@push.rocks/smartnftables 2.5.2 → 3.0.0

package/rust/src/egress.rs

@@ -99,9 +99,28 @@ pub struct Generation {
 pub struct RouterPublishedPort {
     pub protocol: String,
     pub transit_port: u16,
+    /// Last port of a published range starting at `transit_port`. A range keeps
+    /// every port: `endpoint_port` equals `transit_port`. Absent for one port.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub transit_port_end: Option<u16>,
     pub endpoint_port: u16,
     pub endpoint_address: String,
     pub transit_source_address: String,
+    /// The workload may open flows from its published port(s), translated to
+    /// `transit_source_address` and the published port. Absent and false are the
+    /// same canonical policy.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub symmetric: bool,
+}
+impl RouterPublishedPort {
+    /// Last published transit port; equal to `transit_port` for one port.
+    pub fn transit_last(&self) -> u16 {
+        self.transit_port_end.unwrap_or(self.transit_port)
+    }
+    /// Last workload port the publication translates to.
+    pub fn endpoint_last(&self) -> u16 {
+        self.endpoint_port + (self.transit_last() - self.transit_port)
+    }
 }
 /// One exact host-origin flow: the node's own host network namespace dials one
 /// port of one local workload at its lease address, from the transit host
@@ -115,6 +134,10 @@ pub struct HostGrant {
     pub destination_address: String,
     pub destination_port: u16,
 }
+/// One stateful one-way flow between two workloads behind the same router: the
+/// source workload dials one exact port of the destination workload, which may
+/// only answer. It is the same exact tuple as a host grant.
+pub type WorkloadGrant = HostGrant;
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RouterScope {
@@ -131,6 +154,9 @@ pub struct RouterScope {
     /// Absent and empty are the same canonical policy, like publications.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_grants: Vec<HostGrant>,
+    /// Absent and empty are the same canonical policy, like publications.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub workload_grants: Vec<WorkloadGrant>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -143,9 +169,28 @@ pub struct HostHandoff {
 pub struct PublishedPort {
     pub protocol: String,
     pub host_port: u16,
+    /// Last port of a published range starting at `host_port`. A range keeps
+    /// every port: `target_port` equals `host_port`. Absent for one port.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub host_port_end: Option<u16>,
     pub target_port: u16,
     pub target_address: String,
     pub host_ip: String,
+    /// Flows from `target_address` and the published target port(s) may leave
+    /// through the uplink, translated to `host_ip` and the published port. Absent
+    /// and false are the same canonical policy.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub symmetric: bool,
+}
+impl PublishedPort {
+    /// Last published uplink port; equal to `host_port` for one port.
+    pub fn host_last(&self) -> u16 {
+        self.host_port_end.unwrap_or(self.host_port)
+    }
+    /// Last transit port the publication translates to.
+    pub fn target_last(&self) -> u16 {
+        self.target_port + (self.host_last() - self.host_port)
+    }
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -161,6 +206,20 @@ pub struct HostScope {
     /// Absent and empty are the same canonical policy, like publications.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_grants: Vec<HostGrant>,
+    /// Ids of platform endpoints this host serves on an address of one of its
+    /// bound links. Absent and empty are the same canonical policy.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub local_platform_endpoints: Vec<String>,
+}
+/// One loopback TCP service that only one local user may dial: packets the host
+/// sends to the exact address and port from a socket of any other user reject,
+/// and packets arriving there on any interface but loopback drop.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct LocalTcpPortOwner {
+    pub address: String,
+    pub port: u16,
+    pub uid: u32,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -171,6 +230,10 @@ pub struct AllocationPoolGuardScope {
     /// Absent and empty are the same canonical policy.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_grants: Vec<HostGrant>,
+    /// Host-wide loopback port ownership. Absent and empty are the same
+    /// canonical policy.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub local_tcp_port_owners: Vec<LocalTcpPortOwner>,
 }
 #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
 #[serde(tag = "kind", rename_all = "camelCase", deny_unknown_fields)]
@@ -421,16 +484,19 @@ pub fn destination(grant: &Grant, protection: &Protection) -> Result<String> {
 /// with the leased outbound source ports translated to that same transit address.
 fn normalize_router_published(value: &mut RouterScope) -> Result<()> {
     let mut ports = std::mem::take(&mut value.published_ports);
-    require(ports.len() <= 64)?;
+    require(ports.len() <= PUBLISHED_PORTS)?;
     ports.sort();
     for (index, port) in ports.iter().enumerate() {
         require(
             protocol(&port.protocol)
                 && port.transit_port > 0
                 && port.endpoint_port > 0
+                && published_span(port.transit_port, port.transit_port_end, port.endpoint_port)
+                // Sorted by protocol and first port, so disjoint neighbours are
+                // disjoint spans: one protocol/port is published exactly once.
                 && (index == 0
                     || ports[index - 1].protocol != port.protocol
-                    || ports[index - 1].transit_port != port.transit_port),
+                    || ports[index - 1].transit_last() < port.transit_port),
         )?;
         // rtnetlink verifies this exact handoff address at apply, recovery and
         // inspection, and only a current leased transit source address receives a
@@ -486,15 +552,47 @@ fn normalize_router_published(value: &mut RouterScope) -> Result<()> {
                 // port inside a leased outbound range is a translation conflict.
                 require(
                     range.protocol != port.protocol
-                        || port.transit_port < range.first
+                        || port.transit_last() < range.first
                         || port.transit_port > range.last,
                 )?;
             }
         }
     }
+    // A symmetric publication translates its workload's own flows back to its
+    // published ports, so its workload ports belong to it alone.
+    exclusive_symmetric(ports.iter().map(|port| {
+        (
+            port.symmetric,
+            (&port.protocol, &port.endpoint_address),
+            (port.endpoint_port, port.endpoint_last()),
+        )
+    }))?;
     value.published_ports = ports;
     Ok(())
 }
+/// One published port, or a range `first..=end` that keeps every port. The range
+/// is strictly ascending: one port has exactly one canonical form, without an end.
+fn published_span(first: u16, end: Option<u16>, inside: u16) -> bool {
+    end.is_none_or(|end| end > first && inside == first)
+}
+/// A symmetric publication's inside span may not overlap the inside span of any
+/// other publication of the same protocol and address, or its workload's flows
+/// would have two published sources.
+fn exclusive_symmetric<'a>(
+    spans: impl Iterator<Item = (bool, (&'a String, &'a String), (u16, u16))> + Clone,
+) -> Result<()> {
+    for (index, (symmetric, key, (first, last))) in spans.clone().enumerate() {
+        if !symmetric {
+            continue;
+        }
+        for (other, (_, other_key, (other_first, other_last))) in spans.clone().enumerate() {
+            require(
+                other == index || other_key != key || last < other_first || other_last < first,
+            )?;
+        }
+    }
+    Ok(())
+}
 /// Exact tuples only: one protocol, one unicast source and destination address
 /// and one destination port. Addresses never carry a prefix and ports never a
 /// range, so a grant cannot widen past its flow. `bound` checks the authority of
@@ -565,17 +663,65 @@ fn normalize_router_host_grants(value: &mut RouterScope) -> Result<()> {
     value.host_grants = grants;
     Ok(())
 }
+/// Both ends are exact current addresses of two different veth workload endpoints
+/// of this scope, neither router-local nor a platform endpoint. Endpoint prefixes
+/// are protected, so both directions stay in the default conntrack zone ahead of
+/// every leased classifier.
+fn normalize_router_workload_grants(value: &mut RouterScope) -> Result<()> {
+    let mut grants = std::mem::take(&mut value.workload_grants);
+    let scope = &*value;
+    let workload = |ip: &str| -> Result<&policy::Endpoint> {
+        let target = format!("{ip}/32");
+        let endpoint = scope
+            .endpoints
+            .iter()
+            .find(|endpoint| {
+                endpoint
+                    .source_prefixes
+                    .iter()
+                    .any(|source| covers(source, &target) == Ok(true))
+            })
+            .ok_or(Error::Invalid)?;
+        let local = scope
+            .links
+            .iter()
+            .chain(std::iter::once(&scope.handoff))
+            .any(|link| link.required_ipv4_addresses.iter().any(|item| item == ip));
+        let platform = scope
+            .protection
+            .platform_endpoints
+            .iter()
+            .any(|item| item.address == ip);
+        require(endpoint.interface_kind == "veth" && !local && !platform)?;
+        Ok(endpoint)
+    };
+    normalize_host_grants(&mut grants, |grant| {
+        let source = workload(&grant.source_address)?;
+        let destination = workload(&grant.destination_address)?;
+        require(source.id != destination.id)
+    })?;
+    value.workload_grants = grants;
+    Ok(())
+}
+/// Router input bounds. Endpoints, rules and grants are set elements, so the
+/// graph budgets bind them, not the rule reserve: the node shape of 128
+/// workloads with local DNS, public egress and four platform endpoints each fits.
+pub const ROUTER_LINKS: usize = 128;
+pub const ROUTER_RULES: usize = 1024;
+pub const ROUTER_GRANTS: usize = 1024;
+/// Publications per scope; they are set elements on both hops.
+pub const PUBLISHED_PORTS: usize = 1024;
 fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
-    require(value.links.len() <= 32 && value.generations.len() <= 32)?;
+    require(value.links.len() <= ROUTER_LINKS && value.generations.len() <= 32)?;
     let private = policy::Policy {
         schema_version: 1,
         revision,
         endpoints: value.endpoints.clone(),
         rules: value.rules.clone(),
     }
-    .prepare()?;
-    value.endpoints = private.policy.endpoints;
-    value.rules = private.policy.rules;
+    .normalize(ROUTER_LINKS, ROUTER_RULES)?;
+    value.endpoints = private.endpoints;
+    value.rules = private.rules;
     normalize_protection(&mut value.protection)?;
     normalize_link(&mut value.handoff)?;
     require(
@@ -660,7 +806,7 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
                 && labels.insert(generation.conntrack_label.clone()),
         )?;
         count += generation.grants.len();
-        require(count <= 128)?;
+        require(count <= ROUTER_GRANTS)?;
         generation.grants.sort();
         for grant in &generation.grants {
             require(
@@ -737,7 +883,8 @@ fn normalize_router(value: &mut RouterScope, revision: u64) -> Result<()> {
         )
     }))?;
     normalize_router_published(value)?;
-    normalize_router_host_grants(value)
+    normalize_router_host_grants(value)?;
+    normalize_router_workload_grants(value)
 }
 fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
     require(
@@ -760,8 +907,32 @@ fn normalize_pool_guard(value: &mut AllocationPoolGuardScope) -> Result<()> {
         require(covers_address(&value.prefixes, &grant.destination_address)?)
     })?;
     value.host_grants = grants;
+    normalize_local_tcp_port_owners(&mut value.local_tcp_port_owners)
+}
+/// One exact IPv4 loopback host address and port per entry, never a prefix,
+/// wildcard or range, each with exactly one owning uid. `(uid_t)-1` is not a
+/// user; it is the kernel's "unchanged" sentinel.
+fn normalize_local_tcp_port_owners(owners: &mut [LocalTcpPortOwner]) -> Result<()> {
+    require(owners.len() <= LOCAL_TCP_PORT_OWNERS)?;
+    owners.sort();
+    for (index, owner) in owners.iter().enumerate() {
+        let ip = address(&owner.address)?;
+        require(
+            ip >> 24 == 127
+                && ip != 0x7f00_0000
+                && ip != 0x7fff_ffff
+                && owner.port > 0
+                && owner.uid != u32::MAX
+                && owners[..index]
+                    .iter()
+                    .all(|other| other.address != owner.address || other.port != owner.port),
+        )?;
+    }
     Ok(())
 }
+/// Two rules per entry; the maximum fits the atomic graph beside a guard with
+/// 64 pools and 1024 host grants.
+const LOCAL_TCP_PORT_OWNERS: usize = 8;
 /// The host dials from an exact current address of exactly one handoff link, into
 /// protected space that is neither host-local, a platform endpoint nor a leased
 /// router transit address: only a workload behind that handoff remains.
@@ -813,16 +984,19 @@ fn normalize_host_host_grants(value: &mut HostScope) -> Result<()> {
 /// overlap with the leased outbound source ports translated to that same address.
 fn normalize_published(value: &mut HostScope) -> Result<()> {
     let mut ports = std::mem::take(&mut value.published_ports);
-    require(ports.len() <= 64)?;
+    require(ports.len() <= PUBLISHED_PORTS)?;
     ports.sort();
     for (index, port) in ports.iter().enumerate() {
         require(
             protocol(&port.protocol)
                 && port.host_port > 0
                 && port.target_port > 0
+                && published_span(port.host_port, port.host_port_end, port.target_port)
+                // Sorted by protocol and first port, so disjoint neighbours are
+                // disjoint spans: one protocol/port is published exactly once.
                 && (index == 0
                     || ports[index - 1].protocol != port.protocol
-                    || ports[index - 1].host_port != port.host_port),
+                    || ports[index - 1].host_last() < port.host_port),
         )?;
         // rtnetlink verifies this exact uplink address at apply, recovery and
         // inspection. No wildcard, secondary-link or default-route inference.
@@ -844,14 +1018,39 @@ fn normalize_published(value: &mut HostScope) -> Result<()> {
                         // port inside a leased outbound range is a translation conflict.
                         require(
                             range.protocol != port.protocol
-                                || port.host_port < range.first
+                                || port.host_last() < range.first
                                 || port.host_port > range.last,
                         )?;
                     }
                 }
             }
         }
+        if port.symmetric {
+            // The workload's flows leave from its target ports; a leased range of
+            // the same address would claim them for the outer leased translation.
+            for allocation in value
+                .handoffs
+                .iter()
+                .flat_map(|handoff| handoff.allocations.iter())
+                .filter(|allocation| allocation.transit_source_address == port.target_address)
+            {
+                for range in &allocation.source_port_ranges {
+                    require(
+                        range.protocol != port.protocol
+                            || port.target_last() < range.first
+                            || port.target_port > range.last,
+                    )?;
+                }
+            }
+        }
     }
+    exclusive_symmetric(ports.iter().map(|port| {
+        (
+            port.symmetric,
+            (&port.protocol, &port.target_address),
+            (port.target_port, port.target_last()),
+        )
+    }))?;
     value.published_ports = ports;
     Ok(())
 }
@@ -878,14 +1077,31 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
         .flat_map(|item| item.link.required_ipv4_addresses.iter().cloned())
         .chain(value.uplink.required_ipv4_addresses.iter().cloned())
         .collect();
+    // A platform endpoint on a host address is served here, not forwarded, so
+    // only a declared local endpoint may hold one; it must hold a bound address,
+    // which rtnetlink verifies at apply, recovery and inspection.
+    value.local_platform_endpoints.sort();
+    require(
+        value
+            .local_platform_endpoints
+            .windows(2)
+            .all(|pair| pair[0] != pair[1]),
+    )?;
+    for id in &value.local_platform_endpoints {
+        let endpoint = value
+            .protection
+            .platform_endpoints
+            .iter()
+            .find(|endpoint| endpoint.id == *id)
+            .ok_or(Error::Invalid)?;
+        require(local_addresses.contains(&endpoint.address))?;
+    }
     for ip in &local_addresses {
         require(
             covers_address(&value.protection.prefixes, ip)?
-                && value
-                    .protection
-                    .platform_endpoints
-                    .iter()
-                    .all(|endpoint| endpoint.address != *ip),
+                && value.protection.platform_endpoints.iter().all(|endpoint| {
+                    endpoint.address != *ip || value.local_platform_endpoints.contains(&endpoint.id)
+                }),
         )?;
     }
     for handoff in &mut value.handoffs {
@@ -949,8 +1165,23 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
 #[path = "egress_hostgrant_tests.rs"]
 pub(crate) mod hostgrant_tests;
 #[cfg(test)]
+#[path = "egress_localplatform_tests.rs"]
+pub(crate) mod localplatform_tests;
+#[cfg(test)]
+#[path = "egress_localport_tests.rs"]
+pub(crate) mod localport_tests;
+#[cfg(test)]
+#[path = "egress_publishedrange_tests.rs"]
+mod publishedrange_tests;
+#[cfg(test)]
+#[path = "egress_routerequivalence_tests.rs"]
+mod routerequivalence_tests;
+#[cfg(test)]
 #[path = "egress_tests.rs"]
 pub(crate) mod tests;
+#[cfg(test)]
+#[path = "egress_workloadgrant_tests.rs"]
+pub(crate) mod workloadgrant_tests;
 impl Policy {
     pub fn prepare(self) -> Result<Prepared> {
         use sha2::{Digest, Sha256};

package/rust/src/egress.workloadgrant.rs

@@ -0,0 +1,88 @@
+//! Workload grants: stateful one-way flows from one workload endpoint to one
+//! exact port of another, both behind the same router. Like host grants they
+//! compile to a constant number of rules around exact set lookups. The tuple key
+//! carries both protocols and the live and originally tracked tuple, so a
+//! translated flow never matches. A second set binds every grant address to the
+//! exact link that holds it (index and name), and both the incoming and the
+//! outgoing link are looked up on every packet. Only the grant's source opens;
+//! the destination only answers.
+use super::hostgrant::{lookup, meta_to, payload_to, tuple_key, tuple_lookup};
+use super::*;
+use std::collections::BTreeSet;
+
+/// Every exact workload-to-workload flow of the scope.
+pub(super) const TUPLE_SET: &str = "workload_grant";
+/// Every grant address with the exact link that holds it.
+pub(super) const LINK_SET: &str = "workload_link";
+
+/// The link a packet crosses and the address on its side of that link: the
+/// incoming link and the source, or the outgoing link and the destination.
+fn link_lookup(incoming: bool) -> Vec<Attr> {
+    vec![
+        meta_to(if incoming { 4 } else { 5 }, 4),
+        meta_to(if incoming { 6 } else { 7 }, 5),
+        payload_to(1, if incoming { 12 } else { 16 }, 4, 9),
+        lookup(LINK_SET),
+    ]
+}
+fn link_key(link: &LocalLink, address: &str) -> Result<Vec<u8>> {
+    let mut key = link.interface_index.to_ne_bytes().to_vec();
+    let mut name = link.interface_name.as_bytes().to_vec();
+    name.resize(16, 0);
+    key.extend(name);
+    key.extend(super::address(address)?.to_be_bytes());
+    Ok(key)
+}
+
+pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    if scope.workload_grants.is_empty() {
+        return Ok(());
+    }
+    let mut keys = Vec::new();
+    let mut links = BTreeSet::new();
+    for grant in &scope.workload_grants {
+        keys.push(tuple_key(grant, None)?);
+        for address in [&grant.source_address, &grant.destination_address] {
+            links.insert(link_key(
+                super::router::endpoint_link(scope, address)?,
+                address,
+            )?);
+        }
+    }
+    program.set(TUPLE_SET, 3, 32)?;
+    program.elements(TUPLE_SET, keys)?;
+    program.set(LINK_SET, 4, 24)?;
+    program.elements(LINK_SET, links.into_iter().collect())
+}
+
+/// Four forward admissions whatever the number of grants: the ESTABLISHED
+/// original direction, a NEW UDP opening, a NEW TCP opening restricted to SYN
+/// with FIN/RST/ACK clear, and the ESTABLISHED reply, each in the default
+/// conntrack zone. A reply is only ever ESTABLISHED, so the destination
+/// workload can never open a flow toward the source through a grant.
+pub(super) fn admissions(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    if scope.workload_grants.is_empty() {
+        return Ok(());
+    }
+    let admission = |reply: bool, connection_state: u32, transport: Option<&str>| {
+        let mut result = ipv4();
+        result.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+        result.extend(ct(1, None, vec![u8::from(reply)]));
+        result.extend(state(connection_state));
+        if let Some(transport) = transport {
+            result.extend(meta(16, vec![protocol(transport)]));
+            if transport == "tcp" {
+                result.extend(opening_tcp());
+            }
+        }
+        result.extend(link_lookup(true));
+        result.extend(link_lookup(false));
+        result.extend(tuple_lookup(TUPLE_SET, false, reply));
+        result
+    };
+    program.end("forward", admission(false, 2, None), 1)?;
+    for transport in ["udp", "tcp"] {
+        program.end("forward", admission(false, 8, Some(transport)), 1)?;
+    }
+    program.end("forward", admission(true, 2, None), 1)
+}