@push.rocks/smartnftables 1.4.0 → 1.5.0

package/rust/src/owner_host_traffic_tests.rs

@@ -0,0 +1,305 @@
+use super::egress_traffic_tests::{connect, denied, host_policy, ns_ip, roundtrip, socket};
+use super::*;
+use crate::policy::{compare, expr, meta};
+use std::net::UdpSocket;
+
+const SOURCE: &str = "hs_source";
+const HOST: &str = "hs_host";
+const PEER: &str = "hs_peer";
+
+fn payload(offset: u32, bytes: Vec<u8>, transport: bool) -> Vec<Attr> {
+    vec![
+        expr(
+            "payload",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, if transport { 2 } else { 1 }),
+                Attr::u32(3, offset),
+                Attr::u32(4, bytes.len() as u32),
+            ],
+        ),
+        compare(bytes),
+    ]
+}
+fn immediate(value: Vec<u8>) -> Attr {
+    expr(
+        "immediate",
+        vec![
+            Attr::u32(1, 1),
+            Attr::nested(2, vec![Attr::bytes(1, value)]),
+        ],
+    )
+}
+fn hostile_capture_fixture() {
+    let mut socket = wire::Socket::open().unwrap();
+    let table = "snft_foreign_capture";
+    let mut operations = vec![(0, 0x600, vec![Attr::string(1, table), Attr::u32(2, 6)])];
+    for (chain, priority, kind) in [("raw", -300_i32, "filter"), ("pre", -100, "nat")] {
+        operations.push((
+            3,
+            0x600,
+            vec![
+                Attr::string(1, table),
+                Attr::string(3, chain),
+                Attr::nested(4, vec![Attr::u32(1, 0), Attr::u32(2, priority as u32)]),
+                Attr::u32(5, 1),
+                Attr::string(7, kind),
+                Attr::u32(10, 1),
+            ],
+        ));
+    }
+    // Foreign DNAT changes either side of the protected comparison. These
+    // paths have positive packet controls before the managed owner is applied.
+    for (port, destination, target) in [
+        (10001, [10, 250, 0, 2], [203, 0, 113, 2]),
+        (10002, [203, 0, 113, 2], [10, 250, 0, 2]),
+        (10004, [203, 0, 113, 2], [192, 0, 2, 2]),
+    ] {
+        let mut expressions = meta(
+            4,
+            unsafe { libc::if_nametoindex(c"router".as_ptr()) }
+                .to_ne_bytes()
+                .to_vec(),
+        );
+        expressions.extend(meta(16, vec![17]));
+        expressions.extend(payload(12, vec![10, 240, 0, 2], false));
+        expressions.extend(payload(16, destination.to_vec(), false));
+        expressions.extend(payload(0, (port as u16).to_be_bytes().to_vec(), true));
+        expressions.push(immediate(target.to_vec()));
+        expressions.push(expr(
+            "nat",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, 2),
+                Attr::u32(3, 1),
+                Attr::u32(4, 1),
+                Attr::u32(7, 1),
+            ],
+        ));
+        operations.push((
+            6,
+            0xc00,
+            vec![
+                Attr::string(1, table),
+                Attr::string(2, "pre"),
+                Attr::nested(4, expressions),
+            ],
+        ));
+    }
+    let mut expressions = meta(
+        4,
+        unsafe { libc::if_nametoindex(c"router".as_ptr()) }
+            .to_ne_bytes()
+            .to_vec(),
+    );
+    expressions.extend(meta(16, vec![17]));
+    expressions.extend(payload(0, 10003_u16.to_be_bytes().to_vec(), true));
+    expressions.push(immediate(19_u16.to_ne_bytes().to_vec()));
+    expressions.push(expr("ct", vec![Attr::u32(2, 17), Attr::u32(4, 1)]));
+    operations.push((
+        6,
+        0xc00,
+        vec![
+            Attr::string(1, table),
+            Attr::string(2, "raw"),
+            Attr::nested(4, expressions),
+        ],
+    ));
+    let generation = socket.generation().unwrap();
+    socket.batch(generation, operations).unwrap();
+    // This is a persistent *foreign fixture* table. Drop its process socket;
+    // native managed-table ownership never adopts or removes this graph.
+}
+fn control(source: &UdpSocket, destination: &str, target: &UdpSocket, allowed: bool) {
+    assert_eq!(source.send_to(b"probe", destination).unwrap(), 5);
+    if allowed {
+        assert_eq!(target.recv(&mut [0; 64]).unwrap(), 5);
+    } else {
+        assert!(target.recv(&mut [0; 64]).is_err());
+    }
+}
+fn ipv6_pair(a: &str, aname: &str, aip: &str, b: &str, bname: &str, bip: &str) {
+    let aname_owned = aname.to_owned();
+    let bname_owned = bname.to_owned();
+    let amac = in_namespace(a, move || packet_fixture::mac(&aname_owned));
+    let bmac = in_namespace(b, move || packet_fixture::mac(&bname_owned));
+    let mac = |value: [u8; 6]| {
+        value
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect::<Vec<_>>()
+            .join(":")
+    };
+    for (ns, name, address, peer, peer_mac) in
+        [(a, aname, aip, bip, bmac), (b, bname, bip, aip, amac)]
+    {
+        ns_ip(
+            ns,
+            &[
+                "-6",
+                "address",
+                "add",
+                &format!("{address}/64"),
+                "dev",
+                name,
+                "nodad",
+            ],
+        );
+        ns_ip(
+            ns,
+            &[
+                "-6",
+                "neigh",
+                "replace",
+                peer,
+                "lladdr",
+                &mac(peer_mac),
+                "nud",
+                "permanent",
+                "dev",
+                name,
+            ],
+        );
+    }
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_rejects_foreign_dnat_zone_local_diversion_and_ipv6() {
+    isolated();
+    for name in [SOURCE, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap();
+            std::fs::write("/proc/sys/net/ipv6/conf/all/forwarding", "1").unwrap();
+        });
+    }
+    connect(
+        SOURCE,
+        "source",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(SOURCE, &["route", "add", "default", "via", "10.240.0.1"]);
+    ns_ip(
+        HOST,
+        &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
+    );
+    ns_ip(
+        HOST,
+        &["route", "add", "10.250.0.2/32", "via", "192.0.2.3"],
+    );
+    for address in ["203.0.113.2/32", "10.250.0.2/32"] {
+        ns_ip(PEER, &["address", "add", address, "dev", "lo"]);
+    }
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    ipv6_pair(
+        SOURCE,
+        "source",
+        "fd00:240::2",
+        HOST,
+        "router",
+        "fd00:240::1",
+    );
+    ipv6_pair(
+        HOST,
+        "uplink",
+        "2001:db8:190::108",
+        PEER,
+        "underlay",
+        "2001:db8:190::3",
+    );
+    ns_ip(
+        SOURCE,
+        &["-6", "route", "add", "default", "via", "fd00:240::1"],
+    );
+    ns_ip(
+        PEER,
+        &["-6", "route", "add", "default", "via", "2001:db8:190::108"],
+    );
+    in_namespace(HOST, hostile_capture_fixture);
+    let public = socket(PEER, "203.0.113.2:42000");
+    let protected = socket(PEER, "10.250.0.2:42000");
+    let proxy = socket(HOST, "192.0.2.2:42000");
+    let source_original = socket(SOURCE, "10.240.0.2:10001");
+    let source_current = socket(SOURCE, "10.240.0.2:10002");
+    let source_zone = socket(SOURCE, "10.240.0.2:10003");
+    let source_proxy = socket(SOURCE, "10.240.0.2:10004");
+    let source_v6 = socket(SOURCE, "[fd00:240::2]:10000");
+    let target_v6 = socket(PEER, "[2001:db8:190::3]:42000");
+    for (source, destination, target) in [
+        (&source_original, "10.250.0.2:42000", &public),
+        (&source_current, "203.0.113.2:42000", &protected),
+        (&source_zone, "203.0.113.2:42000", &public),
+        (&source_proxy, "203.0.113.2:42000", &proxy),
+        (&source_v6, "[2001:db8:190::3]:42000", &target_v6),
+    ] {
+        control(source, destination, target, true);
+    }
+    let (owner, applied) = in_namespace(HOST, || {
+        let mut owner = Owner::new(options("host_isolation")).unwrap();
+        let target: Prepared = host_policy().prepare().unwrap().into();
+        target
+            .validate_interfaces()
+            .expect("host isolation fixture binding");
+        let result = owner.reconcile(Transition {
+            previous: None,
+            target: target.clone(),
+        });
+        if result.is_err() {
+            let graph = owner.graph().unwrap();
+            if let Some(graph) = graph {
+                println!(
+                    "host graph rules={} chains={} matches={:?} table={:?}",
+                    graph.rules.len(),
+                    graph.chains.len(),
+                    owner.matches(&graph, &target),
+                    graph.table
+                );
+            } else {
+                println!("host graph absent");
+            }
+        }
+        let applied = result.unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
+    for (source, destination, target) in [
+        (&source_original, "10.250.0.2:42000", &public),
+        (&source_current, "203.0.113.2:42000", &protected),
+        (&source_zone, "203.0.113.2:42000", &public),
+        (&source_proxy, "203.0.113.2:42000", &proxy),
+        (&source_v6, "[2001:db8:190::3]:42000", &target_v6),
+    ] {
+        control(source, destination, target, false);
+    }
+    let allowed = socket(SOURCE, "10.240.0.2:10000");
+    assert_eq!(
+        roundtrip(&allowed, &public).ip().to_string(),
+        "192.0.2.2"
+    );
+    let platform = socket(PEER, "192.0.2.3:5300");
+    roundtrip(&allowed, &platform);
+    let unleased = socket(SOURCE, "10.240.0.2:9999");
+    denied(&unleased, &public, false);
+    let local_proxy = socket(HOST, "10.240.0.1:43000");
+    denied(&allowed, &local_proxy, false);
+    denied(&local_proxy, &allowed, true);
+    in_namespace(HOST, move || {
+        let mut owner = owner;
+        assert!(owner.inspect().enforced);
+        owner.release(applied).unwrap();
+    });
+    println!("V2_HOST_PROOF original_protected_dnat_denied=true current_protected_dnat_denied=true nonzero_zone_denied=true input_diversion_denied=true output_spoof_denied=true ipv6_forward_denied=true unleased_port_denied=true exact_platform_allowed=true positive_controls=true");
+}

package/rust/src/owner_identity_tests.rs

@@ -0,0 +1,169 @@
+use super::rule_identity;
+use crate::wire::{self, Attr};
+
+fn expression(name: &str, data: Vec<Attr>) -> Attr {
+    Attr::nested(1, vec![Attr::string(1, name), Attr::nested(2, data)])
+}
+fn rule(expressions: Vec<Attr>) -> Vec<Attr> {
+    vec![
+        Attr::string(1, "snft_identity"),
+        Attr::string(2, "forward"),
+        Attr::nested(4, expressions),
+        Attr::bytes(7, b"exact-intent".to_vec()),
+    ]
+}
+fn range() -> Vec<Attr> {
+    vec![
+        Attr::u32(1, 1),
+        Attr::u32(2, 0),
+        Attr::nested(3, vec![Attr::bytes(1, 10000_u16.to_be_bytes().to_vec())]),
+        Attr::nested(4, vec![Attr::bytes(1, 10999_u16.to_be_bytes().to_vec())]),
+    ]
+}
+fn nat() -> Vec<Attr> {
+    vec![
+        Attr::u32(1, 0),
+        Attr::u32(2, 2),
+        Attr::u32(3, 1),
+        Attr::u32(4, 1),
+        Attr::u32(5, 2),
+        Attr::u32(6, 3),
+        Attr::u32(7, 3),
+    ]
+}
+
+#[test]
+fn egress_identity_preserves_ct_direction_registers_nat_ranges_and_expression_order() {
+    let expressions = vec![
+        expression(
+            "ct",
+            vec![Attr::u32(1, 1), Attr::u32(2, 9), Attr::bytes(3, vec![0])],
+        ),
+        expression("range", range()),
+        expression("nat", nat()),
+    ];
+    let expected = rule_identity(&rule(expressions.clone())).unwrap();
+    let reordered = rule(
+        expressions
+            .iter()
+            .map(|item| {
+                let mut fields = wire::attrs(&item.value).unwrap();
+                let mut data = wire::attrs(&fields[1].value).unwrap();
+                data.reverse();
+                fields[1] = Attr::nested(2, data);
+                expression(
+                    &wire::text(&fields, 1).unwrap(),
+                    wire::attrs(&fields[1].value).unwrap(),
+                )
+            })
+            .collect(),
+    );
+    assert_eq!(rule_identity(&reordered).unwrap(), expected);
+    let mut order = expressions.clone();
+    order.reverse();
+    assert_ne!(rule_identity(&rule(order)).unwrap(), expected);
+    for (index, changed) in [
+        (
+            0,
+            expression(
+                "ct",
+                vec![Attr::u32(1, 1), Attr::u32(2, 9), Attr::bytes(3, vec![1])],
+            ),
+        ),
+        (
+            0,
+            expression(
+                "ct",
+                vec![Attr::u32(1, 2), Attr::u32(2, 9), Attr::bytes(3, vec![0])],
+            ),
+        ),
+        (
+            2,
+            expression("nat", {
+                let mut value = nat();
+                value[5] = Attr::u32(6, 2);
+                value
+            }),
+        ),
+        (
+            2,
+            expression("nat", {
+                let mut value = nat();
+                value[6] = Attr::u32(7, 7);
+                value
+            }),
+        ),
+    ] {
+        let mut value = expressions.clone();
+        value[index] = changed;
+        assert_ne!(rule_identity(&rule(value)).unwrap(), expected);
+    }
+}
+
+#[test]
+fn range_identity_normalizes_nesting_flags_without_losing_inclusive_bounds() {
+    let original = rule_identity(&rule(vec![expression("range", range())])).unwrap();
+    let mut kernel = range();
+    kernel[2].kind &= 0x3fff;
+    kernel[3].kind &= 0x3fff;
+    assert_eq!(
+        rule_identity(&rule(vec![expression("range", kernel)])).unwrap(),
+        original
+    );
+    let mut changed = range();
+    changed[3] = Attr::nested(4, vec![Attr::bytes(1, 11000_u16.to_be_bytes().to_vec())]);
+    assert_ne!(
+        rule_identity(&rule(vec![expression("range", changed)])).unwrap(),
+        original
+    );
+}
+
+#[test]
+fn egress_identity_rejects_unknown_duplicate_or_incomplete_operands() {
+    for (name, value) in [
+        (
+            "ct",
+            vec![Attr::u32(1, 1), Attr::u32(2, 17), Attr::u32(4, 1)],
+        ),
+        ("ct", vec![Attr::u32(2, 17)]),
+        (
+            "ct",
+            vec![Attr::u32(1, 1), Attr::u32(2, 17), Attr::bytes(3, vec![2])],
+        ),
+        ("nat", {
+            let mut value = nat();
+            value.remove(3);
+            value
+        }),
+        ("nat", {
+            let mut value = nat();
+            value.remove(5);
+            value
+        }),
+        ("range", {
+            let mut value = range();
+            value[3] = Attr::nested(4, vec![Attr::bytes(1, vec![1])]);
+            value
+        }),
+        ("range", {
+            let mut value = range();
+            value[2] = Attr::nested(3, vec![Attr::bytes(2, vec![1, 2])]);
+            value
+        }),
+    ] {
+        assert!(rule_identity(&rule(vec![expression(name, value)])).is_err());
+    }
+    for (name, value) in [
+        ("ct", vec![Attr::u32(2, 13), Attr::u32(4, 1)]),
+        ("nat", nat()),
+        ("range", range()),
+    ] {
+        assert!(rule_identity(&rule(vec![expression(name, value.clone())])).is_ok());
+        let mut duplicate = value.clone();
+        duplicate.push(value[0].clone());
+        assert!(rule_identity(&rule(vec![expression(name, duplicate)])).is_err());
+        let mut extra = value;
+        extra.push(Attr::u32(99, 0));
+        assert!(rule_identity(&rule(vec![expression(name, extra)])).is_err());
+    }
+}

package/rust/src/owner_link_tests.rs

@@ -0,0 +1,119 @@
+use super::*;
+
+fn observed(name: &str) -> serde_json::Value {
+    let result = std::process::Command::new("/bin/ip")
+        .args(["-j", "-d", "link", "show", "dev", name])
+        .output()
+        .unwrap();
+    assert!(result.status.success());
+    serde_json::from_slice::<serde_json::Value>(&result.stdout).unwrap()[0].clone()
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn bound_veth_and_tun_reject_changed_local_facts() {
+    isolated();
+    let endpoint = endpoint("a", 1);
+    let link = observed("worka");
+    let index = link["ifindex"].as_u64().unwrap() as u32;
+    assert_eq!(index, endpoint.interface_index);
+    let peer = link["link_index"].as_u64().unwrap() as u32;
+    let mac = link["address"].as_str().unwrap();
+    let addresses = vec!["10.81.1.1".to_owned()];
+    let mut binding = wire::BoundInterface {
+        index,
+        name: "worka",
+        kind: "veth",
+        mac: Some(mac),
+        link_index: peer,
+        addresses: &addresses,
+    };
+    let check = |binding| wire::verify_bound_interfaces(std::iter::once(binding));
+    assert!(check(binding).is_ok());
+    binding.mac = Some("02:00:00:00:00:01");
+    assert!(check(binding).is_err());
+    binding.mac = Some(mac);
+    binding.link_index = peer + 100;
+    assert!(check(binding).is_err());
+    binding.link_index = peer;
+    binding.kind = "ethernet";
+    assert!(check(binding).is_err());
+    binding.kind = "veth";
+    binding.name = "changed";
+    assert!(check(binding).is_err());
+    binding.name = "worka";
+    binding.index = index + 100;
+    assert!(check(binding).is_err());
+    binding.index = index;
+    let missing = vec!["10.81.1.2".to_owned()];
+    binding.addresses = &missing;
+    assert!(check(binding).is_err());
+    binding.addresses = &addresses;
+    ip(&["address", "del", "10.81.1.1/24", "dev", "worka"]);
+    assert!(check(binding).is_err());
+    ip(&["address", "add", "10.81.1.1/24", "dev", "worka"]);
+    assert!(check(binding).is_ok());
+    ip(&["link", "add", "brguard", "type", "bridge"]);
+    ip(&["link", "set", "worka", "master", "brguard"]);
+    assert!(check(binding).is_err());
+    ip(&["link", "set", "worka", "nomaster"]);
+    assert!(check(binding).is_ok());
+
+    ip(&["tuntap", "add", "dev", "relaya", "mode", "tun"]);
+    ip(&["address", "add", "10.90.0.1/24", "dev", "relaya"]);
+    let tun = observed("relaya");
+    let index = tun["ifindex"].as_u64().unwrap() as u32;
+    let addresses = vec!["10.90.0.1".to_owned()];
+    let mut binding = wire::BoundInterface {
+        index,
+        name: "relaya",
+        kind: "tun",
+        mac: None,
+        link_index: index,
+        addresses: &addresses,
+    };
+    assert!(check(binding).is_ok());
+    binding.mac = Some("02:00:00:00:00:01");
+    assert!(check(binding).is_err());
+    ip(&["tuntap", "add", "dev", "badlayer", "mode", "tap"]);
+    let tap = observed("badlayer");
+    binding.index = tap["ifindex"].as_u64().unwrap() as u32;
+    binding.link_index = binding.index;
+    binding.name = "badlayer";
+    binding.mac = None;
+    binding.addresses = &[];
+    assert!(check(binding).is_err());
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn bound_virtio_ethernet_uplink_matches_driver_and_ipv4() {
+    // This test alone uses the initial *guest* namespace. Other tests unshare.
+    // The fixture has one singleton QEMU hubport and no host-facing backend.
+    guest_guard();
+    let link = observed("ens18");
+    assert_eq!(link["address"], "02:00:00:00:ee:01");
+    assert_eq!(link["ifindex"], 2);
+    assert!(link.get("linkinfo").is_none());
+    assert!(link.get("master").is_none());
+    let addresses = vec!["192.0.2.2".to_owned()];
+    let mut binding = wire::BoundInterface {
+        index: 2,
+        name: "ens18",
+        kind: "ethernet",
+        mac: Some("02:00:00:00:ee:01"),
+        link_index: 2,
+        addresses: &addresses,
+    };
+    let check = |binding| wire::verify_bound_interfaces(std::iter::once(binding));
+    assert!(check(binding).is_ok());
+    binding.kind = "veth";
+    assert!(check(binding).is_err());
+    binding.kind = "ethernet";
+    binding.link_index = 3;
+    assert!(check(binding).is_err());
+    binding.link_index = 2;
+    let wrong_addresses = vec!["198.51.100.85".to_owned()];
+    binding.addresses = &wrong_addresses;
+    assert!(check(binding).is_err());
+}