@push.rocks/smartnftables 2.6.0 → 3.0.0

package/rust/src/egress.private.rs

@@ -0,0 +1,197 @@
+//! The router's private endpoints and directed rules compile to a constant number
+//! of rules around named sets, so the rule graph does not grow with workloads.
+//! Every endpoint link (index and name) is one element of `private_link`; the
+//! anti-spoof guard, the directed rules and the terminal denials look the packet
+//! up there and in sets keyed on the link index, so a renamed or reused interface
+//! never matches an element of another link.
+use super::keys::{self, Key, Loads, ADDRESS, INDEX, NAME, PORT, PROTOCOL};
+use super::*;
+
+/// Every endpoint link, index and name, and the absent interface (0, "") of
+/// router-local traffic. Also the proof that a key's link index names its link:
+/// indices are unique, so an index in a key and its pair in this set fix the name.
+pub(super) const LINK: &str = "private_link";
+/// Every endpoint link index, and every endpoint link name: either one alone is
+/// enough for the terminal denial, so a rename or index reuse stays denied.
+const INDEX_SET: &str = "private_index";
+const NAME_SET: &str = "private_name";
+/// Each endpoint link index with each of its source prefixes.
+const SOURCE: &str = "private_source";
+/// Directed rules of any protocol, and of one transport protocol.
+const ANY: &str = "private_any";
+const PORTED: &str = "private_port";
+
+fn name(value: &str) -> Vec<u8> {
+    let mut bytes = value.as_bytes().to_vec();
+    bytes.resize(16, 0);
+    bytes
+}
+fn link_key(index: u32, interface: &str) -> Vec<u8> {
+    let mut key = index.to_ne_bytes().to_vec();
+    key.extend(name(interface));
+    key
+}
+fn index_of(scope: &RouterScope, id: &Option<String>) -> Result<u32> {
+    match id {
+        None => Ok(0),
+        Some(id) => scope
+            .endpoints
+            .iter()
+            .find(|endpoint| endpoint.id == *id)
+            .map(|endpoint| endpoint.interface_index)
+            .ok_or(Error::Invalid),
+    }
+}
+
+pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()> {
+    let mut links = vec![(link_key(0, ""), None)];
+    let mut indices = Vec::new();
+    let mut names = Vec::new();
+    let mut sources = Vec::new();
+    for endpoint in &scope.endpoints {
+        links.push((
+            link_key(endpoint.interface_index, &endpoint.interface_name),
+            None,
+        ));
+        indices.push((endpoint.interface_index.to_ne_bytes().to_vec(), None));
+        names.push((name(&endpoint.interface_name), None));
+        for prefix in &endpoint.source_prefixes {
+            sources.push(
+                Key::default()
+                    .index(endpoint.interface_index)
+                    .prefix(prefix)?
+                    .element(None),
+            );
+        }
+    }
+    keys::exact(program, LINK, 32, INDEX + NAME, None, links)?;
+    keys::exact(program, INDEX_SET, 33, INDEX, None, indices)?;
+    keys::exact(program, NAME_SET, 34, NAME, None, names)?;
+    keys::interval(program, SOURCE, 35, &[INDEX, ADDRESS], None, sources)?;
+    let (mut any, mut ported) = (Vec::new(), Vec::new());
+    for rule in &scope.rules {
+        let key = Key::default()
+            .index(index_of(scope, &rule.source_endpoint)?)
+            .index(index_of(scope, &rule.destination_endpoint)?)
+            .prefix(&rule.source_prefix)?
+            .prefix(&rule.destination_prefix)?;
+        if rule.protocol == "any" {
+            any.push(key.element(None));
+        } else {
+            ported.push(
+                key.protocol(&rule.protocol)
+                    .port(rule.source_port)
+                    .port(rule.destination_port)
+                    .element(None),
+            );
+        }
+    }
+    keys::interval(
+        program,
+        ANY,
+        36,
+        &[INDEX, INDEX, ADDRESS, ADDRESS],
+        None,
+        any,
+    )?;
+    keys::interval(
+        program,
+        PORTED,
+        37,
+        &[INDEX, INDEX, ADDRESS, ADDRESS, PROTOCOL, PORT, PORT],
+        None,
+        ported,
+    )?;
+    Ok(())
+}
+/// The directions a filter chain sees an endpoint link in.
+fn directions(chain: &str) -> Vec<bool> {
+    match chain {
+        "input" => vec![true],
+        "output" => vec![false],
+        _ => vec![true, false],
+    }
+}
+/// The interface of one direction is an endpoint link or absent, by index and
+/// name.
+pub(super) fn known(incoming: bool) -> Vec<Attr> {
+    Loads::new().link(incoming).lookup(LINK)
+}
+/// Anti-spoof guards: a packet arriving from an endpoint link must carry one of
+/// its source prefixes, and one leaving to it one of its prefixes as destination;
+/// anything else on the link, IPv6 included, drops. The absent interface never
+/// occurs in the directions a chain guards.
+pub(super) fn guards(program: &mut Program<'_>, scope: &RouterScope, chain: &str) -> Result<()> {
+    if scope.endpoints.is_empty() {
+        return Ok(());
+    }
+    for incoming in directions(chain) {
+        let mut foreign = known(incoming);
+        foreign.push(expr("meta", vec![Attr::u32(1, 1), Attr::u32(2, 15)]));
+        foreign.push(expr(
+            "cmp",
+            vec![
+                Attr::u32(1, 1),
+                Attr::u32(2, 1),
+                Attr::nested(3, vec![Attr::bytes(1, vec![libc::NFPROTO_IPV4 as u8])]),
+            ],
+        ));
+        program.end(chain, foreign, 0)?;
+        let mut spoofed = ipv4();
+        spoofed.extend(known(incoming));
+        spoofed.extend(
+            Loads::new()
+                .index(incoming)
+                .address(incoming)
+                .absent(SOURCE),
+        );
+        program.end(chain, spoofed, 0)?;
+    }
+    Ok(())
+}
+/// Directed rules: the incoming and outgoing interface (an endpoint link, or
+/// absent for the router itself), the addresses and, for a transport rule, the
+/// protocol and ports. Input sees no outgoing and output no incoming interface,
+/// so each chain matches exactly the rules that were compiled into it.
+pub(super) fn grants(program: &mut Program<'_>, scope: &RouterScope, chain: &str) -> Result<()> {
+    for (set, ported) in [(ANY, false), (PORTED, true)] {
+        if !scope
+            .rules
+            .iter()
+            .any(|rule| (rule.protocol != "any") == ported)
+        {
+            continue;
+        }
+        let mut expressions = ipv4();
+        expressions.extend(known(true));
+        expressions.extend(known(false));
+        let mut loads = Loads::new();
+        loads.index(true).index(false).address(true).address(false);
+        if ported {
+            loads.protocol().port(true).port(false);
+        }
+        expressions.extend(loads.lookup(set));
+        program.end(chain, expressions, 1)?;
+    }
+    Ok(())
+}
+/// Terminal denial of every endpoint link, by index or by name alone.
+pub(super) fn denials(program: &mut Program<'_>, scope: &RouterScope, chain: &str) -> Result<()> {
+    if scope.endpoints.is_empty() {
+        return Ok(());
+    }
+    for incoming in directions(chain) {
+        program.end(chain, Loads::new().index(incoming).lookup(INDEX_SET), 0)?;
+        program.end(
+            chain,
+            Loads::new()
+                .push(
+                    |at| super::hostgrant::meta_to(if incoming { 6 } else { 7 }, at),
+                    NAME,
+                )
+                .lookup(NAME_SET),
+            0,
+        )?;
+    }
+    Ok(())
+}

package/rust/src/egress.published.rs

@@ -0,0 +1,370 @@
+//! Published ports compile to a constant number of rules around concatenated
+//! interval sets and maps, on both hops, so the rule graph does not grow with the
+//! number of publications; publications cost set elements, which have their own
+//! budget. Every key carries the operands the per-publication rules compared one
+//! by one: the variable interface (index and name), the packet and conntrack
+//! protocols, the live address and port, and the originally tracked address and
+//! port. A port field is an inclusive interval, so one element holds one port or
+//! a whole range, and every other field is exact.
+use super::hostgrant::{meta_to, register};
+use super::keys::{self, word, Key, Loads, ADDRESS, INDEX, NAME, PORT, PROTOCOL};
+use super::*;
+
+/// Router handoff arrivals of a publication, classified before conntrack.
+pub(super) const ARRIVAL: &str = "published_arrival";
+/// Router workload packets from a published port, classified before conntrack.
+pub(super) const ENDPOINT: &str = "published_endpoint";
+/// Destination NAT of one-port publications to their inside address and port.
+pub(super) const PORT_MAP: &str = "published_port";
+/// Destination NAT of ranges to their inside address, keeping every port.
+pub(super) const ADDRESS_MAP: &str = "published_address";
+/// Inbound flows of every publication, both directions.
+pub(super) const FORWARD: &str = "published_forward";
+/// Flows symmetric publications open from their inside ports, both directions;
+/// the data is the source NAT to the outside address and port span.
+pub(super) const SYMMETRIC: &str = "published_symmetric";
+
+const LINK: [u32; 2] = [INDEX, NAME];
+
+/// One publication on one hop. The outside is what clients reach (the uplink
+/// address and port on the host, the transit address and port in the router);
+/// the inside is its translation (the leased transit address on the host, the
+/// workload address in the router), behind `link`, the interface toward it.
+pub(super) struct Publication<'a> {
+    pub(super) protocol: &'a str,
+    pub(super) outside: (&'a str, u16, u16),
+    pub(super) inside: (&'a str, u16, u16),
+    pub(super) link: &'a LocalLink,
+    pub(super) symmetric: bool,
+}
+/// One hop's publications and its fixed interface: the uplink on the host, the
+/// handoff in the router.
+pub(super) struct Hop<'a> {
+    pub(super) publications: Vec<Publication<'a>>,
+    pub(super) fixed: &'a LocalLink,
+}
+
+/// `[link, protocols, address, port, original address, original port]`, the key
+/// of both admission sets.
+fn flow_fields() -> Vec<u32> {
+    let mut fields = LINK.to_vec();
+    fields.extend([PROTOCOL, PROTOCOL, ADDRESS, PORT, ADDRESS, PORT]);
+    fields
+}
+fn inbound_key(publication: &Publication<'_>) -> Result<IntervalElement> {
+    let (outside, outside_first, outside_last) = publication.outside;
+    let (inside, inside_first, inside_last) = publication.inside;
+    Ok(Key::default()
+        .link(publication.link)
+        .protocols(publication.protocol)
+        .address(inside)?
+        .span(inside_first, inside_last)
+        .address(outside)?
+        .span(outside_first, outside_last)
+        .element(None))
+}
+fn symmetric_key(publication: &Publication<'_>) -> Result<IntervalElement> {
+    let (outside, outside_first, outside_last) = publication.outside;
+    let (inside, inside_first, inside_last) = publication.inside;
+    let mut data = super::super::address(outside)?.to_be_bytes().to_vec();
+    data.extend(word(&outside_first.to_be_bytes()));
+    data.extend(word(&outside_last.to_be_bytes()));
+    Ok(Key::default()
+        .link(publication.link)
+        .protocols(publication.protocol)
+        .address(inside)?
+        .span(inside_first, inside_last)
+        .address(inside)?
+        .span(inside_first, inside_last)
+        .element(Some(data)))
+}
+/// Inbound flows: the inside link is the outgoing interface of the original
+/// direction and the incoming one of the reply; the live tuple is the translated
+/// inside destination, the original tuple the published outside destination.
+fn inbound_loads(reply: bool) -> Loads {
+    let mut loads = Loads::new();
+    loads
+        .link(reply)
+        .protocols()
+        .address(reply)
+        .port(reply)
+        .original(false);
+    loads
+}
+/// Symmetric flows: opened from the inside link, address and port, so the live
+/// and the original tuple both carry the inside source.
+fn symmetric_loads(reply: bool) -> Loads {
+    let mut loads = Loads::new();
+    loads
+        .link(!reply)
+        .protocols()
+        .address(!reply)
+        .port(!reply)
+        .original(true);
+    loads
+}
+fn translation_loads() -> Loads {
+    let mut loads = Loads::new();
+    loads.protocols().address(false).port(false);
+    loads
+}
+fn translation_fields() -> [u32; 4] {
+    [PROTOCOL, PROTOCOL, ADDRESS, PORT]
+}
+fn ranged(publication: &Publication<'_>) -> bool {
+    publication.outside.1 != publication.outside.2
+}
+
+/// Every set of one hop with its elements, before any rule binds it. `router`
+/// adds the two raw classification sets.
+pub(super) fn sets(program: &mut Program<'_>, hop: &Hop<'_>, router: bool) -> Result<()> {
+    if hop.publications.is_empty() {
+        return Ok(());
+    }
+    if router {
+        let mut arrivals = Vec::new();
+        for publication in &hop.publications {
+            let (outside, first, last) = publication.outside;
+            arrivals.push(
+                Key::default()
+                    .protocol(publication.protocol)
+                    .address(outside)?
+                    .span(first, last)
+                    .element(None),
+            );
+        }
+        declare(
+            program,
+            ARRIVAL,
+            16,
+            &[PROTOCOL, ADDRESS, PORT],
+            None,
+            arrivals,
+        )?;
+        // Several publications may share inside ports that are not symmetric;
+        // the classification is their union, as disjoint intervals.
+        let mut endpoints = Vec::new();
+        for publication in &hop.publications {
+            let (inside, first, last) = publication.inside;
+            endpoints.push(
+                Key::default()
+                    .link(publication.link)
+                    .protocol(publication.protocol)
+                    .address(inside)?
+                    .span(first, last)
+                    .element(None),
+            );
+        }
+        let mut fields = LINK.to_vec();
+        fields.extend([PROTOCOL, ADDRESS, PORT]);
+        declare(program, ENDPOINT, 17, &fields, None, endpoints)?;
+    }
+    let (mut ports, mut addresses) = (Vec::new(), Vec::new());
+    for publication in &hop.publications {
+        let (outside, first, last) = publication.outside;
+        let (inside, inside_first, _) = publication.inside;
+        let key = Key::default()
+            .protocols(publication.protocol)
+            .address(outside)?
+            .span(first, last);
+        let mut data = super::super::address(inside)?.to_be_bytes().to_vec();
+        if ranged(publication) {
+            addresses.push(key.element(Some(data)));
+        } else {
+            data.extend(word(&inside_first.to_be_bytes()));
+            ports.push(key.element(Some(data)));
+        }
+    }
+    declare(program, PORT_MAP, 18, &translation_fields(), Some(8), ports)?;
+    declare(
+        program,
+        ADDRESS_MAP,
+        19,
+        &translation_fields(),
+        Some(4),
+        addresses,
+    )?;
+    let inbound = hop
+        .publications
+        .iter()
+        .map(inbound_key)
+        .collect::<Result<Vec<_>>>()?;
+    declare(program, FORWARD, 20, &flow_fields(), None, inbound)?;
+    let symmetric = hop
+        .publications
+        .iter()
+        .filter(|publication| publication.symmetric)
+        .map(symmetric_key)
+        .collect::<Result<Vec<_>>>()?;
+    declare(program, SYMMETRIC, 21, &flow_fields(), Some(12), symmetric)
+}
+fn declare(
+    program: &mut Program<'_>,
+    name: &str,
+    id: u32,
+    fields: &[u32],
+    data: Option<u32>,
+    elements: Vec<IntervalElement>,
+) -> Result<()> {
+    keys::interval(program, name, id, fields, data, elements).map(|_| ())
+}
+
+/// The admissions of one set whatever its number of elements: the ESTABLISHED
+/// original direction, a NEW opening per protocol (TCP only with SYN and
+/// FIN/RST/ACK clear), and the ESTABLISHED reply. Each checks the fixed
+/// interface, the default conntrack zone and the direction before the lookup.
+fn admissions(
+    program: &mut Program<'_>,
+    hop: &Hop<'_>,
+    set: &str,
+    protocols: &BTreeSet<&str>,
+    fixed_incoming: bool,
+    loads: fn(bool) -> Loads,
+) -> Result<()> {
+    if protocols.is_empty() {
+        return Ok(());
+    }
+    let envelope = |reply: bool, connection_state: u32| {
+        let mut result = ipv4();
+        result.extend(link(hop.fixed, fixed_incoming != reply));
+        result.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+        result.extend(ct(1, None, vec![u8::from(reply)]));
+        result.extend(state(connection_state));
+        result
+    };
+    let mut established = envelope(false, 2);
+    established.extend(loads(false).lookup(set));
+    program.end("forward", established, 1)?;
+    for transport in protocols {
+        let mut opening = envelope(false, 8);
+        opening.extend(meta(16, vec![protocol(transport)]));
+        if *transport == "tcp" {
+            opening.extend(opening_tcp());
+        }
+        opening.extend(loads(false).lookup(set));
+        program.end("forward", opening, 1)?;
+    }
+    let mut reply = envelope(true, 2);
+    reply.extend(loads(true).lookup(set));
+    program.end("forward", reply, 1)
+}
+fn protocols<'a>(hop: &Hop<'a>, symmetric: bool) -> BTreeSet<&'a str> {
+    hop.publications
+        .iter()
+        .filter(|publication| publication.symmetric || !symmetric)
+        .map(|publication| publication.protocol)
+        .collect()
+}
+/// Inbound admissions from the fixed interface to the inside link. They precede
+/// the capture barrier, which denies the protected published address.
+pub(super) fn inbound(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
+    admissions(
+        program,
+        hop,
+        FORWARD,
+        &protocols(hop, false),
+        true,
+        inbound_loads,
+    )
+}
+/// Symmetric admissions from the inside link to the fixed interface. They follow
+/// the capture barrier, so every protected current or original destination stays
+/// denied.
+pub(super) fn symmetric(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
+    admissions(
+        program,
+        hop,
+        SYMMETRIC,
+        &protocols(hop, true),
+        false,
+        symmetric_loads,
+    )
+}
+/// NAT expressions reading the map data the lookup stored: the address from the
+/// first register, and the port bounds from the next when `ports` is 1 or 2.
+pub(super) fn nat(kind: u32, ports: u32) -> Attr {
+    let address = register(4);
+    let mut data = vec![
+        Attr::u32(1, kind),
+        Attr::u32(2, 2),
+        Attr::u32(3, address),
+        Attr::u32(4, address),
+    ];
+    if ports > 0 {
+        data.extend([Attr::u32(5, register(5)), Attr::u32(6, register(4 + ports))]);
+    }
+    data.push(Attr::u32(7, if ports > 0 { 3 } else { 1 }));
+    expr("nat", data)
+}
+fn tracked(fixed: &LocalLink, incoming: bool) -> Vec<Attr> {
+    let mut result = ipv4();
+    result.extend(link(fixed, incoming));
+    result.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
+    result.extend(ct(1, None, vec![0]));
+    result
+}
+/// Destination NAT from the fixed interface: one-port publications to their
+/// inside address and port, ranges to their inside address alone, which never
+/// changes a port.
+pub(super) fn translations(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
+    for (set, ports, present) in [
+        (
+            PORT_MAP,
+            1,
+            hop.publications.iter().any(|item| !ranged(item)),
+        ),
+        (ADDRESS_MAP, 0, hop.publications.iter().any(ranged)),
+    ] {
+        if present {
+            let mut expressions = tracked(hop.fixed, true);
+            expressions.extend(translation_loads().map(set));
+            expressions.push(nat(1, ports));
+            program.rule("pre", expressions)?;
+        }
+    }
+    Ok(())
+}
+/// Source NAT of symmetric flows leaving through the fixed interface, to the
+/// outside address and port span of their publication.
+pub(super) fn symmetric_translation(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
+    if hop.publications.iter().any(|item| item.symmetric) {
+        let mut expressions = tracked(hop.fixed, false);
+        expressions.extend(symmetric_loads(false).map(SYMMETRIC));
+        expressions.push(nat(0, 2));
+        program.rule("post", expressions)?;
+    }
+    Ok(())
+}
+/// Router handoff ingress classification of every publication's arrivals. Raw
+/// runs before conntrack, so it matches the arriving tuple only and never sets a
+/// generation zone.
+pub(super) fn arrival(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
+    if !hop.publications.is_empty() {
+        let mut expressions = ipv4();
+        expressions.extend(link(hop.fixed, true));
+        let mut loads = Loads::new();
+        loads
+            .push(|index| meta_to(16, index), PROTOCOL)
+            .address(false)
+            .port(false);
+        expressions.extend(loads.lookup(ARRIVAL));
+        program.end("raw_return", expressions, 1)?;
+    }
+    Ok(())
+}
+/// Router workload ingress classification of packets from a published port on
+/// its exact link and address, ahead of every leased classifier.
+pub(super) fn endpoint(program: &mut Program<'_>, hop: &Hop<'_>) -> Result<()> {
+    if !hop.publications.is_empty() {
+        let mut expressions = ipv4();
+        let mut loads = Loads::new();
+        loads
+            .link(true)
+            .push(|index| meta_to(16, index), PROTOCOL)
+            .address(true)
+            .port(true);
+        expressions.extend(loads.lookup(ENDPOINT));
+        program.end("raw_in", expressions, 1)?;
+    }
+    Ok(())
+}