@push.rocks/smartnftables 2.5.2 → 3.0.0

package/rust/src/owner_localport_tests.rs

@@ -0,0 +1,241 @@
+use super::egress_traffic_tests::{connect, ns_ip};
+use super::host_traffic_tests::{immediate, payload};
+use super::*;
+use crate::{
+    egress,
+    policy::{expr, meta},
+};
+use serde_json::json;
+use std::io::ErrorKind;
+use std::net::{SocketAddr, TcpListener, TcpStream};
+use std::time::Duration;
+
+const HOST: &str = "lp_host";
+const PEER: &str = "lp_peer";
+
+fn owned(owners: serde_json::Value) -> egress::Policy {
+    serde_json::from_value(egress::localport_tests::owned(
+        egress::tests::pool_guard(),
+        owners,
+    ))
+    .unwrap()
+}
+
+/// The complete graph with the maximum of loopback owners, including every
+/// TCP reset, persists across owner loss and verifies before adoption.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn local_tcp_port_owner_maximum_graph_persist_and_lost_ack_recovery() {
+    isolated();
+    let owners: Vec<_> = (0..8)
+        .map(|index| egress::localport_tests::owner("127.0.0.1", 10010 + index, index.into()))
+        .collect();
+    super::egress_tests::recover("local_port_v2", owned(json!(owners)));
+}
+
+// Foreign NAT controls exist only in this offline guest: the uplink address and
+// an off-host destination both translate to the loopback service, as a foreign
+// owner's prerouting or output DNAT could. They are never part of the policy.
+fn foreign_loopback_translation() {
+    let table = "snft_foreign_loopback";
+    let mut operations = vec![(0, 0x600, vec![Attr::string(1, table), Attr::u32(2, 6)])];
+    for (chain, hook, destination) in [("pre", 0, [192, 0, 2, 2]), ("out", 3, [198, 51, 100, 1])] {
+        operations.push((
+            3,
+            0x600,
+            vec![
+                Attr::string(1, table),
+                Attr::string(3, chain),
+                Attr::nested(4, vec![Attr::u32(1, hook), Attr::u32(2, -100_i32 as u32)]),
+                Attr::u32(5, 1),
+                Attr::string(7, "nat"),
+                Attr::u32(10, 1),
+            ],
+        ));
+        let mut expressions = meta(16, vec![6]);
+        expressions.extend(payload(16, destination.to_vec(), false));
+        expressions.extend(payload(2, 10010_u16.to_be_bytes().to_vec(), true));
+        expressions.push(immediate(vec![127, 0, 0, 1]));
+        expressions.push(expr(
+            "nat",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, 2),
+                Attr::u32(3, 1),
+                Attr::u32(4, 1),
+                Attr::u32(7, 1),
+            ],
+        ));
+        operations.push((
+            6,
+            0xc00,
+            vec![
+                Attr::string(1, table),
+                Attr::string(2, chain),
+                Attr::nested(4, expressions),
+            ],
+        ));
+    }
+    let mut socket = wire::Socket::open().unwrap();
+    let generation = socket.generation().unwrap();
+    socket.batch(generation, operations).unwrap();
+}
+
+/// One TCP connection attempt from `namespace`. A `uid` changes only this
+/// thread's credentials (the raw syscall, not libc's process-wide setresuid)
+/// before the socket is created, so the socket file carries that uid.
+fn dial(namespace: &str, uid: Option<u32>, destination: &str) -> std::io::Result<TcpStream> {
+    let destination: SocketAddr = destination.parse().unwrap();
+    in_namespace(namespace, move || {
+        if let Some(uid) = uid {
+            assert_eq!(
+                unsafe { libc::syscall(libc::SYS_setresuid, uid, uid, uid) },
+                0
+            );
+            assert_eq!(unsafe { libc::syscall(libc::SYS_geteuid) }, i64::from(uid));
+        }
+        TcpStream::connect_timeout(&destination, Duration::from_millis(750))
+    })
+}
+fn reaches(namespace: &str, uid: Option<u32>, destination: &str) {
+    if let Err(error) = dial(namespace, uid, destination) {
+        panic!("{namespace} uid {uid:?} to {destination}: {error}");
+    }
+}
+fn refused(namespace: &str, uid: Option<u32>, destination: &str) {
+    let error = dial(namespace, uid, destination).unwrap_err();
+    assert_eq!(
+        error.kind(),
+        ErrorKind::ConnectionRefused,
+        "{uid:?} {destination}"
+    );
+}
+fn dark(namespace: &str, uid: Option<u32>, destination: &str) {
+    let error = dial(namespace, uid, destination).unwrap_err();
+    assert!(
+        matches!(
+            error.kind(),
+            ErrorKind::TimedOut | ErrorKind::ConnectionRefused
+        ),
+        "{uid:?} {destination}: {error}"
+    );
+}
+
+/// Every probe runs first as a positive control on the same listeners, then
+/// under the policy, then again after release, so each denial is this owner's.
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn local_tcp_port_owner_resets_other_users_and_drops_non_loopback_arrivals() {
+    isolated();
+    for name in [HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+    }
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(
+        HOST,
+        &["route", "add", "198.51.100.0/24", "via", "192.0.2.3"],
+    );
+    in_namespace(HOST, || {
+        // The setting that let adjacent hosts reach loopback services (CVE-2020-8558).
+        for device in ["all", "uplink"] {
+            std::fs::write(
+                format!("/proc/sys/net/ipv4/conf/{device}/route_localnet"),
+                "1",
+            )
+            .unwrap();
+        }
+        foreign_loopback_translation();
+    });
+    let listeners: Vec<TcpListener> = in_namespace(HOST, || {
+        [
+            "127.0.0.1:10010",
+            "127.0.0.1:10011",
+            "127.0.0.1:10012",
+            "127.0.0.2:10010",
+        ]
+        .into_iter()
+        .map(|address| TcpListener::bind(address).unwrap())
+        .collect()
+    });
+    let probes = |applied: bool| {
+        // Root owns 10010, uid 1000 owns 10011; 10012 and 127.0.0.2 are unowned.
+        reaches(HOST, None, "127.0.0.1:10010");
+        reaches(HOST, Some(1000), "127.0.0.1:10011");
+        for uid in [1000, 65534] {
+            reaches(HOST, Some(uid), "127.0.0.1:10012");
+            reaches(HOST, Some(uid), "127.0.0.2:10010");
+        }
+        reaches(HOST, None, "198.51.100.1:10010");
+        if applied {
+            for uid in [1, 1000, 65534] {
+                refused(HOST, Some(uid), "127.0.0.1:10010");
+            }
+            refused(HOST, None, "127.0.0.1:10011");
+            // Output DNAT runs before filter priority 0: the translated
+            // destination is owned, so another user never connects.
+            dark(HOST, Some(1000), "198.51.100.1:10010");
+            // Arrival on the uplink, translated to loopback, drops at INPUT.
+            dark(PEER, None, "192.0.2.2:10010");
+        } else {
+            for uid in [1, 1000, 65534] {
+                reaches(HOST, Some(uid), "127.0.0.1:10010");
+            }
+            reaches(HOST, None, "127.0.0.1:10011");
+            reaches(HOST, Some(1000), "198.51.100.1:10010");
+            reaches(PEER, None, "192.0.2.2:10010");
+        }
+    };
+    probes(false);
+    let (owner, applied) = in_namespace(HOST, || {
+        let mut owner = Owner::new(options("local_port_traffic")).unwrap();
+        let target = owned(json!([
+            egress::localport_tests::owner("127.0.0.1", 10010, 0),
+            egress::localport_tests::owner("127.0.0.1", 10011, 1000)
+        ]))
+        .prepare()
+        .unwrap()
+        .into();
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        (owner, applied)
+    });
+    probes(true);
+    // Retained after the owning process is gone: the kernel still enforces it,
+    // and a fresh owner verifies the exact graph before adopting it.
+    let applied = in_namespace(HOST, move || {
+        let mut owner = owner;
+        owner.detach(applied.clone()).unwrap();
+        assert_eq!(owner.inspect().state, "retained");
+        drop(owner);
+        applied
+    });
+    probes(true);
+    in_namespace(HOST, move || {
+        let mut owner = Owner::new(options("local_port_traffic")).unwrap();
+        let recovered = owner
+            .reconcile(Transition {
+                previous: None,
+                target: applied.prepared.clone(),
+            })
+            .unwrap();
+        assert_eq!(recovered, applied);
+        assert!(owner.inspect().enforced);
+        owner.release(recovered).unwrap();
+    });
+    probes(false);
+    drop(listeners);
+    println!("LOCAL_TCP_PORT_OWNER_PROOF owner_reaches=true other_uids_reset=true uid_generic=true unowned_port_and_address_open=true output_dnat_denied=true non_loopback_arrival_dropped=true retained_after_owner_loss=true adopted_after_verification=true release_control=true");
+}

package/rust/src/owner_publishedrange_traffic_tests.rs

@@ -0,0 +1,306 @@
+//! Published port ranges and symmetric publications across both hops, in the
+//! four-namespace topology of the router publication qualification.
+use super::egress_traffic_tests::{allocation, binding, connect, denied, host_policy, ns_ip};
+use super::egress_traffic_tests::{protection, roundtrip, socket};
+use super::host_traffic_tests::{control, dark_udp, published_udp};
+use super::router_traffic_tests::connect_from;
+use super::*;
+use crate::egress;
+use serde_json::json;
+use std::io::{Read, Write};
+use std::net::TcpListener;
+use std::time::Duration;
+
+const WORK: &str = "pr_work";
+const ROUTER: &str = "pr_router";
+const HOST: &str = "pr_host";
+const PEER: &str = "pr_peer";
+
+/// The SIP/RTP shape on both hops: UDP and TCP signalling on one port and one UDP
+/// RTP range, all symmetric, beside a plain publication and leased egress.
+fn host_ranges() -> egress::Policy {
+    let mut policy = host_policy();
+    let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.published_ports = [
+        ("udp", 20000, Some(20200), 20000, true),
+        ("udp", 5070, None, 5070, true),
+        ("tcp", 5070, None, 5070, true),
+        ("udp", 8125, None, 8125, false),
+    ]
+    .into_iter()
+    .map(
+        |(protocol, host_port, host_port_end, target_port, symmetric)| egress::PublishedPort {
+            protocol: protocol.into(),
+            host_port,
+            host_port_end,
+            target_port,
+            target_address: "10.240.0.2".into(),
+            host_ip: "192.0.2.2".into(),
+            symmetric,
+        },
+    )
+    .collect();
+    policy
+}
+fn router_ranges() -> egress::Policy {
+    let link = binding("work", "10.241.0.1", "veth");
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    generation["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"203.0.113.2/32"},
+            "protocol":"udp","sourcePort":null,"destinationPort":42000,"sourcePortRange":{"first":10000,"last":10015}}
+    ]);
+    let publication = |protocol: &str,
+                       port: u16,
+                       end: Option<u16>,
+                       endpoint: u16,
+                       symmetric: bool| {
+        let mut value = json!({"protocol":protocol,"transitPort":port,"endpointPort":endpoint,
+            "endpointAddress":"10.241.0.2","transitSourceAddress":"10.240.0.2","symmetric":symmetric});
+        if let Some(end) = end {
+            value["transitPortEnd"] = json!(end);
+        }
+        value
+    };
+    serde_json::from_value(
+        json!({"schemaVersion":2,"revision":1,"scope":{"kind":"routerEgress",
+        "endpoints":[{"id":"work","interfaceIndex":link["interfaceIndex"],"interfaceName":"work",
+            "interfaceKind":"veth","sourcePrefixes":["10.241.0.2/32"]}],
+        "rules":[],"links":[link],"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation],"publishedPorts":[
+            publication("udp", 20000, Some(20200), 20000, true),
+            publication("udp", 5070, None, 5070, true),
+            publication("tcp", 5070, None, 5070, true),
+            publication("udp", 8125, None, 9125, false)
+        ]}}),
+    )
+    .unwrap()
+}
+/// Binds and applies a policy inside its namespace, where its links exist, and
+/// returns the owned sets with their element counts as the kernel dumps them.
+/// Enforcement means the dump, every interval element and map datum included,
+/// matched the compiled graph.
+fn apply(
+    namespace: &str,
+    name: &'static str,
+    policy: fn() -> egress::Policy,
+) -> (Owner, Applied, Vec<(String, usize)>) {
+    in_namespace(namespace, move || {
+        let mut owner = Owner::new(options(name)).unwrap();
+        let target: Prepared = policy().prepare().unwrap().into();
+        target
+            .validate_interfaces()
+            .expect("published range fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        let sets = owner
+            .graph()
+            .unwrap()
+            .expect("owned table present")
+            .sets
+            .iter()
+            .map(|(attributes, elements)| (wire::text(attributes, 2).unwrap(), elements.len()))
+            .collect();
+        (owner, applied, sets)
+    })
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_published_ranges_and_symmetric_publications_cross_both_hops() {
+    isolated();
+    for name in [WORK, ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        WORK,
+        "client",
+        "10.241.0.2/24",
+        ROUTER,
+        "work",
+        "10.241.0.1/24",
+    );
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(WORK, &["route", "add", "default", "via", "10.241.0.1"]);
+    ns_ip(ROUTER, &["route", "add", "default", "via", "10.240.0.1"]);
+    // The workload route exists throughout, so every later denial is caused by
+    // policy and not by a missing route.
+    ns_ip(
+        HOST,
+        &["route", "add", "10.241.0.0/24", "via", "10.240.0.2"],
+    );
+    ns_ip(
+        HOST,
+        &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
+    );
+    ns_ip(PEER, &["address", "add", "203.0.113.2/32", "dev", "lo"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    let first = socket(WORK, "10.241.0.2:20000");
+    let middle = socket(WORK, "10.241.0.2:20100");
+    let last = socket(WORK, "10.241.0.2:20200");
+    let above = socket(WORK, "10.241.0.2:20201");
+    let below = socket(WORK, "10.241.0.2:19999");
+    let rtp = socket(WORK, "10.241.0.2:20150");
+    let sip = socket(WORK, "10.241.0.2:5070");
+    let plain = socket(WORK, "10.241.0.2:9125");
+    let work_egress = socket(WORK, "10.241.0.2:40001");
+    let public = socket(PEER, "203.0.113.2:42000");
+    let rtp_peer = socket(PEER, "203.0.113.2:42001");
+    let sip_peer = socket(PEER, "203.0.113.2:42002");
+    let plain_peer = socket(PEER, "203.0.113.2:42003");
+    let protected_peer = socket(PEER, "192.0.2.3:40300");
+    // Positive controls: without policy the workload is routed directly and its
+    // packets reach the protected peer address, so every later result is caused
+    // by policy. Each probe uses its own tuple, so no unreplied conntrack entry
+    // carries a null translation across the policy change.
+    control(
+        &socket(PEER, "192.0.2.3:40010"),
+        "10.241.0.2:20201",
+        &above,
+        true,
+    );
+    control(
+        &socket(PEER, "192.0.2.3:40011"),
+        "10.241.0.2:19999",
+        &below,
+        true,
+    );
+    control(
+        &socket(WORK, "10.241.0.2:5071"),
+        "192.0.2.3:40300",
+        &protected_peer,
+        true,
+    );
+    dark_udp(&socket(PEER, "192.0.2.3:40012"), &middle, "192.0.2.2:20100");
+    let (host_owner, host_applied, host_sets) = apply(HOST, "published_range_host", host_ranges);
+    let (router_owner, router_applied, router_sets) =
+        apply(ROUTER, "published_range", router_ranges);
+    // Publications are set elements: one-port translations, range translations,
+    // the inbound admissions and the symmetric map on both hops, and the two raw
+    // classifications in the router.
+    let named = |sets: &[(String, usize)], name: &str| {
+        sets.iter()
+            .find(|(set, _)| set == name)
+            .map(|(_, count)| *count)
+    };
+    for (name, host, router) in [
+        ("published_port", Some(3), Some(3)),
+        ("published_address", Some(1), Some(1)),
+        ("published_forward", Some(4), Some(4)),
+        ("published_symmetric", Some(3), Some(3)),
+        ("published_arrival", None, Some(4)),
+        // 9125 and the 5070 ports of both protocols and the 20000 range.
+        ("published_endpoint", None, Some(4)),
+    ] {
+        assert_eq!(named(&host_sets, name), host, "host {name}");
+        assert_eq!(named(&router_sets, name), router, "router {name}");
+    }
+    // First, middle and last port of the range reach the listener behind both
+    // hops with the client address preserved, and the reply comes back from the
+    // published address and port.
+    for (port, client_port, workload) in [
+        (20000, 40100, &first),
+        (20100, 40101, &middle),
+        (20200, 40102, &last),
+    ] {
+        let client = in_namespace(PEER, move || {
+            std::net::UdpSocket::bind(format!("192.0.2.3:{client_port}")).unwrap()
+        });
+        client
+            .set_read_timeout(Some(Duration::from_millis(250)))
+            .unwrap();
+        published_udp(
+            &client,
+            workload,
+            &format!("192.0.2.2:{port}"),
+            &format!("192.0.2.3:{client_port}"),
+        );
+    }
+    // The ports just outside the range stay dark.
+    dark_udp(&socket(PEER, "192.0.2.3:40103"), &above, "192.0.2.2:20201");
+    dark_udp(&socket(PEER, "192.0.2.3:40104"), &below, "192.0.2.2:19999");
+    // Symmetric outbound flows reach the uplink with their own port, from a range
+    // port and from the single signalling port, and their replies return.
+    let observed = roundtrip(&rtp, &rtp_peer);
+    assert_eq!(observed.to_string(), "192.0.2.2:20150");
+    let observed = roundtrip(&sip, &sip_peer);
+    assert_eq!(observed.to_string(), "192.0.2.2:5070");
+    // A later request from the same peer tuple toward the published port is the
+    // flow's own reply direction and reaches the workload from that peer.
+    assert_eq!(sip_peer.send_to(b"invite", "192.0.2.2:5070").unwrap(), 6);
+    let mut bytes = [0; 64];
+    let (size, from) = sip
+        .recv_from(&mut bytes)
+        .expect("request on the symmetric flow");
+    assert_eq!(
+        (&bytes[..size], from.to_string().as_str()),
+        (&b"invite"[..], "203.0.113.2:42002")
+    );
+    // An unrelated client still reaches the publication inbound.
+    let unrelated = socket(PEER, "192.0.2.3:40105");
+    published_udp(&unrelated, &sip, "192.0.2.2:5070", "192.0.2.3:40105");
+    let listener = in_namespace(PEER, || TcpListener::bind("203.0.113.2:5060").unwrap());
+    let mut outbound = in_namespace(WORK, || connect_from("10.241.0.2:5070", "203.0.113.2:5060"))
+        .expect("symmetric tcp opening");
+    let (mut served, peer) = listener.accept().unwrap();
+    assert_eq!(peer.to_string(), "192.0.2.2:5070");
+    for stream in [&outbound, &served] {
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+    }
+    outbound.write_all(b"ping").unwrap();
+    served.read_exact(&mut [0; 4]).unwrap();
+    served.write_all(b"pong").unwrap();
+    outbound.read_exact(&mut [0; 4]).unwrap();
+    drop(outbound);
+    drop(served);
+    // Negative controls: a plain publication's workload port opens nothing, and a
+    // symmetric flow into the protected union stays denied from either port kind.
+    denied(&plain, &plain_peer, false);
+    denied(&sip, &protected_peer, false);
+    denied(&rtp, &protected_peer, false);
+    // Leased egress keeps its own leased source range.
+    let outer = roundtrip(&work_egress, &public);
+    assert_eq!(outer.ip().to_string(), "192.0.2.2");
+    assert!((10000..=10015).contains(&outer.port()));
+    in_namespace(ROUTER, move || {
+        let mut owner = router_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(router_applied).unwrap();
+    });
+    in_namespace(HOST, move || {
+        let mut owner = host_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(host_applied).unwrap();
+    });
+    dark_udp(&socket(PEER, "192.0.2.3:40106"), &middle, "192.0.2.2:20100");
+    println!("V2_PUBLISHED_RANGE_PROOF set_backed_graph_verified=true range_first_delivered=true range_middle_delivered=true range_last_delivered=true client_address_preserved=true range_outside_dark=true symmetric_range_source_port_kept=true symmetric_udp_source_port_kept=true symmetric_tcp_source_port_kept=true peer_request_on_symmetric_flow=true inbound_beside_symmetric=true plain_publication_outbound_denied=true symmetric_protected_denied=true leased_egress_unaffected=true protected_positive_control=true released_range_dark=true");
+}

package/rust/src/owner_router_traffic_tests.rs

@@ -135,6 +135,8 @@ fn published_host_policy() -> egress::Policy {
             target_port,
             target_address: "10.240.0.2".into(),
             host_ip: "192.0.2.2".into(),
+            host_port_end: None,
+            symmetric: false,
         })
         .collect();
     policy