@push.rocks/smartnftables 2.6.0 → 4.0.0

package/rust/src/egress.compile.rs

@@ -6,17 +6,46 @@ use crate::wire::{self, Attr};
 mod host;
 #[path = "egress.hostgrant.rs"]
 mod hostgrant;
+#[path = "egress.keys.rs"]
+mod keys;
+#[path = "egress.leased.rs"]
+mod leased;
 #[path = "egress.poolguard.rs"]
 mod poolguard;
+#[path = "egress.private.rs"]
+mod private;
+#[path = "egress.published.rs"]
+mod published;
 #[path = "egress.router.rs"]
 mod router;
 #[path = "egress.workloadgrant.rs"]
 mod workloadgrant;
 
-/// Set elements of one target. Together with the 100,000-byte rule graph and the
-/// handle-only deletion of a previous maximum graph this bounds one replacement
-/// batch below `wire::BATCH_BYTES`.
-pub(super) const ELEMENT_BYTES: usize = 100_000;
+/// The atomic replacement budget. One replacement is one nfnetlink batch in one
+/// `sendmsg`, and Linux refuses a netlink message above the socket send buffer:
+/// `SO_SNDBUF` clamped to `net.core.wmem_max` and doubled, 425,984 bytes with the
+/// default `wmem_max` of 212,992. That is the hard ceiling; `wire::BATCH_BYTES`
+/// (320,000) is this package's choice, which fits every `wmem_max` from 160,016
+/// up. A batch carries its begin and end messages (at most 64 bytes), the
+/// handle-only deletion of the previous graph — fewer than `OPERATIONS` rules,
+/// chains and sets, each message at most 140 bytes (the longest table name, a
+/// chain name of up to 32 bytes and a handle), 107,520 bytes — and the complete
+/// target: its rules, chains and sets within `RULE_BYTES`, and together with its
+/// set elements within `TARGET_BYTES`. 64 + 107,520 + 212,000 = 319,584 bytes.
+/// The elements take whatever the rules leave: a set replaces a rule per entry,
+/// so the element share grows exactly where the rule share shrinks.
+pub(super) const OPERATIONS: usize = 768;
+pub(super) const RULE_BYTES: usize = 100_000;
+pub(super) const TARGET_BYTES: usize = 212_000;
+
+/// One element of an interval set: the first and last key, each field of the
+/// last at or above the same field of the first, and the data of a map.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub(super) struct IntervalElement {
+    pub(super) first: Vec<u8>,
+    pub(super) last: Vec<u8>,
+    pub(super) data: Option<Vec<u8>>,
+}
 
 pub(super) struct Program<'a> {
     table: &'a str,
@@ -32,10 +61,67 @@ impl<'a> Program<'a> {
         // Same atomic replacement reserve as v1: a previous bounded graph must
         // fit its handle-only deletions beside the complete target, and the
         // target's set elements, in one `wire::BATCH_BYTES` batch.
-        require(self.bytes <= 100_000 && self.operations.len() < 768)?;
+        crate::capacity("ruleBytes", RULE_BYTES, self.bytes)?;
+        self.admit(operation, attributes)
+    }
+    /// Admits one message within the target and operation budgets.
+    fn admit(&mut self, operation: u16, attributes: Vec<Attr>) -> Result<()> {
+        crate::capacity("targetBytes", TARGET_BYTES, self.bytes + self.element_bytes)?;
+        crate::capacity("operations", OPERATIONS, self.operations.len() + 1)?;
         self.operations.push((operation, attributes));
         Ok(())
     }
+    /// Element messages count against the target, beside the rules.
+    fn push_elements(&mut self, attributes: Vec<Attr>) -> Result<()> {
+        self.element_bytes += wire::encode_attrs(&attributes).len() + 20;
+        self.admit(12, attributes)
+    }
+    /// One named exact-key hash set, or a map to `data_length` bytes. CONSTANT
+    /// like every set here.
+    fn exact_set(
+        &mut self,
+        name: &str,
+        id: u32,
+        key_length: u32,
+        data_length: Option<u32>,
+    ) -> Result<()> {
+        let mut attributes = vec![
+            Attr::string(1, self.table),
+            Attr::string(2, name),
+            Attr::u32(3, 2 | if data_length.is_some() { 8 } else { 0 }),
+            Attr::u32(4, 0),
+            Attr::u32(5, key_length),
+        ];
+        if let Some(length) = data_length {
+            attributes.extend([Attr::u32(6, 0), Attr::u32(7, length)]);
+        }
+        attributes.push(Attr::u32(10, id));
+        self.push(9, attributes)
+    }
+    fn exact_elements(
+        &mut self,
+        name: &str,
+        elements: Vec<(Vec<u8>, Option<Vec<u8>>)>,
+    ) -> Result<()> {
+        for chunk in elements.chunks(256) {
+            let list = chunk
+                .iter()
+                .map(|(key, data)| {
+                    let mut fields = vec![Attr::nested(1, vec![Attr::bytes(1, key.clone())])];
+                    if let Some(data) = data {
+                        fields.push(Attr::nested(2, vec![Attr::bytes(1, data.clone())]));
+                    }
+                    Attr::nested(1, fields)
+                })
+                .collect();
+            self.push_elements(vec![
+                Attr::string(1, self.table),
+                Attr::string(2, name),
+                Attr::nested(3, list),
+            ])?;
+        }
+        Ok(())
+    }
     /// One named exact-match set. CONSTANT: its elements cannot change once a
     /// rule binds it, so replacement always creates a complete new set.
     fn set(&mut self, name: &str, id: u32, key_length: usize) -> Result<()> {
@@ -56,21 +142,72 @@ impl<'a> Program<'a> {
     /// own budget: a replacement deletes the previous set, and so its elements,
     /// by one handle.
     fn elements(&mut self, name: &str, keys: Vec<Vec<u8>>) -> Result<()> {
-        for chunk in keys.chunks(256) {
-            let elements = chunk
+        self.exact_elements(name, keys.into_iter().map(|key| (key, None)).collect())
+    }
+    /// One named CONSTANT set of concatenated fields in which every field is an
+    /// inclusive interval (the kernel's pipapo backend), optionally a map to
+    /// `data_length` bytes. `fields` are byte lengths; each occupies whole
+    /// 32-bit registers of the key.
+    fn interval_set(
+        &mut self,
+        name: &str,
+        id: u32,
+        fields: &[u32],
+        data_length: Option<u32>,
+    ) -> Result<()> {
+        let key_length: u32 = fields.iter().map(|length| length.div_ceil(4) * 4).sum();
+        let mut attributes = vec![
+            Attr::string(1, self.table),
+            Attr::string(2, name),
+            // CONSTANT | INTERVAL | CONCAT, and MAP for a map.
+            Attr::u32(3, 2 | 4 | 0x80 | if data_length.is_some() { 8 } else { 0 }),
+            Attr::u32(4, 0),
+            Attr::u32(5, key_length),
+        ];
+        if let Some(length) = data_length {
+            attributes.extend([Attr::u32(6, 0), Attr::u32(7, length)]);
+        }
+        attributes.extend([
+            Attr::nested(
+                9,
+                vec![Attr::nested(
+                    2,
+                    fields
+                        .iter()
+                        .map(|length| Attr::nested(1, vec![Attr::u32(1, *length)]))
+                        .collect(),
+                )],
+            ),
+            Attr::u32(10, id),
+        ]);
+        self.push(9, attributes)
+    }
+    /// Interval elements `(first, last, data)`, 256 to a message like `elements`.
+    /// An element whose bounds are equal carries no last key; Linux takes the
+    /// first as the last and dumps it the same way.
+    fn interval_elements(&mut self, name: &str, elements: Vec<IntervalElement>) -> Result<()> {
+        for chunk in elements.chunks(256) {
+            let list = chunk
                 .iter()
-                .map(|key| {
-                    Attr::nested(1, vec![Attr::nested(1, vec![Attr::bytes(1, key.clone())])])
+                .map(|element| {
+                    let value = |kind: u16, bytes: &[u8]| {
+                        Attr::nested(kind, vec![Attr::bytes(1, bytes.to_vec())])
+                    };
+                    let mut fields = vec![value(1, &element.first)];
+                    if element.last != element.first {
+                        fields.push(value(10, &element.last));
+                    }
+                    if let Some(data) = &element.data {
+                        fields.push(value(2, data));
+                    }
+                    Attr::nested(1, fields)
                 })
                 .collect();
-            let attributes = vec![
+            self.push_elements(vec![
                 Attr::string(1, self.table),
                 Attr::string(2, name),
-                Attr::nested(3, elements),
-            ];
-            self.element_bytes += wire::encode_attrs(&attributes).len() + 20;
-            require(self.element_bytes <= ELEMENT_BYTES && self.operations.len() < 768)?;
-            self.operations.push((12, attributes));
+                Attr::nested(3, list),
+            ])?;
         }
         Ok(())
     }
@@ -243,12 +380,6 @@ fn immediate(register: u32, value: Vec<u8>) -> Attr {
         ],
     )
 }
-fn set_ct(key: u32, value: Vec<u8>) -> Vec<Attr> {
-    vec![
-        immediate(1, value),
-        expr("ct", vec![Attr::u32(2, key), Attr::u32(4, 1)]),
-    ]
-}
 fn label(generation: &Generation) -> Vec<u8> {
     // A label is an opaque canonical 16-byte value, never a host-endian integer.
     generation
@@ -258,14 +389,6 @@ fn label(generation: &Generation) -> Vec<u8> {
         .map(|pair| u8::from_str_radix(std::str::from_utf8(pair).unwrap(), 16).unwrap())
         .collect()
 }
-fn generation(generation: &Generation, direction: u8, labelled: bool) -> Vec<Attr> {
-    let mut result = ct(17, None, generation.conntrack_zone.to_ne_bytes().to_vec());
-    result.extend(ct(1, None, vec![direction]));
-    if labelled {
-        result.extend(ct(13, None, label(generation)));
-    }
-    result
-}
 fn state(value: u32) -> Vec<Attr> {
     ct(0, None, value.to_ne_bytes().to_vec())
 }
@@ -297,50 +420,6 @@ fn snat(address: &str, range: Option<(u16, u16)>) -> Result<Vec<Attr>> {
     result.push(expr("nat", data));
     Ok(result)
 }
-/// Published inbound translation. Address and port are always both specified, so
-/// the kernel never picks a port and the graph identity carries explicit registers.
-fn dnat(address: &str, port: u16) -> Result<Vec<Attr>> {
-    Ok(vec![
-        immediate(1, super::address(address)?.to_be_bytes().to_vec()),
-        immediate(2, port.to_be_bytes().to_vec()),
-        expr(
-            "nat",
-            vec![
-                Attr::u32(1, 1),
-                Attr::u32(2, 2),
-                Attr::u32(3, 1),
-                Attr::u32(4, 1),
-                Attr::u32(5, 2),
-                Attr::u32(6, 2),
-                Attr::u32(7, 3),
-            ],
-        ),
-    ])
-}
-fn tuple(grant: &Grant, protection: &Protection, reply: bool, original: bool) -> Result<Vec<Attr>> {
-    let destination = super::destination(grant, protection)?;
-    let mut result = ipv4();
-    result.extend(meta(16, vec![protocol(&grant.protocol)]));
-    result.extend(current_address(&grant.source_prefix, !reply)?);
-    result.extend(current_address(&destination, reply)?);
-    for (port, source) in [(grant.source_port, !reply), (grant.destination_port, reply)] {
-        if let Some(port) = port {
-            result.extend(current_port(port, source));
-        }
-    }
-    if original {
-        result.extend(original_address(&grant.source_prefix, true)?);
-        result.extend(original_address(&destination, false)?);
-        result.extend(ct(10, None, vec![protocol(&grant.protocol)]));
-        for (port, source) in [(grant.source_port, true), (grant.destination_port, false)] {
-            if let Some(port) = port {
-                result.extend(original_port(port, source));
-            }
-        }
-    }
-    Ok(result)
-}
-
 pub(super) fn compile(prepared: &Prepared, table: &str) -> Result<Vec<(u16, Vec<Attr>)>> {
     let mut program = Program {
         table,
@@ -351,9 +430,7 @@ pub(super) fn compile(prepared: &Prepared, table: &str) -> Result<Vec<(u16, Vec<
         operations: Vec::new(),
     };
     match &prepared.policy.scope {
-        Scope::RouterEgress(scope) => {
-            router::compile(&mut program, scope, prepared.policy.revision)?
-        }
+        Scope::RouterEgress(scope) => router::compile(&mut program, scope)?,
         Scope::HostTransit(scope) => host::compile(&mut program, scope)?,
         Scope::AllocationPoolGuard(scope) => poolguard::compile(&mut program, scope)?,
     }

package/rust/src/egress.host.rs

@@ -66,34 +66,12 @@ fn leased(
     expressions.extend(original_range(range.first, range.last));
     Ok(expressions)
 }
-/// Inbound publication envelope. Both directions check the exact links, the
-/// translated current tuple and the original conntrack destination, so foreign
-/// NAT cannot borrow this admission for another flow.
-fn published_envelope(
-    scope: &HostScope,
-    handoff: &HostHandoff,
-    port: &PublishedPort,
-    reply: bool,
-) -> Result<Vec<Attr>> {
-    let mut expressions = ipv4();
-    expressions.extend(link(&scope.uplink, !reply));
-    expressions.extend(link(&handoff.link, reply));
-    expressions.extend(meta(16, vec![protocol(&port.protocol)]));
-    expressions.extend(ct(10, None, vec![protocol(&port.protocol)]));
-    expressions.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
-    expressions.extend(ct(1, None, vec![u8::from(reply)]));
-    let target = format!("{}/32", port.target_address);
-    expressions.extend(current_address(&target, reply)?);
-    expressions.extend(current_port(port.target_port, reply));
-    let published = format!("{}/32", port.host_ip);
-    expressions.extend(original_address(&published, false)?);
-    expressions.extend(original_port(port.host_port, false));
-    Ok(expressions)
-}
-fn published(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
+/// The publications of this hop. Validation admits only leased transit source
+/// addresses as targets, and one address never spans two active handoff links,
+/// so each publication has exactly one handoff.
+fn hop(scope: &HostScope) -> Result<published::Hop<'_>> {
+    let mut publications = Vec::new();
     for port in &scope.published_ports {
-        // Validation admits only leased transit source addresses, and one address
-        // never spans two active handoff links.
         let handoff = scope
             .handoffs
             .iter()
@@ -104,30 +82,18 @@ fn published(program: &mut Program<'_>, scope: &HostScope) -> Result<()> {
                     .any(|allocation| allocation.transit_source_address == port.target_address)
             })
             .ok_or(crate::Error::Invalid)?;
-        let original = published_envelope(scope, handoff, port, false)?;
-        for connection_state in [2, 8] {
-            let mut expressions = original.clone();
-            expressions.extend(state(connection_state));
-            if connection_state == 8 && port.protocol == "tcp" {
-                expressions.extend(opening_tcp());
-            }
-            program.end("forward", expressions, 1)?;
-        }
-        let mut reply = published_envelope(scope, handoff, port, true)?;
-        reply.extend(state(2));
-        program.end("forward", reply, 1)?;
-        let mut translation = ipv4();
-        translation.extend(link(&scope.uplink, true));
-        translation.extend(meta(16, vec![protocol(&port.protocol)]));
-        translation.extend(ct(10, None, vec![protocol(&port.protocol)]));
-        translation.extend(ct(17, None, 0_u16.to_ne_bytes().to_vec()));
-        translation.extend(ct(1, None, vec![0]));
-        translation.extend(current_address(&format!("{}/32", port.host_ip), false)?);
-        translation.extend(current_port(port.host_port, false));
-        translation.extend(dnat(&port.target_address, port.target_port)?);
-        program.rule("pre", translation)?;
+        publications.push(published::Publication {
+            protocol: &port.protocol,
+            outside: (&port.host_ip, port.host_port, port.host_last()),
+            inside: (&port.target_address, port.target_port, port.target_last()),
+            link: &handoff.link,
+            symmetric: port.symmetric,
+        });
     }
-    Ok(())
+    Ok(published::Hop {
+        publications,
+        fixed: &scope.uplink,
+    })
 }
 /// The exact platform endpoints served on host addresses. Every packet is
 /// checked against the live and the originally tracked destination tuple, so a
@@ -235,12 +201,15 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
                 .ok_or(crate::Error::Invalid)
         })?;
     }
+    let hop = hop(scope)?;
+    published::sets(program, &hop, false)?;
     protection(program, scope, false)?;
     protection(program, scope, true)?;
+    published::translations(program, &hop)?;
     // Published admission precedes the capture barrier: the barrier denies every
     // protected original destination, which includes this uplink address, and an
     // exact inbound publication is the explicit authority for that exception.
-    published(program, scope)?;
+    published::inbound(program, &hop)?;
     // Host-origin grants leave through the exact handoff that holds their source
     // address, which is part of every set key, and precede the terminal output
     // and input denials. Nothing else of the host's own traffic crosses a handoff.
@@ -275,6 +244,10 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &HostScope) -> Result<()
             }
         }
     }
+    // Symmetric flows leave from ports outside every leased range of their
+    // address, after the capture barrier and before the terminal handoff denials.
+    published::symmetric(program, &hop)?;
+    published::symmetric_translation(program, &hop)?;
     for handoff in &scope.handoffs {
         program.deny_link("input", &handoff.link, true)?;
         program.deny_link("output", &handoff.link, false)?;

package/rust/src/egress.hostgrant.rs

@@ -38,7 +38,7 @@ pub(super) fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Att
         index,
     )
 }
-fn ct_to(key: u32, original: bool, index: u32) -> Attr {
+pub(super) fn ct_to(key: u32, original: bool, index: u32) -> Attr {
     let mut data = vec![Attr::u32(2, key)];
     if original {
         data.push(Attr::bytes(3, vec![0]));