@push.rocks/smartnftables 2.2.0 → 2.4.0

package/rust/src/egress.rs

@@ -94,6 +94,15 @@ pub struct Generation {
     pub conntrack_label: String,
     pub grants: Vec<Grant>,
 }
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RouterPublishedPort {
+    pub protocol: String,
+    pub transit_port: u16,
+    pub endpoint_port: u16,
+    pub endpoint_address: String,
+    pub transit_source_address: String,
+}
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RouterScope {
@@ -103,6 +112,10 @@ pub struct RouterScope {
     pub handoff: LocalLink,
     pub protection: Protection,
     pub generations: Vec<Generation>,
+    /// Absent and empty are the same canonical policy, so an unpublished scope
+    /// keeps its exact previous digest and compiled graph.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub published_ports: Vec<RouterPublishedPort>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -110,6 +123,15 @@ pub struct HostHandoff {
     pub link: LocalLink,
     pub allocations: Vec<Allocation>,
 }
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PublishedPort {
+    pub protocol: String,
+    pub host_port: u16,
+    pub target_port: u16,
+    pub target_address: String,
+    pub host_ip: String,
+}
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct HostScope {
@@ -117,6 +139,10 @@ pub struct HostScope {
     pub handoffs: Vec<HostHandoff>,
     pub uplink: LocalLink,
     pub snat_address: String,
+    /// Absent and empty are the same canonical policy, so an unpublished scope
+    /// keeps its exact previous digest and compiled graph.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub published_ports: Vec<PublishedPort>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -367,6 +393,86 @@ pub fn destination(grant: &Grant, protection: &Protection) -> Result<String> {
         }
     }
 }
+/// Inbound publication is bounded by the authority this scope already proves: an
+/// exact leased transit source address present on the handoff, an exact current
+/// workload endpoint address behind one of this scope's veth links, and no overlap
+/// with the leased outbound source ports translated to that same transit address.
+fn normalize_router_published(value: &mut RouterScope) -> Result<()> {
+    let mut ports = std::mem::take(&mut value.published_ports);
+    require(ports.len() <= 64)?;
+    ports.sort();
+    for (index, port) in ports.iter().enumerate() {
+        require(
+            protocol(&port.protocol)
+                && port.transit_port > 0
+                && port.endpoint_port > 0
+                && (index == 0
+                    || ports[index - 1].protocol != port.protocol
+                    || ports[index - 1].transit_port != port.transit_port),
+        )?;
+        // rtnetlink verifies this exact handoff address at apply, recovery and
+        // inspection, and only a current leased transit source address receives a
+        // publication; that binding is what the host publication already targets.
+        require(
+            value
+                .handoff
+                .required_ipv4_addresses
+                .contains(&port.transit_source_address)
+                && value.generations.iter().any(|generation| {
+                    generation.transit_source_address == port.transit_source_address
+                }),
+        )?;
+        unicast(&port.endpoint_address)?;
+        // Endpoint source prefixes are canonical and pairwise disjoint, so at most
+        // one endpoint can hold this address. It must be an actual workload veth
+        // behind this scope, never a router-local address, a gateway, the transit
+        // address or a protected platform endpoint.
+        let target = format!("{}/32", port.endpoint_address);
+        let endpoint = value
+            .endpoints
+            .iter()
+            .find(|endpoint| {
+                endpoint
+                    .source_prefixes
+                    .iter()
+                    .any(|source| covers(source, &target) == Ok(true))
+            })
+            .ok_or(Error::Invalid)?;
+        require(
+            endpoint.interface_kind == "veth"
+                && value
+                    .links
+                    .iter()
+                    .chain(std::iter::once(&value.handoff))
+                    .all(|link| {
+                        !link
+                            .required_ipv4_addresses
+                            .contains(&port.endpoint_address)
+                    })
+                && value
+                    .protection
+                    .platform_endpoints
+                    .iter()
+                    .all(|item| item.address != port.endpoint_address),
+        )?;
+        for generation in &value.generations {
+            if generation.transit_source_address != port.transit_source_address {
+                continue;
+            }
+            for range in &generation.source_port_ranges {
+                // Source NAT translates to this same transit address, so a published
+                // port inside a leased outbound range is a translation conflict.
+                require(
+                    range.protocol != port.protocol
+                        || port.transit_port < range.first
+                        || port.transit_port > range.last,
+                )?;
+            }
+        }
+    }
+    value.published_ports = ports;
+    Ok(())
+}
 fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
     require(value.links.len() <= 32 && value.generations.len() <= 32)?;
     let private = policy::Policy {
@@ -537,7 +643,8 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
             item.transit_source_address.as_str(),
             item.source_port_ranges.as_slice(),
         )
-    }))
+    }))?;
+    normalize_router_published(value)
 }
 fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     require(
@@ -556,6 +663,53 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     }
     Ok(())
 }
+/// Inbound publication is bounded by the same authority the scope already proves:
+/// an exact current uplink address, an exact leased transit source address, and no
+/// overlap with the leased outbound source ports translated to that same address.
+fn normalize_published(value: &mut HostScope) -> Result<()> {
+    let mut ports = std::mem::take(&mut value.published_ports);
+    require(ports.len() <= 64)?;
+    ports.sort();
+    for (index, port) in ports.iter().enumerate() {
+        require(
+            protocol(&port.protocol)
+                && port.host_port > 0
+                && port.target_port > 0
+                && (index == 0
+                    || ports[index - 1].protocol != port.protocol
+                    || ports[index - 1].host_port != port.host_port),
+        )?;
+        // rtnetlink verifies this exact uplink address at apply, recovery and
+        // inspection. No wildcard, secondary-link or default-route inference.
+        require(value.uplink.required_ipv4_addresses.contains(&port.host_ip))?;
+        // Only a current leased transit source address can be published; that
+        // binding is what proves the exact handoff link of the forward admission.
+        require(
+            value
+                .handoffs
+                .iter()
+                .flat_map(|handoff| handoff.allocations.iter())
+                .any(|allocation| allocation.transit_source_address == port.target_address),
+        )?;
+        if port.host_ip == value.snat_address {
+            for handoff in &value.handoffs {
+                for allocation in &handoff.allocations {
+                    for range in &allocation.source_port_ranges {
+                        // Outer SNAT translates to this same address, so a published
+                        // port inside a leased outbound range is a translation conflict.
+                        require(
+                            range.protocol != port.protocol
+                                || port.host_port < range.first
+                                || port.host_port > range.last,
+                        )?;
+                    }
+                }
+            }
+        }
+    }
+    value.published_ports = ports;
+    Ok(())
+}
 fn normalize_host(value: &mut HostScope) -> Result<()> {
     normalize_protection(&mut value.protection)?;
     normalize_link(&mut value.uplink)?;
@@ -622,6 +776,7 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
             }
         }
     }
+    normalize_published(value)?;
     unique_links(
         value
             .handoffs