@push.rocks/smartnftables 2.3.0 → 2.4.0

package/rust/src/egress_tests.rs

@@ -676,3 +676,417 @@ fn host_v2_published_ports_reject_unbound_targets_conflicts_and_out_of_range_por
     assert!(normalized(published_host(ports(13))).unwrap().prepare().is_err());
     println!("PUBLISHED_MAX ports=12 operations={} bytes={bytes}", program.len());
 }
+
+pub(crate) fn router_published_port(protocol: &str, transit_port: u16, endpoint_port: u16) -> Value {
+    json!({"protocol":protocol,"transitPort":transit_port,"endpointPort":endpoint_port,
+        "endpointAddress":"10.241.0.2","transitSourceAddress":"10.240.0.2"})
+}
+pub(crate) fn published_router(ports: Value) -> Value {
+    let mut value = router();
+    value["scope"]["publishedPorts"] = ports;
+    value
+}
+
+#[test]
+fn router_v2_without_published_ports_keeps_its_exact_digest_and_compiled_bytes() {
+    use sha2::{Digest, Sha256};
+    let baseline = prepared(router());
+    // Frozen before the optional publication field existed.
+    assert_eq!(
+        baseline.digest,
+        "sha256:762a556e0bf512b653acfcf86699ac7681f26e6cc9ea1d26671443e3d2ca0b61"
+    );
+    let bytes = program_bytes(&baseline, "snft_v2_router_golden");
+    assert_eq!(bytes.len(), 53272);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "66850722fbd38a45a986cebeddcc75a541ebb1e2f003ea4375621decb2e08f99"
+    );
+    let serialized = serde_json::to_string(&baseline.policy).unwrap();
+    assert!(!serialized.contains("publishedPorts"));
+    // An explicit empty publication is the same canonical policy, digest and graph.
+    assert_eq!(prepared(published_router(json!([]))), baseline);
+    let (chains, rules) = graph(&baseline, "snft_v2_router_golden");
+    assert!(!chains.contains(&"pre".to_string()));
+    assert!(rules.iter().all(|(chain, _)| chain != "pre"));
+}
+
+#[test]
+fn router_v2_published_ports_compile_handoff_dnat_classification_and_admission() {
+    use sha2::{Digest, Sha256};
+    let baseline = graph(&prepared(router()), "snft_v2_router_golden");
+    let value = published_router(json!([
+        router_published_port("tcp", 443, 8443),
+        router_published_port("udp", 8125, 8125)
+    ]));
+    let published = prepared(value.clone());
+    assert_ne!(published.digest, prepared(router()).digest);
+    // Publication order is canonical, so a reordered list is the same policy.
+    let mut reordered = value;
+    reordered["scope"]["publishedPorts"]
+        .as_array_mut()
+        .unwrap()
+        .reverse();
+    assert_eq!(prepared(reordered), published);
+    let (chains, rules) = graph(&published, "snft_v2_router_golden");
+    assert_eq!(chains.len(), baseline.0.len() + 1);
+    assert_eq!(chains.iter().filter(|name| *name == "pre").count(), 1);
+    // Six rules per publication: one translation, one handoff ingress and one
+    // endpoint ingress classification, and the three forward admissions.
+    assert_eq!(rules.len(), baseline.1.len() + 12);
+    let translations: Vec<_> = rules.iter().filter(|(chain, _)| chain == "pre").collect();
+    assert_eq!(translations.len(), 2);
+    for (_, expressions) in &translations {
+        assert_eq!(expressions.last().unwrap(), "nat");
+        assert_eq!(
+            expressions.iter().filter(|name| *name == "immediate").count(),
+            2
+        );
+    }
+    let counted = |graph: &Vec<(String, Vec<String>)>, chain: &str| {
+        graph.iter().filter(|(name, _)| name == chain).count()
+    };
+    assert_eq!(
+        counted(&rules, "forward"),
+        counted(&baseline.1, "forward") + 6
+    );
+    // The classification leads the handoff ingress barrier, ahead of every denial
+    // in it, and never touches conntrack because raw runs before it.
+    let returns: Vec<_> = rules
+        .iter()
+        .filter(|(chain, _)| chain == "raw_return")
+        .map(|(_, expressions)| expressions)
+        .collect();
+    assert_eq!(returns.len(), counted(&baseline.1, "raw_return") + 2);
+    for expressions in &returns[..2] {
+        assert!(!expressions.contains(&"ct".to_string()));
+    }
+    assert!(returns[2..]
+        .iter()
+        .any(|expressions| expressions.contains(&"ct".to_string())));
+    assert_eq!(returns.last().unwrap().len(), 1);
+    // The endpoint side is classified in the workload ingress chain, behind the
+    // handoff barrier that opens it and ahead of every leased zone assignment.
+    let incoming: Vec<_> = rules
+        .iter()
+        .filter(|(chain, _)| chain == "raw_in")
+        .map(|(_, expressions)| expressions)
+        .collect();
+    assert_eq!(incoming.len(), counted(&baseline.1, "raw_in") + 2);
+    for expressions in &incoming[3..5] {
+        assert!(!expressions.contains(&"ct".to_string()));
+    }
+    assert!(incoming[5..]
+        .iter()
+        .any(|expressions| expressions.contains(&"ct".to_string())));
+    let bytes = program_bytes(&published, "snft_v2_router_golden");
+    assert_eq!(bytes.len(), 67818);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "62bf0f5aace2a19fb8a92571d1c4d45d774aa003884c239e473c67a7e103bb12"
+    );
+}
+
+#[test]
+fn router_v2_published_ports_are_owned_by_their_generation_and_leave_with_it() {
+    let published = prepared(published_router(json!([router_published_port(
+        "tcp", 443, 8443
+    )])));
+    let rollback = prepared(router());
+    let (chains, rules) = graph(&published, "snft_v2_router_rollback");
+    assert!(chains.contains(&"pre".to_string()));
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    // Every operation names the owned table, and the rollback target compiles the
+    // same graph as before publication; reconcile deletes the complete previous
+    // graph and re-adds the target in one batch, so the publication cannot survive.
+    let (rollback_chains, rollback_rules) = graph(&rollback, "snft_v2_router_rollback");
+    assert!(!rollback_chains.contains(&"pre".to_string()));
+    assert!(rollback_rules.iter().all(|(chain, _)| chain != "pre"));
+    assert_eq!(rollback_chains.len() + 1, chains.len());
+    assert_eq!(rollback_rules.len() + 6, rules.len());
+    assert_ne!(published.digest, rollback.digest);
+    // A released generation takes its publication with it: the scope without
+    // generations rejects the publication it could no longer bind.
+    let mut revoked = published_router(json!([router_published_port("tcp", 443, 8443)]));
+    revoked["scope"]["generations"] = json!([]);
+    assert!(normalized(revoked).is_err());
+}
+
+#[test]
+fn router_v2_published_ports_reject_unbound_endpoints_conflicts_and_out_of_range_ports() {
+    assert!(normalized(published_router(json!([router_published_port("tcp", 443, 8443)]))).is_ok());
+    let mut unknown = router_published_port("tcp", 443, 8443);
+    unknown["endpointId"] = json!("work");
+    for invalid in [
+        published_router(json!([unknown])),
+        published_router(json!([router_published_port("sctp", 443, 8443)])),
+        published_router(json!([router_published_port("tcp", 0, 8443)])),
+        published_router(json!([router_published_port("tcp", 443, 0)])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitPort",
+            json!(65536)
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointPort",
+            json!(65536)
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitPort",
+            json!(-1)
+        )])),
+        // The destination must be a current workload endpoint address of this scope.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.241.0.3")
+        )])),
+        // Not the endpoint's router-local gateway, and not the transit address.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.241.0.1")
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.240.0.2")
+        )])),
+        // Not loopback, not a broadcast/multicast address, and IPv4 only.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("127.0.0.1")
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("fd00::2")
+        )])),
+        // A TUN endpoint keeps private routing only; publication needs a veth.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/endpointAddress",
+            json!("10.242.0.2")
+        )])),
+        // The published address must be a current leased transit source address
+        // that is present on the handoff.
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitSourceAddress",
+            json!("10.240.0.3")
+        )])),
+        published_router(json!([changed(
+            router_published_port("tcp", 443, 8443),
+            "/transitSourceAddress",
+            json!("10.241.0.1")
+        )])),
+        // A published port cannot collide with the leased outbound SNAT ranges
+        // translated to that same transit address.
+        published_router(json!([router_published_port("tcp", 10500, 8443)])),
+        published_router(json!([router_published_port("udp", 10000, 8443)])),
+        // One protocol/port is published exactly once across the scope.
+        published_router(json!([
+            router_published_port("tcp", 443, 8443),
+            router_published_port("tcp", 443, 9443)
+        ])),
+        published_router(json!((0..65)
+            .map(|index| router_published_port("tcp", 20000 + index, 8443))
+            .collect::<Vec<_>>())),
+    ] {
+        assert!(normalized(invalid).is_err());
+    }
+    // Bounded input still meets the atomic reserve first: every publication costs
+    // six operations, so prepare rejects before any kernel work.
+    let ports = |count: u16| -> Value {
+        json!((0..count)
+            .map(|index| router_published_port("tcp", 20000 + index, 8443))
+            .collect::<Vec<_>>())
+    };
+    let prepared = prepared(published_router(ports(5)));
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let bytes: usize = program
+        .iter()
+        .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+        .sum();
+    assert!(program.len() <= 768 && bytes <= 100_000);
+    assert!(normalized(published_router(ports(6)))
+        .unwrap()
+        .prepare()
+        .is_err());
+    println!("ROUTER_PUBLISHED_MAX ports=5 operations={} bytes={bytes}", program.len());
+}
+
+/// One arriving IPv4 tuple for the ordered raw classifiers of a compiled chain.
+#[derive(Clone, Copy)]
+struct Arrival {
+    interface_index: u32,
+    interface_name: &'static str,
+    protocol: u8,
+    source: [u8; 4],
+    destination: [u8; 4],
+    source_port: u16,
+    destination_port: u16,
+}
+/// Walks one compiled chain in program order and reports the first rule that
+/// matches an arriving tuple as (position, verdict, conntrack zone it sets). Raw
+/// prerouting classification is the only hook this covers, so an unexpected
+/// expression panics instead of being silently ignored.
+fn classify(prepared: &Prepared, chain: &str, arrival: &Arrival) -> Option<(usize, i32, u16)> {
+    let table = "snft_v2_router_order";
+    let mut position = 0;
+    for (kind, attributes) in prepared.program(table).unwrap() {
+        if kind == 3 || crate::wire::text(&attributes, 2).unwrap() != chain {
+            continue;
+        }
+        let index = position;
+        position += 1;
+        let mut pending: Option<Vec<u8>> = None;
+        let mut immediate: Option<Vec<u8>> = None;
+        let mut verdict = 0;
+        let mut zone = 0;
+        let mut matched = true;
+        for expression in
+            crate::wire::attrs(&crate::wire::one(&attributes, 4).unwrap().value).unwrap()
+        {
+            let fields = crate::wire::attrs(&expression.value).unwrap();
+            let data = crate::wire::attrs(&crate::wire::one(&fields, 2).unwrap().value).unwrap();
+            match crate::wire::text(&fields, 1).unwrap().as_str() {
+                "meta" => {
+                    pending = Some(match crate::wire::number(&data, 2).unwrap() {
+                        4 => arrival.interface_index.to_ne_bytes().to_vec(),
+                        6 => [arrival.interface_name.as_bytes(), &[0]].concat(),
+                        15 => vec![libc::NFPROTO_IPV4 as u8],
+                        16 => vec![arrival.protocol],
+                        key => panic!("meta {key}"),
+                    })
+                }
+                "payload" => {
+                    pending = Some(
+                        match (
+                            crate::wire::number(&data, 2).unwrap(),
+                            crate::wire::number(&data, 3).unwrap(),
+                        ) {
+                            (1, 12) => arrival.source.to_vec(),
+                            (1, 16) => arrival.destination.to_vec(),
+                            (2, 0) => arrival.source_port.to_be_bytes().to_vec(),
+                            (2, 2) => arrival.destination_port.to_be_bytes().to_vec(),
+                            load => panic!("payload {load:?}"),
+                        },
+                    )
+                }
+                "bitwise" => {
+                    let mask = crate::wire::attrs(&crate::wire::one(&data, 4).unwrap().value)
+                        .unwrap()[0]
+                        .value
+                        .clone();
+                    let loaded = pending.take().unwrap();
+                    pending = Some(
+                        loaded
+                            .iter()
+                            .zip(&mask)
+                            .map(|(byte, mask)| byte & mask)
+                            .collect(),
+                    );
+                }
+                "cmp" => {
+                    assert_eq!(crate::wire::number(&data, 2).unwrap(), 0);
+                    let expected = crate::wire::attrs(&crate::wire::one(&data, 3).unwrap().value)
+                        .unwrap()[0]
+                        .value
+                        .clone();
+                    matched = pending.take().unwrap() == expected;
+                }
+                "ct" => {
+                    // Only the zone store reaches raw classification; a loaded
+                    // conntrack key would need a conntrack lookup that has not run.
+                    assert_eq!(crate::wire::number(&data, 2).unwrap(), 17);
+                    assert_eq!(crate::wire::number(&data, 4).unwrap(), 1);
+                    zone = u16::from_ne_bytes(immediate.take().unwrap().try_into().unwrap());
+                }
+                "immediate" => {
+                    let inner =
+                        crate::wire::attrs(&crate::wire::one(&data, 2).unwrap().value).unwrap();
+                    if crate::wire::number(&data, 1).unwrap() == 0 {
+                        let code = crate::wire::attrs(&crate::wire::one(&inner, 2).unwrap().value)
+                            .unwrap();
+                        verdict = crate::wire::number(&code, 1).unwrap() as i32;
+                    } else {
+                        immediate = Some(crate::wire::one(&inner, 1).unwrap().value.clone());
+                    }
+                }
+                other => panic!("{other}"),
+            }
+            if !matched {
+                break;
+            }
+        }
+        if matched {
+            return Some((index, verdict, zone));
+        }
+    }
+    None
+}
+
+#[test]
+fn router_v2_published_endpoint_traffic_is_classified_before_the_leased_grants() {
+    // A published reply to a client whose source port equals the leased grant's
+    // destination port on its public prefix. Raw runs before conntrack, so only
+    // the payload tuple separates it from ordinary leased egress.
+    let reply = Arrival {
+        interface_index: 2,
+        interface_name: "work",
+        protocol: 6,
+        source: [10, 241, 0, 2],
+        destination: [198, 51, 100, 7],
+        source_port: 9443,
+        destination_port: 443,
+    };
+    // Without the publication that exact tuple is leased into the generation zone,
+    // so the ordering below is what keeps the publication usable at all.
+    let leased = classify(&prepared(router()), "raw_in", &reply).unwrap();
+    assert_eq!((leased.1, leased.2), (1, 1));
+    let published = prepared(published_router(json!([router_published_port(
+        "tcp", 443, 9443
+    )])));
+    let (index, verdict, zone) = classify(&published, "raw_in", &reply).unwrap();
+    // Accepted with no zone set: the reply stays in the default zone, where the
+    // translated publication and its admission live.
+    assert_eq!((verdict, zone), (1, 0));
+    // Every other workload flow keeps its leased classification, and the leased
+    // classifier that claims the tuple above is reached only after this one.
+    let (leased_index, leased_verdict, leased_zone) = classify(
+        &published,
+        "raw_in",
+        &Arrival {
+            source_port: 50000,
+            ..reply
+        },
+    )
+    .unwrap();
+    assert_eq!((leased_verdict, leased_zone), (1, 1));
+    assert!(index < leased_index, "{index} {leased_index}");
+    // The classification is exact: another link, another workload address and
+    // another protocol are not published and are not classified here.
+    for foreign in [
+        Arrival {
+            interface_index: 3,
+            interface_name: "vpn",
+            ..reply
+        },
+        Arrival {
+            source: [10, 241, 0, 3],
+            ..reply
+        },
+        Arrival {
+            protocol: 17,
+            ..reply
+        },
+    ] {
+        assert!(classify(&published, "raw_in", &foreign).is_none());
+    }
+}

package/rust/src/owner_egress_traffic_tests.rs

@@ -25,7 +25,7 @@ pub(super) fn connect(a: &str, aname: &str, aip: &str, b: &str, bname: &str, bip
         ns_ip(ns, &["link", "set", name, "up"]);
     }
 }
-fn binding(name: &str, address: &str, kind: &str) -> Value {
+pub(super) fn binding(name: &str, address: &str, kind: &str) -> Value {
     let output = std::process::Command::new("/bin/ip")
         .args(["-j", "-d", "link", "show", "dev", name])
         .output()
@@ -37,12 +37,12 @@ fn binding(name: &str, address: &str, kind: &str) -> Value {
         "interfaceLinkIndex":if kind=="tun" {observed["ifindex"].clone()} else {observed["link_index"].clone()},
         "requiredIpv4Addresses":[address]})
 }
-fn protection() -> Value {
+pub(super) fn protection() -> Value {
     json!({"authorityDigest":format!("sha256:{}","b".repeat(64)),"prefixes":["10.0.0.0/8","192.0.2.0/24"],
         "platformEndpoints":[{"id":"dns","address":"192.0.2.3","protocol":"udp","port":5300},
             {"id":"mail","address":"192.0.2.3","protocol":"tcp","port":3000}]})
 }
-fn allocation() -> Value {
+pub(super) fn allocation() -> Value {
     json!({"lease":{"id":"lease-a","generation":1,"digest":format!("sha256:{}","a".repeat(64))},
         "transitSourceAddress":"10.240.0.2","sourcePortRanges":[{"protocol":"udp","first":10000,"last":10015},
             {"protocol":"tcp","first":10016,"last":10031}]})

package/rust/src/owner_host_traffic_tests.rs

@@ -113,7 +113,7 @@ fn hostile_capture_fixture() {
     // This is a persistent *foreign fixture* table. Drop its process socket;
     // native managed-table ownership never adopts or removes this graph.
 }
-fn control(source: &UdpSocket, destination: &str, target: &UdpSocket, allowed: bool) {
+pub(super) fn control(source: &UdpSocket, destination: &str, target: &UdpSocket, allowed: bool) {
     assert_eq!(source.send_to(b"probe", destination).unwrap(), 5);
     if allowed {
         assert_eq!(target.recv(&mut [0; 64]).unwrap(), 5);
@@ -305,7 +305,7 @@ const PUBLISH_SOURCE: &str = "hp_source";
 const PUBLISH_HOST: &str = "hp_host";
 const PUBLISH_PEER: &str = "hp_peer";
 
-fn chain_names(owner: &mut Owner) -> Vec<String> {
+pub(super) fn chain_names(owner: &mut Owner) -> Vec<String> {
     owner
         .graph()
         .unwrap()
@@ -317,7 +317,7 @@ fn chain_names(owner: &mut Owner) -> Vec<String> {
 }
 /// Inbound publication through the uplink: the workload must observe the actual
 /// client address, and the client must observe the published address back.
-fn published_udp(client: &UdpSocket, workload: &UdpSocket, published: &str, client_address: &str) {
+pub(super) fn published_udp(client: &UdpSocket, workload: &UdpSocket, published: &str, client_address: &str) {
     let mut bytes = [0; 64];
     assert_eq!(client.send_to(b"query", published).unwrap(), 5);
     let (size, observed) = workload.recv_from(&mut bytes).expect("published delivery");
@@ -328,7 +328,7 @@ fn published_udp(client: &UdpSocket, workload: &UdpSocket, published: &str, clie
     assert_eq!(&bytes[..size], b"reply");
     assert_eq!(from.to_string(), published);
 }
-fn dark_udp(client: &UdpSocket, workload: &UdpSocket, published: &str) {
+pub(super) fn dark_udp(client: &UdpSocket, workload: &UdpSocket, published: &str) {
     assert_eq!(client.send_to(b"query", published).unwrap(), 5);
     assert!(workload.recv(&mut [0; 64]).is_err());
 }

package/rust/src/owner_identity_tests.rs

@@ -204,3 +204,48 @@ fn published_host_graph_identity_preserves_destination_nat_and_admission_operand
         changed.iter().filter(|(chain, _)| chain == "forward").count()
     );
 }
+
+/// A published router generation must survive the same apply-time graph identity
+/// as the rest of the table: the kernel dump is compared operand by operand, so
+/// the workload translation and its admissions cannot be silently rewritten.
+#[test]
+fn published_router_graph_identity_preserves_destination_nat_and_admission_operands() {
+    let compiled = |endpoint_port: u16| {
+        let value = crate::egress::tests::published_router(serde_json::json!([
+            crate::egress::tests::router_published_port("tcp", 443, endpoint_port)
+        ]));
+        let prepared = serde_json::from_value::<crate::egress::Policy>(value)
+            .unwrap()
+            .prepare()
+            .unwrap();
+        let mut chains = Vec::new();
+        let mut rules = Vec::new();
+        for (kind, attributes) in prepared.program("snft_identity").unwrap() {
+            if kind == 3 {
+                chains.push(super::chain_identity(&attributes).unwrap());
+            } else {
+                rules.push(rule_identity(&attributes).unwrap());
+            }
+        }
+        (chains, rules)
+    };
+    let (chains, rules) = compiled(8443);
+    assert_eq!(rules.iter().filter(|(chain, _)| chain == "pre").count(), 1);
+    assert_eq!(chains.len(), 16);
+    let translation = rules.iter().find(|(chain, _)| chain == "pre").unwrap();
+    let (_, changed) = compiled(9443);
+    let other = changed.iter().find(|(chain, _)| chain == "pre").unwrap();
+    assert_ne!(translation.1, other.1);
+    assert_eq!(
+        rules.iter().filter(|(chain, _)| chain == "forward").count(),
+        changed.iter().filter(|(chain, _)| chain == "forward").count()
+    );
+    // The handoff ingress classification is part of the same identity.
+    assert_eq!(
+        rules.iter().filter(|(chain, _)| chain == "raw_return").count(),
+        changed
+            .iter()
+            .filter(|(chain, _)| chain == "raw_return")
+            .count()
+    );
+}