@push.rocks/smartnftables 2.5.2 → 3.0.0

package/rust/src/egress.router.rs

@@ -1,56 +1,10 @@
+use super::leased::Kind;
 use super::*;
 
-fn endpoint<'a>(scope: &'a RouterScope, grant: &Grant) -> Option<&'a LocalLink> {
-    grant.source_endpoint.as_ref().and_then(|id| {
-        let endpoint = scope.endpoints.iter().find(|item| &item.id == id)?;
-        scope
-            .links
-            .iter()
-            .find(|item| item.interface_index == endpoint.interface_index)
-    })
-}
-fn raw_original(scope: &RouterScope, grant: &Grant) -> Result<Vec<Attr>> {
-    let mut result = tuple(grant, &scope.protection, false, false)?;
-    result.extend(match endpoint(scope, grant) {
-        Some(endpoint) => link(endpoint, true),
-        None => link(&scope.handoff, false),
-    });
-    Ok(result)
-}
-fn filter(scope: &RouterScope, grant: &Grant, reply: bool) -> Result<Vec<Attr>> {
-    let mut result = tuple(grant, &scope.protection, reply, true)?;
-    result.extend(link(&scope.handoff, reply));
-    if let Some(endpoint) = endpoint(scope, grant) {
-        result.extend(link(endpoint, !reply));
-    }
-    Ok(result)
-}
-fn raw_return(scope: &RouterScope, grant: &Grant, generation: &Generation) -> Result<Vec<Attr>> {
-    let mut result = ipv4();
-    result.extend(link(&scope.handoff, true));
-    result.extend(meta(16, vec![protocol(&grant.protocol)]));
-    result.extend(current_address(
-        &super::super::destination(grant, &scope.protection)?,
-        true,
-    )?);
-    result.extend(current_address(
-        &format!("{}/32", generation.transit_source_address),
-        false,
-    )?);
-    if let Some(port) = grant.destination_port {
-        result.extend(current_port(port, true));
-    }
-    result.extend(current_range(
-        grant.source_port_range.first,
-        grant.source_port_range.last,
-        false,
-    ));
-    Ok(result)
-}
 /// The exact veth link of the workload endpoint that holds an endpoint address.
 /// Validation admits only a current endpoint address, and endpoint prefixes are
 /// pairwise disjoint, so one publication or host grant never spans two links.
-fn endpoint_link<'a>(scope: &'a RouterScope, address: &str) -> Result<&'a LocalLink> {
+pub(super) fn endpoint_link<'a>(scope: &'a RouterScope, address: &str) -> Result<&'a LocalLink> {
     let target = format!("{address}/32");
     let endpoint = scope
         .endpoints
@@ -68,70 +22,30 @@ fn endpoint_link<'a>(scope: &'a RouterScope, address: &str) -> Result<&'a LocalL
         .find(|link| link.interface_index == endpoint.interface_index)
         .ok_or(crate::Error::Invalid)
 }
-fn published_link<'a>(scope: &'a RouterScope, port: &RouterPublishedPort) -> Result<&'a LocalLink> {
-    endpoint_link(scope, &port.endpoint_address)
-}
-/// Inbound publication envelope. Both directions check the exact links, the
-/// translated current tuple and the original conntrack destination, so foreign
-/// NAT cannot borrow this admission for another flow.
-fn published_envelope(
-    scope: &RouterScope,
-    endpoint: &LocalLink,
-    port: &RouterPublishedPort,
-    reply: bool,
-) -> Result<Vec<Attr>> {
-    let mut expressions = ipv4();
-    expressions.extend(link(&scope.handoff, !reply));
-    expressions.extend(link(endpoint, reply));
-    expressions.extend(meta(16, vec![protocol(&port.protocol)]));
-    expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
-    expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
-    expressions.extend(ct(1, None, vec![u8::from(reply)]));
-    let target = format!("{}/32", port.endpoint_address);
-    expressions.extend(current_address(&target, reply)?);
-    expressions.extend(current_port(port.endpoint_port, reply));
-    let published = format!("{}/32", port.transit_source_address);
-    expressions.extend(original_address(&published, false)?);
-    expressions.extend(original_port(port.transit_port, false));
-    Ok(expressions)
-}
-/// Handoff ingress classification for an exact current publication. Raw runs
-/// before conntrack, so it matches the arriving tuple only and never sets a
-/// generation zone: a publication is an ordinary default-zone flow.
-fn published_return(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
-    for port in &scope.published_ports {
-        let mut expressions = ipv4();
-        expressions.extend(link(&scope.handoff, true));
-        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
-        expressions.extend(current_address(
-            &format!("{}/32", port.transit_source_address),
-            false,
-        )?);
-        expressions.extend(current_port(port.transit_port, false));
-        program.end("raw_return", expressions, 1)?;
-    }
-    Ok(())
-}
-/// Endpoint ingress classification for an exact current publication. The workload
-/// side of a publication is an ordinary default-zone flow too, so it is matched on
-/// its exact link, address and dedicated published port before the leased
-/// classifiers below can zone it: a client whose source port equals a leased
-/// grant's destination port would otherwise move the workload's published packets
-/// into that generation, where they are not its flow. This only classifies; both
-/// the anti-spoof guards and the publication's admissions still decide admission.
-fn published_endpoint(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+/// The publications of this hop, each behind the veth link of its workload.
+fn hop(scope: &RouterScope) -> Result<published::Hop<'_>> {
+    let mut publications = Vec::new();
     for port in &scope.published_ports {
-        let mut expressions = ipv4();
-        expressions.extend(link(published_link(scope, port)?, true));
-        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
-        expressions.extend(current_address(
-            &format!("{}/32", port.endpoint_address),
-            true,
-        )?);
-        expressions.extend(current_port(port.endpoint_port, true));
-        program.end("raw_in", expressions, 1)?;
-    }
-    Ok(())
+        publications.push(published::Publication {
+            protocol: &port.protocol,
+            outside: (
+                &port.transit_source_address,
+                port.transit_port,
+                port.transit_last(),
+            ),
+            inside: (
+                &port.endpoint_address,
+                port.endpoint_port,
+                port.endpoint_last(),
+            ),
+            link: endpoint_link(scope, &port.endpoint_address)?,
+            symmetric: port.symmetric,
+        });
+    }
+    Ok(published::Hop {
+        publications,
+        fixed: &scope.handoff,
+    })
 }
 /// Handoff ingress classification for an exact host grant. Like a publication it
 /// is the explicit authority for its tuple, so it leads the protected-source
@@ -166,42 +80,6 @@ fn host_grant_sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
     }
     Ok(())
 }
-fn published_translation(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
-    for port in &scope.published_ports {
-        let mut expressions = ipv4();
-        expressions.extend(link(&scope.handoff, true));
-        expressions.extend(meta(16, vec![protocol(&port.protocol)]));
-        expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
-        expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
-        expressions.extend(ct(1, None, vec![0]));
-        expressions.extend(current_address(
-            &format!("{}/32", port.transit_source_address),
-            false,
-        )?);
-        expressions.extend(current_port(port.transit_port, false));
-        expressions.extend(dnat(&port.endpoint_address, port.endpoint_port)?);
-        program.rule("pre", expressions)?;
-    }
-    Ok(())
-}
-fn published_admissions(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
-    for port in &scope.published_ports {
-        let endpoint = published_link(scope, port)?;
-        let original = published_envelope(scope, endpoint, port, false)?;
-        for connection_state in [2, 8] {
-            let mut expressions = original.clone();
-            expressions.extend(state(connection_state));
-            if connection_state == 8 && port.protocol == "tcp" {
-                expressions.extend(opening_tcp());
-            }
-            program.end("forward", expressions, 1)?;
-        }
-        let mut reply = published_envelope(scope, endpoint, port, true)?;
-        reply.extend(state(2));
-        program.end("forward", reply, 1)?;
-    }
-    Ok(())
-}
 fn protected(
     program: &mut Program<'_>,
     chain: &str,
@@ -221,7 +99,7 @@ fn protected(
     }
     program.end(chain, vec![], -5)
 }
-fn raw(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+fn raw(program: &mut Program<'_>, scope: &RouterScope, hop: &published::Hop<'_>) -> Result<()> {
     // Handoff ingress must classify only exact leased return envelopes and exact
     // inbound publications. Unknown ingress never reaches private/default-zone
     // rules, even after a rename.
@@ -231,120 +109,28 @@ fn raw(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
     // classified ahead of the protected-source denial below, exactly as a
     // platform return envelope is. The host publishes into this address, so its
     // clients are not confined to unprotected space.
-    published_return(program, scope)?;
+    published::arrival(program, hop)?;
     host_grant_return(program, scope)?;
     // Both sides of a publication lead the leased classifiers of every generation,
     // so neither direction depends on the client's choice of source port.
-    published_endpoint(program, scope)?;
-    for platform in [true, false] {
-        if !platform {
-            for prefix in &scope.protection.prefixes {
-                for chain in ["raw_in", "raw_out"] {
-                    let mut expressions = ipv4();
-                    expressions.extend(current_address(prefix, false)?);
-                    program.end(chain, expressions, -5)?;
-                }
-                let mut expressions = ipv4();
-                expressions.extend(current_address(prefix, true)?);
-                program.end("raw_return", expressions, 0)?;
-            }
-        }
-        for generation in &scope.generations {
-            for grant in &generation.grants {
-                if matches!(grant.destination, Destination::Platform { .. }) != platform {
-                    continue;
-                }
-                let mut original = raw_original(scope, grant)?;
-                original.extend(set_ct(17, generation.conntrack_zone.to_ne_bytes().to_vec()));
-                program.end(
-                    if grant.source_endpoint.is_some() {
-                        "raw_in"
-                    } else {
-                        "raw_out"
-                    },
-                    original,
-                    1,
-                )?;
-                let mut reply = raw_return(scope, grant, generation)?;
-                reply.extend(set_ct(17, generation.conntrack_zone.to_ne_bytes().to_vec()));
-                program.end("raw_return", reply, 1)?;
-            }
+    published::endpoint(program, hop)?;
+    // Platform grants are classified ahead of the protected barrier, public
+    // grants behind it, whose protected destinations stay in the default zone.
+    leased::classification(program, scope, Kind::Platform)?;
+    for prefix in &scope.protection.prefixes {
+        for chain in ["raw_in", "raw_out"] {
+            let mut expressions = ipv4();
+            expressions.extend(current_address(prefix, false)?);
+            program.end(chain, expressions, -5)?;
         }
+        let mut expressions = ipv4();
+        expressions.extend(current_address(prefix, true)?);
+        program.end("raw_return", expressions, 0)?;
     }
+    leased::classification(program, scope, Kind::Public)?;
     program.end("raw_return", vec![], 0)
 }
-fn original_states(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
-    for (index, allocation) in scope.generations.iter().enumerate() {
-        for protocol in ["tcp", "udp"] {
-            if !allocation
-                .grants
-                .iter()
-                .any(|grant| grant.protocol == protocol)
-            {
-                continue;
-            }
-            let chain = format!("original_{index}_{protocol}");
-            program.chain(&chain, None)?;
-            // Only exact tuple/link/zone/direction classifiers jump here. Share
-            // state checks instead of repeating those classifiers three times.
-            for connection_state in [2, 8] {
-                let mut labelled = ct(13, None, label(allocation));
-                labelled.extend(state(connection_state));
-                if connection_state == 8 && protocol == "tcp" {
-                    labelled.extend(opening_tcp());
-                }
-                program.end(&chain, labelled, 1)?;
-            }
-            let mut fresh = state(8);
-            fresh.extend(ct(13, None, vec![0; 16]));
-            if protocol == "tcp" {
-                fresh.extend(opening_tcp());
-            }
-            fresh.extend(set_ct(13, label(allocation)));
-            program.end(&chain, fresh, 1)?;
-            // A failed state/label match returns to the caller's remaining
-            // classifiers and terminal denials, exactly as the inlined rules.
-        }
-    }
-    Ok(())
-}
-fn grants(
-    program: &mut Program<'_>,
-    scope: &RouterScope,
-    chain: &str,
-    platform: bool,
-) -> Result<()> {
-    for (index, allocation) in scope.generations.iter().enumerate() {
-        for grant in &allocation.grants {
-            if matches!(grant.destination, Destination::Platform { .. }) != platform {
-                continue;
-            }
-            let local = grant.source_endpoint.is_none();
-            if chain == "forward" && local || chain != "forward" && !local {
-                continue;
-            }
-            if chain != "input" {
-                let mut original = filter(scope, grant, false)?;
-                original.extend(generation(allocation, 0, false));
-                // Current and original tuples remain checked on every packet;
-                // a label alone never authorizes a changed grant or endpoint.
-                program.jump(
-                    chain,
-                    original,
-                    &format!("original_{index}_{}", grant.protocol),
-                )?;
-            }
-            if chain != "output" {
-                let mut reply = filter(scope, grant, true)?;
-                reply.extend(generation(allocation, 1, true));
-                reply.extend(state(2));
-                program.end(chain, reply, 1)?;
-            }
-        }
-    }
-    Ok(())
-}
-pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision: u64) -> Result<()> {
+pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
     for (name, hook, priority, kind) in [
         ("raw_in", 0, -300, "filter"),
         ("raw_out", 3, -300, "filter"),
@@ -358,36 +144,24 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
     if !scope.published_ports.is_empty() {
         // Published destination NAT lives in this table's own prerouting chain, so
         // it is created, replaced and deleted with the exact generation. An empty
-        // publication list keeps the previous chain set and compiled bytes.
+        // publication list keeps the previous chain set.
         program.chain("pre", Some((0, -100, "nat")))?;
     }
     for name in ["raw_return", "protected_out", "protected_back"] {
         program.chain(name, None)?;
     }
+    let hop = hop(scope)?;
+    published::sets(program, &hop, true)?;
     host_grant_sets(program, scope)?;
-    let private = policy::Policy {
-        schema_version: 1,
-        revision,
-        endpoints: scope.endpoints.clone(),
-        rules: scope.rules.clone(),
-    }
-    .prepare()?;
-    for (name, rules) in private.guard_chains()? {
-        program.chain(&name, None)?;
-        for expressions in rules {
-            program.rule(&name, expressions)?;
-        }
-    }
-    original_states(program, scope)?;
-    raw(program, scope)?;
+    workloadgrant::sets(program, scope)?;
+    private::sets(program, scope)?;
+    leased::sets(program, scope)?;
+    raw(program, scope, &hop)?;
     protected(program, "protected_out", scope, false)?;
     protected(program, "protected_back", scope, true)?;
-    published_translation(program, scope)?;
+    published::translations(program, &hop)?;
     for chain in ["input", "forward", "output"] {
-        let parts = private.filter_rules(chain)?;
-        for expressions in parts.guards {
-            program.rule(chain, expressions)?;
-        }
+        private::guards(program, scope, chain)?;
         // Published admission keeps the private anti-spoof guards ahead of it and
         // precedes the capture barrier: the barrier denies every protected original
         // destination, which includes this transit address, and an exact inbound
@@ -395,13 +169,12 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
         // Host grants take the same position for the same reason: the barrier
         // denies the host's protected transit address in both directions.
         if chain == "forward" {
-            published_admissions(program, scope)?;
+            published::inbound(program, &hop)?;
             host_grant_admissions(program, scope)?;
+            workloadgrant::admissions(program, scope)?;
         }
-        for expressions in parts.grants {
-            program.rule(chain, expressions)?;
-        }
-        grants(program, scope, chain, true)?;
+        private::grants(program, scope, chain)?;
+        leased::admissions(program, scope, chain, Kind::Platform)?;
         for incoming in [true, false] {
             if chain == "input" && !incoming || chain == "output" && incoming {
                 continue;
@@ -416,10 +189,14 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
                 },
             )?;
         }
-        grants(program, scope, chain, false)?;
-        for expressions in parts.denials {
-            program.rule(chain, expressions)?;
+        // Symmetric flows follow the capture barrier, so protected destinations
+        // stay denied; the endpoint classification already keeps them, and
+        // their replies, in the default zone.
+        if chain == "forward" {
+            published::symmetric(program, &hop)?;
         }
+        leased::admissions(program, scope, chain, Kind::Public)?;
+        private::denials(program, scope, chain)?;
         for incoming in [true, false] {
             if chain == "input" && !incoming || chain == "output" && incoming {
                 continue;
@@ -427,16 +204,8 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &RouterScope, revision:
             program.deny_link(chain, &scope.handoff, incoming)?;
         }
     }
-    for allocation in &scope.generations {
-        for grant in &allocation.grants {
-            let mut expressions = filter(scope, grant, false)?;
-            expressions.extend(generation(allocation, 0, true));
-            expressions.extend(snat(
-                &allocation.transit_source_address,
-                Some((grant.source_port_range.first, grant.source_port_range.last)),
-            )?);
-            program.rule("post", expressions)?;
-        }
+    for kind in [Kind::Platform, Kind::Public] {
+        leased::translation(program, scope, kind)?;
     }
-    Ok(())
+    published::symmetric_translation(program, &hop)
 }