@push.rocks/smartnftables 2.3.0 → 2.5.0

package/rust/src/egress.rs

@@ -94,6 +94,27 @@ pub struct Generation {
     pub conntrack_label: String,
     pub grants: Vec<Grant>,
 }
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RouterPublishedPort {
+    pub protocol: String,
+    pub transit_port: u16,
+    pub endpoint_port: u16,
+    pub endpoint_address: String,
+    pub transit_source_address: String,
+}
+/// One exact host-origin flow: the node's own host network namespace dials one
+/// port of one local workload at its lease address, from the transit host
+/// address of the current handoff. The same grant is compiled in every scope the
+/// flow crosses; each scope binds it to the authority that scope proves.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct HostGrant {
+    pub protocol: String,
+    pub source_address: String,
+    pub destination_address: String,
+    pub destination_port: u16,
+}
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RouterScope {
@@ -103,6 +124,13 @@ pub struct RouterScope {
     pub handoff: LocalLink,
     pub protection: Protection,
     pub generations: Vec<Generation>,
+    /// Absent and empty are the same canonical policy, so an unpublished scope
+    /// keeps its exact previous digest and compiled graph.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub published_ports: Vec<RouterPublishedPort>,
+    /// Absent and empty are the same canonical policy, like publications.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub host_grants: Vec<HostGrant>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -130,12 +158,19 @@ pub struct HostScope {
     /// keeps its exact previous digest and compiled graph.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub published_ports: Vec<PublishedPort>,
+    /// Absent and empty are the same canonical policy, like publications.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub host_grants: Vec<HostGrant>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct AllocationPoolGuardScope {
     pub authority_digest: String,
     pub prefixes: Vec<String>,
+    /// The only exceptions to the guard: exact host-origin flows into a pool.
+    /// Absent and empty are the same canonical policy.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub host_grants: Vec<HostGrant>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(tag = "kind", rename_all = "camelCase", deny_unknown_fields)]
@@ -380,6 +415,156 @@ pub fn destination(grant: &Grant, protection: &Protection) -> Result<String> {
         }
     }
 }
+/// Inbound publication is bounded by the authority this scope already proves: an
+/// exact leased transit source address present on the handoff, an exact current
+/// workload endpoint address behind one of this scope's veth links, and no overlap
+/// with the leased outbound source ports translated to that same transit address.
+fn normalize_router_published(value: &mut RouterScope) -> Result<()> {
+    let mut ports = std::mem::take(&mut value.published_ports);
+    require(ports.len() <= 64)?;
+    ports.sort();
+    for (index, port) in ports.iter().enumerate() {
+        require(
+            protocol(&port.protocol)
+                && port.transit_port > 0
+                && port.endpoint_port > 0
+                && (index == 0
+                    || ports[index - 1].protocol != port.protocol
+                    || ports[index - 1].transit_port != port.transit_port),
+        )?;
+        // rtnetlink verifies this exact handoff address at apply, recovery and
+        // inspection, and only a current leased transit source address receives a
+        // publication; that binding is what the host publication already targets.
+        require(
+            value
+                .handoff
+                .required_ipv4_addresses
+                .contains(&port.transit_source_address)
+                && value.generations.iter().any(|generation| {
+                    generation.transit_source_address == port.transit_source_address
+                }),
+        )?;
+        unicast(&port.endpoint_address)?;
+        // Endpoint source prefixes are canonical and pairwise disjoint, so at most
+        // one endpoint can hold this address. It must be an actual workload veth
+        // behind this scope, never a router-local address, a gateway, the transit
+        // address or a protected platform endpoint.
+        let target = format!("{}/32", port.endpoint_address);
+        let endpoint = value
+            .endpoints
+            .iter()
+            .find(|endpoint| {
+                endpoint
+                    .source_prefixes
+                    .iter()
+                    .any(|source| covers(source, &target) == Ok(true))
+            })
+            .ok_or(Error::Invalid)?;
+        require(
+            endpoint.interface_kind == "veth"
+                && value
+                    .links
+                    .iter()
+                    .chain(std::iter::once(&value.handoff))
+                    .all(|link| {
+                        !link
+                            .required_ipv4_addresses
+                            .contains(&port.endpoint_address)
+                    })
+                && value
+                    .protection
+                    .platform_endpoints
+                    .iter()
+                    .all(|item| item.address != port.endpoint_address),
+        )?;
+        for generation in &value.generations {
+            if generation.transit_source_address != port.transit_source_address {
+                continue;
+            }
+            for range in &generation.source_port_ranges {
+                // Source NAT translates to this same transit address, so a published
+                // port inside a leased outbound range is a translation conflict.
+                require(
+                    range.protocol != port.protocol
+                        || port.transit_port < range.first
+                        || port.transit_port > range.last,
+                )?;
+            }
+        }
+    }
+    value.published_ports = ports;
+    Ok(())
+}
+/// Exact tuples only: one protocol, one unicast source and destination address
+/// and one destination port. Addresses never carry a prefix and ports never a
+/// range, so a grant cannot widen past its flow. `bound` checks the authority of
+/// the enclosing scope.
+fn normalize_host_grants(
+    grants: &mut [HostGrant],
+    bound: impl Fn(&HostGrant) -> Result<()>,
+) -> Result<()> {
+    // The contract maximum per projection; set lookups keep the rule graph
+    // constant, and the element budget holds this many in every scope.
+    require(grants.len() <= 1024)?;
+    grants.sort();
+    for (index, grant) in grants.iter().enumerate() {
+        require(
+            protocol(&grant.protocol)
+                && grant.destination_port > 0
+                && (index == 0 || grants[index - 1] != *grant),
+        )?;
+        unicast(&grant.source_address)?;
+        unicast(&grant.destination_address)?;
+        require(grant.source_address != grant.destination_address)?;
+        bound(grant)?;
+    }
+    Ok(())
+}
+/// The router forwards a host grant from its handoff to one workload: the
+/// destination is an exact current veth endpoint address of this scope, and the
+/// source is protected handoff-side space that is neither router-local, a
+/// platform endpoint nor any workload's address.
+fn normalize_router_host_grants(value: &mut RouterScope) -> Result<()> {
+    let mut grants = std::mem::take(&mut value.host_grants);
+    let scope = &*value;
+    let local = |ip: &str| {
+        scope
+            .links
+            .iter()
+            .chain(std::iter::once(&scope.handoff))
+            .any(|link| link.required_ipv4_addresses.iter().any(|item| item == ip))
+    };
+    let platform = |ip: &str| {
+        scope
+            .protection
+            .platform_endpoints
+            .iter()
+            .any(|endpoint| endpoint.address == ip)
+    };
+    let workload = |ip: &str| {
+        let target = format!("{ip}/32");
+        scope.endpoints.iter().find(|endpoint| {
+            endpoint
+                .source_prefixes
+                .iter()
+                .any(|source| covers(source, &target) == Ok(true))
+        })
+    };
+    normalize_host_grants(&mut grants, |grant| {
+        let endpoint = workload(&grant.destination_address).ok_or(Error::Invalid)?;
+        require(
+            endpoint.interface_kind == "veth"
+                && !local(&grant.destination_address)
+                && !platform(&grant.destination_address)
+                && covers_address(&scope.protection.prefixes, &grant.source_address)?
+                && !local(&grant.source_address)
+                && !platform(&grant.source_address)
+                && workload(&grant.source_address).is_none(),
+        )
+    })?;
+    value.host_grants = grants;
+    Ok(())
+}
 fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
     require(value.links.len() <= 32 && value.generations.len() <= 32)?;
     let private = policy::Policy {
@@ -550,7 +735,9 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
             item.transit_source_address.as_str(),
             item.source_port_ranges.as_slice(),
         )
-    }))
+    }))?;
+    normalize_router_published(value)?;
+    normalize_router_host_grants(value)
 }
 fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     require(
@@ -567,6 +754,58 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
             require(!overlaps(item, previous)?)?;
         }
     }
+    // An exception is only ever an exact flow into a guarded pool.
+    let mut grants = std::mem::take(&mut value.host_grants);
+    normalize_host_grants(&mut grants, |grant| {
+        require(covers_address(&value.prefixes, &grant.destination_address)?)
+    })?;
+    value.host_grants = grants;
+    Ok(())
+}
+/// The host dials from an exact current address of exactly one handoff link, into
+/// protected space that is neither host-local, a platform endpoint nor a leased
+/// router transit address: only a workload behind that handoff remains.
+fn normalize_host_host_grants(value: &mut HostScope) -> Result<()> {
+    let mut grants = std::mem::take(&mut value.host_grants);
+    let scope = &*value;
+    normalize_host_grants(&mut grants, |grant| {
+        let destination = &grant.destination_address;
+        require(
+            scope
+                .handoffs
+                .iter()
+                .filter(|handoff| {
+                    handoff
+                        .link
+                        .required_ipv4_addresses
+                        .contains(&grant.source_address)
+                })
+                .count()
+                == 1
+                && !scope
+                    .uplink
+                    .required_ipv4_addresses
+                    .contains(&grant.source_address)
+                && covers_address(&scope.protection.prefixes, destination)?
+                && scope
+                    .handoffs
+                    .iter()
+                    .map(|handoff| &handoff.link)
+                    .chain(std::iter::once(&scope.uplink))
+                    .all(|link| !link.required_ipv4_addresses.contains(destination))
+                && scope
+                    .protection
+                    .platform_endpoints
+                    .iter()
+                    .all(|endpoint| endpoint.address != *destination)
+                && scope
+                    .handoffs
+                    .iter()
+                    .flat_map(|handoff| handoff.allocations.iter())
+                    .all(|allocation| allocation.transit_source_address != *destination),
+        )
+    })?;
+    value.host_grants = grants;
     Ok(())
 }
 /// Inbound publication is bounded by the same authority the scope already proves:
@@ -683,6 +922,7 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
         }
     }
     normalize_published(value)?;
+    normalize_host_host_grants(value)?;
     unique_links(
         value
             .handoffs
@@ -705,6 +945,9 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
     )
 }
 
+#[cfg(test)]
+#[path = "egress_hostgrant_tests.rs"]
+pub(crate) mod hostgrant_tests;
 #[cfg(test)]
 #[path = "egress_tests.rs"]
 pub(crate) mod tests;