@push.rocks/smartnftables 2.5.2 → 3.0.0

package/rust/src/egress_routerequivalence_tests.rs

@@ -0,0 +1,448 @@
+//! Router decision corpus: every hook's verdict, stored zone and NAT for a
+//! deterministic corpus of packets around each fixture's grants, rules and
+//! protection. The digests were frozen from the per-rule router compiler, so the
+//! set-backed compiler must decide every one of these packets identically.
+use super::hostgrant_tests::{Flow, Simulator};
+use super::{Destination, Policy, Prepared, RouterScope, Scope};
+use serde_json::{json, Value};
+
+const NEW: u32 = 8;
+const ESTABLISHED: u32 = 2;
+const SYN: u8 = 0x02;
+const ACK: u8 = 0x10;
+const CHAINS: [&str; 7] = [
+    "raw_in", "raw_out", "input", "forward", "output", "post", "pre",
+];
+
+/// A small deterministic generator; the corpus must never change between runs.
+struct Random(u64);
+impl Random {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+    fn pick<T: Copy>(&mut self, items: &[T]) -> T {
+        items[(self.next() % items.len() as u64) as usize]
+    }
+    fn chance(&mut self, percent: u64) -> bool {
+        self.next() % 100 < percent
+    }
+}
+
+type Link = Option<(u32, &'static str)>;
+fn leak(value: String) -> &'static str {
+    Box::leak(value.into_boxed_str())
+}
+fn first(prefix: &str) -> [u8; 4] {
+    let (address, _) = super::prefix(prefix).unwrap();
+    address.to_be_bytes()
+}
+fn last(prefix: &str) -> [u8; 4] {
+    let (address, mask) = super::prefix(prefix).unwrap();
+    (address | !mask).to_be_bytes()
+}
+fn ip(value: &str) -> [u8; 4] {
+    value.parse::<std::net::Ipv4Addr>().unwrap().octets()
+}
+fn label(value: &str) -> [u8; 16] {
+    let bytes: Vec<u8> = (0..16)
+        .map(|index| u8::from_str_radix(&value[index * 2..index * 2 + 2], 16).unwrap())
+        .collect();
+    bytes.try_into().unwrap()
+}
+
+/// The values a fixture's packets are drawn from, and templates of the flows its
+/// authority names, in both directions.
+struct Pools {
+    links: Vec<Link>,
+    addresses: Vec<[u8; 4]>,
+    ports: Vec<u16>,
+    zones: Vec<u16>,
+    labels: Vec<[u8; 16]>,
+    templates: Vec<Flow>,
+}
+fn flow(
+    input: Link,
+    output: Link,
+    protocol: u8,
+    source: ([u8; 4], u16),
+    destination: ([u8; 4], u16),
+) -> Flow {
+    Flow {
+        input,
+        output,
+        protocol,
+        source: source.0,
+        destination: destination.0,
+        source_port: source.1,
+        destination_port: destination.1,
+        tcp_flags: SYN,
+        state: NEW,
+        reply: false,
+        zone: 0,
+        original: (source.0, destination.0, source.1, destination.1),
+        uid: None,
+        label: [0; 16],
+    }
+}
+fn answer(flow: Flow) -> Flow {
+    Flow {
+        input: flow.output,
+        output: flow.input,
+        source: flow.destination,
+        destination: flow.source,
+        source_port: flow.destination_port,
+        destination_port: flow.source_port,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..flow
+    }
+}
+fn protocol(name: &str) -> u8 {
+    if name == "tcp" {
+        6
+    } else {
+        17
+    }
+}
+fn pools(scope: &RouterScope) -> Pools {
+    let link = |index: u32, name: &str| Some((index, leak(name.to_string())));
+    let mut links: Vec<Link> = vec![
+        None,
+        link(scope.handoff.interface_index, &scope.handoff.interface_name),
+    ];
+    for item in &scope.links {
+        links.push(link(item.interface_index, &item.interface_name));
+        // The same index under another name, and the same name at another index.
+        links.push(link(item.interface_index, "renamed"));
+        links.push(link(item.interface_index + 100, &item.interface_name));
+    }
+    let endpoint_link = |id: &str| {
+        let endpoint = scope.endpoints.iter().find(|item| item.id == id).unwrap();
+        link(endpoint.interface_index, &endpoint.interface_name)
+    };
+    let handoff = link(scope.handoff.interface_index, &scope.handoff.interface_name);
+    let mut addresses = vec![
+        ip("198.51.100.7"),
+        ip("8.8.8.8"),
+        ip("10.9.9.9"),
+        ip("192.0.2.200"),
+    ];
+    for item in scope.links.iter().chain(std::iter::once(&scope.handoff)) {
+        addresses.extend(item.required_ipv4_addresses.iter().map(|value| ip(value)));
+    }
+    for endpoint in &scope.endpoints {
+        for prefix in &endpoint.source_prefixes {
+            addresses.extend([first(prefix), last(prefix)]);
+        }
+    }
+    for prefix in &scope.protection.prefixes {
+        addresses.extend([first(prefix), last(prefix)]);
+    }
+    for endpoint in &scope.protection.platform_endpoints {
+        addresses.push(ip(&endpoint.address));
+    }
+    let mut ports = vec![53, 443, 3000, 5353, 8080, 40000, 65535];
+    let mut zones = vec![0, 7];
+    let mut labels = vec![[0; 16], [0x55; 16]];
+    let mut templates = Vec::new();
+    for generation in &scope.generations {
+        zones.push(generation.conntrack_zone);
+        labels.push(label(&generation.conntrack_label));
+        let transit = ip(&generation.transit_source_address);
+        for range in &generation.source_port_ranges {
+            ports.extend([
+                range.first,
+                range.last,
+                range.first.saturating_sub(1),
+                range.last.saturating_add(1),
+            ]);
+        }
+        for grant in &generation.grants {
+            let target = match &grant.destination {
+                Destination::Public { prefix } => {
+                    if prefix == "0.0.0.0/0" {
+                        ip("198.51.100.7")
+                    } else {
+                        first(prefix)
+                    }
+                }
+                Destination::Platform { endpoint_id } => ip(&scope
+                    .protection
+                    .platform_endpoints
+                    .iter()
+                    .find(|item| item.id == *endpoint_id)
+                    .unwrap()
+                    .address),
+            };
+            let source = first(&grant.source_prefix);
+            let input = grant
+                .source_endpoint
+                .as_deref()
+                .map(endpoint_link)
+                .unwrap_or(None);
+            let original = flow(
+                input,
+                handoff,
+                protocol(&grant.protocol),
+                (source, grant.source_port.unwrap_or(40000)),
+                (target, grant.destination_port.unwrap_or(443)),
+            );
+            let zoned = Flow {
+                zone: generation.conntrack_zone,
+                ..original
+            };
+            let labelled = Flow {
+                label: label(&generation.conntrack_label),
+                ..zoned
+            };
+            templates.extend([original, zoned, labelled, answer(labelled)]);
+            // The translated return arriving on the handoff, before conntrack.
+            templates.push(flow(
+                handoff,
+                None,
+                protocol(&grant.protocol),
+                (target, grant.destination_port.unwrap_or(443)),
+                (transit, grant.source_port_range.first),
+            ));
+        }
+    }
+    for rule in &scope.rules {
+        let input = rule
+            .source_endpoint
+            .as_deref()
+            .map(endpoint_link)
+            .unwrap_or(None);
+        let output = rule
+            .destination_endpoint
+            .as_deref()
+            .map(endpoint_link)
+            .unwrap_or(None);
+        let protocols: Vec<u8> = if rule.protocol == "any" {
+            vec![6, 17, 1]
+        } else {
+            vec![protocol(&rule.protocol)]
+        };
+        for value in protocols {
+            let template = flow(
+                input,
+                output,
+                value,
+                (
+                    first(&rule.source_prefix),
+                    rule.source_port.unwrap_or(40000),
+                ),
+                (
+                    first(&rule.destination_prefix),
+                    rule.destination_port.unwrap_or(40001),
+                ),
+            );
+            templates.extend([template, answer(template)]);
+        }
+    }
+    for grant in scope.host_grants.iter().chain(&scope.workload_grants) {
+        ports.push(grant.destination_port);
+        let template = flow(
+            handoff,
+            links[3],
+            protocol(&grant.protocol),
+            (ip(&grant.source_address), 40000),
+            (ip(&grant.destination_address), grant.destination_port),
+        );
+        templates.extend([template, answer(template)]);
+    }
+    Pools {
+        links,
+        addresses,
+        ports,
+        zones,
+        labels,
+        templates,
+    }
+}
+/// A template changed in up to three operands, or an arbitrary packet.
+fn packet(random: &mut Random, pools: &Pools) -> Flow {
+    let mut flow = if random.chance(80) {
+        random.pick(&pools.templates)
+    } else {
+        flow(
+            random.pick(&pools.links),
+            random.pick(&pools.links),
+            random.pick(&[6, 17]),
+            (random.pick(&pools.addresses), random.pick(&pools.ports)),
+            (random.pick(&pools.addresses), random.pick(&pools.ports)),
+        )
+    };
+    for _ in 0..random.next() % 4 {
+        match random.next() % 14 {
+            0 => flow.input = random.pick(&pools.links),
+            1 => flow.output = random.pick(&pools.links),
+            2 => flow.source = random.pick(&pools.addresses),
+            3 => flow.destination = random.pick(&pools.addresses),
+            4 => flow.source_port = random.pick(&pools.ports),
+            5 => flow.destination_port = random.pick(&pools.ports),
+            6 => flow.protocol = random.pick(&[6, 17, 1]),
+            7 => flow.state = random.pick(&[NEW, ESTABLISHED]),
+            8 => flow.reply = !flow.reply,
+            9 => flow.zone = random.pick(&pools.zones),
+            10 => flow.label = random.pick(&pools.labels),
+            11 => flow.tcp_flags = random.pick(&[SYN, ACK, SYN | ACK, 0x04, 0x42]),
+            12 => {
+                flow.original.1 = random.pick(&pools.addresses);
+                flow.original.3 = random.pick(&pools.ports);
+            }
+            _ => {
+                flow.original.0 = random.pick(&pools.addresses);
+                flow.original.2 = random.pick(&pools.ports);
+            }
+        }
+    }
+    flow
+}
+/// Linux runs each hook with exactly these interfaces: prerouting and input with
+/// an incoming one only, output with an outgoing one only, forward with both, and
+/// postrouting with an outgoing one.
+fn possible(chain: &str, flow: &Flow) -> bool {
+    let (incoming, outgoing) = (flow.input.is_some(), flow.output.is_some());
+    match chain {
+        "raw_in" | "pre" | "input" => incoming && !outgoing,
+        "raw_out" | "output" => !incoming && outgoing,
+        "forward" => incoming && outgoing,
+        _ => outgoing,
+    }
+}
+fn prepared(value: Value) -> Prepared {
+    serde_json::from_value::<Policy>(value)
+        .unwrap()
+        .prepare()
+        .unwrap()
+}
+/// Every decision of the corpus, as `chain verdict zone translation` lines.
+fn decisions(prepared: &Prepared, seed: u64, count: usize) -> Vec<String> {
+    let Scope::RouterEgress(scope) = &prepared.policy.scope else {
+        panic!("router fixture")
+    };
+    let pools = pools(scope);
+    let simulator = Simulator::new(prepared);
+    let mut random = Random(seed);
+    let mut lines = Vec::new();
+    for _ in 0..count {
+        let flow = packet(&mut random, &pools);
+        for chain in CHAINS {
+            if !simulator.has(chain) || !possible(chain, &flow) {
+                continue;
+            }
+            // Postrouting only ever sees what forward or output let through.
+            let filter = if flow.input.is_some() {
+                "forward"
+            } else {
+                "output"
+            };
+            if chain == "post" && simulator.decide(filter, &flow).verdict != 1 {
+                continue;
+            }
+            let decision = simulator.decide(chain, &flow);
+            lines.push(format!(
+                "{chain} {} {} {} {:?}",
+                decision.verdict,
+                decision.chain == "policy",
+                decision.zone,
+                decision.translation
+            ));
+        }
+    }
+    lines
+}
+fn two_generations() -> Value {
+    let mut value = super::tests::router();
+    let mut second = value["scope"]["generations"][0].clone();
+    second["lease"]["id"] = json!("lease-b");
+    second["transitSourceAddress"] = json!("10.240.0.2");
+    second["conntrackZone"] = json!(2);
+    second["conntrackLabel"] = json!("b".repeat(32));
+    second["sourcePortRanges"] = json!([{"protocol":"tcp","first":11000,"last":11999},
+        {"protocol":"udp","first":11000,"last":11999}]);
+    second["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"198.51.100.0/24"},
+            "protocol":"udp","sourcePort":null,"destinationPort":5353,"sourcePortRange":{"first":11000,"last":11999}}
+    ]);
+    value["scope"]["generations"]
+        .as_array_mut()
+        .unwrap()
+        .push(second);
+    value
+}
+fn fixtures() -> Vec<(&'static str, Value)> {
+    let grants = super::hostgrant_tests::granted(
+        super::workloadgrant_tests::granted(
+            super::workloadgrant_tests::two_workloads(),
+            json!([super::workloadgrant_tests::workload_grant(
+                "tcp",
+                "10.241.0.2",
+                "10.241.1.2",
+                8080
+            )]),
+        ),
+        json!([super::hostgrant_tests::host_grant(
+            "tcp",
+            "10.240.0.1",
+            "10.241.0.2",
+            8080
+        )]),
+    );
+    let (node, _) = super::publishedrange_tests::node(3, true, 0, 0, false);
+    vec![
+        ("router", super::tests::router()),
+        (
+            "combined_capacity",
+            super::tests::combined_router_capacity(),
+        ),
+        ("two_generations", two_generations()),
+        ("grants", grants),
+        ("pallet_3", node),
+    ]
+}
+
+#[test]
+fn router_decisions_match_the_frozen_per_rule_corpus() {
+    use sha2::{Digest, Sha256};
+    let mut summary = Vec::new();
+    for (name, value) in fixtures() {
+        let lines = decisions(&prepared(value), 0x9e37_79b9_7f4a_7c15, 16000);
+        let accepted = lines
+            .iter()
+            .filter(|line| {
+                line.split(' ').nth(1) == Some("1") && line.split(' ').nth(2) == Some("false")
+            })
+            .count();
+        let digest = format!("{:x}", Sha256::digest(lines.join("\n")));
+        if let Ok(directory) = std::env::var("SMARTNFTABLES_CORPUS_DIR") {
+            std::fs::write(format!("{directory}/{name}.txt"), lines.join("\n")).unwrap();
+        }
+        println!(
+            "ROUTER_CORPUS {name} decisions={} accepted={accepted} sha256={digest}",
+            lines.len()
+        );
+        summary.push(format!("{name} {digest}"));
+    }
+    assert_eq!(
+        summary,
+        FROZEN
+            .iter()
+            .map(|item| item.to_string())
+            .collect::<Vec<_>>()
+    );
+}
+/// Frozen from the per-rule router compiler of 2.6.0 (with this change's
+/// simulator, which models hooks, interval sets, maps and inverted lookups), and
+/// reproduced unchanged by the set-backed compiler.
+const FROZEN: [&str; 5] = [
+    "router d9a005d2c0ce7ceb6b6a6de91ff087fc4802c6fb2100a9a9ea7ad9e01cc131db",
+    "combined_capacity c2c055acc2b7c68570454289a6c150dbb29a9dd1de3b3fecda79b096430900f4",
+    "two_generations b6750e4930be4cb2713a812d56624f410447c0d57eeb0111136054b43e48d814",
+    "grants 434776a2946b64fd27fb595f792a96cbdb6f6684d2ace15f57cdaec22eee6557",
+    "pallet_3 7d2d06280b903bbfba712eb1a55d62270f0c0b473597b5940fcb4d91b0d5c325",
+];