@push.rocks/smartnftables 1.6.0 → 1.8.0

package/rust/src/owner.detach.rs

@@ -0,0 +1,73 @@
+use super::*;
+
+impl Owner {
+    /// Terminal retention, never adoption/deletion. Exact retry may observe an
+    /// orphan after an ACK was lost, including through a fresh native process.
+    pub fn detach(&mut self, expected: Applied) -> Result<()> {
+        self.validate_receipt(&expected)?;
+        if self.released || self.pending.is_some() {
+            return Err(Error::Conflict);
+        }
+        if let Some(retention) = &self.retention {
+            if retention.expected != expected {
+                return Err(Error::Conflict);
+            }
+        } else {
+            self.retention = Some(Retention {
+                expected: expected.clone(),
+                confirmed: false,
+            });
+        }
+        let result = (|| {
+            self.verify_retention(&expected, false)?;
+            // OWNER disappears with this socket; PERSIST must retain exactly
+            // the same table. The fresh verification socket never adopts it.
+            self.socket = None;
+            self.verify_retention(&expected, true)?;
+            self.socket = None;
+            Ok(())
+        })();
+        self.retention.as_mut().unwrap().confirmed = result.is_ok();
+        match result {
+            Ok(()) => {
+                self.applied = Some(expected);
+                self.error = None;
+                Ok(())
+            }
+            Err(error) => {
+                self.error = Some(error);
+                Err(error)
+            }
+        }
+    }
+
+    fn verify_retention(&mut self, expected: &Applied, orphan_only: bool) -> Result<()> {
+        let graph = self.graph()?.ok_or(Error::Conflict)?;
+        self.binding(&graph, Some(expected))?;
+        let flags = wire::number(&graph.table, 2)?;
+        if (orphan_only && flags != 4)
+            || (flags == 6 && wire::number(&graph.table, 7)? != self.socket()?.port)
+            || !self.matches(&graph, &expected.prepared)?
+        {
+            return Err(Error::Conflict);
+        }
+        expected.prepared.validate_interfaces()
+    }
+
+    pub(super) fn inspect_retained(&mut self) -> Status {
+        let expected = self.retention.as_ref().unwrap().expected.clone();
+        if let Err(error) = self.verify_retention(&expected, true) {
+            self.retention.as_mut().unwrap().confirmed = false;
+            self.error = Some(error);
+        }
+        let enforced = self.retention.as_ref().unwrap().confirmed && self.error.is_none();
+        Status {
+            identity: self.identity.clone(),
+            state: if enforced { "retained" } else { "failed-owned" }.into(),
+            enforced,
+            applied: self.applied.clone(),
+            pending: self.pending.clone(),
+            error: self.error.map(|error| error.code().into()),
+        }
+    }
+}

package/rust/src/owner.rs

@@ -68,8 +68,17 @@ pub struct Owner {
     pending: Option<Transition>,
     error: Option<Error>,
     released: bool,
+    retention: Option<Retention>,
 }
 
+struct Retention {
+    expected: Applied,
+    confirmed: bool,
+}
+
+#[path = "owner.detach.rs"]
+mod detach;
+
 pub(crate) fn context() -> Result<(String, String, String)> {
     let boot = std::fs::read_to_string("/proc/sys/kernel/random/boot_id")
         .map_err(|_| Error::Unavailable)?
@@ -154,6 +163,7 @@ impl Owner {
             pending: None,
             error: None,
             released: false,
+            retention: None,
         })
     }
     fn socket(&mut self) -> Result<&mut Socket> {
@@ -350,7 +360,7 @@ impl Owner {
         })
     }
     pub fn reconcile(&mut self, transition: Transition) -> Result<Applied> {
-        if self.released {
+        if self.released || self.retention.is_some() {
             return Err(Error::Conflict);
         }
         transition.target.validate()?;
@@ -453,6 +463,9 @@ impl Owner {
         self.applied(&graph, transition.target.clone())
     }
     pub fn inspect(&mut self) -> Status {
+        if self.retention.is_some() {
+            return self.inspect_retained();
+        }
         let mut enforced = false;
         if let Some(applied) = self.applied.clone().filter(|_| !self.released) {
             match self.graph().and_then(|graph| {
@@ -490,6 +503,9 @@ impl Owner {
         }
     }
     pub fn release(&mut self, expected: Applied) -> Result<()> {
+        if self.retention.is_some() {
+            return Err(Error::Conflict);
+        }
         self.validate_receipt(&expected)?;
         if self.pending.is_some() {
             return Err(Error::Conflict);
@@ -545,6 +561,9 @@ impl Owner {
         }
     }
     pub fn close(&mut self) -> Result<()> {
+        if self.retention.is_some() {
+            return Err(Error::Conflict);
+        }
         if self.released {
             return Ok(());
         }

package/rust/src/owner_detach_tests.rs

@@ -0,0 +1,252 @@
+use super::namespace_tests::NativeOwner;
+use super::*;
+use crate::egress;
+use serde_json::json;
+use std::io::Write;
+use std::time::{Duration, Instant};
+
+fn pool_target(revision: u64) -> Prepared {
+    let mut policy = egress::tests::pool_guard();
+    policy["revision"] = json!(revision);
+    serde_json::from_value::<egress::Policy>(policy)
+        .unwrap()
+        .prepare()
+        .unwrap()
+        .into()
+}
+fn apply(name: &str) -> (Owner, Applied) {
+    let mut owner = Owner::new(options(name)).unwrap();
+    let applied = owner
+        .reconcile(Transition {
+            previous: None,
+            target: pool_target(1),
+        })
+        .unwrap();
+    (owner, applied)
+}
+fn retained(owner: &mut Owner, applied: &Applied) {
+    let status = owner.inspect();
+    assert_eq!(status.state, "retained");
+    assert!(status.enforced);
+    assert_eq!(status.applied, Some(applied.clone()));
+    let graph = owner.graph().unwrap().unwrap();
+    assert_eq!(wire::number(&graph.table, 2).unwrap(), 4);
+    assert_eq!(
+        wire::handle(&graph.table, 4).unwrap().to_string(),
+        applied.receipt.table_handle
+    );
+    assert!(owner.matches(&graph, &applied.prepared).unwrap());
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn detach_retains_exact_graph_is_terminal_and_replays_without_adoption() {
+    isolated();
+    let (mut owner, applied) = apply("detach_replay");
+    owner.detach(applied.clone()).unwrap();
+    retained(&mut owner, &applied);
+    owner.detach(applied.clone()).unwrap();
+    assert_eq!(owner.close(), Err(Error::Conflict));
+    assert_eq!(owner.release(applied.clone()), Err(Error::Conflict));
+    assert_eq!(
+        owner.reconcile(Transition {
+            previous: Some(applied.clone()),
+            target: pool_target(2)
+        }),
+        Err(Error::Conflict)
+    );
+    let mut different = applied.clone();
+    different.prepared = pool_target(2);
+    different.receipt.revision = 2;
+    different.receipt.digest = different.prepared.digest.clone();
+    assert_eq!(owner.detach(different), Err(Error::Conflict));
+    retained(&mut owner, &applied);
+    drop(owner);
+    let mut fresh = Owner::new(options("detach_replay")).unwrap();
+    fresh.detach(applied.clone()).unwrap();
+    retained(&mut fresh, &applied);
+    // A separate active owner invalidates retention inspection. It is never
+    // detached by this reader, even with the same full logical identity.
+    let mut active = Owner::new(options("detach_replay")).unwrap();
+    active
+        .reconcile(Transition {
+            previous: None,
+            target: applied.prepared.clone(),
+        })
+        .unwrap();
+    assert_eq!(fresh.detach(applied.clone()), Err(Error::Conflict));
+    assert!(!fresh.inspect().enforced);
+    assert!(active.inspect().enforced);
+    assert_eq!(fresh.close(), Err(Error::Conflict));
+    drop(active);
+    fresh.detach(applied.clone()).unwrap();
+    retained(&mut fresh, &applied);
+    drop(fresh);
+    Owner::new(options("detach_replay"))
+        .unwrap()
+        .release(applied)
+        .unwrap();
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn detach_rejects_pending_wrong_receipts_foreign_mutation_and_absence() {
+    isolated();
+    let (mut owner, applied) = apply("detach_faults");
+    let pending = Transition {
+        previous: Some(applied.clone()),
+        target: pool_target(2),
+    };
+    owner.pending = Some(pending.clone());
+    assert_eq!(owner.detach(applied.clone()), Err(Error::Conflict));
+    assert!(owner.retention.is_none());
+    let applied = owner.reconcile(pending).unwrap();
+    for field in ["boot", "namespace", "handle", "digest"] {
+        let mut invalid = applied.clone();
+        match field {
+            "boot" => {
+                invalid.receipt.identity.boot_id = "00000000-0000-0000-0000-000000000000".into()
+            }
+            "namespace" => invalid.receipt.identity.namespace_inode = "0".into(),
+            "handle" => invalid.receipt.table_handle = "18446744073709551615".into(),
+            _ => invalid.receipt.digest = format!("sha256:{}", "0".repeat(64)),
+        }
+        let mut reader = Owner::new(options("detach_faults")).unwrap();
+        assert_eq!(reader.detach(invalid), Err(Error::Conflict));
+        assert!(owner.inspect().enforced);
+    }
+    owner.detach(applied.clone()).unwrap();
+    // Mutation after detachment is observed on exact retry and permanently
+    // retains the failed owner. No failure cleanup adopts or deletes the graph.
+    let mut foreign = Socket::open().unwrap();
+    let generation = foreign.generation().unwrap();
+    foreign
+        .batch(
+            generation,
+            vec![(
+                3,
+                0x600,
+                vec![
+                    Attr::string(1, "snft_detach_faults"),
+                    Attr::string(3, "foreign"),
+                ],
+            )],
+        )
+        .unwrap();
+    assert_eq!(owner.detach(applied.clone()), Err(Error::Conflict));
+    assert!(!owner.inspect().enforced);
+    assert_eq!(owner.close(), Err(Error::Conflict));
+    assert_eq!(owner.release(applied.clone()), Err(Error::Conflict));
+    assert!(owner
+        .graph()
+        .unwrap()
+        .unwrap()
+        .chains
+        .iter()
+        .any(|chain| wire::text(chain, 3).unwrap() == "foreign"));
+    drop(owner);
+    // This disposable fixture's foreign owner deletes only its exact orphan.
+    let generation = foreign.generation().unwrap();
+    foreign
+        .batch(
+            generation,
+            vec![(2, 0, vec![Attr::string(1, "snft_detach_faults")])],
+        )
+        .unwrap();
+    let mut absent = Owner::new(options("detach_faults")).unwrap();
+    assert_eq!(absent.detach(applied), Err(Error::Conflict));
+    assert!(!absent.inspect().enforced);
+    assert_eq!(absent.close(), Err(Error::Conflict));
+    assert!(absent.graph().unwrap().is_none());
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn detach_rechecks_interface_bindings_without_releasing_on_drift() {
+    isolated();
+    let endpoint = endpoint("a", 71);
+    let policy = crate::policy::Policy {
+        schema_version: 1,
+        revision: 1,
+        endpoints: vec![endpoint],
+        rules: vec![],
+    };
+    let mut owner = Owner::new(options("detach_links")).unwrap();
+    let applied = owner
+        .reconcile(Transition {
+            previous: None,
+            target: policy.prepare().unwrap().into(),
+        })
+        .unwrap();
+    ip(&["link", "set", "worka", "name", "renameda"]);
+    assert_eq!(owner.detach(applied.clone()), Err(Error::Conflict));
+    assert_eq!(owner.close(), Err(Error::Conflict));
+    let graph = owner.graph().unwrap().unwrap();
+    assert_eq!(
+        wire::handle(&graph.table, 4).unwrap().to_string(),
+        applied.receipt.table_handle
+    );
+    ip(&["link", "set", "renameda", "name", "worka"]);
+    owner.detach(applied.clone()).unwrap();
+    retained(&mut owner, &applied);
+    drop(owner);
+    Owner::new(options("detach_links"))
+        .unwrap()
+        .release(applied)
+        .unwrap();
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn detach_recovers_lost_response_and_undelivered_request_across_real_native_processes() {
+    isolated();
+    let namespace = std::fs::File::open("/proc/thread-self/ns/net").unwrap();
+    for delivered in [true, false] {
+        let name = if delivered {
+            "detach_ack"
+        } else {
+            "detach_unsent"
+        };
+        let mut native = NativeOwner::start(&namespace);
+        native.call("openOwner", serde_json::to_value(options(name)).unwrap());
+        let applied: Applied = serde_json::from_value(native.call(
+            "reconcilePolicy",
+            json!({"previous":null,"target":pool_target(1)}),
+        ))
+        .unwrap();
+        let mut reader = Owner::new(options(name)).unwrap();
+        reader.validate_receipt(&applied).unwrap();
+        if delivered {
+            writeln!(
+                native.child.stdin.as_mut().unwrap(),
+                "{}",
+                json!({"id":"lost-detach","method":"detachPolicy","params":applied})
+            )
+            .unwrap();
+            let until = Instant::now() + Duration::from_secs(3);
+            loop {
+                let graph = reader.graph().unwrap().unwrap();
+                if wire::number(&graph.table, 2).unwrap() == 4 {
+                    break;
+                }
+                assert!(Instant::now() < until);
+                std::thread::sleep(Duration::from_millis(5));
+            }
+            // Do not read the detach response: terminate the actual process
+            // after observing its kernel effect but before recording an ACK.
+        }
+        drop(native);
+        let mut fresh = NativeOwner::start(&namespace);
+        fresh.call("openOwner", serde_json::to_value(options(name)).unwrap());
+        assert_eq!(
+            fresh.call("detachPolicy", serde_json::to_value(&applied).unwrap()),
+            json!({"detached":true})
+        );
+        assert_eq!(fresh.call("inspectPolicy", json!({}))["state"], "retained");
+        drop(fresh);
+        let graph = reader.graph().unwrap().unwrap();
+        assert_eq!(wire::number(&graph.table, 2).unwrap(), 4);
+        assert!(reader.matches(&graph, &applied.prepared).unwrap());
+        reader.release(applied).unwrap();
+    }
+}

package/rust/src/owner_egress_tests.rs

@@ -62,7 +62,7 @@ fn host() -> egress::Policy {
     value["scope"]["uplink"] = binding("uplink", "192.0.2.2", "veth");
     serde_json::from_value(value).unwrap()
 }
-fn recover(name: &str, policy: egress::Policy) {
+pub(super) fn recover(name: &str, policy: egress::Policy) {
     let prepared: Prepared = policy.clone().prepare().unwrap().into();
     prepared.validate_interfaces().expect("fixture bindings");
     let mut owner = Owner::new(options(name)).unwrap();

package/rust/src/owner_egress_traffic_tests.rs

@@ -205,6 +205,18 @@ fn v2_four_namespace_private_tun_local_dns_egress_and_revocation() {
     ns_ip(ROUTER, &["address", "add", "10.242.0.1/24", "dev", "vpn"]);
     ns_ip(ROUTER, &["link", "set", "vpn", "up"]);
     let mut device = in_namespace(ROUTER, tun);
+    let (pool_owner, pool_applied) = in_namespace(HOST, || {
+        let mut owner = Owner::new(options("pool_coexistence")).unwrap();
+        let policy: egress::Policy = serde_json::from_value(egress::tests::pool_guard()).unwrap();
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target: policy.prepare().unwrap().into(),
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
     let (host_owner, host_applied) = in_namespace(HOST, || {
         let mut owner = Owner::new(options("host_packets")).unwrap();
         let applied = owner
@@ -260,11 +272,8 @@ fn v2_four_namespace_private_tun_local_dns_egress_and_revocation() {
     });
     let listener = in_namespace(PEER, || TcpListener::bind("192.0.2.3:3000").unwrap());
     let mut client = in_namespace(WORK, || {
-        TcpStream::connect_timeout(
-            &"192.0.2.3:3000".parse().unwrap(),
-            Duration::from_secs(1),
-        )
-        .unwrap()
+        TcpStream::connect_timeout(&"192.0.2.3:3000".parse().unwrap(), Duration::from_secs(1))
+            .unwrap()
     });
     let (mut server, peer) = listener.accept().unwrap();
     assert_eq!(peer.ip().to_string(), "192.0.2.2");
@@ -290,11 +299,8 @@ fn v2_four_namespace_private_tun_local_dns_egress_and_revocation() {
     assert_eq!(syn[33] & 0xc0, 0xc0);
     assert!((10016..=10031).contains(&u16::from_be_bytes(syn[20..22].try_into().unwrap())));
     let mut local_tcp = in_namespace(ROUTER, || {
-        TcpStream::connect_timeout(
-            &"192.0.2.3:3000".parse().unwrap(),
-            Duration::from_secs(1),
-        )
-        .unwrap()
+        TcpStream::connect_timeout(&"192.0.2.3:3000".parse().unwrap(), Duration::from_secs(1))
+            .unwrap()
     });
     let (mut local_peer, local_outer) = listener.accept().unwrap();
     assert!((10016..=10031).contains(&local_outer.port()));
@@ -466,5 +472,10 @@ fn v2_four_namespace_private_tun_local_dns_egress_and_revocation() {
         let mut owner = host_owner;
         owner.release(host_applied).unwrap();
     });
+    in_namespace(HOST, move || {
+        let mut owner = pool_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(pool_applied).unwrap();
+    });
     println!("V2_PACKET_PROOF private_dns=true tun_private=true tun_public_denied=true workload_public=true local_dns_and_tcp=true handoff_udp_tcp_ranges=true ecn_syn=true opening_ack_rst_denied=true fragments_checked=true range_exhaustion_denied=true protected_grant_denied=true ungranted_local_denied=true retired_replies_denied=true revoked_egress_denied=true disjoint_generation_restored=true flows_drained=false reusable=false");
 }

package/rust/src/owner_host_traffic_tests.rs

@@ -7,7 +7,7 @@ const SOURCE: &str = "hs_source";
 const HOST: &str = "hs_host";
 const PEER: &str = "hs_peer";
 
-fn payload(offset: u32, bytes: Vec<u8>, transport: bool) -> Vec<Attr> {
+pub(super) fn payload(offset: u32, bytes: Vec<u8>, transport: bool) -> Vec<Attr> {
     vec![
         expr(
             "payload",
@@ -21,7 +21,7 @@ fn payload(offset: u32, bytes: Vec<u8>, transport: bool) -> Vec<Attr> {
         compare(bytes),
     ]
 }
-fn immediate(value: Vec<u8>) -> Attr {
+pub(super) fn immediate(value: Vec<u8>) -> Attr {
     expr(
         "immediate",
         vec![
@@ -196,10 +196,7 @@ fn v2_host_rejects_foreign_dnat_zone_local_diversion_and_ipv6() {
         HOST,
         &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
     );
-    ns_ip(
-        HOST,
-        &["route", "add", "10.250.0.2/32", "via", "192.0.2.3"],
-    );
+    ns_ip(HOST, &["route", "add", "10.250.0.2/32", "via", "192.0.2.3"]);
     for address in ["203.0.113.2/32", "10.250.0.2/32"] {
         ns_ip(PEER, &["address", "add", address, "dev", "lo"]);
     }
@@ -285,10 +282,7 @@ fn v2_host_rejects_foreign_dnat_zone_local_diversion_and_ipv6() {
         control(source, destination, target, false);
     }
     let allowed = socket(SOURCE, "10.240.0.2:10000");
-    assert_eq!(
-        roundtrip(&allowed, &public).ip().to_string(),
-        "192.0.2.2"
-    );
+    assert_eq!(roundtrip(&allowed, &public).ip().to_string(), "192.0.2.2");
     let platform = socket(PEER, "192.0.2.3:5300");
     roundtrip(&allowed, &platform);
     let unleased = socket(SOURCE, "10.240.0.2:9999");

package/rust/src/owner_namespace_tests.rs

@@ -30,13 +30,13 @@ fn command(namespace: &File) -> Command {
     command
 }
 
-struct NativeOwner {
-    child: Child,
+pub(super) struct NativeOwner {
+    pub(super) child: Child,
     messages: Receiver<Value>,
     reader: Option<JoinHandle<()>>,
 }
 impl NativeOwner {
-    fn start(namespace: &File) -> Self {
+    pub(super) fn start(namespace: &File) -> Self {
         let mut child = command(namespace).spawn().unwrap();
         let output = child.stdout.take().unwrap();
         let (send, messages) = mpsc::channel();
@@ -76,7 +76,7 @@ impl NativeOwner {
         assert_eq!(response["id"], method);
         response
     }
-    fn call(&mut self, method: &str, params: Value) -> Value {
+    pub(super) fn call(&mut self, method: &str, params: Value) -> Value {
         let response = self.response(method, params);
         assert_eq!(response["success"], true, "{response}");
         response["result"].clone()