@push.rocks/smartnftables 1.4.0 → 1.5.0

package/rust/src/owner_egress_identity_tests.rs

@@ -0,0 +1,155 @@
+use super::isolated;
+use crate::owner::{chain_identity, rule_identity};
+use crate::wire::{self, Attr, Socket};
+
+fn expression(name: &str, data: Vec<Attr>) -> Attr {
+    Attr::nested(1, vec![Attr::string(1, name), Attr::nested(2, data)])
+}
+fn immediate(register: u32, value: Vec<u8>) -> Attr {
+    expression(
+        "immediate",
+        vec![
+            Attr::u32(1, register),
+            Attr::nested(2, vec![Attr::bytes(1, value)]),
+        ],
+    )
+}
+fn chain(name: &str, hook: u32, priority: i32, kind: &str) -> Vec<Attr> {
+    vec![
+        Attr::string(1, "snft_egress_identity"),
+        Attr::string(3, name),
+        Attr::nested(4, vec![Attr::u32(1, hook), Attr::u32(2, priority as u32)]),
+        Attr::u32(5, 1),
+        Attr::string(7, kind),
+        Attr::u32(10, 1),
+    ]
+}
+fn rule(chain: &str, ordinal: u8, expressions: Vec<Attr>) -> Vec<Attr> {
+    vec![
+        Attr::string(1, "snft_egress_identity"),
+        Attr::string(2, chain),
+        Attr::nested(4, expressions),
+        Attr::bytes(7, vec![ordinal]),
+    ]
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn native_ct_nat_range_graph_identity_matches_exact_linux_dump() {
+    isolated();
+    let chains = [
+        chain("raw", 0, -300, "filter"),
+        chain("forward", 2, 0, "filter"),
+        chain("post", 4, 100, "nat"),
+    ];
+    let rules = [
+        rule(
+            "raw",
+            1,
+            vec![
+                immediate(1, 17_u16.to_ne_bytes().to_vec()),
+                expression("ct", vec![Attr::u32(2, 17), Attr::u32(4, 1)]),
+            ],
+        ),
+        rule(
+            "forward",
+            2,
+            vec![
+                expression(
+                    "ct",
+                    vec![Attr::u32(1, 1), Attr::u32(2, 20), Attr::bytes(3, vec![0])],
+                ),
+                expression("ct", vec![Attr::u32(1, 1), Attr::u32(2, 17)]),
+                immediate(1, vec![0x7a; 16]),
+                expression("ct", vec![Attr::u32(2, 13), Attr::u32(4, 1)]),
+                expression("ct", vec![Attr::u32(1, 1), Attr::u32(2, 13)]),
+                expression(
+                    "payload",
+                    vec![
+                        Attr::u32(1, 1),
+                        Attr::u32(2, 2),
+                        Attr::u32(3, 0),
+                        Attr::u32(4, 2),
+                    ],
+                ),
+                expression(
+                    "range",
+                    vec![
+                        Attr::u32(1, 1),
+                        Attr::u32(2, 0),
+                        Attr::nested(3, vec![Attr::bytes(1, 10000_u16.to_be_bytes().to_vec())]),
+                        Attr::nested(4, vec![Attr::bytes(1, 10999_u16.to_be_bytes().to_vec())]),
+                    ],
+                ),
+            ],
+        ),
+        rule(
+            "post",
+            3,
+            vec![
+                immediate(1, vec![10, 240, 0, 2]),
+                immediate(2, 10000_u16.to_be_bytes().to_vec()),
+                immediate(3, 10999_u16.to_be_bytes().to_vec()),
+                expression(
+                    "nat",
+                    vec![
+                        Attr::u32(1, 0),
+                        Attr::u32(2, 2),
+                        Attr::u32(3, 1),
+                        Attr::u32(4, 1),
+                        Attr::u32(5, 2),
+                        Attr::u32(6, 3),
+                        Attr::u32(7, 3),
+                    ],
+                ),
+            ],
+        ),
+    ];
+    let mut socket = Socket::open().unwrap();
+    let mut operations = vec![(
+        0,
+        0x600,
+        vec![Attr::string(1, "snft_egress_identity"), Attr::u32(2, 6)],
+    )];
+    operations.extend(chains.iter().cloned().map(|value| (3, 0x600, value)));
+    operations.extend(rules.iter().cloned().map(|value| (6, 0xc00, value)));
+    let generation = socket.generation().unwrap();
+    socket.batch(generation, operations).unwrap();
+    let dumped_chains = socket
+        .query(4, vec![Attr::string(1, "snft_egress_identity")], true)
+        .unwrap();
+    assert_eq!(dumped_chains.len(), chains.len());
+    for expected in &chains {
+        let name = wire::text(expected, 3).unwrap();
+        let actual = dumped_chains
+            .iter()
+            .find(|item| wire::text(item, 3).unwrap() == name)
+            .unwrap();
+        assert_eq!(
+            chain_identity(actual).unwrap(),
+            chain_identity(expected).unwrap()
+        );
+    }
+    let dumped_rules = socket
+        .query(7, vec![Attr::string(1, "snft_egress_identity")], true)
+        .unwrap();
+    assert_eq!(dumped_rules.len(), rules.len());
+    for expected in &rules {
+        let actual = dumped_rules
+            .iter()
+            .find(|item| wire::one(item, 7).unwrap().value == wire::one(expected, 7).unwrap().value)
+            .unwrap();
+        assert_eq!(
+            rule_identity(actual).unwrap(),
+            rule_identity(expected).unwrap()
+        );
+    }
+    let generation = socket.generation().unwrap();
+    socket
+        .batch(
+            generation,
+            vec![(2, 0, vec![Attr::string(1, "snft_egress_identity")])],
+        )
+        .unwrap();
+    println!("EGRESS_EXPRESSION_IDENTITY ct_zone_label_original_ipv4=true nat_explicit_min_max=true range_inclusive=true traffic_qualified=false");
+}

package/rust/src/owner_egress_tests.rs

@@ -0,0 +1,153 @@
+use super::*;
+use crate::egress;
+use serde_json::{json, Value};
+
+fn binding(name: &str, address: &str, kind: &str) -> Value {
+    let output = std::process::Command::new("/bin/ip")
+        .args(["-j", "-d", "link", "show", "dev", name])
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let observed = serde_json::from_slice::<Value>(&output.stdout).unwrap()[0].clone();
+    let index = observed["ifindex"].as_u64().unwrap();
+    let peer_index = if kind == "veth" {
+        let peer = std::ffi::CString::new(format!("{name}peer")).unwrap();
+        let index = unsafe { libc::if_nametoindex(peer.as_ptr()) };
+        assert_ne!(index, 0);
+        u64::from(index)
+    } else {
+        index
+    };
+    json!({"interfaceIndex":index,"interfaceName":name,"interfaceKind":kind,
+        "macAddress":if kind=="tun" {Value::Null} else {observed["address"].clone()},
+        "interfaceLinkIndex":peer_index,
+        "requiredIpv4Addresses":[address]})
+}
+fn veth(name: &str, address: &str) {
+    ip(&[
+        "link",
+        "add",
+        name,
+        "type",
+        "veth",
+        "peer",
+        "name",
+        &format!("{name}peer"),
+    ]);
+    ip(&["address", "add", address, "dev", name]);
+    ip(&["link", "set", name, "up"]);
+}
+fn router() -> egress::Policy {
+    veth("work", "10.241.0.1/24");
+    veth("handoff", "10.240.0.2/30");
+    ip(&["tuntap", "add", "dev", "vpn", "mode", "tun"]);
+    ip(&["address", "add", "10.242.0.1/24", "dev", "vpn"]);
+    let mut value = egress::tests::router();
+    value["scope"]["links"] = json!([
+        binding("work", "10.241.0.1", "veth"),
+        binding("vpn", "10.242.0.1", "tun")
+    ]);
+    value["scope"]["handoff"] = binding("handoff", "10.240.0.2", "veth");
+    for index in 0..2 {
+        value["scope"]["endpoints"][index]["interfaceIndex"] =
+            value["scope"]["links"][index]["interfaceIndex"].clone();
+    }
+    serde_json::from_value(value).unwrap()
+}
+fn host() -> egress::Policy {
+    veth("handoff", "10.240.0.1/30");
+    veth("uplink", "192.0.2.2/24");
+    let mut value = egress::tests::host();
+    value["scope"]["handoffs"][0]["link"] = binding("handoff", "10.240.0.1", "veth");
+    value["scope"]["uplink"] = binding("uplink", "192.0.2.2", "veth");
+    serde_json::from_value(value).unwrap()
+}
+fn recover(name: &str, policy: egress::Policy) {
+    let prepared: Prepared = policy.clone().prepare().unwrap().into();
+    prepared.validate_interfaces().expect("fixture bindings");
+    let mut owner = Owner::new(options(name)).unwrap();
+    let result = owner.reconcile(Transition {
+        previous: None,
+        target: prepared.clone(),
+    });
+    if result.is_err() {
+        if let Some(graph) = owner.graph().unwrap() {
+            for (kind, expected) in prepared.program(&format!("snft_{name}")).unwrap() {
+                if kind == 3 {
+                    let name = wire::text(&expected, 3).unwrap();
+                    let actual = graph
+                        .chains
+                        .iter()
+                        .find(|item| wire::text(item, 3).unwrap() == name)
+                        .unwrap();
+                    assert_eq!(
+                        chain_identity(&expected),
+                        chain_identity(actual),
+                        "chain {name}"
+                    );
+                } else {
+                    let stamp = &wire::one(&expected, 7).unwrap().value;
+                    let actual = graph
+                        .rules
+                        .iter()
+                        .find(|item| &wire::one(item, 7).unwrap().value == stamp)
+                        .unwrap();
+                    if rule_identity(&expected) != rule_identity(actual) {
+                        println!("expected_rule={expected:?}\nactual_rule={actual:?}");
+                        panic!("full graph identity differs");
+                    }
+                }
+            }
+        }
+    }
+    let applied = result.unwrap();
+    assert!(owner.inspect().enforced);
+    let handle = applied.receipt.table_handle.clone();
+    // Drop only the process/socket owner. PERSIST retains the complete graph.
+    drop(owner);
+    let mut owner = Owner::new(options(name)).unwrap();
+    let recovered = owner
+        .reconcile(Transition {
+            previous: None,
+            target: prepared,
+        })
+        .unwrap();
+    assert_eq!(recovered.receipt.table_handle, handle);
+    assert!(owner.inspect().enforced);
+    let mut next = policy;
+    next.revision += 1;
+    let transition = Transition {
+        previous: Some(recovered.clone()),
+        target: next.prepare().unwrap().into(),
+    };
+    let next_applied = owner.reconcile(transition.clone()).unwrap();
+    assert!(owner.inspect().enforced);
+    // Exact persisted command replay after the target ACK was lost.
+    drop(owner);
+    let mut owner = Owner::new(options(name)).unwrap();
+    assert_eq!(owner.reconcile(transition).unwrap(), next_applied);
+    assert!(owner.inspect().enforced);
+    // A valid private-v1 policy cannot replace this table's v2 role.
+    assert_eq!(
+        owner.reconcile(Transition {
+            previous: Some(next_applied.clone()),
+            target: empty(3)
+        }),
+        Err(Error::Conflict)
+    );
+    assert!(owner.inspect().enforced);
+    owner.release(next_applied).unwrap();
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_router_complete_graph_persist_and_lost_ack_recovery() {
+    isolated();
+    recover("router_v2", router());
+}
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_complete_graph_persist_and_lost_ack_recovery() {
+    isolated();
+    recover("host_v2", host());
+}