hysn-firecracker-python 1.0.5__tar.gz → 1.0.6__tar.gz

{hysn_firecracker_python-1.0.5/hysn_firecracker_python.egg-info → hysn_firecracker_python-1.0.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hysn-firecracker-python
-Version: 1.0.5
+Version: 1.0.6
 Summary: A Python client library to interact with Firecracker microVMs
 Author: Muhammad Yuga Nugraha
 License: MIT License

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.6}/firecracker/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.5'
-__version_tuple__ = version_tuple = (1, 0, 5)
+__version__ = version = '1.0.6'
+__version_tuple__ = version_tuple = (1, 0, 6)
 
-__commit_id__ = commit_id = 'g01bf110fc'
+__commit_id__ = commit_id = 'g3b21589ba'

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.6}/firecracker/network.py

@@ -497,6 +497,18 @@ class NetworkManager:
                     has_correct_dnat = False
 
                     for e in expr:
+                        # Current form: `fib daddr type local` (no host-IP match).
+                        if (
+                            "match" in e
+                            and e["match"]["op"] == "=="
+                            and "fib" in e["match"].get("left", {})
+                            and "daddr"
+                            in e["match"]["left"]["fib"].get("flags", [])
+                            and e["match"]["right"] == "local"
+                        ):
+                            has_daddr_match = True
+
+                        # Legacy form: exact `ip daddr <host_ip>` payload match.
                         if (
                             "match" in e
                             and e["match"]["op"] == "=="
@@ -684,6 +696,71 @@ class NetworkManager:
                 )
             return False
 
+    def _build_prerouting_rule(
+        self,
+        id: str,
+        family: str,
+        host_port: int,
+        dest_ip: str,
+        dest_port: int,
+        protocol: str = "tcp",
+    ):
+        """Build the PREROUTING DNAT rule for a port forward.
+
+        The destination-address match uses ``fib daddr type local`` instead of a
+        single detected host IP. This matches any address the host owns, on every
+        provider, with zero host-IP detection -- fixing the ``ip daddr 0.0.0.0``
+        bug where a failed/empty public-IP lookup produced a rule that never fired.
+
+        Args:
+            id (str): Machine ID, used in the rule comment.
+            family (str): nftables family ("ip" or "ip6").
+            host_port (int): Host port to forward.
+            dest_ip (str): IP address to forward to.
+            dest_port (int): Port to forward to.
+            protocol (str): Protocol to forward (default: "tcp").
+
+        Returns:
+            dict: An nftables ``add`` rule object for the PREROUTING chain.
+        """
+        return {
+            "add": {
+                "rule": {
+                    "family": family,
+                    "table": "nat",
+                    "chain": "PREROUTING",
+                    "comment": f"machine_id={id} host_port={host_port} vm_port={dest_port}",
+                    "expr": [
+                        {
+                            "match": {
+                                "op": "==",
+                                "left": {
+                                    "fib": {
+                                        "result": "type",
+                                        "flags": ["daddr"],
+                                    }
+                                },
+                                "right": "local",
+                            }
+                        },
+                        {
+                            "match": {
+                                "op": "==",
+                                "left": {
+                                    "payload": {
+                                        "protocol": protocol,
+                                        "field": "dport",
+                                    }
+                                },
+                                "right": host_port,
+                            }
+                        },
+                        {"dnat": {"addr": dest_ip, "port": dest_port}},
+                    ],
+                }
+            }
+        }
+
     def add_port_forward(
         self,
         id: str,
@@ -695,8 +772,13 @@ class NetworkManager:
     ):
         """Port forward a port to a new IP and port.
 
+        The PREROUTING rule matches ``fib daddr type local`` (any address the host
+        owns), so ``host_ip`` is used only to detect the IP family (IPv4 vs IPv6);
+        its value no longer appears in the rule match. This avoids the
+        ``ip daddr 0.0.0.0`` bug on hosts where public-IP detection fails.
+
         Args:
-            host_ip (str): IP address to forward from.
+            host_ip (str): IP address used only to detect IPv4/IPv6 family.
             host_port (int): Port to forward.
             dest_ip (str): IP address to forward to.
             dest_port (int): Port to forward to.
@@ -767,45 +849,11 @@ class NetworkManager:
                 }
             )
 
-        # Add PREROUTING rule
+        # Add PREROUTING rule (fib daddr type local -- no host-IP detection)
         rules["nftables"].append(
-            {
-                "add": {
-                    "rule": {
-                        "family": family,
-                        "table": "nat",
-                        "chain": "PREROUTING",
-                        "comment": f"machine_id={id} host_port={host_port} vm_port={dest_port}",
-                        "expr": [
-                            {
-                                "match": {
-                                    "op": "==",
-                                    "left": {
-                                        "payload": {
-                                            "protocol": family,
-                                            "field": "daddr",
-                                        }
-                                    },
-                                    "right": host_ip,
-                                }
-                            },
-                            {
-                                "match": {
-                                    "op": "==",
-                                    "left": {
-                                        "payload": {
-                                            "protocol": protocol,
-                                            "field": "dport",
-                                        }
-                                    },
-                                    "right": host_port,
-                                }
-                            },
-                            {"dnat": {"addr": dest_ip, "port": dest_port}},
-                        ],
-                    }
-                }
-            }
+            self._build_prerouting_rule(
+                id, family, host_port, dest_ip, dest_port, protocol
+            )
         )
 
         # Only add POSTROUTING rule if it doesn't already exist

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.6}/firecracker/utils.py

@@ -2,6 +2,7 @@ import os
 import random
 import string
 import signal
+import ipaddress
 import requests
 import subprocess
 import socket
@@ -185,8 +186,20 @@ def get_public_ip(timeout: int = 5):
 
     for url in URLS:
         try:
-            return _try_get_ip_from_url(url, timeout)
+            ip = _try_get_ip_from_url(url, timeout)
         except requests.RequestException:
             continue
 
+        # Reject empty/garbage and unspecified (0.0.0.0 / ::) responses so a bad
+        # service can never silently produce a dead "daddr 0.0.0.0" forward rule.
+        try:
+            ip_obj = ipaddress.ip_address(ip)
+        except ValueError:
+            continue
+
+        if ip_obj.is_unspecified:
+            continue
+
+        return str(ip_obj)
+
     raise RuntimeError("Failed to get public IP")

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.6/hysn_firecracker_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hysn-firecracker-python
-Version: 1.0.5
+Version: 1.0.6
 Summary: A Python client library to interact with Firecracker microVMs
 Author: Muhammad Yuga Nugraha
 License: MIT License

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.6}/tests/test_port_forward.py

@@ -2,10 +2,77 @@
 
 import json
 import os
+from unittest.mock import patch
 
 import pytest
 
 from firecracker import MicroVM
+from firecracker.network import NetworkManager
+
+
+class TestPreroutingRuleBuild:
+    """Unit tests for the PREROUTING DNAT rule builder (no nftables/KVM needed).
+
+    Guards the `ip daddr 0.0.0.0` regression: the rule must match
+    `fib daddr type local`, never an exact host-IP daddr payload.
+    """
+
+    def _build(self, **kwargs):
+        with patch("firecracker.network.IPRoute"):
+            nm = NetworkManager()
+        defaults = dict(
+            id="9fngkuf7",
+            family="ip",
+            host_port=37699,
+            dest_ip="172.115.48.209",
+            dest_port=22,
+            protocol="tcp",
+        )
+        defaults.update(kwargs)
+        return nm._build_prerouting_rule(**defaults)
+
+    def test_uses_fib_daddr_type_local(self):
+        """Rule matches any local address via fib, not a single host IP."""
+        expr = self._build()["add"]["rule"]["expr"]
+        fib_matches = [
+            e
+            for e in expr
+            if "match" in e and "fib" in e["match"].get("left", {})
+        ]
+        assert len(fib_matches) == 1
+        m = fib_matches[0]["match"]
+        assert m["op"] == "=="
+        assert m["left"]["fib"]["result"] == "type"
+        assert "daddr" in m["left"]["fib"]["flags"]
+        assert m["right"] == "local"
+
+    def test_no_exact_daddr_payload_match(self):
+        """Regression: no `ip daddr <addr>` payload match remains in the rule."""
+        expr = self._build()["add"]["rule"]["expr"]
+        for e in expr:
+            left = e.get("match", {}).get("left", {})
+            if "payload" in left:
+                assert left["payload"]["field"] != "daddr"
+
+    def test_dport_and_dnat_preserved(self):
+        """dport match and dnat target unchanged."""
+        expr = self._build()["add"]["rule"]["expr"]
+        dport = next(
+            e["match"]
+            for e in expr
+            if "match" in e
+            and e["match"]["left"].get("payload", {}).get("field") == "dport"
+        )
+        assert dport["right"] == 37699
+        dnat = next(e["dnat"] for e in expr if "dnat" in e)
+        assert dnat == {"addr": "172.115.48.209", "port": 22}
+
+    def test_comment_format_unchanged(self):
+        """Comment key is unchanged -- deletion/idempotency paths depend on it."""
+        rule = self._build()["add"]["rule"]
+        assert rule["comment"] == "machine_id=9fngkuf7 host_port=37699 vm_port=22"
+        assert rule["chain"] == "PREROUTING"
+        assert rule["table"] == "nat"
 
 KERNEL_FILE = "/var/lib/firecracker/vmlinux-6.1.159"
 BASE_ROOTFS = "/var/lib/firecracker/devsecops-box.img"

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.6}/tests/test_utils.py

@@ -167,3 +167,51 @@ class TestUtilsFunctions:
 
         with pytest.raises(RuntimeError, match="VMM ID required"):
             test_func(None)
+
+
+class TestGetPublicIP:
+    """Tests for get_public_ip validation (never yield 0.0.0.0/empty)."""
+
+    def test_returns_valid_ip(self):
+        """A valid IP from the first service is returned."""
+        from unittest.mock import patch
+        from firecracker.utils import get_public_ip
+
+        with patch(
+            "firecracker.utils._try_get_ip_from_url", return_value="138.201.226.62"
+        ):
+            assert get_public_ip() == "138.201.226.62"
+
+    def test_skips_unspecified_then_returns_valid(self):
+        """0.0.0.0 from one service is skipped; next valid IP wins."""
+        from unittest.mock import patch
+        from firecracker.utils import get_public_ip
+
+        with patch(
+            "firecracker.utils._try_get_ip_from_url",
+            side_effect=["0.0.0.0", "203.0.113.5", "203.0.113.9"],
+        ):
+            assert get_public_ip() == "203.0.113.5"
+
+    def test_skips_empty_and_garbage(self):
+        """Empty/garbage responses are skipped, not returned."""
+        from unittest.mock import patch
+        from firecracker.utils import get_public_ip
+
+        with patch(
+            "firecracker.utils._try_get_ip_from_url",
+            side_effect=["", "not-an-ip", "203.0.113.7"],
+        ):
+            assert get_public_ip() == "203.0.113.7"
+
+    def test_raises_when_all_unspecified_or_invalid(self):
+        """All services returning 0.0.0.0/garbage -> RuntimeError, never 0.0.0.0."""
+        from unittest.mock import patch
+        from firecracker.utils import get_public_ip
+
+        with patch(
+            "firecracker.utils._try_get_ip_from_url",
+            side_effect=["0.0.0.0", "", "::"],
+        ):
+            with pytest.raises(RuntimeError, match="Failed to get public IP"):
+                get_public_ip()