@push.rocks/smartnftables 2.4.0 → 2.5.0

package/rust/src/egress.hostgrant.rs

@@ -0,0 +1,187 @@
+//! Host grants compile to a constant number of rules around exact-tuple set
+//! lookups, so the rule graph does not grow with the number of grants. The key
+//! carries every operand the rules would otherwise compare one by one: the
+//! variable interface (index and name), the packet and conntrack protocols, the
+//! live tuple and the originally tracked tuple. An element is one grant with its
+//! live tuple equal to its original tuple, so translated flows never match.
+use super::*;
+
+/// Every exact host-origin flow of the scope, keyed on its full tuple.
+pub(super) const TUPLE_SET: &str = "host_grant";
+/// Router raw ingress runs before conntrack: exact arriving tuples only.
+pub(super) const ARRIVAL_SET: &str = "host_grant_arrival";
+
+/// Register numbers as Linux dumps them: 16-byte aligned registers use the
+/// legacy NFT_REG_1..4 names, every other 4-byte register NFT_REG32_xx.
+fn register(index: u32) -> u32 {
+    if index % 4 == 0 {
+        index / 4
+    } else {
+        index - 4 + 8
+    }
+}
+fn store(name: &str, mut data: Vec<Attr>, index: u32) -> Attr {
+    data.insert(0, Attr::u32(1, register(index)));
+    expr(name, data)
+}
+fn meta_to(key: u32, index: u32) -> Attr {
+    store("meta", vec![Attr::u32(2, key)], index)
+}
+fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Attr {
+    store(
+        "payload",
+        vec![
+            Attr::u32(2, base),
+            Attr::u32(3, offset),
+            Attr::u32(4, length),
+        ],
+        index,
+    )
+}
+fn ct_to(key: u32, original: bool, index: u32) -> Attr {
+    let mut data = vec![Attr::u32(2, key)];
+    if original {
+        data.push(Attr::bytes(3, vec![0]));
+    }
+    store("ct", data, index)
+}
+fn lookup(set: &str) -> Attr {
+    expr(
+        "lookup",
+        vec![
+            Attr::string(1, set),
+            Attr::u32(2, register(4)),
+            Attr::u32(5, 0),
+        ],
+    )
+}
+fn word(bytes: &[u8]) -> Vec<u8> {
+    let mut result = bytes.to_vec();
+    result.resize(4, 0);
+    result
+}
+
+/// Key loads for one direction, then the lookup. `linked` adds the variable
+/// interface: the outgoing interface of the original direction, the incoming
+/// interface of the reply.
+fn tuple_lookup(linked: bool, reply: bool) -> Vec<Attr> {
+    let mut result = Vec::new();
+    let mut index = 4;
+    if linked {
+        result.push(meta_to(if reply { 4 } else { 5 }, index));
+        result.push(meta_to(if reply { 6 } else { 7 }, index + 1));
+        index += 5;
+    }
+    result.push(meta_to(16, index));
+    result.push(ct_to(10, false, index + 1));
+    // The grant's source and destination are the packet's own addresses in the
+    // original direction and swapped on the reply; the port is the workload's.
+    result.push(payload_to(1, if reply { 16 } else { 12 }, 4, index + 2));
+    result.push(payload_to(1, if reply { 12 } else { 16 }, 4, index + 3));
+    result.push(payload_to(2, if reply { 0 } else { 2 }, 2, index + 4));
+    result.push(ct_to(19, true, index + 5));
+    result.push(ct_to(20, true, index + 6));
+    result.push(ct_to(12, true, index + 7));
+    result.push(lookup(TUPLE_SET));
+    result
+}
+fn tuple_key(grant: &HostGrant, link: Option<&LocalLink>) -> Result<Vec<u8>> {
+    let protocol = word(&[protocol(&grant.protocol)]);
+    let source = address(&grant.source_address)?.to_be_bytes();
+    let destination = address(&grant.destination_address)?.to_be_bytes();
+    let port = word(&grant.destination_port.to_be_bytes());
+    let mut key = Vec::new();
+    if let Some(link) = link {
+        key.extend(link.interface_index.to_ne_bytes());
+        let mut name = link.interface_name.as_bytes().to_vec();
+        name.resize(16, 0);
+        key.extend(name);
+    }
+    for field in [
+        &protocol[..],
+        &protocol,
+        &source,
+        &destination,
+        &port,
+        &source,
+        &destination,
+        &port,
+    ] {
+        key.extend(field);
+    }
+    Ok(key)
+}
+
+/// The scope's exact tuple set. `link` returns the variable interface of a
+/// grant, or None for a link-independent scope.
+pub(super) fn tuple_set<'s>(
+    program: &mut Program<'_>,
+    grants: &'s [HostGrant],
+    link: impl Fn(&HostGrant) -> Result<Option<&'s LocalLink>>,
+) -> Result<()> {
+    let mut keys = Vec::new();
+    for grant in grants {
+        keys.push(tuple_key(grant, link(grant)?)?);
+    }
+    let length = keys.first().map(Vec::len).ok_or(crate::Error::Invalid)?;
+    program.set(TUPLE_SET, 1, length)?;
+    program.elements(TUPLE_SET, keys)
+}
+pub(super) fn arrival_set(program: &mut Program<'_>, grants: &[HostGrant]) -> Result<()> {
+    let mut keys = Vec::new();
+    for grant in grants {
+        let mut key = word(&[protocol(&grant.protocol)]);
+        key.extend(address(&grant.source_address)?.to_be_bytes());
+        key.extend(address(&grant.destination_address)?.to_be_bytes());
+        key.extend(word(&grant.destination_port.to_be_bytes()));
+        keys.push(key);
+    }
+    program.set(ARRIVAL_SET, 2, 16)?;
+    program.elements(ARRIVAL_SET, keys)
+}
+/// Exact arriving tuple, before conntrack: protocol, addresses and port.
+pub(super) fn arrival_lookup() -> Vec<Attr> {
+    vec![
+        meta_to(16, 4),
+        payload_to(1, 12, 4, 5),
+        payload_to(1, 16, 4, 6),
+        payload_to(2, 2, 2, 7),
+        lookup(ARRIVAL_SET),
+    ]
+}
+
+/// Four admissions whatever the number of grants: the ESTABLISHED original
+/// direction, a NEW UDP opening, a NEW TCP opening restricted to SYN with
+/// FIN/RST/ACK clear, and the ESTABLISHED reply. Each checks the default
+/// conntrack zone and the direction before one exact-tuple lookup. `fixed`
+/// adds the scope's fixed interface for each direction.
+pub(super) fn admissions(
+    program: &mut Program<'_>,
+    chains: [&str; 2],
+    linked: bool,
+    fixed: impl Fn(bool) -> Vec<Attr>,
+) -> Result<()> {
+    let envelope = |reply: bool, connection_state: u32| {
+        let mut result = ipv4();
+        result.extend(fixed(reply));
+        result.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+        result.extend(ct(1, None, vec![u8::from(reply)]));
+        result.extend(state(connection_state));
+        result
+    };
+    let mut established = envelope(false, 2);
+    established.extend(tuple_lookup(linked, false));
+    program.end(chains[0], established, 1)?;
+    for transport in ["udp", "tcp"] {
+        let mut opening = envelope(false, 8);
+        opening.extend(meta(16, vec![protocol(transport)]));
+        if transport == "tcp" {
+            opening.extend(opening_tcp());
+        }
+        opening.extend(tuple_lookup(linked, false));
+        program.end(chains[0], opening, 1)?;
+    }
+    let mut reply = envelope(true, 2);
+    reply.extend(tuple_lookup(linked, true));
+    program.end(chains[1], reply, 1)
+}

package/rust/src/egress.poolguard.rs

@@ -7,6 +7,13 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
     for name in ["pool_guard", "pool_reply"] {
         program.chain(name, None)?;
     }
+    // The only exceptions: an exact host-origin flow into a pool and its reply,
+    // ahead of the guard. Everything else, including a translated flow that merely
+    // arrives at a granted tuple, still meets the unconditional guard below.
+    if !scope.host_grants.is_empty() {
+        hostgrant::tuple_set(program, &scope.host_grants, |_| Ok(None))?;
+        hostgrant::admissions(program, ["output", "input"], false, |_| vec![])?;
+    }
     for name in ["input", "forward", "output"] {
         program.jump(name, ipv4(), "pool_guard")?;
     }

package/rust/src/egress.router.rs

@@ -47,11 +47,11 @@ fn raw_return(scope: &RouterScope, grant: &Grant, generation: &Generation) -> Re
     ));
     Ok(result)
 }
-/// The exact veth link of the workload endpoint that holds a published address.
+/// The exact veth link of the workload endpoint that holds an endpoint address.
 /// Validation admits only a current endpoint address, and endpoint prefixes are
-/// pairwise disjoint, so one publication never spans two endpoint links.
-fn published_link<'a>(scope: &'a RouterScope, port: &RouterPublishedPort) -> Result<&'a LocalLink> {
-    let target = format!("{}/32", port.endpoint_address);
+/// pairwise disjoint, so one publication or host grant never spans two links.
+fn endpoint_link<'a>(scope: &'a RouterScope, address: &str) -> Result<&'a LocalLink> {
+    let target = format!("{address}/32");
     let endpoint = scope
         .endpoints
         .iter()
@@ -68,6 +68,9 @@ fn published_link<'a>(scope: &'a RouterScope, port: &RouterPublishedPort) -> Res
         .find(|link| link.interface_index == endpoint.interface_index)
         .ok_or(crate::Error::Invalid)
 }
+fn published_link<'a>(scope: &'a RouterScope, port: &RouterPublishedPort) -> Result<&'a LocalLink> {
+    endpoint_link(scope, &port.endpoint_address)
+}
 /// Inbound publication envelope. Both directions check the exact links, the
 /// translated current tuple and the original conntrack destination, so foreign
 /// NAT cannot borrow this admission for another flow.
@@ -130,6 +133,39 @@ fn published_endpoint(program: &mut Program<'_>, scope: &RouterScope) -> Result<
     }
     Ok(())
 }
+/// Handoff ingress classification for an exact host grant. Like a publication it
+/// is the explicit authority for its tuple, so it leads the protected-source
+/// denial that otherwise drops every packet from the host's transit address, and
+/// it never sets a generation zone: a host grant is an ordinary default-zone flow.
+/// The workload's replies need no classifier of their own: their destination is
+/// protected, so they return to the default zone ahead of every leased classifier.
+fn host_grant_return(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    if !scope.host_grants.is_empty() {
+        let mut expressions = ipv4();
+        expressions.extend(link(&scope.handoff, true));
+        expressions.extend(hostgrant::arrival_lookup());
+        program.end("raw_return", expressions, 1)?;
+    }
+    Ok(())
+}
+/// The workload link of each grant is part of its key; the handoff is fixed.
+fn host_grant_admissions(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    if !scope.host_grants.is_empty() {
+        hostgrant::admissions(program, ["forward", "forward"], true, |reply| {
+            link(&scope.handoff, !reply)
+        })?;
+    }
+    Ok(())
+}
+fn host_grant_sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    if !scope.host_grants.is_empty() {
+        hostgrant::tuple_set(program, &scope.host_grants, |grant| {
+            endpoint_link(scope, &grant.destination_address).map(Some)
+        })?;
+        hostgrant::arrival_set(program, &scope.host_grants)?;
+    }
+    Ok(())
+}
 fn published_translation(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
     for port in &scope.published_ports {
         let mut expressions = ipv4();
@@ -196,6 +232,7 @@ fn raw(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
     // platform return envelope is. The host publishes into this address, so its
     // clients are not confined to unprotected space.
     published_return(program, scope)?;
+    host_grant_return(program, scope)?;
     // Both sides of a publication lead the leased classifiers of every generation,
     // so neither direction depends on the client's choice of source port.
     published_endpoint(program, scope)?;
@@ -327,6 +364,7 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
     for name in ["raw_return", "protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
+    host_grant_sets(program, scope)?;
     let private = policy::Policy {
         schema_version: 1,
         revision,
@@ -354,8 +392,11 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
         // precedes the capture barrier: the barrier denies every protected original
         // destination, which includes this transit address, and an exact inbound
         // publication is the explicit authority for that exception.
+        // Host grants take the same position for the same reason: the barrier
+        // denies the host's protected transit address in both directions.
         if chain == "forward" {
             published_admissions(program, scope)?;
+            host_grant_admissions(program, scope)?;
         }
         for expressions in parts.grants {
             program.rule(chain, expressions)?;

package/rust/src/egress.rs

@@ -103,6 +103,18 @@ pub struct RouterPublishedPort {
     pub endpoint_address: String,
     pub transit_source_address: String,
 }
+/// One exact host-origin flow: the node's own host network namespace dials one
+/// port of one local workload at its lease address, from the transit host
+/// address of the current handoff. The same grant is compiled in every scope the
+/// flow crosses; each scope binds it to the authority that scope proves.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct HostGrant {
+    pub protocol: String,
+    pub source_address: String,
+    pub destination_address: String,
+    pub destination_port: u16,
+}
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RouterScope {
@@ -116,6 +128,9 @@ pub struct RouterScope {
     /// keeps its exact previous digest and compiled graph.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub published_ports: Vec<RouterPublishedPort>,
+    /// Absent and empty are the same canonical policy, like publications.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub host_grants: Vec<HostGrant>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -143,12 +158,19 @@ pub struct HostScope {
     /// keeps its exact previous digest and compiled graph.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub published_ports: Vec<PublishedPort>,
+    /// Absent and empty are the same canonical policy, like publications.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub host_grants: Vec<HostGrant>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct AllocationPoolGuardScope {
     pub authority_digest: String,
     pub prefixes: Vec<String>,
+    /// The only exceptions to the guard: exact host-origin flows into a pool.
+    /// Absent and empty are the same canonical policy.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub host_grants: Vec<HostGrant>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(tag = "kind", rename_all = "camelCase", deny_unknown_fields)]
@@ -473,6 +495,76 @@ fn normalize_router_published(value: &mut RouterScope) -> Result<()> {
     value.published_ports = ports;
     Ok(())
 }
+/// Exact tuples only: one protocol, one unicast source and destination address
+/// and one destination port. Addresses never carry a prefix and ports never a
+/// range, so a grant cannot widen past its flow. `bound` checks the authority of
+/// the enclosing scope.
+fn normalize_host_grants(
+    grants: &mut [HostGrant],
+    bound: impl Fn(&HostGrant) -> Result<()>,
+) -> Result<()> {
+    // The contract maximum per projection; set lookups keep the rule graph
+    // constant, and the element budget holds this many in every scope.
+    require(grants.len() <= 1024)?;
+    grants.sort();
+    for (index, grant) in grants.iter().enumerate() {
+        require(
+            protocol(&grant.protocol)
+                && grant.destination_port > 0
+                && (index == 0 || grants[index - 1] != *grant),
+        )?;
+        unicast(&grant.source_address)?;
+        unicast(&grant.destination_address)?;
+        require(grant.source_address != grant.destination_address)?;
+        bound(grant)?;
+    }
+    Ok(())
+}
+/// The router forwards a host grant from its handoff to one workload: the
+/// destination is an exact current veth endpoint address of this scope, and the
+/// source is protected handoff-side space that is neither router-local, a
+/// platform endpoint nor any workload's address.
+fn normalize_router_host_grants(value: &mut RouterScope) -> Result<()> {
+    let mut grants = std::mem::take(&mut value.host_grants);
+    let scope = &*value;
+    let local = |ip: &str| {
+        scope
+            .links
+            .iter()
+            .chain(std::iter::once(&scope.handoff))
+            .any(|link| link.required_ipv4_addresses.iter().any(|item| item == ip))
+    };
+    let platform = |ip: &str| {
+        scope
+            .protection
+            .platform_endpoints
+            .iter()
+            .any(|endpoint| endpoint.address == ip)
+    };
+    let workload = |ip: &str| {
+        let target = format!("{ip}/32");
+        scope.endpoints.iter().find(|endpoint| {
+            endpoint
+                .source_prefixes
+                .iter()
+                .any(|source| covers(source, &target) == Ok(true))
+        })
+    };
+    normalize_host_grants(&mut grants, |grant| {
+        let endpoint = workload(&grant.destination_address).ok_or(Error::Invalid)?;
+        require(
+            endpoint.interface_kind == "veth"
+                && !local(&grant.destination_address)
+                && !platform(&grant.destination_address)
+                && covers_address(&scope.protection.prefixes, &grant.source_address)?
+                && !local(&grant.source_address)
+                && !platform(&grant.source_address)
+                && workload(&grant.source_address).is_none(),
+        )
+    })?;
+    value.host_grants = grants;
+    Ok(())
+}
 fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
     require(value.links.len() <= 32 && value.generations.len() <= 32)?;
     let private = policy::Policy {
@@ -644,7 +736,8 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
             item.source_port_ranges.as_slice(),
         )
     }))?;
-    normalize_router_published(value)
+    normalize_router_published(value)?;
+    normalize_router_host_grants(value)
 }
 fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     require(
@@ -661,6 +754,58 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
             require(!overlaps(item, previous)?)?;
         }
     }
+    // An exception is only ever an exact flow into a guarded pool.
+    let mut grants = std::mem::take(&mut value.host_grants);
+    normalize_host_grants(&mut grants, |grant| {
+        require(covers_address(&value.prefixes, &grant.destination_address)?)
+    })?;
+    value.host_grants = grants;
+    Ok(())
+}
+/// The host dials from an exact current address of exactly one handoff link, into
+/// protected space that is neither host-local, a platform endpoint nor a leased
+/// router transit address: only a workload behind that handoff remains.
+fn normalize_host_host_grants(value: &mut HostScope) -> Result<()> {
+    let mut grants = std::mem::take(&mut value.host_grants);
+    let scope = &*value;
+    normalize_host_grants(&mut grants, |grant| {
+        let destination = &grant.destination_address;
+        require(
+            scope
+                .handoffs
+                .iter()
+                .filter(|handoff| {
+                    handoff
+                        .link
+                        .required_ipv4_addresses
+                        .contains(&grant.source_address)
+                })
+                .count()
+                == 1
+                && !scope
+                    .uplink
+                    .required_ipv4_addresses
+                    .contains(&grant.source_address)
+                && covers_address(&scope.protection.prefixes, destination)?
+                && scope
+                    .handoffs
+                    .iter()
+                    .map(|handoff| &handoff.link)
+                    .chain(std::iter::once(&scope.uplink))
+                    .all(|link| !link.required_ipv4_addresses.contains(destination))
+                && scope
+                    .protection
+                    .platform_endpoints
+                    .iter()
+                    .all(|endpoint| endpoint.address != *destination)
+                && scope
+                    .handoffs
+                    .iter()
+                    .flat_map(|handoff| handoff.allocations.iter())
+                    .all(|allocation| allocation.transit_source_address != *destination),
+        )
+    })?;
+    value.host_grants = grants;
     Ok(())
 }
 /// Inbound publication is bounded by the same authority the scope already proves:
@@ -777,6 +922,7 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
         }
     }
     normalize_published(value)?;
+    normalize_host_host_grants(value)?;
     unique_links(
         value
             .handoffs
@@ -799,6 +945,9 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
     )
 }
 
+#[cfg(test)]
+#[path = "egress_hostgrant_tests.rs"]
+pub(crate) mod hostgrant_tests;
 #[cfg(test)]
 #[path = "egress_tests.rs"]
 pub(crate) mod tests;