@push.rocks/smartnftables 2.6.0 → 4.0.0

package/rust/src/owner_publishedrange_traffic_tests.rs

@@ -0,0 +1,306 @@
+//! Published port ranges and symmetric publications across both hops, in the
+//! four-namespace topology of the router publication qualification.
+use super::egress_traffic_tests::{allocation, binding, connect, denied, host_policy, ns_ip};
+use super::egress_traffic_tests::{protection, roundtrip, socket};
+use super::host_traffic_tests::{control, dark_udp, published_udp};
+use super::router_traffic_tests::connect_from;
+use super::*;
+use crate::egress;
+use serde_json::json;
+use std::io::{Read, Write};
+use std::net::TcpListener;
+use std::time::Duration;
+
+const WORK: &str = "pr_work";
+const ROUTER: &str = "pr_router";
+const HOST: &str = "pr_host";
+const PEER: &str = "pr_peer";
+
+/// The SIP/RTP shape on both hops: UDP and TCP signalling on one port and one UDP
+/// RTP range, all symmetric, beside a plain publication and leased egress.
+fn host_ranges() -> egress::Policy {
+    let mut policy = host_policy();
+    let egress::Scope::HostTransit(scope) = &mut policy.scope else {
+        panic!()
+    };
+    scope.published_ports = [
+        ("udp", 20000, Some(20200), 20000, true),
+        ("udp", 5070, None, 5070, true),
+        ("tcp", 5070, None, 5070, true),
+        ("udp", 8125, None, 8125, false),
+    ]
+    .into_iter()
+    .map(
+        |(protocol, host_port, host_port_end, target_port, symmetric)| egress::PublishedPort {
+            protocol: protocol.into(),
+            host_port,
+            host_port_end,
+            target_port,
+            target_address: "10.240.0.2".into(),
+            host_ip: "192.0.2.2".into(),
+            symmetric,
+        },
+    )
+    .collect();
+    policy
+}
+fn router_ranges() -> egress::Policy {
+    let link = binding("work", "10.241.0.1", "veth");
+    let mut generation = allocation();
+    generation["conntrackZone"] = json!(17);
+    generation["conntrackLabel"] = json!("a".repeat(32));
+    generation["grants"] = json!([
+        {"sourceEndpoint":"work","sourcePrefix":"10.241.0.2/32","destination":{"kind":"public","prefix":"203.0.113.2/32"},
+            "protocol":"udp","sourcePort":null,"destinationPort":42000,"sourcePortRange":{"first":10000,"last":10015}}
+    ]);
+    let publication = |protocol: &str,
+                       port: u16,
+                       end: Option<u16>,
+                       endpoint: u16,
+                       symmetric: bool| {
+        let mut value = json!({"protocol":protocol,"transitPort":port,"endpointPort":endpoint,
+            "endpointAddress":"10.241.0.2","transitSourceAddress":"10.240.0.2","symmetric":symmetric});
+        if let Some(end) = end {
+            value["transitPortEnd"] = json!(end);
+        }
+        value
+    };
+    serde_json::from_value(
+        json!({"schemaVersion":2,"revision":1,"scope":{"kind":"routerEgress",
+        "endpoints":[{"id":"work","interfaceIndex":link["interfaceIndex"],"interfaceName":"work",
+            "interfaceKind":"veth","sourcePrefixes":["10.241.0.2/32"]}],
+        "rules":[],"links":[link],"handoff":binding("handoff","10.240.0.2","veth"),
+        "protection":protection(),"generations":[generation],"publishedPorts":[
+            publication("udp", 20000, Some(20200), 20000, true),
+            publication("udp", 5070, None, 5070, true),
+            publication("tcp", 5070, None, 5070, true),
+            publication("udp", 8125, None, 9125, false)
+        ]}}),
+    )
+    .unwrap()
+}
+/// Binds and applies a policy inside its namespace, where its links exist, and
+/// returns the owned sets with their element counts as the kernel dumps them.
+/// Enforcement means the dump, every interval element and map datum included,
+/// matched the compiled graph.
+fn apply(
+    namespace: &str,
+    name: &'static str,
+    policy: fn() -> egress::Policy,
+) -> (Owner, Applied, Vec<(String, usize)>) {
+    in_namespace(namespace, move || {
+        let mut owner = Owner::new(options(name)).unwrap();
+        let target: Prepared = policy().prepare().unwrap().into();
+        target
+            .validate_interfaces()
+            .expect("published range fixture binding");
+        let applied = owner
+            .reconcile(Transition {
+                previous: None,
+                target,
+            })
+            .unwrap();
+        assert!(owner.inspect().enforced);
+        let sets = owner
+            .graph()
+            .unwrap()
+            .expect("owned table present")
+            .sets
+            .iter()
+            .map(|(attributes, elements)| (wire::text(attributes, 2).unwrap(), elements.len()))
+            .collect();
+        (owner, applied, sets)
+    })
+}
+
+#[test]
+#[ignore = "requires disposable isolated native qualification guest"]
+fn v2_published_ranges_and_symmetric_publications_cross_both_hops() {
+    isolated();
+    for name in [WORK, ROUTER, HOST, PEER] {
+        ip(&["netns", "add", name]);
+        ns_ip(name, &["link", "set", "lo", "up"]);
+        in_namespace(name, || {
+            std::fs::write("/proc/sys/net/ipv4/ip_forward", "1").unwrap()
+        });
+    }
+    connect(
+        WORK,
+        "client",
+        "10.241.0.2/24",
+        ROUTER,
+        "work",
+        "10.241.0.1/24",
+    );
+    connect(
+        ROUTER,
+        "handoff",
+        "10.240.0.2/30",
+        HOST,
+        "router",
+        "10.240.0.1/30",
+    );
+    connect(
+        HOST,
+        "uplink",
+        "192.0.2.2/24",
+        PEER,
+        "underlay",
+        "192.0.2.3/24",
+    );
+    ns_ip(WORK, &["route", "add", "default", "via", "10.241.0.1"]);
+    ns_ip(ROUTER, &["route", "add", "default", "via", "10.240.0.1"]);
+    // The workload route exists throughout, so every later denial is caused by
+    // policy and not by a missing route.
+    ns_ip(
+        HOST,
+        &["route", "add", "10.241.0.0/24", "via", "10.240.0.2"],
+    );
+    ns_ip(
+        HOST,
+        &["route", "add", "203.0.113.2/32", "via", "192.0.2.3"],
+    );
+    ns_ip(PEER, &["address", "add", "203.0.113.2/32", "dev", "lo"]);
+    ns_ip(PEER, &["route", "add", "default", "via", "192.0.2.2"]);
+    let first = socket(WORK, "10.241.0.2:20000");
+    let middle = socket(WORK, "10.241.0.2:20100");
+    let last = socket(WORK, "10.241.0.2:20200");
+    let above = socket(WORK, "10.241.0.2:20201");
+    let below = socket(WORK, "10.241.0.2:19999");
+    let rtp = socket(WORK, "10.241.0.2:20150");
+    let sip = socket(WORK, "10.241.0.2:5070");
+    let plain = socket(WORK, "10.241.0.2:9125");
+    let work_egress = socket(WORK, "10.241.0.2:40001");
+    let public = socket(PEER, "203.0.113.2:42000");
+    let rtp_peer = socket(PEER, "203.0.113.2:42001");
+    let sip_peer = socket(PEER, "203.0.113.2:42002");
+    let plain_peer = socket(PEER, "203.0.113.2:42003");
+    let protected_peer = socket(PEER, "192.0.2.3:40300");
+    // Positive controls: without policy the workload is routed directly and its
+    // packets reach the protected peer address, so every later result is caused
+    // by policy. Each probe uses its own tuple, so no unreplied conntrack entry
+    // carries a null translation across the policy change.
+    control(
+        &socket(PEER, "192.0.2.3:40010"),
+        "10.241.0.2:20201",
+        &above,
+        true,
+    );
+    control(
+        &socket(PEER, "192.0.2.3:40011"),
+        "10.241.0.2:19999",
+        &below,
+        true,
+    );
+    control(
+        &socket(WORK, "10.241.0.2:5071"),
+        "192.0.2.3:40300",
+        &protected_peer,
+        true,
+    );
+    dark_udp(&socket(PEER, "192.0.2.3:40012"), &middle, "192.0.2.2:20100");
+    let (host_owner, host_applied, host_sets) = apply(HOST, "published_range_host", host_ranges);
+    let (router_owner, router_applied, router_sets) =
+        apply(ROUTER, "published_range", router_ranges);
+    // Publications are set elements: one-port translations, range translations,
+    // the inbound admissions and the symmetric map on both hops, and the two raw
+    // classifications in the router.
+    let named = |sets: &[(String, usize)], name: &str| {
+        sets.iter()
+            .find(|(set, _)| set == name)
+            .map(|(_, count)| *count)
+    };
+    for (name, host, router) in [
+        ("published_port", Some(3), Some(3)),
+        ("published_address", Some(1), Some(1)),
+        ("published_forward", Some(4), Some(4)),
+        ("published_symmetric", Some(3), Some(3)),
+        ("published_arrival", None, Some(4)),
+        // 9125 and the 5070 ports of both protocols and the 20000 range.
+        ("published_endpoint", None, Some(4)),
+    ] {
+        assert_eq!(named(&host_sets, name), host, "host {name}");
+        assert_eq!(named(&router_sets, name), router, "router {name}");
+    }
+    // First, middle and last port of the range reach the listener behind both
+    // hops with the client address preserved, and the reply comes back from the
+    // published address and port.
+    for (port, client_port, workload) in [
+        (20000, 40100, &first),
+        (20100, 40101, &middle),
+        (20200, 40102, &last),
+    ] {
+        let client = in_namespace(PEER, move || {
+            std::net::UdpSocket::bind(format!("192.0.2.3:{client_port}")).unwrap()
+        });
+        client
+            .set_read_timeout(Some(Duration::from_millis(250)))
+            .unwrap();
+        published_udp(
+            &client,
+            workload,
+            &format!("192.0.2.2:{port}"),
+            &format!("192.0.2.3:{client_port}"),
+        );
+    }
+    // The ports just outside the range stay dark.
+    dark_udp(&socket(PEER, "192.0.2.3:40103"), &above, "192.0.2.2:20201");
+    dark_udp(&socket(PEER, "192.0.2.3:40104"), &below, "192.0.2.2:19999");
+    // Symmetric outbound flows reach the uplink with their own port, from a range
+    // port and from the single signalling port, and their replies return.
+    let observed = roundtrip(&rtp, &rtp_peer);
+    assert_eq!(observed.to_string(), "192.0.2.2:20150");
+    let observed = roundtrip(&sip, &sip_peer);
+    assert_eq!(observed.to_string(), "192.0.2.2:5070");
+    // A later request from the same peer tuple toward the published port is the
+    // flow's own reply direction and reaches the workload from that peer.
+    assert_eq!(sip_peer.send_to(b"invite", "192.0.2.2:5070").unwrap(), 6);
+    let mut bytes = [0; 64];
+    let (size, from) = sip
+        .recv_from(&mut bytes)
+        .expect("request on the symmetric flow");
+    assert_eq!(
+        (&bytes[..size], from.to_string().as_str()),
+        (&b"invite"[..], "203.0.113.2:42002")
+    );
+    // An unrelated client still reaches the publication inbound.
+    let unrelated = socket(PEER, "192.0.2.3:40105");
+    published_udp(&unrelated, &sip, "192.0.2.2:5070", "192.0.2.3:40105");
+    let listener = in_namespace(PEER, || TcpListener::bind("203.0.113.2:5060").unwrap());
+    let mut outbound = in_namespace(WORK, || connect_from("10.241.0.2:5070", "203.0.113.2:5060"))
+        .expect("symmetric tcp opening");
+    let (mut served, peer) = listener.accept().unwrap();
+    assert_eq!(peer.to_string(), "192.0.2.2:5070");
+    for stream in [&outbound, &served] {
+        stream
+            .set_read_timeout(Some(Duration::from_secs(1)))
+            .unwrap();
+    }
+    outbound.write_all(b"ping").unwrap();
+    served.read_exact(&mut [0; 4]).unwrap();
+    served.write_all(b"pong").unwrap();
+    outbound.read_exact(&mut [0; 4]).unwrap();
+    drop(outbound);
+    drop(served);
+    // Negative controls: a plain publication's workload port opens nothing, and a
+    // symmetric flow into the protected union stays denied from either port kind.
+    denied(&plain, &plain_peer, false);
+    denied(&sip, &protected_peer, false);
+    denied(&rtp, &protected_peer, false);
+    // Leased egress keeps its own leased source range.
+    let outer = roundtrip(&work_egress, &public);
+    assert_eq!(outer.ip().to_string(), "192.0.2.2");
+    assert!((10000..=10015).contains(&outer.port()));
+    in_namespace(ROUTER, move || {
+        let mut owner = router_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(router_applied).unwrap();
+    });
+    in_namespace(HOST, move || {
+        let mut owner = host_owner;
+        assert!(owner.inspect().enforced);
+        owner.release(host_applied).unwrap();
+    });
+    dark_udp(&socket(PEER, "192.0.2.3:40106"), &middle, "192.0.2.2:20100");
+    println!("V2_PUBLISHED_RANGE_PROOF set_backed_graph_verified=true range_first_delivered=true range_middle_delivered=true range_last_delivered=true client_address_preserved=true range_outside_dark=true symmetric_range_source_port_kept=true symmetric_udp_source_port_kept=true symmetric_tcp_source_port_kept=true peer_request_on_symmetric_flow=true inbound_beside_symmetric=true plain_publication_outbound_denied=true symmetric_protected_denied=true leased_egress_unaffected=true protected_positive_control=true released_range_dark=true");
+}

package/rust/src/owner_router_traffic_tests.rs

@@ -135,6 +135,8 @@ fn published_host_policy() -> egress::Policy {
             target_port,
             target_address: "10.240.0.2".into(),
             host_ip: "192.0.2.2".into(),
+            host_port_end: None,
+            symmetric: false,
         })
         .collect();
     policy