy).map_err(|_| Error::Invalid)?);
+        let result = Prepared {
+            policy,
+            digest: format!("sha256:{:x}", hash.finalize()),
+        };
+        result.program(&format!("snft_{}", "x".repeat(59)))?;
+        Ok(result)
+    }
+    pub fn normalize(mut self) -> Result<Self> {
+        require(self.schema_version == 2 && integer(self.revision))?;
+        match &mut self.scope {
+            Scope::RouterEgress(scope) => normalize_router(scope, self.revision)?,
+            Scope::HostTransit(scope) => normalize_host(scope)?,
+        }
+        Ok(self)
+    }
+}
+
+impl Prepared {
+    pub fn validate(&self) -> Result<()> {
+        require(self.policy.clone().prepare()? == *self)
+    }
+    pub fn program(&self, table: &str) -> Result<Vec<(u16, Vec<crate::wire::Attr>)>> {
+        compile::compile(self, table)
+    }
+    pub fn validate_interfaces(&self) -> Result<()> {
+        let links: Vec<&LocalLink> = match &self.policy.scope {
+            Scope::RouterEgress(scope) => scope
+                .links
+                .iter()
+                .chain(std::iter::once(&scope.handoff))
+                .collect(),
+            Scope::HostTransit(scope) => scope
+                .handoffs
+                .iter()
+                .map(|item| &item.link)
+                .chain(std::iter::once(&scope.uplink))
+                .collect(),
+        };
+        crate::wire::verify_bound_interfaces(links.into_iter().map(|link| {
+            crate::wire::BoundInterface {
+                index: link.interface_index,
+                name: &link.interface_name,
+                kind: &link.interface_kind,
+                mac: link.mac_address.as_deref(),
+                link_index: link.interface_link_index,
+                addresses: &link.required_ipv4_addresses,
+            }
+        }))
+    }
+}