@push.rocks/smartnftables 2.5.2 → 3.0.0

package/rust/src/egress_localport_tests.rs

@@ -0,0 +1,266 @@
+//! Loopback TCP port ownership in the allocation-pool guard: canonical input,
+//! strict validation, the exact compiled decision per hook and the atomic budget.
+use super::hostgrant_tests::{
+    bytes, chains, decide, granted, many, normalized, opening, prepared, Flow, ACK, ESTABLISHED,
+    REJECT,
+};
+use super::tests::pool_guard;
+use crate::wire;
+use serde_json::{json, Value};
+
+pub(crate) fn owner(address: &str, port: u16, uid: u32) -> Value {
+    json!({"address":address,"port":port,"uid":uid})
+}
+pub(crate) fn owned(mut value: Value, owners: Value) -> Value {
+    value["scope"]["localTcpPortOwners"] = owners;
+    value
+}
+/// The fixture: a root-only CRI stream port and a port owned by uid 1000.
+fn exact() -> Value {
+    json!([
+        owner("127.0.0.1", 10010, 0),
+        owner("127.0.0.1", 10011, 1000)
+    ])
+}
+const LOOPBACK: [u8; 4] = [127, 0, 0, 1];
+const LO: Option<(u32, &str)> = Some((1, "lo"));
+/// A local TCP opening from `uid` to the loopback `port`, as OUTPUT sees it.
+fn dial(port: u16, uid: Option<u32>) -> Flow {
+    Flow {
+        input: None,
+        output: LO,
+        source: LOOPBACK,
+        destination: LOOPBACK,
+        source_port: 40000,
+        destination_port: port,
+        original: (LOOPBACK, LOOPBACK, 40000, port),
+        uid,
+        ..opening(None, LO)
+    }
+}
+
+#[test]
+fn local_tcp_port_owners_absent_and_empty_keep_the_guard_digest_and_compiled_bytes() {
+    let baseline = prepared(pool_guard());
+    let empty = prepared(owned(pool_guard(), json!([])));
+    assert_eq!(empty, baseline);
+    assert_eq!(bytes(&empty), bytes(&baseline));
+    let with = prepared(owned(pool_guard(), exact()));
+    assert_ne!(with.digest, baseline.digest);
+    // Canonical order: the same set of owners is the same policy.
+    let mut reversed = exact();
+    reversed.as_array_mut().unwrap().reverse();
+    assert_eq!(prepared(owned(pool_guard(), reversed)), with);
+    // The owning uid is part of the policy identity.
+    let changed = json!([
+        owner("127.0.0.1", 10010, 1),
+        owner("127.0.0.1", 10011, 1000)
+    ]);
+    assert_ne!(prepared(owned(pool_guard(), changed)).digest, with.digest);
+}
+
+#[test]
+fn local_tcp_port_owner_rejects_every_other_uid_at_its_exact_loopback_destination() {
+    let baseline = prepared(pool_guard());
+    let with = prepared(owned(pool_guard(), exact()));
+    // Every flow the baseline accepts; the owners change only their exact tuples.
+    for flow in [
+        dial(10010, Some(0)),
+        dial(10010, Some(1000)),
+        dial(10012, Some(1000)),
+    ] {
+        assert_eq!(decide(&baseline, "output", &flow).verdict, 1);
+    }
+    // The owner dials its port; every other user's socket is reset.
+    assert_eq!(decide(&with, "output", &dial(10010, Some(0))).verdict, 1);
+    for uid in [1, 1000, 65534, u32::MAX - 1] {
+        assert_eq!(
+            decide(&with, "output", &dial(10010, Some(uid))).verdict,
+            REJECT,
+            "{uid}"
+        );
+    }
+    assert_eq!(decide(&with, "output", &dial(10011, Some(1000))).verdict, 1);
+    assert_eq!(
+        decide(&with, "output", &dial(10011, Some(0))).verdict,
+        REJECT
+    );
+    // Not only openings: an established packet of another user is reset too.
+    let established = Flow {
+        state: ESTABLISHED,
+        tcp_flags: ACK,
+        ..dial(10010, Some(1000))
+    };
+    assert_eq!(decide(&with, "output", &established).verdict, REJECT);
+    // Without a user socket `meta skuid` breaks the rule: a kernel reply or an
+    // orphaned socket's teardown cannot open a connection.
+    assert_eq!(decide(&with, "output", &dial(10010, None)).verdict, 1);
+    // Another port, another loopback address and UDP keep the baseline decision.
+    for flow in [
+        dial(10012, Some(1000)),
+        Flow {
+            destination: [127, 0, 0, 2],
+            ..dial(10010, Some(1000))
+        },
+        Flow {
+            protocol: 17,
+            ..dial(10010, Some(1000))
+        },
+    ] {
+        assert_eq!(
+            decide(&with, "output", &flow),
+            decide(&baseline, "output", &flow)
+        );
+    }
+    // INPUT admits the destination only from loopback; any other interface, as
+    // route_localnet or prerouting DNAT could deliver it, drops.
+    let arriving = |input| Flow {
+        input,
+        output: None,
+        uid: None,
+        label: [0; 16],
+        ..dial(10010, None)
+    };
+    assert_eq!(decide(&with, "input", &arriving(LO)).verdict, 1);
+    for input in [Some((2, "ens18")), Some((1, "ens18")), Some((2, "lo"))] {
+        let flow = arriving(input);
+        assert_eq!(decide(&baseline, "input", &flow).verdict, 1);
+        // Index 1 is the loopback device in every namespace; a device named "lo"
+        // with another index is not loopback.
+        let expected = if input.unwrap().0 == 1 { 1 } else { 0 };
+        assert_eq!(decide(&with, "input", &flow).verdict, expected, "{input:?}");
+    }
+    // Guarded pool traffic from any user keeps the guard's decision.
+    let pool = Flow {
+        uid: Some(1000),
+        label: [0; 16],
+        ..opening(None, Some((4, "handoff")))
+    };
+    assert_eq!(
+        decide(&with, "output", &pool),
+        decide(&baseline, "output", &pool)
+    );
+    assert_eq!(decide(&with, "output", &pool).verdict, 0);
+}
+
+#[test]
+fn local_tcp_port_owners_lead_the_base_chains_and_leave_the_guard_unchanged() {
+    let reference = chains(&prepared(granted(pool_guard(), many(4))));
+    let graph = chains(&prepared(owned(granted(pool_guard(), many(4)), exact())));
+    for name in ["pool_guard", "pool_reply", "forward"] {
+        assert_eq!(graph[name], reference[name], "{name}");
+    }
+    // Two owners, one OUTPUT and one INPUT rule each, ahead of everything the
+    // guard and its host grants compile, so nothing earlier accepts past them.
+    for name in ["output", "input"] {
+        assert_eq!(graph[name].len(), reference[name].len() + 2, "{name}");
+        assert_eq!(graph[name][2..], reference[name][..], "{name}");
+    }
+    let names = |expressions: &Vec<wire::Attr>| -> Vec<String> {
+        expressions
+            .iter()
+            .map(|expression| wire::text(&wire::attrs(&expression.value).unwrap(), 1).unwrap())
+            .collect()
+    };
+    for rule in &graph["output"][..2] {
+        assert_eq!(names(rule).last().unwrap(), "reject");
+    }
+    for rule in &graph["input"][..2] {
+        assert_eq!(names(rule).last().unwrap(), "immediate");
+    }
+}
+
+#[test]
+fn local_tcp_port_owners_reject_non_loopback_wildcard_duplicate_and_unknown_input() {
+    for owners in [
+        json!([owner("10.0.0.1", 10010, 0)]),
+        json!([owner("0.0.0.0", 10010, 0)]),
+        json!([owner("128.0.0.1", 10010, 0)]),
+        json!([owner("127.0.0.0", 10010, 0)]),
+        json!([owner("127.255.255.255", 10010, 0)]),
+        json!([owner("127.0.0.01", 10010, 0)]),
+        json!([owner("127.0.0.1/32", 10010, 0)]),
+        json!([owner("127.0.0.0/8", 10010, 0)]),
+        json!([owner("::1", 10010, 0)]),
+        json!([owner("localhost", 10010, 0)]),
+        json!([owner("127.0.0.1", 0, 0)]),
+        json!([{"address":"127.0.0.1","port":65536,"uid":0}]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":-1}]),
+        json!([owner("127.0.0.1", 10010, u32::MAX)]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":4294967296_u64}]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":0.5}]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":"0"}]),
+        json!([{"address":"127.0.0.1","port":10010}]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":0,"uids":[0]}]),
+        json!([{"address":"127.0.0.1","port":10010,"uid":0,"protocol":"tcp"}]),
+        // One owner per exact address and port.
+        json!([owner("127.0.0.1", 10010, 0), owner("127.0.0.1", 10010, 0)]),
+        json!([
+            owner("127.0.0.1", 10010, 0),
+            owner("127.0.0.1", 10010, 1000)
+        ]),
+        json!({}),
+        Value::Null,
+    ] {
+        assert!(
+            normalized(owned(pool_guard(), owners.clone())).is_err(),
+            "{owners}"
+        );
+    }
+    // Other loopback host addresses and the full port and uid ranges are valid.
+    assert!(normalized(owned(
+        pool_guard(),
+        json!([
+            owner("127.0.0.1", 1, 0),
+            owner("127.0.0.1", 65535, u32::MAX - 1),
+            owner("127.0.0.2", 1, 0),
+            owner("127.255.255.254", 10010, 1000)
+        ])
+    ))
+    .is_ok());
+    // Only the allocation-pool guard carries loopback ownership.
+    for fixture in [super::tests::host(), super::tests::router()] {
+        assert!(normalized(owned(fixture, exact())).is_err());
+    }
+}
+
+#[test]
+fn local_tcp_port_owners_meet_the_atomic_reserve_at_the_contract_maximum() {
+    let deletion = 768 * (20 + 72 + 36 + 12);
+    let maximum: Vec<_> = (0..8)
+        .map(|index| owner("127.0.0.1", 10000 + index, 0))
+        .collect();
+    // The guard's own maximum beside the owners: 64 pools and 1024 host grants.
+    let mut grants = many(1024);
+    for grant in grants.as_array_mut().unwrap() {
+        grant["destinationAddress"] = json!("10.1.0.2");
+    }
+    let mut value = owned(granted(pool_guard(), grants), json!(maximum));
+    value["scope"]["prefixes"] = json!((0..64)
+        .map(|part| format!("10.{part}.0.0/16"))
+        .collect::<Vec<_>>());
+    let prepared = prepared(value.clone());
+    prepared.validate().unwrap();
+    let program = prepared
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let size = |kinds: &[u16]| -> usize {
+        program
+            .iter()
+            .filter(|(kind, _)| kinds.contains(kind))
+            .map(|(_, attributes)| wire::encode_attrs(attributes).len() + 20)
+            .sum()
+    };
+    let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
+    assert!(program.len() < 768 && graph <= super::compile::RULE_BYTES && graph + elements <= super::compile::TARGET_BYTES);
+    assert!(deletion + graph + elements + 64 <= wire::BATCH_BYTES);
+    println!(
+        "LOCAL_TCP_PORT_OWNER_MAX owners=8 prefixes=64 grants=1024 operations={} rule_bytes={graph}",
+        program.len()
+    );
+    value["scope"]["localTcpPortOwners"]
+        .as_array_mut()
+        .unwrap()
+        .push(owner("127.0.0.1", 10008, 0));
+    assert!(normalized(value).is_err());
+}