@push.rocks/smartnftables 1.4.0 → 1.6.0

package/rust/src/owner_packet_fixture.rs

@@ -0,0 +1,200 @@
+//! Guest-only Ethernet observation/injection for packet-path qualifications.
+use super::*;
+use std::os::fd::{AsRawFd, FromRawFd, OwnedFd};
+use std::time::{Duration, Instant};
+
+pub(super) struct PacketSocket {
+    fd: OwnedFd,
+    index: i32,
+}
+impl PacketSocket {
+    pub(super) fn open(name: &str) -> Self {
+        guest_guard();
+        let name = std::ffi::CString::new(name).unwrap();
+        let index = unsafe { libc::if_nametoindex(name.as_ptr()) } as i32;
+        assert!(index > 0);
+        let raw = unsafe {
+            libc::socket(
+                libc::AF_PACKET,
+                libc::SOCK_DGRAM | libc::SOCK_CLOEXEC,
+                i32::from((libc::ETH_P_IP as u16).to_be()),
+            )
+        };
+        assert!(
+            raw >= 0,
+            "packet socket: {}",
+            std::io::Error::last_os_error()
+        );
+        let fd = unsafe { OwnedFd::from_raw_fd(raw) };
+        let mut address: libc::sockaddr_ll = unsafe { std::mem::zeroed() };
+        address.sll_family = libc::AF_PACKET as u16;
+        address.sll_protocol = (libc::ETH_P_IP as u16).to_be();
+        address.sll_ifindex = index;
+        assert_eq!(
+            unsafe {
+                libc::bind(
+                    raw,
+                    (&address as *const libc::sockaddr_ll).cast(),
+                    std::mem::size_of_val(&address) as _,
+                )
+            },
+            0
+        );
+        Self { fd, index }
+    }
+    pub(super) fn send(&self, mac: [u8; 6], packet: &[u8]) {
+        let mut address: libc::sockaddr_ll = unsafe { std::mem::zeroed() };
+        address.sll_family = libc::AF_PACKET as u16;
+        address.sll_protocol = (libc::ETH_P_IP as u16).to_be();
+        address.sll_ifindex = self.index;
+        address.sll_halen = 6;
+        address.sll_addr[..6].copy_from_slice(&mac);
+        assert_eq!(
+            unsafe {
+                libc::sendto(
+                    self.fd.as_raw_fd(),
+                    packet.as_ptr().cast(),
+                    packet.len(),
+                    0,
+                    (&address as *const libc::sockaddr_ll).cast(),
+                    std::mem::size_of_val(&address) as _,
+                )
+            },
+            packet.len() as isize
+        );
+    }
+    pub(super) fn matching(&self, mut matches: impl FnMut(&[u8]) -> bool) -> Option<Vec<u8>> {
+        let deadline = Instant::now() + Duration::from_millis(500);
+        loop {
+            let remaining = deadline
+                .saturating_duration_since(Instant::now())
+                .as_millis();
+            if remaining == 0 {
+                return None;
+            }
+            let mut poll = libc::pollfd {
+                fd: self.fd.as_raw_fd(),
+                events: libc::POLLIN,
+                revents: 0,
+            };
+            let ready = unsafe { libc::poll(&mut poll, 1, remaining as i32) };
+            assert!(ready >= 0);
+            if ready == 0 {
+                return None;
+            }
+            let mut packet = vec![0; 65536];
+            let size = unsafe {
+                libc::recv(
+                    self.fd.as_raw_fd(),
+                    packet.as_mut_ptr().cast(),
+                    packet.len(),
+                    libc::MSG_TRUNC,
+                )
+            };
+            assert!(size >= 0 && (size as usize) <= packet.len());
+            packet.truncate(size as usize);
+            if matches(&packet) {
+                return Some(packet);
+            }
+        }
+    }
+}
+pub(super) fn mac(name: &str) -> [u8; 6] {
+    let output = std::process::Command::new("/bin/ip")
+        .args(["-j", "link", "show", "dev", name])
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let value = serde_json::from_slice::<serde_json::Value>(&output.stdout).unwrap();
+    value[0]["address"]
+        .as_str()
+        .unwrap()
+        .split(':')
+        .map(|byte| u8::from_str_radix(byte, 16).unwrap())
+        .collect::<Vec<_>>()
+        .try_into()
+        .unwrap()
+}
+fn checksum(bytes: &[u8]) -> u16 {
+    let mut sum: u32 = bytes
+        .chunks(2)
+        .map(|bytes| u32::from(bytes[0]) * 256 + u32::from(*bytes.get(1).unwrap_or(&0)))
+        .sum();
+    while sum >> 16 != 0 {
+        sum = (sum & 0xffff) + (sum >> 16);
+    }
+    !(sum as u16)
+}
+pub(super) fn tcp(
+    source: [u8; 4],
+    destination: [u8; 4],
+    source_port: u16,
+    destination_port: u16,
+    flags: u8,
+) -> Vec<u8> {
+    let mut packet = vec![0; 40];
+    packet[0] = 0x45;
+    packet[2..4].copy_from_slice(&40_u16.to_be_bytes());
+    packet[8] = 64;
+    packet[9] = 6;
+    packet[12..16].copy_from_slice(&source);
+    packet[16..20].copy_from_slice(&destination);
+    let sum = checksum(&packet[..20]);
+    packet[10..12].copy_from_slice(&sum.to_be_bytes());
+    packet[20..22].copy_from_slice(&source_port.to_be_bytes());
+    packet[22..24].copy_from_slice(&destination_port.to_be_bytes());
+    packet[24..28].copy_from_slice(&100_u32.to_be_bytes());
+    packet[32] = 0x50;
+    packet[33] = flags;
+    packet[34..36].copy_from_slice(&65535_u16.to_be_bytes());
+    let mut pseudo = Vec::new();
+    pseudo.extend(source);
+    pseudo.extend(destination);
+    pseudo.extend([0, 6, 0, 20]);
+    pseudo.extend(&packet[20..]);
+    let sum = checksum(&pseudo);
+    packet[36..38].copy_from_slice(&sum.to_be_bytes());
+    packet
+}
+
+pub(super) fn udp(
+    source: [u8; 4],
+    destination: [u8; 4],
+    source_port: u16,
+    destination_port: u16,
+) -> Vec<u8> {
+    let mut packet = vec![0; 32];
+    packet[0] = 0x45;
+    packet[2..4].copy_from_slice(&32_u16.to_be_bytes());
+    packet[8] = 64;
+    packet[9] = 17;
+    packet[12..16].copy_from_slice(&source);
+    packet[16..20].copy_from_slice(&destination);
+    let sum = checksum(&packet[..20]);
+    packet[10..12].copy_from_slice(&sum.to_be_bytes());
+    packet[20..22].copy_from_slice(&source_port.to_be_bytes());
+    packet[22..24].copy_from_slice(&destination_port.to_be_bytes());
+    packet[24..26].copy_from_slice(&12_u16.to_be_bytes());
+    packet[28..].copy_from_slice(b"frag");
+    packet
+}
+pub(super) fn fragments(packet: &[u8], id: u16) -> [Vec<u8>; 2] {
+    assert_eq!(packet.len(), 32);
+    assert_eq!(packet[0], 0x45);
+    let fragment = |body: &[u8], offset: u16| {
+        let mut result = packet[..20].to_vec();
+        result.extend(body);
+        let length = result.len() as u16;
+        result[2..4].copy_from_slice(&length.to_be_bytes());
+        result[4..6].copy_from_slice(&id.to_be_bytes());
+        result[6..8].copy_from_slice(&offset.to_be_bytes());
+        result[10..12].fill(0);
+        let sum = checksum(&result[..20]);
+        result[10..12].copy_from_slice(&sum.to_be_bytes());
+        result
+    };
+    [
+        fragment(&packet[20..28], 0x2000),
+        fragment(&packet[28..], 1),
+    ]
+}

package/rust/src/owner_tests.rs

@@ -3,7 +3,28 @@ use super::*;
 #[path = "owner_namespace_tests.rs"]
 mod namespace_tests;
 
-fn isolated() {
+#[path = "owner_egress_identity_tests.rs"]
+mod egress_identity_tests;
+
+#[path = "owner_link_tests.rs"]
+mod link_tests;
+
+#[path = "owner_egress_tests.rs"]
+mod egress_tests;
+
+#[path = "owner_egress_traffic_tests.rs"]
+mod egress_traffic_tests;
+
+#[path = "owner_packet_fixture.rs"]
+mod packet_fixture;
+
+#[path = "owner_host_traffic_tests.rs"]
+mod host_traffic_tests;
+
+#[path = "owner_coexistence_tests.rs"]
+mod coexistence_tests;
+
+fn guest_guard() {
     assert_eq!(
         std::env::var("SMARTNFTABLES_ISOLATED_NATIVE").as_deref(),
         Ok("qemu-6.18.35")
@@ -12,6 +33,10 @@ fn isolated() {
         .unwrap()
         .contains("smartnftables_qualification=1"));
     assert_eq!(unsafe { libc::geteuid() }, 0);
+}
+
+fn isolated() {
+    guest_guard();
     let initial = context().unwrap();
     assert_eq!(
         unsafe { libc::unshare(libc::CLONE_NEWNET | libc::CLONE_NEWNS) },
@@ -279,7 +304,7 @@ fn native_interface_ipv4_directed_grants_and_spoof_denial() {
     assert_eq!(
         owner.reconcile(Transition {
             previous: None,
-            target: invalid_pair.prepare().unwrap()
+            target: invalid_pair.prepare().unwrap().into()
         }),
         Err(Error::Conflict)
     );
@@ -289,7 +314,7 @@ fn native_interface_ipv4_directed_grants_and_spoof_denial() {
     assert_eq!(
         owner.reconcile(Transition {
             previous: None,
-            target: policy.clone().prepare().unwrap()
+            target: policy.clone().prepare().unwrap().into()
         }),
         Err(Error::Conflict)
     );
@@ -298,7 +323,7 @@ fn native_interface_ipv4_directed_grants_and_spoof_denial() {
     let current = owner
         .reconcile(Transition {
             previous: None,
-            target: policy.clone().prepare().unwrap(),
+            target: policy.clone().prepare().unwrap().into(),
         })
         .expect("apply interface policy");
     assert!(owner.inspect().enforced);
@@ -336,7 +361,7 @@ fn native_interface_ipv4_directed_grants_and_spoof_denial() {
     let revoked = owner
         .reconcile(Transition {
             previous: Some(current),
-            target: denied.prepare().unwrap(),
+            target: denied.prepare().unwrap().into(),
         })
         .expect("atomic complete deny");
     udp(&client, &server, false);
@@ -364,6 +389,7 @@ fn empty(revision: u64) -> Prepared {
     }
     .prepare()
     .unwrap()
+    .into()
 }
 
 #[test]
@@ -699,14 +725,14 @@ fn native_tun_forwarding_binds_remote_ingress_and_rejects_tap() {
     assert_eq!(
         owner.reconcile(Transition {
             previous: None,
-            target: invalid.prepare().unwrap()
+            target: invalid.prepare().unwrap().into()
         }),
         Err(Error::Conflict)
     );
     let applied = owner
         .reconcile(Transition {
             previous: None,
-            target: policy.prepare().unwrap(),
+            target: policy.prepare().unwrap().into(),
         })
         .unwrap();
     send_tunnel(&mut device, true);

package/rust/src/policy.rs

@@ -210,10 +210,10 @@ impl Policy {
     }
 }
 
-fn expr(name: &str, data: Vec<Attr>) -> Attr {
+pub(crate) fn expr(name: &str, data: Vec<Attr>) -> Attr {
     Attr::nested(1, vec![Attr::string(1, name), Attr::nested(2, data)])
 }
-fn compare(value: Vec<u8>) -> Attr {
+pub(crate) fn compare(value: Vec<u8>) -> Attr {
     expr(
         "cmp",
         vec![
@@ -223,7 +223,7 @@ fn compare(value: Vec<u8>) -> Attr {
         ],
     )
 }
-fn meta(key: u32, value: Vec<u8>) -> Vec<Attr> {
+pub(crate) fn meta(key: u32, value: Vec<u8>) -> Vec<Attr> {
     vec![
         expr("meta", vec![Attr::u32(1, 1), Attr::u32(2, key)]),
         compare(value),
@@ -239,7 +239,7 @@ fn interface(endpoint: &Endpoint, incoming: bool) -> Vec<Attr> {
     result.extend(meta(if incoming { 6 } else { 7 }, name));
     result
 }
-fn ipv4() -> Vec<Attr> {
+pub(crate) fn ipv4() -> Vec<Attr> {
     meta(15, vec![libc::NFPROTO_IPV4 as u8])
 }
 fn address(cidr: &str, source: bool) -> Result<Vec<Attr>> {
@@ -268,7 +268,7 @@ fn address(cidr: &str, source: bool) -> Result<Vec<Attr>> {
         compare(address.to_be_bytes().to_vec()),
     ])
 }
-fn verdict(code: i32, chain: Option<&str>) -> Attr {
+pub(crate) fn verdict(code: i32, chain: Option<&str>) -> Attr {
     let mut data = vec![Attr::u32(1, code as u32)];
     if let Some(chain) = chain {
         data.push(Attr::string(2, chain));
@@ -329,99 +329,138 @@ impl Prepared {
                 ],
             ));
         }
+        for (name, expressions) in self.guard_chains()? {
+            program.push((3, vec![Attr::string(1, table), Attr::string(3, &name)]));
+            for expressions in expressions {
+                rule(&name, expressions, &mut program);
+            }
+        }
+        for chain in ["input", "forward", "output"] {
+            let parts = self.filter_rules(chain)?;
+            for expressions in parts
+                .guards
+                .into_iter()
+                .chain(parts.grants)
+                .chain(parts.denials)
+            {
+                rule(chain, expressions, &mut program);
+            }
+        }
+        Ok(program)
+    }
+}
+
+/// Reused inside a combined router graph; order remains part of schema-v1's bytes.
+pub(crate) struct PrivateRules {
+    pub guards: Vec<Vec<Attr>>,
+    pub grants: Vec<Vec<Attr>>,
+    pub denials: Vec<Vec<Attr>>,
+}
+impl Prepared {
+    pub(crate) fn guard_chains(&self) -> Result<Vec<(String, Vec<Vec<Attr>>)>> {
+        let mut result = Vec::new();
         for (index, endpoint) in self.policy.endpoints.iter().enumerate() {
             for incoming in [true, false] {
                 let name = format!("guard_{index}_{}", if incoming { "in" } else { "out" });
-                program.push((3, vec![Attr::string(1, table), Attr::string(3, &name)]));
+                let mut rules = Vec::new();
                 for cidr in &endpoint.source_prefixes {
                     let mut expressions = ipv4();
                     expressions.extend(address(cidr, incoming)?);
                     expressions.push(verdict(-5, None));
-                    rule(&name, expressions, &mut program);
+                    rules.push(expressions);
                 }
-                rule(&name, vec![verdict(0, None)], &mut program);
+                rules.push(vec![verdict(0, None)]);
+                result.push((name, rules));
             }
         }
-        for chain in ["input", "forward", "output"] {
-            for (index, endpoint) in self.policy.endpoints.iter().enumerate() {
-                for incoming in [true, false] {
-                    if (chain == "input" && !incoming) || (chain == "output" && incoming) {
-                        continue;
-                    }
-                    let name = format!("guard_{index}_{}", if incoming { "in" } else { "out" });
-                    let mut expressions = interface(endpoint, incoming);
-                    expressions.push(verdict(-3, Some(&name)));
-                    rule(chain, expressions, &mut program);
-                }
-            }
-            for grant in &self.policy.rules {
-                if chain == "input" && grant.destination_endpoint.is_some()
-                    || chain == "output" && grant.source_endpoint.is_some()
-                    || chain == "forward"
-                        && (grant.source_endpoint.is_none() || grant.destination_endpoint.is_none())
-                {
+        Ok(result)
+    }
+    pub(crate) fn filter_rules(&self, chain: &str) -> Result<PrivateRules> {
+        if !["input", "forward", "output"].contains(&chain) {
+            return Err(Error::Invalid);
+        }
+        let mut result = PrivateRules {
+            guards: Vec::new(),
+            grants: Vec::new(),
+            denials: Vec::new(),
+        };
+        for (index, endpoint) in self.policy.endpoints.iter().enumerate() {
+            for incoming in [true, false] {
+                if (chain == "input" && !incoming) || (chain == "output" && incoming) {
                     continue;
                 }
-                let mut expressions = ipv4();
-                for (id, incoming) in [
-                    (&grant.source_endpoint, true),
-                    (&grant.destination_endpoint, false),
-                ] {
-                    if let Some(id) = id {
-                        let endpoint = self
-                            .policy
-                            .endpoints
-                            .iter()
-                            .find(|ep| &ep.id == id)
-                            .ok_or(Error::Invalid)?;
-                        expressions.extend(interface(endpoint, incoming));
-                    }
-                }
-                expressions.extend(address(&grant.source_prefix, true)?);
-                expressions.extend(address(&grant.destination_prefix, false)?);
-                if grant.protocol != "any" {
-                    expressions
-                        .extend(meta(16, vec![if grant.protocol == "tcp" { 6 } else { 17 }]));
+                let name = format!("guard_{index}_{}", if incoming { "in" } else { "out" });
+                let mut expressions = interface(endpoint, incoming);
+                expressions.push(verdict(-3, Some(&name)));
+                result.guards.push(expressions);
+            }
+        }
+        for grant in &self.policy.rules {
+            if chain == "input" && grant.destination_endpoint.is_some()
+                || chain == "output" && grant.source_endpoint.is_some()
+                || chain == "forward"
+                    && (grant.source_endpoint.is_none() || grant.destination_endpoint.is_none())
+            {
+                continue;
+            }
+            let mut expressions = ipv4();
+            for (id, incoming) in [
+                (&grant.source_endpoint, true),
+                (&grant.destination_endpoint, false),
+            ] {
+                if let Some(id) = id {
+                    let endpoint = self
+                        .policy
+                        .endpoints
+                        .iter()
+                        .find(|ep| &ep.id == id)
+                        .ok_or(Error::Invalid)?;
+                    expressions.extend(interface(endpoint, incoming));
                 }
-                for (port, offset) in [(grant.source_port, 0), (grant.destination_port, 2)] {
-                    if let Some(port) = port {
-                        expressions.push(expr(
-                            "payload",
-                            vec![
-                                Attr::u32(1, 1),
-                                Attr::u32(2, 2),
-                                Attr::u32(3, offset),
-                                Attr::u32(4, 2),
-                            ],
-                        ));
-                        expressions.push(compare(port.to_be_bytes().to_vec()));
-                    }
+            }
+            expressions.extend(address(&grant.source_prefix, true)?);
+            expressions.extend(address(&grant.destination_prefix, false)?);
+            if grant.protocol != "any" {
+                expressions.extend(meta(16, vec![if grant.protocol == "tcp" { 6 } else { 17 }]));
+            }
+            for (port, offset) in [(grant.source_port, 0), (grant.destination_port, 2)] {
+                if let Some(port) = port {
+                    expressions.push(expr(
+                        "payload",
+                        vec![
+                            Attr::u32(1, 1),
+                            Attr::u32(2, 2),
+                            Attr::u32(3, offset),
+                            Attr::u32(4, 2),
+                        ],
+                    ));
+                    expressions.push(compare(port.to_be_bytes().to_vec()));
                 }
-                expressions.push(verdict(1, None));
-                rule(chain, expressions, &mut program);
             }
-            for endpoint in &self.policy.endpoints {
-                for incoming in [true, false] {
-                    if (chain == "input" && !incoming) || (chain == "output" && incoming) {
-                        continue;
-                    }
-                    // Either selector matching is enough to retain denial after rename/reuse.
-                    for mut expressions in [
-                        meta(
-                            if incoming { 4 } else { 5 },
-                            endpoint.interface_index.to_ne_bytes().to_vec(),
-                        ),
-                        meta(
-                            if incoming { 6 } else { 7 },
-                            [endpoint.interface_name.as_bytes(), &[0]].concat(),
-                        ),
-                    ] {
-                        expressions.push(verdict(0, None));
-                        rule(chain, expressions, &mut program);
-                    }
+            expressions.push(verdict(1, None));
+            result.grants.push(expressions);
+        }
+        for endpoint in &self.policy.endpoints {
+            for incoming in [true, false] {
+                if (chain == "input" && !incoming) || (chain == "output" && incoming) {
+                    continue;
+                }
+                // Either selector matching is enough to retain denial after rename/reuse.
+                for mut expressions in [
+                    meta(
+                        if incoming { 4 } else { 5 },
+                        endpoint.interface_index.to_ne_bytes().to_vec(),
+                    ),
+                    meta(
+                        if incoming { 6 } else { 7 },
+                        [endpoint.interface_name.as_bytes(), &[0]].concat(),
+                    ),
+                ] {
+                    expressions.push(verdict(0, None));
+                    result.denials.push(expressions);
                 }
             }
         }
-        Ok(program)
+        Ok(result)
     }
 }

package/rust/src/tests.rs

@@ -1,9 +1,31 @@
 use crate::{decode, policy::Policy, wire, Error};
+use sha2::{Digest, Sha256};
 
 fn policy() -> Policy {
     serde_json::from_str(r#"{"schemaVersion":1,"revision":1,"endpoints":[{"id":"a","interfaceIndex":2,"interfaceName":"worka","interfaceKind":"veth","sourcePrefixes":["10.81.0.2/32"]},{"id":"b","interfaceIndex":3,"interfaceName":"workb","interfaceKind":"veth","sourcePrefixes":["10.81.0.3/32"]}],"rules":[{"sourceEndpoint":"a","destinationEndpoint":"b","sourcePrefix":"10.81.0.2/32","destinationPrefix":"10.81.0.3/32","protocol":"udp","sourcePort":null,"destinationPort":53}]}"#).unwrap()
 }
 
+#[test]
+fn v1_policy_and_program_bytes_remain_frozen() {
+    let prepared = policy().prepare().unwrap();
+    let mut bytes = Vec::new();
+    for (kind, attributes) in prepared.program("snft_v1_golden").unwrap() {
+        let encoded = wire::encode_attrs(&attributes);
+        bytes.extend(kind.to_be_bytes());
+        bytes.extend((encoded.len() as u32).to_be_bytes());
+        bytes.extend(encoded);
+    }
+    assert_eq!(
+        prepared.digest,
+        "sha256:13897f4e711db2111618c61eb3f0be00714ed79f2075bf7f75e16f93f26ce2db"
+    );
+    assert_eq!(bytes.len(), 11020);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(bytes)),
+        "e57215884bca4bc8e0d7bef4c975cc3a1cc9e9233e44c248502a9efd99fa5c34"
+    );
+}
+
 #[test]
 fn canonical_policy_rejects_ambiguous_or_unbound_grants() {
     let prepared = policy().prepare().unwrap();