@push.rocks/smartnftables 2.1.0 → 2.3.0

package/rust/src/owner_host_traffic_tests.rs

@@ -1,7 +1,10 @@
 use super::egress_traffic_tests::{connect, denied, host_policy, ns_ip, roundtrip, socket};
 use super::*;
+use crate::egress;
 use crate::policy::{compare, expr, meta};
-use std::net::UdpSocket;
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream, UdpSocket};
+use std::time::Duration;
 
 const SOURCE: &str = "hs_source";
 const HOST: &str = "hs_host";
@@ -297,3 +300,223 @@ fn v2_host_rejects_foreign_dnat_zone_local_diversion_and_ipv6() {
     });
     println!("V2_HOST_PROOF original_protected_dnat_denied=true current_protected_dnat_denied=true nonzero_zone_denied=true input_diversion_denied=true output_spoof_denied=true ipv6_forward_denied=true unleased_port_denied=true exact_platform_allowed=true positive_controls=true");
 }
+
+const PUBLISH_SOURCE: &str = "hp_source";
+const PUBLISH_HOST: &str = "hp_host";
+const PUBLISH_PEER: &str = "hp_peer";
+
+fn chain_names(owner: &mut Owner) -> Vec<String> {
+    owner
+        .graph()
+        .unwrap()
+        .expect("owned table present")
+        .chains
+        .iter()
+        .map(|chain| wire::text(chain, 3).unwrap())
+        .collect()
+}
+/// Inbound publication through the uplink: the workload must observe the actual
+/// client address, and the client must observe the published address back.
+fn published_udp(client: &UdpSocket, workload: &UdpSocket, published: &str, client_address: &str) {
+    let mut bytes = [0; 64];
+    assert_eq!(client.send_to(b"query", published).unwrap(), 5);
+    let (size, observed) = workload.recv_from(&mut bytes).expect("published delivery");
+    assert_eq!(&bytes[..size], b"query");
+    assert_eq!(observed.to_string(), client_address);
+    assert_eq!(workload.send_to(b"reply", observed).unwrap(), 5);
+    let (size, from) = client.recv_from(&mut bytes).expect("published reply");
+    assert_eq!(&bytes[..size], b"reply");
+    assert_eq!(from.to_string(), published);
+}
+fn dark_udp(client: &UdpSocket, workload: &UdpSocket, published: &str) {
+    assert_eq!(client.send_to(b"query", published).unwrap(), 5);
+    assert!(workload.recv(&mut [0; 64]).is_err());
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_publishes_exact_uplink_ports_and_removes_them_with_the_generation() {
+    isolated();
+    for name in [PUBLISH_SOURCE, PUBLISH_HOST, PUBLISH_PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        PUBLISH_SOURCE,
+        "source",
+        "10.240.0.2/30",
+        PUBLISH_HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        PUBLISH_HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PUBLISH_PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(PUBLISH_SOURCE, &["route", "add", "default", "via", "10.240.0.1"]);
+    ns_ip(PUBLISH_PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    let workload_udp = socket(PUBLISH_SOURCE, "10.240.0.2:8125");
+    let workload_direct = socket(PUBLISH_SOURCE, "10.240.0.2:8444");
+    let workload_unpublished = socket(PUBLISH_SOURCE, "10.240.0.2:9999");
+    // Every probe uses its own client port: an unreplied conntrack entry would
+    // otherwise carry its null translation across the policy change.
+    let control_client = socket(PUBLISH_PEER, "192.0.2.3:40010");
+    let client_udp = socket(PUBLISH_PEER, "192.0.2.3:40000");
+    // Positive controls: without policy the workload is reachable directly, and
+    // the published address is not, so every later result is caused by the policy.
+    control(&control_client, "10.240.0.2:8444", &workload_direct, true);
+    dark_udp(
+        &socket(PUBLISH_PEER, "192.0.2.3:40011"),
+        &workload_udp,
+        "192.0.2.2:8125",
+    );
+    let (owner, applied, published_policy, names) = in_namespace(PUBLISH_HOST, || {
+        let mut policy = host_policy();
+        let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+            panic!()
+        };
+        scope.published_ports = vec![
+            egress::PublishedPort {
+                protocol: "tcp".into(),
+                host_port: 443,
+                target_port: 8443,
+                target_address: "10.240.0.2".into(),
+                host_ip: "192.0.2.2".into(),
+            },
+            egress::PublishedPort {
+                protocol: "udp".into(),
+                host_port: 8125,
+                target_port: 8125,
+                target_address: "10.240.0.2".into(),
+                host_ip: "192.0.2.2".into(),
+            },
+        ];
+        let mut owner = Owner::new(options("host_published")).unwrap();
+        let target: Prepared = policy.clone().prepare().unwrap().into();
+        target
+            .validate_interfaces()
+            .expect("published host fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        let names = chain_names(&mut owner);
+        (owner, applied, policy, names)
+    });
+    assert!(names.contains(&"pre".to_string()));
+    // The fixture observes ingress only, so the translated opening is read where
+    // it arrives: the workload side of the handoff.
+    let observer = in_namespace(PUBLISH_SOURCE, || packet_fixture::PacketSocket::open("source"));
+    published_udp(&client_udp, &workload_udp, "192.0.2.2:8125", "192.0.2.3:40000");
+    let listener = in_namespace(PUBLISH_SOURCE, || {
+        TcpListener::bind("10.240.0.2:8443").unwrap()
+    });
+    let mut client = in_namespace(PUBLISH_PEER, || {
+        TcpStream::connect_timeout(&"192.0.2.2:443".parse().unwrap(), Duration::from_secs(1))
+            .expect("published tcp opening")
+    });
+    let (mut server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.ip().to_string(), "192.0.2.3");
+    assert_eq!(client.peer_addr().unwrap().to_string(), "192.0.2.2:443");
+    for stream in [&client, &server] {
+        stream.set_read_timeout(Some(Duration::from_secs(1))).unwrap();
+    }
+    client.write_all(b"ping").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"pong").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    // The translated opening is observable on the handoff, with the actual client
+    // address preserved and SYN only.
+    let syn = observer
+        .matching(|packet| {
+            packet.len() >= 40
+                && packet[9] == 6
+                && packet[16..20] == [10, 240, 0, 2]
+                && packet[22..24] == 8443_u16.to_be_bytes()
+                && packet[33] & 0x17 == 0x02
+        })
+        .expect("translated opening on the handoff");
+    assert_eq!(syn[12..16], [192, 0, 2, 3]);
+    // An opening that is not SYN cannot acquire the publication.
+    let injector = in_namespace(PUBLISH_PEER, || {
+        packet_fixture::PacketSocket::open("underlay")
+    });
+    let uplink_mac = in_namespace(PUBLISH_HOST, || packet_fixture::mac("uplink"));
+    for (port, flags) in [(40050_u16, 0x10_u8), (40051, 0x04), (40052, 0x12)] {
+        injector.send(
+            uplink_mac,
+            &packet_fixture::tcp([192, 0, 2, 3], [192, 0, 2, 2], port, 443, flags),
+        );
+        // The exact injected flow, never the live connection's own acknowledgements.
+        assert!(
+            observer
+                .matching(|packet| packet.len() >= 40
+                    && packet[9] == 6
+                    && packet[16..20] == [10, 240, 0, 2]
+                    && packet[20..22] == port.to_be_bytes()
+                    && packet[22..24] == 8443_u16.to_be_bytes()
+                    && packet[24..28] == 100_u32.to_be_bytes()
+                    && packet[33] == flags)
+                .is_none(),
+            "{flags:#04x}"
+        );
+    }
+    // The capture barrier still denies every unpublished path to the workload.
+    control(&control_client, "10.240.0.2:8444", &workload_direct, false);
+    let unpublished_client = socket(PUBLISH_PEER, "192.0.2.3:40002");
+    dark_udp(&unpublished_client, &workload_unpublished, "192.0.2.2:9999");
+    assert!(in_namespace(PUBLISH_PEER, || TcpStream::connect_timeout(
+        &"192.0.2.2:444".parse().unwrap(),
+        Duration::from_secs(1)
+    ))
+    .is_err());
+    drop(client);
+    drop(server);
+    // Withdrawing the publication is an ordinary generation replacement.
+    let (mut owner, rolled_back, names) = in_namespace(PUBLISH_HOST, {
+        let mut owner = owner;
+        move || {
+            let mut withdrawn = published_policy;
+            withdrawn.revision = 2;
+            let egress::Scope::HostTransit(scope) = &mut withdrawn.scope else {
+                panic!()
+            };
+            scope.published_ports.clear();
+            let applied = owner
+                .reconcile(Transition {
+                    previous: Some(applied),
+                    target: withdrawn.prepare().unwrap().into(),
+                })
+                .unwrap();
+            assert!(owner.inspect().enforced);
+            let names = chain_names(&mut owner);
+            (owner, applied, names)
+        }
+    });
+    assert!(!names.contains(&"pre".to_string()));
+    let dark_client = socket(PUBLISH_PEER, "192.0.2.3:40003");
+    dark_udp(&dark_client, &workload_udp, "192.0.2.2:8125");
+    assert!(in_namespace(PUBLISH_PEER, || TcpStream::connect_timeout(
+        &"192.0.2.2:443".parse().unwrap(),
+        Duration::from_secs(1)
+    ))
+    .is_err());
+    control(&control_client, "10.240.0.2:8444", &workload_direct, false);
+    in_namespace(PUBLISH_HOST, move || {
+        assert!(owner.inspect().enforced);
+        owner.release(rolled_back).unwrap();
+    });
+    let released_client = socket(PUBLISH_PEER, "192.0.2.3:40004");
+    dark_udp(&released_client, &workload_udp, "192.0.2.2:8125");
+    println!("V2_HOST_PUBLISHED_PROOF udp_published_delivered=true tcp_published_delivered=true client_address_preserved=true reverse_translation=true syn_only_opening=true nonsyn_opening_denied=true unpublished_workload_port_denied=true unpublished_uplink_port_denied=true barrier_positive_control=true withdrawn_chain_absent=true withdrawn_port_dark=true released_port_dark=true");
+}

package/rust/src/owner_identity_tests.rs

@@ -167,3 +167,40 @@ fn egress_identity_rejects_unknown_duplicate_or_incomplete_operands() {
         assert!(rule_identity(&rule(vec![expression(name, extra)])).is_err());
     }
 }
+
+/// A published host-transit generation must survive the same apply-time graph
+/// identity as the rest of the table: the kernel dump is compared operand by
+/// operand, so destination NAT and its admissions cannot be silently rewritten.
+#[test]
+fn published_host_graph_identity_preserves_destination_nat_and_admission_operands() {
+    let compiled = |target_port: u16| {
+        let value = crate::egress::tests::published_host(serde_json::json!([
+            crate::egress::tests::published_port("tcp", 443, target_port)
+        ]));
+        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
+            .unwrap()
+            .prepare()
+            .unwrap();
+        let mut chains = Vec::new();
+        let mut rules = Vec::new();
+        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
+            if kind == 3 {
+                chains.push(super::chain_identity(&attributes).unwrap());
+            } else {
+                rules.push(rule_identity(&attributes).unwrap());
+            }
+        }
+        (chains, rules)
+    };
+    let (chains, rules) = compiled(8443);
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    assert_eq!(chains.len(), 7);
+    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
+    let (_, changed) = compiled(9443);
+    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
+    assert_ne!(translation.1, other.1);
+    assert_eq!(
+        rules.iter().filter(|(chain, _)| chain == "forward").count(),
+        changed.iter().filter(|(chain, _)| chain == "forward").count()
+    );
+}

package/rust/src/owner_tests.rs

@@ -27,6 +27,9 @@ mod poolguard_tests;
 #[path = "owner_detach_tests.rs"]
 mod detach_tests;
 
+#[path = "owner_transitionrelease_tests.rs"]
+mod transitionrelease_tests;
+
 #[path = "owner_coexistence_tests.rs"]
 mod coexistence_tests;
 

package/rust/src/owner_transitionrelease_tests.rs

@@ -0,0 +1,327 @@
+use super::namespace_tests::NativeOwner;
+use super::*;
+use serde_json::json;
+use std::io::Write;
+use std::time::{Duration, Instant};
+
+fn target(revision: u64) -> Prepared {
+    let mut policy = crate::egress::tests::pool_guard();
+    policy["revision"] = json!(revision);
+    serde_json::from_value::<crate::egress::Policy>(policy)
+        .unwrap()
+        .prepare()
+        .unwrap()
+        .into()
+}
+fn request(owner: &Owner, transition: Transition) -> TransitionRelease {
+    TransitionRelease {
+        identity: owner.identity.clone(),
+        transition,
+    }
+}
+
+#[test]
+fn transition_release_validates_closed_identity_and_body_before_admission() {
+    let mut owner = Owner::new(options("release_input")).unwrap();
+    let command = request(
+        &owner,
+        Transition {
+            previous: None,
+            target: target(1),
+        },
+    );
+    for field in ["bootId", "namespaceDevice", "namespaceInode", "instanceId"] {
+        let mut invalid = serde_json::to_value(&command).unwrap();
+        invalid["identity"][field] = json!("invalid");
+        assert_eq!(
+            owner.release_transition(serde_json::from_value(invalid).unwrap()),
+            Err(Error::Conflict)
+        );
+        assert!(owner.transition_release.is_none());
+    }
+    let mut invalid = command.clone();
+    invalid.transition.target.digest = format!("sha256:{}", "0".repeat(64));
+    assert!(owner.release_transition(invalid).is_err());
+    assert!(owner.transition_release.is_none());
+    for pointer in ["", "/identity", "/transition", "/transition/target"] {
+        let mut invalid = serde_json::to_value(&command).unwrap();
+        invalid.pointer_mut(pointer).unwrap()["extra"] = json!(true);
+        assert!(serde_json::from_value::<TransitionRelease>(invalid).is_err());
+    }
+    let mut invalid = serde_json::to_value(&command).unwrap();
+    invalid["transition"]
+        .as_object_mut()
+        .unwrap()
+        .remove("previous");
+    assert!(serde_json::from_value::<TransitionRelease>(invalid).is_err());
+    assert!(owner.socket.is_none());
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn release_original_transition_after_interfaces_disappear_never_recreates_policy() {
+    isolated();
+    for replacement in [false, true] {
+        for delivered in [false, true] {
+            let endpoint = endpoint("a", 72);
+            let policy = crate::policy::Policy {
+                schema_version: 1,
+                revision: 1,
+                endpoints: vec![endpoint],
+                rules: vec![],
+            };
+            let mut owner = Owner::new(options("release_links")).unwrap();
+            let previous = replacement.then(|| {
+                owner
+                    .reconcile(Transition {
+                        previous: None,
+                        target: policy.clone().prepare().unwrap().into(),
+                    })
+                    .unwrap()
+            });
+            let mut next = policy;
+            if replacement {
+                next.revision = 2;
+            }
+            let command = request(
+                &owner,
+                Transition {
+                    previous,
+                    target: next.prepare().unwrap().into(),
+                },
+            );
+            if delivered {
+                owner.reconcile(command.transition.clone()).unwrap();
+            }
+            // Only the original command crosses this process boundary.
+            drop(owner);
+            ip(&["link", "del", "worka"]);
+            ip(&["netns", "del", "a"]);
+            let mut fresh = Owner::new(options("release_links")).unwrap();
+            assert!(fresh.reconcile(command.transition.clone()).is_err());
+            if replacement && delivered {
+                // Model a retained native pending command after an ambiguous batch.
+                fresh.pending = Some(command.transition.clone());
+            }
+            fresh.release_transition(command.clone()).unwrap();
+            let status = fresh.inspect();
+            assert_eq!(status.state, "released");
+            assert!(!status.enforced);
+            assert!(fresh.graph().unwrap().is_none());
+            fresh.release_transition(command.clone()).unwrap();
+            assert_eq!(
+                fresh.reconcile(command.transition.clone()),
+                Err(Error::Conflict)
+            );
+            let mut different = command;
+            different.transition.target = target(3);
+            assert_eq!(fresh.release_transition(different), Err(Error::Conflict));
+            fresh.close().unwrap();
+        }
+    }
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn release_transition_rejects_foreign_owner_and_keeps_exact_terminal_choice() {
+    isolated();
+    let mut active = Owner::new(options("release_foreign")).unwrap();
+    let command = request(
+        &active,
+        Transition {
+            previous: None,
+            target: target(1),
+        },
+    );
+    let applied = active.reconcile(command.transition.clone()).unwrap();
+    let mut fresh = Owner::new(options("release_foreign")).unwrap();
+    assert_eq!(
+        fresh.release_transition(command.clone()),
+        Err(Error::ForeignOwner)
+    );
+    assert_eq!(fresh.inspect().state, "failed-owned");
+    assert!(!fresh.inspect().enforced);
+    assert_eq!(
+        fresh.reconcile(command.transition.clone()),
+        Err(Error::Conflict)
+    );
+    assert_eq!(fresh.detach(applied.clone()), Err(Error::Conflict));
+    assert_eq!(fresh.release(applied), Err(Error::Conflict));
+    assert!(active.inspect().enforced);
+    drop(active);
+    // close may retry only the already-selected exact release operation.
+    fresh.close().unwrap();
+    assert!(fresh.graph().unwrap().is_none());
+    fresh.release_transition(command).unwrap();
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn release_transition_binds_previous_handle_and_complete_graph() {
+    isolated();
+    for fault in ["handle", "body", "pending"] {
+        let mut active = Owner::new(options("release_binding")).unwrap();
+        let previous = active
+            .reconcile(Transition {
+                previous: None,
+                target: target(1),
+            })
+            .unwrap();
+        let command = request(
+            &active,
+            Transition {
+                previous: Some(previous.clone()),
+                target: target(2),
+            },
+        );
+        drop(active);
+        let mut fresh = Owner::new(options("release_binding")).unwrap();
+        let mut invalid = command.clone();
+        if fault == "handle" {
+            invalid
+                .transition
+                .previous
+                .as_mut()
+                .unwrap()
+                .receipt
+                .table_handle = "18446744073709551615".into();
+        } else if fault == "pending" {
+            fresh.pending = Some(Transition {
+                previous: Some(previous.clone()),
+                target: target(3),
+            });
+        } else {
+            let mut foreign = Socket::open().unwrap();
+            let generation = foreign.generation().unwrap();
+            foreign
+                .batch(
+                    generation,
+                    vec![(
+                        3,
+                        0x600,
+                        vec![
+                            Attr::string(1, "snft_release_binding"),
+                            Attr::string(3, "foreign"),
+                        ],
+                    )],
+                )
+                .unwrap();
+        }
+        assert_eq!(fresh.release_transition(invalid), Err(Error::Conflict));
+        assert!(fresh.graph().unwrap().is_some());
+        assert!(!fresh.inspect().enforced);
+        drop(fresh);
+        // Disposable fixture cleanup never enters the production API.
+        let mut cleanup = Socket::open().unwrap();
+        let generation = cleanup.generation().unwrap();
+        cleanup
+            .batch(
+                generation,
+                vec![(2, 0, vec![Attr::string(1, "snft_release_binding")])],
+            )
+            .unwrap();
+    }
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn release_transition_retry_never_deletes_a_replacement_for_its_observed_handle() {
+    isolated();
+    let mut owner = Owner::new(options("release_replaced")).unwrap();
+    let command = request(
+        &owner,
+        Transition {
+            previous: None,
+            target: target(1),
+        },
+    );
+    let first = owner.reconcile(command.transition.clone()).unwrap();
+    // Stop at the exact production boundary after deletion, before its final
+    // observation. Retained state must still bind the handle already acquired.
+    owner.transition_release = Some(command.clone());
+    let graph = owner.graph().unwrap().unwrap();
+    owner
+        .socket()
+        .unwrap()
+        .batch(
+            graph.generation,
+            vec![(
+                2,
+                0,
+                vec![Attr::u64(4, wire::handle(&graph.table, 4).unwrap())],
+            )],
+        )
+        .unwrap();
+    let mut replacement = Owner::new(options("release_replaced")).unwrap();
+    let second = replacement.reconcile(command.transition.clone()).unwrap();
+    assert_ne!(first.receipt.table_handle, second.receipt.table_handle);
+    drop(replacement);
+    assert_eq!(owner.release_transition(command), Err(Error::Conflict));
+    let graph = owner.graph().unwrap().unwrap();
+    assert_eq!(
+        wire::handle(&graph.table, 4).unwrap().to_string(),
+        second.receipt.table_handle
+    );
+    assert_eq!(owner.applied, Some(first));
+    assert!(!owner.inspect().enforced);
+    drop(owner);
+    Owner::new(options("release_replaced"))
+        .unwrap()
+        .release(second)
+        .unwrap();
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn release_transition_recovers_lost_delete_ack_across_actual_native_processes() {
+    isolated();
+    let namespace = std::fs::File::open("/proc/thread-self/ns/net").unwrap();
+    let mut native = NativeOwner::start(&namespace);
+    let status = native.call(
+        "openOwner",
+        serde_json::to_value(options("release_ack")).unwrap(),
+    );
+    let command = TransitionRelease {
+        identity: serde_json::from_value(status["identity"].clone()).unwrap(),
+        transition: Transition {
+            previous: None,
+            target: target(1),
+        },
+    };
+    native.call(
+        "reconcilePolicy",
+        serde_json::to_value(&command.transition).unwrap(),
+    );
+    writeln!(
+        native.child.stdin.as_mut().unwrap(),
+        "{}",
+        json!({
+            "id":"lost-release", "method":"releasePolicyTransition", "params":command,
+        })
+    )
+    .unwrap();
+    let mut observer = Owner::new(options("release_ack")).unwrap();
+    let until = Instant::now() + Duration::from_secs(3);
+    while observer.graph().unwrap().is_some() {
+        assert!(Instant::now() < until);
+        std::thread::sleep(Duration::from_millis(5));
+    }
+    // Never read or retain the release response.
+    drop(native);
+    let mut fresh = NativeOwner::start(&namespace);
+    fresh.call(
+        "openOwner",
+        serde_json::to_value(options("release_ack")).unwrap(),
+    );
+    assert_eq!(
+        fresh.call(
+            "releasePolicyTransition",
+            serde_json::to_value(&command).unwrap()
+        ),
+        json!({"released":true})
+    );
+    let status = fresh.call("inspectPolicy", json!({}));
+    assert_eq!(status["state"], "released");
+    assert_eq!(status["enforced"], false);
+    assert!(observer.graph().unwrap().is_none());
+}

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '2.1.0',
+  version: '2.3.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }