@push.rocks/smartnftables 4.3.1 → 4.5.0

package/rust/src/egress_poolguardpublished_tests.rs

@@ -0,0 +1,418 @@
+//! Publications through the allocation-pool guard: a publication translates an
+//! inbound flow from the uplink into a pool (the router's transit address), which
+//! the guard denies by its current destination and, on the reply, by its current
+//! source. A guard publication admits exactly that forwarded flow and its replies;
+//! every other tuple meets the decision of the guard without it.
+use super::hostgrant_tests::{
+    bytes, chains, decide, granted, host_grant, normalized, prepared, Flow, ACK, ESTABLISHED,
+};
+use super::tests::pool_guard;
+use super::Prepared;
+use serde_json::{json, Value};
+
+const NEW: u32 = 8;
+const SYN: u8 = 0x02;
+const CLIENT: [u8; 4] = [198, 51, 100, 7];
+const UPLINK: [u8; 4] = [192, 0, 2, 2];
+const TRANSIT: [u8; 4] = [10, 240, 0, 1];
+const ENS18: Option<(u32, &str)> = Some((2, "ens18"));
+const HANDOFF: Option<(u32, &str)> = Some((4, "handoff"));
+
+fn port(protocol: &str, first: u16, end: Option<u16>, target: u16, address: &str) -> Value {
+    let mut value =
+        json!({"protocol":protocol,"hostPort":first,"targetPort":target,"targetAddress":address});
+    if let Some(end) = end {
+        value["hostPortEnd"] = json!(end);
+    }
+    value
+}
+fn published(mut value: Value, ports: Value) -> Value {
+    value["scope"]["publishedPorts"] = ports;
+    value
+}
+/// One port translated to another, and a range that keeps every port.
+fn fixture() -> Value {
+    published(
+        pool_guard(),
+        json!([
+            port("tcp", 443, None, 8443, "10.240.0.1"),
+            port("udp", 20000, Some(20200), 20000, "10.240.0.1")
+        ]),
+    )
+}
+/// The opening of an inbound publication as the forward hook sees it: after the
+/// destination NAT to the transit address, the original destination still the uplink.
+fn inbound(protocol: u8, outside: u16, inside: u16) -> Flow {
+    Flow {
+        input: ENS18,
+        output: HANDOFF,
+        protocol,
+        source: CLIENT,
+        destination: TRANSIT,
+        source_port: 40000,
+        destination_port: inside,
+        tcp_flags: if protocol == 6 { SYN } else { 0 },
+        state: NEW,
+        reply: false,
+        zone: 0,
+        original: (CLIENT, UPLINK, 40000, outside),
+        uid: None,
+        label: [0; 16],
+    }
+}
+/// The workload's reply as the forward hook sees it, before the reverse NAT.
+fn reply(flow: Flow) -> Flow {
+    Flow {
+        input: flow.output,
+        output: flow.input,
+        source: flow.destination,
+        destination: flow.source,
+        source_port: flow.destination_port,
+        destination_port: flow.source_port,
+        tcp_flags: if flow.protocol == 6 { ACK } else { 0 },
+        state: ESTABLISHED,
+        reply: true,
+        ..flow
+    }
+}
+/// Every admitted variant: the opening, the established original direction and
+/// the reply, for the one-port and every boundary of the range.
+fn admitted() -> Vec<Flow> {
+    let mut flows = Vec::new();
+    for opening in [
+        inbound(6, 443, 8443),
+        inbound(17, 20000, 20000),
+        inbound(17, 20100, 20100),
+        inbound(17, 20200, 20200),
+    ] {
+        flows.push(opening);
+        flows.push(Flow {
+            state: ESTABLISHED,
+            tcp_flags: if opening.protocol == 6 { ACK } else { 0 },
+            ..opening
+        });
+        flows.push(reply(opening));
+    }
+    flows
+}
+/// Tuples the publications do not name, each of which the guard alone denies.
+fn foreign() -> Vec<Flow> {
+    let tcp = inbound(6, 443, 8443);
+    let udp = inbound(17, 20000, 20000);
+    vec![
+        // An original destination in a pool: no translation from outside every pool.
+        Flow {
+            original: (CLIENT, [10, 240, 0, 9], 40000, 443),
+            ..tcp
+        },
+        Flow {
+            original: (CLIENT, TRANSIT, 40000, 8443),
+            ..tcp
+        },
+        reply(Flow {
+            original: (CLIENT, [10, 241, 0, 9], 40000, 20000),
+            ..udp
+        }),
+        // Another target address, target port, published port or protocol.
+        Flow {
+            destination: [10, 240, 0, 3],
+            ..tcp
+        },
+        Flow {
+            destination_port: 8444,
+            ..tcp
+        },
+        Flow {
+            original: (CLIENT, UPLINK, 40000, 444),
+            ..tcp
+        },
+        Flow {
+            original: (CLIENT, UPLINK, 40000, 8443),
+            ..tcp
+        },
+        Flow {
+            protocol: 17,
+            tcp_flags: 0,
+            ..tcp
+        },
+        Flow {
+            protocol: 6,
+            tcp_flags: SYN,
+            ..udp
+        },
+        inbound(17, 19999, 19999),
+        inbound(17, 20201, 20201),
+        reply(inbound(17, 20201, 20201)),
+        // Another conntrack zone, a non-SYN opening, a reply that is not ESTABLISHED
+        // and the reply direction carrying the original direction's tuple.
+        Flow { zone: 7, ..tcp },
+        reply(Flow { zone: 7, ..udp }),
+        Flow {
+            tcp_flags: ACK,
+            ..tcp
+        },
+        Flow {
+            state: NEW,
+            ..reply(tcp)
+        },
+    ]
+}
+
+#[test]
+fn pool_guard_publications_admit_exactly_the_forwarded_flow_and_its_reply() {
+    let baseline = prepared(pool_guard());
+    let with = prepared(fixture());
+    for flow in admitted() {
+        assert_eq!(
+            decide(&baseline, "forward", &flow).verdict,
+            0,
+            "{:?} baseline",
+            flow.destination_port
+        );
+        let decision = decide(&with, "forward", &flow);
+        assert_eq!(
+            (decision.verdict, decision.chain.as_str()),
+            (1, "pool_guard"),
+            "{:?}",
+            flow.destination_port
+        );
+    }
+    for (index, flow) in foreign().iter().enumerate() {
+        assert_eq!(
+            decide(&baseline, "forward", flow).verdict,
+            0,
+            "variant {index} baseline"
+        );
+        assert_eq!(
+            decide(&with, "forward", flow),
+            decide(&baseline, "forward", flow),
+            "variant {index}"
+        );
+    }
+    // The reply direction carrying the original direction's tuple is not from a
+    // pool, so the guard passes it with or without publications.
+    let turned = Flow {
+        reply: true,
+        state: ESTABLISHED,
+        ..inbound(6, 443, 8443)
+    };
+    assert_eq!(
+        decide(&with, "forward", &turned),
+        decide(&baseline, "forward", &turned)
+    );
+}
+
+#[test]
+fn pool_guard_publications_add_only_their_admissions_to_the_guard_chain() {
+    let baseline = prepared(pool_guard());
+    let with = prepared(fixture());
+    let graph = chains(&with);
+    let reference = chains(&baseline);
+    assert_eq!(
+        graph.keys().collect::<Vec<_>>(),
+        reference.keys().collect::<Vec<_>>()
+    );
+    for name in ["input", "forward", "output", "pool_reply"] {
+        assert_eq!(graph[name], reference[name], "{name}");
+    }
+    // Whatever the number of publications: the ESTABLISHED admission and one
+    // opening per protocol, right after the original-destination denial of every pool.
+    let pools = 2;
+    assert_eq!(
+        graph["pool_guard"].len(),
+        reference["pool_guard"].len() + 1 + 2
+    );
+    assert_eq!(
+        graph["pool_guard"][..pools],
+        reference["pool_guard"][..pools]
+    );
+    assert_eq!(
+        graph["pool_guard"][pools + 3..],
+        reference["pool_guard"][pools..]
+    );
+    // A host-local flow with a publication's tuples, translated from outside every
+    // pool, is the same publication on the local hooks.
+    for flow in admitted() {
+        for (chain, local) in [
+            (
+                "input",
+                Flow {
+                    output: None,
+                    ..flow
+                },
+            ),
+            (
+                "output",
+                Flow {
+                    input: None,
+                    ..flow
+                },
+            ),
+        ] {
+            assert_eq!(
+                decide(&baseline, chain, &local).verdict,
+                0,
+                "{chain} baseline"
+            );
+            assert_eq!(decide(&with, chain, &local).verdict, 1, "{chain}");
+        }
+    }
+}
+
+#[test]
+fn pool_guard_publications_absent_and_empty_keep_the_digest_and_compiled_bytes() {
+    let baseline = prepared(pool_guard());
+    assert!(!serde_json::to_string(&baseline.policy)
+        .unwrap()
+        .contains("publishedPorts"));
+    let empty = prepared(published(pool_guard(), json!([])));
+    assert_eq!(empty, baseline);
+    assert_eq!(bytes(&empty), bytes(&baseline));
+    let with = prepared(fixture());
+    assert_ne!(with.digest, baseline.digest);
+    // Canonical order: a reordered list is the same policy.
+    let reordered = prepared(published(
+        pool_guard(),
+        json!([
+            port("udp", 20000, Some(20200), 20000, "10.240.0.1"),
+            port("tcp", 443, None, 8443, "10.240.0.1")
+        ]),
+    ));
+    assert_eq!(reordered, with);
+    // Host grants and publications are independent exceptions of one guard.
+    let both = prepared(granted(
+        fixture(),
+        json!([host_grant("tcp", "10.240.0.1", "10.241.0.2", 8080)]),
+    ));
+    for flow in admitted() {
+        assert_eq!(decide(&both, "forward", &flow).verdict, 1);
+    }
+}
+
+#[test]
+fn pool_guard_publications_refuse_every_entry_outside_the_contract() {
+    let refused = |ports: Value| normalized(published(pool_guard(), ports)).is_err();
+    // A target outside every pool needs no exception and is no publication into one.
+    assert!(refused(json!([port("tcp", 443, None, 8443, "10.250.0.1")])));
+    assert!(refused(json!([port(
+        "tcp",
+        443,
+        None,
+        8443,
+        "10.240.0.0/16"
+    )])));
+    assert!(refused(json!([port("tcp", 443, None, 8443, "127.0.0.1")])));
+    assert!(refused(json!([port(
+        "sctp",
+        443,
+        None,
+        8443,
+        "10.240.0.1"
+    )])));
+    assert!(refused(json!([port("tcp", 0, None, 8443, "10.240.0.1")])));
+    assert!(refused(json!([port("tcp", 443, None, 0, "10.240.0.1")])));
+    // A range keeps every port and runs upward; one port has no end.
+    assert!(refused(json!([port(
+        "udp",
+        20000,
+        Some(20200),
+        30000,
+        "10.240.0.1"
+    )])));
+    assert!(refused(json!([port(
+        "udp",
+        20000,
+        Some(20000),
+        20000,
+        "10.240.0.1"
+    )])));
+    assert!(refused(json!([port(
+        "udp",
+        20000,
+        Some(19999),
+        20000,
+        "10.240.0.1"
+    )])));
+    // One protocol and port is published once.
+    assert!(refused(json!([
+        port("tcp", 443, None, 8443, "10.240.0.1"),
+        port("tcp", 443, None, 8444, "10.240.0.1")
+    ])));
+    assert!(refused(json!([
+        port("udp", 20000, Some(20200), 20000, "10.240.0.1"),
+        port("udp", 20200, None, 5060, "10.240.0.1")
+    ])));
+    assert!(!refused(json!([
+        port("tcp", 443, None, 8443, "10.240.0.1"),
+        port("udp", 443, None, 8443, "10.240.0.1")
+    ])));
+    let mut unknown = port("tcp", 443, None, 8443, "10.240.0.1");
+    unknown["hostIp"] = json!("192.0.2.2");
+    assert!(refused(json!([unknown])));
+}
+
+#[test]
+fn pool_guard_publications_are_bounded_and_fit_the_largest_guard() {
+    let many = |count: u16| -> Value {
+        json!((0..count)
+            .map(|index| port("tcp", 1000 + index, None, 1000 + index, "10.240.0.1"))
+            .collect::<Vec<_>>())
+    };
+    match normalized(published(pool_guard(), many(1025))) {
+        Err(crate::Error::Exhausted(bound)) => assert_eq!(bound.name, "publishedPorts"),
+        other => panic!("{other:?}"),
+    }
+    // The largest guard: 64 pools, 1024 host grants, 1024 publications and every
+    // loopback port owner compile inside the atomic budget.
+    let mut guard = pool_guard();
+    guard["scope"]["prefixes"] = json!((0..64)
+        .map(|part| format!("10.{part}.0.0/16"))
+        .collect::<Vec<_>>());
+    let grants: Vec<_> = (0..1024_u16)
+        .map(|index| {
+            host_grant(
+                if index % 2 == 0 { "tcp" } else { "udp" },
+                "10.40.0.1",
+                "10.41.0.2",
+                20000 + index / 2,
+            )
+        })
+        .collect();
+    guard["scope"]["hostGrants"] = json!(grants);
+    guard["scope"]["localTcpPortOwners"] = json!((0..8)
+        .map(|index| json!({"address":"127.0.0.1","port":10010 + index,"uid":0}))
+        .collect::<Vec<_>>());
+    let ports: Vec<_> = (0..1024_u16)
+        .map(|index| {
+            port(
+                if index % 2 == 0 { "tcp" } else { "udp" },
+                1000 + index / 2,
+                None,
+                1000 + index / 2,
+                "10.40.0.1",
+            )
+        })
+        .collect();
+    let largest: Prepared = prepared(published(guard, json!(ports)));
+    let program = largest
+        .program(&format!("snft_{}", "x".repeat(59)))
+        .unwrap();
+    let size = |kinds: &[u16]| -> usize {
+        program
+            .iter()
+            .filter(|(kind, _)| kinds.contains(kind))
+            .map(|(_, attributes)| crate::wire::encode_attrs(attributes).len() + 20)
+            .sum()
+    };
+    let (graph, elements) = (size(&[3, 6, 9]), size(&[12]));
+    assert!(
+        program.len() < 768
+            && graph <= super::compile::RULE_BYTES
+            && graph + elements <= super::compile::TARGET_BYTES
+    );
+    assert!(768 * (20 + 72 + 36 + 12) + graph + elements + 64 <= crate::wire::BATCH_BYTES);
+    println!(
+        "POOL_GUARD_PUBLISHED_MAX prefixes=64 grants=1024 owners=8 published=1024 operations={} rule_bytes={graph} element_bytes={elements}",
+        program.len()
+    );
+}

package/rust/src/egress_tests.rs

@@ -507,8 +507,27 @@ fn prepared(value: Value) -> Prepared {
     normalized(value).unwrap().prepare().unwrap()
 }
 fn program_bytes(prepared: &Prepared, table: &str) -> Vec<u8> {
+    encoded(prepared.program(table).unwrap())
+}
+/// LEGACY(<=4.4.x): the program as releases before typed sets compiled it,
+/// whose goldens it must still reproduce byte for byte, so their kernel graphs
+/// stay adoptable.
+fn untyped_program_bytes(prepared: &Prepared, table: &str) -> Vec<u8> {
+    encoded(
+        prepared
+            .program(table)
+            .unwrap()
+            .into_iter()
+            .map(|(kind, attributes)| match kind {
+                9 => (kind, crate::owner::untyped_set(&attributes)),
+                _ => (kind, attributes),
+            })
+            .collect(),
+    )
+}
+fn encoded(program: Vec<(u16, Vec<crate::wire::Attr>)>) -> Vec<u8> {
     let mut bytes = Vec::new();
-    for (kind, attributes) in prepared.program(table).unwrap() {
+    for (kind, attributes) in program {
         let encoded = crate::wire::encode_attrs(&attributes);
         bytes.extend(kind.to_be_bytes());
         bytes.extend((encoded.len() as u32).to_be_bytes());
@@ -606,12 +625,20 @@ fn host_v2_published_ports_compile_uplink_dnat_and_exact_forward_admission() {
     for (_, expressions) in &forward[..4] {
         assert_eq!(expressions[expressions.len() - 2], "lookup");
     }
-    let bytes = program_bytes(&published, "snft_v2_host_golden");
+    // The graph of 4.4.x, byte for byte, once its sets are untyped again.
+    let bytes = untyped_program_bytes(&published, "snft_v2_host_golden");
     assert_eq!(bytes.len(), 30988);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
         "b36f359c6439e9fcd77c291c7dac7854014225d3de1f8a4e49df6fec6ae570c4"
     );
+    // Re-frozen with typed sets in 4.5.0.
+    let bytes = program_bytes(&published, "snft_v2_host_golden");
+    assert_eq!(bytes.len(), 31168);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "609f2388e3c5cf45b921182c17252c072c4db2f07e3cc605e282faddd937d458"
+    );
 }
 
 #[test]
@@ -724,12 +751,20 @@ fn router_v2_without_published_ports_keeps_its_exact_digest_and_compiled_bytes()
     );
     // Re-frozen with the set-backed router graph of 3.0.0: the digest is the
     // policy's and did not change, the compiled graph did.
-    let bytes = program_bytes(&baseline, "snft_v2_router_golden");
+    // The graph of 4.4.x, byte for byte, once its sets are untyped again.
+    let bytes = untyped_program_bytes(&baseline, "snft_v2_router_golden");
     assert_eq!(bytes.len(), 47674);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
         "ea609865f32031f6835ef4fc7f67f5754a15f466580308bdccc9db87d4ccd2c5"
     );
+    // Re-frozen with typed sets in 4.5.0.
+    let bytes = program_bytes(&baseline, "snft_v2_router_golden");
+    assert_eq!(bytes.len(), 48362);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "47280ecb596125d6421b1ab42e2d768e53844f55d7d0f130fe31a8cd5b9a5668"
+    );
     let serialized = serde_json::to_string(&baseline.policy).unwrap();
     assert!(!serialized.contains("publishedPorts"));
     // An explicit empty publication is the same canonical policy, digest and graph.
@@ -796,12 +831,20 @@ fn router_v2_published_ports_compile_handoff_dnat_classification_and_admission()
     assert!(incoming[4..]
         .iter()
         .any(|expressions| expressions.contains(&"ct".to_string())));
-    let bytes = program_bytes(&published, "snft_v2_router_golden");
+    // The graph of 4.4.x, byte for byte, once its sets are untyped again.
+    let bytes = untyped_program_bytes(&published, "snft_v2_router_golden");
     assert_eq!(bytes.len(), 55494);
     assert_eq!(
         format!("{:x}", Sha256::digest(&bytes)),
         "60a7ba1c15d49e5ff54cfbf9fbe2d72f03973acd1a897eef2d975547ef4abf5b"
     );
+    // Re-frozen with typed sets in 4.5.0.
+    let bytes = program_bytes(&published, "snft_v2_router_golden");
+    assert_eq!(bytes.len(), 56454);
+    assert_eq!(
+        format!("{:x}", Sha256::digest(&bytes)),
+        "1d2a72707bc10ed689e3f9b4c1cb3e798e89c01fc97115078dcd32e891b22306"
+    );
 }
 
 #[test]