@push.rocks/smartnftables 2.5.1 → 2.6.0

package/rust/src/owner_identity_tests.rs

@@ -328,3 +328,65 @@ fn host_grant_sets_elements_and_lookups_have_exact_graph_identity() {
         assert!(rule_identity(&lookup(invalid)).is_err());
     }
 }
+
+/// A loopback port owner compiles `meta skuid != uid` and a TCP reset. The graph
+/// identity keeps the comparison operator, the uid and the reject type, and the
+/// only reject Linux may dump back is a plain TCP reset.
+#[test]
+fn local_tcp_port_owner_graph_identity_preserves_uid_operator_and_tcp_reset() {
+    let policy = |uid: u32| {
+        crate::egress::localport_tests::owned(
+            crate::egress::tests::pool_guard(),
+            serde_json::json!([crate::egress::localport_tests::owner(
+                "127.0.0.1",
+                10010,
+                uid
+            )]),
+        )
+    };
+    let output = |uid: u32| {
+        let prepared = serde_json::from_value::<crate::egress::Policy>(policy(uid))
+            .unwrap()
+            .prepare()
+            .unwrap();
+        let program = prepared.program("snft_identity").unwrap();
+        let (_, rule) = program
+            .into_iter()
+            .find(|(kind, attributes)| *kind == 6 && wire::text(attributes, 2).unwrap() == "output")
+            .unwrap();
+        rule
+    };
+    let root = rule_identity(&output(0)).unwrap();
+    assert_ne!(rule_identity(&output(1000)).unwrap().1, root.1);
+    // The same rule with `==` instead of `!=` is a different graph.
+    let mut equal = output(0);
+    let expressions = wire::attrs(&wire::one(&equal, 4).unwrap().value).unwrap();
+    let flipped: Vec<_> = expressions
+        .iter()
+        .enumerate()
+        .map(|(index, item)| {
+            if index + 2 != expressions.len() {
+                return item.clone();
+            }
+            let parts = wire::attrs(&item.value).unwrap();
+            let mut fields = wire::attrs(&wire::one(&parts, 2).unwrap().value).unwrap();
+            assert_eq!(wire::number(&fields, 2).unwrap(), 1);
+            fields[1] = Attr::u32(2, 0);
+            expression("cmp", fields)
+        })
+        .collect();
+    equal[2] = Attr::nested(4, flipped);
+    assert_ne!(rule_identity(&equal).unwrap(), root);
+    let reject = |data: Vec<Attr>| rule(vec![expression("reject", data)]);
+    assert!(rule_identity(&reject(vec![Attr::u32(1, 1)])).is_ok());
+    for invalid in [
+        vec![],
+        vec![Attr::u32(1, 0)],
+        vec![Attr::u32(1, 2)],
+        vec![Attr::u32(1, 1), Attr::bytes(2, vec![3])],
+        vec![Attr::u32(1, 1), Attr::u32(1, 1)],
+        vec![Attr::bytes(1, vec![1])],
+    ] {
+        assert!(rule_identity(&reject(invalid)).is_err());
+    }
+}

package/rust/src/owner_localplatform_tests.rs

@@ -0,0 +1,274 @@
+use super::egress_traffic_tests::{connect, denied, host_policy, ns_ip, roundtrip};
+use super::host_traffic_tests::{immediate, payload};
+use super::hostgrant_traffic_tests::Hop;
+use super::router_traffic_tests::connect_from;
+use super::*;
+use crate::{
+    egress,
+    policy::{expr, meta},
+};
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream, UdpSocket};
+use std::time::Duration;
+
+const ROUTER: &str = "lp_router";
+const HOST: &str = "lp_host";
+const PEER: &str = "lp_peer";
+
+/// Two platform endpoints the host serves itself: a TCP hub on the uplink
+/// address and a UDP store on the handoff address.
+fn served(policy: &mut egress::Policy, declared: bool) {
+    let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+        panic!()
+    };
+    if declared {
+        scope.protection.platform_endpoints.extend([
+            egress::PlatformEndpoint {
+                id: "hub".into(),
+                address: "192.0.2.2".into(),
+                protocol: "tcp".into(),
+                port: 8443,
+            },
+            egress::PlatformEndpoint {
+                id: "store".into(),
+                address: "10.240.0.1".into(),
+                protocol: "udp".into(),
+                port: 7000,
+            },
+        ]);
+        scope.local_platform_endpoints = vec!["hub".into(), "store".into()];
+    }
+}
+fn transit_policy(revision: u64, declared: bool) -> egress::Policy {
+    let mut policy = host_policy();
+    policy.revision = revision;
+    served(&mut policy, declared);
+    policy
+}
+
+// A foreign prerouting DNAT, only in this guest: the handoff address port 9000
+// translates to the served hub, so a leased flow could otherwise reach the hub
+// under another destination.
+fn foreign_translation() {
+    let table = "snft_foreign_local_platform";
+    let mut expressions = meta(16, vec![6]);
+    expressions.extend(payload(16, vec![10, 240, 0, 1], false));
+    expressions.extend(payload(2, 9000_u16.to_be_bytes().to_vec(), true));
+    expressions.push(immediate(vec![192, 0, 2, 2]));
+    expressions.push(expr(
+        "immediate",
+        vec![
+            Attr::u32(1, 2),
+            Attr::nested(2, vec![Attr::bytes(1, 8443_u16.to_be_bytes().to_vec())]),
+        ],
+    ));
+    expressions.push(expr(
+        "nat",
+        vec![
+            Attr::u32(1, 1),
+            Attr::u32(2, 2),
+            Attr::u32(3, 1),
+            Attr::u32(4, 1),
+            Attr::u32(5, 2),
+            Attr::u32(6, 2),
+            Attr::u32(7, 3),
+        ],
+    ));
+    let operations = vec![
+        (0, 0x600, vec![Attr::string(1, table), Attr::u32(2, 6)]),
+        (
+            3,
+            0x600,
+            vec![
+                Attr::string(1, table),
+                Attr::string(3, "pre"),
+                Attr::nested(4, vec![Attr::u32(1, 0), Attr::u32(2, -100_i32 as u32)]),
+                Attr::u32(5, 1),
+                Attr::string(7, "nat"),
+                Attr::u32(10, 1),
+            ],
+        ),
+        (
+            6,
+            0xc00,
+            vec![
+                Attr::string(1, table),
+                Attr::string(2, "pre"),
+                Attr::nested(4, expressions),
+            ],
+        ),
+    ];
+    let mut socket = wire::Socket::open().unwrap();
+    let generation = socket.generation().unwrap();
+    socket.batch(generation, operations).unwrap();
+}
+
+/// A UDP socket in `namespace` bound to an exact address and port.
+fn udp(namespace: &str, address: String) -> UdpSocket {
+    let socket = in_namespace(namespace, move || UdpSocket::bind(address).unwrap());
+    socket
+        .set_read_timeout(Some(Duration::from_millis(250)))
+        .unwrap();
+    socket
+}
+/// A TCP flow from an exact leased source address and port in the router
+/// namespace. On success the host's listener observes that exact source and
+/// data crosses both ways.
+fn dial(source: &str, destination: &str, listener: &TcpListener) -> Option<(TcpStream, TcpStream)> {
+    let (from, to) = (source.to_owned(), destination.to_owned());
+    let client = in_namespace(ROUTER, move || connect_from(&from, &to)).ok()?;
+    let (server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.to_string(), source);
+    let (mut client, mut server) = (client, server);
+    for stream in [&client, &server] {
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+    }
+    client.write_all(b"ping").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"pong").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    Some((client, server))
+}
+fn dark(source: &str, destination: &str, listener: &TcpListener) {
+    assert!(
+        dial(source, destination, listener).is_none(),
+        "{source} -> {destination}"
+    );
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_serves_local_platform_endpoints_only_to_exact_leased_untranslated_flows() {
+    isolated();
+    for name in [ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+    }
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/29",
+        HOST,
+        "router",
+        "10.240.0.1/29",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    // A second, unleased source address on the router side of the handoff.
+    ns_ip(
+        ROUTER,
+        &["address", "add", "10.240.0.3/29", "dev", "handoff"],
+    );
+    ns_ip(
+        ROUTER,
+        &["route", "add", "192.0.2.0/24", "via", "10.240.0.1"],
+    );
+    in_namespace(HOST, foreign_translation);
+    let hub = in_namespace(HOST, || TcpListener::bind("192.0.2.2:8443").unwrap());
+    let other = in_namespace(HOST, || TcpListener::bind("192.0.2.2:8444").unwrap());
+    let store = udp(HOST, "10.240.0.1:7000".into());
+    let other_store = udp(HOST, "10.240.0.1:7001".into());
+    let transit = in_namespace(ROUTER, || TcpListener::bind("10.240.0.2:10031").unwrap());
+    // The host's own opening toward the transit address.
+    let host_dial = |expected: bool| {
+        let result = in_namespace(HOST, || {
+            TcpStream::connect_timeout(&"10.240.0.2:10031".parse().unwrap(), Duration::from_secs(1))
+        });
+        assert_eq!(result.is_ok(), expected);
+        if expected {
+            transit.accept().unwrap();
+        }
+    };
+    // Every probe of one phase uses its own source ports: TCP ports that closed
+    // stay in TIME_WAIT and an unreplied UDP entry would carry a decision over.
+    // The leased ranges are UDP 10000–10015 and TCP 10016–10031.
+    let leased = |port: u16| format!("10.240.0.2:{port}");
+    let probes = |phase: u16, served: bool| {
+        let exact = dial(&leased(10016 + phase), "192.0.2.2:8443", &hub);
+        assert_eq!(exact.is_some(), served, "phase {phase}");
+        let client = udp(ROUTER, leased(10000 + phase));
+        if served {
+            let observed = roundtrip(&client, &store);
+            assert_eq!(observed.to_string(), leased(10000 + phase));
+        } else {
+            denied(&client, &store, false);
+        }
+        exact
+    };
+    // The rest never passes the member: another port, another protocol range,
+    // outside the lease, another source address, another endpoint port, and a
+    // flow whose destination was rewritten in transit.
+    let refused = |phase: u16| {
+        dark(&leased(20000 + phase), "192.0.2.2:8443", &hub);
+        dark(&leased(10005 + phase), "192.0.2.2:8443", &hub);
+        dark(
+            &format!("10.240.0.3:{}", 10021 + phase),
+            "192.0.2.2:8443",
+            &hub,
+        );
+        dark(&leased(10021 + phase), "192.0.2.2:8444", &other);
+        dark(&leased(10026 + phase), "10.240.0.1:9000", &hub);
+        denied(&udp(ROUTER, leased(10006 + phase)), &other_store, false);
+        denied(&udp(ROUTER, leased(10026 + phase)), &store, false);
+        host_dial(false);
+    };
+    // Positive controls without policy: every probe can succeed, including the
+    // translated flow and the host's own opening.
+    probes(0, true);
+    assert!(dial("10.240.0.2:20000", "192.0.2.2:8443", &hub).is_some());
+    assert!(dial("10.240.0.2:10005", "192.0.2.2:8443", &hub).is_some());
+    assert!(dial("10.240.0.3:10021", "192.0.2.2:8443", &hub).is_some());
+    assert!(dial("10.240.0.2:10021", "192.0.2.2:8444", &other).is_some());
+    assert!(dial("10.240.0.2:10026", "10.240.0.1:9000", &hub).is_some());
+    roundtrip(&udp(ROUTER, leased(10006)), &other_store);
+    roundtrip(&udp(ROUTER, leased(10026)), &store);
+    host_dial(true);
+
+    let mut transit_hop = Hop::new(HOST, "local_platform_transit");
+    // Without the member the handoff denials refuse the host's own addresses.
+    transit_hop.apply(transit_policy, 1, false);
+    assert!(probes(1, false).is_none());
+    refused(1);
+    // With it, exactly the leased flows reach the served endpoints.
+    transit_hop.apply(transit_policy, 2, true);
+    let (mut established, mut accepted) = probes(2, true).unwrap();
+    refused(2);
+    // Withdrawal stops new flows and the established one.
+    transit_hop.apply(transit_policy, 3, false);
+    assert!(probes(3, false).is_none());
+    established.write_all(b"late").unwrap();
+    assert!(accepted.read_exact(&mut [0; 4]).is_err());
+    drop((established, accepted));
+    transit_hop.release();
+    // Release control: the path is open again, so each denial was this table.
+    assert!(probes(4, true).is_some());
+    println!("V2_LOCAL_PLATFORM_PROOF positive_controls=true undeclared_dark=true exact_tcp=true exact_udp=true source_preserved=true outside_lease_denied=true other_protocol_range_denied=true other_source_denied=true other_port_denied=true translated_denied=true host_origin_denied=true withdrawn_dark=true established_withdrawn=true release_control=true");
+}
+
+/// The complete graph with served endpoints persists across owner loss and
+/// verifies before adoption, like every other transit graph.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_host_local_platform_graph_persist_and_lost_ack_recovery() {
+    isolated();
+    // Peers live in another namespace, as the bound veth facts expect.
+    ip(&["netns", "add", PEER]);
+    for (name, address) in [("router", "10.240.0.1/30"), ("uplink", "192.0.2.2/24")] {
+        ip(&[
+            "link", "add", name, "type", "veth", "peer", "name", name, "netns", PEER,
+        ]);
+        ip(&["address", "add", address, "dev", name]);
+        ip(&["link", "set", name, "up"]);
+    }
+    let mut policy = host_policy();
+    served(&mut policy, true);
+    super::egress_tests::recover("local_platform_v2", policy);
+}

package/rust/src/owner_localport_tests.rs

@@ -0,0 +1,241 @@
+use super::egress_traffic_tests::{connect, ns_ip};
+use super::host_traffic_tests::{immediate, payload};
+use super::*;
+use crate::{
+    egress,
+    policy::{expr, meta},
+};
+use serde_json::json;
+use std::io::ErrorKind;
+use std::net::{SocketAddr, TcpListener, TcpStream};
+use std::time::Duration;
+
+const HOST: &str = "lp_host";
+const PEER: &str = "lp_peer";
+
+fn owned(owners: serde_json::Value) -> egress::Policy {
+    serde_json::from_value(egress::localport_tests::owned(
+        egress::tests::pool_guard(),
+        owners,
+    ))
+    .unwrap()
+}
+
+/// The complete graph with the maximum of loopback owners, including every
+/// TCP reset, persists across owner loss and verifies before adoption.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn local_tcp_port_owner_maximum_graph_persist_and_lost_ack_recovery() {
+    isolated();
+    let owners: Vec<_> = (0..8)
+        .map(|index| egress::localport_tests::owner("127.0.0.1", 10010 + index, index.into()))
+        .collect();
+    super::egress_tests::recover("local_port_v2", owned(json!(owners)));
+}
+
+// Foreign NAT controls exist only in this offline guest: the uplink address and
+// an off-host destination both translate to the loopback service, as a foreign
+// owner's prerouting or output DNAT could. They are never part of the policy.
+fn foreign_loopback_translation() {
+    let table = "snft_foreign_loopback";
+    let mut operations = vec![(0, 0x600, vec![Attr::string(1, table), Attr::u32(2, 6)])];
+    for (chain, hook, destination) in [("pre", 0, [192, 0, 2, 2]), ("out", 3, [198, 51, 100, 1])] {
+        operations.push((
+            3,
+            0x600,
+            vec![
+                Attr::string(1, table),
+                Attr::string(3, chain),
+                Attr::nested(4, vec![Attr::u32(1, hook), Attr::u32(2, -100_i32 as u32)]),
+                Attr::u32(5, 1),
+                Attr::string(7, "nat"),
+                Attr::u32(10, 1),
+            ],
+        ));
+        let mut expressions = meta(16, vec![6]);
+        expressions.extend(payload(16, destination.to_vec(), false));
+        expressions.extend(payload(2, 10010_u16.to_be_bytes().to_vec(), true));
+        expressions.push(immediate(vec![127, 0, 0, 1]));
+        expressions.push(expr(
+            "nat",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, 2),
+                Attr::u32(3, 1),
+                Attr::u32(4, 1),
+                Attr::u32(7, 1),
+            ],
+        ));
+        operations.push((
+            6,
+            0xc00,
+            vec![
+                Attr::string(1, table),
+                Attr::string(2, chain),
+                Attr::nested(4, expressions),
+            ],
+        ));
+    }
+    let mut socket = wire::Socket::open().unwrap();
+    let generation = socket.generation().unwrap();
+    socket.batch(generation, operations).unwrap();
+}
+
+/// One TCP connection attempt from `namespace`. A `uid` changes only this
+/// thread's credentials (the raw syscall, not libc's process-wide setresuid)
+/// before the socket is created, so the socket file carries that uid.
+fn dial(namespace: &str, uid: Option<u32>, destination: &str) -> std::io::Result<TcpStream> {
+    let destination: SocketAddr = destination.parse().unwrap();
+    in_namespace(namespace, move || {
+        if let Some(uid) = uid {
+            assert_eq!(
+                unsafe { libc::syscall(libc::SYS_setresuid, uid, uid, uid) },
+                0
+            );
+            assert_eq!(unsafe { libc::syscall(libc::SYS_geteuid) }, i64::from(uid));
+        }
+        TcpStream::connect_timeout(&destination, Duration::from_millis(750))
+    })
+}
+fn reaches(namespace: &str, uid: Option<u32>, destination: &str) {
+    if let Err(error) = dial(namespace, uid, destination) {
+        panic!("{namespace} uid {uid:?} to {destination}: {error}");
+    }
+}
+fn refused(namespace: &str, uid: Option<u32>, destination: &str) {
+    let error = dial(namespace, uid, destination).unwrap_err();
+    assert_eq!(
+        error.kind(),
+        ErrorKind::ConnectionRefused,
+        "{uid:?} {destination}"
+    );
+}
+fn dark(namespace: &str, uid: Option<u32>, destination: &str) {
+    let error = dial(namespace, uid, destination).unwrap_err();
+    assert!(
+        matches!(
+            error.kind(),
+            ErrorKind::TimedOut | ErrorKind::ConnectionRefused
+        ),
+        "{uid:?} {destination}: {error}"
+    );
+}
+
+/// Every probe runs first as a positive control on the same listeners, then
+/// under the policy, then again after release, so each denial is this owner's.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn local_tcp_port_owner_resets_other_users_and_drops_non_loopback_arrivals() {
+    isolated();
+    for name in [HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+    }
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(
+        HOST,
+        &["route", "add", "198.51.100.0/24", "via", "192.0.2.3"],
+    );
+    in_namespace(HOST, || {
+        // The setting that let adjacent hosts reach loopback services (CVE-2020-8558).
+        for device in ["all", "uplink"] {
+            std::fs::write(
+                format!("/proc/sys/net/ipv4/conf/{device}/route_localnet"),
+                "1",
+            )
+            .unwrap();
+        }
+        foreign_loopback_translation();
+    });
+    let listeners: Vec<TcpListener> = in_namespace(HOST, || {
+        [
+            "127.0.0.1:10010",
+            "127.0.0.1:10011",
+            "127.0.0.1:10012",
+            "127.0.0.2:10010",
+        ]
+        .into_iter()
+        .map(|address| TcpListener::bind(address).unwrap())
+        .collect()
+    });
+    let probes = |applied: bool| {
+        // Root owns 10010, uid 1000 owns 10011; 10012 and 127.0.0.2 are unowned.
+        reaches(HOST, None, "127.0.0.1:10010");
+        reaches(HOST, Some(1000), "127.0.0.1:10011");
+        for uid in [1000, 65534] {
+            reaches(HOST, Some(uid), "127.0.0.1:10012");
+            reaches(HOST, Some(uid), "127.0.0.2:10010");
+        }
+        reaches(HOST, None, "198.51.100.1:10010");
+        if applied {
+            for uid in [1, 1000, 65534] {
+                refused(HOST, Some(uid), "127.0.0.1:10010");
+            }
+            refused(HOST, None, "127.0.0.1:10011");
+            // Output DNAT runs before filter priority 0: the translated
+            // destination is owned, so another user never connects.
+            dark(HOST, Some(1000), "198.51.100.1:10010");
+            // Arrival on the uplink, translated to loopback, drops at INPUT.
+            dark(PEER, None, "192.0.2.2:10010");
+        } else {
+            for uid in [1, 1000, 65534] {
+                reaches(HOST, Some(uid), "127.0.0.1:10010");
+            }
+            reaches(HOST, None, "127.0.0.1:10011");
+            reaches(HOST, Some(1000), "198.51.100.1:10010");
+            reaches(PEER, None, "192.0.2.2:10010");
+        }
+    };
+    probes(false);
+    let (owner, applied) = in_namespace(HOST, || {
+        let mut owner = Owner::new(options("local_port_traffic")).unwrap();
+        let target = owned(json!([
+            egress::localport_tests::owner("127.0.0.1", 10010, 0),
+            egress::localport_tests::owner("127.0.0.1", 10011, 1000)
+        ]))
+        .prepare()
+        .unwrap()
+        .into();
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
+    probes(true);
+    // Retained after the owning process is gone: the kernel still enforces it,
+    // and a fresh owner verifies the exact graph before adopting it.
+    let applied = in_namespace(HOST, move || {
+        let mut owner = owner;
+        owner.detach(applied.clone()).unwrap();
+        assert_eq!(owner.inspect().state, "retained");
+        drop(owner);
+        applied
+    });
+    probes(true);
+    in_namespace(HOST, move || {
+        let mut owner = Owner::new(options("local_port_traffic")).unwrap();
+        let recovered = owner
+            .reconcile(Transition {
+                previous: None,
+                target: applied.prepared.clone(),
+            })
+            .unwrap();
+        assert_eq!(recovered, applied);
+        assert!(owner.inspect().enforced);
+        owner.release(recovered).unwrap();
+    });
+    probes(false);
+    drop(listeners);
+    println!("LOCAL_TCP_PORT_OWNER_PROOF owner_reaches=true other_uids_reset=true uid_generic=true unowned_port_and_address_open=true output_dnat_denied=true non_loopback_arrival_dropped=true retained_after_owner_loss=true adopted_after_verification=true release_control=true");
+}

package/rust/src/owner_tests.rs

@@ -27,6 +27,15 @@ mod router_traffic_tests;
 #[path = "owner_poolguard_tests.rs"]
 mod poolguard_tests;
 
+#[path = "owner_localport_tests.rs"]
+mod localport_tests;
+
+#[path = "owner_localplatform_tests.rs"]
+mod localplatform_tests;
+
+#[path = "owner_workloadgrant_tests.rs"]
+mod workloadgrant_tests;
+
 #[path = "owner_hostgrant_traffic_tests.rs"]
 mod hostgrant_traffic_tests;