mirror of
https://github.com/cirruslabs/softnet.git
synced 2026-10-01 04:21:54 +02:00
Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Nikolay Edigaryev
|
7dfa77ba84 | ||
|
dependabot[bot]andNikolay Edigaryev
|
c709387d71 | ||
|
Fedor Kororkovandedi-oai
|
08200b7a09 |
Generated
+105
-81
@@ -230,9 +230,15 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "anyhow"
|
||||
version = "1.0.102"
|
||||
version = "1.0.104"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
|
||||
checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
|
||||
|
||||
[[package]]
|
||||
name = "array-const-fn-init"
|
||||
version = "0.1.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8bcb85e548c05d407fa6faff46b750ba287714ef32afc0f5e15b4641ffd6affb"
|
||||
|
||||
[[package]]
|
||||
name = "arrayvec"
|
||||
@@ -368,9 +374,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "clap"
|
||||
version = "4.6.1"
|
||||
version = "4.6.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
|
||||
checksum = "0fb99565819980999fb7b4a1796046a5c949e6d4ff132cf5fadf5a641e20d776"
|
||||
dependencies = [
|
||||
"clap_builder",
|
||||
"clap_derive",
|
||||
@@ -378,9 +384,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "clap_builder"
|
||||
version = "4.6.0"
|
||||
version = "4.6.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
|
||||
checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
|
||||
dependencies = [
|
||||
"anstream",
|
||||
"anstyle",
|
||||
@@ -390,9 +396,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "clap_derive"
|
||||
version = "4.6.1"
|
||||
version = "4.6.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
|
||||
checksum = "32f2392eae7f16557a3d727ef3a12e57b2b2ca6f98566a5f4fb41ffe305df077"
|
||||
dependencies = [
|
||||
"heck",
|
||||
"proc-macro2",
|
||||
@@ -632,20 +638,20 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "dhcproto"
|
||||
version = "0.14.0"
|
||||
source = "git+https://github.com/bluecatengineering/dhcproto.git?branch=master#eece41c9a13b0e4912fb9a8f08401ab01b4123d4"
|
||||
version = "0.16.0"
|
||||
source = "git+https://github.com/bluecatengineering/dhcproto.git?branch=master#60719e5df11359b12bf74e743b3c7e0831351c2d"
|
||||
dependencies = [
|
||||
"dhcproto-macros",
|
||||
"hickory-proto",
|
||||
"ipnet",
|
||||
"rand 0.9.4",
|
||||
"thiserror 2.0.12",
|
||||
"rand 0.10.1",
|
||||
"thiserror 2.0.19",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "dhcproto-macros"
|
||||
version = "0.2.0"
|
||||
source = "git+https://github.com/bluecatengineering/dhcproto.git?branch=master#eece41c9a13b0e4912fb9a8f08401ab01b4123d4"
|
||||
source = "git+https://github.com/bluecatengineering/dhcproto.git?branch=master#60719e5df11359b12bf74e743b3c7e0831351c2d"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
@@ -993,7 +999,7 @@ dependencies = [
|
||||
"jni",
|
||||
"once_cell",
|
||||
"rand 0.10.1",
|
||||
"thiserror 2.0.12",
|
||||
"thiserror 2.0.19",
|
||||
"tinyvec",
|
||||
"tracing",
|
||||
"url",
|
||||
@@ -1367,7 +1373,7 @@ dependencies = [
|
||||
"jni-sys",
|
||||
"log",
|
||||
"simd_cesu8",
|
||||
"thiserror 2.0.12",
|
||||
"thiserror 2.0.19",
|
||||
"walkdir",
|
||||
"windows-link",
|
||||
]
|
||||
@@ -1414,6 +1420,18 @@ dependencies = [
|
||||
"wasm-bindgen",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "jsonrpsee-types"
|
||||
version = "0.26.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bc88ff4688e43cc3fa9883a8a95c6fa27aa2e76c96e610b737b6554d650d7fd5"
|
||||
dependencies = [
|
||||
"http 1.1.0",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"thiserror 2.0.19",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "language-tags"
|
||||
version = "0.3.2"
|
||||
@@ -1434,9 +1452,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
|
||||
|
||||
[[package]]
|
||||
name = "libc"
|
||||
version = "0.2.186"
|
||||
version = "0.2.188"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
|
||||
checksum = "22053b6a34f84abc97f9129e61334f40174659a1b9bd18c970b83db6a9a6348b"
|
||||
|
||||
[[package]]
|
||||
name = "linux-raw-sys"
|
||||
@@ -1485,9 +1503,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "log"
|
||||
version = "0.4.29"
|
||||
version = "0.4.33"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
|
||||
checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
|
||||
|
||||
[[package]]
|
||||
name = "mac_address"
|
||||
@@ -1592,9 +1610,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "nix"
|
||||
version = "0.31.2"
|
||||
version = "0.31.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5d6d0705320c1e6ba1d912b5e37cf18071b6c2e9b7fa8215a1e8a7651966f5d3"
|
||||
checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
|
||||
dependencies = [
|
||||
"bitflags 2.9.4",
|
||||
"cfg-if",
|
||||
@@ -1844,10 +1862,11 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "prefix-trie"
|
||||
version = "0.8.3"
|
||||
version = "0.9.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "90f561214012d3fc240a1f9c817cc4d57f5310910d066069c1b093f766bb5966"
|
||||
checksum = "fbeb97a96d43f215f842f6ab81e8c7b5f6e9b912495c3178127f54f9dce28e32"
|
||||
dependencies = [
|
||||
"array-const-fn-init",
|
||||
"either",
|
||||
"ipnet",
|
||||
"num-traits",
|
||||
@@ -2193,15 +2212,6 @@ dependencies = [
|
||||
"winapi-util",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "scc"
|
||||
version = "2.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
|
||||
dependencies = [
|
||||
"sdd",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "schannel"
|
||||
version = "0.1.24"
|
||||
@@ -2217,12 +2227,6 @@ version = "1.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
|
||||
|
||||
[[package]]
|
||||
name = "sdd"
|
||||
version = "3.0.10"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
|
||||
|
||||
[[package]]
|
||||
name = "security-framework"
|
||||
version = "2.11.1"
|
||||
@@ -2254,9 +2258,9 @@ checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
|
||||
|
||||
[[package]]
|
||||
name = "sentry"
|
||||
version = "0.48.1"
|
||||
version = "0.48.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b93b3e19f45495ddd41d8222a152c48c84f6ba45abe9c69e2527e9cdea29bb5b"
|
||||
checksum = "d631477761f57c76148456e55e80e9a479ff3fa4c65b2b4a0c3acf1167fd4638"
|
||||
dependencies = [
|
||||
"cfg_aliases",
|
||||
"httpdate",
|
||||
@@ -2275,9 +2279,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "sentry-actix"
|
||||
version = "0.48.1"
|
||||
version = "0.48.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "168d0312e1b1741d8295a16c7b2c62c10c76302f7476a1749d6ccc14cb40663a"
|
||||
checksum = "119ede4e37790ec04e8a14073c8414f0a4b2648402856c0563495a9a5cf54d57"
|
||||
dependencies = [
|
||||
"actix-http",
|
||||
"actix-web",
|
||||
@@ -2288,9 +2292,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "sentry-anyhow"
|
||||
version = "0.48.1"
|
||||
version = "0.48.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0fafe70e622ded2d3b75dc7889ecb5391b4c22d850b5a36e81af4615cbe687f2"
|
||||
checksum = "d8f73466a403f4da78c7e576049d6044b31d2b16dfcc26b51705f318ed74b804"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"sentry-backtrace",
|
||||
@@ -2299,9 +2303,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "sentry-backtrace"
|
||||
version = "0.48.1"
|
||||
version = "0.48.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dc84c325ace9ca2388e510fe7d6672b5d60cd8b3bd0eb4bb4ee8314c323cd686"
|
||||
checksum = "448b0981fbde6cdc9eb087ba3dc01035a253fef9a0d9e79aaf198fc26acb2e64"
|
||||
dependencies = [
|
||||
"backtrace",
|
||||
"regex",
|
||||
@@ -2310,9 +2314,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "sentry-contexts"
|
||||
version = "0.48.1"
|
||||
version = "0.48.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "896c1ab62dbfe1746fb262bbf72e6feb2fb9dfb2c14709077bf71beb532e44b2"
|
||||
checksum = "9e5e909d02170ba6d1dc5ebd05bef7999280f5d960e3eaee5d1a18d88d41b334"
|
||||
dependencies = [
|
||||
"hostname",
|
||||
"libc",
|
||||
@@ -2324,9 +2328,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "sentry-core"
|
||||
version = "0.48.1"
|
||||
version = "0.48.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d5f5abf20c42cb1593ec1638976e2647da55f79bccac956444c1707b6cce259a"
|
||||
checksum = "ecf0b1a4a4e9ec88395b52e6fa4868b95564c1fa96b26a0606f5f6288a0f7149"
|
||||
dependencies = [
|
||||
"rand 0.9.4",
|
||||
"sentry-types",
|
||||
@@ -2337,9 +2341,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "sentry-debug-images"
|
||||
version = "0.48.1"
|
||||
version = "0.48.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4b88bbe6a760d5724bb40689827e82e8db1e275947df2c59abe171bfc30bb671"
|
||||
checksum = "f81d7749c57fc78ed52134889e8121da874065bc40da788d5798cce0f8c19f15"
|
||||
dependencies = [
|
||||
"findshlibs",
|
||||
"sentry-core",
|
||||
@@ -2347,9 +2351,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "sentry-panic"
|
||||
version = "0.48.1"
|
||||
version = "0.48.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0260dcb52562b6a79ae7702312a26dba94b79fb5baee7301087529e5ca4e872e"
|
||||
checksum = "0b7d93d6ecb55d2251c5fc084c55c03a2bc68904918d76117e602c999e92f00f"
|
||||
dependencies = [
|
||||
"sentry-backtrace",
|
||||
"sentry-core",
|
||||
@@ -2357,9 +2361,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "sentry-tracing"
|
||||
version = "0.48.1"
|
||||
version = "0.48.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a1c035f3a0a8671ae1a231c5b457abb68b71acba2bf3054dab2a09a9d4ea487e"
|
||||
checksum = "58d26379236c4ef97eaf081bca3c7bf0ef6f06b3aa881eca2ee8e8dbc923e5b8"
|
||||
dependencies = [
|
||||
"bitflags 2.9.4",
|
||||
"sentry-backtrace",
|
||||
@@ -2370,16 +2374,16 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "sentry-types"
|
||||
version = "0.48.1"
|
||||
version = "0.48.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "82d8e81058ec155992191f61c7b29bfa7b2cf12012131e7cdc0678020898a7c9"
|
||||
checksum = "2239099d47e76857b0825a182ecdb90159add7aa1097b60247c6e7ca6bf49c6a"
|
||||
dependencies = [
|
||||
"debugid",
|
||||
"hex",
|
||||
"rand 0.9.4",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"thiserror 2.0.12",
|
||||
"thiserror 2.0.19",
|
||||
"time",
|
||||
"url",
|
||||
"uuid",
|
||||
@@ -2387,9 +2391,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "serde"
|
||||
version = "1.0.228"
|
||||
version = "1.0.229"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
|
||||
checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
|
||||
dependencies = [
|
||||
"serde_core",
|
||||
"serde_derive",
|
||||
@@ -2397,34 +2401,35 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "serde_core"
|
||||
version = "1.0.228"
|
||||
version = "1.0.229"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
|
||||
checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
|
||||
dependencies = [
|
||||
"serde_derive",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "serde_derive"
|
||||
version = "1.0.228"
|
||||
version = "1.0.229"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
|
||||
checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn 2.0.117",
|
||||
"syn 3.0.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "serde_json"
|
||||
version = "1.0.128"
|
||||
version = "1.0.151"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6ff5456707a1de34e7e37f2a6fd3d3f808c318259cbd01ab6377795054b483d8"
|
||||
checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
|
||||
dependencies = [
|
||||
"itoa",
|
||||
"memchr",
|
||||
"ryu",
|
||||
"serde",
|
||||
"serde_core",
|
||||
"zmij",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -2441,24 +2446,23 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "serial_test"
|
||||
version = "3.4.0"
|
||||
version = "3.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
|
||||
checksum = "699f4197115b8a7e7ff19c9a315a4bd6fffec26cc4626ef45ecaea389e081c6d"
|
||||
dependencies = [
|
||||
"futures-executor",
|
||||
"futures-util",
|
||||
"log",
|
||||
"once_cell",
|
||||
"parking_lot",
|
||||
"scc",
|
||||
"serial_test_derive",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "serial_test_derive"
|
||||
version = "3.4.0"
|
||||
version = "3.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
|
||||
checksum = "94e153fc76e1c6a068703d6d29c508a0b15c061c4b7e43da59cc097bc342673c"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
@@ -2568,10 +2572,11 @@ dependencies = [
|
||||
"dhcproto",
|
||||
"ip_network",
|
||||
"ipnet",
|
||||
"jsonrpsee-types",
|
||||
"libc",
|
||||
"log",
|
||||
"mac_address",
|
||||
"nix 0.31.2",
|
||||
"nix 0.31.3",
|
||||
"num_enum 0.7.6",
|
||||
"oslog",
|
||||
"polling",
|
||||
@@ -2579,6 +2584,8 @@ dependencies = [
|
||||
"privdrop",
|
||||
"sentry",
|
||||
"sentry-anyhow",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"serial_test",
|
||||
"smoltcp",
|
||||
"system-configuration",
|
||||
@@ -2632,6 +2639,17 @@ dependencies = [
|
||||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "syn"
|
||||
version = "3.0.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a207d6d6a2b7fc470b80443726053f18a2481b7e1eee970597051596567987a3"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sync_wrapper"
|
||||
version = "1.0.1"
|
||||
@@ -2697,11 +2715,11 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "thiserror"
|
||||
version = "2.0.12"
|
||||
version = "2.0.19"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
|
||||
checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
|
||||
dependencies = [
|
||||
"thiserror-impl 2.0.12",
|
||||
"thiserror-impl 2.0.19",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -2717,13 +2735,13 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "thiserror-impl"
|
||||
version = "2.0.12"
|
||||
version = "2.0.19"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
|
||||
checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn 2.0.117",
|
||||
"syn 3.0.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -3747,3 +3765,9 @@ dependencies = [
|
||||
"quote",
|
||||
"syn 2.0.117",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zmij"
|
||||
version = "1.0.23"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
|
||||
|
||||
@@ -34,6 +34,9 @@ oslog = "0.2.0"
|
||||
log = "0.4.29"
|
||||
serial_test = "3"
|
||||
coarsetime = "0.1.37"
|
||||
serde = { version = "1", features = ["derive"] }
|
||||
serde_json = "1"
|
||||
jsonrpsee-types = "0.26"
|
||||
|
||||
[profile.release]
|
||||
debug = true
|
||||
|
||||
@@ -43,3 +43,20 @@ For proper functioning, Softnet binary requires two things:
|
||||
## Running
|
||||
|
||||
Softnet is started and managed automatically by Tart if `--net-softnet` flag is provided when calling `tart run`.
|
||||
|
||||
### Dynamic network policy
|
||||
|
||||
Softnet can update the running VM's IPv4 policy without restarting the VM. Pass a connected Unix stream socket as `--control-fd` to enable a newline-delimited [JSON-RPC 2.0](https://www.jsonrpc.org/specification) control channel. The socket is duplex and must be separate from `--vm-fd`, which carries VM packets.
|
||||
|
||||
The supported methods are `softnet.policy.get` and `softnet.policy.set`. A complete policy update looks like this (each request and response occupies one line):
|
||||
|
||||
```json
|
||||
{"jsonrpc":"2.0","id":"42","method":"softnet.policy.set","params":{"allow":["@host","10.0.0.0/8"],"block":["0.0.0.0/0"]}}
|
||||
{"jsonrpc":"2.0","id":"42","result":{"allow":["10.0.0.0/8","@host"],"block":["0.0.0.0/0"],"ruleCount":3}}
|
||||
```
|
||||
|
||||
Every request must include a non-null string (at most 256 bytes) or non-negative integer `id`; notifications are rejected so policy changes always have an acknowledgment. Policy updates are atomic: all rules are parsed and a new prefix map is built before the active policy changes. Longest-prefix matching and block precedence for identical rules are preserved. Rules are normalized and deduplicated. A policy update may contain at most 4096 combined allow/block rules, and a request frame may not exceed 1 MiB.
|
||||
|
||||
When the effective normalized policy changes, Softnet clears existing conntrack state so the new policy applies to established flows immediately. This may interrupt active connections. Repeating an equivalent normalized policy is a no-op and preserves conntrack state.
|
||||
|
||||
Use `block=["0.0.0.0/0"]` with specific allow rules for a default-deny policy. Closing the control socket leaves the last accepted policy active.
|
||||
|
||||
+1
-1
@@ -96,7 +96,7 @@ impl Lease {
|
||||
coarsetime::Instant::recent() < self.valid_until
|
||||
}
|
||||
|
||||
pub fn valid_ip_source(&self, address: Ipv4Address) -> bool {
|
||||
pub fn is_valid_for(&self, address: Ipv4Address) -> bool {
|
||||
self.address == address && self.valid()
|
||||
}
|
||||
}
|
||||
|
||||
+20
-1
@@ -12,6 +12,7 @@ pub struct Poller<'poller> {
|
||||
timeout: Duration,
|
||||
vm_fd: BorrowedFd<'poller>,
|
||||
host_fd: BorrowedFd<'poller>,
|
||||
control_fd: Option<BorrowedFd<'poller>>,
|
||||
}
|
||||
|
||||
#[derive(IntoPrimitive)]
|
||||
@@ -19,6 +20,7 @@ pub struct Poller<'poller> {
|
||||
enum EventKey {
|
||||
VM,
|
||||
Host,
|
||||
Control,
|
||||
Interrupt,
|
||||
}
|
||||
|
||||
@@ -26,6 +28,7 @@ impl Poller<'_> {
|
||||
pub fn new<'poller>(
|
||||
vm_fd: RawFd,
|
||||
host_fd: RawFd,
|
||||
control_fd: Option<RawFd>,
|
||||
timeout: Duration,
|
||||
) -> Result<Poller<'poller>> {
|
||||
let poller = polling::Poller::new()?;
|
||||
@@ -36,6 +39,7 @@ impl Poller<'_> {
|
||||
timeout,
|
||||
vm_fd: unsafe { BorrowedFd::borrow_raw(vm_fd) },
|
||||
host_fd: unsafe { BorrowedFd::borrow_raw(host_fd) },
|
||||
control_fd: control_fd.map(|fd| unsafe { BorrowedFd::borrow_raw(fd) }),
|
||||
})
|
||||
}
|
||||
|
||||
@@ -46,6 +50,14 @@ impl Poller<'_> {
|
||||
self.vm_interest(),
|
||||
PollMode::Edge,
|
||||
)?;
|
||||
|
||||
if let Some(control_fd) = self.control_fd {
|
||||
self.poller.add_with_mode(
|
||||
control_fd.as_raw_fd(),
|
||||
polling::Event::all(EventKey::Control.into()),
|
||||
PollMode::Edge,
|
||||
)?;
|
||||
}
|
||||
self.poller.add_with_mode(
|
||||
self.host_fd.as_raw_fd(),
|
||||
self.host_interest(),
|
||||
@@ -79,10 +91,17 @@ impl Poller<'_> {
|
||||
.events
|
||||
.iter()
|
||||
.any(|ev| ev.key == Into::<usize>::into(EventKey::Interrupt));
|
||||
|
||||
Ok((vm_readable, host_readable, interrupt))
|
||||
}
|
||||
|
||||
pub fn remove_control(&mut self) -> Result<()> {
|
||||
if let Some(control_fd) = self.control_fd.take() {
|
||||
self.poller.delete(control_fd)?;
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn vm_interest(&self) -> polling::Event {
|
||||
polling::Event::readable(EventKey::VM.into())
|
||||
}
|
||||
|
||||
@@ -0,0 +1,386 @@
|
||||
#[path = "conntrack_tcp.rs"]
|
||||
mod tcp;
|
||||
#[path = "conntrack_udp.rs"]
|
||||
mod udp;
|
||||
|
||||
use coarsetime::{Duration, Instant};
|
||||
use smoltcp::wire::{IpProtocol, Ipv4Address, Ipv4Packet};
|
||||
use std::collections::HashMap;
|
||||
|
||||
const MAX_FLOWS: usize = 4096;
|
||||
const MAX_VM_INITIATED_FLOWS: usize = 1024;
|
||||
const MAX_EMBRYONIC_FLOWS_PER_SOURCE: usize = 256;
|
||||
const SWEEP_INTERVAL: Duration = Duration::from_secs(1);
|
||||
|
||||
/// Tracks permission to use an exact host/VM flow tuple.
|
||||
///
|
||||
/// This deliberately does not replace either endpoint's transport stack:
|
||||
/// TCP sequence/window validation remains the host's and VM's responsibility.
|
||||
/// Its security boundary is flow initiation: only an authorized first packet
|
||||
/// can create an entry, and VM traffic to the host must match the reverse.
|
||||
#[derive(Debug)]
|
||||
pub(crate) struct Conntrack {
|
||||
flows: HashMap<FlowKey, Flow>,
|
||||
next_sweep: Instant,
|
||||
}
|
||||
|
||||
pub(crate) enum ConntrackResult {
|
||||
Allowed,
|
||||
New(PendingFlow),
|
||||
Denied,
|
||||
}
|
||||
|
||||
pub(crate) struct PendingFlow {
|
||||
key: FlowKey,
|
||||
flow: Flow,
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
|
||||
enum FlowKey {
|
||||
Tcp {
|
||||
host_addr: Ipv4Address,
|
||||
host_port: u16,
|
||||
vm_addr: Ipv4Address,
|
||||
vm_port: u16,
|
||||
},
|
||||
Udp {
|
||||
host_addr: Ipv4Address,
|
||||
host_port: u16,
|
||||
vm_addr: Ipv4Address,
|
||||
vm_port: u16,
|
||||
},
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
|
||||
enum Initiator {
|
||||
Host,
|
||||
Vm,
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, Debug)]
|
||||
struct Flow {
|
||||
initiator: Initiator,
|
||||
state: FlowState,
|
||||
last_seen: Instant,
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, Debug)]
|
||||
enum FlowState {
|
||||
Tcp(tcp::State),
|
||||
Udp(udp::State),
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy)]
|
||||
enum Direction {
|
||||
FromHost,
|
||||
FromVm,
|
||||
}
|
||||
|
||||
impl Conntrack {
|
||||
pub(crate) fn new() -> Self {
|
||||
let now = Instant::recent();
|
||||
Self {
|
||||
flows: HashMap::new(),
|
||||
next_sweep: now + SWEEP_INTERVAL,
|
||||
}
|
||||
}
|
||||
|
||||
pub(crate) fn inspect_from_host(&mut self, packet: &Ipv4Packet<&[u8]>) -> ConntrackResult {
|
||||
self.inspect(packet, Direction::FromHost, Instant::recent())
|
||||
}
|
||||
|
||||
pub(crate) fn inspect_from_vm(&mut self, packet: &Ipv4Packet<&[u8]>) -> ConntrackResult {
|
||||
self.inspect(packet, Direction::FromVm, Instant::recent())
|
||||
}
|
||||
|
||||
pub(crate) fn commit(&mut self, mut pending: PendingFlow) -> bool {
|
||||
let now = Instant::recent();
|
||||
pending.flow.last_seen = now;
|
||||
self.insert(pending.key, pending.flow, now)
|
||||
}
|
||||
|
||||
pub(crate) fn tick(&mut self) {
|
||||
let now = Instant::recent();
|
||||
if now >= self.next_sweep {
|
||||
self.expire(now);
|
||||
self.next_sweep = now + SWEEP_INTERVAL;
|
||||
}
|
||||
}
|
||||
|
||||
pub(crate) fn clear(&mut self) {
|
||||
self.flows.clear();
|
||||
}
|
||||
|
||||
fn inspect(
|
||||
&mut self,
|
||||
packet: &Ipv4Packet<&[u8]>,
|
||||
direction: Direction,
|
||||
now: Instant,
|
||||
) -> ConntrackResult {
|
||||
// Later fragments do not contain the transport header needed to bind them
|
||||
// to a permitted flow. Fail closed instead of admitting them by IP alone.
|
||||
if packet.more_frags() || packet.frag_offset() != 0 {
|
||||
return ConntrackResult::Denied;
|
||||
}
|
||||
|
||||
match packet.next_header() {
|
||||
IpProtocol::Tcp => self.inspect_tcp(packet, direction, now),
|
||||
IpProtocol::Udp => self.inspect_udp(packet, direction, now),
|
||||
_ => ConntrackResult::Denied,
|
||||
}
|
||||
}
|
||||
|
||||
fn insert(&mut self, key: FlowKey, flow: Flow, now: Instant) -> bool {
|
||||
self.expire(now);
|
||||
if self.flows.len() >= MAX_FLOWS {
|
||||
return false;
|
||||
}
|
||||
if flow.initiator == Initiator::Vm
|
||||
&& self
|
||||
.flows
|
||||
.values()
|
||||
.filter(|flow| flow.initiator == Initiator::Vm)
|
||||
.count()
|
||||
>= MAX_VM_INITIATED_FLOWS
|
||||
{
|
||||
return false;
|
||||
}
|
||||
if let Some(initiator_addr) = embryonic_source(key, flow)
|
||||
&& self
|
||||
.flows
|
||||
.iter()
|
||||
.filter(|(key, flow)| embryonic_source(**key, **flow) == Some(initiator_addr))
|
||||
.count()
|
||||
>= MAX_EMBRYONIC_FLOWS_PER_SOURCE
|
||||
{
|
||||
return false;
|
||||
}
|
||||
self.flows.insert(key, flow);
|
||||
true
|
||||
}
|
||||
|
||||
fn expire(&mut self, now: Instant) {
|
||||
self.flows
|
||||
.retain(|_, flow| now.duration_since(flow.last_seen) < flow.timeout());
|
||||
}
|
||||
}
|
||||
|
||||
impl Flow {
|
||||
fn timeout(&self) -> Duration {
|
||||
match self.state {
|
||||
FlowState::Tcp(state) => state.timeout(),
|
||||
FlowState::Udp(state) => state.timeout(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn embryonic_source(key: FlowKey, flow: Flow) -> Option<Ipv4Address> {
|
||||
match (key, flow.initiator, flow.state) {
|
||||
(
|
||||
FlowKey::Tcp { host_addr, .. },
|
||||
Initiator::Host,
|
||||
FlowState::Tcp(tcp::State::SynSent | tcp::State::SynReceived),
|
||||
) => Some(host_addr),
|
||||
(
|
||||
FlowKey::Tcp { vm_addr, .. },
|
||||
Initiator::Vm,
|
||||
FlowState::Tcp(tcp::State::SynSent | tcp::State::SynReceived),
|
||||
) => Some(vm_addr),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
fn oriented_transport_key(
|
||||
packet: &Ipv4Packet<&[u8]>,
|
||||
direction: Direction,
|
||||
make_key: impl FnOnce(Ipv4Address, u16, Ipv4Address, u16) -> FlowKey,
|
||||
src_port: u16,
|
||||
dst_port: u16,
|
||||
) -> FlowKey {
|
||||
match direction {
|
||||
Direction::FromHost => make_key(packet.src_addr(), src_port, packet.dst_addr(), dst_port),
|
||||
Direction::FromVm => make_key(packet.dst_addr(), dst_port, packet.src_addr(), src_port),
|
||||
}
|
||||
}
|
||||
|
||||
fn initiator(direction: Direction) -> Initiator {
|
||||
match direction {
|
||||
Direction::FromHost => Initiator::Host,
|
||||
Direction::FromVm => Initiator::Vm,
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::test_support::{HOST, TcpFlags, VM, inspect_from_host, inspect_from_vm, tcp_packet};
|
||||
use super::{Conntrack, ConntrackResult, MAX_EMBRYONIC_FLOWS_PER_SOURCE};
|
||||
use smoltcp::wire::{Ipv4Address, Ipv4Packet};
|
||||
|
||||
#[test]
|
||||
fn fragments_fail_closed() {
|
||||
let mut packet = tcp_packet(HOST, 49152, VM, 22, TcpFlags::SYN);
|
||||
Ipv4Packet::new_unchecked(packet.as_mut_slice()).set_more_frags(true);
|
||||
|
||||
let mut tracker = Conntrack::new();
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &packet),
|
||||
ConntrackResult::Denied
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn clear_removes_tracked_flows() {
|
||||
let packet = tcp_packet(HOST, 49152, VM, 22, TcpFlags::SYN);
|
||||
let mut tracker = Conntrack::new();
|
||||
|
||||
let ConntrackResult::New(pending) = inspect_from_host(&mut tracker, &packet) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
assert_eq!(tracker.flows.len(), 1);
|
||||
|
||||
tracker.clear();
|
||||
assert!(tracker.flows.is_empty());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn embryonic_tcp_limit_is_per_source() {
|
||||
let mut tracker = Conntrack::new();
|
||||
|
||||
for index in 0..MAX_EMBRYONIC_FLOWS_PER_SOURCE {
|
||||
let syn = tcp_packet(HOST, 10000 + index as u16, VM, 22, TcpFlags::SYN);
|
||||
let ConntrackResult::New(pending) = inspect_from_host(&mut tracker, &syn) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
}
|
||||
|
||||
let over_limit = tcp_packet(HOST, 20000, VM, 22, TcpFlags::SYN);
|
||||
let ConntrackResult::New(pending) = inspect_from_host(&mut tracker, &over_limit) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(!tracker.commit(pending));
|
||||
|
||||
let other_host = Ipv4Address::new(192, 168, 64, 3);
|
||||
let other_source = tcp_packet(other_host, 20000, VM, 22, TcpFlags::SYN);
|
||||
let ConntrackResult::New(pending) = inspect_from_host(&mut tracker, &other_source) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
|
||||
let syn_ack = tcp_packet(VM, 22, HOST, 10000, TcpFlags::SYN_ACK);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &syn_ack),
|
||||
ConntrackResult::Allowed
|
||||
));
|
||||
let ack = tcp_packet(HOST, 10000, VM, 22, TcpFlags::ACK);
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &ack),
|
||||
ConntrackResult::Allowed
|
||||
));
|
||||
|
||||
let ConntrackResult::New(pending) = inspect_from_host(&mut tracker, &over_limit) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod test_support {
|
||||
use super::{Conntrack, ConntrackResult};
|
||||
use smoltcp::wire::{IpProtocol, Ipv4Address, Ipv4Packet, TcpPacket, UdpPacket};
|
||||
|
||||
pub(super) const HOST: Ipv4Address = Ipv4Address::new(192, 168, 64, 1);
|
||||
pub(super) const VM: Ipv4Address = Ipv4Address::new(192, 168, 64, 2);
|
||||
|
||||
pub(super) fn inspect_from_host(tracker: &mut Conntrack, bytes: &[u8]) -> ConntrackResult {
|
||||
let packet = Ipv4Packet::new_checked(bytes).unwrap();
|
||||
tracker.inspect_from_host(&packet)
|
||||
}
|
||||
|
||||
pub(super) fn inspect_from_vm(tracker: &mut Conntrack, bytes: &[u8]) -> ConntrackResult {
|
||||
let packet = Ipv4Packet::new_checked(bytes).unwrap();
|
||||
tracker.inspect_from_vm(&packet)
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy)]
|
||||
pub(super) struct TcpFlags {
|
||||
syn: bool,
|
||||
ack: bool,
|
||||
rst: bool,
|
||||
}
|
||||
|
||||
impl TcpFlags {
|
||||
pub(super) const SYN: Self = Self {
|
||||
syn: true,
|
||||
ack: false,
|
||||
rst: false,
|
||||
};
|
||||
pub(super) const SYN_ACK: Self = Self {
|
||||
syn: true,
|
||||
ack: true,
|
||||
rst: false,
|
||||
};
|
||||
pub(super) const ACK: Self = Self {
|
||||
syn: false,
|
||||
ack: true,
|
||||
rst: false,
|
||||
};
|
||||
pub(super) const RST: Self = Self {
|
||||
syn: false,
|
||||
ack: false,
|
||||
rst: true,
|
||||
};
|
||||
}
|
||||
|
||||
pub(super) fn tcp_packet(
|
||||
src_addr: Ipv4Address,
|
||||
src_port: u16,
|
||||
dst_addr: Ipv4Address,
|
||||
dst_port: u16,
|
||||
flags: TcpFlags,
|
||||
) -> Vec<u8> {
|
||||
let mut bytes = ipv4_packet(src_addr, dst_addr, IpProtocol::Tcp, 20);
|
||||
let mut tcp = TcpPacket::new_unchecked(&mut bytes[20..]);
|
||||
tcp.set_src_port(src_port);
|
||||
tcp.set_dst_port(dst_port);
|
||||
tcp.set_header_len(20);
|
||||
tcp.set_syn(flags.syn);
|
||||
tcp.set_ack(flags.ack);
|
||||
tcp.set_rst(flags.rst);
|
||||
bytes
|
||||
}
|
||||
|
||||
pub(super) fn udp_packet(
|
||||
src_addr: Ipv4Address,
|
||||
src_port: u16,
|
||||
dst_addr: Ipv4Address,
|
||||
dst_port: u16,
|
||||
) -> Vec<u8> {
|
||||
let mut bytes = ipv4_packet(src_addr, dst_addr, IpProtocol::Udp, 8);
|
||||
let mut udp = UdpPacket::new_unchecked(&mut bytes[20..]);
|
||||
udp.set_src_port(src_port);
|
||||
udp.set_dst_port(dst_port);
|
||||
udp.set_len(8);
|
||||
bytes
|
||||
}
|
||||
|
||||
fn ipv4_packet(
|
||||
src_addr: Ipv4Address,
|
||||
dst_addr: Ipv4Address,
|
||||
protocol: IpProtocol,
|
||||
payload_len: usize,
|
||||
) -> Vec<u8> {
|
||||
let mut bytes = vec![0; 20 + payload_len];
|
||||
let total_len = bytes.len() as u16;
|
||||
let mut ipv4 = Ipv4Packet::new_unchecked(bytes.as_mut_slice());
|
||||
ipv4.set_version(4);
|
||||
ipv4.set_header_len(20);
|
||||
ipv4.set_total_len(total_len);
|
||||
ipv4.set_next_header(protocol);
|
||||
ipv4.set_src_addr(src_addr);
|
||||
ipv4.set_dst_addr(dst_addr);
|
||||
bytes
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,257 @@
|
||||
use super::{
|
||||
Conntrack, ConntrackResult, Direction, Flow, FlowKey, FlowState, PendingFlow, initiator,
|
||||
oriented_transport_key,
|
||||
};
|
||||
use coarsetime::{Duration, Instant};
|
||||
use smoltcp::wire::{Ipv4Packet, TcpPacket};
|
||||
|
||||
const HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(60);
|
||||
const ESTABLISHED_TIMEOUT: Duration = Duration::from_secs(5 * 24 * 60 * 60);
|
||||
const CLOSING_TIMEOUT: Duration = Duration::from_secs(2 * 60);
|
||||
|
||||
#[derive(Clone, Copy, Debug)]
|
||||
pub(super) enum State {
|
||||
SynSent,
|
||||
SynReceived,
|
||||
Established,
|
||||
Closing { host_fin: bool, vm_fin: bool },
|
||||
}
|
||||
|
||||
impl State {
|
||||
pub(super) fn timeout(self) -> Duration {
|
||||
match self {
|
||||
Self::SynSent | Self::SynReceived => HANDSHAKE_TIMEOUT,
|
||||
Self::Established => ESTABLISHED_TIMEOUT,
|
||||
Self::Closing { .. } => CLOSING_TIMEOUT,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Conntrack {
|
||||
pub(super) fn inspect_tcp(
|
||||
&mut self,
|
||||
packet: &Ipv4Packet<&[u8]>,
|
||||
direction: Direction,
|
||||
now: Instant,
|
||||
) -> ConntrackResult {
|
||||
let Ok(tcp) = TcpPacket::new_checked(packet.payload()) else {
|
||||
return ConntrackResult::Denied;
|
||||
};
|
||||
if tcp.src_port() == 0 || tcp.dst_port() == 0 {
|
||||
return ConntrackResult::Denied;
|
||||
}
|
||||
|
||||
let key = oriented_transport_key(
|
||||
packet,
|
||||
direction,
|
||||
|host_addr, host_port, vm_addr, vm_port| FlowKey::Tcp {
|
||||
host_addr,
|
||||
host_port,
|
||||
vm_addr,
|
||||
vm_port,
|
||||
},
|
||||
tcp.src_port(),
|
||||
tcp.dst_port(),
|
||||
);
|
||||
|
||||
if let Some(flow) = self.flows.get_mut(&key) {
|
||||
let from_initiator = matches!(
|
||||
(flow.initiator, direction),
|
||||
(super::Initiator::Host, Direction::FromHost)
|
||||
| (super::Initiator::Vm, Direction::FromVm)
|
||||
);
|
||||
let FlowState::Tcp(state) = &mut flow.state else {
|
||||
return ConntrackResult::Denied;
|
||||
};
|
||||
|
||||
if tcp.rst() {
|
||||
self.flows.remove(&key);
|
||||
return ConntrackResult::Allowed;
|
||||
}
|
||||
|
||||
let allowed = match *state {
|
||||
State::SynSent if from_initiator => is_initial_syn(&tcp),
|
||||
State::SynSent => {
|
||||
if tcp.syn() && tcp.ack() && !tcp.fin() {
|
||||
*state = State::SynReceived;
|
||||
true
|
||||
} else {
|
||||
false
|
||||
}
|
||||
}
|
||||
State::SynReceived if from_initiator => {
|
||||
if is_initial_syn(&tcp) {
|
||||
true
|
||||
} else if tcp.ack() && !tcp.syn() {
|
||||
*state = if tcp.fin() {
|
||||
State::Closing {
|
||||
host_fin: matches!(direction, Direction::FromHost),
|
||||
vm_fin: matches!(direction, Direction::FromVm),
|
||||
}
|
||||
} else {
|
||||
State::Established
|
||||
};
|
||||
true
|
||||
} else {
|
||||
false
|
||||
}
|
||||
}
|
||||
State::SynReceived => tcp.syn() && tcp.ack() && !tcp.fin(),
|
||||
State::Established | State::Closing { .. }
|
||||
if is_initial_syn(&tcp) && !from_initiator =>
|
||||
{
|
||||
false
|
||||
}
|
||||
State::Established | State::Closing { .. } if is_initial_syn(&tcp) => {
|
||||
*state = State::SynSent;
|
||||
true
|
||||
}
|
||||
State::Established if tcp.fin() => {
|
||||
*state = State::Closing {
|
||||
host_fin: matches!(direction, Direction::FromHost),
|
||||
vm_fin: matches!(direction, Direction::FromVm),
|
||||
};
|
||||
true
|
||||
}
|
||||
State::Closing { .. } if tcp.fin() => {
|
||||
if let State::Closing { host_fin, vm_fin } = state {
|
||||
match direction {
|
||||
Direction::FromHost => *host_fin = true,
|
||||
Direction::FromVm => *vm_fin = true,
|
||||
}
|
||||
}
|
||||
true
|
||||
}
|
||||
_ => true,
|
||||
};
|
||||
|
||||
if allowed {
|
||||
flow.last_seen = now;
|
||||
}
|
||||
return if allowed {
|
||||
ConntrackResult::Allowed
|
||||
} else {
|
||||
ConntrackResult::Denied
|
||||
};
|
||||
}
|
||||
|
||||
if !is_initial_syn(&tcp) {
|
||||
return ConntrackResult::Denied;
|
||||
}
|
||||
|
||||
ConntrackResult::New(PendingFlow {
|
||||
key,
|
||||
flow: Flow {
|
||||
initiator: initiator(direction),
|
||||
state: FlowState::Tcp(State::SynSent),
|
||||
last_seen: now,
|
||||
},
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
fn is_initial_syn(tcp: &TcpPacket<&[u8]>) -> bool {
|
||||
tcp.syn() && !tcp.ack() && !tcp.fin() && !tcp.rst()
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::super::test_support::{
|
||||
HOST, TcpFlags, VM, inspect_from_host, inspect_from_vm, tcp_packet,
|
||||
};
|
||||
use super::super::{Conntrack, ConntrackResult};
|
||||
|
||||
#[test]
|
||||
fn tcp_flows_are_oriented() {
|
||||
let mut tracker = Conntrack::new();
|
||||
|
||||
let vm_syn = tcp_packet(VM, 22, HOST, 49152, TcpFlags::SYN);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &vm_syn),
|
||||
ConntrackResult::New(_)
|
||||
));
|
||||
|
||||
let host_syn = tcp_packet(HOST, 49152, VM, 22, TcpFlags::SYN);
|
||||
let ConntrackResult::New(pending) = inspect_from_host(&mut tracker, &host_syn) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
|
||||
let premature_vm_ack = tcp_packet(VM, 22, HOST, 49152, TcpFlags::ACK);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &premature_vm_ack),
|
||||
ConntrackResult::Denied
|
||||
));
|
||||
|
||||
let wrong_vm_reply = tcp_packet(VM, 22, HOST, 49153, TcpFlags::SYN_ACK);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &wrong_vm_reply),
|
||||
ConntrackResult::Denied
|
||||
));
|
||||
|
||||
let vm_syn_ack = tcp_packet(VM, 22, HOST, 49152, TcpFlags::SYN_ACK);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &vm_syn_ack),
|
||||
ConntrackResult::Allowed
|
||||
));
|
||||
|
||||
let premature_vm_ack = tcp_packet(VM, 22, HOST, 49152, TcpFlags::ACK);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &premature_vm_ack),
|
||||
ConntrackResult::Denied
|
||||
));
|
||||
|
||||
let host_ack = tcp_packet(HOST, 49152, VM, 22, TcpFlags::ACK);
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &host_ack),
|
||||
ConntrackResult::Allowed
|
||||
));
|
||||
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &premature_vm_ack),
|
||||
ConntrackResult::Allowed
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn vm_can_initiate_tcp() {
|
||||
let mut tracker = Conntrack::new();
|
||||
let vm_syn = tcp_packet(VM, 49152, HOST, 22, TcpFlags::SYN);
|
||||
let host_syn_ack = tcp_packet(HOST, 22, VM, 49152, TcpFlags::SYN_ACK);
|
||||
let vm_ack = tcp_packet(VM, 49152, HOST, 22, TcpFlags::ACK);
|
||||
|
||||
let ConntrackResult::New(pending) = inspect_from_vm(&mut tracker, &vm_syn) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &host_syn_ack),
|
||||
ConntrackResult::Allowed
|
||||
));
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &vm_ack),
|
||||
ConntrackResult::Allowed
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn tcp_rst_removes_permission() {
|
||||
let mut tracker = Conntrack::new();
|
||||
let host_syn = tcp_packet(HOST, 49152, VM, 22, TcpFlags::SYN);
|
||||
let vm_rst = tcp_packet(VM, 22, HOST, 49152, TcpFlags::RST);
|
||||
let vm_ack = tcp_packet(VM, 22, HOST, 49152, TcpFlags::ACK);
|
||||
|
||||
let ConntrackResult::New(pending) = inspect_from_host(&mut tracker, &host_syn) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &vm_rst),
|
||||
ConntrackResult::Allowed
|
||||
));
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &vm_ack),
|
||||
ConntrackResult::Denied
|
||||
));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,131 @@
|
||||
use super::{
|
||||
Conntrack, ConntrackResult, Direction, Flow, FlowKey, FlowState, Initiator, PendingFlow,
|
||||
initiator, oriented_transport_key,
|
||||
};
|
||||
use coarsetime::{Duration, Instant};
|
||||
use smoltcp::wire::{Ipv4Packet, UdpPacket};
|
||||
|
||||
const UNREPLIED_TIMEOUT: Duration = Duration::from_secs(30);
|
||||
const REPLIED_TIMEOUT: Duration = Duration::from_secs(3 * 60);
|
||||
|
||||
#[derive(Clone, Copy, Debug)]
|
||||
pub(super) struct State {
|
||||
replied: bool,
|
||||
}
|
||||
|
||||
impl State {
|
||||
pub(super) fn timeout(self) -> Duration {
|
||||
if self.replied {
|
||||
REPLIED_TIMEOUT
|
||||
} else {
|
||||
UNREPLIED_TIMEOUT
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Conntrack {
|
||||
pub(super) fn inspect_udp(
|
||||
&mut self,
|
||||
packet: &Ipv4Packet<&[u8]>,
|
||||
direction: Direction,
|
||||
now: Instant,
|
||||
) -> ConntrackResult {
|
||||
let Ok(udp) = UdpPacket::new_checked(packet.payload()) else {
|
||||
return ConntrackResult::Denied;
|
||||
};
|
||||
if udp.src_port() == 0 || udp.dst_port() == 0 {
|
||||
return ConntrackResult::Denied;
|
||||
}
|
||||
|
||||
let key = oriented_transport_key(
|
||||
packet,
|
||||
direction,
|
||||
|host_addr, host_port, vm_addr, vm_port| FlowKey::Udp {
|
||||
host_addr,
|
||||
host_port,
|
||||
vm_addr,
|
||||
vm_port,
|
||||
},
|
||||
udp.src_port(),
|
||||
udp.dst_port(),
|
||||
);
|
||||
|
||||
if let Some(flow) = self.flows.get_mut(&key) {
|
||||
let FlowState::Udp(state) = &mut flow.state else {
|
||||
return ConntrackResult::Denied;
|
||||
};
|
||||
|
||||
let is_reply = matches!(
|
||||
(flow.initiator, direction),
|
||||
(Initiator::Host, Direction::FromVm) | (Initiator::Vm, Direction::FromHost)
|
||||
);
|
||||
state.replied |= is_reply;
|
||||
flow.last_seen = now;
|
||||
return ConntrackResult::Allowed;
|
||||
}
|
||||
|
||||
ConntrackResult::New(PendingFlow {
|
||||
key,
|
||||
flow: Flow {
|
||||
initiator: initiator(direction),
|
||||
state: FlowState::Udp(State { replied: false }),
|
||||
last_seen: now,
|
||||
},
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::super::test_support::{HOST, VM, inspect_from_host, inspect_from_vm, udp_packet};
|
||||
use super::super::{Conntrack, ConntrackResult};
|
||||
|
||||
#[test]
|
||||
fn udp_reply_requires_an_exact_host_request() {
|
||||
let mut tracker = Conntrack::new();
|
||||
|
||||
let vm_datagram = udp_packet(VM, 5353, HOST, 50000);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &vm_datagram),
|
||||
ConntrackResult::New(_)
|
||||
));
|
||||
|
||||
let host_datagram = udp_packet(HOST, 50000, VM, 5353);
|
||||
let ConntrackResult::New(pending) = inspect_from_host(&mut tracker, &host_datagram) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &vm_datagram),
|
||||
ConntrackResult::Allowed
|
||||
));
|
||||
|
||||
let wrong_vm_datagram = udp_packet(VM, 5353, HOST, 50001);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &wrong_vm_datagram),
|
||||
ConntrackResult::New(_)
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn explicitly_allowed_vm_udp_gets_only_its_reply() {
|
||||
let mut tracker = Conntrack::new();
|
||||
let vm_dns = udp_packet(VM, 53000, HOST, 53);
|
||||
let host_dns = udp_packet(HOST, 53, VM, 53000);
|
||||
|
||||
let ConntrackResult::New(pending) = inspect_from_vm(&mut tracker, &vm_dns) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &host_dns),
|
||||
ConntrackResult::Allowed
|
||||
));
|
||||
|
||||
let unsolicited_host_udp = udp_packet(HOST, 53, VM, 53001);
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &unsolicited_host_udp),
|
||||
ConntrackResult::New(_)
|
||||
));
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
+74
-11
@@ -1,5 +1,6 @@
|
||||
use crate::proxy::Proxy;
|
||||
use crate::proxy::conntrack::ConntrackResult;
|
||||
use crate::proxy::udp_packet_helper::UdpPacketHelper;
|
||||
use crate::proxy::{Action, Direction, Proxy, Rule, select_rules};
|
||||
use anyhow::{Context, Result};
|
||||
use smoltcp::wire::{EthernetFrame, EthernetProtocol, Ipv4Packet, UdpPacket};
|
||||
|
||||
@@ -39,11 +40,69 @@ impl Proxy<'_> {
|
||||
fn allowed_from_host(&mut self, frame: &EthernetFrame<&[u8]>) -> Option<()> {
|
||||
match frame.ethertype() {
|
||||
EthernetProtocol::Arp => Some(()),
|
||||
EthernetProtocol::Ipv4 => Some(()),
|
||||
EthernetProtocol::Ipv4 => {
|
||||
let ipv4_pkt = Ipv4Packet::new_checked(frame.payload()).ok()?;
|
||||
self.allowed_from_host_ipv4(&ipv4_pkt)
|
||||
}
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
fn allowed_from_host_ipv4(&mut self, ipv4_pkt: &Ipv4Packet<&[u8]>) -> Option<()> {
|
||||
if !self.stateful_policy {
|
||||
return Some(());
|
||||
}
|
||||
|
||||
if let Some(rules) = select_rules(&self.rules, ipv4_pkt.src_addr(), Direction::In) {
|
||||
// DHCP is required to maintain the VM's lease and must bypass user-specified rules
|
||||
if self.is_allowed_dhcp_response(ipv4_pkt) {
|
||||
return Some(());
|
||||
}
|
||||
|
||||
// Only process packets addressed to the VM's current IP
|
||||
let Some(lease) = self.dhcp_snooper.lease() else {
|
||||
return None;
|
||||
};
|
||||
if !lease.is_valid_for(ipv4_pkt.dst_addr()) {
|
||||
return None;
|
||||
}
|
||||
|
||||
// Stateless rules decide each packet immediately, without consulting the conntrack
|
||||
if let Some((action, _)) = rules
|
||||
.iter()
|
||||
.find(|(_, rule)| matches!(rule, Rule::Stateless(_)))
|
||||
{
|
||||
return (*action == Action::Allow).then_some(());
|
||||
}
|
||||
|
||||
// Existing connections follow conntrack; new ones require an inbound stateful allow rule
|
||||
return match self.conntrack.inspect_from_host(ipv4_pkt) {
|
||||
ConntrackResult::Allowed => Some(()),
|
||||
ConntrackResult::Denied => None,
|
||||
ConntrackResult::New(pending) => {
|
||||
let allow_new = rules.iter().any(|(action, rule)| {
|
||||
*action == Action::Allow
|
||||
&& matches!(
|
||||
rule,
|
||||
Rule::Stateful {
|
||||
direction: Direction::In,
|
||||
..
|
||||
}
|
||||
)
|
||||
});
|
||||
|
||||
if !allow_new {
|
||||
return None;
|
||||
}
|
||||
|
||||
self.conntrack.commit(pending).then_some(())
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
Some(())
|
||||
}
|
||||
|
||||
fn snoop(&mut self, frame: &EthernetFrame<&[u8]>) {
|
||||
if frame.ethertype() != EthernetProtocol::Ipv4 {
|
||||
return;
|
||||
@@ -54,11 +113,7 @@ impl Proxy<'_> {
|
||||
_ => return,
|
||||
};
|
||||
|
||||
if ipv4_pkt.src_addr() != self.host.gateway_ip {
|
||||
return;
|
||||
}
|
||||
|
||||
if ipv4_pkt.next_header() != smoltcp::wire::IpProtocol::Udp {
|
||||
if !self.is_allowed_dhcp_response(&ipv4_pkt) {
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -67,10 +122,18 @@ impl Proxy<'_> {
|
||||
Err(_) => return,
|
||||
};
|
||||
|
||||
if !udp_pkt.is_dhcp_response() {
|
||||
return;
|
||||
}
|
||||
|
||||
self.dhcp_snooper.register_dhcp_reply(udp_pkt.payload());
|
||||
}
|
||||
|
||||
fn is_allowed_dhcp_response(&self, ipv4_pkt: &Ipv4Packet<&[u8]>) -> bool {
|
||||
if ipv4_pkt.src_addr() != self.host.gateway_ip
|
||||
|| ipv4_pkt.next_header() != smoltcp::wire::IpProtocol::Udp
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
UdpPacket::new_checked(ipv4_pkt.payload())
|
||||
.map(|udp_pkt| udp_pkt.is_dhcp_response())
|
||||
.unwrap_or(false)
|
||||
}
|
||||
}
|
||||
|
||||
+122
-77
@@ -1,6 +1,10 @@
|
||||
mod conntrack;
|
||||
mod control;
|
||||
mod exposed_port;
|
||||
mod host;
|
||||
mod port_forwarder;
|
||||
mod rule;
|
||||
mod rules;
|
||||
mod udp_packet_helper;
|
||||
mod vm;
|
||||
|
||||
@@ -10,15 +14,17 @@ use crate::host::NetType;
|
||||
use crate::poller::Poller;
|
||||
use crate::vm::VM;
|
||||
use anyhow::Result;
|
||||
use conntrack::Conntrack;
|
||||
use control::Control;
|
||||
pub use exposed_port::ExposedPort;
|
||||
use ipnet::Ipv4Net;
|
||||
use mac_address::MacAddress;
|
||||
use port_forwarder::PortForwarder;
|
||||
use prefix_trie::{Prefix, PrefixMap};
|
||||
pub use rule::{Direction, Rule, Target};
|
||||
pub(crate) use rules::{Action, Rules, build_rules, has_stateful_rules, rule_count, select_rules};
|
||||
use smoltcp::wire::EthernetFrame;
|
||||
use std::io::ErrorKind;
|
||||
use std::os::unix::io::{AsRawFd, RawFd};
|
||||
use std::str::FromStr;
|
||||
use std::time::Duration;
|
||||
use vmnet::Batch;
|
||||
|
||||
@@ -28,75 +34,44 @@ pub struct Proxy<'proxy> {
|
||||
poller: Poller<'proxy>,
|
||||
vm_mac_address: smoltcp::wire::EthernetAddress,
|
||||
dhcp_snooper: DhcpSnooper,
|
||||
rules: PrefixMap<Ipv4Net, Action>,
|
||||
rules: Rules,
|
||||
stateful_policy: bool,
|
||||
control: Option<Control>,
|
||||
conntrack: Conntrack,
|
||||
enobufs_encountered: bool,
|
||||
port_forwarder: PortForwarder,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, PartialEq, Eq)]
|
||||
pub enum Target {
|
||||
Prefix(Ipv4Net),
|
||||
Host,
|
||||
}
|
||||
|
||||
impl FromStr for Target {
|
||||
type Err = ipnet::AddrParseError;
|
||||
|
||||
fn from_str(s: &str) -> std::result::Result<Self, Self::Err> {
|
||||
if s == "@host" {
|
||||
return Ok(Target::Host);
|
||||
}
|
||||
|
||||
Ipv4Net::from_str(s).map(Target::Prefix)
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, PartialEq)]
|
||||
pub(crate) enum Action {
|
||||
Block,
|
||||
Allow,
|
||||
}
|
||||
|
||||
impl Proxy<'_> {
|
||||
pub fn new<'proxy>(
|
||||
vm_fd: RawFd,
|
||||
vm_mac_address: MacAddress,
|
||||
vm_net_type: NetType,
|
||||
allow: Vec<Target>,
|
||||
block: Vec<Target>,
|
||||
allow: Vec<Rule>,
|
||||
block: Vec<Rule>,
|
||||
exposed_ports: Vec<ExposedPort>,
|
||||
control_fd: Option<RawFd>,
|
||||
) -> Result<Proxy<'proxy>> {
|
||||
let vm = VM::new(vm_fd)?;
|
||||
let host = Host::new(
|
||||
vm_net_type,
|
||||
!allow.contains(&Target::Prefix(Ipv4Net::zero())),
|
||||
!allow.contains(&Rule::Stateless(Target::Prefix(Ipv4Net::default()))),
|
||||
)?;
|
||||
let poller_timeout = Duration::from_millis(100);
|
||||
let poller = Poller::new(vm.as_raw_fd(), host.as_raw_fd(), poller_timeout)?;
|
||||
let control = control_fd
|
||||
.map(|control_fd| {
|
||||
Control::new(control_fd, host.gateway_ip, allow.clone(), block.clone())
|
||||
})
|
||||
.transpose()?;
|
||||
let poller = Poller::new(
|
||||
vm.as_raw_fd(),
|
||||
host.as_raw_fd(),
|
||||
control.as_ref().map(AsRawFd::as_raw_fd),
|
||||
poller_timeout,
|
||||
)?;
|
||||
|
||||
// Craft packet filter rules
|
||||
//
|
||||
// SECURITY: blocking rules must always take precedence
|
||||
// over allowing rules when prefixes are identical.
|
||||
let mut rules = PrefixMap::new();
|
||||
|
||||
for allow_target in allow {
|
||||
let allow_prefix = match allow_target {
|
||||
Target::Prefix(prefix) => prefix,
|
||||
Target::Host => host.gateway_ip.into(),
|
||||
};
|
||||
|
||||
rules.insert(allow_prefix, Action::Allow);
|
||||
}
|
||||
|
||||
for block_target in block {
|
||||
let block_prefix = match block_target {
|
||||
Target::Prefix(prefix) => prefix,
|
||||
Target::Host => host.gateway_ip.into(),
|
||||
};
|
||||
|
||||
rules.insert(block_prefix, Action::Block);
|
||||
}
|
||||
let rules = build_rules(host.gateway_ip, &allow, &block);
|
||||
let stateful_policy = has_stateful_rules(&rules);
|
||||
|
||||
Ok(Proxy {
|
||||
vm,
|
||||
@@ -105,6 +80,9 @@ impl Proxy<'_> {
|
||||
vm_mac_address: smoltcp::wire::EthernetAddress(vm_mac_address.bytes()),
|
||||
dhcp_snooper: DhcpSnooper::new(poller_timeout),
|
||||
rules,
|
||||
stateful_policy,
|
||||
control,
|
||||
conntrack: Conntrack::new(),
|
||||
enobufs_encountered: false,
|
||||
port_forwarder: PortForwarder::new(exposed_ports),
|
||||
})
|
||||
@@ -126,9 +104,16 @@ impl Proxy<'_> {
|
||||
loop {
|
||||
let (vm_readable, host_readable, interrupt) = self.poller.wait()?;
|
||||
|
||||
// Update coarse time for the DHCP snooper
|
||||
// Update coarse time for DHCP snooping and conntrack
|
||||
coarsetime::Instant::update();
|
||||
|
||||
// Expire stale flows before processing packets
|
||||
self.conntrack.tick();
|
||||
|
||||
// Service control on every wake (including timeouts) so a bounded read or a pending
|
||||
// response continues making progress even when no new edge is generated.
|
||||
self.service_control();
|
||||
|
||||
if vm_readable {
|
||||
self.read_from_vm(buf.as_mut_slice())?;
|
||||
}
|
||||
@@ -153,15 +138,23 @@ impl Proxy<'_> {
|
||||
}
|
||||
|
||||
fn read_from_vm(&mut self, buf: &mut [u8]) -> Result<()> {
|
||||
let mut packets_read = 0;
|
||||
|
||||
loop {
|
||||
match self.vm.read(buf) {
|
||||
Ok(n) => {
|
||||
// Update coarse time for the DHCP snooper
|
||||
// Update coarse time for DHCP snooping and conntrack
|
||||
coarsetime::Instant::update();
|
||||
|
||||
if let Ok(frame) = EthernetFrame::new_checked(&buf[..n]) {
|
||||
self.process_frame_from_vm(frame)?;
|
||||
}
|
||||
|
||||
packets_read += 1;
|
||||
if packets_read == 128 {
|
||||
self.service_control();
|
||||
packets_read = 0;
|
||||
}
|
||||
}
|
||||
Err(err) => {
|
||||
if err.kind() == ErrorKind::WouldBlock {
|
||||
@@ -178,7 +171,7 @@ impl Proxy<'_> {
|
||||
loop {
|
||||
match self.host.read(batch, bufs) {
|
||||
Ok(pktcnt) => {
|
||||
// Update coarse time for the DHCP snooper
|
||||
// Update coarse time for DHCP snooping and conntrack
|
||||
coarsetime::Instant::update();
|
||||
|
||||
for buf in batch.packet_sized_bufs(bufs).take(pktcnt) {
|
||||
@@ -186,6 +179,8 @@ impl Proxy<'_> {
|
||||
self.process_frame_from_host(&pkt)?;
|
||||
}
|
||||
}
|
||||
|
||||
self.service_control();
|
||||
}
|
||||
Err(err) => {
|
||||
if let vmnet::Error::VmnetReadNothing = err {
|
||||
@@ -197,13 +192,46 @@ impl Proxy<'_> {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn service_control(&mut self) {
|
||||
let Some(control) = self.control.as_mut() else {
|
||||
return;
|
||||
};
|
||||
|
||||
let keep_open = match control.service(&mut self.rules) {
|
||||
Ok(keep_open) => keep_open,
|
||||
Err(err) => {
|
||||
log::warn!("disabling Softnet control socket: {err:#}");
|
||||
false
|
||||
}
|
||||
};
|
||||
|
||||
if control.policy_changed() {
|
||||
self.stateful_policy = has_stateful_rules(&self.rules);
|
||||
self.conntrack.clear();
|
||||
}
|
||||
|
||||
if keep_open {
|
||||
return;
|
||||
}
|
||||
|
||||
if let Err(err) = self.poller.remove_control() {
|
||||
log::warn!("failed to remove Softnet control socket from the poller: {err:#}");
|
||||
}
|
||||
|
||||
if let Some(control) = self.control.take()
|
||||
&& let Err(err) = control.shutdown()
|
||||
{
|
||||
log::warn!("failed to shut down Softnet control socket: {err:#}");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use crate::NetType;
|
||||
use crate::dhcp_snooper::Lease;
|
||||
use crate::proxy::{Action, Proxy};
|
||||
use crate::proxy::{Action, Proxy, Rule, Target};
|
||||
use ipnet::Ipv4Net;
|
||||
use mac_address::MacAddress;
|
||||
use nix::sys::socket::{AddressFamily, SockFlag, SockType, socketpair};
|
||||
@@ -219,57 +247,73 @@ mod tests {
|
||||
#[serial]
|
||||
fn test_blocking_takes_precedence() {
|
||||
let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
|
||||
let proxy = create_proxy(vm_ip, vec!["66.66.0.0/16"], vec!["66.66.0.0/16"]);
|
||||
let mut proxy = create_proxy(vm_ip, vec!["66.66.0.0/16"], vec!["66.66.0.0/16"]);
|
||||
|
||||
assert_eq!(
|
||||
proxy.rules,
|
||||
PrefixMap::<Ipv4Net, Action>::from_iter(vec![(
|
||||
PrefixMap::<Ipv4Net, Vec<(Action, Rule)>>::from_iter(vec![(
|
||||
Ipv4Net::from_str("66.66.0.0/16").unwrap(),
|
||||
Action::Block
|
||||
vec![(Action::Block, "66.66.0.0/16".parse().unwrap(),)]
|
||||
),])
|
||||
);
|
||||
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "66.66.66.66").is_none());
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, "66.66.66.66").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial]
|
||||
fn test_longest_prefix_match_wins() {
|
||||
let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
|
||||
let proxy = create_proxy(vm_ip, vec!["33.33.33.33/32"], vec!["33.33.33.0/24"]);
|
||||
let mut proxy = create_proxy(vm_ip, vec!["33.33.33.33/32"], vec!["33.33.33.0/24"]);
|
||||
|
||||
assert_eq!(
|
||||
proxy.rules,
|
||||
PrefixMap::<Ipv4Net, Action>::from_iter(vec![
|
||||
(Ipv4Net::from_str("33.33.33.33/32").unwrap(), Action::Allow),
|
||||
(Ipv4Net::from_str("33.33.33.0/24").unwrap(), Action::Block),
|
||||
PrefixMap::<Ipv4Net, Vec<(Action, Rule)>>::from_iter(vec![
|
||||
(
|
||||
Ipv4Net::from_str("33.33.33.33/32").unwrap(),
|
||||
vec![(Action::Allow, "33.33.33.33/32".parse().unwrap(),)]
|
||||
),
|
||||
(
|
||||
Ipv4Net::from_str("33.33.33.0/24").unwrap(),
|
||||
vec![(Action::Block, "33.33.33.0/24".parse().unwrap(),)]
|
||||
),
|
||||
])
|
||||
);
|
||||
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.32").is_none());
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.33").is_some());
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.34").is_none());
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, "33.33.33.32").is_none());
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, "33.33.33.33").is_some());
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, "33.33.33.34").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial]
|
||||
fn test_allow_host() {
|
||||
let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
|
||||
let proxy = create_proxy(vm_ip, vec!["@host"], vec!["0.0.0.0/0"]);
|
||||
let mut proxy = create_proxy(vm_ip, vec!["@host"], vec!["0.0.0.0/0"]);
|
||||
|
||||
assert_eq!(
|
||||
proxy.rules,
|
||||
PrefixMap::from_iter(vec![
|
||||
(proxy.host.gateway_ip.into(), Action::Allow),
|
||||
(Ipv4Net::from_str("0.0.0.0/0").unwrap(), Action::Block),
|
||||
(
|
||||
proxy.host.gateway_ip.into(),
|
||||
vec![(
|
||||
Action::Allow,
|
||||
Rule::Stateless(Target::Prefix(proxy.host.gateway_ip.into())),
|
||||
)],
|
||||
),
|
||||
(
|
||||
Ipv4Net::from_str("0.0.0.0/0").unwrap(),
|
||||
vec![(Action::Block, "0.0.0.0/0".parse().unwrap(),)]
|
||||
),
|
||||
])
|
||||
);
|
||||
|
||||
// Access to global IPs should be disallowed because of --block=0.0.0.0/0
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "8.8.8.8").is_none());
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, "8.8.8.8").is_none());
|
||||
|
||||
// Despite the above, access to host IP address should be possible because of --allow=@host
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, &proxy.host.gateway_ip.to_string()).is_some());
|
||||
let gateway_ip = proxy.host.gateway_ip.to_string();
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, &gateway_ip).is_some());
|
||||
}
|
||||
|
||||
fn create_proxy<'test>(vm_ip: Ipv4Address, allow: Vec<&str>, block: Vec<&str>) -> Proxy<'test> {
|
||||
@@ -288,13 +332,14 @@ mod tests {
|
||||
NetType::Nat,
|
||||
allow
|
||||
.into_iter()
|
||||
.map(|cidr| cidr.parse().unwrap())
|
||||
.map(|value| value.parse().unwrap())
|
||||
.collect(),
|
||||
block
|
||||
.into_iter()
|
||||
.map(|cidr| cidr.parse().unwrap())
|
||||
.map(|value| value.parse().unwrap())
|
||||
.collect(),
|
||||
Vec::default(),
|
||||
None,
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
@@ -307,7 +352,7 @@ mod tests {
|
||||
proxy
|
||||
}
|
||||
|
||||
fn allowed_from_vm_ipv4(proxy: &Proxy, src: Ipv4Address, dst: &str) -> Option<()> {
|
||||
fn allowed_from_vm_ipv4(proxy: &mut Proxy, src: Ipv4Address, dst: &str) -> Option<()> {
|
||||
let mut buf = vec![0; 1500];
|
||||
|
||||
let mut ipv4_pkt_mut = Ipv4Packet::new_unchecked(&mut buf[..]);
|
||||
|
||||
@@ -0,0 +1,171 @@
|
||||
use ipnet::Ipv4Net;
|
||||
use std::fmt::{self, Display, Formatter};
|
||||
use std::str::FromStr;
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum Rule {
|
||||
Stateless(Target),
|
||||
Stateful {
|
||||
direction: Direction,
|
||||
target: Target,
|
||||
},
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum Target {
|
||||
Prefix(Ipv4Net),
|
||||
Host,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum Direction {
|
||||
In,
|
||||
Out,
|
||||
}
|
||||
|
||||
impl Rule {
|
||||
pub(super) fn target(self) -> Target {
|
||||
match self {
|
||||
Rule::Stateless(target) => target,
|
||||
Rule::Stateful { target, .. } => target,
|
||||
}
|
||||
}
|
||||
|
||||
pub(super) fn normalized(self) -> Self {
|
||||
match self {
|
||||
Rule::Stateless(target) => Rule::Stateless(target.normalized()),
|
||||
Rule::Stateful { direction, target } => Rule::Stateful {
|
||||
direction,
|
||||
target: target.normalized(),
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl FromStr for Rule {
|
||||
type Err = ipnet::AddrParseError;
|
||||
|
||||
fn from_str(input: &str) -> Result<Self, Self::Err> {
|
||||
let (direction, target) = if let Some(target) = input.strip_prefix("in ") {
|
||||
(Direction::In, target)
|
||||
} else if let Some(target) = input.strip_prefix("out ") {
|
||||
(Direction::Out, target)
|
||||
} else {
|
||||
return input.parse().map(Rule::Stateless);
|
||||
};
|
||||
|
||||
let target = target.trim_start_matches(' ').parse()?;
|
||||
Ok(Rule::Stateful { direction, target })
|
||||
}
|
||||
}
|
||||
|
||||
impl Display for Rule {
|
||||
fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
|
||||
match self {
|
||||
Rule::Stateless(target) => Display::fmt(target, formatter),
|
||||
Rule::Stateful { direction, target } => match direction {
|
||||
Direction::In => write!(formatter, "in {target}"),
|
||||
Direction::Out => write!(formatter, "out {target}"),
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Target {
|
||||
fn normalized(self) -> Self {
|
||||
match self {
|
||||
Target::Prefix(prefix) => Target::Prefix(prefix.trunc()),
|
||||
Target::Host => Target::Host,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl FromStr for Target {
|
||||
type Err = ipnet::AddrParseError;
|
||||
|
||||
fn from_str(input: &str) -> Result<Self, Self::Err> {
|
||||
if input == "@host" {
|
||||
Ok(Target::Host)
|
||||
} else {
|
||||
input.parse().map(Target::Prefix)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Display for Target {
|
||||
fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
|
||||
match self {
|
||||
Target::Prefix(prefix) => Display::fmt(prefix, formatter),
|
||||
Target::Host => formatter.write_str("@host"),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::{Direction, Rule, Target};
|
||||
use ipnet::Ipv4Net;
|
||||
use std::str::FromStr;
|
||||
|
||||
#[test]
|
||||
fn parses_stateless_target() {
|
||||
assert_eq!(
|
||||
"@host".parse::<Rule>().unwrap(),
|
||||
Rule::Stateless(Target::Host)
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_stateful_directions() {
|
||||
let private_network = Target::Prefix(Ipv4Net::from_str("10.0.0.0/8").unwrap());
|
||||
|
||||
assert_eq!(
|
||||
"in @host".parse::<Rule>().unwrap(),
|
||||
Rule::Stateful {
|
||||
direction: Direction::In,
|
||||
target: Target::Host,
|
||||
}
|
||||
);
|
||||
assert_eq!(
|
||||
"out 10.0.0.0/8".parse::<Rule>().unwrap(),
|
||||
Rule::Stateful {
|
||||
direction: Direction::Out,
|
||||
target: private_network,
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn displays_normalized_rules() {
|
||||
assert_eq!(
|
||||
"in 10.1.2.3/8"
|
||||
.parse::<Rule>()
|
||||
.unwrap()
|
||||
.normalized()
|
||||
.to_string(),
|
||||
"in 10.0.0.0/8"
|
||||
);
|
||||
assert_eq!(
|
||||
"@host".parse::<Rule>().unwrap().normalized().to_string(),
|
||||
"@host"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn rejects_invalid_rules() {
|
||||
for input in [
|
||||
"",
|
||||
"from @host",
|
||||
"in",
|
||||
"out",
|
||||
"in from @host",
|
||||
"out to @host",
|
||||
"infrom @host",
|
||||
" in @host",
|
||||
"in @host ",
|
||||
"in\t@host",
|
||||
] {
|
||||
assert!(input.parse::<Rule>().is_err(), "{input:?} should fail");
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,202 @@
|
||||
use super::{Direction, Rule, Target};
|
||||
use ipnet::Ipv4Net;
|
||||
use prefix_trie::PrefixMap;
|
||||
use smoltcp::wire::Ipv4Address;
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub(crate) enum Action {
|
||||
Block,
|
||||
Allow,
|
||||
}
|
||||
|
||||
pub(crate) type Rules = PrefixMap<Ipv4Net, Vec<(Action, Rule)>>;
|
||||
|
||||
pub(crate) fn select_rules(
|
||||
rules: &Rules,
|
||||
address: Ipv4Address,
|
||||
direction: Direction,
|
||||
) -> Option<&[(Action, Rule)]> {
|
||||
if rules.is_empty() {
|
||||
return None;
|
||||
}
|
||||
|
||||
let mut prefix = Ipv4Net::from(address);
|
||||
loop {
|
||||
let (matched_prefix, matched_rules) = rules.get_lpm(&prefix)?;
|
||||
if matched_rules.iter().any(|(_, rule)| match rule {
|
||||
Rule::Stateless(_) => true,
|
||||
Rule::Stateful {
|
||||
direction: rule_direction,
|
||||
..
|
||||
} => *rule_direction == direction,
|
||||
}) {
|
||||
return Some(matched_rules.as_slice());
|
||||
}
|
||||
prefix = matched_prefix.supernet()?;
|
||||
}
|
||||
}
|
||||
|
||||
pub(crate) fn build_rules(host_address: Ipv4Address, allow: &[Rule], block: &[Rule]) -> Rules {
|
||||
let mut rules = PrefixMap::new();
|
||||
|
||||
for &rule in allow {
|
||||
insert_rule(&mut rules, rule, Action::Allow, host_address);
|
||||
}
|
||||
|
||||
for &rule in block {
|
||||
insert_rule(&mut rules, rule, Action::Block, host_address);
|
||||
}
|
||||
|
||||
rules
|
||||
}
|
||||
|
||||
pub(crate) fn rule_count(rules: &Rules) -> usize {
|
||||
rules.into_iter().map(|(_, rules)| rules.len()).sum()
|
||||
}
|
||||
|
||||
pub(crate) fn has_stateful_rules(rules: &Rules) -> bool {
|
||||
rules.into_iter().any(|(_, rules)| {
|
||||
rules
|
||||
.iter()
|
||||
.any(|(_, rule)| matches!(rule, Rule::Stateful { .. }))
|
||||
})
|
||||
}
|
||||
|
||||
fn insert_rule(rules: &mut Rules, rule: Rule, mut action: Action, host_address: Ipv4Address) {
|
||||
let prefix = match rule.target() {
|
||||
Target::Prefix(prefix) => prefix,
|
||||
Target::Host => host_address.into(),
|
||||
};
|
||||
let rule = match rule {
|
||||
Rule::Stateless(_) => Rule::Stateless(Target::Prefix(prefix)),
|
||||
Rule::Stateful { direction, .. } => Rule::Stateful {
|
||||
direction,
|
||||
target: Target::Prefix(prefix),
|
||||
},
|
||||
};
|
||||
|
||||
let prefix_rules = rules.entry(prefix).or_default();
|
||||
|
||||
// SECURITY: blocking rules must always take precedence
|
||||
// over allowing rules when prefixes are identical
|
||||
if let Some(existing) = prefix_rules
|
||||
.iter_mut()
|
||||
.find(|(_, existing_rule)| *existing_rule == rule)
|
||||
{
|
||||
if existing.0 == Action::Block {
|
||||
action = Action::Block;
|
||||
}
|
||||
*existing = (action, rule);
|
||||
} else {
|
||||
prefix_rules.push((action, rule));
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::{Action, has_stateful_rules, insert_rule, rule_count, select_rules};
|
||||
use crate::proxy::{Direction, Rule, Target};
|
||||
use ipnet::Ipv4Net;
|
||||
use prefix_trie::PrefixMap;
|
||||
use smoltcp::wire::Ipv4Address;
|
||||
use std::str::FromStr;
|
||||
|
||||
#[test]
|
||||
fn test_policy_precedence() {
|
||||
let host = Ipv4Address::new(192, 168, 64, 1);
|
||||
let target = Ipv4Address::new(10, 0, 0, 1);
|
||||
let mut rules = PrefixMap::new();
|
||||
|
||||
insert_rule(
|
||||
&mut rules,
|
||||
"0.0.0.0/0".parse().unwrap(),
|
||||
Action::Block,
|
||||
host,
|
||||
);
|
||||
assert!(!has_stateful_rules(&rules));
|
||||
|
||||
insert_rule(
|
||||
&mut rules,
|
||||
"in 10.0.0.0/8".parse().unwrap(),
|
||||
Action::Allow,
|
||||
host,
|
||||
);
|
||||
assert!(has_stateful_rules(&rules));
|
||||
|
||||
assert_eq!(
|
||||
select_rules(&rules, target, Direction::In),
|
||||
Some(
|
||||
&[(
|
||||
Action::Allow,
|
||||
Rule::Stateful {
|
||||
direction: Direction::In,
|
||||
target: Target::Prefix(Ipv4Net::from_str("10.0.0.0/8").unwrap()),
|
||||
}
|
||||
)][..]
|
||||
)
|
||||
);
|
||||
assert_eq!(
|
||||
select_rules(&rules, target, Direction::Out),
|
||||
Some(&[(Action::Block, "0.0.0.0/0".parse().unwrap())][..])
|
||||
);
|
||||
|
||||
insert_rule(
|
||||
&mut rules,
|
||||
"10.0.0.1/32".parse().unwrap(),
|
||||
Action::Allow,
|
||||
host,
|
||||
);
|
||||
assert_eq!(
|
||||
select_rules(&rules, target, Direction::Out).unwrap().len(),
|
||||
1
|
||||
);
|
||||
|
||||
insert_rule(
|
||||
&mut rules,
|
||||
"out 10.0.0.1/32".parse().unwrap(),
|
||||
Action::Allow,
|
||||
host,
|
||||
);
|
||||
assert_eq!(
|
||||
select_rules(&rules, target, Direction::Out).unwrap().len(),
|
||||
2
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_directional_rules_share_a_prefix() {
|
||||
let host = Ipv4Address::new(192, 168, 64, 1);
|
||||
let mut rules = PrefixMap::new();
|
||||
|
||||
for (target, action) in [
|
||||
("in @host", Action::Allow),
|
||||
("out @host", Action::Allow),
|
||||
("in @host", Action::Block),
|
||||
] {
|
||||
insert_rule(&mut rules, target.parse().unwrap(), action, host);
|
||||
}
|
||||
|
||||
assert_eq!(
|
||||
select_rules(&rules, host, Direction::In),
|
||||
Some(
|
||||
&[
|
||||
(
|
||||
Action::Block,
|
||||
Rule::Stateful {
|
||||
direction: Direction::In,
|
||||
target: Target::Prefix(host.into()),
|
||||
}
|
||||
),
|
||||
(
|
||||
Action::Allow,
|
||||
Rule::Stateful {
|
||||
direction: Direction::Out,
|
||||
target: Target::Prefix(host.into()),
|
||||
}
|
||||
),
|
||||
][..]
|
||||
)
|
||||
);
|
||||
assert_eq!(rule_count(&rules), 2);
|
||||
}
|
||||
}
|
||||
+96
-20
@@ -1,12 +1,12 @@
|
||||
use crate::dhcp_snooper::Lease;
|
||||
use crate::proxy::conntrack::ConntrackResult;
|
||||
use crate::proxy::udp_packet_helper::UdpPacketHelper;
|
||||
use crate::proxy::{Action, Proxy};
|
||||
use crate::proxy::{Action, Direction, Proxy, Rule, select_rules};
|
||||
use anyhow::Context;
|
||||
use anyhow::Result;
|
||||
use ipnet::Ipv4Net;
|
||||
use smoltcp::wire::{
|
||||
ArpOperation, ArpPacket, ArpRepr, EthernetFrame, EthernetProtocol, IpProtocol, Ipv4Packet,
|
||||
UdpPacket,
|
||||
ArpOperation, ArpPacket, ArpRepr, EthernetFrame, EthernetProtocol, IpProtocol, Ipv4Address,
|
||||
Ipv4Packet, UdpPacket,
|
||||
};
|
||||
|
||||
impl Proxy<'_> {
|
||||
@@ -22,7 +22,7 @@ impl Proxy<'_> {
|
||||
.context("failed to write to the host")
|
||||
}
|
||||
|
||||
fn allowed_from_vm(&self, frame: &EthernetFrame<&[u8]>) -> Option<()> {
|
||||
fn allowed_from_vm(&mut self, frame: &EthernetFrame<&[u8]>) -> Option<()> {
|
||||
if frame.src_addr() != self.vm_mac_address {
|
||||
return None;
|
||||
}
|
||||
@@ -44,23 +44,52 @@ impl Proxy<'_> {
|
||||
vm_arp_allowed(arp_pkt, self.vm_mac_address, self.dhcp_snooper.lease())
|
||||
}
|
||||
|
||||
pub(crate) fn allowed_from_vm_ipv4(&self, ipv4_pkt: Ipv4Packet<&[u8]>) -> Option<()> {
|
||||
pub(crate) fn allowed_from_vm_ipv4(&mut self, ipv4_pkt: Ipv4Packet<&[u8]>) -> Option<()> {
|
||||
// Is this packet coming from VM's IP address that we've learned from DHCP snooping?
|
||||
if let Some(lease) = &self.dhcp_snooper.lease()
|
||||
&& lease.valid_ip_source(ipv4_pkt.src_addr())
|
||||
&& lease.is_valid_for(ipv4_pkt.src_addr())
|
||||
{
|
||||
let dst_addr = ipv4_pkt.dst_addr();
|
||||
|
||||
// Filter traffic based on user-specified rules first
|
||||
if !self.rules.is_empty() {
|
||||
let dst_net = Ipv4Net::from(dst_addr);
|
||||
if let Some(rules) = select_rules(&self.rules, dst_addr, Direction::Out) {
|
||||
// DHCP is required to maintain the VM's lease and must bypass user-specified rules
|
||||
if is_allowed_dhcp_request(&ipv4_pkt, Some(self.host.gateway_ip)) {
|
||||
return Some(());
|
||||
}
|
||||
|
||||
if let Some((_, action)) = self.rules.get_lpm(&dst_net) {
|
||||
if let Some((action, _)) = rules
|
||||
.iter()
|
||||
.find(|(_, rule)| matches!(rule, Rule::Stateless(_)))
|
||||
{
|
||||
return match action {
|
||||
Action::Allow => Some(()),
|
||||
Action::Block => None,
|
||||
};
|
||||
}
|
||||
|
||||
return match self.conntrack.inspect_from_vm(&ipv4_pkt) {
|
||||
ConntrackResult::Allowed => Some(()),
|
||||
ConntrackResult::Denied => None,
|
||||
ConntrackResult::New(pending) => {
|
||||
let allow_new = rules.iter().any(|(action, rule)| {
|
||||
*action == Action::Allow
|
||||
&& matches!(
|
||||
rule,
|
||||
Rule::Stateful {
|
||||
direction: Direction::Out,
|
||||
..
|
||||
}
|
||||
)
|
||||
});
|
||||
|
||||
if !allow_new {
|
||||
return None;
|
||||
}
|
||||
|
||||
self.conntrack.commit(pending).then_some(())
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
// When no user-specified rules matched, simply allow all global traffic
|
||||
@@ -87,21 +116,38 @@ impl Proxy<'_> {
|
||||
}
|
||||
}
|
||||
|
||||
// Allow outgoing DHCP requests to broadcast addresses,
|
||||
// Allow outgoing DHCP requests to the bootpd(8) broadcast address,
|
||||
// otherwise DHCP snooper will never be populated
|
||||
if ipv4_pkt.next_header() == IpProtocol::Udp {
|
||||
let udp_pkt = UdpPacket::new_checked(ipv4_pkt.payload()).ok()?;
|
||||
|
||||
// Allow DHCP communication with the bootpd(8) on host via broadcast address
|
||||
if udp_pkt.is_dhcp_request() && ipv4_pkt.dst_addr().is_broadcast() {
|
||||
return Some(());
|
||||
}
|
||||
if is_allowed_dhcp_request(&ipv4_pkt, None) {
|
||||
return Some(());
|
||||
}
|
||||
|
||||
None
|
||||
}
|
||||
}
|
||||
|
||||
fn is_allowed_dhcp_request(
|
||||
ipv4_pkt: &Ipv4Packet<&[u8]>,
|
||||
unicast_target: Option<Ipv4Address>,
|
||||
) -> bool {
|
||||
let dst_addr = ipv4_pkt.dst_addr();
|
||||
|
||||
// Keep the common path cheap and inspect UDP only for a permitted DHCP target
|
||||
if !dst_addr.is_broadcast() && unicast_target != Some(dst_addr) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if ipv4_pkt.next_header() != IpProtocol::Udp {
|
||||
return false;
|
||||
}
|
||||
|
||||
let Ok(udp_pkt) = UdpPacket::new_checked(ipv4_pkt.payload()) else {
|
||||
return false;
|
||||
};
|
||||
|
||||
udp_pkt.is_dhcp_request()
|
||||
}
|
||||
|
||||
fn vm_arp_allowed(
|
||||
arp_pkt: ArpPacket<&[u8]>,
|
||||
vm_mac_address: smoltcp::wire::EthernetAddress,
|
||||
@@ -127,7 +173,7 @@ fn vm_arp_allowed(
|
||||
}
|
||||
|
||||
if let Some(lease) = lease {
|
||||
if lease.valid_ip_source(source_protocol_addr) {
|
||||
if lease.is_valid_for(source_protocol_addr) {
|
||||
return Some(());
|
||||
}
|
||||
} else if source_protocol_addr.is_unspecified() {
|
||||
@@ -141,11 +187,23 @@ fn vm_arp_allowed(
|
||||
mod tests {
|
||||
use crate::dhcp_snooper::Lease;
|
||||
use smoltcp::wire::{
|
||||
ArpHardware, ArpOperation, ArpPacket, EthernetAddress, EthernetProtocol, Ipv4Address,
|
||||
ArpHardware, ArpOperation, ArpPacket, EthernetAddress, EthernetProtocol, IpProtocol,
|
||||
Ipv4Address, Ipv4Packet, UdpPacket,
|
||||
};
|
||||
use std::collections::HashSet;
|
||||
use std::time::Duration;
|
||||
|
||||
#[test]
|
||||
fn test_allowed_dhcp_request_targets() {
|
||||
let gateway = Ipv4Address::new(192, 168, 64, 1);
|
||||
let other = Ipv4Address::new(192, 168, 64, 2);
|
||||
|
||||
assert!(allowed_dhcp_request(Ipv4Address::BROADCAST, None));
|
||||
assert!(allowed_dhcp_request(gateway, Some(gateway)));
|
||||
assert!(!allowed_dhcp_request(gateway, None));
|
||||
assert!(!allowed_dhcp_request(other, Some(gateway)));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_allowed_from_vm_arp_allows_unspecified_request_without_lease() {
|
||||
let vm_mac_address = EthernetAddress([0x02, 0x00, 0x00, 0x00, 0x00, 0x01]);
|
||||
@@ -244,4 +302,22 @@ mod tests {
|
||||
arp_pkt.set_target_protocol_addr(&vec![0; protocol_len as usize]);
|
||||
buf
|
||||
}
|
||||
|
||||
fn allowed_dhcp_request(dst_addr: Ipv4Address, unicast_target: Option<Ipv4Address>) -> bool {
|
||||
let mut buf = vec![0; 28];
|
||||
let mut ipv4_pkt = Ipv4Packet::new_unchecked(buf.as_mut_slice());
|
||||
ipv4_pkt.set_version(4);
|
||||
ipv4_pkt.set_header_len(20);
|
||||
ipv4_pkt.set_total_len(28);
|
||||
ipv4_pkt.set_next_header(IpProtocol::Udp);
|
||||
ipv4_pkt.set_dst_addr(dst_addr);
|
||||
|
||||
let mut udp_pkt = UdpPacket::new_unchecked(ipv4_pkt.payload_mut());
|
||||
udp_pkt.set_src_port(68);
|
||||
udp_pkt.set_dst_port(67);
|
||||
udp_pkt.set_len(8);
|
||||
|
||||
let ipv4_pkt = Ipv4Packet::new_checked(buf.as_slice()).unwrap();
|
||||
super::is_allowed_dhcp_request(&ipv4_pkt, unicast_target)
|
||||
}
|
||||
}
|
||||
|
||||
+62
-20
@@ -7,7 +7,7 @@ use privdrop::PrivDrop;
|
||||
use softnet::NetType;
|
||||
use softnet::proxy::ExposedPort;
|
||||
use softnet::proxy::Proxy;
|
||||
use softnet::proxy::Target;
|
||||
use softnet::proxy::Rule;
|
||||
use std::borrow::Cow;
|
||||
use std::env;
|
||||
use std::os::raw::c_int;
|
||||
@@ -31,6 +31,13 @@ struct Args {
|
||||
)]
|
||||
vm_fd: c_int,
|
||||
|
||||
#[clap(
|
||||
long,
|
||||
value_parser = parse_vm_fd,
|
||||
help = "connected Unix stream FD for newline-delimited JSON-RPC policy control"
|
||||
)]
|
||||
control_fd: Option<c_int>,
|
||||
|
||||
#[clap(long, help = "MAC address to enforce for the VM")]
|
||||
vm_mac_address: mac_address::MacAddress,
|
||||
|
||||
@@ -52,34 +59,51 @@ struct Args {
|
||||
|
||||
#[clap(
|
||||
long,
|
||||
help = "Comma-separated list of CIDRs to allow the traffic to \
|
||||
(e.g. --allow=192.168.0.0/24 may be used to allow a LAN access for a VM), \
|
||||
plus supported @-aliases. Currently the only supported @-alias is @host, \
|
||||
which matches the vmnet bridge gateway IP. \
|
||||
When used with --block, the longest prefix match always wins. \
|
||||
In case an identical prefix is both --allow'ed and --block'ed, \
|
||||
blocking will take precedence. --allow=0.0.0.0/0 is a special case, \
|
||||
it additionally disables bridge isolation (even when --block=0.0.0.0/0 is specified).",
|
||||
value_name = "comma-separated CIDRs or @-alias",
|
||||
help = "Comma-separated list of rules for allowing traffic.\n\n\
|
||||
Rule forms:\n\n\
|
||||
* TARGET: traffic between TARGET and the VM in either direction\n\
|
||||
* in TARGET: flows initiated from TARGET to the VM\n\
|
||||
* out TARGET: flows initiated from the VM to TARGET\n\n\
|
||||
Targets are:\n\n\
|
||||
* IPv4 CIDRs\n\
|
||||
* @host, which matches the vmnet bridge gateway IP\n\n\
|
||||
When used with --block, the longest prefix match wins. If an identical rule is both \
|
||||
allowed and blocked, blocking takes precedence.\n\n\
|
||||
--allow=0.0.0.0/0 additionally disables bridge isolation, even when \
|
||||
--block=0.0.0.0/0 is specified.\n\n\
|
||||
Examples:\n\n\
|
||||
* --allow=192.168.0.0/24 — allow stateless traffic with this LAN\n\
|
||||
* --allow=\"in @host\" — allow stateful flows initiated from @host\n\
|
||||
* --allow=\"out 192.168.0.0/24\" — allow stateful flows initiated toward this LAN\n\
|
||||
* --allow=\"in @host,out 192.168.0.0/24\" — multiple rules may be comma-separated",
|
||||
value_name = "comma-separated rules",
|
||||
use_value_delimiter = true,
|
||||
action = clap::ArgAction::Set
|
||||
)]
|
||||
allow: Vec<Target>,
|
||||
allow: Vec<Rule>,
|
||||
|
||||
#[clap(
|
||||
long,
|
||||
help = "Comma-separated list of CIDRs to block the traffic to \
|
||||
(e.g. --block=0.0.0.0/0 may be used to establish a default deny policy \
|
||||
that is further relaxed with --allow), plus supported @-aliases. \
|
||||
Currently the only supported @-alias is @host, which matches the vmnet bridge gateway IP. \
|
||||
When used with --allow, the longest prefix match always wins. \
|
||||
In case an identical prefix is both --allow'ed and --block'ed, \
|
||||
blocking will take precedence.",
|
||||
value_name = "comma-separated CIDRs or @-alias",
|
||||
help = "Comma-separated list of rules for blocking traffic.\n\n\
|
||||
Rule forms:\n\n\
|
||||
* TARGET: traffic between TARGET and the VM in either direction\n\
|
||||
* in TARGET: flows initiated from TARGET to the VM\n\
|
||||
* out TARGET: flows initiated from the VM to TARGET\n\n\
|
||||
Targets are:\n\n\
|
||||
* IPv4 CIDRs\n\
|
||||
* @host, which matches the vmnet bridge gateway IP\n\n\
|
||||
When used with --allow, the longest prefix match wins. If an identical rule is both \
|
||||
allowed and blocked, blocking takes precedence.\n\n\
|
||||
Examples:\n\n\
|
||||
* --block=0.0.0.0/0 — establish a stateless default-deny policy\n\
|
||||
* --block=\"in @host\" — block stateful flows initiated from @host\n\
|
||||
* --block=\"out 66.66.66.0/24\" — block stateful flows initiated toward this CIDR\n\
|
||||
* --block=\"in @host,out 66.66.66.0/24\" — multiple rules may be comma-separated",
|
||||
value_name = "comma-separated rules",
|
||||
use_value_delimiter = true,
|
||||
action = clap::ArgAction::Set
|
||||
)]
|
||||
block: Vec<Target>,
|
||||
block: Vec<Rule>,
|
||||
|
||||
#[clap(
|
||||
long,
|
||||
@@ -203,6 +227,7 @@ fn try_main() -> anyhow::Result<()> {
|
||||
args.allow,
|
||||
args.block,
|
||||
args.expose,
|
||||
args.control_fd.map(|fd| fd as RawFd),
|
||||
)
|
||||
.context("failed to initialize proxy")?;
|
||||
|
||||
@@ -286,4 +311,21 @@ mod tests {
|
||||
.contains("file descriptor must be non-negative")
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_cli_rejects_negative_control_fd_before_startup() {
|
||||
let error = Args::try_parse_from([
|
||||
"softnet",
|
||||
"--vm-fd=0",
|
||||
"--control-fd=-1",
|
||||
"--vm-mac-address=02:00:00:00:00:01",
|
||||
])
|
||||
.unwrap_err();
|
||||
|
||||
assert!(
|
||||
error
|
||||
.to_string()
|
||||
.contains("file descriptor must be non-negative")
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user