@push.rocks/smartnftables 2.5.1 → 2.6.0

package/rust/src/owner_workloadgrant_tests.rs

@@ -0,0 +1,278 @@
+use super::egress_traffic_tests::{
+    allocation, binding, connect, denied, ns_ip, protection, roundtrip,
+};
+use super::hostgrant_traffic_tests::Hop;
+use super::router_traffic_tests::connect_from;
+use super::*;
+use crate::egress;
+use serde_json::{json, Value};
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream, UdpSocket};
+use std::time::Duration;
+
+const A: &str = "wg_a";
+const B: &str = "wg_b";
+const C: &str = "wg_c";
+const ROUTER: &str = "wg_router";
+const HOST: &str = "wg_host";
+
+fn endpoint(name: &str, prefix: &str, link: &Value) -> Value {
+    json!({"id":name,"interfaceIndex":link["interfaceIndex"],"interfaceName":name,
+        "interfaceKind":"veth","sourcePrefixes":[prefix]})
+}
+/// Three workloads behind the router, each with leased public egress on every
+/// port of both protocols, exactly as a node composes it: a leased classifier
+/// would claim a workload's packets if grants were not default-zone flows.
+fn router_policy(revision: u64, granted: bool) -> egress::Policy {
+    let links: Vec<_> = [
+        ("wka", "10.241.0.1"),
+        ("wkb", "10.241.1.1"),
+        ("wkc", "10.241.2.1"),
+    ]
+    .into_iter()
+    .map(|(name, address)| binding(name, address, "veth"))
+    .collect();
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    let mut grants = Vec::new();
+    for (name, source) in [
+        ("wka", "10.241.0.2"),
+        ("wkb", "10.241.1.2"),
+        ("wkc", "10.241.2.2"),
+    ] {
+        for (protocol, first, last) in [("udp", 10000, 10015), ("tcp", 10016, 10031)] {
+            grants.push(json!({"sourceEndpoint":name,"sourcePrefix":format!("{source}/32"),
+                "destination":{"kind":"public","prefix":"0.0.0.0/0"},"protocol":protocol,
+                "sourcePort":null,"destinationPort":null,"sourcePortRange":{"first":first,"last":last}}));
+        }
+    }
+    generation["grants"] = json!(grants);
+    let workload_grants = if granted {
+        json!([
+            {"protocol":"tcp","sourceAddress":"10.241.0.2","destinationAddress":"10.241.1.2","destinationPort":8080},
+            {"protocol":"udp","sourceAddress":"10.241.0.2","destinationAddress":"10.241.1.2","destinationPort":5353}
+        ])
+    } else {
+        json!([])
+    };
+    serde_json::from_value(json!({"schemaVersion":2,"revision":revision,"scope":{"kind":"routerEgress",
+        "endpoints":[endpoint("wka","10.241.0.2/32",&links[0]),endpoint("wkb","10.241.1.2/32",&links[1]),
+            endpoint("wkc","10.241.2.2/32",&links[2])],
+        "rules":[],"links":links,"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation],"workloadGrants":workload_grants}}))
+    .unwrap()
+}
+fn udp(namespace: &str, address: &str) -> UdpSocket {
+    let address = address.to_owned();
+    let socket = in_namespace(namespace, move || UdpSocket::bind(address).unwrap());
+    socket
+        .set_read_timeout(Some(Duration::from_millis(250)))
+        .unwrap();
+    socket
+}
+/// A TCP flow from an exact source; on success the listener observes it and
+/// data crosses both ways.
+fn dial(
+    namespace: &str,
+    source: &str,
+    destination: &str,
+    listener: &TcpListener,
+) -> Option<(TcpStream, TcpStream)> {
+    let (from, to) = (source.to_owned(), destination.to_owned());
+    let client = in_namespace(namespace, move || connect_from(&from, &to)).ok()?;
+    let (server, peer) = listener.accept().unwrap();
+    assert_eq!(peer.to_string(), source);
+    let (mut client, mut server) = (client, server);
+    for stream in [&client, &server] {
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+    }
+    client.write_all(b"ping").unwrap();
+    server.read_exact(&mut [0; 4]).unwrap();
+    server.write_all(b"pong").unwrap();
+    client.read_exact(&mut [0; 4]).unwrap();
+    Some((client, server))
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_workload_grant_opens_one_way_between_workloads_and_never_in_reverse() {
+    isolated();
+    for name in [A, B, C, ROUTER, HOST] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+    }
+    in_namespace(ROUTER, || {
+        std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+    });
+    for (namespace, name, octet) in [(A, "wka", 0), (B, "wkb", 1), (C, "wkc", 2)] {
+        connect(
+            namespace,
+            "eth0",
+            &format!("10.241.{octet}.2/24"),
+            ROUTER,
+            name,
+            &format!("10.241.{octet}.1/24"),
+        );
+        ns_ip(
+            namespace,
+            &[
+                "route",
+                "add",
+                "default",
+                "via",
+                &format!("10.241.{octet}.1"),
+            ],
+        );
+    }
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    let granted = in_namespace(B, || TcpListener::bind("10.241.1.2:8080").unwrap());
+    let other = in_namespace(B, || TcpListener::bind("10.241.1.2:8081").unwrap());
+    let third = in_namespace(C, || TcpListener::bind("10.241.2.2:8080").unwrap());
+    let source = in_namespace(A, || TcpListener::bind("10.241.0.2:9000").unwrap());
+    let served = udp(B, "10.241.1.2:5353");
+    let other_served = udp(B, "10.241.1.2:5354");
+    // Each phase uses its own client ports; TCP ports that closed stay in TIME_WAIT
+    // and an unreplied UDP entry would carry a decision over a policy change.
+    let exact = |phase: u16| {
+        let result = dial(
+            A,
+            &format!("10.241.0.2:{}", 40000 + phase),
+            "10.241.1.2:8080",
+            &granted,
+        );
+        let client = udp(A, &format!("10.241.0.2:{}", 41000 + phase));
+        (result, client)
+    };
+    let refused = |phase: u16| {
+        // Another port, another source workload, another destination workload.
+        assert!(dial(
+            A,
+            &format!("10.241.0.2:{}", 42000 + phase),
+            "10.241.1.2:8081",
+            &other
+        )
+        .is_none());
+        assert!(dial(
+            C,
+            &format!("10.241.2.2:{}", 40000 + phase),
+            "10.241.1.2:8080",
+            &granted
+        )
+        .is_none());
+        assert!(dial(
+            A,
+            &format!("10.241.0.2:{}", 43000 + phase),
+            "10.241.2.2:8080",
+            &third
+        )
+        .is_none());
+        // No reverse opening: the destination cannot open toward the source.
+        assert!(dial(
+            B,
+            &format!("10.241.1.2:{}", 44000 + phase),
+            "10.241.0.2:9000",
+            &source
+        )
+        .is_none());
+        let reverse = udp(B, &format!("10.241.1.2:{}", 45000 + phase));
+        denied(
+            &reverse,
+            &udp(A, &format!("10.241.0.2:{}", 46000 + phase)),
+            false,
+        );
+        denied(
+            &udp(A, &format!("10.241.0.2:{}", 47000 + phase)),
+            &other_served,
+            false,
+        );
+    };
+    // Positive controls without policy: every probe below can succeed.
+    let (flow, client) = exact(0);
+    assert!(flow.is_some());
+    roundtrip(&client, &served);
+    assert!(dial(A, "10.241.0.2:42000", "10.241.1.2:8081", &other).is_some());
+    assert!(dial(C, "10.241.2.2:40000", "10.241.1.2:8080", &granted).is_some());
+    assert!(dial(A, "10.241.0.2:43000", "10.241.2.2:8080", &third).is_some());
+    assert!(dial(B, "10.241.1.2:44000", "10.241.0.2:9000", &source).is_some());
+    roundtrip(&udp(B, "10.241.1.2:45000"), &udp(A, "10.241.0.2:46000"));
+    roundtrip(&udp(A, "10.241.0.2:47000"), &other_served);
+
+    let mut router = Hop::new(ROUTER, "workload_grant_router");
+    // Without grants the private endpoint denials refuse every workload flow.
+    router.apply(router_policy, 1, false);
+    let (flow, client) = exact(1);
+    assert!(flow.is_none());
+    denied(&client, &served, false);
+    refused(1);
+    // With them, exactly the source's openings and their answers pass.
+    router.apply(router_policy, 2, true);
+    let (flow, client) = exact(2);
+    let (mut established, mut accepted) = flow.expect("granted workload tcp");
+    let observed = roundtrip(&client, &served);
+    assert_eq!(observed.to_string(), "10.241.0.2:41002");
+    refused(2);
+    // Withdrawal stops new flows and the established one.
+    router.apply(router_policy, 3, false);
+    let (flow, client) = exact(3);
+    assert!(flow.is_none());
+    denied(&client, &served, false);
+    established.write_all(b"late").unwrap();
+    assert!(accepted.read_exact(&mut [0; 4]).is_err());
+    drop((established, accepted));
+    router.release();
+    // Release control.
+    let (flow, client) = exact(4);
+    assert!(flow.is_some());
+    roundtrip(&client, &served);
+    println!("V2_WORKLOAD_GRANT_PROOF positive_controls=true ungranted_dark=true exact_tcp=true exact_udp=true source_preserved=true leased_egress_unaffected=true other_port_denied=true other_source_denied=true other_destination_denied=true reverse_tcp_denied=true reverse_udp_denied=true withdrawn_dark=true established_withdrawn=true release_control=true");
+}
+
+/// A full grant set of 1024 persists across owner loss, is re-verified element
+/// by element before adoption, and is replaced and released like the rest.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_workload_grant_set_persist_and_lost_ack_recovery() {
+    isolated();
+    // Peers live in another namespace, as the bound veth facts expect.
+    ip(&["netns", "add", HOST]);
+    for (name, address) in [
+        ("wka", "10.241.0.1/24"),
+        ("wkb", "10.241.1.1/24"),
+        ("wkc", "10.241.2.1/24"),
+        ("handoff", "10.240.0.2/30"),
+    ] {
+        ip(&[
+            "link", "add", name, "type", "veth", "peer", "name", name, "netns", HOST,
+        ]);
+        ip(&["address", "add", address, "dev", name]);
+        ip(&["link", "set", name, "up"]);
+    }
+    let mut policy = router_policy(1, true);
+    let egress::Scope::RouterEgress(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.workload_grants = (0..1024_u16)
+        .map(|index| egress::WorkloadGrant {
+            protocol: if index % 2 == 0 { "tcp" } else { "udp" }.into(),
+            source_address: "10.241.0.2".into(),
+            destination_address: if index < 512 {
+                "10.241.1.2"
+            } else {
+                "10.241.2.2"
+            }
+            .into(),
+            destination_port: 20000 + index,
+        })
+        .collect();
+    super::egress_tests::recover("workload_grant_v2", policy);
+}

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '2.5.1',
+  version: '2.6.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/managed.egress.types.ts

@@ -88,6 +88,22 @@ export interface IManagedNftHostGrant {
   destinationPort: number;
 }
 
+/** One stateful one-way flow between two workloads behind the same router: the source workload opens
+ * connections to one exact port of the destination workload, which may only answer. Both addresses are
+ * exact current addresses of two different veth workload endpoints of the scope. It admits the tuple
+ * (a TCP opening only with SYN) and its ESTABLISHED replies in the default conntrack zone and nothing
+ * else: no reverse opening, no translation and no source-port selection. Grant the reverse direction as
+ * a second grant. */
+export interface IManagedNftWorkloadGrant {
+  protocol: 'tcp' | 'udp';
+  /** Exact unicast address of the dialling workload endpoint, never a prefix. */
+  sourceAddress: string;
+  /** Exact unicast address of the dialled workload endpoint, never a prefix. */
+  destinationAddress: string;
+  /** The destination workload's exact listening port, 1–65535; never a range. */
+  destinationPort: number;
+}
+
 /** One combined private/TUN/local/egress table; never compose a second ACCEPT over v1 terminal drops. */
 export interface IManagedNftRouterEgressScopeV2 {
   kind: 'routerEgress';
@@ -111,6 +127,10 @@ export interface IManagedNftRouterEgressScopeV2 {
    * workload. Absent and empty are the same canonical policy, digest and compiled graph; at most 1024,
    * held in a named set behind a constant number of rules. */
   hostGrants?: IManagedNftHostGrant[];
+  /** Optional stateful one-way workload-to-workload grants. Absent and empty are the same canonical
+   * policy, digest and compiled graph; at most 1024, held in two named sets behind four rules. They
+   * share the scope's set element budget with `hostGrants`. */
+  workloadGrants?: IManagedNftWorkloadGrant[];
 }
 
 /** One inbound uplink publication, compiled inside the same host-transit generation. */
@@ -143,6 +163,28 @@ export interface IManagedNftHostTransitScopeV2 {
    * host-local, a platform endpoint nor a leased transit source address. Absent and empty are the
    * same canonical policy; at most 1024, held in a named set behind a constant number of rules. */
   hostGrants?: IManagedNftHostGrant[];
+  /** Optional ids of `protection.platformEndpoints` this host serves itself, on an exact current address
+   * of the uplink or of a handoff link (rtnetlink verifies it at apply, recovery and inspection). Only a
+   * declared endpoint may hold a host address. Leased flows reach it from their exact handoff with the
+   * leased source address and a source port of the allocation's range for the endpoint's protocol; its
+   * ESTABLISHED replies return. Absent and empty are the same canonical policy, digest and compiled graph. */
+  localPlatformEndpoints?: string[];
+}
+
+/** One loopback TCP service that only one local user may dial. Every packet the host sends to the
+ * exact address and port from a socket of any other user is rejected with a TCP reset, after ordinary
+ * output destination NAT; the address and port arriving on any interface but loopback are dropped.
+ * The service must bind exactly this address: a wildcard listener stays reachable through others. */
+export interface IManagedNftLocalTcpPortOwner {
+  /** Exact IPv4 loopback host address in 127.0.0.0/8, e.g. `127.0.0.1`. Never a prefix or wildcard. */
+  address: string;
+  /** The service's exact listening port, 1–65535; never a range. */
+  port: number;
+  /** The only user id whose sockets may send to the port: the socket file's file-system uid as
+   * the user namespace owning the network namespace sees it, 0–4294967294. Packets without a socket file carry no uid and
+   * are not matched: kernel replies, the teardown of an orphaned socket, and in-kernel sockets such as NFS or CIFS clients,
+   * which only privileged mounts create. */
+  uid: number;
 }
 
 /** Host-wide IPv4 destination denial for caller-authenticated private allocation pools.
@@ -156,6 +198,10 @@ export interface IManagedNftAllocationPoolGuardScopeV2 {
    * listed pool, and their replies. Absent and empty are the same canonical policy; at most 1024,
    * held in a named set behind a constant number of rules. */
   hostGrants?: IManagedNftHostGrant[];
+  /** Optional host-wide loopback port ownership, compiled ahead of the guard in the same table.
+   * Absent and empty are the same canonical policy, digest and compiled graph; at most 8, one per
+   * exact address and port. */
+  localTcpPortOwners?: IManagedNftLocalTcpPortOwner[];
 }
 
 export interface IManagedNftPolicyV2 {