@push.rocks/smartnftables 1.4.0 → 1.6.0

package/rust/src/egress_tests.rs

@@ -0,0 +1,332 @@
+use super::{Policy, Scope};
+use serde_json::{json, Value};
+
+fn link(index: u32, name: &str, kind: &str, address: &str) -> Value {
+    json!({"interfaceIndex":index,"interfaceName":name,"interfaceKind":kind,
+        "macAddress":if kind == "tun" { Value::Null } else { json!(format!("02:00:00:00:00:{index:02x}")) },
+        "interfaceLinkIndex":index+100,"requiredIpv4Addresses":[address]})
+}
+fn allocation() -> Value {
+    json!({"lease":{"id":"lease-a","generation":1,"digest":format!("sha256:{}","a".repeat(64))},
+        "transitSourceAddress":"10.240.0.2",
+        "sourcePortRanges":[{"protocol":"tcp","first":10000,"last":10999},{"protocol":"udp","first":10000,"last":10999}]})
+}
+fn protection() -> Value {
+    json!({"authorityDigest":format!("sha256:{}","b".repeat(64)),
+        "prefixes":["10.0.0.0/8","192.0.2.0/24","203.0.113.10/32"],
+        "platformEndpoints":[{"id":"dns","address":"192.0.2.1","protocol":"udp","port":53},
+            {"id":"relay","address":"203.0.113.10","protocol":"tcp","port":443}]})
+}
+pub(crate) fn router() -> Value {
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(1);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    generation["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"0.0.0.0/0"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":443,"sourcePortRange":{"first":10000,"last":10999}},
+        {"sourceEndpoint":null,"sourcePrefix":"10.240.0.2/32","destination":{"kind":"platform","endpointId":"dns"},
+            "protocol":"udp","sourcePort":null,"destinationPort":53,"sourcePortRange":{"first":10000,"last":10999}},
+        {"sourceEndpoint":null,"sourcePrefix":"10.240.0.2/32","destination":{"kind":"platform","endpointId":"relay"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":443,"sourcePortRange":{"first":10000,"last":10999}}
+    ]);
+    json!({"schemaVersion":2,"revision":1,"scope":{"kind":"routerEgress",
+        "endpoints":[
+            {"id":"work","interfaceIndex":2,"interfaceName":"work","interfaceKind":"veth","sourcePrefixes":["10.241.0.2/32"]},
+            {"id":"vpn","interfaceIndex":3,"interfaceName":"vpn","interfaceKind":"tun","sourcePrefixes":["10.242.0.0/24"]}],
+        "rules":[
+            {"sourceEndpoint":"work","destinationEndpoint":"vpn","sourcePrefix":"10.241.0.2/32","destinationPrefix":"10.242.0.2/32","protocol":"udp","sourcePort":null,"destinationPort":53},
+            {"sourceEndpoint":"work","destinationEndpoint":null,"sourcePrefix":"10.241.0.2/32","destinationPrefix":"10.241.0.1/32","protocol":"udp","sourcePort":null,"destinationPort":53},
+            {"sourceEndpoint":null,"destinationEndpoint":"work","sourcePrefix":"10.241.0.1/32","destinationPrefix":"10.241.0.2/32","protocol":"udp","sourcePort":53,"destinationPort":null}],
+        "links":[link(2,"work","veth","10.241.0.1"),link(3,"vpn","tun","10.242.0.1")],
+        "handoff":link(4,"handoff","veth","10.240.0.2"),"protection":protection(),"generations":[generation]}})
+}
+pub(crate) fn host() -> Value {
+    json!({"schemaVersion":2,"revision":1,"scope":{"kind":"hostTransit","protection":protection(),
+        "handoffs":[{"link":link(4,"handoff","veth","10.240.0.1"),"allocations":[allocation()]}],
+        "uplink":link(2,"ens18","ethernet","192.0.2.2"),"snatAddress":"192.0.2.2"}})
+}
+fn normalized(value: Value) -> super::Result<Policy> {
+    serde_json::from_value::<Policy>(value)
+        .map_err(|_| crate::Error::Invalid)?
+        .normalize()
+}
+fn changed(mut value: Value, path: &str, replacement: Value) -> Value {
+    *value.pointer_mut(path).unwrap() = replacement;
+    value
+}
+
+#[test]
+fn combined_router_preserves_private_tun_dns_and_explicit_local_egress() {
+    let expected = normalized(router()).unwrap();
+    let mut reordered = router();
+    for path in [
+        "/scope/endpoints",
+        "/scope/rules",
+        "/scope/links",
+        "/scope/protection/prefixes",
+        "/scope/protection/platformEndpoints",
+        "/scope/generations/0/sourcePortRanges",
+        "/scope/generations/0/grants",
+    ] {
+        reordered
+            .pointer_mut(path)
+            .unwrap()
+            .as_array_mut()
+            .unwrap()
+            .reverse();
+    }
+    assert_eq!(normalized(reordered).unwrap(), expected);
+    let denied = normalized(changed(router(), "/scope/generations", json!([]))).unwrap();
+    let Scope::RouterEgress(denied) = denied.scope else {
+        panic!()
+    };
+    assert_eq!(denied.endpoints.len(), 2);
+    assert_eq!(denied.rules.len(), 3);
+    assert!(denied.generations.is_empty());
+    assert!(normalized(host()).is_ok());
+}
+
+#[test]
+fn v2_rejects_unknown_fields_missing_nulls_and_wrong_scope_shapes() {
+    let mut unknown = router();
+    unknown["commands"] = json!([]);
+    let mut no_null = router();
+    no_null["scope"]["generations"][0]["grants"][0]
+        .as_object_mut()
+        .unwrap()
+        .remove("sourcePort");
+    let mut mixed = host();
+    mixed["scope"]["generations"] = json!([]);
+    for invalid in [
+        unknown,
+        no_null,
+        mixed,
+        changed(router(), "/schemaVersion", json!(1)),
+        changed(router(), "/revision", json!(0)),
+        changed(router(), "/revision", json!(9007199254740992_u64)),
+        changed(router(), "/scope/kind", json!("egress")),
+    ] {
+        assert!(normalized(invalid).is_err());
+    }
+    let duplicate = serde_json::to_string(&router()).unwrap().replace(
+        "\"schemaVersion\":2",
+        "\"schemaVersion\":2,\"schemaVersion\":2",
+    );
+    assert!(serde_json::from_str::<Policy>(&duplicate).is_err());
+}
+
+#[test]
+fn v2_binds_exact_local_links_addresses_and_complete_protection() {
+    for (path, replacement) in [
+        ("/scope/handoff/interfaceKind", json!("ethernet")),
+        ("/scope/handoff/interfaceIndex", json!(2)),
+        ("/scope/handoff/macAddress", json!("03:00:00:00:00:04")),
+        ("/scope/handoff/macAddress", json!("00:00:00:00:00:00")),
+        ("/scope/handoff/interfaceLinkIndex", json!(0)),
+        ("/scope/links/0/interfaceName", json!("foreign")),
+        ("/scope/links/1/macAddress", json!("02:00:00:00:00:03")),
+        (
+            "/scope/links/0/requiredIpv4Addresses",
+            json!(["10.241.0.1", "10.241.0.1"]),
+        ),
+        ("/scope/protection/prefixes", json!(["10.0.0.0/8"])),
+        (
+            "/scope/protection/prefixes",
+            json!([
+                "10.0.0.0/8",
+                "10.240.0.0/16",
+                "192.0.2.0/24",
+                "203.0.113.10/32"
+            ]),
+        ),
+        (
+            "/scope/protection/platformEndpoints/0/address",
+            json!("10.241.0.1"),
+        ),
+        (
+            "/scope/protection/platformEndpoints/0/address",
+            json!("10.241.0.2"),
+        ),
+        ("/scope/protection/authorityDigest", json!("sha256:bad")),
+    ] {
+        assert!(
+            normalized(changed(router(), path, replacement)).is_err(),
+            "{path}"
+        );
+    }
+    for (path, replacement) in [
+        ("/scope/snatAddress", json!("192.0.2.4")),
+        ("/scope/uplink/interfaceKind", json!("tun")),
+        (
+            "/scope/handoffs/0/allocations/0/transitSourceAddress",
+            json!("10.240.0.1"),
+        ),
+        (
+            "/scope/protection/platformEndpoints/0/address",
+            json!("192.0.2.2"),
+        ),
+    ] {
+        assert!(
+            normalized(changed(host(), path, replacement)).is_err(),
+            "{path}"
+        );
+    }
+}
+
+#[test]
+fn v2_rejects_unleased_ports_unbound_sources_and_ambiguous_platform_grants() {
+    for (path, replacement) in [
+        ("/scope/generations/0/lease/generation", json!(0)),
+        ("/scope/generations/0/conntrackZone", json!(0)),
+        ("/scope/generations/0/conntrackZone", json!(65536)),
+        ("/scope/generations/0/conntrackLabel", json!("0".repeat(32))),
+        (
+            "/scope/generations/0/transitSourceAddress",
+            json!("10.240.0.3"),
+        ),
+        ("/scope/generations/0/sourcePortRanges/0/first", json!(0)),
+        ("/scope/generations/0/sourcePortRanges/0/last", json!(9999)),
+        (
+            "/scope/generations/0/grants/0/sourcePortRange/last",
+            json!(11000),
+        ),
+        ("/scope/generations/0/grants/0/sourceEndpoint", json!("vpn")),
+        (
+            "/scope/generations/0/grants/0/sourcePrefix",
+            json!("10.241.0.0/24"),
+        ),
+        ("/scope/generations/0/grants/0/sourcePort", json!(0)),
+        (
+            "/scope/generations/0/grants/0/destination/prefix",
+            json!("10.242.0.0/24"),
+        ),
+        (
+            "/scope/generations/0/grants/1/sourcePrefix",
+            json!("10.240.0.0/24"),
+        ),
+        ("/scope/generations/0/grants/1/destinationPort", Value::Null),
+        ("/scope/generations/0/grants/1/protocol", json!("tcp")),
+    ] {
+        assert!(
+            normalized(changed(router(), path, replacement)).is_err(),
+            "{path}"
+        );
+    }
+}
+
+#[test]
+fn v2_classification_and_return_ranges_are_disjoint_between_active_generations() {
+    let mut value = router();
+    value["scope"]["generations"][0]["grants"]
+        .as_array_mut()
+        .unwrap()
+        .truncate(1);
+    let mut next = value["scope"]["generations"][0].clone();
+    next["lease"]["id"] = json!("lease-b");
+    next["conntrackZone"] = json!(2);
+    next["conntrackLabel"] = json!("b".repeat(32));
+    next["sourcePortRanges"] = json!([{"protocol":"tcp","first":11000,"last":11999}]);
+    next["grants"][0]["sourcePortRange"] = json!({"first":11000,"last":11999});
+    value["scope"]["generations"]
+        .as_array_mut()
+        .unwrap()
+        .push(next);
+    assert!(normalized(value.clone()).is_err());
+    value["scope"]["generations"][0]["grants"][0]["sourcePort"] = json!(1000);
+    value["scope"]["generations"][1]["grants"][0]["sourcePort"] = json!(2000);
+    assert!(normalized(value.clone()).is_ok());
+    for (path, replacement) in [
+        ("/scope/generations/1/conntrackZone", json!(1)),
+        ("/scope/generations/1/conntrackLabel", json!("a".repeat(32))),
+        ("/scope/generations/1/lease/id", json!("lease-a")),
+    ] {
+        assert!(normalized(changed(value.clone(), path, replacement)).is_err());
+    }
+    value["scope"]["generations"][1]["sourcePortRanges"][0] =
+        json!({"protocol":"tcp","first":10500,"last":11500});
+    value["scope"]["generations"][1]["grants"][0]["sourcePortRange"] =
+        json!({"first":10500,"last":11500});
+    assert!(normalized(value).is_err());
+}
+
+#[test]
+fn host_never_assigns_the_same_transit_source_to_different_active_handoff_links() {
+    let mut value = host();
+    let mut other = value["scope"]["handoffs"][0].clone();
+    other["link"] = link(5, "handoff-b", "veth", "10.240.0.5");
+    other["allocations"][0]["lease"]["id"] = json!("lease-b");
+    other["allocations"][0]["sourcePortRanges"] =
+        json!([{"protocol":"udp","first":12000,"last":12999}]);
+    value["scope"]["handoffs"]
+        .as_array_mut()
+        .unwrap()
+        .push(other);
+    assert!(normalized(value.clone()).is_err());
+    value["scope"]["handoffs"][1]["allocations"][0]["transitSourceAddress"] = json!("10.240.0.6");
+    assert!(normalized(value).is_ok());
+}
+
+#[test]
+fn prepared_v2_compiles_both_scopes_with_bounded_and_identifiable_graphs() {
+    for fixture in [router(), host()] {
+        let prepared = serde_json::from_value::<Policy>(fixture)
+            .unwrap()
+            .prepare()
+            .unwrap();
+        prepared.validate().unwrap();
+        let program = prepared.program("snft_v2_fixture").unwrap();
+        assert!(program.len() <= 768);
+        assert!(
+            program
+                .iter()
+                .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+                .sum::<usize>()
+                <= 100_000
+        );
+        assert!(program.iter().all(|(kind, _)| [3, 6].contains(kind)));
+        let mut changed = prepared.clone();
+        changed.policy.revision += 1;
+        assert!(changed.validate().is_err());
+        assert_ne!(changed.policy.prepare().unwrap().digest, prepared.digest);
+        println!("V2_GRAPH operations={}", program.len());
+    }
+}
+
+#[test]
+fn v2_compiled_graph_limit_rejects_bounded_but_excessive_cross_products() {
+    let mut value = router();
+    let mut grants = Vec::new();
+    for port in 1000..1032 {
+        let mut grant = value["scope"]["generations"][0]["grants"][0].clone();
+        grant["destinationPort"] = json!(port);
+        grants.push(grant);
+    }
+    value["scope"]["generations"][0]["grants"] = json!(grants);
+    let policy = normalized(value).unwrap();
+    assert!(policy.prepare().is_err());
+}
+
+#[test]
+fn managed_union_keeps_strict_duplicate_and_unknown_field_rejection() {
+    for value in [router(), host()] {
+        let text = serde_json::to_string(&value).unwrap();
+        assert!(serde_json::from_str::<crate::managed::Policy>(&text).is_ok());
+        for invalid in [
+            text.replace(
+                "\"schemaVersion\":2",
+                "\"schemaVersion\":2,\"schemaVersion\":2",
+            ),
+            text.replace("\"revision\":1", "\"revision\":1,\"revision\":2"),
+            text.replace(
+                "\"interfaceIndex\":2",
+                "\"interfaceIndex\":2,\"interfaceIndex\":2",
+            ),
+        ] {
+            assert!(serde_json::from_str::<crate::managed::Policy>(&invalid).is_err());
+        }
+    }
+    assert!(serde_json::from_str::<crate::managed::Policy>(
+        r#"{"schemaVersion":1,"schemaVersion":1,"revision":1,"endpoints":[],"rules":[]}"#
+    )
+    .is_err());
+}

package/rust/src/main.rs

@@ -1,3 +1,6 @@
+mod egress;
+mod docker;
+mod managed;
 mod namespace;
 mod owner;
 mod policy;
@@ -12,6 +15,7 @@ use std::io::{BufRead, Read, Write};
 pub enum Error {
     Invalid,
     Unsupported,
+    UnsupportedBackend,
     Permission,
     ForeignOwner,
     Conflict,
@@ -25,6 +29,7 @@ impl Error {
         match self {
             Self::Invalid => "INVALID",
             Self::Unsupported => "UNSUPPORTED_KERNEL",
+            Self::UnsupportedBackend => "UNSUPPORTED_BACKEND",
             Self::Permission => "PERMISSION",
             Self::ForeignOwner => "FOREIGN_OWNER",
             Self::Conflict => "CONFLICT",
@@ -59,7 +64,7 @@ fn encode(value: impl serde::Serialize) -> Result<serde_json::Value> {
 }
 fn dispatch(owner: &mut Option<owner::Owner>, request: Request) -> Result<serde_json::Value> {
     match request.method.as_str() {
-        "preparePolicy" => encode(decode::<policy::Policy>(request.params)?.prepare()?),
+        "preparePolicy" => encode(decode::<managed::Policy>(request.params)?.prepare()?),
         "openOwner" => {
             if owner.is_some() {
                 return Err(Error::Conflict);
@@ -99,13 +104,14 @@ fn dispatch(owner: &mut Option<owner::Owner>, request: Request) -> Result<serde_
 
 fn main() {
     let arguments = std::env::args().skip(1).collect::<Vec<_>>();
-    let descriptor = match arguments.as_slice() {
-        [management] if management == "--management" => None,
+    let (docker_mode, descriptor) = match arguments.as_slice() {
+        [management] if management == "--management" => (false, None),
+        [management] if management == "--docker-forwarding" => (true, None),
         [management, option, fd]
-            if management == "--management" && option == "--network-namespace-fd" =>
+            if (management == "--management" || management == "--docker-forwarding") && option == "--network-namespace-fd" =>
         {
             match fd.parse::<i32>() {
-                Ok(value) => Some(value),
+                Ok(value) => (management == "--docker-forwarding", Some(value)),
                 Err(_) => std::process::exit(2),
             }
         }
@@ -123,6 +129,7 @@ fn main() {
     output.flush().unwrap();
     let mut input = std::io::stdin().lock();
     let mut owner = None;
+    let mut docker = None;
     loop {
         let mut bytes = Vec::new();
         let read = std::io::Read::by_ref(&mut input)
@@ -142,7 +149,7 @@ fn main() {
             std::process::exit(2);
         }
         let id = request.id.clone();
-        let response = match dispatch(&mut owner, request) {
+        let response = match if docker_mode { docker::dispatch(&mut docker, request) } else { dispatch(&mut owner, request) } {
             Ok(result) => serde_json::json!({"id":id,"success":true,"result":result}),
             Err(error) => {
                 serde_json::json!({"id":id,"success":false,"error":"Managed policy operation failed.","errorCode":error.code()})

package/rust/src/managed.rs

@@ -0,0 +1,105 @@
+use crate::{egress, policy, wire, Result};
+use serde::{Deserialize, Serialize};
+
+/// The v1 object remains byte-for-byte unchanged inside this input union.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(untagged)]
+pub enum Policy {
+    Private(policy::Policy),
+    Egress(egress::Policy),
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Prepared {
+    pub policy: Policy,
+    pub digest: String,
+}
+
+impl Policy {
+    pub fn revision(&self) -> u64 {
+        match self {
+            Self::Private(value) => value.revision,
+            Self::Egress(value) => value.revision,
+        }
+    }
+    pub fn kind(&self) -> &'static str {
+        match self {
+            Self::Private(_) => "privateV1",
+            Self::Egress(egress::Policy {
+                scope: egress::Scope::RouterEgress(_),
+                ..
+            }) => "routerEgressV2",
+            Self::Egress(egress::Policy {
+                scope: egress::Scope::HostTransit(_),
+                ..
+            }) => "hostTransitV2",
+        }
+    }
+    pub fn prepare(self) -> Result<Prepared> {
+        match self {
+            Self::Private(value) => Ok(value.prepare()?.into()),
+            Self::Egress(value) => Ok(value.prepare()?.into()),
+        }
+    }
+}
+impl From<policy::Prepared> for Prepared {
+    fn from(value: policy::Prepared) -> Self {
+        Self {
+            policy: Policy::Private(value.policy),
+            digest: value.digest,
+        }
+    }
+}
+impl From<egress::Prepared> for Prepared {
+    fn from(value: egress::Prepared) -> Self {
+        Self {
+            policy: Policy::Egress(value.policy),
+            digest: value.digest,
+        }
+    }
+}
+impl Prepared {
+    pub fn validate(&self) -> Result<()> {
+        match &self.policy {
+            Policy::Private(policy) => policy::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .validate(),
+            Policy::Egress(policy) => egress::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .validate(),
+        }
+    }
+    pub fn program(&self, table: &str) -> Result<Vec<(u16, Vec<wire::Attr>)>> {
+        match &self.policy {
+            Policy::Private(policy) => policy::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .program(table),
+            Policy::Egress(policy) => egress::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .program(table),
+        }
+    }
+    pub fn validate_interfaces(&self) -> Result<()> {
+        match &self.policy {
+            Policy::Private(policy) => policy::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .validate_interfaces(),
+            Policy::Egress(policy) => egress::Prepared {
+                policy: policy.clone(),
+                digest: self.digest.clone(),
+            }
+            .validate_interfaces(),
+        }
+    }
+}