@push.rocks/smartnftables 1.4.0 → 1.6.0

package/rust/src/owner.rs

@@ -1,4 +1,5 @@
-use crate::policy::{identifier, Prepared};
+use crate::managed::Prepared;
+use crate::policy::identifier;
 use crate::wire::{self, Attr, Socket};
 use crate::{Error, Result};
 use serde::{Deserialize, Serialize};
@@ -69,7 +70,7 @@ pub struct Owner {
     released: bool,
 }
 
-fn context() -> Result<(String, String, String)> {
+pub(crate) fn context() -> Result<(String, String, String)> {
     let boot = std::fs::read_to_string("/proc/sys/kernel/random/boot_id")
         .map_err(|_| Error::Unavailable)?
         .trim()
@@ -111,6 +112,24 @@ fn kernel_floor() -> Result<()> {
 }
 
 impl Owner {
+    /// Read another dedicated owner's exact receipt without claiming its table.
+    /// PERSIST may retain enforcement after that owner's socket closes.
+    pub(crate) fn verify_external(expected: &Applied) -> Result<()> {
+        let identity = &expected.receipt.identity;
+        let mut reader = Self::new(Options {
+            owner_id: identity.owner_id.clone(),
+            instance_id: identity.instance_id.clone(),
+            table_name: identity.table_name.clone(),
+        })?;
+        reader.validate_receipt(expected)?;
+        let graph = reader.graph()?.ok_or(Error::Conflict)?;
+        reader.binding(&graph, Some(expected))?;
+        if !reader.matches(&graph, &expected.prepared)? {
+            return Err(Error::Conflict);
+        }
+        expected.prepared.validate_interfaces()
+    }
+
     pub fn new(options: Options) -> Result<Self> {
         if !identifier(&options.owner_id)
             || !identifier(&options.instance_id)
@@ -171,7 +190,15 @@ impl Owner {
                 Err(error) => return Err(error),
                 _ => return Err(Error::Protocol),
             };
-            let chains = socket.query(4, vec![Attr::string(1, &table_name)], true)?;
+            // Linux's NFT_MSG_GETCHAIN dump is family-wide: it ignores
+            // NFTA_CHAIN_TABLE. Select exact table identity before examining
+            // chain contents; another owner's chains are not our graph.
+            let mut chains = Vec::new();
+            for chain in socket.query(4, vec![Attr::string(1, &table_name)], true)? {
+                if wire::text(&chain, 1)? == table_name {
+                    chains.push(chain);
+                }
+            }
             let rules = socket.query(7, vec![Attr::string(1, &table_name)], true)?;
             // The managed compiler never creates any of these. Foreign objects reject.
             for operation in [10, 19, 23] {
@@ -222,7 +249,7 @@ impl Owner {
         if handle == 0
             || handle.to_string() != expected.receipt.table_handle
             || expected.receipt.identity != self.identity
-            || expected.receipt.revision != expected.prepared.policy.revision
+            || expected.receipt.revision != expected.prepared.policy.revision()
             || expected.receipt.digest != expected.prepared.digest
         {
             return Err(Error::Conflict);
@@ -316,7 +343,7 @@ impl Owner {
             receipt: Receipt {
                 identity: self.identity.clone(),
                 table_handle: wire::handle(&graph.table, 4)?.to_string(),
-                revision: prepared.policy.revision,
+                revision: prepared.policy.revision(),
                 digest: prepared.digest.clone(),
             },
             prepared,
@@ -334,7 +361,9 @@ impl Owner {
         }
         if let Some(previous) = &transition.previous {
             self.validate_receipt(previous)?;
-            if transition.target.policy.revision <= previous.prepared.policy.revision {
+            if transition.target.policy.kind() != previous.prepared.policy.kind()
+                || transition.target.policy.revision() <= previous.prepared.policy.revision()
+            {
                 return Err(Error::Conflict);
             }
         }
@@ -568,11 +597,13 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
         }
         let name = wire::text(&fields, 1)?;
         let mut data = wire::attrs(&wire::one(&fields, 2)?.value)?;
+        validate_egress_expression(&name, &data)?;
         let nested: &[u16] = match name.as_str() {
             "immediate" => &[2],
             "cmp" => &[3],
             "bitwise" => &[4, 5],
-            "meta" | "payload" => &[],
+            "range" => &[3, 4],
+            "meta" | "payload" | "ct" | "nat" => &[],
             _ => return Err(Error::Conflict),
         };
         for attribute in &mut data {
@@ -599,6 +630,83 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
     Ok((chain, encoded))
 }
 
+/// These expressions are compiler-owned. Preserve all operands in graph identity;
+/// neither unknown fields nor default repair may hide a changed kernel rule.
+fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
+    let allowed: &[u16] = match name {
+        "ct" | "range" => &[1, 2, 3, 4],
+        "nat" => &[1, 2, 3, 4, 5, 6, 7],
+        _ => return Ok(()),
+    };
+    for attribute in data {
+        if !allowed.contains(&attribute.id()) {
+            return Err(Error::Conflict);
+        }
+        wire::one(data, attribute.id())?; // Duplicate fields are never canonical identity.
+    }
+    match name {
+        "ct" => {
+            let read = data.iter().any(|item| item.id() == 1);
+            let write = data.iter().any(|item| item.id() == 4);
+            if read == write {
+                return Err(Error::Conflict);
+            }
+            wire::number(data, if read { 1 } else { 4 })?;
+            wire::number(data, 2)?;
+            if data.iter().any(|item| item.id() == 3)
+                && ![vec![0], vec![1]].contains(&wire::one(data, 3)?.value)
+            {
+                return Err(Error::Conflict);
+            }
+        }
+        "nat" => {
+            // Emit min/max registers and derived flags explicitly, just as Linux
+            // dumps them. This surface only compiles address-bearing IPv4 NAT.
+            for id in [1, 2, 3, 4, 7] {
+                wire::number(data, id)?;
+            }
+            if wire::number(data, 1)? > 1 || wire::number(data, 2)? != 2 {
+                return Err(Error::Conflict);
+            }
+            let first_port = data.iter().any(|item| item.id() == 5);
+            let last_port = data.iter().any(|item| item.id() == 6);
+            if first_port != last_port {
+                return Err(Error::Conflict);
+            }
+            if first_port {
+                wire::number(data, 5)?;
+                wire::number(data, 6)?;
+            }
+        }
+        "range" => {
+            wire::number(data, 1)?;
+            if wire::number(data, 2)? > 1 || data.len() != 4 {
+                return Err(Error::Conflict);
+            }
+            let mut length = None;
+            for id in [3, 4] {
+                let value = wire::attrs(&wire::one(data, id)?.value)?;
+                if value.len() != 1 {
+                    return Err(Error::Conflict);
+                }
+                let bytes = &wire::one(&value, 1)?.value;
+                if !(1..=16).contains(&bytes.len())
+                    || length.is_some_and(|size| size != bytes.len())
+                {
+                    return Err(Error::Conflict);
+                }
+                length = Some(bytes.len());
+            }
+        }
+        _ => unreachable!(),
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+#[path = "owner_identity_tests.rs"]
+mod identity_tests;
+
 #[cfg(test)]
 #[path = "owner_tests.rs"]
 mod native_tests;

package/rust/src/owner_coexistence_tests.rs

@@ -0,0 +1,77 @@
+use super::*;
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn owner_scopes_family_wide_chain_dump_and_retains_foreign_table() {
+    isolated();
+    let mut foreign = Socket::open().unwrap();
+    let generation = foreign.generation().unwrap();
+    foreign
+        .batch(
+            generation,
+            vec![
+                (
+                    0,
+                    0x600,
+                    vec![Attr::string(1, "foreign_table"), Attr::u32(2, 6)],
+                ),
+                (
+                    3,
+                    0x600,
+                    vec![Attr::string(1, "foreign_table"), Attr::string(3, "input")],
+                ),
+                (
+                    3,
+                    0x600,
+                    vec![
+                        Attr::string(1, "foreign_table"),
+                        Attr::string(3, "foreign_chain"),
+                    ],
+                ),
+            ],
+        )
+        .unwrap();
+    let before = foreign
+        .query(4, vec![Attr::string(1, "foreign_table")], true)
+        .unwrap();
+    assert_eq!(before.len(), 2);
+    let mut owner = Owner::new(options("coexistence")).unwrap();
+    let intent = Transition {
+        previous: None,
+        target: empty(1),
+    };
+    let applied = owner.reconcile(intent.clone()).unwrap();
+    assert!(owner.inspect().enforced);
+    // Prove the kernel ignores the requested chain table filter.
+    assert_eq!(
+        foreign
+            .query(4, vec![Attr::string(1, "foreign_table")], true)
+            .unwrap()
+            .len(),
+        5
+    );
+    assert_eq!(owner.graph().unwrap().unwrap().chains.len(), 3);
+    drop(owner);
+    let mut owner = Owner::new(options("coexistence")).unwrap();
+    assert_eq!(owner.reconcile(intent).unwrap(), applied);
+    let applied = owner
+        .reconcile(Transition {
+            previous: Some(applied),
+            target: empty(2),
+        })
+        .unwrap();
+    owner.release(applied).unwrap();
+    assert_eq!(
+        foreign
+            .query(4, vec![Attr::string(1, "foreign_table")], true)
+            .unwrap(),
+        before
+    );
+    let generation = foreign.generation().unwrap();
+    foreign
+        .batch(
+            generation,
+            vec![(2, 0, vec![Attr::string(1, "foreign_table")])],
+        )
+        .unwrap();
+}

package/rust/src/owner_egress_identity_tests.rs

@@ -0,0 +1,155 @@
+use super::isolated;
+use crate::owner::{chain_identity, rule_identity};
+use crate::wire::{self, Attr, Socket};
+
+fn expression(name: &str, data: Vec<Attr>) -> Attr {
+    Attr::nested(1, vec![Attr::string(1, name), Attr::nested(2, data)])
+}
+fn immediate(register: u32, value: Vec<u8>) -> Attr {
+    expression(
+        "immediate",
+        vec![
+            Attr::u32(1, register),
+            Attr::nested(2, vec![Attr::bytes(1, value)]),
+        ],
+    )
+}
+fn chain(name: &str, hook: u32, priority: i32, kind: &str) -> Vec<Attr> {
+    vec![
+        Attr::string(1, "snft_egress_identity"),
+        Attr::string(3, name),
+        Attr::nested(4, vec![Attr::u32(1, hook), Attr::u32(2, priority as u32)]),
+        Attr::u32(5, 1),
+        Attr::string(7, kind),
+        Attr::u32(10, 1),
+    ]
+}
+fn rule(chain: &str, ordinal: u8, expressions: Vec<Attr>) -> Vec<Attr> {
+    vec![
+        Attr::string(1, "snft_egress_identity"),
+        Attr::string(2, chain),
+        Attr::nested(4, expressions),
+        Attr::bytes(7, vec![ordinal]),
+    ]
+}
+
+#[test]
+#[ignore = "requires the explicitly isolated QEMU qualification guest"]
+fn native_ct_nat_range_graph_identity_matches_exact_linux_dump() {
+    isolated();
+    let chains = [
+        chain("raw", 0, -300, "filter"),
+        chain("forward", 2, 0, "filter"),
+        chain("post", 4, 100, "nat"),
+    ];
+    let rules = [
+        rule(
+            "raw",
+            1,
+            vec![
+                immediate(1, 17_u16.to_ne_bytes().to_vec()),
+                expression("ct", vec![Attr::u32(2, 17), Attr::u32(4, 1)]),
+            ],
+        ),
+        rule(
+            "forward",
+            2,
+            vec![
+                expression(
+                    "ct",
+                    vec![Attr::u32(1, 1), Attr::u32(2, 20), Attr::bytes(3, vec![0])],
+                ),
+                expression("ct", vec![Attr::u32(1, 1), Attr::u32(2, 17)]),
+                immediate(1, vec![0x7a; 16]),
+                expression("ct", vec![Attr::u32(2, 13), Attr::u32(4, 1)]),
+                expression("ct", vec![Attr::u32(1, 1), Attr::u32(2, 13)]),
+                expression(
+                    "payload",
+                    vec![
+                        Attr::u32(1, 1),
+                        Attr::u32(2, 2),
+                        Attr::u32(3, 0),
+                        Attr::u32(4, 2),
+                    ],
+                ),
+                expression(
+                    "range",
+                    vec![
+                        Attr::u32(1, 1),
+                        Attr::u32(2, 0),
+                        Attr::nested(3, vec![Attr::bytes(1, 10000_u16.to_be_bytes().to_vec())]),
+                        Attr::nested(4, vec![Attr::bytes(1, 10999_u16.to_be_bytes().to_vec())]),
+                    ],
+                ),
+            ],
+        ),
+        rule(
+            "post",
+            3,
+            vec![
+                immediate(1, vec![10, 240, 0, 2]),
+                immediate(2, 10000_u16.to_be_bytes().to_vec()),
+                immediate(3, 10999_u16.to_be_bytes().to_vec()),
+                expression(
+                    "nat",
+                    vec![
+                        Attr::u32(1, 0),
+                        Attr::u32(2, 2),
+                        Attr::u32(3, 1),
+                        Attr::u32(4, 1),
+                        Attr::u32(5, 2),
+                        Attr::u32(6, 3),
+                        Attr::u32(7, 3),
+                    ],
+                ),
+            ],
+        ),
+    ];
+    let mut socket = Socket::open().unwrap();
+    let mut operations = vec![(
+        0,
+        0x600,
+        vec![Attr::string(1, "snft_egress_identity"), Attr::u32(2, 6)],
+    )];
+    operations.extend(chains.iter().cloned().map(|value| (3, 0x600, value)));
+    operations.extend(rules.iter().cloned().map(|value| (6, 0xc00, value)));
+    let generation = socket.generation().unwrap();
+    socket.batch(generation, operations).unwrap();
+    let dumped_chains = socket
+        .query(4, vec![Attr::string(1, "snft_egress_identity")], true)
+        .unwrap();
+    assert_eq!(dumped_chains.len(), chains.len());
+    for expected in &chains {
+        let name = wire::text(expected, 3).unwrap();
+        let actual = dumped_chains
+            .iter()
+            .find(|item| wire::text(item, 3).unwrap() == name)
+            .unwrap();
+        assert_eq!(
+            chain_identity(actual).unwrap(),
+            chain_identity(expected).unwrap()
+        );
+    }
+    let dumped_rules = socket
+        .query(7, vec![Attr::string(1, "snft_egress_identity")], true)
+        .unwrap();
+    assert_eq!(dumped_rules.len(), rules.len());
+    for expected in &rules {
+        let actual = dumped_rules
+            .iter()
+            .find(|item| wire::one(item, 7).unwrap().value == wire::one(expected, 7).unwrap().value)
+            .unwrap();
+        assert_eq!(
+            rule_identity(actual).unwrap(),
+            rule_identity(expected).unwrap()
+        );
+    }
+    let generation = socket.generation().unwrap();
+    socket
+        .batch(
+            generation,
+            vec![(2, 0, vec![Attr::string(1, "snft_egress_identity")])],
+        )
+        .unwrap();
+    println!("EGRESS_EXPRESSION_IDENTITY ct_zone_label_original_ipv4=true nat_explicit_min_max=true range_inclusive=true traffic_qualified=false");
+}

package/rust/src/owner_egress_tests.rs

@@ -0,0 +1,153 @@
+use super::*;
+use crate::egress;
+use serde_json::{json, Value};
+
+fn binding(name: &str, address: &str, kind: &str) -> Value {
+    let output = std::process::Command::new("/bin/ip")
+        .args(["-j", "-d", "link", "show", "dev", name])
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let observed = serde_json::from_slice::<Value>(&output.stdout).unwrap()[0].clone();
+    let index = observed["ifindex"].as_u64().unwrap();
+    let peer_index = if kind == "veth" {
+        let peer = std::ffi::CString::new(format!("{name}peer")).unwrap();
+        let index = unsafe { libc::if_nametoindex(peer.as_ptr()) };
+        assert_ne!(index, 0);
+        u64::from(index)
+    } else {
+        index
+    };
+    json!({"interfaceIndex":index,"interfaceName":name,"interfaceKind":kind,
+        "macAddress":if kind=="tun" {Value::Null} else {observed["address"].clone()},
+        "interfaceLinkIndex":peer_index,
+        "requiredIpv4Addresses":[address]})
+}
+fn veth(name: &str, address: &str) {
+    ip(&[
+        "link",
+        "add",
+        name,
+        "type",
+        "veth",
+        "peer",
+        "name",
+        &format!("{name}peer"),
+    ]);
+    ip(&["address", "add", address, "dev", name]);
+    ip(&["link", "set", name, "up"]);
+}
+fn router() -> egress::Policy {
+    veth("work", "10.241.0.1/24");
+    veth("handoff", "10.240.0.2/30");
+    ip(&["tuntap", "add", "dev", "vpn", "mode", "tun"]);
+    ip(&["address", "add", "10.242.0.1/24", "dev", "vpn"]);
+    let mut value = egress::tests::router();
+    value["scope"]["links"] = json!([
+        binding("work", "10.241.0.1", "veth"),
+        binding("vpn", "10.242.0.1", "tun")
+    ]);
+    value["scope"]["handoff"] = binding("handoff", "10.240.0.2", "veth");
+    for index in 0..2 {
+        value["scope"]["endpoints"][index]["interfaceIndex"] =
+            value["scope"]["links"][index]["interfaceIndex"].clone();
+    }
+    serde_json::from_value(value).unwrap()
+}
+fn host() -> egress::Policy {
+    veth("handoff", "10.240.0.1/30");
+    veth("uplink", "192.0.2.2/24");
+    let mut value = egress::tests::host();
+    value["scope"]["handoffs"][0]["link"] = binding("handoff", "10.240.0.1", "veth");
+    value["scope"]["uplink"] = binding("uplink", "192.0.2.2", "veth");
+    serde_json::from_value(value).unwrap()
+}
+fn recover(name: &str, policy: egress::Policy) {
+    let prepared: Prepared = policy.clone().prepare().unwrap().into();
+    prepared.validate_interfaces().expect("fixture bindings");
+    let mut owner = Owner::new(options(name)).unwrap();
+    let result = owner.reconcile(Transition {
+        previous: None,
+        target: prepared.clone(),
+    });
+    if result.is_err() {
+        if let Some(graph) = owner.graph().unwrap() {
+            for (kind, expected) in prepared.program(&format!("snft_{name}")).unwrap() {
+                if kind == 3 {
+                    let name = wire::text(&expected, 3).unwrap();
+                    let actual = graph
+                        .chains
+                        .iter()
+                        .find(|item| wire::text(item, 3).unwrap() == name)
+                        .unwrap();
+                    assert_eq!(
+                        chain_identity(&expected),
+                        chain_identity(actual),
+                        "chain {name}"
+                    );
+                } else {
+                    let stamp = &wire::one(&expected, 7).unwrap().value;
+                    let actual = graph
+                        .rules
+                        .iter()
+                        .find(|item| &wire::one(item, 7).unwrap().value == stamp)
+                        .unwrap();
+                    if rule_identity(&expected) != rule_identity(actual) {
+                        println!("expected_rule={expected:?}\nactual_rule={actual:?}");
+                        panic!("full graph identity differs");
+                    }
+                }
+            }
+        }
+    }
+    let applied = result.unwrap();
+    assert!(owner.inspect().enforced);
+    let handle = applied.receipt.table_handle.clone();
+    // Drop only the process/socket owner. PERSIST retains the complete graph.
+    drop(owner);
+    let mut owner = Owner::new(options(name)).unwrap();
+    let recovered = owner
+        .reconcile(Transition {
+            previous: None,
+            target: prepared,
+        })
+        .unwrap();
+    assert_eq!(recovered.receipt.table_handle, handle);
+    assert!(owner.inspect().enforced);
+    let mut next = policy;
+    next.revision += 1;
+    let transition = Transition {
+        previous: Some(recovered.clone()),
+        target: next.prepare().unwrap().into(),
+    };
+    let next_applied = owner.reconcile(transition.clone()).unwrap();
+    assert!(owner.inspect().enforced);
+    // Exact persisted command replay after the target ACK was lost.
+    drop(owner);
+    let mut owner = Owner::new(options(name)).unwrap();
+    assert_eq!(owner.reconcile(transition).unwrap(), next_applied);
+    assert!(owner.inspect().enforced);
+    // A valid private-v1 policy cannot replace this table's v2 role.
+    assert_eq!(
+        owner.reconcile(Transition {
+            previous: Some(next_applied.clone()),
+            target: empty(3)
+        }),
+        Err(Error::Conflict)
+    );
+    assert!(owner.inspect().enforced);
+    owner.release(next_applied).unwrap();
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_router_complete_graph_persist_and_lost_ack_recovery() {
+    isolated();
+    recover("router_v2", router());
+}
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_complete_graph_persist_and_lost_ack_recovery() {
+    isolated();
+    recover("host_v2", host());
+}