@push.rocks/smartnftables 4.3.1 → 4.5.0

package/rust/src/egress.leased.rs

@@ -6,13 +6,26 @@
 //! rules prove through `private_link`), the protocols, the live and originally
 //! tracked tuple and the generation's conntrack zone. Generation labels live in
 //! two exact sets, so a label alone never authorizes a changed grant.
-use super::keys::{self, Key, Loads, ADDRESS, INDEX, LABEL, PORT, PROTOCOL, ZONE};
+use super::keys::{
+    self, Field, Key, Loads, CT_LABEL, CT_ORIGINAL_DADDR, CT_ORIGINAL_DPORT, CT_ORIGINAL_SADDR,
+    CT_ORIGINAL_SPORT, CT_PROTOCOL, CT_ZONE, IIF, IP_DADDR, IP_SADDR, L4PROTO, TH_DPORT, TH_SPORT,
+};
 use super::private::known;
 use super::*;
 
 const LABEL_SET: &str = "leased_label";
 const GENERATION_MAP: &str = "leased_generation";
-const RETURN: [u32; 5] = [PROTOCOL, ADDRESS, ADDRESS, PORT, PORT];
+const LABEL_KEY: [Field; 2] = [CT_ZONE, CT_LABEL];
+/// The generation map's key is the zone padded to its register, as every
+/// release before typed sets declared it.
+const GENERATION_KEY: [Field; 1] = [CT_ZONE];
+const GENERATION_DATA: [Field; 1] = [CT_LABEL];
+const RETURN: [Field; 5] = [L4PROTO, IP_SADDR, IP_DADDR, TH_SPORT, TH_DPORT];
+/// The zone a classification stores.
+const ZONE_DATA: [Field; 1] = [CT_ZONE];
+/// The source NAT a flow map stores: the transit address and the first and
+/// last port of the leased range.
+const TRANSLATION: [Field; 3] = [IP_SADDR, TH_SPORT, TH_SPORT];
 
 /// Platform grants precede the protected barrier and public grants follow it.
 #[derive(Clone, Copy, PartialEq, Eq)]
@@ -69,24 +82,26 @@ impl Shape {
     }
     /// A source port field only where the grants name one, then the
     /// destination port.
-    fn ports(self) -> Vec<u32> {
+    fn ports(self, source: Field, destination: Field) -> Vec<Field> {
         if self.sourced {
-            vec![PORT, PORT]
+            vec![source, destination]
         } else {
-            vec![PORT]
+            vec![destination]
         }
     }
-    fn classification(self) -> Vec<u32> {
-        let mut fields = vec![INDEX, PROTOCOL, ADDRESS, ADDRESS];
-        fields.extend(self.ports());
+    /// The classification key, as the incoming direction loads it.
+    fn classification(self) -> Vec<Field> {
+        let mut fields = vec![IIF, L4PROTO, IP_SADDR, IP_DADDR];
+        fields.extend(self.ports(TH_SPORT, TH_DPORT));
         fields
     }
-    fn flow(self) -> Vec<u32> {
-        let mut fields = vec![INDEX, PROTOCOL, PROTOCOL, ADDRESS, ADDRESS];
-        fields.extend(self.ports());
-        fields.extend([ADDRESS, ADDRESS]);
-        fields.extend(self.ports());
-        fields.push(ZONE);
+    /// The flow key, as the original direction loads it.
+    fn flow(self) -> Vec<Field> {
+        let mut fields = vec![IIF, L4PROTO, CT_PROTOCOL, IP_SADDR, IP_DADDR];
+        fields.extend(self.ports(TH_SPORT, TH_DPORT));
+        fields.extend([CT_ORIGINAL_SADDR, CT_ORIGINAL_DADDR]);
+        fields.extend(self.ports(CT_ORIGINAL_SPORT, CT_ORIGINAL_DPORT));
+        fields.push(CT_ZONE);
         fields
     }
     fn key_ports(self, key: Key, grant: &Grant) -> Key {
@@ -151,8 +166,15 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
         labels.push((key, None));
         generations.push((zone_word(generation.conntrack_zone), Some(label)));
     }
-    keys::exact(program, LABEL_SET, 38, 4 + LABEL, None, labels)?;
-    keys::exact(program, GENERATION_MAP, 39, 4, Some(LABEL), generations)?;
+    keys::exact(program, LABEL_SET, 38, &LABEL_KEY, None, labels)?;
+    keys::exact(
+        program,
+        GENERATION_MAP,
+        39,
+        &GENERATION_KEY,
+        Some(&GENERATION_DATA),
+        generations,
+    )?;
     for kind in [Kind::Platform, Kind::Public] {
         let mut returns = Vec::new();
         for shape in Shape::all(kind) {
@@ -212,7 +234,7 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
                 &shape.name("zone"),
                 shape.id(0),
                 &shape.classification(),
-                Some(ZONE),
+                Some(&ZONE_DATA),
                 classification,
             )?;
             keys::interval(
@@ -220,12 +242,19 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
                 &shape.name("flow"),
                 shape.id(1),
                 &shape.flow(),
-                Some(12),
+                Some(&TRANSLATION),
                 flows,
             )?;
         }
         let id = 48 + 8 + u32::from(kind == Kind::Public);
-        keys::interval(program, &kind.returns(), id, &RETURN, Some(ZONE), returns)?;
+        keys::interval(
+            program,
+            &kind.returns(),
+            id,
+            &RETURN,
+            Some(&ZONE_DATA),
+            returns,
+        )?;
     }
     Ok(())
 }
@@ -260,15 +289,15 @@ pub(super) fn classification(
         };
         if !present(scope, shape, false).is_empty() {
             let mut expressions = ipv4();
-            expressions.extend(known(true));
-            expressions.extend(tuple(true).map(&shape.name("zone")));
+            expressions.extend(known(true)?);
+            expressions.extend(tuple(true).map(&shape.name("zone"), &shape.classification())?);
             expressions.push(zone_from_data());
             program.end("raw_in", expressions, 1)?;
         }
         if !present(scope, shape, true).is_empty() {
             let mut expressions = ipv4();
             expressions.extend(link(&scope.handoff, false));
-            expressions.extend(tuple(false).map(&shape.name("zone")));
+            expressions.extend(tuple(false).map(&shape.name("zone"), &shape.classification())?);
             expressions.push(zone_from_data());
             program.end("raw_out", expressions, 1)?;
         }
@@ -283,7 +312,7 @@ pub(super) fn classification(
             .address(false)
             .port(true)
             .port(false);
-        expressions.extend(loads.map(&kind.returns()));
+        expressions.extend(loads.map(&kind.returns(), &RETURN)?);
         expressions.push(zone_from_data());
         program.end("raw_return", expressions, 1)?;
     }
@@ -305,8 +334,8 @@ fn flow(shape: Shape, reply: bool) -> Loads {
     loads.zone();
     loads
 }
-fn labelled() -> Vec<Attr> {
-    Loads::new().zone().label().lookup(LABEL_SET)
+fn labelled() -> Result<Vec<Attr>> {
+    Loads::new().zone().label().lookup(LABEL_SET, &LABEL_KEY)
 }
 /// Admissions of one kind in one filter chain. The original direction leaves
 /// through the handoff: ESTABLISHED or NEW with the generation's label, or a
@@ -340,36 +369,36 @@ pub(super) fn admissions(
         };
         if !original.is_empty() {
             let mut established = envelope(false, 2);
-            established.extend(known(true));
-            established.extend(flow(shape, false).lookup(&name));
-            established.extend(labelled());
+            established.extend(known(true)?);
+            established.extend(flow(shape, false).lookup(&name, &shape.flow())?);
+            established.extend(labelled()?);
             program.end(chain, established, 1)?;
             for transport in &original {
-                let opening = || {
+                let opening = || -> Result<Vec<Attr>> {
                     let mut result = envelope(false, 8);
                     result.extend(meta(16, vec![protocol(transport)]));
                     if *transport == "tcp" {
                         result.extend(opening_tcp());
                     }
-                    result.extend(known(true));
-                    result.extend(flow(shape, false).lookup(&name));
-                    result
+                    result.extend(known(true)?);
+                    result.extend(flow(shape, false).lookup(&name, &shape.flow())?);
+                    Ok(result)
                 };
-                let mut labelled_opening = opening();
-                labelled_opening.extend(labelled());
+                let mut labelled_opening = opening()?;
+                labelled_opening.extend(labelled()?);
                 program.end(chain, labelled_opening, 1)?;
-                let mut fresh = opening();
+                let mut fresh = opening()?;
                 fresh.extend(ct(13, None, vec![0; 16]));
-                fresh.extend(Loads::new().zone().map(GENERATION_MAP));
+                fresh.extend(Loads::new().zone().map(GENERATION_MAP, &GENERATION_KEY)?);
                 fresh.push(keys::set_ct_from_data(13));
                 program.end(chain, fresh, 1)?;
             }
         }
         if reply {
             let mut answer = envelope(true, 2);
-            answer.extend(known(false));
-            answer.extend(flow(shape, true).lookup(&name));
-            answer.extend(labelled());
+            answer.extend(known(false)?);
+            answer.extend(flow(shape, true).lookup(&name, &shape.flow())?);
+            answer.extend(labelled()?);
             program.end(chain, answer, 1)?;
         }
     }
@@ -389,9 +418,9 @@ pub(super) fn translation(
         let mut expressions = ipv4();
         expressions.extend(link(&scope.handoff, false));
         expressions.extend(ct(1, None, vec![0]));
-        expressions.extend(labelled());
-        expressions.extend(known(true));
-        expressions.extend(flow(shape, false).map(&shape.name("flow")));
+        expressions.extend(labelled()?);
+        expressions.extend(known(true)?);
+        expressions.extend(flow(shape, false).map(&shape.name("flow"), &shape.flow())?);
         expressions.push(super::published::nat(0, 2));
         program.rule("post", expressions)?;
     }

package/rust/src/egress.poolguard.rs

@@ -1,5 +1,14 @@
+use super::keys::{
+    self, Field, Key, Loads, CT_ORIGINAL_DPORT, CT_REPLY_SADDR, CT_REPLY_SPORT, L4PROTO,
+};
 use super::*;
 
+/// Publications translated into a pool: the protocol, the address and port the
+/// flow was translated to, and its originally tracked destination port. Port fields are inclusive intervals, so one element holds
+/// one port or a whole range.
+const PUBLISHED: &str = "pool_published";
+const PUBLISHED_KEY: [Field; 4] = [L4PROTO, CT_REPLY_SADDR, CT_REPLY_SPORT, CT_ORIGINAL_DPORT];
+
 pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) -> Result<()> {
     for (name, hook) in [("input", 1), ("forward", 2), ("output", 3)] {
         program.chain(name, Some((hook, 0, "filter")))?;
@@ -18,6 +27,9 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
         hostgrant::tuple_set(program, &scope.host_grants, |_| Ok(None))?;
         hostgrant::admissions(program, ["output", "input"], false, |_| vec![])?;
     }
+    if !scope.published_ports.is_empty() {
+        published_set(program, scope)?;
+    }
     for name in ["input", "forward", "output"] {
         program.jump(name, ipv4(), "pool_guard")?;
     }
@@ -25,6 +37,11 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
     for prefix in &scope.prefixes {
         program.end("pool_guard", original_address(prefix, false)?, 0)?;
     }
+    // Publications follow that denial, so only a flow translated from outside
+    // every pool can match one, and precede every current-address denial.
+    if !scope.published_ports.is_empty() {
+        published(program, scope)?;
+    }
     // GOTO, not JUMP: RETURN from pool_reply must return to the base chain,
     // skipping current-destination denial for legitimate reverse-SNAT replies.
     let mut reply = ct(1, None, vec![1]);
@@ -40,6 +57,61 @@ pub(super) fn compile(program: &mut Program<'_>, scope: &AllocationPoolGuardScop
     program.end("pool_reply", vec![], -5)
 }
 
+/// The publications of the scope as one interval set.
+fn published_set(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) -> Result<()> {
+    let mut elements = Vec::new();
+    for port in &scope.published_ports {
+        elements.push(
+            Key::default()
+                .protocol(&port.protocol)
+                .address(&port.target_address)?
+                .span(port.target_port, port.target_last())
+                .span(port.host_port, port.host_last())
+                .element(None),
+        );
+    }
+    keys::interval(program, PUBLISHED, 2, &PUBLISHED_KEY, None, elements).map(|_| ())
+}
+/// The admissions of every publication, whatever their number: behind the
+/// default conntrack zone, an ESTABLISHED packet of either direction, and a NEW
+/// opening per protocol (TCP only with SYN and FIN/RST/ACK clear). Each looks its
+/// flow up once by the reply tuple's source, which is the address and port the
+/// flow was translated to in both directions, and the originally tracked
+/// destination port. They run in the guard chain after the original-destination
+/// denial, so a flow whose original destination lies in a pool never reaches
+/// them. A publication is the exception of every hook it crosses: on a host that
+/// forwards it, that is FORWARD alone.
+fn published(program: &mut Program<'_>, scope: &AllocationPoolGuardScope) -> Result<()> {
+    let lookup = || {
+        let mut loads = Loads::new();
+        loads.protocol().translated().original_port(false);
+        loads.lookup(PUBLISHED, &PUBLISHED_KEY)
+    };
+    let envelope = |connection_state: u32| {
+        let mut result = ct(17, None, 0_u16.to_ne_bytes().to_vec());
+        result.extend(state(connection_state));
+        result
+    };
+    let mut established = envelope(2);
+    established.extend(lookup()?);
+    program.end("pool_guard", established, 1)?;
+    let transports: std::collections::BTreeSet<&str> = scope
+        .published_ports
+        .iter()
+        .map(|port| port.protocol.as_str())
+        .collect();
+    for transport in transports {
+        let mut opening = envelope(8);
+        opening.extend(meta(16, vec![protocol(transport)]));
+        if transport == "tcp" {
+            opening.extend(opening_tcp());
+        }
+        opening.extend(lookup()?);
+        program.end("pool_guard", opening, 1)?;
+    }
+    Ok(())
+}
+
 /// The exact loopback TCP destination: IPv4, TCP, address and port.
 fn local_tcp_port(owner: &LocalTcpPortOwner) -> Result<Vec<Attr>> {
     let mut result = ipv4();

package/rust/src/egress.private.rs

@@ -4,7 +4,9 @@
 //! anti-spoof guard, the directed rules and the terminal denials look the packet
 //! up there and in sets keyed on the link index, so a renamed or reused interface
 //! never matches an element of another link.
-use super::keys::{self, Key, Loads, ADDRESS, INDEX, NAME, PORT, PROTOCOL};
+use super::keys::{
+    self, Field, Key, Loads, IIF, IIFNAME, IP_DADDR, IP_SADDR, L4PROTO, OIF, TH_DPORT, TH_SPORT,
+};
 use super::*;
 
 /// Every endpoint link, index and name, and the absent interface (0, "") of
@@ -21,6 +23,14 @@ const SOURCE: &str = "private_source";
 const ANY: &str = "private_any";
 const PORTED: &str = "private_port";
 
+/// The keys, as the incoming direction loads them where both directions do.
+const LINK_KEY: [Field; 2] = [IIF, IIFNAME];
+const INDEX_KEY: [Field; 1] = [IIF];
+const NAME_KEY: [Field; 1] = [IIFNAME];
+const SOURCE_KEY: [Field; 2] = [IIF, IP_SADDR];
+const ANY_KEY: [Field; 4] = [IIF, OIF, IP_SADDR, IP_DADDR];
+const PORTED_KEY: [Field; 7] = [IIF, OIF, IP_SADDR, IP_DADDR, L4PROTO, TH_SPORT, TH_DPORT];
+
 fn name(value: &str) -> Vec<u8> {
     let mut bytes = value.as_bytes().to_vec();
     bytes.resize(16, 0);
@@ -64,10 +74,10 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
             );
         }
     }
-    keys::exact(program, LINK, 32, INDEX + NAME, None, links)?;
-    keys::exact(program, INDEX_SET, 33, INDEX, None, indices)?;
-    keys::exact(program, NAME_SET, 34, NAME, None, names)?;
-    keys::interval(program, SOURCE, 35, &[INDEX, ADDRESS], None, sources)?;
+    keys::exact(program, LINK, 32, &LINK_KEY, None, links)?;
+    keys::exact(program, INDEX_SET, 33, &INDEX_KEY, None, indices)?;
+    keys::exact(program, NAME_SET, 34, &NAME_KEY, None, names)?;
+    keys::interval(program, SOURCE, 35, &SOURCE_KEY, None, sources)?;
     let (mut any, mut ported) = (Vec::new(), Vec::new());
     for rule in &scope.rules {
         let key = Key::default()
@@ -86,22 +96,8 @@ pub(super) fn sets(program: &mut Program<'_>, scope: &RouterScope) -> Result<()>
             );
         }
     }
-    keys::interval(
-        program,
-        ANY,
-        36,
-        &[INDEX, INDEX, ADDRESS, ADDRESS],
-        None,
-        any,
-    )?;
-    keys::interval(
-        program,
-        PORTED,
-        37,
-        &[INDEX, INDEX, ADDRESS, ADDRESS, PROTOCOL, PORT, PORT],
-        None,
-        ported,
-    )?;
+    keys::interval(program, ANY, 36, &ANY_KEY, None, any)?;
+    keys::interval(program, PORTED, 37, &PORTED_KEY, None, ported)?;
     Ok(())
 }
 /// The directions a filter chain sees an endpoint link in.
@@ -114,8 +110,8 @@ fn directions(chain: &str) -> Vec<bool> {
 }
 /// The interface of one direction is an endpoint link or absent, by index and
 /// name.
-pub(super) fn known(incoming: bool) -> Vec<Attr> {
-    Loads::new().link(incoming).lookup(LINK)
+pub(super) fn known(incoming: bool) -> Result<Vec<Attr>> {
+    Loads::new().link(incoming).lookup(LINK, &LINK_KEY)
 }
 /// Anti-spoof guards: a packet arriving from an endpoint link must carry one of
 /// its source prefixes, and one leaving to it one of its prefixes as destination;
@@ -126,7 +122,7 @@ pub(super) fn guards(program: &mut Program<'_>, scope: &RouterScope, chain: &str
         return Ok(());
     }
     for incoming in directions(chain) {
-        let mut foreign = known(incoming);
+        let mut foreign = known(incoming)?;
         foreign.push(expr("meta", vec![Attr::u32(1, 1), Attr::u32(2, 15)]));
         foreign.push(expr(
             "cmp",
@@ -138,12 +134,12 @@ pub(super) fn guards(program: &mut Program<'_>, scope: &RouterScope, chain: &str
         ));
         program.end(chain, foreign, 0)?;
         let mut spoofed = ipv4();
-        spoofed.extend(known(incoming));
+        spoofed.extend(known(incoming)?);
         spoofed.extend(
             Loads::new()
                 .index(incoming)
                 .address(incoming)
-                .absent(SOURCE),
+                .absent(SOURCE, &SOURCE_KEY)?,
         );
         program.end(chain, spoofed, 0)?;
     }
@@ -154,7 +150,7 @@ pub(super) fn guards(program: &mut Program<'_>, scope: &RouterScope, chain: &str
 /// protocol and ports. Input sees no outgoing and output no incoming interface,
 /// so each chain matches exactly the rules that were compiled into it.
 pub(super) fn grants(program: &mut Program<'_>, scope: &RouterScope, chain: &str) -> Result<()> {
-    for (set, ported) in [(ANY, false), (PORTED, true)] {
+    for (set, key, ported) in [(ANY, &ANY_KEY[..], false), (PORTED, &PORTED_KEY[..], true)] {
         if !scope
             .rules
             .iter()
@@ -163,14 +159,14 @@ pub(super) fn grants(program: &mut Program<'_>, scope: &RouterScope, chain: &str
             continue;
         }
         let mut expressions = ipv4();
-        expressions.extend(known(true));
-        expressions.extend(known(false));
+        expressions.extend(known(true)?);
+        expressions.extend(known(false)?);
         let mut loads = Loads::new();
         loads.index(true).index(false).address(true).address(false);
         if ported {
             loads.protocol().port(true).port(false);
         }
-        expressions.extend(loads.lookup(set));
+        expressions.extend(loads.lookup(set, key)?);
         program.end(chain, expressions, 1)?;
     }
     Ok(())
@@ -181,15 +177,14 @@ pub(super) fn denials(program: &mut Program<'_>, scope: &RouterScope, chain: &st
         return Ok(());
     }
     for incoming in directions(chain) {
-        program.end(chain, Loads::new().index(incoming).lookup(INDEX_SET), 0)?;
         program.end(
             chain,
-            Loads::new()
-                .push(
-                    |at| super::hostgrant::meta_to(if incoming { 6 } else { 7 }, at),
-                    NAME,
-                )
-                .lookup(NAME_SET),
+            Loads::new().index(incoming).lookup(INDEX_SET, &INDEX_KEY)?,
+            0,
+        )?;
+        program.end(
+            chain,
+            Loads::new().name(incoming).lookup(NAME_SET, &NAME_KEY)?,
             0,
         )?;
     }