@push.rocks/smartnftables 4.3.1 → 4.5.0

package/rust/src/egress.hostgrant.rs

@@ -4,6 +4,10 @@
 //! variable interface (index and name), the packet and conntrack protocols, the
 //! live tuple and the originally tracked tuple. An element is one grant with its
 //! live tuple equal to its original tuple, so translated flows never match.
+use super::keys::{
+    Field, Loads, CT_ORIGINAL_DADDR, CT_ORIGINAL_DPORT, CT_ORIGINAL_SADDR, CT_PROTOCOL, IP_DADDR,
+    IP_SADDR, L4PROTO, OIF, OIFNAME, TH_DPORT,
+};
 use super::*;
 
 /// Every exact host-origin flow of the scope, keyed on its full tuple.
@@ -11,6 +15,42 @@ pub(super) const TUPLE_SET: &str = "host_grant";
 /// Router raw ingress runs before conntrack: exact arriving tuples only.
 pub(super) const ARRIVAL_SET: &str = "host_grant_arrival";
 
+/// The tuple key of a link-independent scope: both protocols, the live tuple
+/// and the originally tracked tuple, as the original direction loads them.
+pub(super) const TUPLE: [Field; 8] = [
+    L4PROTO,
+    CT_PROTOCOL,
+    IP_SADDR,
+    IP_DADDR,
+    TH_DPORT,
+    CT_ORIGINAL_SADDR,
+    CT_ORIGINAL_DADDR,
+    CT_ORIGINAL_DPORT,
+];
+/// The tuple key behind the variable interface: its index and name first.
+const LINKED_TUPLE: [Field; 10] = [
+    OIF,
+    OIFNAME,
+    L4PROTO,
+    CT_PROTOCOL,
+    IP_SADDR,
+    IP_DADDR,
+    TH_DPORT,
+    CT_ORIGINAL_SADDR,
+    CT_ORIGINAL_DADDR,
+    CT_ORIGINAL_DPORT,
+];
+/// The exact arriving tuple: protocol, addresses and port.
+const ARRIVAL: [Field; 4] = [L4PROTO, IP_SADDR, IP_DADDR, TH_DPORT];
+
+fn tuple(linked: bool) -> &'static [Field] {
+    if linked {
+        &LINKED_TUPLE
+    } else {
+        &TUPLE
+    }
+}
+
 /// Register numbers as Linux dumps them: 16-byte aligned registers use the
 /// legacy NFT_REG_1..4 names, every other 4-byte register NFT_REG32_xx.
 pub(super) fn register(index: u32) -> u32 {
@@ -38,10 +78,11 @@ pub(super) fn payload_to(base: u32, offset: u32, length: u32, index: u32) -> Att
         index,
     )
 }
-pub(super) fn ct_to(key: u32, original: bool, index: u32) -> Attr {
+/// A conntrack key of the original (0) or reply (1) tuple, or of neither.
+pub(super) fn ct_to(key: u32, direction: Option<u8>, index: u32) -> Attr {
     let mut data = vec![Attr::u32(2, key)];
-    if original {
-        data.push(Attr::bytes(3, vec![0]));
+    if let Some(direction) = direction {
+        data.push(Attr::bytes(3, vec![direction]));
     }
     store("ct", data, index)
 }
@@ -64,26 +105,22 @@ fn word(bytes: &[u8]) -> Vec<u8> {
 /// Key loads for one direction, then the lookup in `set`. `linked` adds the
 /// variable interface: the outgoing interface of the original direction, the
 /// incoming interface of the reply.
-pub(super) fn tuple_lookup(set: &str, linked: bool, reply: bool) -> Vec<Attr> {
-    let mut result = Vec::new();
-    let mut index = 4;
+pub(super) fn tuple_lookup(set: &str, linked: bool, reply: bool) -> Result<Vec<Attr>> {
+    let mut loads = Loads::new();
     if linked {
-        result.push(meta_to(if reply { 4 } else { 5 }, index));
-        result.push(meta_to(if reply { 6 } else { 7 }, index + 1));
-        index += 5;
+        loads.link(reply);
     }
-    result.push(meta_to(16, index));
-    result.push(ct_to(10, false, index + 1));
     // The grant's source and destination are the packet's own addresses in the
     // original direction and swapped on the reply; the port is the workload's.
-    result.push(payload_to(1, if reply { 16 } else { 12 }, 4, index + 2));
-    result.push(payload_to(1, if reply { 12 } else { 16 }, 4, index + 3));
-    result.push(payload_to(2, if reply { 0 } else { 2 }, 2, index + 4));
-    result.push(ct_to(19, true, index + 5));
-    result.push(ct_to(20, true, index + 6));
-    result.push(ct_to(12, true, index + 7));
-    result.push(lookup(set));
-    result
+    loads
+        .protocols()
+        .address(!reply)
+        .address(reply)
+        .port(reply)
+        .original_address(true)
+        .original_address(false)
+        .original_port(false);
+    loads.lookup(set, tuple(linked))
 }
 pub(super) fn tuple_key(grant: &HostGrant, link: Option<&LocalLink>) -> Result<Vec<u8>> {
     let protocol = word(&[protocol(&grant.protocol)]);
@@ -120,11 +157,15 @@ pub(super) fn tuple_set<'s>(
     link: impl Fn(&HostGrant) -> Result<Option<&'s LocalLink>>,
 ) -> Result<()> {
     let mut keys = Vec::new();
+    let mut linked = false;
     for grant in grants {
-        keys.push(tuple_key(grant, link(grant)?)?);
+        let link = link(grant)?;
+        linked = link.is_some();
+        keys.push(tuple_key(grant, link)?);
     }
-    let length = keys.first().map(Vec::len).ok_or(crate::Error::Invalid)?;
-    program.set(TUPLE_SET, 1, length)?;
+    // Every element has the declared key's length, so a scope never mixes them.
+    require(!keys.is_empty())?;
+    program.exact_set(TUPLE_SET, 1, tuple(linked), None)?;
     program.elements(TUPLE_SET, keys)
 }
 pub(super) fn arrival_set(program: &mut Program<'_>, grants: &[HostGrant]) -> Result<()> {
@@ -136,18 +177,17 @@ pub(super) fn arrival_set(program: &mut Program<'_>, grants: &[HostGrant]) -> Re
         key.extend(word(&grant.destination_port.to_be_bytes()));
         keys.push(key);
     }
-    program.set(ARRIVAL_SET, 2, 16)?;
+    program.exact_set(ARRIVAL_SET, 2, &ARRIVAL, None)?;
     program.elements(ARRIVAL_SET, keys)
 }
 /// Exact arriving tuple, before conntrack: protocol, addresses and port.
-pub(super) fn arrival_lookup() -> Vec<Attr> {
-    vec![
-        meta_to(16, 4),
-        payload_to(1, 12, 4, 5),
-        payload_to(1, 16, 4, 6),
-        payload_to(2, 2, 2, 7),
-        lookup(ARRIVAL_SET),
-    ]
+pub(super) fn arrival_lookup() -> Result<Vec<Attr>> {
+    Loads::new()
+        .protocol()
+        .address(true)
+        .address(false)
+        .port(false)
+        .lookup(ARRIVAL_SET, &ARRIVAL)
 }
 
 /// Four admissions whatever the number of grants: the ESTABLISHED original
@@ -170,7 +210,7 @@ pub(super) fn admissions(
         result
     };
     let mut established = envelope(false, 2);
-    established.extend(tuple_lookup(TUPLE_SET, linked, false));
+    established.extend(tuple_lookup(TUPLE_SET, linked, false)?);
     program.end(chains[0], established, 1)?;
     for transport in ["udp", "tcp"] {
         let mut opening = envelope(false, 8);
@@ -178,10 +218,10 @@ pub(super) fn admissions(
         if transport == "tcp" {
             opening.extend(opening_tcp());
         }
-        opening.extend(tuple_lookup(TUPLE_SET, linked, false));
+        opening.extend(tuple_lookup(TUPLE_SET, linked, false)?);
         program.end(chains[0], opening, 1)?;
     }
     let mut reply = envelope(true, 2);
-    reply.extend(tuple_lookup(TUPLE_SET, linked, true));
+    reply.extend(tuple_lookup(TUPLE_SET, linked, true)?);
     program.end(chains[1], reply, 1)
 }