@push.rocks/smartnftables 2.6.0 → 3.0.0

package/rust/src/egress_hostgrant_tests.rs

@@ -55,6 +55,8 @@ pub(super) struct Flow {
     /// The file system uid of the packet's user socket; None without one, when
     /// `meta skuid` breaks the rule like the kernel.
     pub(super) uid: Option<u32>,
+    /// The conntrack label of the flow's entry.
+    pub(super) label: [u8; 16],
 }
 const HOST: [u8; 4] = [10, 240, 0, 1];
 const WORK: [u8; 4] = [10, 241, 0, 2];
@@ -82,6 +84,7 @@ pub(super) fn opening(
         zone: 0,
         original: (HOST, WORK, 443, 8080),
         uid: None,
+        label: [0; 16],
     }
 }
 /// The workload's answer to `flow`, arriving on the reverse links.
@@ -194,11 +197,47 @@ pub(super) struct Decision {
     pub(super) verdict: i32,
     pub(super) chain: String,
     pub(super) zone: u16,
+    /// The NAT a nat-chain rule performed, which also ends that rule with an
+    /// accept exactly as the kernel's nat expression does.
+    pub(super) translation: Option<Translation>,
 }
-/// The compiled table: rules per chain and element keys per set.
+/// Source (0) or destination (1) NAT to an address and, when the rule names
+/// them, an inclusive port range.
+#[derive(Debug, PartialEq, Eq)]
+pub(super) struct Translation {
+    pub(super) kind: u32,
+    pub(super) address: [u8; 4],
+    pub(super) ports: Option<(u16, u16)>,
+}
+/// The compiled table: rules per chain, element keys per exact set, and the
+/// fields and elements of every interval set or map.
 struct Table {
     chains: BTreeMap<String, Vec<Vec<Attr>>>,
     sets: BTreeMap<String, Vec<Vec<u8>>>,
+    intervals: BTreeMap<String, Interval>,
+}
+/// Field byte lengths, then `(first, last, data)` per element.
+#[derive(Default)]
+struct Interval {
+    fields: Vec<usize>,
+    elements: Vec<(Vec<u8>, Vec<u8>, Option<Vec<u8>>)>,
+}
+impl Interval {
+    /// Every field of the key within its bounds, compared as the kernel's
+    /// pipapo backend does: byte strings of the field's own length.
+    fn find(&self, key: &[u8]) -> Option<&(Vec<u8>, Vec<u8>, Option<Vec<u8>>)> {
+        self.elements.iter().find(|(first, last, _)| {
+            let mut at = 0;
+            self.fields.iter().all(|length| {
+                let range = at..at + length;
+                at += length.div_ceil(4) * 4;
+                first[range.clone()] <= key[range.clone()] && key[range.clone()] <= last[range]
+            })
+        })
+    }
+    fn width(&self) -> usize {
+        self.fields.iter().map(|length| length.div_ceil(4) * 4).sum()
+    }
 }
 pub(super) fn chains(prepared: &Prepared) -> BTreeMap<String, Vec<Vec<Attr>>> {
     table(prepared).chains
@@ -206,6 +245,7 @@ pub(super) fn chains(prepared: &Prepared) -> BTreeMap<String, Vec<Vec<Attr>>> {
 fn table(prepared: &Prepared) -> Table {
     let mut chains: BTreeMap<String, Vec<Vec<Attr>>> = BTreeMap::new();
     let mut sets: BTreeMap<String, Vec<Vec<u8>>> = BTreeMap::new();
+    let mut intervals: BTreeMap<String, Interval> = BTreeMap::new();
     for (kind, attributes) in prepared.program("snft_host_grant").unwrap() {
         match kind {
             3 => {
@@ -218,21 +258,59 @@ fn table(prepared: &Prepared) -> Table {
                 .or_default()
                 .push(wire::attrs(&wire::one(&attributes, 4).unwrap().value).unwrap()),
             9 => {
-                assert!(sets
-                    .insert(wire::text(&attributes, 2).unwrap(), Vec::new())
-                    .is_none());
+                let name = wire::text(&attributes, 2).unwrap();
+                if let Ok(description) = wire::one(&attributes, 9) {
+                    let concatenation = wire::attrs(&description.value).unwrap();
+                    let fields = wire::attrs(&wire::one(&concatenation, 2).unwrap().value)
+                        .unwrap()
+                        .iter()
+                        .map(|field| {
+                            wire::number(&wire::attrs(&field.value).unwrap(), 1).unwrap() as usize
+                        })
+                        .collect();
+                    assert!(intervals
+                        .insert(name, Interval { fields, elements: Vec::new() })
+                        .is_none());
+                } else if wire::number(&attributes, 3).unwrap() & 8 != 0 {
+                    // An exact map is one field of the whole key.
+                    let fields = vec![wire::number(&attributes, 5).unwrap() as usize];
+                    assert!(intervals
+                        .insert(name, Interval { fields, elements: Vec::new() })
+                        .is_none());
+                } else {
+                    assert!(sets.insert(name, Vec::new()).is_none());
+                }
             }
             12 => {
-                let keys = sets.get_mut(&wire::text(&attributes, 2).unwrap()).unwrap();
+                let name = wire::text(&attributes, 2).unwrap();
                 for element in wire::attrs(&wire::one(&attributes, 3).unwrap().value).unwrap() {
                     let key = wire::attrs(&element.value).unwrap();
-                    keys.push(data(&key, 1));
+                    if let Some(interval) = intervals.get_mut(&name) {
+                        // An element without a last key is one exact key.
+                        let first = data(&key, 1);
+                        let last = if wire::one(&key, 10).is_ok() {
+                            data(&key, 10)
+                        } else {
+                            first.clone()
+                        };
+                        interval.elements.push((
+                            first,
+                            last,
+                            wire::one(&key, 2).ok().map(|_| data(&key, 2)),
+                        ));
+                    } else {
+                        sets.get_mut(&name).unwrap().push(data(&key, 1));
+                    }
                 }
             }
             other => panic!("operation {other}"),
         }
     }
-    Table { chains, sets }
+    Table {
+        chains,
+        sets,
+        intervals,
+    }
 }
 fn data(attributes: &[Attr], id: u16) -> Vec<u8> {
     wire::attrs(&wire::one(attributes, id).unwrap().value).unwrap()[0]
@@ -290,7 +368,7 @@ fn load(flow: &Flow, name: &str, fields: &[Attr]) -> Option<Vec<u8>> {
                 10 => vec![flow.protocol],
                 11 => source_port.to_be_bytes().to_vec(),
                 12 => destination_port.to_be_bytes().to_vec(),
-                13 => vec![0; 16],
+                13 => flow.label.to_vec(),
                 17 => flow.zone.to_ne_bytes().to_vec(),
                 19 => source.to_vec(),
                 20 => destination.to_vec(),
@@ -321,6 +399,7 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
         let mut registers = [0_u8; 80];
         let mut matched = true;
         let mut verdict: Option<(i32, Option<String>)> = None;
+        let mut translation = None;
         for expression in expressions {
             let parts = wire::attrs(&expression.value).unwrap();
             let name = wire::text(&parts, 1).unwrap();
@@ -367,12 +446,29 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
                     matched = loaded >= &first[..] && loaded <= &last[..];
                 }
                 "lookup" => {
-                    assert_eq!(wire::number(&fields, 5).unwrap(), 0);
-                    let keys = &table.sets[&wire::text(&fields, 1).unwrap()];
+                    let inverted = wire::number(&fields, 5).unwrap() == 1;
+                    let name = wire::text(&fields, 1).unwrap();
                     let at = offset(&fields, 2);
-                    matched = keys
-                        .iter()
-                        .any(|key| registers[at..at + key.len()] == key[..]);
+                    if let Some(interval) = table.intervals.get(&name) {
+                        let key = registers[at..at + interval.width()].to_vec();
+                        let found = interval.find(&key);
+                        matched = found.is_some();
+                        if let (Some((_, _, data)), Ok(_)) = (found, wire::one(&fields, 3)) {
+                            // A map lookup stores the element's data.
+                            let data = data.as_ref().unwrap();
+                            let to = offset(&fields, 3);
+                            registers[to..to + data.len()].copy_from_slice(data);
+                        }
+                    } else {
+                        let keys = &table.sets[&name];
+                        matched = keys
+                            .iter()
+                            .any(|key| registers[at..at + key.len()] == key[..]);
+                    }
+                    if inverted {
+                        assert!(wire::one(&fields, 3).is_err());
+                        matched = !matched;
+                    }
                 }
                 "immediate" if wire::number(&fields, 1).unwrap() == 0 => {
                     let code = wire::attrs(
@@ -394,7 +490,19 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
                     let at = offset(&fields, 1);
                     registers[at..at + value.len()].copy_from_slice(&value);
                 }
-                "nat" => {}
+                "nat" => {
+                    let at = offset(&fields, 3);
+                    let port = |id: u16| {
+                        let at = offset(&fields, id);
+                        u16::from_be_bytes(registers[at..at + 2].try_into().unwrap())
+                    };
+                    translation = Some(Translation {
+                        kind: wire::number(&fields, 1).unwrap(),
+                        address: registers[at..at + 4].try_into().unwrap(),
+                        ports: wire::one(&fields, 5).ok().map(|_| (port(5), port(6))),
+                    });
+                    verdict = Some((1, None));
+                }
                 "reject" => {
                     assert_eq!(fields, vec![Attr::u32(1, 1)]);
                     verdict = Some((REJECT, None));
@@ -414,6 +522,7 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
                     verdict: code,
                     chain: chain.into(),
                     zone: *zone,
+                    translation,
                 })
             }
             Some((-5, _)) => return Step::Next,
@@ -431,13 +540,34 @@ fn run(table: &Table, chain: &str, flow: &Flow, zone: &mut u16) -> Step {
 }
 /// A base chain that ends without a terminal verdict accepts by policy.
 pub(super) fn decide(prepared: &Prepared, chain: &str, flow: &Flow) -> Decision {
+    Simulator::new(prepared).decide(chain, flow)
+}
+/// One compiled table, parsed once for many decisions.
+pub(super) struct Simulator {
+    table: Table,
+}
+impl Simulator {
+    pub(super) fn new(prepared: &Prepared) -> Self {
+        Self {
+            table: table(prepared),
+        }
+    }
+    pub(super) fn has(&self, chain: &str) -> bool {
+        self.table.chains.contains_key(chain)
+    }
+    pub(super) fn decide(&self, chain: &str, flow: &Flow) -> Decision {
+        decide_in(&self.table, chain, flow)
+    }
+}
+fn decide_in(table: &Table, chain: &str, flow: &Flow) -> Decision {
     let mut zone = 0;
-    match run(&table(prepared), chain, flow, &mut zone) {
+    match run(table, chain, flow, &mut zone) {
         Step::Final(decision) => decision,
         Step::Next => Decision {
             verdict: 1,
             chain: "policy".into(),
             zone,
+            translation: None,
         },
     }
 }
@@ -835,7 +965,8 @@ fn host_grants_compile_a_constant_rule_graph_and_one_element_per_grant() {
         if let Some(arrival) = all.sets.get("host_grant_arrival") {
             assert_eq!(arrival.len(), 1024);
         }
-        assert!(table(&prepared(fixture)).sets.is_empty());
+        let without = table(&prepared(fixture));
+        assert!(without.sets.keys().all(|name| !name.starts_with("host_grant")));
     }
 }
 
@@ -917,7 +1048,7 @@ fn host_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
         };
         let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
         assert!(
-            program.len() < 768 && graph <= 100_000 && elements <= super::compile::ELEMENT_BYTES
+            program.len() < 768 && graph <= super::compile::RULE_BYTES && graph + elements <= super::compile::TARGET_BYTES
         );
         assert!(deletion + graph + elements + 64 <= crate::wire::BATCH_BYTES);
         // The contract maximum is the validation bound.
@@ -929,7 +1060,7 @@ fn host_grants_meet_the_atomic_reserve_at_the_contract_maximum() {
         );
     }
     // The reserve itself: a maximum previous graph beside a maximum target.
-    assert!(deletion + 100_000 + super::compile::ELEMENT_BYTES + 64 <= crate::wire::BATCH_BYTES);
+    assert!(deletion + super::compile::TARGET_BYTES + 64 <= crate::wire::BATCH_BYTES);
 }
 
 /// A status carries up to three complete policies: the applied one and the

package/rust/src/egress_localport_tests.rs

@@ -118,6 +118,7 @@ fn local_tcp_port_owner_rejects_every_other_uid_at_its_exact_loopback_destinatio
         input,
         output: None,
         uid: None,
+        label: [0; 16],
         ..dial(10010, None)
     };
     assert_eq!(decide(&with, "input", &arriving(LO)).verdict, 1);
@@ -132,6 +133,7 @@ fn local_tcp_port_owner_rejects_every_other_uid_at_its_exact_loopback_destinatio
     // Guarded pool traffic from any user keeps the guard's decision.
     let pool = Flow {
         uid: Some(1000),
+        label: [0; 16],
         ..opening(None, Some((4, "handoff")))
     };
     assert_eq!(
@@ -250,7 +252,7 @@ fn local_tcp_port_owners_meet_the_atomic_reserve_at_the_contract_maximum() {
             .sum()
     };
     let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
-    assert!(program.len() < 768 && graph <= 100_000 && elements <= super::compile::ELEMENT_BYTES);
+    assert!(program.len() < 768 && graph <= super::compile::RULE_BYTES && graph + elements <= super::compile::TARGET_BYTES);
     assert!(deletion + graph + elements + 64 <= wire::BATCH_BYTES);
     println!(
         "LOCAL_TCP_PORT_OWNER_MAX owners=8 prefixes=64 grants=1024 operations={} rule_bytes={graph}",