@push.rocks/smartnftables 1.6.0 → 1.8.0

package/rust/src/owner_poolguard_tests.rs

@@ -0,0 +1,268 @@
+use super::egress_traffic_tests::{connect, ns_ip, roundtrip, socket};
+use super::host_traffic_tests::{immediate, payload};
+use super::*;
+use crate::{
+    egress,
+    policy::{expr, meta},
+};
+use serde_json::json;
+use std::net::{SocketAddr, UdpSocket};
+use std::time::Duration;
+
+const SOURCE: &str = "pg_source";
+const HOST: &str = "pg_host";
+const PEER: &str = "pg_peer";
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn allocation_pool_guard_maximum_graph_persist_and_lost_ack_recovery() {
+    isolated();
+    let mut policy = egress::tests::pool_guard();
+    policy["scope"]["prefixes"] = json!((0..64)
+        .map(|part| format!("10.{part}.0.0/16"))
+        .collect::<Vec<_>>());
+    super::egress_tests::recover("pools_v2", serde_json::from_value(policy).unwrap());
+}
+
+// Foreign capture controls exist only in this offline guest. They are never
+// composed into or removed with the managed policy under test.
+fn foreign_captures() {
+    let table = "snft_foreign_pool_capture";
+    let mut operations = vec![(0, 0x600, vec![Attr::string(1, table), Attr::u32(2, 6)])];
+    for (chain, hook, priority, kind) in [
+        ("raw_pre", 0, -300_i32, "filter"),
+        ("raw_out", 3, -300, "filter"),
+        ("pre", 0, -100, "nat"),
+        ("out", 3, -100, "nat"),
+    ] {
+        operations.push((
+            3,
+            0x600,
+            vec![
+                Attr::string(1, table),
+                Attr::string(3, chain),
+                Attr::nested(4, vec![Attr::u32(1, hook), Attr::u32(2, priority as u32)]),
+                Attr::u32(5, 1),
+                Attr::string(7, kind),
+                Attr::u32(10, 1),
+            ],
+        ));
+    }
+    let mut rule = |chain: &str, expressions| {
+        operations.push((
+            6,
+            0xc00,
+            vec![
+                Attr::string(1, table),
+                Attr::string(2, chain),
+                Attr::nested(4, expressions),
+            ],
+        ))
+    };
+    for chain in ["raw_pre", "raw_out"] {
+        let mut expressions = meta(16, vec![17]);
+        expressions.extend(payload(2, 44003_u16.to_be_bytes().to_vec(), true));
+        expressions.push(expr("notrack", vec![]));
+        rule(chain, expressions);
+    }
+    for chain in ["pre", "out"] {
+        for (port, destination, target) in [
+            (44001_u16, [10, 250, 0, 2], [203, 0, 113, 2]),
+            (44002, [203, 0, 113, 2], [10, 250, 0, 2]),
+            (44004, [10, 250, 0, 2], [192, 0, 2, 2]),
+            (44005, [203, 0, 113, 2], [10, 241, 0, 1]),
+        ] {
+            let mut expressions = meta(16, vec![17]);
+            expressions.extend(payload(16, destination.to_vec(), false));
+            expressions.extend(payload(2, port.to_be_bytes().to_vec(), true));
+            expressions.push(immediate(target.to_vec()));
+            expressions.push(expr(
+                "nat",
+                vec![
+                    Attr::u32(1, 1),
+                    Attr::u32(2, 2),
+                    Attr::u32(3, 1),
+                    Attr::u32(4, 1),
+                    Attr::u32(7, 1),
+                ],
+            ));
+            rule(chain, expressions);
+        }
+    }
+    let mut socket = wire::Socket::open().unwrap();
+    let generation = socket.generation().unwrap();
+    socket.batch(generation, operations).unwrap();
+}
+
+fn bound(namespace: &str, address: &str) -> UdpSocket {
+    let address = address.to_owned();
+    let socket = in_namespace(namespace, move || UdpSocket::bind(address).unwrap());
+    socket
+        .set_read_timeout(Some(Duration::from_millis(250)))
+        .unwrap();
+    socket
+}
+fn probe(
+    source: &UdpSocket,
+    destination: &str,
+    target: &UdpSocket,
+    allowed: bool,
+    local: bool,
+) -> Option<SocketAddr> {
+    let result = source.send_to(b"probe", destination);
+    if !allowed && local {
+        assert_eq!(
+            result.unwrap_err().raw_os_error(),
+            Some(libc::EPERM),
+            "{destination}"
+        );
+    } else {
+        assert_eq!(result.unwrap(), 5, "{destination}");
+    }
+    match target.recv_from(&mut [0; 64]) {
+        Ok((size, sender)) => {
+            assert!(allowed, "unexpected packet to {destination}");
+            assert_eq!(size, 5);
+            Some(sender)
+        }
+        Err(error) => {
+            assert!(!allowed, "missing packet to {destination}: {error}");
+            assert!(matches!(
+                error.kind(),
+                std::io::ErrorKind::WouldBlock | std::io::ErrorKind::TimedOut
+            ));
+            None
+        }
+    }
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn allocation_pool_guard_covers_all_host_hooks_dnat_untracked_and_reply_direction() {
+    isolated();
+    for name in [SOURCE, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        SOURCE,
+        "source",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(SOURCE, &["route", "add", "default", "via", "10.240.0.1"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    ns_ip(HOST, &["address", "add", "10.241.0.1/32", "dev", "lo"]);
+    for address in ["203.0.113.2", "10.250.0.2"] {
+        ns_ip(
+            PEER,
+            &["address", "add", &format!("{address}/32"), "dev", "lo"],
+        );
+        ns_ip(
+            HOST,
+            &["route", "add", &format!("{address}/32"), "via", "192.0.2.3"],
+        );
+    }
+    in_namespace(HOST, foreign_captures);
+    let source = socket(SOURCE, "10.240.0.2:10000");
+    let host = socket(HOST, "192.0.2.2:10000");
+    let host_pool = socket(HOST, "10.241.0.1:10000");
+    let public = socket(PEER, "203.0.113.2:42000");
+    let lan = socket(PEER, "192.0.2.3:42000");
+    // Controls exercise established flows before apply, plus fresh ones below.
+    roundtrip(&source, &public);
+    roundtrip(&source, &host);
+    roundtrip(&host_pool, &public);
+    roundtrip(&host, &lan);
+    let cases = [
+        ("10.250.0.2:42001", PEER, "10.250.0.2:42001"),
+        ("10.241.0.1:42002", HOST, "10.241.0.1:42002"),
+        ("10.250.0.2:44001", PEER, "203.0.113.2:44001"),
+        ("203.0.113.2:44002", PEER, "10.250.0.2:44002"),
+        ("10.250.0.2:44003", PEER, "10.250.0.2:44003"),
+        ("10.250.0.2:44004", HOST, "192.0.2.2:44004"),
+        ("203.0.113.2:44005", HOST, "10.241.0.1:44005"),
+    ];
+    let targets: Vec<_> = cases
+        .iter()
+        .map(|(_, ns, address)| bound(ns, address))
+        .collect();
+    let mut replies = Vec::new();
+    for ((destination, _, _), target) in cases.iter().zip(&targets) {
+        for sender in [&source, &host] {
+            replies.push(probe(sender, destination, target, true, false).unwrap());
+        }
+    }
+    // INPUT with NOTRACK is independent of OUTPUT/FORWARD controls.
+    let untracked_input = socket(HOST, "10.241.0.1:44003");
+    probe(&lan, "10.241.0.1:44003", &untracked_input, true, false);
+    // A reply to a public original destination can have a pool source before
+    // reverse DNAT in POSTROUTING. Both INPUT and FORWARD must deny that reply.
+    for (sender, receiver) in [(&source, replies[6]), (&host, replies[7])] {
+        targets[3].send_to(b"before", receiver).unwrap();
+        assert_eq!(sender.recv(&mut [0; 64]).unwrap(), 6);
+    }
+    let (owner, applied) = in_namespace(HOST, || {
+        let mut owner = Owner::new(options("pool_traffic")).unwrap();
+        let mut policy = egress::tests::pool_guard();
+        policy["scope"]["prefixes"]
+            .as_array_mut()
+            .unwrap()
+            .push(json!("10.250.0.0/16"));
+        let target = serde_json::from_value::<egress::Policy>(policy)
+            .unwrap()
+            .prepare()
+            .unwrap()
+            .into();
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        owner.detach(applied.clone()).unwrap();
+        assert_eq!(owner.inspect().state, "retained");
+        (owner, applied)
+    });
+    for ((destination, _, _), target) in cases.iter().zip(&targets) {
+        probe(&source, destination, target, false, false);
+        probe(&host, destination, target, false, true);
+    }
+    probe(&lan, "10.241.0.1:44003", &untracked_input, false, false);
+    for (sender, receiver) in [(&source, replies[6]), (&host, replies[7])] {
+        targets[3].send_to(b"after", receiver).unwrap();
+        assert!(sender.recv(&mut [0; 64]).is_err());
+    }
+    roundtrip(&source, &public);
+    roundtrip(&source, &host);
+    roundtrip(&host_pool, &public);
+    roundtrip(&host, &lan);
+    let fresh = socket(SOURCE, "10.240.0.2:10001");
+    roundtrip(&fresh, &public);
+    in_namespace(HOST, move || {
+        let mut owner = owner;
+        assert!(owner.inspect().enforced);
+        drop(owner);
+        Owner::new(options("pool_traffic")).unwrap().release(applied).unwrap();
+    });
+    // Positive control after release proves the denials were this guard.
+    for ((destination, _, _), target) in cases.iter().zip(&targets) {
+        probe(&source, destination, target, true, false);
+        probe(&host, destination, target, true, false);
+    }
+    println!("POOL_GUARD_PACKET_PROOF input=true forward=true output=true current_dnat=true original_dnat=true untracked=true reply_current_source=true established_and_fresh_public=true management_lan=true release_control=true allocation_reusable=false");
+}

package/rust/src/owner_tests.rs

@@ -21,6 +21,12 @@ mod packet_fixture;
 #[path = "owner_host_traffic_tests.rs"]
 mod host_traffic_tests;
 
+#[path = "owner_poolguard_tests.rs"]
+mod poolguard_tests;
+
+#[path = "owner_detach_tests.rs"]
+mod detach_tests;
+
 #[path = "owner_coexistence_tests.rs"]
 mod coexistence_tests;
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '1.6.0',
+  version: '1.8.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/classes.managednftables.ts

@@ -50,6 +50,9 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
   #work: Promise<unknown> | null = null;
   #close: Promise<void> | null = null;
   #nativeMayOwn = false;
+  #retaining = false;
+  #detachExpected: IAppliedManagedNftPolicy<TPolicy> | null = null;
+  #detach: Promise<{ detached: true }> | null = null;
 
   constructor(options: IManagedNftOptions) {
     this.#options = snapshot(options);
@@ -68,7 +71,7 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
 
   /** Starts only the compiler/IPC owner. The returned idle status is not enforcement. */
   public start(): Promise<IManagedNftStatus<TPolicy>> {
-    if (this.#state !== 'new') return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
+    if (this.#state !== 'new' || this.#retaining) return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
     this.#state = 'starting';
     const work = (async () => {
       if (process.platform !== 'linux' || !['x64', 'arm64'].includes(process.arch)) throw new ManagedNftablesError('UNSUPPORTED_PLATFORM');
@@ -80,7 +83,7 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
         cliArgs: ['--management', ...(this.#options.networkNamespaceFd === undefined ? [] : ['--network-namespace-fd', '3'])],
         inheritedFileDescriptors: this.#options.networkNamespaceFd === undefined ? undefined : [this.#options.networkNamespaceFd],
         readyTimeoutMs: 3000, requestTimeoutMs: 30_000, maxPayloadSize: 262_144,
-        maxPendingRequestsByMethod: { preparePolicy: 1, openOwner: 1, reconcilePolicy: 1, inspectPolicy: 1, releasePolicy: 1, closeOwner: 1 },
+        maxPendingRequestsByMethod: { preparePolicy: 1, openOwner: 1, reconcilePolicy: 1, inspectPolicy: 1, releasePolicy: 1, detachPolicy: 1, closeOwner: 1 },
       });
       this.#bridge.on('exit', () => {
         if (!['closing', 'stopped'].includes(this.#state)) this.#state = 'failed-owned';
@@ -105,15 +108,42 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
     return this.#invoke('releasePolicy', expected);
   }
 
-  /** Join policy operations and owned-table deletion, then native termination; packet/allocation fencing belongs to the caller. */
+  /** Permanently selects retention cleanup, verifies exact PERSIST retention, and
+   * joins the native process. Retain the full applied value before this call.
+   * After any failure close() only terminates; it never deletes the table. */
+  public detach(expected: IAppliedManagedNftPolicy<TPolicy>): Promise<{ detached: true }> {
+    this.#retaining = true;
+    let captured: IAppliedManagedNftPolicy<TPolicy>;
+    try {
+      captured = snapshot(expected);
+      if (this.#detachExpected && !plugins.util.isDeepStrictEqual(this.#detachExpected, captured)) throw new ManagedNftablesError('CONFLICT');
+      if (this.#detach) return this.#detach;
+      if (!['ready', 'failed-owned'].includes(this.#state) || !this.#bridge || this.#work || this.#close) throw new ManagedNftablesError('UNAVAILABLE');
+      this.#detachExpected = captured;
+    } catch (error) { return Promise.reject(error instanceof ManagedNftablesError ? error : new ManagedNftablesError('INVALID')); }
+    const work = this.#track(this.#bridge.sendCommand('detachPolicy', captured).then((value) => {
+      const result = snapshot(value);
+      if (result?.detached !== true || Object.keys(result).length !== 1) throw new ManagedNftablesError('PROTOCOL');
+      this.#nativeMayOwn = false;
+      return result;
+    }));
+    const detached = (async () => { const result = await work; await this.close(); return result; })();
+    this.#detach = detached;
+    void detached.catch(() => { this.#detach = null; });
+    return detached;
+  }
+
+  /** Join policy operations, then delete and terminate unless detach selected retention.
+   * Packet/allocation fencing belongs to the caller; already-admitted close cannot be undone. */
   public close(): Promise<void> {
     if (this.#close) return this.#close;
     if (this.#state === 'stopped') return Promise.resolve();
+    const retaining = this.#retaining;
     this.#state = 'closing';
     this.#close = (async () => {
       await this.#work?.catch(() => undefined);
       if (this.#bridge) {
-        if (this.#nativeMayOwn) {
+        if (this.#nativeMayOwn && !retaining) {
           const result = await this.#bridge.sendCommand('closeOwner', {});
           if (result.released !== true) throw new ManagedNftablesError('PROTOCOL');
         }
@@ -128,7 +158,7 @@ export class ManagedNftables<TPolicy extends TManagedNftPolicy = IManagedNftPoli
   }
 
   #invoke<K extends keyof TManagedNftCommands<TPolicy>>(method: K, params: TManagedNftCommands<TPolicy>[K]['params']): Promise<TManagedNftCommands<TPolicy>[K]['result']> {
-    if (!['ready', 'failed-owned'].includes(this.#state) || !this.#bridge || this.#work) return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
+    if (this.#retaining || !['ready', 'failed-owned'].includes(this.#state) || !this.#bridge || this.#work) return Promise.reject(new ManagedNftablesError('UNAVAILABLE'));
     let captured: TManagedNftCommands<TPolicy>[K]['params'];
     try { captured = snapshot(params); } catch { return Promise.reject(new ManagedNftablesError('INVALID')); }
     if (method === 'reconcilePolicy' || method === 'releasePolicy') this.#nativeMayOwn = true;

package/ts/managed.egress.types.ts

@@ -78,8 +78,17 @@ export interface IManagedNftHostTransitScopeV2 {
   snatAddress: string;
 }
 
+/** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
+ * This has no link dependency or allow grants. It is not allocation-release or boot-order proof. */
+export interface IManagedNftAllocationPoolGuardScopeV2 {
+  kind: 'allocationPoolGuard';
+  authorityDigest: string;
+  /** Complete current pool list: 1–64 canonical, disjoint RFC1918 prefixes. */
+  prefixes: string[];
+}
+
 export interface IManagedNftPolicyV2 {
   schemaVersion: 2;
   revision: number;
-  scope: IManagedNftRouterEgressScopeV2 | IManagedNftHostTransitScopeV2;
+  scope: IManagedNftRouterEgressScopeV2 | IManagedNftHostTransitScopeV2 | IManagedNftAllocationPoolGuardScopeV2;
 }

package/ts/managed.types.ts

@@ -62,7 +62,7 @@ export interface IManagedNftTransition<TPolicy extends TManagedNftPolicy = IMana
 
 export interface IManagedNftStatus<TPolicy extends TManagedNftPolicy = IManagedNftPolicy> {
   identity: IManagedNftIdentity;
-  state: 'idle' | 'applied' | 'failed-owned' | 'released';
+  state: 'idle' | 'applied' | 'failed-owned' | 'released' | 'retained';
   enforced: boolean;
   applied: IAppliedManagedNftPolicy<TPolicy> | null;
   pending: IManagedNftTransition<TPolicy> | null;
@@ -91,5 +91,6 @@ export type TManagedNftCommands<TPolicy extends TManagedNftPolicy = IManagedNftP
   reconcilePolicy: { params: IManagedNftTransition<TPolicy>; result: IAppliedManagedNftPolicy<TPolicy> };
   inspectPolicy: { params: Record<string, never>; result: IManagedNftStatus<TPolicy> };
   releasePolicy: { params: IAppliedManagedNftPolicy<TPolicy>; result: { released: true } };
+  detachPolicy: { params: IAppliedManagedNftPolicy<TPolicy>; result: { detached: true } };
   closeOwner: { params: Record<string, never>; result: { released: true } };
 };