@push.rocks/smartnftables 2.1.0 → 2.3.0

package/rust/src/egress.rs

@@ -110,6 +110,15 @@ pub struct HostHandoff {
     pub link: LocalLink,
     pub allocations: Vec<Allocation>,
 }
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PublishedPort {
+    pub protocol: String,
+    pub host_port: u16,
+    pub target_port: u16,
+    pub target_address: String,
+    pub host_ip: String,
+}
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct HostScope {
@@ -117,6 +126,10 @@ pub struct HostScope {
     pub handoffs: Vec<HostHandoff>,
     pub uplink: LocalLink,
     pub snat_address: String,
+    /// Absent and empty are the same canonical policy, so an unpublished scope
+    /// keeps its exact previous digest and compiled graph.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub published_ports: Vec<PublishedPort>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -556,6 +569,53 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     }
     Ok(())
 }
+/// Inbound publication is bounded by the same authority the scope already proves:
+/// an exact current uplink address, an exact leased transit source address, and no
+/// overlap with the leased outbound source ports translated to that same address.
+fn normalize_published(value: &mut HostScope) -> Result<()> {
+    let mut ports = std::mem::take(&mut value.published_ports);
+    require(ports.len() <= 64)?;
+    ports.sort();
+    for (index, port) in ports.iter().enumerate() {
+        require(
+            protocol(&port.protocol)
+                && port.host_port > 0
+                && port.target_port > 0
+                && (index == 0
+                    || ports[index - 1].protocol != port.protocol
+                    || ports[index - 1].host_port != port.host_port),
+        )?;
+        // rtnetlink verifies this exact uplink address at apply, recovery and
+        // inspection. No wildcard, secondary-link or default-route inference.
+        require(value.uplink.required_ipv4_addresses.contains(&port.host_ip))?;
+        // Only a current leased transit source address can be published; that
+        // binding is what proves the exact handoff link of the forward admission.
+        require(
+            value
+                .handoffs
+                .iter()
+                .flat_map(|handoff| handoff.allocations.iter())
+                .any(|allocation| allocation.transit_source_address == port.target_address),
+        )?;
+        if port.host_ip == value.snat_address {
+            for handoff in &value.handoffs {
+                for allocation in &handoff.allocations {
+                    for range in &allocation.source_port_ranges {
+                        // Outer SNAT translates to this same address, so a published
+                        // port inside a leased outbound range is a translation conflict.
+                        require(
+                            range.protocol != port.protocol
+                                || port.host_port < range.first
+                                || port.host_port > range.last,
+                        )?;
+                    }
+                }
+            }
+        }
+    }
+    value.published_ports = ports;
+    Ok(())
+}
 fn normalize_host(value: &mut HostScope) -> Result<()> {
     normalize_protection(&mut value.protection)?;
     normalize_link(&mut value.uplink)?;
@@ -622,6 +682,7 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
             }
         }
     }
+    normalize_published(value)?;
     unique_links(
         value
             .handoffs

package/rust/src/egress_tests.rs

@@ -1,4 +1,4 @@
-use super::{Policy, Scope};
+use super::{Policy, Prepared, Scope};
 use serde_json::{json, Value};
 
 fn link(index: u32, name: &str, kind: &str, address: &str) -> Value {
@@ -483,3 +483,196 @@ fn allocation_pool_guard_maximum_fits_the_atomic_graph_without_link_bindings() {
     let excessive: Vec<_> = (0..65).map(|part| format!("10.{part}.0.0/16")).collect();
     assert!(normalized(changed(pool_guard(), "/scope/prefixes", json!(excessive))).is_err());
 }
+
+pub(crate) fn published_port(protocol: &str, host_port: u16, target_port: u16) -> Value {
+    json!({"protocol":protocol,"hostPort":host_port,"targetPort":target_port,
+        "targetAddress":"10.240.0.2","hostIp":"192.0.2.2"})
+}
+pub(crate) fn published_host(ports: Value) -> Value {
+    let mut value = host();
+    value["scope"]["publishedPorts"] = ports;
+    value
+}
+fn prepared(value: Value) -> Prepared {
+    normalized(value).unwrap().prepare().unwrap()
+}
+fn program_bytes(prepared: &Prepared, table: &str) -> Vec<u8> {
+    let mut bytes = Vec::new();
+    for (kind, attributes) in prepared.program(table).unwrap() {
+        let encoded = crate::wire::encode_attrs(&attributes);
+        bytes.extend(kind.to_be_bytes());
+        bytes.extend((encoded.len() as u32).to_be_bytes());
+        bytes.extend(encoded);
+    }
+    bytes
+}
+/// Chain names in creation order, then every rule as (chain, expression names).
+fn graph(prepared: &Prepared, table: &str) -> (Vec<String>, Vec<(String, Vec<String>)>) {
+    let mut chains = Vec::new();
+    let mut rules = Vec::new();
+    for (kind, attributes) in prepared.program(table).unwrap() {
+        assert_eq!(crate::wire::text(&attributes, 1).unwrap(), table);
+        if kind == 3 {
+            chains.push(crate::wire::text(&attributes, 3).unwrap());
+            continue;
+        }
+        let expressions = crate::wire::attrs(&crate::wire::one(&attributes, 4).unwrap().value).unwrap();
+        rules.push((
+            crate::wire::text(&attributes, 2).unwrap(),
+            expressions
+                .iter()
+                .map(|expression| {
+                    let fields = crate::wire::attrs(&expression.value).unwrap();
+                    crate::wire::text(&fields, 1).unwrap()
+                })
+                .collect(),
+        ));
+    }
+    (chains, rules)
+}
+
+#[test]
+fn host_v2_without_published_ports_keeps_its_exact_digest_and_compiled_bytes() {
+    use sha2::{Digest, Sha256};
+    let baseline = prepared(host());
+    // Frozen before the optional publication field existed.
+    assert_eq!(
+        baseline.digest,
+        "sha256:b24cd2bc4e812014cabd71a77f57a2fe085c4b83d4e7b7939ccfca28949c6848"
+    );
+    let bytes = program_bytes(&baseline, "snft_v2_host_golden");
+    assert_eq!(bytes.len(), 24932);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "91735de50a831184648bf79cd7a840f7af5264f3c6ec461f5412b3fc1d1ef6ec"
+    );
+    let serialized = serde_json::to_string(&baseline.policy).unwrap();
+    assert!(!serialized.contains("publishedPorts"));
+    // An explicit empty publication is the same canonical policy, digest and graph.
+    assert_eq!(prepared(published_host(json!([]))), baseline);
+    let (chains, rules) = graph(&baseline, "snft_v2_host_golden");
+    assert!(!chains.contains(&"pre".to_string()));
+    assert!(rules.iter().all(|(chain, _)| chain != "pre"));
+}
+
+#[test]
+fn host_v2_published_ports_compile_uplink_dnat_and_exact_forward_admission() {
+    use sha2::{Digest, Sha256};
+    let baseline = graph(&prepared(host()), "snft_v2_host_golden");
+    let value = published_host(json!([
+        published_port("tcp", 443, 8443),
+        published_port("udp", 8125, 8125)
+    ]));
+    let published = prepared(value.clone());
+    assert_ne!(published.digest, prepared(host()).digest);
+    // Publication order is canonical, so a reordered list is the same policy.
+    let mut reordered = value;
+    reordered["scope"]["publishedPorts"]
+        .as_array_mut()
+        .unwrap()
+        .reverse();
+    assert_eq!(prepared(reordered), published);
+    let (chains, rules) = graph(&published, "snft_v2_host_golden");
+    assert_eq!(chains.len(), baseline.0.len() + 1);
+    assert_eq!(chains.iter().filter(|name| *name == "pre").count(), 1);
+    assert_eq!(rules.len(), baseline.1.len() + 8);
+    let translations: Vec<_> = rules.iter().filter(|(chain, _)| chain == "pre").collect();
+    assert_eq!(translations.len(), 2);
+    for (_, expressions) in &translations {
+        assert_eq!(expressions.last().unwrap(), "nat");
+        assert_eq!(expressions.iter().filter(|name| *name == "immediate").count(), 2);
+    }
+    // The three admissions precede the capture barrier jumps of their handoff.
+    let forward: Vec<_> = rules
+        .iter()
+        .filter(|(chain, _)| chain == "forward")
+        .map(|(_, expressions)| expressions.len())
+        .collect();
+    assert_eq!(forward.len(), baseline.1.iter().filter(|(chain, _)| chain == "forward").count() + 6);
+    let (_, first) = rules.iter().find(|(chain, _)| chain == "forward").unwrap();
+    assert!(first.contains(&"ct".to_string()) && first.len() > 4);
+    let bytes = program_bytes(&published, "snft_v2_host_golden");
+    assert_eq!(bytes.len(), 36322);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "1d3485bb739ac3601642610eba465b80c9b5ac34df22a5374cfbc8773623710b"
+    );
+}
+
+#[test]
+fn host_v2_published_ports_are_owned_by_their_generation_and_leave_with_it() {
+    let published = prepared(published_host(json!([published_port("tcp", 443, 8443)])));
+    let rollback = prepared(host());
+    let (chains, rules) = graph(&published, "snft_v2_host_rollback");
+    assert!(chains.contains(&"pre".to_string()));
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    // Every operation names the owned table, and the rollback target compiles the
+    // same graph as before publication; reconcile deletes the complete previous
+    // graph and re-adds the target in one batch, so the publication cannot survive.
+    let (rollback_chains, rollback_rules) = graph(&rollback, "snft_v2_host_rollback");
+    assert!(!rollback_chains.contains(&"pre".to_string()));
+    assert!(rollback_rules.iter().all(|(chain, _)| chain != "pre"));
+    assert_eq!(rollback_chains.len() + 1, chains.len());
+    assert_eq!(rollback_rules.len() + 4, rules.len());
+    assert_ne!(published.digest, rollback.digest);
+}
+
+#[test]
+fn host_v2_published_ports_reject_unbound_targets_conflicts_and_out_of_range_ports() {
+    assert!(normalized(published_host(json!([published_port("tcp", 443, 8443)]))).is_ok());
+    let mut unknown = published_port("tcp", 443, 8443);
+    unknown["hostInterface"] = json!("ens18");
+    let mut second_address = published_host(json!([
+        changed(published_port("tcp", 443, 8443), "/hostIp", json!("192.0.2.5"))
+    ]));
+    second_address["scope"]["uplink"]["requiredIpv4Addresses"] = json!(["192.0.2.2", "192.0.2.5"]);
+    let mut duplicate_across_addresses = second_address.clone();
+    duplicate_across_addresses["scope"]["publishedPorts"]
+        .as_array_mut()
+        .unwrap()
+        .push(published_port("tcp", 443, 9443));
+    assert!(normalized(second_address).is_ok());
+    for invalid in [
+        published_host(json!([unknown])),
+        published_host(json!([published_port("sctp", 443, 8443)])),
+        published_host(json!([published_port("tcp", 0, 8443)])),
+        published_host(json!([published_port("tcp", 443, 0)])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostPort", json!(65536))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetPort", json!(65536))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostPort", json!(-1))])),
+        // The published address must be an exact current uplink address.
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostIp", json!("192.0.2.5"))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/hostIp", json!("10.240.0.1"))])),
+        // The target must be a current leased transit source address.
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetAddress", json!("10.240.0.3"))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetAddress", json!("10.240.0.1"))])),
+        published_host(json!([changed(published_port("tcp", 443, 8443), "/targetAddress", json!("192.0.2.2"))])),
+        // A published port cannot collide with the leased outbound SNAT ranges.
+        published_host(json!([published_port("tcp", 10500, 8443)])),
+        published_host(json!([published_port("udp", 10000, 8443)])),
+        // One protocol/port is published exactly once, including across addresses.
+        published_host(json!([published_port("tcp", 443, 8443), published_port("tcp", 443, 9443)])),
+        duplicate_across_addresses,
+        published_host(json!((0..65).map(|index| published_port("tcp", 20000 + index, 8443)).collect::<Vec<_>>())),
+    ] {
+        assert!(normalized(invalid).is_err());
+    }
+    // Bounded input still meets the atomic reserve first: every publication costs
+    // one translation and three admissions, so prepare rejects before any kernel work.
+    let ports = |count: u16| -> Value {
+        json!((0..count)
+            .map(|index| published_port("tcp", 20000 + index, 8443))
+            .collect::<Vec<_>>())
+    };
+    let prepared = prepared(published_host(ports(12)));
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let bytes: usize = program
+        .iter()
+        .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+        .sum();
+    assert!(program.len() <= 768 && bytes <= 100_000);
+    assert!(normalized(published_host(ports(13))).unwrap().prepare().is_err());
+    println!("PUBLISHED_MAX ports=12 operations={} bytes={bytes}", program.len());
+}

package/rust/src/main.rs

@@ -91,6 +91,10 @@ fn dispatch(owner: &mut Option<owner::Owner>, request: Request) -> Result<serde_
                 .release(decode(request.params)?)?;
             Ok(serde_json::json!({"released":true}))
         }
+        "releasePolicyTransition" => {
+            owner.as_mut().ok_or(Error::Conflict)?.release_transition(decode(request.params)?)?;
+            Ok(serde_json::json!({"released":true}))
+        }
         "detachPolicy" => {
             owner.as_mut().ok_or(Error::Conflict)?.detach(decode(request.params)?)?;
             Ok(serde_json::json!({"detached":true}))

package/rust/src/owner.detach.rs

@@ -5,7 +5,7 @@ impl Owner {
     /// orphan after an ACK was lost, including through a fresh native process.
     pub fn detach(&mut self, expected: Applied) -> Result<()> {
         self.validate_receipt(&expected)?;
-        if self.released || self.pending.is_some() {
+        if self.released || self.pending.is_some() || self.transition_release.is_some() {
             return Err(Error::Conflict);
         }
         if let Some(retention) = &self.retention {

package/rust/src/owner.rs

@@ -44,6 +44,12 @@ pub struct Transition {
     pub previous: Option<Applied>,
     pub target: Prepared,
 }
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TransitionRelease {
+    pub identity: Identity,
+    pub transition: Transition,
+}
 #[derive(Clone, Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct Status {
@@ -69,6 +75,7 @@ pub struct Owner {
     error: Option<Error>,
     released: bool,
     retention: Option<Retention>,
+    transition_release: Option<TransitionRelease>,
 }
 
 struct Retention {
@@ -78,6 +85,8 @@ struct Retention {
 
 #[path = "owner.detach.rs"]
 mod detach;
+#[path = "owner.transitionrelease.rs"]
+mod transitionrelease;
 
 pub(crate) fn context() -> Result<(String, String, String)> {
     let boot = std::fs::read_to_string("/proc/sys/kernel/random/boot_id")
@@ -164,6 +173,7 @@ impl Owner {
             error: None,
             released: false,
             retention: None,
+            transition_release: None,
         })
     }
     fn socket(&mut self) -> Result<&mut Socket> {
@@ -360,7 +370,7 @@ impl Owner {
         })
     }
     pub fn reconcile(&mut self, transition: Transition) -> Result<Applied> {
-        if self.released || self.retention.is_some() {
+        if self.released || self.retention.is_some() || self.transition_release.is_some() {
             return Err(Error::Conflict);
         }
         transition.target.validate()?;
@@ -463,6 +473,9 @@ impl Owner {
         self.applied(&graph, transition.target.clone())
     }
     pub fn inspect(&mut self) -> Status {
+        if self.transition_release.is_some() {
+            return self.inspect_transition_release();
+        }
         if self.retention.is_some() {
             return self.inspect_retained();
         }
@@ -503,7 +516,7 @@ impl Owner {
         }
     }
     pub fn release(&mut self, expected: Applied) -> Result<()> {
-        if self.retention.is_some() {
+        if self.retention.is_some() || self.transition_release.is_some() {
             return Err(Error::Conflict);
         }
         self.validate_receipt(&expected)?;
@@ -561,6 +574,9 @@ impl Owner {
         }
     }
     pub fn close(&mut self) -> Result<()> {
+        if let Some(request) = self.transition_release.clone() {
+            return self.release_transition(request);
+        }
         if self.retention.is_some() {
             return Err(Error::Conflict);
         }

package/rust/src/owner.transitionrelease.rs

@@ -0,0 +1,107 @@
+use super::*;
+
+impl Owner {
+    /// Terminal cleanup of an exact caller-retained transition. Unlike reconcile,
+    /// this never creates/replaces policy and does not require surviving interfaces.
+    pub fn release_transition(&mut self, request: TransitionRelease) -> Result<()> {
+        if self.retention.is_some() || request.identity != self.identity {
+            return Err(Error::Conflict);
+        }
+        request.transition.target.validate()?;
+        if let Some(previous) = &request.transition.previous {
+            self.validate_receipt(previous)?;
+            if previous.prepared.policy.kind() != request.transition.target.policy.kind()
+                || previous.prepared.policy.revision()
+                    >= request.transition.target.policy.revision()
+            {
+                return Err(Error::Conflict);
+            }
+        }
+        if let Some(selected) = &self.transition_release {
+            if selected != &request {
+                return Err(Error::Conflict);
+            }
+            if self.released {
+                return Ok(());
+            }
+        } else {
+            if self.released
+                || self
+                    .pending
+                    .as_ref()
+                    .is_some_and(|pending| pending != &request.transition)
+                || self.applied.as_ref().is_some_and(|applied| {
+                    Some(applied) != request.transition.previous.as_ref()
+                        && applied.prepared != request.transition.target
+                })
+            {
+                return Err(Error::Conflict);
+            }
+            // Capture terminal intent before any query, ownership claim or delete.
+            self.transition_release = Some(request.clone());
+        }
+        let result = self.release_transition_inner(&request.transition);
+        match result {
+            Ok(()) => {
+                self.released = true;
+                self.pending = None;
+                self.error = None;
+                self.socket = None;
+                Ok(())
+            }
+            Err(error) => {
+                self.error = Some(error);
+                Err(error)
+            }
+        }
+    }
+
+    fn release_transition_inner(&mut self, transition: &Transition) -> Result<()> {
+        let Some(graph) = self.graph()? else {
+            return Ok(());
+        };
+        // Also bind any handle this process already observed before an ambiguous
+        // delete. A replacement under the same name must never inherit authority.
+        if let Some(applied) = &self.applied {
+            self.binding(&graph, Some(applied))?;
+        }
+        let graph = self.adopt(graph, transition)?;
+        let prepared = if self.matches(&graph, &transition.target)? {
+            transition.target.clone()
+        } else {
+            transition
+                .previous
+                .as_ref()
+                .ok_or(Error::Conflict)?
+                .prepared
+                .clone()
+        };
+        self.applied = Some(self.applied(&graph, prepared)?);
+        self.socket()?.batch(
+            graph.generation,
+            vec![(2, 0, vec![Attr::u64(4, wire::handle(&graph.table, 4)?)])],
+        )?;
+        if self.graph()?.is_some() {
+            return Err(Error::Conflict);
+        }
+        Ok(())
+    }
+
+    pub(super) fn inspect_transition_release(&self) -> Status {
+        // Cleanup intent cannot grant enforcement, including after a failed
+        // attempt that acquired OWNER on an otherwise valid persistent graph.
+        Status {
+            identity: self.identity.clone(),
+            state: if self.released {
+                "released"
+            } else {
+                "failed-owned"
+            }
+            .into(),
+            enforced: false,
+            applied: self.applied.clone(),
+            pending: self.pending.clone(),
+            error: self.error.map(|error| error.code().into()),
+        }
+    }
+}