@push.rocks/smartnftables 2.5.2 → 3.0.0

package/rust/src/egress_workloadgrant_tests.rs

@@ -0,0 +1,313 @@
+//! Workload grants: stateful one-way flows between two workload endpoints of
+//! one router scope, with no reverse opening.
+use super::hostgrant_tests::{
+    bytes, chains, decide, host_grant, many, normalized, opening, prepared, Flow, ACK, ESTABLISHED,
+};
+use super::tests::{host, pool_guard, router};
+use crate::wire;
+use serde_json::{json, Value};
+
+const SOURCE: [u8; 4] = [10, 241, 0, 2];
+const TARGET: [u8; 4] = [10, 241, 1, 2];
+const SOURCE_LINK: Option<(u32, &str)> = Some((2, "work"));
+const TARGET_LINK: Option<(u32, &str)> = Some((5, "target"));
+
+/// The router fixture with a second veth workload endpoint, `target`.
+pub(crate) fn two_workloads() -> Value {
+    let mut value = router();
+    value["scope"]["endpoints"]
+        .as_array_mut()
+        .unwrap()
+        .push(json!(
+        {"id":"target","interfaceIndex":5,"interfaceName":"target","interfaceKind":"veth",
+            "sourcePrefixes":["10.241.1.2/32"]}));
+    value["scope"]["links"].as_array_mut().unwrap().push(json!(
+        {"interfaceIndex":5,"interfaceName":"target","interfaceKind":"veth",
+            "macAddress":"02:00:00:00:00:05","interfaceLinkIndex":105,
+            "requiredIpv4Addresses":["10.241.1.1"]}));
+    value
+}
+pub(crate) fn workload_grant(protocol: &str, source: &str, destination: &str, port: u16) -> Value {
+    host_grant(protocol, source, destination, port)
+}
+pub(crate) fn granted(mut value: Value, grants: Value) -> Value {
+    value["scope"]["workloadGrants"] = grants;
+    value
+}
+fn exact() -> Value {
+    json!([
+        workload_grant("tcp", "10.241.0.2", "10.241.1.2", 8080),
+        workload_grant("udp", "10.241.0.2", "10.241.1.2", 5353)
+    ])
+}
+/// The source workload's opening toward the target, as FORWARD sees it.
+fn dial(protocol: u8, port: u16) -> Flow {
+    Flow {
+        input: SOURCE_LINK,
+        output: TARGET_LINK,
+        protocol,
+        source: SOURCE,
+        destination: TARGET,
+        source_port: 40000,
+        destination_port: port,
+        original: (SOURCE, TARGET, 40000, port),
+        ..opening(SOURCE_LINK, TARGET_LINK)
+    }
+}
+fn answer(flow: Flow) -> Flow {
+    Flow {
+        input: flow.output,
+        output: flow.input,
+        source: flow.destination,
+        destination: flow.source,
+        source_port: flow.destination_port,
+        destination_port: flow.source_port,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..flow
+    }
+}
+
+#[test]
+fn workload_grants_absent_and_empty_keep_the_router_digest_and_compiled_bytes() {
+    let baseline = prepared(two_workloads());
+    let empty = prepared(granted(two_workloads(), json!([])));
+    assert_eq!(empty, baseline);
+    assert_eq!(bytes(&empty), bytes(&baseline));
+    let with = prepared(granted(two_workloads(), exact()));
+    assert_ne!(with.digest, baseline.digest);
+    let mut reversed = exact();
+    reversed.as_array_mut().unwrap().reverse();
+    assert_eq!(prepared(granted(two_workloads(), reversed)), with);
+    // Only the router scope carries workload grants.
+    for fixture in [host(), pool_guard()] {
+        assert!(normalized(granted(fixture, exact())).is_err());
+    }
+}
+
+#[test]
+fn workload_grant_opens_one_way_and_admits_only_the_exact_answer() {
+    let baseline = prepared(two_workloads());
+    let with = prepared(granted(two_workloads(), exact()));
+    let decided = |flow: &Flow| {
+        (
+            decide(&baseline, "forward", flow).verdict,
+            decide(&with, "forward", flow).verdict,
+        )
+    };
+    let tcp = dial(6, 8080);
+    let udp = dial(17, 5353);
+    // The openings, the established original direction and both answers pass;
+    // the baseline denies each at the private endpoint denials.
+    for flow in [
+        tcp,
+        Flow {
+            state: ESTABLISHED,
+            tcp_flags: ACK,
+            ..tcp
+        },
+        udp,
+        answer(tcp),
+        answer(udp),
+    ] {
+        assert_eq!(decided(&flow), (0, 1), "{:?}", flow.original);
+    }
+    // No reverse opening: the target cannot open toward the source, not even
+    // from the granted port to the source's port, and an answer that is not
+    // ESTABLISHED is refused.
+    let reverse = |port: u16, source_port: u16| Flow {
+        reply: false,
+        state: 8,
+        tcp_flags: 0x02,
+        original: (TARGET, SOURCE, source_port, port),
+        ..answer(Flow {
+            source_port: port,
+            destination_port: source_port,
+            ..tcp
+        })
+    };
+    for flow in [
+        reverse(40000, 8080),
+        reverse(8080, 40000),
+        reverse(5353, 40000),
+        Flow {
+            state: 8,
+            ..answer(tcp)
+        },
+        Flow {
+            state: 8,
+            ..answer(udp)
+        },
+    ] {
+        assert_eq!(decided(&flow), (0, 0), "{:?}", flow.original);
+    }
+    // Everything the grant does not name keeps the baseline decision: another
+    // port or protocol, a spoofed or renamed link, another address, a flow
+    // translated in transit, another zone and a TCP opening without SYN.
+    for flow in [
+        dial(6, 8081),
+        dial(17, 8080),
+        dial(6, 5353),
+        Flow {
+            input: Some((3, "vpn")),
+            ..tcp
+        },
+        Flow {
+            input: Some((2, "renamed")),
+            ..tcp
+        },
+        Flow {
+            input: Some((9, "work")),
+            ..tcp
+        },
+        Flow {
+            output: Some((5, "renamed")),
+            ..tcp
+        },
+        Flow {
+            destination: [10, 241, 1, 3],
+            original: (SOURCE, [10, 241, 1, 3], 40000, 8080),
+            ..tcp
+        },
+        Flow {
+            original: (SOURCE, TARGET, 40000, 9090),
+            ..tcp
+        },
+        Flow {
+            original: ([10, 241, 0, 9], TARGET, 40000, 8080),
+            ..tcp
+        },
+        Flow { zone: 17, ..tcp },
+        Flow {
+            tcp_flags: ACK,
+            ..tcp
+        },
+    ] {
+        let (before, after) = decided(&flow);
+        assert_eq!(after, before, "{:?} {:?}", flow.input, flow.original);
+    }
+    // Everything else in the graph is unchanged.
+    let graph = chains(&with);
+    let reference = chains(&baseline);
+    for (name, rules) in &reference {
+        if name != "forward" {
+            assert_eq!(&graph[name], rules, "{name}");
+        }
+    }
+    assert_eq!(graph["forward"].len(), reference["forward"].len() + 4);
+}
+
+#[test]
+fn workload_grants_reject_unbound_same_link_local_platform_and_tun_ends() {
+    assert!(normalized(granted(two_workloads(), exact())).is_ok());
+    let grant = |source: &str, destination: &str| {
+        granted(
+            two_workloads(),
+            json!([workload_grant("tcp", source, destination, 8080)]),
+        )
+    };
+    let mut tun = two_workloads();
+    tun["scope"]["endpoints"][1]["sourcePrefixes"] = json!(["10.242.0.0/24"]);
+    for invalid in [
+        // An end outside every workload endpoint, or the same endpoint twice.
+        grant("10.241.0.2", "10.241.9.2"),
+        grant("10.241.9.2", "10.241.1.2"),
+        grant("10.241.0.2", "10.241.0.2"),
+        // A router-local address or a TUN endpoint is not a veth workload.
+        grant("10.241.0.2", "10.241.1.1"),
+        grant("10.242.0.2", "10.241.1.2"),
+        grant("10.241.0.2", "10.242.0.2"),
+        // Prefixes, wildcards, ports and duplicates, as for host grants.
+        grant("10.241.0.2", "10.241.1.0/24"),
+        grant("0.0.0.0", "10.241.1.2"),
+        granted(
+            two_workloads(),
+            json!([workload_grant("tcp", "10.241.0.2", "10.241.1.2", 0)]),
+        ),
+        granted(
+            two_workloads(),
+            json!([workload_grant("sctp", "10.241.0.2", "10.241.1.2", 80)]),
+        ),
+        granted(
+            two_workloads(),
+            json!([
+                workload_grant("tcp", "10.241.0.2", "10.241.1.2", 80),
+                workload_grant("tcp", "10.241.0.2", "10.241.1.2", 80)
+            ]),
+        ),
+        granted(
+            two_workloads(),
+            json!([{"protocol":"tcp","sourceAddress":"10.241.0.2","destinationAddress":"10.241.1.2",
+                "destinationPort":80,"bidirectional":true}]),
+        ),
+        granted(
+            two_workloads(),
+            json!((0..1025_u16)
+                .map(|port| workload_grant("tcp", "10.241.0.2", "10.241.1.2", 1 + port))
+                .collect::<Vec<_>>()),
+        ),
+    ] {
+        assert!(
+            normalized(invalid.clone()).is_err(),
+            "{}",
+            invalid["scope"]["workloadGrants"]
+        );
+    }
+    // Both directions between two workloads are two separate grants.
+    assert!(normalized(granted(
+        two_workloads(),
+        json!([
+            workload_grant("tcp", "10.241.0.2", "10.241.1.2", 8080),
+            workload_grant("tcp", "10.241.1.2", "10.241.0.2", 8080)
+        ])
+    ))
+    .is_ok());
+}
+
+/// 1024 grants fit the atomic reserve with a constant rule graph; the element
+/// budget is shared with the scope's host grants.
+#[test]
+fn workload_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
+    let deletion = 768 * (20 + 72 + 36 + 12);
+    let maximum: Vec<_> = (0..1024_u16)
+        .map(|index| {
+            workload_grant(
+                if index % 2 == 0 { "tcp" } else { "udp" },
+                "10.241.0.2",
+                "10.241.1.2",
+                20000 + index / 2,
+            )
+        })
+        .collect();
+    let small = prepared(granted(two_workloads(), exact()));
+    let prepared = prepared(granted(two_workloads(), json!(maximum)));
+    assert_eq!(
+        chains(&prepared)["forward"].len(),
+        chains(&small)["forward"].len()
+    );
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let size = |kinds: &[u16]| -> usize {
+        program
+            .iter()
+            .filter(|(kind, _)| kinds.contains(kind))
+            .map(|(_, attributes)| wire::encode_attrs(attributes).len() + 20)
+            .sum()
+    };
+    let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
+    assert!(program.len() < 768 && graph <= super::compile::RULE_BYTES && graph + elements <= super::compile::TARGET_BYTES);
+    assert!(deletion + graph + elements + 64 <= wire::BATCH_BYTES);
+    println!(
+        "WORKLOAD_GRANT_MAX grants=1024 operations={} rule_bytes={graph} element_bytes={elements}",
+        program.len()
+    );
+    // Host grants and workload grants share the target budget with the rest of
+    // the scope's elements; both maxima together fit it.
+    let mut both = granted(two_workloads(), json!(maximum));
+    both["scope"]["hostGrants"] = many(1024);
+    let both = normalized(both).unwrap().prepare().unwrap();
+    let (operations, rule_bytes, element_bytes) = super::tests::cost(&both);
+    assert!(operations < 768 && rule_bytes + element_bytes <= super::compile::TARGET_BYTES);
+}

package/rust/src/owner.rs

@@ -680,7 +680,8 @@ fn chain_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
     }
     serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
 }
-/// A set is its table, name, flags, key type and key length. The handle, the
+/// A set is its table, name, flags, key type and key length, a map's data type
+/// and length, and the field lengths of a concatenation. The handle, the
 /// informational backend type and count, the transaction ID and an empty
 /// description are not identity; anything else rejects.
 fn set_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
@@ -688,30 +689,78 @@ fn set_identity(attributes: &[Attr]) -> Result<Vec<u8>> {
     for attribute in attributes {
         match attribute.id() {
             10 | 16 | 19 | 20 => {}
-            9 if wire::attrs(&attribute.value)?.is_empty() => {}
-            1..=5 => identity.push(attribute.clone()),
+            9 => {
+                if let Some(fields) = concatenation(&attribute.value)? {
+                    identity.push(Attr::bytes(9, fields));
+                }
+            }
+            1..=7 => identity.push(attribute.clone()),
             _ => return Err(Error::Conflict),
         }
     }
     for id in [1, 2, 3, 4, 5] {
         wire::one(&identity, id)?;
     }
+    // A map carries its data type and length, and nothing else does.
+    let map = wire::number(&identity, 3)? & 8 != 0;
+    for id in [6, 7] {
+        if wire::one(&identity, id).is_ok() != map {
+            return Err(Error::Conflict);
+        }
+    }
     serde_json::to_vec(&wire::canonical(&identity, false)?).map_err(|_| Error::Protocol)
 }
-/// Only plain keys: an element with data, flags, timeouts, expressions or any
-/// other extension is not one the compiler created.
+/// The field lengths of a set description: only a concatenation, never a size.
+/// An empty description is none.
+fn concatenation(value: &[u8]) -> Result<Option<Vec<u8>>> {
+    let description = wire::attrs(value)?;
+    if description.is_empty() {
+        return Ok(None);
+    }
+    if description.len() != 1 || description[0].id() != 2 {
+        return Err(Error::Conflict);
+    }
+    let mut lengths = Vec::new();
+    for field in wire::attrs(&description[0].value)? {
+        let length = wire::attrs(&field.value)?;
+        if field.id() != 1 || length.len() != 1 {
+            return Err(Error::Conflict);
+        }
+        lengths.extend(wire::number(&length, 1)?.to_be_bytes());
+    }
+    Ok(Some(lengths))
+}
+/// Only compiler elements: a key, the last key of an interval and a map's data.
+/// Flags, timeouts, expressions or any other extension reject. The identity is
+/// the three values, so any changed bound or datum is a changed element.
 fn element_keys(list: &[Attr]) -> Result<Vec<Vec<u8>>> {
     let mut keys = Vec::new();
     for element in list {
-        let fields = wire::attrs(&element.value)?;
-        if element.id() != 1 || fields.len() != 1 {
+        if element.id() != 1 {
             return Err(Error::Conflict);
         }
-        let key = wire::attrs(&wire::one(&fields, 1)?.value)?;
-        if key.len() != 1 {
-            return Err(Error::Conflict);
+        let mut values: [Option<Vec<u8>>; 3] = [None, None, None];
+        for field in wire::attrs(&element.value)? {
+            let slot = match field.id() {
+                1 => 0,
+                10 => 1,
+                2 => 2,
+                _ => return Err(Error::Conflict),
+            };
+            let value = wire::attrs(&field.value)?;
+            if value.len() != 1 || values[slot].is_some() {
+                return Err(Error::Conflict);
+            }
+            values[slot] = Some(wire::one(&value, 1)?.value.clone());
         }
-        keys.push(wire::one(&key, 1)?.value.clone());
+        let [Some(key), last, data] = values else {
+            return Err(Error::Conflict);
+        };
+        keys.push(if last.is_none() && data.is_none() {
+            key
+        } else {
+            serde_json::to_vec(&(key, last, data)).map_err(|_| Error::Protocol)?
+        });
     }
     Ok(keys)
 }
@@ -741,7 +790,7 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
             "cmp" => &[3],
             "bitwise" => &[4, 5],
             "range" => &[3, 4],
-            "meta" | "payload" | "ct" | "nat" | "lookup" => &[],
+            "meta" | "payload" | "ct" | "nat" | "lookup" | "reject" => &[],
             _ => return Err(Error::Conflict),
         };
         for attribute in &mut data {
@@ -772,9 +821,10 @@ fn rule_identity(attributes: &[Attr]) -> Result<(String, Vec<u8>)> {
 /// neither unknown fields nor default repair may hide a changed kernel rule.
 fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
     let allowed: &[u16] = match name {
-        "lookup" => &[1, 2, 5],
+        "lookup" => &[1, 2, 3, 5],
         "ct" | "range" => &[1, 2, 3, 4],
         "nat" => &[1, 2, 3, 4, 5, 6, 7],
+        "reject" => &[1],
         _ => return Ok(()),
     };
     for attribute in data {
@@ -785,10 +835,16 @@ fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
     }
     match name {
         "lookup" => {
-            // A plain membership test of a named set: no map, no inversion.
+            // A membership or absence test of a named set, or a map lookup into
+            // a data register, which is never inverted.
             wire::text(data, 1)?;
             wire::number(data, 2)?;
-            if data.len() != 3 || wire::number(data, 5)? != 0 {
+            let map = wire::one(data, 3).is_ok();
+            if map {
+                wire::number(data, 3)?;
+            }
+            let flags = wire::number(data, 5)?;
+            if data.len() != 3 + usize::from(map) || flags > 1 || map && flags != 0 {
                 return Err(Error::Conflict);
             }
         }
@@ -825,6 +881,12 @@ fn validate_egress_expression(name: &str, data: &[Attr]) -> Result<()> {
                 wire::number(data, 6)?;
             }
         }
+        "reject" => {
+            // Only a TCP reset, which carries no ICMP code.
+            if data.len() != 1 || wire::number(data, 1)? != 1 {
+                return Err(Error::Conflict);
+            }
+        }
         "range" => {
             wire::number(data, 1)?;
             if wire::number(data, 2)? > 1 || data.len() != 4 {

package/rust/src/owner_host_traffic_tests.rs

@@ -389,6 +389,8 @@ fn v2_host_publishes_exact_uplink_ports_and_removes_them_with_the_generation() {
                 target_port: 8443,
                 target_address: "10.240.0.2".into(),
                 host_ip: "192.0.2.2".into(),
+                host_port_end: None,
+                symmetric: false,
             },
             egress::PublishedPort {
                 protocol: "udp".into(),
@@ -396,6 +398,8 @@ fn v2_host_publishes_exact_uplink_ports_and_removes_them_with_the_generation() {
                 target_port: 8125,
                 target_address: "10.240.0.2".into(),
                 host_ip: "192.0.2.2".into(),
+                host_port_end: None,
+                symmetric: false,
             },
         ];
         let mut owner = Owner::new(options("host_published")).unwrap();

package/rust/src/owner_hostgrant_traffic_tests.rs

@@ -79,13 +79,13 @@ fn guard_policy(revision: u64, granted: bool) -> egress::Policy {
     policy
 }
 /// One policy owner in its own namespace; every transition runs there.
-struct Hop {
+pub(super) struct Hop {
     namespace: &'static str,
     owner: Option<Owner>,
     applied: Option<Applied>,
 }
 impl Hop {
-    fn new(namespace: &'static str, table: &'static str) -> Self {
+    pub(super) fn new(namespace: &'static str, table: &'static str) -> Self {
         let owner = in_namespace(namespace, move || Owner::new(options(table)).unwrap());
         Self {
             namespace,
@@ -93,7 +93,12 @@ impl Hop {
             applied: None,
         }
     }
-    fn apply(&mut self, build: fn(u64, bool) -> egress::Policy, revision: u64, granted: bool) {
+    pub(super) fn apply(
+        &mut self,
+        build: fn(u64, bool) -> egress::Policy,
+        revision: u64,
+        granted: bool,
+    ) {
         let mut owner = self.owner.take().unwrap();
         let previous = self.applied.take();
         let (owner, applied) = in_namespace(self.namespace, move || {
@@ -108,7 +113,7 @@ impl Hop {
         self.owner = Some(owner);
         self.applied = Some(applied);
     }
-    fn release(mut self) {
+    pub(super) fn release(mut self) {
         let mut owner = self.owner.take().unwrap();
         let applied = self.applied.take().unwrap();
         in_namespace(self.namespace, move || {