@push.rocks/smartnftables 1.4.0 → 1.6.0

package/rust/src/egress.compile.rs

@@ -0,0 +1,288 @@
+use super::*;
+use crate::policy::{compare, expr, ipv4, meta, verdict};
+use crate::wire::{self, Attr};
+
+#[path = "egress.host.rs"]
+mod host;
+#[path = "egress.router.rs"]
+mod router;
+
+pub(super) struct Program<'a> {
+    table: &'a str,
+    stamp: String,
+    ordinal: usize,
+    bytes: usize,
+    operations: Vec<(u16, Vec<Attr>)>,
+}
+impl<'a> Program<'a> {
+    fn push(&mut self, operation: u16, attributes: Vec<Attr>) -> Result<()> {
+        self.bytes += wire::encode_attrs(&attributes).len() + 20;
+        // Same atomic replacement reserve as v1: a previous bounded graph must
+        // fit its handle-only deletions beside the complete target in 240 KiB.
+        require(self.bytes <= 100_000 && self.operations.len() < 768)?;
+        self.operations.push((operation, attributes));
+        Ok(())
+    }
+    fn chain(&mut self, name: &str, base: Option<(u32, i32, &str)>) -> Result<()> {
+        let mut data = vec![Attr::string(1, self.table), Attr::string(3, name)];
+        if let Some((hook, priority, kind)) = base {
+            data.extend([
+                Attr::nested(4, vec![Attr::u32(1, hook), Attr::u32(2, priority as u32)]),
+                Attr::u32(5, 1),
+                Attr::string(7, kind),
+                Attr::u32(10, 1),
+            ]);
+        }
+        self.push(3, data)
+    }
+    fn rule(&mut self, chain: &str, expressions: Vec<Attr>) -> Result<()> {
+        let stamp = format!("{}:{}", self.stamp, self.ordinal);
+        self.ordinal += 1;
+        self.push(
+            6,
+            vec![
+                Attr::string(1, self.table),
+                Attr::string(2, chain),
+                Attr::nested(4, expressions),
+                Attr::bytes(7, stamp.into_bytes()),
+            ],
+        )
+    }
+    fn end(&mut self, chain: &str, mut expressions: Vec<Attr>, code: i32) -> Result<()> {
+        expressions.push(verdict(code, None));
+        self.rule(chain, expressions)
+    }
+    fn jump(&mut self, chain: &str, mut expressions: Vec<Attr>, target: &str) -> Result<()> {
+        expressions.push(verdict(-3, Some(target)));
+        self.rule(chain, expressions)
+    }
+    fn deny_link(&mut self, chain: &str, link: &LocalLink, incoming: bool) -> Result<()> {
+        // Keep denial when either a name or an index changes independently.
+        self.end(
+            chain,
+            meta(
+                if incoming { 4 } else { 5 },
+                link.interface_index.to_ne_bytes().to_vec(),
+            ),
+            0,
+        )?;
+        self.end(
+            chain,
+            meta(
+                if incoming { 6 } else { 7 },
+                [link.interface_name.as_bytes(), &[0]].concat(),
+            ),
+            0,
+        )
+    }
+}
+
+fn link(value: &LocalLink, incoming: bool) -> Vec<Attr> {
+    let mut result = meta(
+        if incoming { 4 } else { 5 },
+        value.interface_index.to_ne_bytes().to_vec(),
+    );
+    result.extend(meta(
+        if incoming { 6 } else { 7 },
+        [value.interface_name.as_bytes(), &[0]].concat(),
+    ));
+    result
+}
+fn load_payload(base: u32, offset: u32, length: u32) -> Attr {
+    expr(
+        "payload",
+        vec![
+            Attr::u32(1, 1),
+            Attr::u32(2, base),
+            Attr::u32(3, offset),
+            Attr::u32(4, length),
+        ],
+    )
+}
+fn masked(mask: Vec<u8>, expected: Vec<u8>) -> Vec<Attr> {
+    vec![
+        expr(
+            "bitwise",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, 1),
+                Attr::u32(3, mask.len() as u32),
+                Attr::nested(4, vec![Attr::bytes(1, mask.clone())]),
+                Attr::nested(5, vec![Attr::bytes(1, vec![0; mask.len()])]),
+                Attr::u32(6, 0),
+            ],
+        ),
+        compare(expected),
+    ]
+}
+fn current_address(prefix: &str, source: bool) -> Result<Vec<Attr>> {
+    let (address, mask) = super::prefix(prefix)?;
+    let mut result = vec![load_payload(1, if source { 12 } else { 16 }, 4)];
+    result.extend(masked(
+        mask.to_be_bytes().to_vec(),
+        address.to_be_bytes().to_vec(),
+    ));
+    Ok(result)
+}
+fn current_port(port: u16, source: bool) -> Vec<Attr> {
+    vec![
+        load_payload(2, if source { 0 } else { 2 }, 2),
+        compare(port.to_be_bytes().to_vec()),
+    ]
+}
+fn load_ct(key: u32, direction: Option<u8>) -> Attr {
+    let mut data = vec![Attr::u32(1, 1), Attr::u32(2, key)];
+    if let Some(direction) = direction {
+        data.push(Attr::bytes(3, vec![direction]));
+    }
+    expr("ct", data)
+}
+fn ct(key: u32, direction: Option<u8>, value: Vec<u8>) -> Vec<Attr> {
+    vec![load_ct(key, direction), compare(value)]
+}
+fn original_address(prefix: &str, source: bool) -> Result<Vec<Attr>> {
+    let (address, mask) = super::prefix(prefix)?;
+    let mut result = vec![load_ct(if source { 19 } else { 20 }, Some(0))];
+    result.extend(masked(
+        mask.to_be_bytes().to_vec(),
+        address.to_be_bytes().to_vec(),
+    ));
+    Ok(result)
+}
+fn original_port(port: u16, source: bool) -> Vec<Attr> {
+    ct(
+        if source { 11 } else { 12 },
+        Some(0),
+        port.to_be_bytes().to_vec(),
+    )
+}
+fn protocol(value: &str) -> u8 {
+    if value == "tcp" {
+        6
+    } else {
+        17
+    }
+}
+fn ports(first: u16, last: u16) -> Attr {
+    expr(
+        "range",
+        vec![
+            Attr::u32(1, 1),
+            Attr::u32(2, 0),
+            Attr::nested(3, vec![Attr::bytes(1, first.to_be_bytes().to_vec())]),
+            Attr::nested(4, vec![Attr::bytes(1, last.to_be_bytes().to_vec())]),
+        ],
+    )
+}
+fn current_range(first: u16, last: u16, source: bool) -> Vec<Attr> {
+    vec![
+        load_payload(2, if source { 0 } else { 2 }, 2),
+        ports(first, last),
+    ]
+}
+fn original_range(first: u16, last: u16) -> Vec<Attr> {
+    vec![load_ct(11, Some(0)), ports(first, last)]
+}
+fn immediate(register: u32, value: Vec<u8>) -> Attr {
+    expr(
+        "immediate",
+        vec![
+            Attr::u32(1, register),
+            Attr::nested(2, vec![Attr::bytes(1, value)]),
+        ],
+    )
+}
+fn set_ct(key: u32, value: Vec<u8>) -> Vec<Attr> {
+    vec![
+        immediate(1, value),
+        expr("ct", vec![Attr::u32(2, key), Attr::u32(4, 1)]),
+    ]
+}
+fn label(generation: &Generation) -> Vec<u8> {
+    // A label is an opaque canonical 16-byte value, never a host-endian integer.
+    generation
+        .conntrack_label
+        .as_bytes()
+        .chunks_exact(2)
+        .map(|pair| u8::from_str_radix(std::str::from_utf8(pair).unwrap(), 16).unwrap())
+        .collect()
+}
+fn generation(generation: &Generation, direction: u8, labelled: bool) -> Vec<Attr> {
+    let mut result = ct(17, None, generation.conntrack_zone.to_ne_bytes().to_vec());
+    result.extend(ct(1, None, vec![direction]));
+    if labelled {
+        result.extend(ct(13, None, label(generation)));
+    }
+    result
+}
+fn state(value: u32) -> Vec<Attr> {
+    ct(0, None, value.to_ne_bytes().to_vec())
+}
+fn opening_tcp() -> Vec<Attr> {
+    let mut result = vec![load_payload(2, 13, 1)];
+    // SYN set; FIN, RST, ACK clear. ECN negotiation flags remain permitted.
+    result.extend(masked(vec![0x17], vec![0x02]));
+    result
+}
+fn snat(address: &str, range: Option<(u16, u16)>) -> Result<Vec<Attr>> {
+    let mut result = vec![immediate(
+        1,
+        super::address(address)?.to_be_bytes().to_vec(),
+    )];
+    let mut data = vec![
+        Attr::u32(1, 0),
+        Attr::u32(2, 2),
+        Attr::u32(3, 1),
+        Attr::u32(4, 1),
+    ];
+    if let Some((first, last)) = range {
+        result.extend([
+            immediate(2, first.to_be_bytes().to_vec()),
+            immediate(3, last.to_be_bytes().to_vec()),
+        ]);
+        data.extend([Attr::u32(5, 2), Attr::u32(6, 3)]);
+    }
+    data.push(Attr::u32(7, if range.is_some() { 3 } else { 1 }));
+    result.push(expr("nat", data));
+    Ok(result)
+}
+fn tuple(grant: &Grant, protection: &Protection, reply: bool, original: bool) -> Result<Vec<Attr>> {
+    let destination = super::destination(grant, protection)?;
+    let mut result = ipv4();
+    result.extend(meta(16, vec![protocol(&grant.protocol)]));
+    result.extend(current_address(&grant.source_prefix, !reply)?);
+    result.extend(current_address(&destination, reply)?);
+    for (port, source) in [(grant.source_port, !reply), (grant.destination_port, reply)] {
+        if let Some(port) = port {
+            result.extend(current_port(port, source));
+        }
+    }
+    if original {
+        result.extend(original_address(&grant.source_prefix, true)?);
+        result.extend(original_address(&destination, false)?);
+        result.extend(ct(10, None, vec![protocol(&grant.protocol)]));
+        for (port, source) in [(grant.source_port, true), (grant.destination_port, false)] {
+            if let Some(port) = port {
+                result.extend(original_port(port, source));
+            }
+        }
+    }
+    Ok(result)
+}
+
+pub(super) fn compile(prepared: &Prepared, table: &str) -> Result<Vec<(u16, Vec<Attr>)>> {
+    let mut program = Program {
+        table,
+        stamp: format!("snft2:{}:{}", prepared.policy.revision, prepared.digest),
+        ordinal: 0,
+        bytes: 0,
+        operations: Vec::new(),
+    };
+    match &prepared.policy.scope {
+        Scope::RouterEgress(scope) => {
+            router::compile(&mut program, scope, prepared.policy.revision)?
+        }
+        Scope::HostTransit(scope) => host::compile(&mut program, scope)?,
+    }
+    Ok(program.operations)
+}

package/rust/src/egress.host.rs

@@ -0,0 +1,103 @@
+use super::*;
+
+fn protection(program: &mut Program<'_>, scope: &HostScope, reply: bool) -> Result<()> {
+    let chain = if reply {
+        "protected_back"
+    } else {
+        "protected_out"
+    };
+    for endpoint in &scope.protection.platform_endpoints {
+        let mut expressions = ipv4();
+        expressions.extend(meta(16, vec![protocol(&endpoint.protocol)]));
+        expressions.extend(ct(10, None, vec![protocol(&endpoint.protocol)]));
+        let prefix = format!("{}/32", endpoint.address);
+        expressions.extend(current_address(&prefix, reply)?);
+        expressions.extend(current_port(endpoint.port, reply));
+        expressions.extend(original_address(&prefix, false)?);
+        expressions.extend(original_port(endpoint.port, false));
+        program.end(chain, expressions, -5)?;
+    }
+    for prefix in &scope.protection.prefixes {
+        for original in [false, true] {
+            let mut expressions = ipv4();
+            expressions.extend(if original {
+                original_address(prefix, false)?
+            } else {
+                current_address(prefix, reply)?
+            });
+            program.end(chain, expressions, 0)?;
+        }
+    }
+    program.end(chain, vec![], -5)
+}
+fn envelope(
+    scope: &HostScope,
+    handoff: &HostHandoff,
+    allocation: &Allocation,
+    range: &PortRange,
+    reply: bool,
+) -> Result<Vec<Attr>> {
+    let mut expressions = ipv4();
+    expressions.extend(link(&handoff.link, !reply));
+    expressions.extend(link(&scope.uplink, reply));
+    expressions.extend(meta(16, vec![protocol(&range.protocol)]));
+    expressions.extend(ct(10, None, vec![protocol(&range.protocol)]));
+    expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+    expressions.extend(ct(1, None, vec![u8::from(reply)]));
+    let prefix = format!("{}/32", allocation.transit_source_address);
+    expressions.extend(current_address(&prefix, !reply)?);
+    expressions.extend(current_range(range.first, range.last, !reply));
+    expressions.extend(original_address(&prefix, true)?);
+    expressions.extend(original_range(range.first, range.last));
+    Ok(expressions)
+}
+pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
+    // Filtering runs after destination NAT. Docker has independent filter hooks.
+    // This table cannot override another owner's DROP; Docker contribution and
+    // the rest of the host path are independently verified by the caller.
+    for (name, hook, priority, kind) in [
+        ("input", 1, 0, "filter"),
+        ("forward", 2, 0, "filter"),
+        ("output", 3, 0, "filter"),
+        ("post", 4, 100, "nat"),
+    ] {
+        program.chain(name, Some((hook, priority, kind)))?;
+    }
+    for name in ["protected_out", "protected_back"] {
+        program.chain(name, None)?;
+    }
+    protection(program, scope, false)?;
+    protection(program, scope, true)?;
+    for handoff in &scope.handoffs {
+        program.jump("forward", link(&handoff.link, true), "protected_out")?;
+        program.jump("forward", link(&handoff.link, false), "protected_back")?;
+    }
+    for handoff in &scope.handoffs {
+        for allocation in &handoff.allocations {
+            for range in &allocation.source_port_ranges {
+                let original = envelope(scope, handoff, allocation, range, false)?;
+                for connection_state in [2, 8] {
+                    let mut expressions = original.clone();
+                    expressions.extend(state(connection_state));
+                    if connection_state == 8 && range.protocol == "tcp" {
+                        expressions.extend(opening_tcp());
+                    }
+                    program.end("forward", expressions, 1)?;
+                }
+                let mut reply = envelope(scope, handoff, allocation, range, true)?;
+                reply.extend(state(2));
+                program.end("forward", reply, 1)?;
+                let mut nat = original;
+                nat.extend(snat(&scope.snat_address, None)?);
+                program.rule("post", nat)?;
+            }
+        }
+    }
+    for handoff in &scope.handoffs {
+        program.deny_link("input", &handoff.link, true)?;
+        program.deny_link("output", &handoff.link, false)?;
+        program.deny_link("forward", &handoff.link, true)?;
+        program.deny_link("forward", &handoff.link, false)?;
+    }
+    Ok(())
+}

package/rust/src/egress.router.rs

@@ -0,0 +1,231 @@
+use super::*;
+
+fn endpoint<'a>(scope: &'a RouterScope, grant: &Grant) -> Option<&'a LocalLink> {
+    grant.source_endpoint.as_ref().and_then(|id| {
+        let endpoint = scope.endpoints.iter().find(|item| &item.id == id)?;
+        scope
+            .links
+            .iter()
+            .find(|item| item.interface_index == endpoint.interface_index)
+    })
+}
+fn raw_original(scope: &RouterScope, grant: &Grant) -> Result<Vec<Attr>> {
+    let mut result = tuple(grant, &scope.protection, false, false)?;
+    result.extend(match endpoint(scope, grant) {
+        Some(endpoint) => link(endpoint, true),
+        None => link(&scope.handoff, false),
+    });
+    Ok(result)
+}
+fn filter(scope: &RouterScope, grant: &Grant, reply: bool) -> Result<Vec<Attr>> {
+    let mut result = tuple(grant, &scope.protection, reply, true)?;
+    result.extend(link(&scope.handoff, reply));
+    if let Some(endpoint) = endpoint(scope, grant) {
+        result.extend(link(endpoint, !reply));
+    }
+    Ok(result)
+}
+fn raw_return(scope: &RouterScope, grant: &Grant, generation: &Generation) -> Result<Vec<Attr>> {
+    let mut result = ipv4();
+    result.extend(link(&scope.handoff, true));
+    result.extend(meta(16, vec![protocol(&grant.protocol)]));
+    result.extend(current_address(
+        &super::super::destination(grant, &scope.protection)?,
+        true,
+    )?);
+    result.extend(current_address(
+        &format!("{}/32", generation.transit_source_address),
+        false,
+    )?);
+    if let Some(port) = grant.destination_port {
+        result.extend(current_port(port, true));
+    }
+    result.extend(current_range(
+        grant.source_port_range.first,
+        grant.source_port_range.last,
+        false,
+    ));
+    Ok(result)
+}
+fn protected(
+    program: &mut Program<'_>,
+    chain: &str,
+    scope: &RouterScope,
+    reply: bool,
+) -> Result<()> {
+    for prefix in &scope.protection.prefixes {
+        for original in [false, true] {
+            let mut expressions = ipv4();
+            expressions.extend(if original {
+                original_address(prefix, false)?
+            } else {
+                current_address(prefix, reply)?
+            });
+            program.end(chain, expressions, 0)?;
+        }
+    }
+    program.end(chain, vec![], -5)
+}
+fn raw(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    // Handoff ingress must classify only exact leased return envelopes. Unknown
+    // ingress never reaches private/default-zone rules, even after a rename.
+    program.jump("raw_in", link(&scope.handoff, true), "raw_return")?;
+    program.deny_link("raw_in", &scope.handoff, true)?;
+    for platform in [true, false] {
+        if !platform {
+            for prefix in &scope.protection.prefixes {
+                for chain in ["raw_in", "raw_out"] {
+                    let mut expressions = ipv4();
+                    expressions.extend(current_address(prefix, false)?);
+                    program.end(chain, expressions, -5)?;
+                }
+                let mut expressions = ipv4();
+                expressions.extend(current_address(prefix, true)?);
+                program.end("raw_return", expressions, 0)?;
+            }
+        }
+        for generation in &scope.generations {
+            for grant in &generation.grants {
+                if matches!(grant.destination, Destination::Platform { .. }) != platform {
+                    continue;
+                }
+                let mut original = raw_original(scope, grant)?;
+                original.extend(set_ct(17, generation.conntrack_zone.to_ne_bytes().to_vec()));
+                program.end(
+                    if grant.source_endpoint.is_some() {
+                        "raw_in"
+                    } else {
+                        "raw_out"
+                    },
+                    original,
+                    1,
+                )?;
+                let mut reply = raw_return(scope, grant, generation)?;
+                reply.extend(set_ct(17, generation.conntrack_zone.to_ne_bytes().to_vec()));
+                program.end("raw_return", reply, 1)?;
+            }
+        }
+    }
+    program.end("raw_return", vec![], 0)
+}
+fn grants(
+    program: &mut Program<'_>,
+    scope: &RouterScope,
+    chain: &str,
+    platform: bool,
+) -> Result<()> {
+    for allocation in &scope.generations {
+        for grant in &allocation.grants {
+            if matches!(grant.destination, Destination::Platform { .. }) != platform {
+                continue;
+            }
+            let local = grant.source_endpoint.is_none();
+            if chain == "forward" && local || chain != "forward" && !local {
+                continue;
+            }
+            if chain != "input" {
+                let mut original = filter(scope, grant, false)?;
+                original.extend(generation(allocation, 0, false));
+                // Both original directions are checked for every packet; a
+                // label alone never authorizes a changed grant or endpoint.
+                for connection_state in [2, 8] {
+                    let mut labelled = original.clone();
+                    labelled.extend(ct(13, None, label(allocation)));
+                    labelled.extend(state(connection_state));
+                    if connection_state == 8 && grant.protocol == "tcp" {
+                        labelled.extend(opening_tcp());
+                    }
+                    program.end(chain, labelled, 1)?;
+                }
+                original.extend(state(8));
+                original.extend(ct(13, None, vec![0; 16]));
+                if grant.protocol == "tcp" {
+                    original.extend(opening_tcp());
+                }
+                original.extend(set_ct(13, label(allocation)));
+                program.end(chain, original, 1)?;
+            }
+            if chain != "output" {
+                let mut reply = filter(scope, grant, true)?;
+                reply.extend(generation(allocation, 1, true));
+                reply.extend(state(2));
+                program.end(chain, reply, 1)?;
+            }
+        }
+    }
+    Ok(())
+}
+pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision: u64) -> Result<()> {
+    for (name, hook, priority, kind) in [
+        ("raw_in", 0, -300, "filter"),
+        ("raw_out", 3, -300, "filter"),
+        ("input", 1, -150, "filter"),
+        ("forward", 2, -150, "filter"),
+        ("output", 3, -150, "filter"),
+        ("post", 4, 100, "nat"),
+    ] {
+        program.chain(name, Some((hook, priority, kind)))?;
+    }
+    for name in ["raw_return", "protected_out", "protected_back"] {
+        program.chain(name, None)?;
+    }
+    let private = policy::Policy {
+        schema_version: 1,
+        revision,
+        endpoints: scope.endpoints.clone(),
+        rules: scope.rules.clone(),
+    }
+    .prepare()?;
+    for (name, rules) in private.guard_chains()? {
+        program.chain(&name, None)?;
+        for expressions in rules {
+            program.rule(&name, expressions)?;
+        }
+    }
+    raw(program, scope)?;
+    protected(program, "protected_out", scope, false)?;
+    protected(program, "protected_back", scope, true)?;
+    for chain in ["input", "forward", "output"] {
+        let parts = private.filter_rules(chain)?;
+        for expressions in parts.guards.into_iter().chain(parts.grants) {
+            program.rule(chain, expressions)?;
+        }
+        grants(program, scope, chain, true)?;
+        for incoming in [true, false] {
+            if chain == "input" && !incoming || chain == "output" && incoming {
+                continue;
+            }
+            program.jump(
+                chain,
+                link(&scope.handoff, incoming),
+                if incoming {
+                    "protected_back"
+                } else {
+                    "protected_out"
+                },
+            )?;
+        }
+        grants(program, scope, chain, false)?;
+        for expressions in parts.denials {
+            program.rule(chain, expressions)?;
+        }
+        for incoming in [true, false] {
+            if chain == "input" && !incoming || chain == "output" && incoming {
+                continue;
+            }
+            program.deny_link(chain, &scope.handoff, incoming)?;
+        }
+    }
+    for allocation in &scope.generations {
+        for grant in &allocation.grants {
+            let mut expressions = filter(scope, grant, false)?;
+            expressions.extend(generation(allocation, 0, true));
+            expressions.extend(snat(
+                &allocation.transit_source_address,
+                Some((grant.source_port_range.first, grant.source_port_range.last)),
+            )?);
+            program.rule("post", expressions)?;
+        }
+    }
+    Ok(())
+}