@push.rocks/smartnftables 2.3.0 → 2.5.0

package/rust/src/egress.compile.rs

@@ -4,27 +4,74 @@ use crate::wire::{self, Attr};
 
 #[path = "egress.host.rs"]
 mod host;
+#[path = "egress.hostgrant.rs"]
+mod hostgrant;
 #[path = "egress.poolguard.rs"]
 mod poolguard;
 #[path = "egress.router.rs"]
 mod router;
 
+/// Set elements of one target. Together with the 100,000-byte rule graph and the
+/// handle-only deletion of a previous maximum graph this bounds one replacement
+/// batch below `wire::BATCH_BYTES`.
+pub(super) const ELEMENT_BYTES: usize = 100_000;
+
 pub(super) struct Program<'a> {
     table: &'a str,
     stamp: String,
     ordinal: usize,
     bytes: usize,
+    element_bytes: usize,
     operations: Vec<(u16, Vec<Attr>)>,
 }
 impl<'a> Program<'a> {
     fn push(&mut self, operation: u16, attributes: Vec<Attr>) -> Result<()> {
         self.bytes += wire::encode_attrs(&attributes).len() + 20;
         // Same atomic replacement reserve as v1: a previous bounded graph must
-        // fit its handle-only deletions beside the complete target in 240 KiB.
+        // fit its handle-only deletions beside the complete target, and the
+        // target's set elements, in one `wire::BATCH_BYTES` batch.
         require(self.bytes <= 100_000 && self.operations.len() < 768)?;
         self.operations.push((operation, attributes));
         Ok(())
     }
+    /// One named exact-match set. CONSTANT: its elements cannot change once a
+    /// rule binds it, so replacement always creates a complete new set.
+    fn set(&mut self, name: &str, id: u32, key_length: usize) -> Result<()> {
+        self.push(
+            9,
+            vec![
+                Attr::string(1, self.table),
+                Attr::string(2, name),
+                Attr::u32(3, 2),
+                Attr::u32(4, 0),
+                Attr::u32(5, key_length as u32),
+                Attr::u32(10, id),
+            ],
+        )
+    }
+    /// The elements of one set, 256 to a message so every nested attribute
+    /// stays far below netlink's 16-bit attribute length. Elements have their
+    /// own budget: a replacement deletes the previous set, and so its elements,
+    /// by one handle.
+    fn elements(&mut self, name: &str, keys: Vec<Vec<u8>>) -> Result<()> {
+        for chunk in keys.chunks(256) {
+            let elements = chunk
+                .iter()
+                .map(|key| {
+                    Attr::nested(1, vec![Attr::nested(1, vec![Attr::bytes(1, key.clone())])])
+                })
+                .collect();
+            let attributes = vec![
+                Attr::string(1, self.table),
+                Attr::string(2, name),
+                Attr::nested(3, elements),
+            ];
+            self.element_bytes += wire::encode_attrs(&attributes).len() + 20;
+            require(self.element_bytes <= ELEMENT_BYTES && self.operations.len() < 768)?;
+            self.operations.push((12, attributes));
+        }
+        Ok(())
+    }
     fn chain(&mut self, name: &str, base: Option<(u32, i32, &str)>) -> Result<()> {
         let mut data = vec![Attr::string(1, self.table), Attr::string(3, name)];
         if let Some((hook, priority, kind)) = base {
@@ -298,6 +345,7 @@ pub(super) fn compile(prepared: &Prepared, table: &str) -> Result<Vec<(u16, Vec<
         stamp: format!("snft2:{}:{}", prepared.policy.revision, prepared.digest),
         ordinal: 0,
         bytes: 0,
+        element_bytes: 0,
         operations: Vec::new(),
     };
     match &prepared.policy.scope {

package/rust/src/egress.host.rs

@@ -135,12 +135,34 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
     for name in ["protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
+    if !scope.host_grants.is_empty() {
+        // Validation admits only an address of exactly one handoff link.
+        hostgrant::tuple_set(program, &scope.host_grants, |grant| {
+            scope
+                .handoffs
+                .iter()
+                .find(|handoff| {
+                    handoff
+                        .link
+                        .required_ipv4_addresses
+                        .contains(&grant.source_address)
+                })
+                .map(|handoff| Some(&handoff.link))
+                .ok_or(crate::Error::Invalid)
+        })?;
+    }
     protection(program, scope, false)?;
     protection(program, scope, true)?;
     // Published admission precedes the capture barrier: the barrier denies every
     // protected original destination, which includes this uplink address, and an
     // exact inbound publication is the explicit authority for that exception.
     published(program, scope)?;
+    // Host-origin grants leave through the exact handoff that holds their source
+    // address, which is part of every set key, and precede the terminal output
+    // and input denials. Nothing else of the host's own traffic crosses a handoff.
+    if !scope.host_grants.is_empty() {
+        hostgrant::admissions(program, ["output", "input"], true, |_| vec![])?;
+    }
     for handoff in &scope.handoffs {
         program.jump("forward", link(&handoff.link, true), "protected_out")?;
         program.jump("forward", link(&handoff.link, false), "protected_back")?;

package/rust/src/egress.hostgrant.rs

@@ -0,0 +1,187 @@
+//! Host grants compile to a constant number of rules around exact-tuple set
+//! lookups, so the rule graph does not grow with the number of grants. The key
+//! carries every operand the rules would otherwise compare one by one: the
+//! variable interface (index and name), the packet and conntrack protocols, the
+//! live tuple and the originally tracked tuple. An element is one grant with its
+//! live tuple equal to its original tuple, so translated flows never match.
+use super::*;
+
+/// Every exact host-origin flow of the scope, keyed on its full tuple.
+pub(super) const TUPLE_SET: &str = "host_grant";
+/// Router raw ingress runs before conntrack: exact arriving tuples only.
+pub(super) const ARRIVAL_SET: &str = "host_grant_arrival";
+
+/// Register numbers as Linux dumps them: 16-byte aligned registers use the
+/// legacy NFT_REG_1..4 names, every other 4-byte register NFT_REG32_xx.
+fn register(index: u32) -> u32 {
+    if index % 4 == 0 {
+        index / 4
+    } else {
+        index - 4 + 8
+    }
+}
+fn store(name: &str, mut data: Vec<Attr>, index: u32) -> Attr {
+    data.insert(0, Attr::u32(1, register(index)));
+    expr(name, data)
+}
+fn meta_to(key: u32, index: u32) -> Attr {
+    store("meta", vec![Attr::u32(2, key)], index)
+}
+fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Attr {
+    store(
+        "payload",
+        vec![
+            Attr::u32(2, base),
+            Attr::u32(3, offset),
+            Attr::u32(4, length),
+        ],
+        index,
+    )
+}
+fn ct_to(key: u32, original: bool, index: u32) -> Attr {
+    let mut data = vec![Attr::u32(2, key)];
+    if original {
+        data.push(Attr::bytes(3, vec![0]));
+    }
+    store("ct", data, index)
+}
+fn lookup(set: &str) -> Attr {
+    expr(
+        "lookup",
+        vec![
+            Attr::string(1, set),
+            Attr::u32(2, register(4)),
+            Attr::u32(5, 0),
+        ],
+    )
+}
+fn word(bytes: &[u8]) -> Vec<u8> {
+    let mut result = bytes.to_vec();
+    result.resize(4, 0);
+    result
+}
+
+/// Key loads for one direction, then the lookup. `linked` adds the variable
+/// interface: the outgoing interface of the original direction, the incoming
+/// interface of the reply.
+fn tuple_lookup(linked: bool, reply: bool) -> Vec<Attr> {
+    let mut result = Vec::new();
+    let mut index = 4;
+    if linked {
+        result.push(meta_to(if reply { 4 } else { 5 }, index));
+        result.push(meta_to(if reply { 6 } else { 7 }, index + 1));
+        index += 5;
+    }
+    result.push(meta_to(16, index));
+    result.push(ct_to(10, false, index + 1));
+    // The grant's source and destination are the packet's own addresses in the
+    // original direction and swapped on the reply; the port is the workload's.
+    result.push(payload_to(1, if reply { 16 } else { 12 }, 4, index + 2));
+    result.push(payload_to(1, if reply { 12 } else { 16 }, 4, index + 3));
+    result.push(payload_to(2, if reply { 0 } else { 2 }, 2, index + 4));
+    result.push(ct_to(19, true, index + 5));
+    result.push(ct_to(20, true, index + 6));
+    result.push(ct_to(12, true, index + 7));
+    result.push(lookup(TUPLE_SET));
+    result
+}
+fn tuple_key(grant: &HostGrant, link: Option<&LocalLink>) -> Result<Vec<u8>> {
+    let protocol = word(&[protocol(&grant.protocol)]);
+    let source = address(&grant.source_address)?.to_be_bytes();
+    let destination = address(&grant.destination_address)?.to_be_bytes();
+    let port = word(&grant.destination_port.to_be_bytes());
+    let mut key = Vec::new();
+    if let Some(link) = link {
+        key.extend(link.interface_index.to_ne_bytes());
+        let mut name = link.interface_name.as_bytes().to_vec();
+        name.resize(16, 0);
+        key.extend(name);
+    }
+    for field in [
+        &protocol[..],
+        &protocol,
+        &source,
+        &destination,
+        &port,
+        &source,
+        &destination,
+        &port,
+    ] {
+        key.extend(field);
+    }
+    Ok(key)
+}
+
+/// The scope's exact tuple set. `link` returns the variable interface of a
+/// grant, or None for a link-independent scope.
+pub(super) fn tuple_set<'s>(
+    program: &mut Program<'_>,
+    grants: &'s [HostGrant],
+    link: impl Fn(&HostGrant) -> Result<Option<&'s LocalLink>>,
+) -> Result<()> {
+    let mut keys = Vec::new();
+    for grant in grants {
+        keys.push(tuple_key(grant, link(grant)?)?);
+    }
+    let length = keys.first().map(Vec::len).ok_or(crate::Error::Invalid)?;
+    program.set(TUPLE_SET, 1, length)?;
+    program.elements(TUPLE_SET, keys)
+}
+pub(super) fn arrival_set(program: &mut Program<'_>, grants: &[HostGrant]) -> Result<()> {
+    let mut keys = Vec::new();
+    for grant in grants {
+        let mut key = word(&[protocol(&grant.protocol)]);
+        key.extend(address(&grant.source_address)?.to_be_bytes());
+        key.extend(address(&grant.destination_address)?.to_be_bytes());
+        key.extend(word(&grant.destination_port.to_be_bytes()));
+        keys.push(key);
+    }
+    program.set(ARRIVAL_SET, 2, 16)?;
+    program.elements(ARRIVAL_SET, keys)
+}
+/// Exact arriving tuple, before conntrack: protocol, addresses and port.
+pub(super) fn arrival_lookup() -> Vec<Attr> {
+    vec![
+        meta_to(16, 4),
+        payload_to(1, 12, 4, 5),
+        payload_to(1, 16, 4, 6),
+        payload_to(2, 2, 2, 7),
+        lookup(ARRIVAL_SET),
+    ]
+}
+
+/// Four admissions whatever the number of grants: the ESTABLISHED original
+/// direction, a NEW UDP opening, a NEW TCP opening restricted to SYN with
+/// FIN/RST/ACK clear, and the ESTABLISHED reply. Each checks the default
+/// conntrack zone and the direction before one exact-tuple lookup. `fixed`
+/// adds the scope's fixed interface for each direction.
+pub(super) fn admissions(
+    program: &mut Program<'_>,
+    chains: [&str; 2],
+    linked: bool,
+    fixed: impl Fn(bool) -> Vec<Attr>,
+) -> Result<()> {
+    let envelope = |reply: bool, connection_state: u32| {
+        let mut result = ipv4();
+        result.extend(fixed(reply));
+        result.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+        result.extend(ct(1, None, vec![u8::from(reply)]));
+        result.extend(state(connection_state));
+        result
+    };
+    let mut established = envelope(false, 2);
+    established.extend(tuple_lookup(linked, false));
+    program.end(chains[0], established, 1)?;
+    for transport in ["udp", "tcp"] {
+        let mut opening = envelope(false, 8);
+        opening.extend(meta(16, vec![protocol(transport)]));
+        if transport == "tcp" {
+            opening.extend(opening_tcp());
+        }
+        opening.extend(tuple_lookup(linked, false));
+        program.end(chains[0], opening, 1)?;
+    }
+    let mut reply = envelope(true, 2);
+    reply.extend(tuple_lookup(linked, true));
+    program.end(chains[1], reply, 1)
+}

package/rust/src/egress.poolguard.rs

@@ -7,6 +7,13 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
     for name in ["pool_guard", "pool_reply"] {
         program.chain(name, None)?;
     }
+    // The only exceptions: an exact host-origin flow into a pool and its reply,
+    // ahead of the guard. Everything else, including a translated flow that merely
+    // arrives at a granted tuple, still meets the unconditional guard below.
+    if !scope.host_grants.is_empty() {
+        hostgrant::tuple_set(program, &scope.host_grants, |_| Ok(None))?;
+        hostgrant::admissions(program, ["output", "input"], false, |_| vec![])?;
+    }
     for name in ["input", "forward", "output"] {
         program.jump(name, ipv4(), "pool_guard")?;
     }

package/rust/src/egress.router.rs

@@ -47,6 +47,161 @@ fn raw_return(scope: &RouterScope, grant: &Grant, generation: &Generation) -> Re
     ));
     Ok(result)
 }
+/// The exact veth link of the workload endpoint that holds an endpoint address.
+/// Validation admits only a current endpoint address, and endpoint prefixes are
+/// pairwise disjoint, so one publication or host grant never spans two links.
+fn endpoint_link<'a>(scope: &'a RouterScope, address: &str) -> Result<&'a LocalLink> {
+    let target = format!("{address}/32");
+    let endpoint = scope
+        .endpoints
+        .iter()
+        .find(|endpoint| {
+            endpoint
+                .source_prefixes
+                .iter()
+                .any(|source| super::super::covers(source, &target) == Ok(true))
+        })
+        .ok_or(crate::Error::Invalid)?;
+    scope
+        .links
+        .iter()
+        .find(|link| link.interface_index == endpoint.interface_index)
+        .ok_or(crate::Error::Invalid)
+}
+fn published_link<'a>(scope: &'a RouterScope, port: &RouterPublishedPort) -> Result<&'a LocalLink> {
+    endpoint_link(scope, &port.endpoint_address)
+}
+/// Inbound publication envelope. Both directions check the exact links, the
+/// translated current tuple and the original conntrack destination, so foreign
+/// NAT cannot borrow this admission for another flow.
+fn published_envelope(
+    scope: &RouterScope,
+    endpoint: &LocalLink,
+    port: &RouterPublishedPort,
+    reply: bool,
+) -> Result<Vec<Attr>> {
+    let mut expressions = ipv4();
+    expressions.extend(link(&scope.handoff, !reply));
+    expressions.extend(link(endpoint, reply));
+    expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+    expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
+    expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+    expressions.extend(ct(1, None, vec![u8::from(reply)]));
+    let target = format!("{}/32", port.endpoint_address);
+    expressions.extend(current_address(&target, reply)?);
+    expressions.extend(current_port(port.endpoint_port, reply));
+    let published = format!("{}/32", port.transit_source_address);
+    expressions.extend(original_address(&published, false)?);
+    expressions.extend(original_port(port.transit_port, false));
+    Ok(expressions)
+}
+/// Handoff ingress classification for an exact current publication. Raw runs
+/// before conntrack, so it matches the arriving tuple only and never sets a
+/// generation zone: a publication is an ordinary default-zone flow.
+fn published_return(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let mut expressions = ipv4();
+        expressions.extend(link(&scope.handoff, true));
+        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+        expressions.extend(current_address(
+            &format!("{}/32", port.transit_source_address),
+            false,
+        )?);
+        expressions.extend(current_port(port.transit_port, false));
+        program.end("raw_return", expressions, 1)?;
+    }
+    Ok(())
+}
+/// Endpoint ingress classification for an exact current publication. The workload
+/// side of a publication is an ordinary default-zone flow too, so it is matched on
+/// its exact link, address and dedicated published port before the leased
+/// classifiers below can zone it: a client whose source port equals a leased
+/// grant's destination port would otherwise move the workload's published packets
+/// into that generation, where they are not its flow. This only classifies; both
+/// the anti-spoof guards and the publication's admissions still decide admission.
+fn published_endpoint(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let mut expressions = ipv4();
+        expressions.extend(link(published_link(scope, port)?, true));
+        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+        expressions.extend(current_address(
+            &format!("{}/32", port.endpoint_address),
+            true,
+        )?);
+        expressions.extend(current_port(port.endpoint_port, true));
+        program.end("raw_in", expressions, 1)?;
+    }
+    Ok(())
+}
+/// Handoff ingress classification for an exact host grant. Like a publication it
+/// is the explicit authority for its tuple, so it leads the protected-source
+/// denial that otherwise drops every packet from the host's transit address, and
+/// it never sets a generation zone: a host grant is an ordinary default-zone flow.
+/// The workload's replies need no classifier of their own: their destination is
+/// protected, so they return to the default zone ahead of every leased classifier.
+fn host_grant_return(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    if !scope.host_grants.is_empty() {
+        let mut expressions = ipv4();
+        expressions.extend(link(&scope.handoff, true));
+        expressions.extend(hostgrant::arrival_lookup());
+        program.end("raw_return", expressions, 1)?;
+    }
+    Ok(())
+}
+/// The workload link of each grant is part of its key; the handoff is fixed.
+fn host_grant_admissions(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    if !scope.host_grants.is_empty() {
+        hostgrant::admissions(program, ["forward", "forward"], true, |reply| {
+            link(&scope.handoff, !reply)
+        })?;
+    }
+    Ok(())
+}
+fn host_grant_sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    if !scope.host_grants.is_empty() {
+        hostgrant::tuple_set(program, &scope.host_grants, |grant| {
+            endpoint_link(scope, &grant.destination_address).map(Some)
+        })?;
+        hostgrant::arrival_set(program, &scope.host_grants)?;
+    }
+    Ok(())
+}
+fn published_translation(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let mut expressions = ipv4();
+        expressions.extend(link(&scope.handoff, true));
+        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
+        expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
+        expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+        expressions.extend(ct(1, None, vec![0]));
+        expressions.extend(current_address(
+            &format!("{}/32", port.transit_source_address),
+            false,
+        )?);
+        expressions.extend(current_port(port.transit_port, false));
+        expressions.extend(dnat(&port.endpoint_address, port.endpoint_port)?);
+        program.rule("pre", expressions)?;
+    }
+    Ok(())
+}
+fn published_admissions(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    for port in &scope.published_ports {
+        let endpoint = published_link(scope, port)?;
+        let original = published_envelope(scope, endpoint, port, false)?;
+        for connection_state in [2, 8] {
+            let mut expressions = original.clone();
+            expressions.extend(state(connection_state));
+            if connection_state == 8 && port.protocol == "tcp" {
+                expressions.extend(opening_tcp());
+            }
+            program.end("forward", expressions, 1)?;
+        }
+        let mut reply = published_envelope(scope, endpoint, port, true)?;
+        reply.extend(state(2));
+        program.end("forward", reply, 1)?;
+    }
+    Ok(())
+}
 fn protected(
     program: &mut Program<'_>,
     chain: &str,
@@ -67,10 +222,20 @@ fn protected(
     program.end(chain, vec![], -5)
 }
 fn raw(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
-    // Handoff ingress must classify only exact leased return envelopes. Unknown
-    // ingress never reaches private/default-zone rules, even after a rename.
+    // Handoff ingress must classify only exact leased return envelopes and exact
+    // inbound publications. Unknown ingress never reaches private/default-zone
+    // rules, even after a rename.
     program.jump("raw_in", link(&scope.handoff, true), "raw_return")?;
     program.deny_link("raw_in", &scope.handoff, true)?;
+    // A publication is the explicit authority for its exact tuple, so it is
+    // classified ahead of the protected-source denial below, exactly as a
+    // platform return envelope is. The host publishes into this address, so its
+    // clients are not confined to unprotected space.
+    published_return(program, scope)?;
+    host_grant_return(program, scope)?;
+    // Both sides of a publication lead the leased classifiers of every generation,
+    // so neither direction depends on the client's choice of source port.
+    published_endpoint(program, scope)?;
     for platform in [true, false] {
         if !platform {
             for prefix in &scope.protection.prefixes {
@@ -190,9 +355,16 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
     ] {
         program.chain(name, Some((hook, priority, kind)))?;
     }
+    if !scope.published_ports.is_empty() {
+        // Published destination NAT lives in this table's own prerouting chain, so
+        // it is created, replaced and deleted with the exact generation. An empty
+        // publication list keeps the previous chain set and compiled bytes.
+        program.chain("pre", Some((0, -100, "nat")))?;
+    }
     for name in ["raw_return", "protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
+    host_grant_sets(program, scope)?;
     let private = policy::Policy {
         schema_version: 1,
         revision,
@@ -210,9 +382,23 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
     raw(program, scope)?;
     protected(program, "protected_out", scope, false)?;
     protected(program, "protected_back", scope, true)?;
+    published_translation(program, scope)?;
     for chain in ["input", "forward", "output"] {
         let parts = private.filter_rules(chain)?;
-        for expressions in parts.guards.into_iter().chain(parts.grants) {
+        for expressions in parts.guards {
+            program.rule(chain, expressions)?;
+        }
+        // Published admission keeps the private anti-spoof guards ahead of it and
+        // precedes the capture barrier: the barrier denies every protected original
+        // destination, which includes this transit address, and an exact inbound
+        // publication is the explicit authority for that exception.
+        // Host grants take the same position for the same reason: the barrier
+        // denies the host's protected transit address in both directions.
+        if chain == "forward" {
+            published_admissions(program, scope)?;
+            host_grant_admissions(program, scope)?;
+        }
+        for expressions in parts.grants {
             program.rule(chain, expressions)?;
         }
         grants(program, scope, chain, true)?;