@push.rocks/smartnftables 2.6.0 → 3.0.0

package/rust/src/owner_scale_traffic_tests.rs

@@ -0,0 +1,383 @@
+//! A 64-workload router: every workload with local DNS, public TCP and UDP
+//! egress, four platform endpoints and a publication, the first with the SIP
+//! shape, applied in one batch and proven on first, middle and last workloads.
+use super::egress_traffic_tests::{allocation, binding, connect, denied, ns_ip, roundtrip};
+use super::host_traffic_tests::{control, published_udp};
+use super::*;
+use crate::egress;
+use serde_json::{json, Value};
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream, UdpSocket};
+use std::time::Duration;
+
+const WORKLOADS: u32 = 64;
+const ROUTER: &str = "sc_router";
+const HOST: &str = "sc_host";
+const PEER: &str = "sc_peer";
+/// The proven workloads: first, middle and last.
+const PROBED: [u32; 3] = [0, 31, 63];
+
+fn workload(index: u32) -> String {
+    format!("sc_w{index}")
+}
+fn socket_at(namespace: &str, address: String) -> UdpSocket {
+    let socket = in_namespace(namespace, move || UdpSocket::bind(address).unwrap());
+    socket
+        .set_read_timeout(Some(Duration::from_millis(250)))
+        .unwrap();
+    socket
+}
+/// Four platform endpoints on the peer, beside the protected prefixes.
+fn protection() -> Value {
+    json!({"authorityDigest":format!("sha256:{}","b".repeat(64)),"prefixes":["10.0.0.0/8","192.0.2.0/24"],
+        "platformEndpoints":[{"id":"dns","address":"192.0.2.3","protocol":"udp","port":5300},
+            {"id":"mail","address":"192.0.2.3","protocol":"tcp","port":3000},
+            {"id":"metrics","address":"192.0.2.3","protocol":"tcp","port":9100},
+            {"id":"registry","address":"192.0.2.3","protocol":"udp","port":5301}]})
+}
+/// Publication `index`: one TCP port per workload, and the SIP shape on the
+/// first.
+fn publications(router: bool) -> Vec<Value> {
+    let entry = |protocol: &str,
+                 port: u16,
+                 end: Option<u16>,
+                 endpoint: u16,
+                 address: String,
+                 symmetric: bool| {
+        let mut value = if router {
+            json!({"protocol":protocol,"transitPort":port,"endpointPort":endpoint,
+                "endpointAddress":address,"transitSourceAddress":"10.240.0.2","symmetric":symmetric})
+        } else {
+            json!({"protocol":protocol,"hostPort":port,"targetPort":port,
+                "targetAddress":"10.240.0.2","hostIp":"192.0.2.2","symmetric":symmetric})
+        };
+        if let Some(end) = end {
+            value[if router {
+                "transitPortEnd"
+            } else {
+                "hostPortEnd"
+            }] = json!(end);
+        }
+        value
+    };
+    let mut result = vec![
+        entry("udp", 5070, None, 5070, "10.241.0.2".into(), true),
+        entry("tcp", 5070, None, 5070, "10.241.0.2".into(), true),
+        entry("udp", 20000, Some(20200), 20000, "10.241.0.2".into(), true),
+    ];
+    for index in 0..WORKLOADS {
+        let port = 30000 + index as u16;
+        result.push(entry(
+            "tcp",
+            port,
+            None,
+            if router { 8080 } else { port },
+            format!("10.241.{index}.2"),
+            false,
+        ));
+    }
+    result
+}
+fn router_policy() -> egress::Policy {
+    let mut endpoints = Vec::new();
+    let mut links = Vec::new();
+    let mut rules = Vec::new();
+    let mut grants = Vec::new();
+    for index in 0..WORKLOADS {
+        let name = format!("w{index}");
+        let gateway = format!("10.241.{index}.1");
+        let address = format!("10.241.{index}.2");
+        let link = binding(&name, &gateway, "veth");
+        endpoints.push(
+            json!({"id":name,"interfaceIndex":link["interfaceIndex"],"interfaceName":name,
+            "interfaceKind":"veth","sourcePrefixes":[format!("{address}/32")]}),
+        );
+        links.push(link);
+        for protocol in ["tcp", "udp"] {
+            rules.push(json!({"sourceEndpoint":name,"destinationEndpoint":null,
+                "sourcePrefix":format!("{address}/32"),"destinationPrefix":format!("{gateway}/32"),
+                "protocol":protocol,"sourcePort":null,"destinationPort":53}));
+            rules.push(json!({"sourceEndpoint":null,"destinationEndpoint":name,
+                "sourcePrefix":format!("{gateway}/32"),"destinationPrefix":format!("{address}/32"),
+                "protocol":protocol,"sourcePort":53,"destinationPort":null}));
+            let range = if protocol == "udp" {
+                (10000, 10015)
+            } else {
+                (10016, 10031)
+            };
+            grants.push(
+                json!({"sourceEndpoint":name,"sourcePrefix":format!("{address}/32"),
+                "destination":{"kind":"public","prefix":"0.0.0.0/0"},"protocol":protocol,
+                "sourcePort":null,"destinationPort":null,
+                "sourcePortRange":{"first":range.0,"last":range.1}}),
+            );
+        }
+        for (id, protocol, port) in [
+            ("dns", "udp", 5300),
+            ("mail", "tcp", 3000),
+            ("metrics", "tcp", 9100),
+            ("registry", "udp", 5301),
+        ] {
+            let range = if protocol == "udp" {
+                (10000, 10015)
+            } else {
+                (10016, 10031)
+            };
+            grants.push(
+                json!({"sourceEndpoint":name,"sourcePrefix":format!("{address}/32"),
+                "destination":{"kind":"platform","endpointId":id},"protocol":protocol,
+                "sourcePort":null,"destinationPort":port,
+                "sourcePortRange":{"first":range.0,"last":range.1}}),
+            );
+        }
+    }
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    generation["grants"] = json!(grants);
+    serde_json::from_value(json!({"schemaVersion":2,"revision":1,"scope":{"kind":"routerEgress",
+        "endpoints":endpoints,"rules":rules,"links":links,"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation],"publishedPorts":publications(true)}}))
+    .unwrap()
+}
+fn host_policy() -> egress::Policy {
+    let mut value = egress::tests::host();
+    value["scope"]["protection"] = protection();
+    value["scope"]["handoffs"][0]["link"] = binding("router", "10.240.0.1", "veth");
+    value["scope"]["handoffs"][0]["allocations"] = json!([allocation()]);
+    value["scope"]["uplink"] = binding("uplink", "192.0.2.2", "veth");
+    value["scope"]["publishedPorts"] = json!(publications(false));
+    serde_json::from_value(value).unwrap()
+}
+fn apply(
+    namespace: &str,
+    name: &'static str,
+    policy: fn() -> egress::Policy,
+) -> (Owner, Applied, usize, Vec<(String, usize)>) {
+    in_namespace(namespace, move || {
+        let mut owner = Owner::new(options(name)).unwrap();
+        let target: Prepared = policy().prepare().unwrap().into();
+        target.validate_interfaces().expect("scale fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        let graph = owner.graph().unwrap().expect("owned table present");
+        let sets = graph
+            .sets
+            .iter()
+            .map(|(attributes, elements)| (wire::text(attributes, 2).unwrap(), elements.len()))
+            .collect();
+        (owner, applied, graph.rules.len(), sets)
+    })
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_sixty_four_workload_router_enforces_every_workload_from_set_elements() {
+    isolated();
+    for name in [ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    for index in 0..WORKLOADS {
+        let name = workload(index);
+        ip(&["netns", "add", &name]);
+        connect(
+            &name,
+            "client",
+            &format!("10.241.{index}.2/24"),
+            ROUTER,
+            &format!("w{index}"),
+            &format!("10.241.{index}.1/24"),
+        );
+        ns_ip(
+            &name,
+            &[
+                "route",
+                "add",
+                "default",
+                "via",
+                &format!("10.241.{index}.1"),
+            ],
+        );
+    }
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(ROUTER, &["route", "add", "default", "via", "10.240.0.1"]);
+    ns_ip(
+        HOST,
+        &["route", "add", "10.241.0.0/16", "via", "10.240.0.2"],
+    );
+    ns_ip(
+        HOST,
+        &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
+    );
+    ns_ip(PEER, &["address", "add", "203.0.113.2/32", "dev", "lo"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    // Positive controls before any policy: a workload reaches another workload,
+    // the protected peer address, and the peer with another workload's source.
+    let neighbour = socket_at(&workload(1), "10.241.1.2:8081".into());
+    let protected_peer = socket_at(PEER, "192.0.2.3:40300".into());
+    let spoof_target = socket_at(PEER, "203.0.113.2:42100".into());
+    control(
+        &socket_at(&workload(0), "10.241.0.2:40400".into()),
+        "10.241.1.2:8081",
+        &neighbour,
+        true,
+    );
+    control(
+        &socket_at(&workload(0), "10.241.0.2:40401".into()),
+        "192.0.2.3:40300",
+        &protected_peer,
+        true,
+    );
+    ns_ip(
+        &workload(0),
+        &["address", "add", "10.241.1.99/32", "dev", "client"],
+    );
+    control(
+        &socket_at(&workload(0), "10.241.1.99:40402".into()),
+        "203.0.113.2:42100",
+        &spoof_target,
+        true,
+    );
+    let (host_owner, host_applied, _, _) = apply(HOST, "scale_host", host_policy);
+    let (router_owner, router_applied, router_rules, router_sets) =
+        apply(ROUTER, "scale_router", router_policy);
+    // Every workload is set elements: links, endpoint indices and names, source
+    // prefixes, the four DNS rules each, and six leased grants each.
+    let named = |name: &str| {
+        router_sets
+            .iter()
+            .find(|(set, _)| set == name)
+            .map(|(_, count)| *count)
+    };
+    assert_eq!(named("private_link"), Some(WORKLOADS as usize + 1));
+    assert_eq!(named("private_source"), Some(WORKLOADS as usize));
+    assert_eq!(named("private_port"), Some(WORKLOADS as usize * 4));
+    assert_eq!(named("leased_public_flow"), Some(WORKLOADS as usize * 2));
+    assert_eq!(named("leased_platform_flow"), Some(WORKLOADS as usize * 4));
+    assert_eq!(named("published_forward"), Some(WORKLOADS as usize + 3));
+    // The rule graph a single workload compiles, independent of the count.
+    assert!(router_rules < 100, "{router_rules}");
+    let public = socket_at(PEER, "203.0.113.2:42000".into());
+    let platform = socket_at(PEER, "192.0.2.3:5300".into());
+    let registry = socket_at(PEER, "192.0.2.3:5301".into());
+    let metrics = in_namespace(PEER, || TcpListener::bind("192.0.2.3:9100").unwrap());
+    for index in PROBED {
+        let name = workload(index);
+        let address = format!("10.241.{index}.2");
+        // Local DNS on the workload's own gateway.
+        let dns = socket_at(ROUTER, format!("10.241.{index}.1:53"));
+        let client = socket_at(&name, format!("{address}:40001"));
+        assert_eq!(
+            roundtrip(&client, &dns).to_string(),
+            format!("{address}:40001")
+        );
+        // Public egress through both hops from the leased range.
+        let outer = roundtrip(&socket_at(&name, format!("{address}:40002")), &public);
+        assert_eq!(outer.ip().to_string(), "192.0.2.2");
+        assert!((10000..=10015).contains(&outer.port()), "{outer}");
+        // Two platform endpoints over UDP and one over TCP.
+        for target in [&platform, &registry] {
+            let outer = roundtrip(&socket_at(&name, format!("{address}:40003")), target);
+            assert_eq!(outer.ip().to_string(), "192.0.2.2");
+        }
+        let mut stream = in_namespace(&name, || {
+            TcpStream::connect_timeout(&"192.0.2.3:9100".parse().unwrap(), Duration::from_secs(1))
+        })
+        .expect("platform tcp opening");
+        let (mut served, peer) = metrics.accept().unwrap();
+        assert_eq!(peer.ip().to_string(), "192.0.2.2");
+        assert!((10016..=10031).contains(&peer.port()));
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+        served.write_all(b"pong").unwrap();
+        stream.read_exact(&mut [0; 4]).unwrap();
+        // The workload's publication, with the client address preserved.
+        let listener = in_namespace(&name, move || {
+            TcpListener::bind(format!("10.241.{index}.2:8080")).unwrap()
+        });
+        let mut inbound = in_namespace(PEER, move || {
+            TcpStream::connect_timeout(
+                &format!("192.0.2.2:{}", 30000 + index).parse().unwrap(),
+                Duration::from_secs(1),
+            )
+        })
+        .expect("published tcp opening");
+        let (mut accepted, client) = listener.accept().unwrap();
+        assert_eq!(client.ip().to_string(), "192.0.2.3");
+        accepted.write_all(b"pong").unwrap();
+        inbound
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+        inbound.read_exact(&mut [0; 4]).unwrap();
+        // Nothing unnamed: another workload, a protected address outside the
+        // platform endpoints, and a platform port that is not granted.
+        denied(
+            &socket_at(&name, format!("{address}:40005")),
+            &neighbour,
+            false,
+        );
+        denied(
+            &socket_at(&name, format!("{address}:40006")),
+            &protected_peer,
+            false,
+        );
+        let ungranted = socket_at(PEER, format!("192.0.2.3:{}", 5400 + index));
+        denied(
+            &socket_at(&name, format!("{address}:40007")),
+            &ungranted,
+            false,
+        );
+    }
+    // The first workload's SIP publication leaves from its own port.
+    let sip = socket_at(&workload(0), "10.241.0.2:5070".into());
+    let sip_peer = socket_at(PEER, "203.0.113.2:42002".into());
+    assert_eq!(roundtrip(&sip, &sip_peer).to_string(), "192.0.2.2:5070");
+    published_udp(
+        &socket_at(PEER, "192.0.2.3:40500".into()),
+        &socket_at(&workload(0), "10.241.0.2:20100".into()),
+        "192.0.2.2:20100",
+        "192.0.2.3:40500",
+    );
+    // Another workload's source address stays behind the anti-spoof guard.
+    denied(
+        &socket_at(&workload(0), "10.241.1.99:40403".into()),
+        &spoof_target,
+        false,
+    );
+    in_namespace(ROUTER, move || {
+        let mut owner = router_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(router_applied).unwrap();
+    });
+    in_namespace(HOST, move || {
+        let mut owner = host_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(host_applied).unwrap();
+    });
+    println!("V2_SCALE_PROOF workloads=64 router_rules={router_rules} set_elements_verified=true private_dns=true public_egress=true platform_udp=true platform_tcp=true published_inbound=true client_address_preserved=true cross_workload_denied=true protected_denied=true ungranted_platform_port_denied=true symmetric_sip=true published_range=true spoof_denied=true positive_controls=true released=true");
+}

package/rust/src/owner_tests.rs

@@ -24,6 +24,12 @@ mod host_traffic_tests;
 #[path = "owner_router_traffic_tests.rs"]
 mod router_traffic_tests;
 
+#[path = "owner_publishedrange_traffic_tests.rs"]
+mod publishedrange_traffic_tests;
+
+#[path = "owner_scale_traffic_tests.rs"]
+mod scale_traffic_tests;
+
 #[path = "owner_poolguard_tests.rs"]
 mod poolguard_tests;
 

package/rust/src/policy.rs

@@ -90,12 +90,37 @@ fn covers(parent: &str, child: &str) -> Result<bool> {
 }
 
 impl Policy {
-    pub fn prepare(mut self) -> Result<Prepared> {
+    pub fn prepare(self) -> Result<Prepared> {
+        let policy = self.normalize(32, 128)?;
+        let digest = format!(
+            "sha256:{:x}",
+            Sha256::digest(serde_json::to_vec(&policy).map_err(|_| Error::Invalid)?)
+        );
+        let prepared = Prepared { policy, digest };
+        // Compile during preparation; an oversized native batch never reaches the kernel.
+        let program = prepared.program(&format!("snft_{}", "x".repeat(59)))?;
+        // Reserve enough of the batch for deleting a previous maximum
+        // graph, then installing this complete graph in the same transaction.
+        if program.len() > 768
+            || program
+                .iter()
+                .map(|(_, attrs)| wire::encode_attrs(attrs).len() + 20)
+                .sum::<usize>()
+                > 100_000
+        {
+            return Err(Error::Invalid);
+        }
+        Ok(prepared)
+    }
+    /// Validates and orders the endpoints and rules. Schema v1 compiles one rule
+    /// per endpoint and grant, so it admits 32 endpoints and 128 rules; the
+    /// set-backed router scope of schema v2 admits more.
+    pub(crate) fn normalize(mut self, endpoints: usize, rules: usize) -> Result<Self> {
         if self.schema_version != 1
             || self.revision == 0
             || self.revision > 9_007_199_254_740_991
-            || self.endpoints.len() > 32
-            || self.rules.len() > 128
+            || self.endpoints.len() > endpoints
+            || self.rules.len() > rules
         {
             return Err(Error::Invalid);
         }
@@ -185,28 +210,7 @@ impl Policy {
                 }
             }
         }
-        let digest = format!(
-            "sha256:{:x}",
-            Sha256::digest(serde_json::to_vec(&self).map_err(|_| Error::Invalid)?)
-        );
-        let prepared = Prepared {
-            policy: self,
-            digest,
-        };
-        // Compile during preparation; an oversized native batch never reaches the kernel.
-        let program = prepared.program(&format!("snft_{}", "x".repeat(59)))?;
-        // Reserve enough of the batch for deleting a previous maximum
-        // graph, then installing this complete graph in the same transaction.
-        if program.len() > 768
-            || program
-                .iter()
-                .map(|(_, attrs)| wire::encode_attrs(attrs).len() + 20)
-                .sum::<usize>()
-                > 100_000
-        {
-            return Err(Error::Invalid);
-        }
-        Ok(prepared)
+        Ok(self)
     }
 }
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnftables',
-  version: '2.6.0',
+  version: '3.0.0',
   description: 'A TypeScript module for managing nftables rules including NAT, firewall, and rate limiting with a high-level API.'
 }

package/ts/managed.egress.types.ts

@@ -60,9 +60,14 @@ export interface IManagedNftEgressGenerationV2 extends IManagedNftHandoffAllocat
  * `transitSourceAddress:transitPort`, this translates on to the workload. */
 export interface IManagedNftRouterPublishedPortV2 {
   protocol: 'tcp' | 'udp';
-  /** Published handoff port, 1–65535 and unique per protocol across the scope.
-   * It is the `targetPort` of the matching host-transit publication. */
+  /** Published handoff port, 1–65535; published ports never overlap per protocol across the
+   * scope. It is the `targetPort` of the matching host-transit publication. */
   transitPort: number;
+  /** Optional last port of a published range `transitPort..transitPortEnd`, greater than
+   * `transitPort`. A range keeps every port, so `endpointPort` must equal `transitPort`; like one
+   * port it is one interval set element per set, and its translation keeps the port. Absent for
+   * one port, which is its only canonical form. */
+  transitPortEnd?: number;
   endpointPort: number;
   /** Exact current workload endpoint address behind one veth endpoint of this
    * scope. Never a router-local address, a gateway or a platform endpoint. */
@@ -70,6 +75,12 @@ export interface IManagedNftRouterPublishedPortV2 {
   /** Exact leased transit source address of one current generation, present on
    * `handoff`. No wildcard, secondary-address or route inference. */
   transitSourceAddress: string;
+  /** Optional: the workload may open flows from `endpointAddress` and its published endpoint
+   * port(s) toward unprotected space, source-translated to `transitSourceAddress` and the
+   * published transit port (a range keeps the port). The protected union stays denied, and its
+   * endpoint ports may not overlap another publication's on the same address. Absent and
+   * `false` are the same canonical policy. */
+  symmetric?: boolean;
 }
 
 /** One exact host-origin flow: the node's own host network namespace dials one port of one local
@@ -136,13 +147,24 @@ export interface IManagedNftRouterEgressScopeV2 {
 /** One inbound uplink publication, compiled inside the same host-transit generation. */
 export interface IManagedNftPublishedPortV2 {
   protocol: 'tcp' | 'udp';
-  /** Published uplink port, 1–65535 and unique per protocol across the scope. */
+  /** Published uplink port, 1–65535; published ports never overlap per protocol across the scope. */
   hostPort: number;
+  /** Optional last port of a published range `hostPort..hostPortEnd`, greater than `hostPort`.
+   * A range keeps every port, so `targetPort` must equal `hostPort`; like one port it is one
+   * interval set element per set, and its translation keeps the port. Absent for one port, which
+   * is its only canonical form. */
+  hostPortEnd?: number;
   targetPort: number;
   /** Exact leased transit source address of one current allocation; it selects the handoff. */
   targetAddress: string;
   /** Exact current uplink address that publishes this port. No wildcard or route inference. */
   hostIp: string;
+  /** Optional: flows from `targetAddress` and the published target port(s) may leave through the
+   * uplink toward unprotected space, source-translated to `hostIp` and the published uplink port
+   * (a range keeps the port). The protected union stays denied, its target ports may not fall in
+   * a leased range of `targetAddress` or overlap another publication's. Absent and `false` are
+   * the same canonical policy. */
+  symmetric?: boolean;
 }
 
 /** Shared-host capture barrier and explicit outer SNAT; Docker forwarding remains a separate owner. */