@push.rocks/smartnftables 2.2.0 → 2.4.0

package/rust/src/owner_router_traffic_tests.rs

@@ -0,0 +1,393 @@
+use super::egress_traffic_tests::{allocation, binding, connect, host_policy, ns_ip, protection};
+use super::egress_traffic_tests::{roundtrip, socket};
+use super::host_traffic_tests::{chain_names, control, dark_udp, published_udp};
+use super::*;
+use crate::egress;
+use serde_json::json;
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream};
+use std::os::fd::FromRawFd;
+use std::time::Duration;
+
+const WORK: &str = "rp_work";
+const ROUTER: &str = "rp_router";
+const HOST: &str = "rp_host";
+const PEER: &str = "rp_peer";
+
+/// One workload veth behind the router, one leased generation, and the inbound
+/// publications of the second hop. The first hop is the host-transit publication.
+fn router_policy(published: bool) -> egress::Policy {
+    let link = binding("work", "10.241.0.1", "veth");
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    // Both leased grants claim the same public address and a destination port a
+    // published client may legitimately use as its source port, so the generation
+    // and the publications compete for the workload's outgoing packets.
+    generation["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"203.0.113.2/32"},
+            "protocol":"udp","sourcePort":null,"destinationPort":42000,"sourcePortRange":{"first":10000,"last":10015}},
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"203.0.113.2/32"},
+            "protocol":"tcp","sourcePort":null,"destinationPort":443,"sourcePortRange":{"first":10016,"last":10031}}
+    ]);
+    let ports = if published {
+        json!([
+            {"protocol":"tcp","transitPort":8443,"endpointPort":9443,
+                "endpointAddress":"10.241.0.2","transitSourceAddress":"10.240.0.2"},
+            {"protocol":"udp","transitPort":8125,"endpointPort":9125,
+                "endpointAddress":"10.241.0.2","transitSourceAddress":"10.240.0.2"}
+        ])
+    } else {
+        json!([])
+    };
+    serde_json::from_value(json!({"schemaVersion":2,"revision":1,"scope":{"kind":"routerEgress",
+        "endpoints":[{"id":"work","interfaceIndex":link["interfaceIndex"],"interfaceName":"work",
+            "interfaceKind":"veth","sourcePrefixes":["10.241.0.2/32"]}],
+        "rules":[],"links":[link],"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation],"publishedPorts":ports}}))
+    .unwrap()
+}
+fn sockaddr(value: &str) -> libc::sockaddr_in {
+    let parsed: std::net::SocketAddrV4 = value.parse().unwrap();
+    let mut raw: libc::sockaddr_in = unsafe { std::mem::zeroed() };
+    raw.sin_family = libc::AF_INET as u16;
+    raw.sin_port = parsed.port().to_be();
+    raw.sin_addr.s_addr = u32::from(*parsed.ip()).to_be();
+    raw
+}
+/// A TCP client with an exact source address and port, which std cannot express.
+/// The collision this qualifies is the client's source port, so it must be chosen
+/// and not left to the ephemeral range.
+fn connect_from(source: &str, destination: &str) -> std::io::Result<TcpStream> {
+    let raw = unsafe { libc::socket(libc::AF_INET, libc::SOCK_STREAM | libc::SOCK_CLOEXEC, 0) };
+    assert!(raw >= 0, "socket: {}", std::io::Error::last_os_error());
+    let stream = unsafe { TcpStream::from_raw_fd(raw) };
+    let bound = sockaddr(source);
+    assert_eq!(
+        unsafe {
+            libc::bind(
+                raw,
+                (&bound as *const libc::sockaddr_in).cast(),
+                std::mem::size_of_val(&bound) as _,
+            )
+        },
+        0,
+        "bind: {}",
+        std::io::Error::last_os_error()
+    );
+    stream.set_nonblocking(true)?;
+    let target = sockaddr(destination);
+    if unsafe {
+        libc::connect(
+            raw,
+            (&target as *const libc::sockaddr_in).cast(),
+            std::mem::size_of_val(&target) as _,
+        )
+    } != 0
+    {
+        let error = std::io::Error::last_os_error();
+        if error.raw_os_error() != Some(libc::EINPROGRESS) {
+            return Err(error);
+        }
+        let mut waiting = libc::pollfd {
+            fd: raw,
+            events: libc::POLLOUT,
+            revents: 0,
+        };
+        assert!(unsafe { libc::poll(&mut waiting, 1, 1000) } >= 0);
+        let mut code: libc::c_int = 0;
+        let mut size = std::mem::size_of_val(&code) as libc::socklen_t;
+        assert_eq!(
+            unsafe {
+                libc::getsockopt(
+                    raw,
+                    libc::SOL_SOCKET,
+                    libc::SO_ERROR,
+                    (&mut code as *mut libc::c_int).cast(),
+                    &mut size,
+                )
+            },
+            0
+        );
+        if code != 0 || waiting.revents & libc::POLLOUT == 0 {
+            return Err(std::io::Error::from_raw_os_error(if code != 0 {
+                code
+            } else {
+                libc::ETIMEDOUT
+            }));
+        }
+    }
+    stream.set_nonblocking(false)?;
+    Ok(stream)
+}
+/// The host publications of the first hop: two with a router counterpart, and one
+/// whose transit port the router never publishes.
+fn published_host_policy() -> egress::Policy {
+    let mut policy = host_policy();
+    let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.published_ports = [("tcp", 443, 8443), ("udp", 8125, 8125), ("udp", 8126, 8126)]
+        .into_iter()
+        .map(|(protocol, host_port, target_port)| egress::PublishedPort {
+            protocol: protocol.into(),
+            host_port,
+            target_port,
+            target_address: "10.240.0.2".into(),
+            host_ip: "192.0.2.2".into(),
+        })
+        .collect();
+    policy
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_router_publishes_transit_ports_to_the_workload_and_removes_them_with_the_generation() {
+    isolated();
+    for name in [WORK, ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        WORK,
+        "client",
+        "10.241.0.2/24",
+        ROUTER,
+        "work",
+        "10.241.0.1/24",
+    );
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(WORK, &["route", "add", "default", "via", "10.241.0.1"]);
+    ns_ip(ROUTER, &["route", "add", "default", "via", "10.240.0.1"]);
+    // The unpublished workload route exists throughout, so every later denial is
+    // caused by policy and not by a missing route.
+    ns_ip(HOST, &["route", "add", "10.241.0.0/24", "via", "10.240.0.2"]);
+    ns_ip(
+        HOST,
+        &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
+    );
+    ns_ip(PEER, &["address", "add", "203.0.113.2/32", "dev", "lo"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    let workload_udp = socket(WORK, "10.241.0.2:9125");
+    let workload_direct = socket(WORK, "10.241.0.2:8444");
+    let workload_unpublished = socket(WORK, "10.241.0.2:9126");
+    let work_egress = socket(WORK, "10.241.0.2:40001");
+    let public = socket(PEER, "203.0.113.2:42000");
+    // Every probe uses its own client port: an unreplied conntrack entry would
+    // otherwise carry its null translation across the policy change.
+    let control_client = socket(PEER, "192.0.2.3:40010");
+    let client_udp = socket(PEER, "192.0.2.3:40000");
+    // Positive controls: without policy both hops forward to the workload, and the
+    // published address is not reachable, so every later result is caused by policy.
+    control(&control_client, "10.241.0.2:8444", &workload_direct, true);
+    dark_udp(
+        &socket(PEER, "192.0.2.3:40011"),
+        &workload_udp,
+        "192.0.2.2:8125",
+    );
+    let (host_owner, host_applied) = in_namespace(HOST, || {
+        let mut owner = Owner::new(options("router_published_host")).unwrap();
+        let target: Prepared = published_host_policy().prepare().unwrap().into();
+        target
+            .validate_interfaces()
+            .expect("published host fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
+    let (router_owner, router_applied, names) = in_namespace(ROUTER, || {
+        let mut owner = Owner::new(options("router_published")).unwrap();
+        let target: Prepared = router_policy(true).prepare().unwrap().into();
+        target
+            .validate_interfaces()
+            .expect("published router fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        let names = chain_names(&mut owner);
+        (owner, applied, names)
+    });
+    assert!(names.contains(&"pre".to_string()));
+    // Two hops of destination NAT deliver UDP to the workload; the workload sees the
+    // actual client and the client sees the published uplink address back.
+    published_udp(
+        &client_udp,
+        &workload_udp,
+        "192.0.2.2:8125",
+        "192.0.2.3:40000",
+    );
+    // The fixture observes ingress only, so the translated opening is read where it
+    // arrives: the workload side of the last veth.
+    let observer = in_namespace(WORK, || packet_fixture::PacketSocket::open("client"));
+    let listener = in_namespace(WORK, || TcpListener::bind("10.241.0.2:9443").unwrap());
+    let mut client = in_namespace(PEER, || {
+        TcpStream::connect_timeout(&"192.0.2.2:443".parse().unwrap(), Duration::from_secs(1))
+            .expect("published tcp opening")
+    });
+    let (mut server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.ip().to_string(), "192.0.2.3");
+    assert_eq!(client.peer_addr().unwrap().to_string(), "192.0.2.2:443");
+    for stream in [&client, &server] {
+        stream.set_read_timeout(Some(Duration::from_secs(1))).unwrap();
+    }
+    client.write_all(b"ping").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"pong").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    let syn = observer
+        .matching(|packet| {
+            packet.len() >= 40
+                && packet[9] == 6
+                && packet[16..20] == [10, 241, 0, 2]
+                && packet[22..24] == 9443_u16.to_be_bytes()
+                && packet[33] & 0x17 == 0x02
+        })
+        .expect("translated opening at the workload");
+    assert_eq!(syn[12..16], [192, 0, 2, 3]);
+    // Leased egress is unaffected by the publication in the same generation.
+    let outer = roundtrip(&work_egress, &public);
+    assert_eq!(outer.ip().to_string(), "192.0.2.2");
+    assert!((10000..=10015).contains(&outer.port()));
+    // A client whose source port equals a leased grant's destination port on that
+    // grant's public address is the exact collision raw classification must
+    // survive: the workload's published packets carry the same tuple, and raw runs
+    // before conntrack can separate the two flows. The publication must keep its
+    // own translation, so the reply arrives from the published address and port.
+    published_udp(&public, &workload_udp, "192.0.2.2:8125", "203.0.113.2:42000");
+    let mut colliding = in_namespace(PEER, || connect_from("203.0.113.2:443", "192.0.2.2:443"))
+        .expect("published tcp opening from a leased destination port");
+    let (mut served, observed) = listener.accept().unwrap();
+    assert_eq!(observed.to_string(), "203.0.113.2:443");
+    assert_eq!(colliding.peer_addr().unwrap().to_string(), "192.0.2.2:443");
+    for stream in [&colliding, &served] {
+        stream.set_read_timeout(Some(Duration::from_secs(1))).unwrap();
+    }
+    colliding.write_all(b"ping").unwrap();
+    served.read_exact(&mut [0; 4]).unwrap();
+    served.write_all(b"pong").unwrap();
+    colliding.read_exact(&mut [0; 4]).unwrap();
+    drop(colliding);
+    drop(served);
+    // Inject the second hop directly: only SYN with FIN/RST/ACK clear may open the
+    // publication, and an unpublished transit port stays behind the router barrier.
+    let injector = in_namespace(HOST, || packet_fixture::PacketSocket::open("router"));
+    let handoff_mac = in_namespace(ROUTER, || packet_fixture::mac("handoff"));
+    let arrived = |port: u16, flags: u8| {
+        observer
+            .matching(|packet| {
+                packet.len() >= 40
+                    && packet[9] == 6
+                    && packet[16..20] == [10, 241, 0, 2]
+                    && packet[20..22] == port.to_be_bytes()
+                    && packet[22..24] == 9443_u16.to_be_bytes()
+                    && packet[24..28] == 100_u32.to_be_bytes()
+                    && packet[33] == flags
+            })
+            .is_some()
+    };
+    for (port, flags) in [(40050_u16, 0x10_u8), (40051, 0x04), (40052, 0x12)] {
+        injector.send(
+            handoff_mac,
+            &packet_fixture::tcp([192, 0, 2, 3], [10, 240, 0, 2], port, 8443, flags),
+        );
+        assert!(!arrived(port, flags), "{flags:#04x}");
+    }
+    // The same injector opens the publication with an exact SYN, so the denials
+    // above are caused by the opening flags and not by the fixture.
+    injector.send(
+        handoff_mac,
+        &packet_fixture::tcp([192, 0, 2, 3], [10, 240, 0, 2], 40053, 8443, 0x02),
+    );
+    assert!(arrived(40053, 0x02));
+    injector.send(
+        handoff_mac,
+        &packet_fixture::tcp([192, 0, 2, 3], [10, 240, 0, 2], 40054, 9999, 0x02),
+    );
+    assert!(observer
+        .matching(|packet| packet.len() >= 40
+            && packet[9] == 6
+            && packet[20..22] == 40054_u16.to_be_bytes()
+            && packet[24..28] == 100_u32.to_be_bytes())
+        .is_none());
+    // A host publication whose transit port the router never published cannot pass
+    // the router barrier, while the published port beside it keeps working.
+    dark_udp(
+        &socket(PEER, "192.0.2.3:40012"),
+        &workload_unpublished,
+        "192.0.2.2:8126",
+    );
+    control(&control_client, "10.241.0.2:8444", &workload_direct, false);
+    drop(client);
+    drop(server);
+    // Withdrawing the router publication is an ordinary generation replacement. The
+    // host publication stays installed, so this isolates the second hop exactly.
+    let (mut router_owner, rolled_back, names) = in_namespace(ROUTER, {
+        let mut owner = router_owner;
+        move || {
+            let mut withdrawn = router_policy(false);
+            withdrawn.revision = 2;
+            let applied = owner
+                .reconcile(Transition {
+                    previous: Some(router_applied),
+                    target: withdrawn.prepare().unwrap().into(),
+                })
+                .unwrap();
+            assert!(owner.inspect().enforced);
+            let names = chain_names(&mut owner);
+            (owner, applied, names)
+        }
+    });
+    assert!(!names.contains(&"pre".to_string()));
+    dark_udp(
+        &socket(PEER, "192.0.2.3:40003"),
+        &workload_udp,
+        "192.0.2.2:8125",
+    );
+    assert!(in_namespace(PEER, || TcpStream::connect_timeout(
+        &"192.0.2.2:443".parse().unwrap(),
+        Duration::from_secs(1)
+    ))
+    .is_err());
+    in_namespace(ROUTER, move || {
+        assert!(router_owner.inspect().enforced);
+        router_owner.release(rolled_back).unwrap();
+    });
+    dark_udp(
+        &socket(PEER, "192.0.2.3:40004"),
+        &workload_udp,
+        "192.0.2.2:8125",
+    );
+    in_namespace(HOST, move || {
+        let mut owner = host_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(host_applied).unwrap();
+    });
+    println!("V2_ROUTER_PUBLISHED_PROOF two_hop_udp_delivered=true two_hop_tcp_delivered=true client_address_preserved=true reverse_translation_both_hops=true syn_only_opening=true nonsyn_opening_denied=true injector_positive_control=true unpublished_transit_port_denied=true unpublished_workload_port_denied=true leased_egress_unaffected=true leased_destination_port_client_tcp=true leased_destination_port_client_udp=true barrier_positive_control=true withdrawn_chain_absent=true withdrawn_port_dark=true released_port_dark=true");
+}

package/rust/src/owner_tests.rs

@@ -21,6 +21,9 @@ mod packet_fixture;
 #[path = "owner_host_traffic_tests.rs"]
 mod host_traffic_tests;
 
+#[path = "owner_router_traffic_tests.rs"]
+mod router_traffic_tests;
+
 #[path = "owner_poolguard_tests.rs"]
 mod poolguard_tests;
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '2.2.0',
+  version: '2.4.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/managed.egress.types.ts

@@ -55,6 +55,23 @@ export interface IManagedNftEgressGenerationV2 extends IManagedNftHandoffAllocat
   grants: IManagedNftEgressGrantV2[];
 }
 
+/** One inbound handoff publication, compiled inside the same router generation.
+ * It is the second hop of a published host port: the host translates to
+ * `transitSourceAddress:transitPort`, this translates on to the workload. */
+export interface IManagedNftRouterPublishedPortV2 {
+  protocol: 'tcp' | 'udp';
+  /** Published handoff port, 1–65535 and unique per protocol across the scope.
+   * It is the `targetPort` of the matching host-transit publication. */
+  transitPort: number;
+  endpointPort: number;
+  /** Exact current workload endpoint address behind one veth endpoint of this
+   * scope. Never a router-local address, a gateway or a platform endpoint. */
+  endpointAddress: string;
+  /** Exact leased transit source address of one current generation, present on
+   * `handoff`. No wildcard, secondary-address or route inference. */
+  transitSourceAddress: string;
+}
+
 /** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
 export interface IManagedNftRouterEgressScopeV2 {
   kind: 'routerEgress';
@@ -66,6 +83,24 @@ export interface IManagedNftRouterEgressScopeV2 {
   protection: IManagedNftProtectionV2;
   /** Empty retains private/local enforcement while denying external egress. */
   generations: IManagedNftEgressGenerationV2[];
+  /** Optional inbound destination NAT toward a workload endpoint. Absent and empty
+   * are the same canonical policy and keep the compiled graph unchanged. Every entry
+   * compiles its own handoff DNAT, the handoff ingress classification and the exact
+   * forward and reply admission in this generation, so a failed apply, a target
+   * without it, or release removes it with the generation. */
+  publishedPorts?: IManagedNftRouterPublishedPortV2[];
+}
+
+/** One inbound uplink publication, compiled inside the same host-transit generation. */
+export interface IManagedNftPublishedPortV2 {
+  protocol: 'tcp' | 'udp';
+  /** Published uplink port, 1–65535 and unique per protocol across the scope. */
+  hostPort: number;
+  targetPort: number;
+  /** Exact leased transit source address of one current allocation; it selects the handoff. */
+  targetAddress: string;
+  /** Exact current uplink address that publishes this port. No wildcard or route inference. */
+  hostIp: string;
 }
 
 /** Shared-host capture barrier and explicit outer SNAT; Docker forwarding remains a separate owner. */
@@ -76,6 +111,11 @@ export interface IManagedNftHostTransitScopeV2 {
   uplink: IManagedNftLocalLinkV2;
   /** Exact current address present on uplink. No masquerade or default-route inference. */
   snatAddress: string;
+  /** Optional inbound destination NAT. Absent and empty are the same canonical policy and
+   * keep the compiled graph unchanged. Every entry compiles its own uplink DNAT plus the
+   * exact forward and reply admission in this generation, so a failed apply, a target
+   * without it, or release removes it with the generation. */
+  publishedPorts?: IManagedNftPublishedPortV2[];
 }
 
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.