@push.rocks/smartnftables 4.4.0 → 4.5.0

package/rust/src/egress.keys.rs

@@ -1,10 +1,309 @@
 //! Concatenated set keys shared by every set-backed part of the compiled graph:
-//! the loads that build a key in consecutive 32-bit registers, element bounds
-//! built field by field, the disjoint union the kernel's interval backend needs,
-//! and set declarations that are never created empty.
-use super::hostgrant::{ct_reply_to, ct_to, lookup, meta_to, payload_to, register};
+//! the fields a key is built from, the loads that build it in consecutive 32-bit
+//! registers, element bounds built field by field, the disjoint union the
+//! kernel's interval backend needs, and set declarations that are never created
+//! empty.
+//!
+//! A [`Field`] is the single source of a key field. Its loads fill the registers
+//! a lookup reads, and a set declared on it carries the types nft needs to list
+//! the set and every rule that looks it up: the key and data types, their byte
+//! orders and the `typeof` expressions, exactly as nftables 1.0.9 writes them.
+use super::hostgrant::{ct_to, lookup, meta_to, payload_to, register};
 use super::*;
 
+/// The expression that loads a field, which is also its nft `typeof`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Source {
+    /// A meta key (`NFT_META_*`).
+    Meta(u32),
+    /// The header field at `offset` from `base` (1 network, 2 transport), with
+    /// nft's protocol description (`enum proto_desc_id`) and header template.
+    Payload {
+        base: u32,
+        offset: u32,
+        description: u32,
+        template: u32,
+    },
+    /// A conntrack key, of the original (0) or reply (1) tuple, or of neither.
+    Ct { key: u32, direction: Option<u8> },
+}
+
+/// One key or data field: its value's length and nft's description of it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) struct Field {
+    /// The value's bytes. A key pads every field to whole 32-bit registers.
+    pub(super) length: u32,
+    /// nft's datatype (`enum datatypes`).
+    datatype: u32,
+    /// nft's byte order of the value: host (1) or big endian (2).
+    byteorder: u32,
+    source: Source,
+    /// nft's spelling of the expression, as `typeof` names it.
+    pub(super) name: &'static str,
+}
+
+const HOST: u32 = 1;
+const BIG: u32 = 2;
+const IFINDEX: u32 = 20;
+const IFNAME: u32 = 41;
+const INET_PROTOCOL: u32 = 12;
+const IPV4_ADDRESS: u32 = 7;
+const INET_SERVICE: u32 = 13;
+const INTEGER: u32 = 4;
+const CT_LABEL_TYPE: u32 = 30;
+/// nft's protocol descriptions of the IPv4 header and of the transport header
+/// (`th`), whose templates number the fields from 1.
+const IP_HEADER: u32 = 12;
+const TRANSPORT_HEADER: u32 = 11;
+
+const fn meta_field(key: u32, length: u32, datatype: u32, name: &'static str) -> Field {
+    Field {
+        length,
+        datatype,
+        byteorder: HOST,
+        source: Source::Meta(key),
+        name,
+    }
+}
+const fn address_field(offset: u32, template: u32, name: &'static str) -> Field {
+    Field {
+        length: ADDRESS,
+        datatype: IPV4_ADDRESS,
+        byteorder: BIG,
+        source: Source::Payload {
+            base: 1,
+            offset,
+            description: IP_HEADER,
+            template,
+        },
+        name,
+    }
+}
+const fn port_field(offset: u32, template: u32, name: &'static str) -> Field {
+    Field {
+        length: PORT,
+        datatype: INET_SERVICE,
+        byteorder: BIG,
+        source: Source::Payload {
+            base: 2,
+            offset,
+            description: TRANSPORT_HEADER,
+            template,
+        },
+        name,
+    }
+}
+const fn ct_field(
+    key: u32,
+    direction: Option<u8>,
+    length: u32,
+    datatype: u32,
+    byteorder: u32,
+    name: &'static str,
+) -> Field {
+    Field {
+        length,
+        datatype,
+        byteorder,
+        source: Source::Ct { key, direction },
+        name,
+    }
+}
+
+pub(super) const IIF: Field = meta_field(4, INDEX, IFINDEX, "meta iif");
+pub(super) const OIF: Field = meta_field(5, INDEX, IFINDEX, "meta oif");
+pub(super) const IIFNAME: Field = meta_field(6, NAME, IFNAME, "meta iifname");
+pub(super) const OIFNAME: Field = meta_field(7, NAME, IFNAME, "meta oifname");
+pub(super) const L4PROTO: Field = meta_field(16, PROTOCOL, INET_PROTOCOL, "meta l4proto");
+pub(super) const CT_PROTOCOL: Field =
+    ct_field(10, None, PROTOCOL, INET_PROTOCOL, BIG, "ct protocol");
+pub(super) const IP_SADDR: Field = address_field(12, 11, "ip saddr");
+pub(super) const IP_DADDR: Field = address_field(16, 12, "ip daddr");
+pub(super) const TH_SPORT: Field = port_field(0, 1, "th sport");
+pub(super) const TH_DPORT: Field = port_field(2, 2, "th dport");
+pub(super) const CT_ORIGINAL_SADDR: Field = ct_field(
+    19,
+    Some(0),
+    ADDRESS,
+    IPV4_ADDRESS,
+    BIG,
+    "ct original ip saddr",
+);
+pub(super) const CT_ORIGINAL_DADDR: Field = ct_field(
+    20,
+    Some(0),
+    ADDRESS,
+    IPV4_ADDRESS,
+    BIG,
+    "ct original ip daddr",
+);
+pub(super) const CT_ORIGINAL_SPORT: Field = ct_field(
+    11,
+    Some(0),
+    PORT,
+    INET_SERVICE,
+    BIG,
+    "ct original proto-src",
+);
+pub(super) const CT_ORIGINAL_DPORT: Field = ct_field(
+    12,
+    Some(0),
+    PORT,
+    INET_SERVICE,
+    BIG,
+    "ct original proto-dst",
+);
+pub(super) const CT_REPLY_SADDR: Field =
+    ct_field(19, Some(1), ADDRESS, IPV4_ADDRESS, BIG, "ct reply ip saddr");
+pub(super) const CT_REPLY_SPORT: Field =
+    ct_field(11, Some(1), PORT, INET_SERVICE, BIG, "ct reply proto-src");
+pub(super) const CT_ZONE: Field = ct_field(17, None, ZONE, INTEGER, HOST, "ct zone");
+pub(super) const CT_LABEL: Field = ct_field(13, None, LABEL, CT_LABEL_TYPE, HOST, "ct label");
+
+/// nft's expression types (`enum expr_types`) in set userdata.
+const PAYLOAD_EXPRESSION: u32 = 7;
+const META_EXPRESSION: u32 = 9;
+const CT_EXPRESSION: u32 = 12;
+const CONCAT_EXPRESSION: u32 = 13;
+/// nft 1.0.9 describes at most this many concatenated fields by `typeof`: its
+/// concatenation userdata is bounded by `NFT_REG32_SIZE` (4) where the register
+/// count was meant. A longer key is described by its type alone, as nft does
+/// for a set declared by `type`.
+const TYPEOF_FIELDS: usize = 4;
+/// Bits of one field's type within a concatenation's type; nft keeps the type
+/// in 32 bits and drops what a long concatenation shifts out.
+const TYPE_BITS: u32 = 6;
+
+impl Field {
+    /// The register-padded bytes the field occupies in a key.
+    pub(super) fn padded(self) -> u32 {
+        self.length.div_ceil(4) * 4
+    }
+    /// The load of this field into the 32-bit register `index`.
+    pub(super) fn load(self, index: u32) -> Attr {
+        match self.source {
+            Source::Meta(key) => meta_to(key, index),
+            Source::Payload { base, offset, .. } => payload_to(base, offset, self.length, index),
+            Source::Ct { key, direction } => ct_to(key, direction, index),
+        }
+    }
+    /// Whether a lookup may load `self` where a set declares `declared`: the
+    /// same length and type, as when one direction's field stands for the other.
+    fn fits(self, declared: Field) -> bool {
+        self.length == declared.length && self.datatype == declared.datatype
+    }
+    /// nft's expression type and its userdata (`build_udata`).
+    fn expression(self) -> Result<(u32, Vec<u8>)> {
+        let mut data = Vec::new();
+        let kind = match self.source {
+            Source::Meta(key) => {
+                tlv_number(&mut data, 0, key)?;
+                META_EXPRESSION
+            }
+            Source::Payload {
+                description,
+                template,
+                ..
+            } => {
+                tlv_number(&mut data, 0, description)?;
+                tlv_number(&mut data, 1, template)?;
+                PAYLOAD_EXPRESSION
+            }
+            Source::Ct { key, direction } => {
+                tlv_number(&mut data, 0, key)?;
+                // nft stores the direction as a signed byte: none is -1.
+                tlv_number(&mut data, 1, direction.map_or(u32::MAX, u32::from))?;
+                CT_EXPRESSION
+            }
+        };
+        Ok((kind, data))
+    }
+}
+
+/// One userdata attribute: a type byte, a length byte and the value.
+fn tlv(out: &mut Vec<u8>, kind: u8, value: &[u8]) -> Result<()> {
+    out.push(kind);
+    out.push(u8::try_from(value.len()).map_err(|_| Error::Invalid)?);
+    out.extend_from_slice(value);
+    Ok(())
+}
+/// libnftnl writes userdata numbers in host byte order.
+fn tlv_number(out: &mut Vec<u8>, kind: u8, value: u32) -> Result<()> {
+    tlv(out, kind, &value.to_ne_bytes())
+}
+
+/// The bytes of a key: every field padded to whole registers.
+pub(super) fn key_length(fields: &[Field]) -> u32 {
+    fields.iter().map(|field| field.padded()).sum()
+}
+/// The bytes of map data: one field as it is, a concatenation padded.
+pub(super) fn data_length(fields: &[Field]) -> u32 {
+    match fields {
+        [field] => field.length,
+        _ => key_length(fields),
+    }
+}
+/// nft's type of a key or data: a field's own, or a concatenation's, each
+/// field's type in turn.
+pub(super) fn datatype(fields: &[Field]) -> u32 {
+    match fields {
+        [field] => field.datatype,
+        _ => fields
+            .iter()
+            .fold(0, |result, field| (result << TYPE_BITS) | field.datatype),
+    }
+}
+/// nft's byte order of a key or data: a field's own; a concatenation has none.
+fn byteorder(fields: &[Field]) -> u32 {
+    match fields {
+        [field] => field.byteorder,
+        _ => 0,
+    }
+}
+/// nft's `typeof` description of a key or data (`set_key_expression`), or none
+/// for a concatenation longer than nft describes.
+fn typeof_description(fields: &[Field]) -> Result<Option<Vec<u8>>> {
+    let (kind, data) = match fields {
+        [field] => field.expression()?,
+        _ if fields.len() <= TYPEOF_FIELDS => {
+            let mut data = Vec::new();
+            for (position, field) in (0_u8..).zip(fields) {
+                let (kind, description) = field.expression()?;
+                let mut nested = Vec::new();
+                tlv_number(&mut nested, 0, kind)?;
+                tlv(&mut nested, 1, &description)?;
+                tlv(&mut data, position, &nested)?;
+            }
+            (CONCAT_EXPRESSION, data)
+        }
+        _ => return Ok(None),
+    };
+    let mut result = Vec::new();
+    tlv_number(&mut result, 0, kind)?;
+    tlv(&mut result, 1, &data)?;
+    Ok(Some(result))
+}
+/// The set userdata nft writes (`mnl_nft_set_add`): the key's byte order, a
+/// map's data byte order, the key's and a map's data `typeof`, and for a map
+/// that its data is no interval.
+pub(super) fn userdata(key: &[Field], data: Option<&[Field]>) -> Result<Vec<u8>> {
+    let mut result = Vec::new();
+    tlv_number(&mut result, 0, byteorder(key))?;
+    if let Some(data) = data {
+        tlv_number(&mut result, 1, byteorder(data))?;
+    }
+    if let Some(description) = typeof_description(key)? {
+        tlv(&mut result, 3, &description)?;
+    }
+    if let Some(data) = data {
+        if let Some(description) = typeof_description(data)? {
+            tlv(&mut result, 4, &description)?;
+        }
+        tlv_number(&mut result, 6, 0)?;
+    }
+    Ok(result)
+}
+
 /// Field byte lengths. Each field occupies whole 32-bit registers of the key.
 pub(super) const INDEX: u32 = 4;
 pub(super) const NAME: u32 = 16;
@@ -16,94 +315,116 @@ pub(super) const LABEL: u32 = 16;
 
 /// Key loads into consecutive 32-bit registers, starting where a lookup reads.
 pub(super) struct Loads {
-    expressions: Vec<Attr>,
-    index: u32,
+    fields: Vec<Field>,
 }
 impl Loads {
     pub(super) fn new() -> Self {
-        Self {
-            expressions: Vec::new(),
-            index: 4,
-        }
+        Self { fields: Vec::new() }
     }
-    pub(super) fn push(&mut self, load: impl FnOnce(u32) -> Attr, length: u32) -> &mut Self {
-        self.expressions.push(load(self.index));
-        self.index += length.div_ceil(4);
+    fn push(&mut self, field: Field) -> &mut Self {
+        self.fields.push(field);
         self
     }
     /// An interface index; an absent interface loads as index 0.
     pub(super) fn index(&mut self, incoming: bool) -> &mut Self {
-        self.push(|at| meta_to(if incoming { 4 } else { 5 }, at), INDEX)
+        self.push(if incoming { IIF } else { OIF })
+    }
+    /// An interface name; an absent interface loads as "".
+    pub(super) fn name(&mut self, incoming: bool) -> &mut Self {
+        self.push(if incoming { IIFNAME } else { OIFNAME })
     }
-    /// An interface index and name; an absent interface loads as 0 and "".
+    /// An interface index and name.
     pub(super) fn link(&mut self, incoming: bool) -> &mut Self {
-        self.index(incoming)
-            .push(|at| meta_to(if incoming { 6 } else { 7 }, at), NAME)
+        self.index(incoming).name(incoming)
     }
     pub(super) fn protocol(&mut self) -> &mut Self {
-        self.push(|at| meta_to(16, at), PROTOCOL)
+        self.push(L4PROTO)
     }
     pub(super) fn protocols(&mut self) -> &mut Self {
-        self.protocol().push(|at| ct_to(10, false, at), PROTOCOL)
+        self.protocol().push(CT_PROTOCOL)
     }
     pub(super) fn address(&mut self, source: bool) -> &mut Self {
-        self.push(
-            |at| payload_to(1, if source { 12 } else { 16 }, 4, at),
-            ADDRESS,
-        )
+        self.push(if source { IP_SADDR } else { IP_DADDR })
     }
     pub(super) fn port(&mut self, source: bool) -> &mut Self {
-        self.push(|at| payload_to(2, if source { 0 } else { 2 }, 2, at), PORT)
+        self.push(if source { TH_SPORT } else { TH_DPORT })
     }
     /// The originally tracked address and port of one side.
     pub(super) fn original(&mut self, source: bool) -> &mut Self {
         self.original_address(source).original_port(source)
     }
     pub(super) fn original_address(&mut self, source: bool) -> &mut Self {
-        self.push(|at| ct_to(if source { 19 } else { 20 }, true, at), ADDRESS)
+        self.push(if source {
+            CT_ORIGINAL_SADDR
+        } else {
+            CT_ORIGINAL_DADDR
+        })
     }
     pub(super) fn original_port(&mut self, source: bool) -> &mut Self {
-        self.push(|at| ct_to(if source { 11 } else { 12 }, true, at), PORT)
+        self.push(if source {
+            CT_ORIGINAL_SPORT
+        } else {
+            CT_ORIGINAL_DPORT
+        })
     }
     /// The reply tuple's source address and port: where a translated flow was
     /// translated to, whichever direction the packet travels.
     pub(super) fn translated(&mut self) -> &mut Self {
-        self.push(|at| ct_reply_to(19, at), ADDRESS)
-            .push(|at| ct_reply_to(11, at), PORT)
+        self.push(CT_REPLY_SADDR).push(CT_REPLY_SPORT)
     }
     pub(super) fn zone(&mut self) -> &mut Self {
-        self.push(|at| ct_to(17, false, at), ZONE)
+        self.push(CT_ZONE)
     }
     pub(super) fn label(&mut self) -> &mut Self {
-        self.push(|at| ct_to(13, false, at), LABEL)
-    }
-    fn finish(&mut self, set: &str, data: bool, invert: bool) -> Vec<Attr> {
-        let mut result = std::mem::take(&mut self.expressions);
-        self.index = 4;
+        self.push(CT_LABEL)
+    }
+    /// The loads, then the lookup in `set`, whose key `declared` the loads must
+    /// fit field by field.
+    fn finish(
+        &mut self,
+        set: &str,
+        declared: &[Field],
+        data: bool,
+        invert: bool,
+    ) -> Result<Vec<Attr>> {
+        let fields = std::mem::take(&mut self.fields);
+        require(
+            fields.len() == declared.len()
+                && fields
+                    .iter()
+                    .zip(declared)
+                    .all(|(field, declared)| field.fits(*declared)),
+        )?;
+        let mut result = Vec::new();
+        let mut index = 4;
+        for field in fields {
+            result.push(field.load(index));
+            index += field.length.div_ceil(4);
+        }
         let mut expression = lookup(set);
         if data || invert {
-            let mut fields = vec![Attr::string(1, set), Attr::u32(2, register(4))];
+            let mut attributes = vec![Attr::string(1, set), Attr::u32(2, register(4))];
             if data {
                 // The map's data replaces the key from the first register on.
-                fields.push(Attr::u32(3, register(4)));
+                attributes.push(Attr::u32(3, register(4)));
             }
-            fields.push(Attr::u32(5, u32::from(invert)));
-            expression = expr("lookup", fields);
+            attributes.push(Attr::u32(5, u32::from(invert)));
+            expression = expr("lookup", attributes);
         }
         result.push(expression);
-        result
+        Ok(result)
     }
     /// Membership of the loaded key.
-    pub(super) fn lookup(&mut self, set: &str) -> Vec<Attr> {
-        self.finish(set, false, false)
+    pub(super) fn lookup(&mut self, set: &str, declared: &[Field]) -> Result<Vec<Attr>> {
+        self.finish(set, declared, false, false)
     }
     /// A map lookup storing the element's data from the first key register on.
-    pub(super) fn map(&mut self, set: &str) -> Vec<Attr> {
-        self.finish(set, true, false)
+    pub(super) fn map(&mut self, set: &str, declared: &[Field]) -> Result<Vec<Attr>> {
+        self.finish(set, declared, true, false)
     }
     /// Absence of the loaded key.
-    pub(super) fn absent(&mut self, set: &str) -> Vec<Attr> {
-        self.finish(set, false, true)
+    pub(super) fn absent(&mut self, set: &str, declared: &[Field]) -> Result<Vec<Attr>> {
+        self.finish(set, declared, false, true)
     }
 }
 /// Stores `length` bytes of map data from the first key register into a
@@ -180,13 +501,13 @@ impl Key {
 }
 
 /// The byte range of each field inside the padded key.
-fn layout(fields: &[u32]) -> Vec<std::ops::Range<usize>> {
+fn layout(fields: &[Field]) -> Vec<std::ops::Range<usize>> {
     let mut at = 0;
     fields
         .iter()
-        .map(|length| {
-            let range = at..at + *length as usize;
-            at += length.div_ceil(4) as usize * 4;
+        .map(|field| {
+            let range = at..at + field.length as usize;
+            at += field.padded() as usize;
             range
         })
         .collect()
@@ -246,7 +567,7 @@ fn subtract(
 /// of a map may overlap only where they carry the same data; anything else is a
 /// policy the compiler cannot express and rejects.
 pub(super) fn disjoint(
-    fields: &[u32],
+    fields: &[Field],
     mut elements: Vec<IntervalElement>,
 ) -> Result<Vec<IntervalElement>> {
     let layout = layout(fields);
@@ -278,8 +599,8 @@ pub(super) fn interval(
     program: &mut Program<'_>,
     name: &str,
     id: u32,
-    fields: &[u32],
-    data: Option<u32>,
+    fields: &[Field],
+    data: Option<&[Field]>,
     elements: Vec<IntervalElement>,
 ) -> Result<bool> {
     if elements.is_empty() {
@@ -295,8 +616,8 @@ pub(super) fn exact(
     program: &mut Program<'_>,
     name: &str,
     id: u32,
-    key_length: u32,
-    data: Option<u32>,
+    key: &[Field],
+    data: Option<&[Field]>,
     mut elements: Vec<(Vec<u8>, Option<Vec<u8>>)>,
 ) -> Result<bool> {
     if elements.is_empty() {
@@ -305,7 +626,11 @@ pub(super) fn exact(
     elements.sort();
     elements.dedup();
     require(elements.windows(2).all(|pair| pair[0].0 != pair[1].0))?;
-    program.exact_set(name, id, key_length, data)?;
+    program.exact_set(name, id, key, data)?;
     program.exact_elements(name, elements)?;
     Ok(true)
 }
+
+#[cfg(test)]
+#[path = "egress_keys_tests.rs"]
+mod tests;