@push.rocks/smartnftables 2.2.0 → 2.4.0

package/rust/src/owner_host_traffic_tests.rs

@@ -1,7 +1,10 @@
 use super::egress_traffic_tests::{connect, denied, host_policy, ns_ip, roundtrip, socket};
 use super::*;
+use crate::egress;
 use crate::policy::{compare, expr, meta};
-use std::net::UdpSocket;
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream, UdpSocket};
+use std::time::Duration;
 
 const SOURCE: &str = "hs_source";
 const HOST: &str = "hs_host";
@@ -110,7 +113,7 @@ fn hostile_capture_fixture() {
     // This is a persistent *foreign fixture* table. Drop its process socket;
     // native managed-table ownership never adopts or removes this graph.
 }
-fn control(source: &UdpSocket, destination: &str, target: &UdpSocket, allowed: bool) {
+pub(super) fn control(source: &UdpSocket, destination: &str, target: &UdpSocket, allowed: bool) {
     assert_eq!(source.send_to(b"probe", destination).unwrap(), 5);
     if allowed {
         assert_eq!(target.recv(&mut [0; 64]).unwrap(), 5);
@@ -297,3 +300,223 @@ fn v2_host_rejects_foreign_dnat_zone_local_diversion_and_ipv6() {
     });
     println!("V2_HOST_PROOF original_protected_dnat_denied=true current_protected_dnat_denied=true nonzero_zone_denied=true input_diversion_denied=true output_spoof_denied=true ipv6_forward_denied=true unleased_port_denied=true exact_platform_allowed=true positive_controls=true");
 }
+
+const PUBLISH_SOURCE: &str = "hp_source";
+const PUBLISH_HOST: &str = "hp_host";
+const PUBLISH_PEER: &str = "hp_peer";
+
+pub(super) fn chain_names(owner: &mut Owner) -> Vec<String> {
+    owner
+        .graph()
+        .unwrap()
+        .expect("owned table present")
+        .chains
+        .iter()
+        .map(|chain| wire::text(chain, 3).unwrap())
+        .collect()
+}
+/// Inbound publication through the uplink: the workload must observe the actual
+/// client address, and the client must observe the published address back.
+pub(super) fn published_udp(client: &UdpSocket, workload: &UdpSocket, published: &str, client_address: &str) {
+    let mut bytes = [0; 64];
+    assert_eq!(client.send_to(b"query", published).unwrap(), 5);
+    let (size, observed) = workload.recv_from(&mut bytes).expect("published delivery");
+    assert_eq!(&bytes[..size], b"query");
+    assert_eq!(observed.to_string(), client_address);
+    assert_eq!(workload.send_to(b"reply", observed).unwrap(), 5);
+    let (size, from) = client.recv_from(&mut bytes).expect("published reply");
+    assert_eq!(&bytes[..size], b"reply");
+    assert_eq!(from.to_string(), published);
+}
+pub(super) fn dark_udp(client: &UdpSocket, workload: &UdpSocket, published: &str) {
+    assert_eq!(client.send_to(b"query", published).unwrap(), 5);
+    assert!(workload.recv(&mut [0; 64]).is_err());
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_publishes_exact_uplink_ports_and_removes_them_with_the_generation() {
+    isolated();
+    for name in [PUBLISH_SOURCE, PUBLISH_HOST, PUBLISH_PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        PUBLISH_SOURCE,
+        "source",
+        "10.240.0.2/30",
+        PUBLISH_HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        PUBLISH_HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PUBLISH_PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(PUBLISH_SOURCE, &["route", "add", "default", "via", "10.240.0.1"]);
+    ns_ip(PUBLISH_PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    let workload_udp = socket(PUBLISH_SOURCE, "10.240.0.2:8125");
+    let workload_direct = socket(PUBLISH_SOURCE, "10.240.0.2:8444");
+    let workload_unpublished = socket(PUBLISH_SOURCE, "10.240.0.2:9999");
+    // Every probe uses its own client port: an unreplied conntrack entry would
+    // otherwise carry its null translation across the policy change.
+    let control_client = socket(PUBLISH_PEER, "192.0.2.3:40010");
+    let client_udp = socket(PUBLISH_PEER, "192.0.2.3:40000");
+    // Positive controls: without policy the workload is reachable directly, and
+    // the published address is not, so every later result is caused by the policy.
+    control(&control_client, "10.240.0.2:8444", &workload_direct, true);
+    dark_udp(
+        &socket(PUBLISH_PEER, "192.0.2.3:40011"),
+        &workload_udp,
+        "192.0.2.2:8125",
+    );
+    let (owner, applied, published_policy, names) = in_namespace(PUBLISH_HOST, || {
+        let mut policy = host_policy();
+        let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+            panic!()
+        };
+        scope.published_ports = vec![
+            egress::PublishedPort {
+                protocol: "tcp".into(),
+                host_port: 443,
+                target_port: 8443,
+                target_address: "10.240.0.2".into(),
+                host_ip: "192.0.2.2".into(),
+            },
+            egress::PublishedPort {
+                protocol: "udp".into(),
+                host_port: 8125,
+                target_port: 8125,
+                target_address: "10.240.0.2".into(),
+                host_ip: "192.0.2.2".into(),
+            },
+        ];
+        let mut owner = Owner::new(options("host_published")).unwrap();
+        let target: Prepared = policy.clone().prepare().unwrap().into();
+        target
+            .validate_interfaces()
+            .expect("published host fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        let names = chain_names(&mut owner);
+        (owner, applied, policy, names)
+    });
+    assert!(names.contains(&"pre".to_string()));
+    // The fixture observes ingress only, so the translated opening is read where
+    // it arrives: the workload side of the handoff.
+    let observer = in_namespace(PUBLISH_SOURCE, || packet_fixture::PacketSocket::open("source"));
+    published_udp(&client_udp, &workload_udp, "192.0.2.2:8125", "192.0.2.3:40000");
+    let listener = in_namespace(PUBLISH_SOURCE, || {
+        TcpListener::bind("10.240.0.2:8443").unwrap()
+    });
+    let mut client = in_namespace(PUBLISH_PEER, || {
+        TcpStream::connect_timeout(&"192.0.2.2:443".parse().unwrap(), Duration::from_secs(1))
+            .expect("published tcp opening")
+    });
+    let (mut server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.ip().to_string(), "192.0.2.3");
+    assert_eq!(client.peer_addr().unwrap().to_string(), "192.0.2.2:443");
+    for stream in [&client, &server] {
+        stream.set_read_timeout(Some(Duration::from_secs(1))).unwrap();
+    }
+    client.write_all(b"ping").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"pong").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    // The translated opening is observable on the handoff, with the actual client
+    // address preserved and SYN only.
+    let syn = observer
+        .matching(|packet| {
+            packet.len() >= 40
+                && packet[9] == 6
+                && packet[16..20] == [10, 240, 0, 2]
+                && packet[22..24] == 8443_u16.to_be_bytes()
+                && packet[33] & 0x17 == 0x02
+        })
+        .expect("translated opening on the handoff");
+    assert_eq!(syn[12..16], [192, 0, 2, 3]);
+    // An opening that is not SYN cannot acquire the publication.
+    let injector = in_namespace(PUBLISH_PEER, || {
+        packet_fixture::PacketSocket::open("underlay")
+    });
+    let uplink_mac = in_namespace(PUBLISH_HOST, || packet_fixture::mac("uplink"));
+    for (port, flags) in [(40050_u16, 0x10_u8), (40051, 0x04), (40052, 0x12)] {
+        injector.send(
+            uplink_mac,
+            &packet_fixture::tcp([192, 0, 2, 3], [192, 0, 2, 2], port, 443, flags),
+        );
+        // The exact injected flow, never the live connection's own acknowledgements.
+        assert!(
+            observer
+                .matching(|packet| packet.len() >= 40
+                    && packet[9] == 6
+                    && packet[16..20] == [10, 240, 0, 2]
+                    && packet[20..22] == port.to_be_bytes()
+                    && packet[22..24] == 8443_u16.to_be_bytes()
+                    && packet[24..28] == 100_u32.to_be_bytes()
+                    && packet[33] == flags)
+                .is_none(),
+            "{flags:#04x}"
+        );
+    }
+    // The capture barrier still denies every unpublished path to the workload.
+    control(&control_client, "10.240.0.2:8444", &workload_direct, false);
+    let unpublished_client = socket(PUBLISH_PEER, "192.0.2.3:40002");
+    dark_udp(&unpublished_client, &workload_unpublished, "192.0.2.2:9999");
+    assert!(in_namespace(PUBLISH_PEER, || TcpStream::connect_timeout(
+        &"192.0.2.2:444".parse().unwrap(),
+        Duration::from_secs(1)
+    ))
+    .is_err());
+    drop(client);
+    drop(server);
+    // Withdrawing the publication is an ordinary generation replacement.
+    let (mut owner, rolled_back, names) = in_namespace(PUBLISH_HOST, {
+        let mut owner = owner;
+        move || {
+            let mut withdrawn = published_policy;
+            withdrawn.revision = 2;
+            let egress::Scope::HostTransit(scope) = &mut withdrawn.scope else {
+                panic!()
+            };
+            scope.published_ports.clear();
+            let applied = owner
+                .reconcile(Transition {
+                    previous: Some(applied),
+                    target: withdrawn.prepare().unwrap().into(),
+                })
+                .unwrap();
+            assert!(owner.inspect().enforced);
+            let names = chain_names(&mut owner);
+            (owner, applied, names)
+        }
+    });
+    assert!(!names.contains(&"pre".to_string()));
+    let dark_client = socket(PUBLISH_PEER, "192.0.2.3:40003");
+    dark_udp(&dark_client, &workload_udp, "192.0.2.2:8125");
+    assert!(in_namespace(PUBLISH_PEER, || TcpStream::connect_timeout(
+        &"192.0.2.2:443".parse().unwrap(),
+        Duration::from_secs(1)
+    ))
+    .is_err());
+    control(&control_client, "10.240.0.2:8444", &workload_direct, false);
+    in_namespace(PUBLISH_HOST, move || {
+        assert!(owner.inspect().enforced);
+        owner.release(rolled_back).unwrap();
+    });
+    let released_client = socket(PUBLISH_PEER, "192.0.2.3:40004");
+    dark_udp(&released_client, &workload_udp, "192.0.2.2:8125");
+    println!("V2_HOST_PUBLISHED_PROOF udp_published_delivered=true tcp_published_delivered=true client_address_preserved=true reverse_translation=true syn_only_opening=true nonsyn_opening_denied=true unpublished_workload_port_denied=true unpublished_uplink_port_denied=true barrier_positive_control=true withdrawn_chain_absent=true withdrawn_port_dark=true released_port_dark=true");
+}

package/rust/src/owner_identity_tests.rs

@@ -167,3 +167,85 @@ fn egress_identity_rejects_unknown_duplicate_or_incomplete_operands() {
         assert!(rule_identity(&rule(vec![expression(name, extra)])).is_err());
     }
 }
+
+/// A published host-transit generation must survive the same apply-time graph
+/// identity as the rest of the table: the kernel dump is compared operand by
+/// operand, so destination NAT and its admissions cannot be silently rewritten.
+#[test]
+fn published_host_graph_identity_preserves_destination_nat_and_admission_operands() {
+    let compiled = |target_port: u16| {
+        let value = crate::egress::tests::published_host(serde_json::json!([
+            crate::egress::tests::published_port("tcp", 443, target_port)
+        ]));
+        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
+            .unwrap()
+            .prepare()
+            .unwrap();
+        let mut chains = Vec::new();
+        let mut rules = Vec::new();
+        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
+            if kind == 3 {
+                chains.push(super::chain_identity(&attributes).unwrap());
+            } else {
+                rules.push(rule_identity(&attributes).unwrap());
+            }
+        }
+        (chains, rules)
+    };
+    let (chains, rules) = compiled(8443);
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    assert_eq!(chains.len(), 7);
+    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
+    let (_, changed) = compiled(9443);
+    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
+    assert_ne!(translation.1, other.1);
+    assert_eq!(
+        rules.iter().filter(|(chain, _)| chain == "forward").count(),
+        changed.iter().filter(|(chain, _)| chain == "forward").count()
+    );
+}
+
+/// A published router generation must survive the same apply-time graph identity
+/// as the rest of the table: the kernel dump is compared operand by operand, so
+/// the workload translation and its admissions cannot be silently rewritten.
+#[test]
+fn published_router_graph_identity_preserves_destination_nat_and_admission_operands() {
+    let compiled = |endpoint_port: u16| {
+        let value = crate::egress::tests::published_router(serde_json::json!([
+            crate::egress::tests::router_published_port("tcp", 443, endpoint_port)
+        ]));
+        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
+            .unwrap()
+            .prepare()
+            .unwrap();
+        let mut chains = Vec::new();
+        let mut rules = Vec::new();
+        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
+            if kind == 3 {
+                chains.push(super::chain_identity(&attributes).unwrap());
+            } else {
+                rules.push(rule_identity(&attributes).unwrap());
+            }
+        }
+        (chains, rules)
+    };
+    let (chains, rules) = compiled(8443);
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    assert_eq!(chains.len(), 16);
+    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
+    let (_, changed) = compiled(9443);
+    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
+    assert_ne!(translation.1, other.1);
+    assert_eq!(
+        rules.iter().filter(|(chain, _)| chain == "forward").count(),
+        changed.iter().filter(|(chain, _)| chain == "forward").count()
+    );
+    // The handoff ingress classification is part of the same identity.
+    assert_eq!(
+        rules.iter().filter(|(chain, _)| chain == "raw_return").count(),
+        changed
+            .iter()
+            .filter(|(chain, _)| chain == "raw_return")
+            .count()
+    );
+}