Compare commits
No commits in common. "main" and "0.20.0" have entirely different histories.
|
|
@ -5,8 +5,6 @@ project_name: softnet
|
|||
builds:
|
||||
- builder: rust
|
||||
command: build
|
||||
env:
|
||||
- SOFTNET_VERSION={{ .Version }}-{{ .ShortCommit }}
|
||||
targets:
|
||||
- aarch64-apple-darwin
|
||||
- x86_64-apple-darwin
|
||||
|
|
|
|||
|
|
@ -230,15 +230,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "anyhow"
|
||||
version = "1.0.104"
|
||||
version = "1.0.102"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
|
||||
|
||||
[[package]]
|
||||
name = "array-const-fn-init"
|
||||
version = "0.1.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8bcb85e548c05d407fa6faff46b750ba287714ef32afc0f5e15b4641ffd6affb"
|
||||
checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
|
||||
|
||||
[[package]]
|
||||
name = "arrayvec"
|
||||
|
|
@ -246,6 +240,12 @@ version = "0.5.2"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
|
||||
|
||||
[[package]]
|
||||
name = "atomic-waker"
|
||||
version = "1.1.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
|
||||
|
||||
[[package]]
|
||||
name = "autocfg"
|
||||
version = "1.4.0"
|
||||
|
|
@ -368,9 +368,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "clap"
|
||||
version = "4.6.6"
|
||||
version = "4.6.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
|
||||
checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
|
||||
dependencies = [
|
||||
"clap_builder",
|
||||
"clap_derive",
|
||||
|
|
@ -378,9 +378,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "clap_builder"
|
||||
version = "4.6.6"
|
||||
version = "4.6.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
|
||||
checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
|
||||
dependencies = [
|
||||
"anstream",
|
||||
"anstyle",
|
||||
|
|
@ -390,14 +390,14 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "clap_derive"
|
||||
version = "4.6.4"
|
||||
version = "4.6.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
|
||||
checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
|
||||
dependencies = [
|
||||
"heck",
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn 3.0.2",
|
||||
"syn 2.0.117",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -458,16 +458,6 @@ dependencies = [
|
|||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "core-foundation"
|
||||
version = "0.10.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
|
||||
dependencies = [
|
||||
"core-foundation-sys",
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "core-foundation-sys"
|
||||
version = "0.8.7"
|
||||
|
|
@ -642,20 +632,20 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "dhcproto"
|
||||
version = "0.16.0"
|
||||
source = "git+https://github.com/bluecatengineering/dhcproto.git?branch=master#60719e5df11359b12bf74e743b3c7e0831351c2d"
|
||||
version = "0.14.0"
|
||||
source = "git+https://github.com/bluecatengineering/dhcproto.git?branch=master#eece41c9a13b0e4912fb9a8f08401ab01b4123d4"
|
||||
dependencies = [
|
||||
"dhcproto-macros",
|
||||
"hickory-proto",
|
||||
"ipnet",
|
||||
"rand 0.10.1",
|
||||
"thiserror 2.0.19",
|
||||
"rand 0.9.4",
|
||||
"thiserror 2.0.12",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "dhcproto-macros"
|
||||
version = "0.2.0"
|
||||
source = "git+https://github.com/bluecatengineering/dhcproto.git?branch=master#60719e5df11359b12bf74e743b3c7e0831351c2d"
|
||||
source = "git+https://github.com/bluecatengineering/dhcproto.git?branch=master#eece41c9a13b0e4912fb9a8f08401ab01b4123d4"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
|
|
@ -899,6 +889,25 @@ version = "0.31.0"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "32085ea23f3234fc7846555e85283ba4de91e21016dc0455a16286d87a292d64"
|
||||
|
||||
[[package]]
|
||||
name = "h2"
|
||||
version = "0.4.13"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
|
||||
dependencies = [
|
||||
"atomic-waker",
|
||||
"bytes",
|
||||
"fnv",
|
||||
"futures-core",
|
||||
"futures-sink",
|
||||
"http 1.1.0",
|
||||
"indexmap",
|
||||
"slab",
|
||||
"tokio",
|
||||
"tokio-util",
|
||||
"tracing",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "hash32"
|
||||
version = "0.3.1"
|
||||
|
|
@ -984,7 +993,7 @@ dependencies = [
|
|||
"jni",
|
||||
"once_cell",
|
||||
"rand 0.10.1",
|
||||
"thiserror 2.0.19",
|
||||
"thiserror 2.0.12",
|
||||
"tinyvec",
|
||||
"tracing",
|
||||
"url",
|
||||
|
|
@ -1076,6 +1085,7 @@ dependencies = [
|
|||
"bytes",
|
||||
"futures-channel",
|
||||
"futures-util",
|
||||
"h2",
|
||||
"http 1.1.0",
|
||||
"http-body",
|
||||
"httparse",
|
||||
|
|
@ -1086,6 +1096,22 @@ dependencies = [
|
|||
"want",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "hyper-rustls"
|
||||
version = "0.27.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
|
||||
dependencies = [
|
||||
"http 1.1.0",
|
||||
"hyper",
|
||||
"hyper-util",
|
||||
"rustls",
|
||||
"rustls-pki-types",
|
||||
"tokio",
|
||||
"tokio-rustls",
|
||||
"tower-service",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "hyper-tls"
|
||||
version = "0.6.0"
|
||||
|
|
@ -1303,9 +1329,9 @@ checksum = "aa2f047c0a98b2f299aa5d6d7088443570faae494e9ae1305e48be000c9e0eb1"
|
|||
|
||||
[[package]]
|
||||
name = "ipnet"
|
||||
version = "2.12.1"
|
||||
version = "2.12.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
|
||||
checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
|
||||
|
||||
[[package]]
|
||||
name = "iri-string"
|
||||
|
|
@ -1341,7 +1367,7 @@ dependencies = [
|
|||
"jni-sys",
|
||||
"log",
|
||||
"simd_cesu8",
|
||||
"thiserror 2.0.19",
|
||||
"thiserror 2.0.12",
|
||||
"walkdir",
|
||||
"windows-link",
|
||||
]
|
||||
|
|
@ -1388,18 +1414,6 @@ dependencies = [
|
|||
"wasm-bindgen",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "jsonrpsee-types"
|
||||
version = "0.26.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bc88ff4688e43cc3fa9883a8a95c6fa27aa2e76c96e610b737b6554d650d7fd5"
|
||||
dependencies = [
|
||||
"http 1.1.0",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"thiserror 2.0.19",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "language-tags"
|
||||
version = "0.3.2"
|
||||
|
|
@ -1420,9 +1434,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
|
|||
|
||||
[[package]]
|
||||
name = "libc"
|
||||
version = "0.2.189"
|
||||
version = "0.2.186"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
|
||||
checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
|
||||
|
||||
[[package]]
|
||||
name = "linux-raw-sys"
|
||||
|
|
@ -1471,9 +1485,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "log"
|
||||
version = "0.4.33"
|
||||
version = "0.4.29"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
|
||||
checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
|
||||
|
||||
[[package]]
|
||||
name = "mac_address"
|
||||
|
|
@ -1578,9 +1592,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "nix"
|
||||
version = "0.31.3"
|
||||
version = "0.31.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
|
||||
checksum = "5d6d0705320c1e6ba1d912b5e37cf18071b6c2e9b7fa8215a1e8a7651966f5d3"
|
||||
dependencies = [
|
||||
"bitflags 2.9.4",
|
||||
"cfg-if",
|
||||
|
|
@ -1830,11 +1844,10 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "prefix-trie"
|
||||
version = "0.9.2"
|
||||
version = "0.8.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "fbeb97a96d43f215f842f6ab81e8c7b5f6e9b912495c3178127f54f9dce28e32"
|
||||
checksum = "90f561214012d3fc240a1f9c817cc4d57f5310910d066069c1b093f766bb5966"
|
||||
dependencies = [
|
||||
"array-const-fn-init",
|
||||
"either",
|
||||
"ipnet",
|
||||
"num-traits",
|
||||
|
|
@ -2034,10 +2047,12 @@ dependencies = [
|
|||
"futures-channel",
|
||||
"futures-core",
|
||||
"futures-util",
|
||||
"h2",
|
||||
"http 1.1.0",
|
||||
"http-body",
|
||||
"http-body-util",
|
||||
"hyper",
|
||||
"hyper-rustls",
|
||||
"hyper-tls",
|
||||
"hyper-util",
|
||||
"js-sys",
|
||||
|
|
@ -2060,6 +2075,20 @@ dependencies = [
|
|||
"web-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "ring"
|
||||
version = "0.17.14"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"cfg-if",
|
||||
"getrandom 0.2.15",
|
||||
"libc",
|
||||
"untrusted",
|
||||
"windows-sys 0.52.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rustc-demangle"
|
||||
version = "0.1.24"
|
||||
|
|
@ -2101,6 +2130,19 @@ dependencies = [
|
|||
"windows-sys 0.59.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rustls"
|
||||
version = "0.23.37"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
|
||||
dependencies = [
|
||||
"once_cell",
|
||||
"rustls-pki-types",
|
||||
"rustls-webpki",
|
||||
"subtle",
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rustls-pemfile"
|
||||
version = "2.2.0"
|
||||
|
|
@ -2119,6 +2161,17 @@ dependencies = [
|
|||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rustls-webpki"
|
||||
version = "0.103.13"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
|
||||
dependencies = [
|
||||
"ring",
|
||||
"rustls-pki-types",
|
||||
"untrusted",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rustversion"
|
||||
version = "1.0.21"
|
||||
|
|
@ -2140,6 +2193,15 @@ dependencies = [
|
|||
"winapi-util",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "scc"
|
||||
version = "2.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
|
||||
dependencies = [
|
||||
"sdd",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "schannel"
|
||||
version = "0.1.24"
|
||||
|
|
@ -2155,6 +2217,12 @@ version = "1.2.0"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
|
||||
|
||||
[[package]]
|
||||
name = "sdd"
|
||||
version = "3.0.10"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
|
||||
|
||||
[[package]]
|
||||
name = "security-framework"
|
||||
version = "2.11.1"
|
||||
|
|
@ -2162,7 +2230,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|||
checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
|
||||
dependencies = [
|
||||
"bitflags 2.9.4",
|
||||
"core-foundation 0.9.4",
|
||||
"core-foundation",
|
||||
"core-foundation-sys",
|
||||
"libc",
|
||||
"security-framework-sys",
|
||||
|
|
@ -2186,9 +2254,9 @@ checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
|
|||
|
||||
[[package]]
|
||||
name = "sentry"
|
||||
version = "0.49.1"
|
||||
version = "0.48.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "63207365db50cb817402f0ec8097d6dad3d644ef3fffd6ba30c75b3077e514da"
|
||||
checksum = "b93b3e19f45495ddd41d8222a152c48c84f6ba45abe9c69e2527e9cdea29bb5b"
|
||||
dependencies = [
|
||||
"cfg_aliases",
|
||||
"httpdate",
|
||||
|
|
@ -2199,7 +2267,6 @@ dependencies = [
|
|||
"sentry-contexts",
|
||||
"sentry-core",
|
||||
"sentry-debug-images",
|
||||
"sentry-log",
|
||||
"sentry-panic",
|
||||
"sentry-tracing",
|
||||
"tokio",
|
||||
|
|
@ -2208,9 +2275,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "sentry-actix"
|
||||
version = "0.49.1"
|
||||
version = "0.48.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4a0eb1ed18478fb48db007aeaa672a3de176055357feb768eee0c3471802d0ce"
|
||||
checksum = "168d0312e1b1741d8295a16c7b2c62c10c76302f7476a1749d6ccc14cb40663a"
|
||||
dependencies = [
|
||||
"actix-http",
|
||||
"actix-web",
|
||||
|
|
@ -2221,9 +2288,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "sentry-anyhow"
|
||||
version = "0.49.1"
|
||||
version = "0.48.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6265521f1b724f709bc07747ecb01c5289b974cb70b348026df01780280fc136"
|
||||
checksum = "0fafe70e622ded2d3b75dc7889ecb5391b4c22d850b5a36e81af4615cbe687f2"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"sentry-backtrace",
|
||||
|
|
@ -2232,9 +2299,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "sentry-backtrace"
|
||||
version = "0.49.1"
|
||||
version = "0.48.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e3bcc2497c2327998146207b7600599ef7592233920f4d4e1d41ddeeba0e4210"
|
||||
checksum = "dc84c325ace9ca2388e510fe7d6672b5d60cd8b3bd0eb4bb4ee8314c323cd686"
|
||||
dependencies = [
|
||||
"backtrace",
|
||||
"regex",
|
||||
|
|
@ -2243,9 +2310,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "sentry-contexts"
|
||||
version = "0.49.1"
|
||||
version = "0.48.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1cb04cba225b38f59d08f9e3c29ab7259d9cc94fbb2c46d613a51cb0a4a7ee05"
|
||||
checksum = "896c1ab62dbfe1746fb262bbf72e6feb2fb9dfb2c14709077bf71beb532e44b2"
|
||||
dependencies = [
|
||||
"hostname",
|
||||
"libc",
|
||||
|
|
@ -2257,9 +2324,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "sentry-core"
|
||||
version = "0.49.1"
|
||||
version = "0.48.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "48759bc392fb5e3b36b4efcb485f51074c0ba8479711cd5c8cf79e86f9f75d41"
|
||||
checksum = "d5f5abf20c42cb1593ec1638976e2647da55f79bccac956444c1707b6cce259a"
|
||||
dependencies = [
|
||||
"rand 0.9.4",
|
||||
"sentry-types",
|
||||
|
|
@ -2270,30 +2337,19 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "sentry-debug-images"
|
||||
version = "0.49.1"
|
||||
version = "0.48.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0a5bd325059b70b21ca6e42b0f2409821272dddc1cf37923de37269af55389b5"
|
||||
checksum = "4b88bbe6a760d5724bb40689827e82e8db1e275947df2c59abe171bfc30bb671"
|
||||
dependencies = [
|
||||
"findshlibs",
|
||||
"sentry-core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sentry-log"
|
||||
version = "0.49.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f9553a2f0f75bc8550137ebc753e8d2161af63ff780ca59983935f8df8f01655"
|
||||
dependencies = [
|
||||
"bitflags 2.9.4",
|
||||
"log",
|
||||
"sentry-core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sentry-panic"
|
||||
version = "0.49.1"
|
||||
version = "0.48.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a685d22f672b1562ebeff3f2affceb5960595648cc936dae73da3e1d6a55fbd1"
|
||||
checksum = "0260dcb52562b6a79ae7702312a26dba94b79fb5baee7301087529e5ca4e872e"
|
||||
dependencies = [
|
||||
"sentry-backtrace",
|
||||
"sentry-core",
|
||||
|
|
@ -2301,9 +2357,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "sentry-tracing"
|
||||
version = "0.49.1"
|
||||
version = "0.48.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8aa7d8e0db4cccddbac01ddabd5344ad03b7c2f954b3ff850cecb1d9cf5d4758"
|
||||
checksum = "a1c035f3a0a8671ae1a231c5b457abb68b71acba2bf3054dab2a09a9d4ea487e"
|
||||
dependencies = [
|
||||
"bitflags 2.9.4",
|
||||
"sentry-backtrace",
|
||||
|
|
@ -2314,16 +2370,16 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "sentry-types"
|
||||
version = "0.49.1"
|
||||
version = "0.48.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "fab146d15a30ab4897a95fd15d6a038b8d7fbf2661c5f8b13738ce8df7a095b7"
|
||||
checksum = "82d8e81058ec155992191f61c7b29bfa7b2cf12012131e7cdc0678020898a7c9"
|
||||
dependencies = [
|
||||
"debugid",
|
||||
"hex",
|
||||
"rand 0.9.4",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"thiserror 2.0.19",
|
||||
"thiserror 2.0.12",
|
||||
"time",
|
||||
"url",
|
||||
"uuid",
|
||||
|
|
@ -2331,9 +2387,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "serde"
|
||||
version = "1.0.229"
|
||||
version = "1.0.228"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
|
||||
checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
|
||||
dependencies = [
|
||||
"serde_core",
|
||||
"serde_derive",
|
||||
|
|
@ -2341,35 +2397,34 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "serde_core"
|
||||
version = "1.0.229"
|
||||
version = "1.0.228"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
|
||||
checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
|
||||
dependencies = [
|
||||
"serde_derive",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "serde_derive"
|
||||
version = "1.0.229"
|
||||
version = "1.0.228"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
|
||||
checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn 3.0.2",
|
||||
"syn 2.0.117",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "serde_json"
|
||||
version = "1.0.151"
|
||||
version = "1.0.128"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
|
||||
checksum = "6ff5456707a1de34e7e37f2a6fd3d3f808c318259cbd01ab6377795054b483d8"
|
||||
dependencies = [
|
||||
"itoa",
|
||||
"memchr",
|
||||
"ryu",
|
||||
"serde",
|
||||
"serde_core",
|
||||
"zmij",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -2386,27 +2441,28 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "serial_test"
|
||||
version = "4.0.1"
|
||||
version = "3.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a6df5ed973ad8d834e09f824f9e9f449af6b9a3745f78dec7cc752770bd3bf11"
|
||||
checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
|
||||
dependencies = [
|
||||
"futures-executor",
|
||||
"futures-util",
|
||||
"log",
|
||||
"once_cell",
|
||||
"parking_lot",
|
||||
"scc",
|
||||
"serial_test_derive",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "serial_test_derive"
|
||||
version = "4.0.1"
|
||||
version = "3.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a22144e767da4ddd8416dbf383700542ffd8a5dc493dfecedfe1fe3ad03c98ae"
|
||||
checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn 3.0.2",
|
||||
"syn 2.0.117",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -2512,11 +2568,10 @@ dependencies = [
|
|||
"dhcproto",
|
||||
"ip_network",
|
||||
"ipnet",
|
||||
"jsonrpsee-types",
|
||||
"libc",
|
||||
"log",
|
||||
"mac_address",
|
||||
"nix 0.31.3",
|
||||
"nix 0.31.2",
|
||||
"num_enum 0.7.6",
|
||||
"oslog",
|
||||
"polling",
|
||||
|
|
@ -2524,8 +2579,6 @@ dependencies = [
|
|||
"privdrop",
|
||||
"sentry",
|
||||
"sentry-anyhow",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"serial_test",
|
||||
"smoltcp",
|
||||
"system-configuration",
|
||||
|
|
@ -2551,6 +2604,12 @@ version = "0.11.1"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
|
||||
|
||||
[[package]]
|
||||
name = "subtle"
|
||||
version = "2.6.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
|
||||
|
||||
[[package]]
|
||||
name = "syn"
|
||||
version = "1.0.109"
|
||||
|
|
@ -2573,17 +2632,6 @@ dependencies = [
|
|||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "syn"
|
||||
version = "3.0.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a207d6d6a2b7fc470b80443726053f18a2481b7e1eee970597051596567987a3"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sync_wrapper"
|
||||
version = "1.0.1"
|
||||
|
|
@ -2606,12 +2654,12 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "system-configuration"
|
||||
version = "0.8.0"
|
||||
version = "0.7.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "501336eb7ba9e417300a6a0fa985721065467aa83a6dcf0422a8e43e4c0328fa"
|
||||
checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
|
||||
dependencies = [
|
||||
"bitflags 2.9.4",
|
||||
"core-foundation 0.10.1",
|
||||
"core-foundation",
|
||||
"system-configuration-sys",
|
||||
]
|
||||
|
||||
|
|
@ -2649,11 +2697,11 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "thiserror"
|
||||
version = "2.0.19"
|
||||
version = "2.0.12"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
|
||||
checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
|
||||
dependencies = [
|
||||
"thiserror-impl 2.0.19",
|
||||
"thiserror-impl 2.0.12",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -2669,13 +2717,13 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "thiserror-impl"
|
||||
version = "2.0.19"
|
||||
version = "2.0.12"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
|
||||
checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn 3.0.2",
|
||||
"syn 2.0.117",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -2761,6 +2809,16 @@ dependencies = [
|
|||
"tokio",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tokio-rustls"
|
||||
version = "0.26.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
|
||||
dependencies = [
|
||||
"rustls",
|
||||
"tokio",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tokio-util"
|
||||
version = "0.7.15"
|
||||
|
|
@ -2922,6 +2980,12 @@ version = "0.2.6"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
|
||||
|
||||
[[package]]
|
||||
name = "untrusted"
|
||||
version = "0.9.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
|
||||
|
||||
[[package]]
|
||||
name = "ureq"
|
||||
version = "3.0.12"
|
||||
|
|
@ -3683,9 +3747,3 @@ dependencies = [
|
|||
"quote",
|
||||
"syn 2.0.117",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zmij"
|
||||
version = "1.0.23"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
|
||||
|
|
|
|||
|
|
@ -32,11 +32,8 @@ prefix-trie = "0"
|
|||
ipnet = "2"
|
||||
oslog = "0.2.0"
|
||||
log = "0.4.29"
|
||||
serial_test = "4"
|
||||
serial_test = "3"
|
||||
coarsetime = "0.1.37"
|
||||
serde = { version = "1", features = ["derive"] }
|
||||
serde_json = "1"
|
||||
jsonrpsee-types = "0.26"
|
||||
|
||||
[profile.release]
|
||||
debug = true
|
||||
|
|
|
|||
44
README.md
44
README.md
|
|
@ -30,33 +30,6 @@ And assumes that:
|
|||
|
||||
...otherwise it's possible for two VMs to receive an identical IP-address from the macOS built-in DHCP-server (even in the presence of Softnet's packet filtering) and thus bypass the protections offered by Softnet.
|
||||
|
||||
### Stateful flow authorization
|
||||
|
||||
Stateful `in`/`out` rules use a bounded authorization cache that records the
|
||||
direction and exact transport tuple of policy-approved flows, allowing matching
|
||||
return traffic without treating it as a new flow and thus requiring a separate
|
||||
policy entry. It is not a complete TCP connection tracker: endpoint transport
|
||||
stacks remain responsible for validating sequence numbers, receive windows,
|
||||
resets, and application-level traffic.
|
||||
|
||||
This cache deliberately favors security, bounded resource use, and a simple
|
||||
implementation over availability. Only policy-authorized initiator traffic
|
||||
renews an entry; return traffic does not. Softnet does not maintain fairness
|
||||
quotas, eviction heuristics, or complete TCP lifecycle state.
|
||||
|
||||
A packet admitted by a stateful rule is denied when Softnet cannot represent its
|
||||
flow, including when the cache is full. High flow churn, long idle connections,
|
||||
or ambiguous retransmissions may therefore interrupt networking and require the
|
||||
affected VM to reconnect.
|
||||
|
||||
For TCP, a bare TCP SYN on an existing tuple is deliberately returned to policy
|
||||
because Softnet cannot distinguish a retransmission from tuple reuse without
|
||||
tracking TCP sequence state. If authorized, it may replace the tuple's previous
|
||||
cache lifetime; this can reduce availability but cannot grant traffic that
|
||||
policy did not permit.
|
||||
|
||||
For ICMP, stateful flow authorization supports only echo requests and replies.
|
||||
|
||||
## Installing
|
||||
|
||||
For proper functioning, Softnet binary requires two things:
|
||||
|
|
@ -70,20 +43,3 @@ For proper functioning, Softnet binary requires two things:
|
|||
## Running
|
||||
|
||||
Softnet is started and managed automatically by Tart if `--net-softnet` flag is provided when calling `tart run`.
|
||||
|
||||
### Dynamic network policy
|
||||
|
||||
Softnet can update the running VM's IPv4 policy without restarting the VM. Pass a connected Unix stream socket as `--control-fd` to enable a newline-delimited [JSON-RPC 2.0](https://www.jsonrpc.org/specification) control channel. The socket is duplex and must be separate from `--vm-fd`, which carries VM packets.
|
||||
|
||||
The supported methods are `softnet.policy.get` and `softnet.policy.set`. A complete policy update looks like this (each request and response occupies one line):
|
||||
|
||||
```json
|
||||
{"jsonrpc":"2.0","id":"42","method":"softnet.policy.set","params":{"allow":["@host","10.0.0.0/8"],"block":["0.0.0.0/0"]}}
|
||||
{"jsonrpc":"2.0","id":"42","result":{"allow":["10.0.0.0/8","@host"],"block":["0.0.0.0/0"],"ruleCount":3}}
|
||||
```
|
||||
|
||||
Every request must include a non-null string (at most 256 bytes) or non-negative integer `id`; notifications are rejected so policy changes always have an acknowledgment. Policy updates are atomic: all rules are parsed and a new prefix map is built before the active policy changes. Longest-prefix matching and block precedence for identical rules are preserved. Rules are normalized and deduplicated. A policy update may contain at most 4096 combined allow/block rules, and a request frame may not exceed 1 MiB.
|
||||
|
||||
When the normalized allow or block policy changes, Softnet clears the flow table so the new policy applies to established flows immediately. This may interrupt active connections. Repeating the same normalized policy is a no-op and preserves the flow table.
|
||||
|
||||
Use `block=["0.0.0.0/0"]` with specific allow rules for a default-deny egress policy. Closing the control socket leaves the last accepted policy active.
|
||||
|
|
|
|||
|
|
@ -1,20 +1,18 @@
|
|||
use dhcproto::Decodable;
|
||||
use dhcproto::v4::{DhcpOption, HType, Message, MessageType, Opcode, OptionCode};
|
||||
use dhcproto::v4::{DhcpOption, MessageType, OptionCode};
|
||||
use smoltcp::wire::Ipv4Address;
|
||||
use std::collections::HashSet;
|
||||
use std::time::Duration;
|
||||
|
||||
#[derive(Default)]
|
||||
pub struct DhcpSnooper {
|
||||
vm_mac_address: [u8; 6],
|
||||
vm_lease: Option<Lease>,
|
||||
uncertainty_duration: Duration,
|
||||
}
|
||||
|
||||
impl DhcpSnooper {
|
||||
pub fn new(uncertainty_duration: Duration, vm_mac_address: [u8; 6]) -> Self {
|
||||
pub fn new(uncertainty_duration: Duration) -> Self {
|
||||
DhcpSnooper {
|
||||
vm_mac_address,
|
||||
uncertainty_duration,
|
||||
..Default::default()
|
||||
}
|
||||
|
|
@ -28,14 +26,6 @@ impl DhcpSnooper {
|
|||
Err(_) => return,
|
||||
};
|
||||
|
||||
// Decoded DHCP replies may be broadcast[1], so additionally validate the BOOTP client
|
||||
// hardware address to avoid acting on another VM's lease transition
|
||||
//
|
||||
// [1]: https://datatracker.ietf.org/doc/html/rfc2131#section-4.1
|
||||
if !message_matches_bootp_client(&message, Opcode::BootReply, self.vm_mac_address) {
|
||||
return;
|
||||
}
|
||||
|
||||
match message.opts().msg_type() {
|
||||
Some(MessageType::Ack) => {
|
||||
let lease_time = match message.opts().get(OptionCode::AddressLeaseTime) {
|
||||
|
|
@ -73,11 +63,6 @@ impl DhcpSnooper {
|
|||
&self.vm_lease
|
||||
}
|
||||
|
||||
pub(crate) fn address_and_dns_ips(&self) -> Option<(Ipv4Address, HashSet<Ipv4Address>)> {
|
||||
let lease = self.vm_lease.as_ref().filter(|lease| lease.valid())?;
|
||||
Some((lease.address(), lease.dns_ips.clone()))
|
||||
}
|
||||
|
||||
pub fn valid_dns_target(&self, addr: &Ipv4Address) -> bool {
|
||||
if let Some(lease) = &self.vm_lease {
|
||||
return lease.dns_ips.contains(addr);
|
||||
|
|
@ -111,72 +96,7 @@ impl Lease {
|
|||
coarsetime::Instant::recent() < self.valid_until
|
||||
}
|
||||
|
||||
pub fn is_valid_for(&self, address: Ipv4Address) -> bool {
|
||||
pub fn valid_ip_source(&self, address: Ipv4Address) -> bool {
|
||||
self.address == address && self.valid()
|
||||
}
|
||||
}
|
||||
|
||||
pub(crate) fn message_matches_bootp_client(
|
||||
message: &Message,
|
||||
opcode: Opcode,
|
||||
mac: [u8; 6],
|
||||
) -> bool {
|
||||
message.opcode() == opcode
|
||||
&& message.htype() == HType::Eth
|
||||
&& message.hlen() == mac.len() as u8
|
||||
&& message.chaddr() == mac
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::{DhcpSnooper, Lease};
|
||||
use dhcproto::v4::{DhcpOption, Message, MessageType, Opcode};
|
||||
use dhcproto::{Encodable, Encoder};
|
||||
use smoltcp::wire::Ipv4Address;
|
||||
use std::collections::HashSet;
|
||||
use std::time::Duration;
|
||||
|
||||
const VM_MAC: [u8; 6] = [0x02, 0x00, 0x00, 0x00, 0x00, 0x01];
|
||||
const OTHER_MAC: [u8; 6] = [0x02, 0x00, 0x00, 0x00, 0x00, 0x02];
|
||||
const OLD_ADDRESS: Ipv4Address = Ipv4Address::new(192, 168, 64, 2);
|
||||
|
||||
#[test]
|
||||
fn processes_replies_only_for_matching_client() {
|
||||
// Start with an active lease
|
||||
let mut snooper = DhcpSnooper::new(Duration::ZERO, VM_MAC);
|
||||
snooper.set_lease(Some(Lease::new(
|
||||
OLD_ADDRESS,
|
||||
Duration::from_secs(600),
|
||||
HashSet::new(),
|
||||
)));
|
||||
|
||||
// Ignore a NAK for another client
|
||||
let mut message = Message::new(
|
||||
Ipv4Address::UNSPECIFIED,
|
||||
Ipv4Address::UNSPECIFIED,
|
||||
Ipv4Address::UNSPECIFIED,
|
||||
Ipv4Address::UNSPECIFIED,
|
||||
&OTHER_MAC,
|
||||
);
|
||||
message.set_opcode(Opcode::BootReply);
|
||||
message
|
||||
.opts_mut()
|
||||
.insert(DhcpOption::MessageType(MessageType::Nak));
|
||||
|
||||
let mut encoded = Vec::new();
|
||||
message.encode(&mut Encoder::new(&mut encoded)).unwrap();
|
||||
|
||||
snooper.register_dhcp_reply(&encoded);
|
||||
|
||||
assert_eq!(snooper.lease().as_ref().unwrap().address(), OLD_ADDRESS);
|
||||
|
||||
// Process a NAK for the matching client
|
||||
message.set_chaddr(&VM_MAC);
|
||||
encoded.clear();
|
||||
message.encode(&mut Encoder::new(&mut encoded)).unwrap();
|
||||
|
||||
snooper.register_dhcp_reply(&encoded);
|
||||
|
||||
assert!(snooper.lease().is_none());
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -12,7 +12,6 @@ pub struct Poller<'poller> {
|
|||
timeout: Duration,
|
||||
vm_fd: BorrowedFd<'poller>,
|
||||
host_fd: BorrowedFd<'poller>,
|
||||
control_fd: Option<BorrowedFd<'poller>>,
|
||||
}
|
||||
|
||||
#[derive(IntoPrimitive)]
|
||||
|
|
@ -20,7 +19,6 @@ pub struct Poller<'poller> {
|
|||
enum EventKey {
|
||||
VM,
|
||||
Host,
|
||||
Control,
|
||||
Interrupt,
|
||||
}
|
||||
|
||||
|
|
@ -28,7 +26,6 @@ impl Poller<'_> {
|
|||
pub fn new<'poller>(
|
||||
vm_fd: RawFd,
|
||||
host_fd: RawFd,
|
||||
control_fd: Option<RawFd>,
|
||||
timeout: Duration,
|
||||
) -> Result<Poller<'poller>> {
|
||||
let poller = polling::Poller::new()?;
|
||||
|
|
@ -39,7 +36,6 @@ impl Poller<'_> {
|
|||
timeout,
|
||||
vm_fd: unsafe { BorrowedFd::borrow_raw(vm_fd) },
|
||||
host_fd: unsafe { BorrowedFd::borrow_raw(host_fd) },
|
||||
control_fd: control_fd.map(|fd| unsafe { BorrowedFd::borrow_raw(fd) }),
|
||||
})
|
||||
}
|
||||
|
||||
|
|
@ -50,14 +46,6 @@ impl Poller<'_> {
|
|||
self.vm_interest(),
|
||||
PollMode::Edge,
|
||||
)?;
|
||||
|
||||
if let Some(control_fd) = self.control_fd {
|
||||
self.poller.add_with_mode(
|
||||
control_fd.as_raw_fd(),
|
||||
polling::Event::all(EventKey::Control.into()),
|
||||
PollMode::Edge,
|
||||
)?;
|
||||
}
|
||||
self.poller.add_with_mode(
|
||||
self.host_fd.as_raw_fd(),
|
||||
self.host_interest(),
|
||||
|
|
@ -91,17 +79,10 @@ impl Poller<'_> {
|
|||
.events
|
||||
.iter()
|
||||
.any(|ev| ev.key == Into::<usize>::into(EventKey::Interrupt));
|
||||
|
||||
Ok((vm_readable, host_readable, interrupt))
|
||||
}
|
||||
|
||||
pub fn remove_control(&mut self) -> Result<()> {
|
||||
if let Some(control_fd) = self.control_fd.take() {
|
||||
self.poller.delete(control_fd)?;
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn vm_interest(&self) -> polling::Event {
|
||||
polling::Event::readable(EventKey::VM.into())
|
||||
}
|
||||
|
|
|
|||
1153
lib/proxy/control.rs
1153
lib/proxy/control.rs
File diff suppressed because it is too large
Load Diff
|
|
@ -1,173 +0,0 @@
|
|||
use super::{FlowDirection, FlowKey, FlowMatch, FlowTable};
|
||||
use coarsetime::{Duration, Instant};
|
||||
use smoltcp::wire::{Icmpv4Message, Icmpv4Packet, Ipv4Address, Ipv4Packet};
|
||||
|
||||
const ECHO_TIMEOUT: Duration = Duration::from_secs(30);
|
||||
|
||||
impl FlowTable {
|
||||
pub(super) fn inspect_icmp(
|
||||
&mut self,
|
||||
ipv4_pkt: &Ipv4Packet<&[u8]>,
|
||||
direction: FlowDirection,
|
||||
now: Instant,
|
||||
) -> FlowMatch {
|
||||
let Ok(icmp) = Icmpv4Packet::new_checked(ipv4_pkt.payload()) else {
|
||||
return FlowMatch::Denied;
|
||||
};
|
||||
if !icmp.verify_checksum() {
|
||||
return FlowMatch::Denied;
|
||||
}
|
||||
|
||||
match (icmp.msg_type(), icmp.msg_code()) {
|
||||
(Icmpv4Message::EchoRequest, 0) => {
|
||||
self.inspect_echo(ipv4_pkt, direction, icmp.echo_ident(), true, now)
|
||||
}
|
||||
(Icmpv4Message::EchoReply, 0) => {
|
||||
self.inspect_echo(ipv4_pkt, direction, icmp.echo_ident(), false, now)
|
||||
}
|
||||
// Other ICMP messages follow normal source policy: treating errors that quote
|
||||
// tracked tuples as RELATED requires validation beyond this exact-tuple table
|
||||
//
|
||||
// Potential degradation of PMTU discovery and traceroute is an accepted tradeoff.
|
||||
_ => FlowMatch::Untracked,
|
||||
}
|
||||
}
|
||||
|
||||
fn inspect_echo(
|
||||
&mut self,
|
||||
ipv4_pkt: &Ipv4Packet<&[u8]>,
|
||||
direction: FlowDirection,
|
||||
ident: u16,
|
||||
is_request: bool,
|
||||
now: Instant,
|
||||
) -> FlowMatch {
|
||||
// We need to preserve the request direction so opposite-direction echo flows remain distinct
|
||||
let initiating_direction = if is_request {
|
||||
direction
|
||||
} else {
|
||||
direction.opposite()
|
||||
};
|
||||
|
||||
let key = FlowKey::icmp_echo(
|
||||
ipv4_pkt.src_addr(),
|
||||
ipv4_pkt.dst_addr(),
|
||||
direction,
|
||||
initiating_direction,
|
||||
ident,
|
||||
);
|
||||
|
||||
if let Some(matched) = self.match_existing_flow(key, direction, now, ECHO_TIMEOUT) {
|
||||
return matched;
|
||||
}
|
||||
|
||||
if is_request {
|
||||
FlowMatch::candidate(key, initiating_direction, now, ECHO_TIMEOUT)
|
||||
} else {
|
||||
// Only replies matching an admitted request are tracked
|
||||
FlowMatch::Untracked
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl FlowKey {
|
||||
fn icmp_echo(
|
||||
src_addr: Ipv4Address,
|
||||
dst_addr: Ipv4Address,
|
||||
direction: FlowDirection,
|
||||
initiating_direction: FlowDirection,
|
||||
ident: u16,
|
||||
) -> Self {
|
||||
let (host_addr, vm_addr) = direction.host_vm_pair(src_addr, dst_addr);
|
||||
Self::IcmpEcho {
|
||||
host_addr,
|
||||
vm_addr,
|
||||
ident,
|
||||
initiating_direction,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::super::test_support::{HOST, VM, inspect_from_host, inspect_from_vm, ipv4_packet};
|
||||
use super::super::{FlowMatch, FlowTable};
|
||||
use smoltcp::wire::{Icmpv4Message, Icmpv4Packet, IpProtocol, Ipv4Address};
|
||||
|
||||
#[test]
|
||||
fn echo_request_and_reply_are_tracked_in_both_directions() {
|
||||
let mut tracker = FlowTable::new();
|
||||
let vm_request = echo_packet(VM, HOST, Icmpv4Message::EchoRequest, 7, 1);
|
||||
|
||||
let FlowMatch::Candidate(pending) = inspect_from_vm(&mut tracker, &vm_request) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
|
||||
let host_reply = echo_packet(HOST, VM, Icmpv4Message::EchoReply, 7, 1);
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &host_reply),
|
||||
FlowMatch::Allowed
|
||||
));
|
||||
|
||||
let wrong_ident = echo_packet(HOST, VM, Icmpv4Message::EchoReply, 8, 1);
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &wrong_ident),
|
||||
FlowMatch::Untracked
|
||||
));
|
||||
|
||||
// The opposite direction is a distinct flow even with the same identifier.
|
||||
let host_request = echo_packet(HOST, VM, Icmpv4Message::EchoRequest, 7, 1);
|
||||
let FlowMatch::Candidate(pending) = inspect_from_host(&mut tracker, &host_request) else {
|
||||
panic!("expected a new flow");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
|
||||
let vm_reply = echo_packet(VM, HOST, Icmpv4Message::EchoReply, 7, 1);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &vm_reply),
|
||||
FlowMatch::Allowed
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn invalid_echo_is_denied_and_unsolicited_echo_is_untracked() {
|
||||
let mut tracker = FlowTable::new();
|
||||
let unsolicited = echo_packet(HOST, VM, Icmpv4Message::EchoReply, 7, 1);
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &unsolicited),
|
||||
FlowMatch::Untracked
|
||||
));
|
||||
|
||||
let mut wrong_code = echo_packet(HOST, VM, Icmpv4Message::EchoRequest, 7, 1);
|
||||
wrong_code[21] = 1;
|
||||
Icmpv4Packet::new_unchecked(&mut wrong_code[20..]).fill_checksum();
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &wrong_code),
|
||||
FlowMatch::Untracked
|
||||
));
|
||||
|
||||
let mut bad_checksum = echo_packet(HOST, VM, Icmpv4Message::EchoRequest, 7, 1);
|
||||
bad_checksum[27] ^= 1;
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &bad_checksum),
|
||||
FlowMatch::Denied
|
||||
));
|
||||
}
|
||||
|
||||
fn echo_packet(
|
||||
src_addr: Ipv4Address,
|
||||
dst_addr: Ipv4Address,
|
||||
message: Icmpv4Message,
|
||||
ident: u16,
|
||||
sequence: u16,
|
||||
) -> Vec<u8> {
|
||||
let mut bytes = ipv4_packet(src_addr, dst_addr, IpProtocol::Icmp, 8);
|
||||
let mut icmp = Icmpv4Packet::new_unchecked(&mut bytes[20..]);
|
||||
icmp.set_msg_type(message);
|
||||
icmp.set_msg_code(0);
|
||||
icmp.set_echo_ident(ident);
|
||||
icmp.set_echo_seq_no(sequence);
|
||||
icmp.fill_checksum();
|
||||
bytes
|
||||
}
|
||||
}
|
||||
|
|
@ -1,394 +0,0 @@
|
|||
mod icmp;
|
||||
mod tcp;
|
||||
mod udp;
|
||||
|
||||
use coarsetime::{Duration, Instant};
|
||||
use smoltcp::wire::{IpProtocol, Ipv4Address, Ipv4Packet};
|
||||
use std::collections::HashMap;
|
||||
|
||||
const MAX_FLOWS: usize = 32_768;
|
||||
const SWEEP_INTERVAL: Duration = Duration::from_secs(1);
|
||||
|
||||
/// A bounded cache of exact-tuple permissions for return traffic.
|
||||
///
|
||||
/// The table establishes only the direction in which a flow was authorized.
|
||||
/// This is deliberately not a TCP state machine. Endpoint transport stacks remain
|
||||
/// responsible for TCP handshakes, teardown, sequence numbers, and receive windows,
|
||||
/// as well as ICMP echo sequences.
|
||||
///
|
||||
/// Capacity is intentionally enforced with one fail-closed limit per VM.
|
||||
/// Exhaustion may deny further networking for that VM; this availability
|
||||
/// tradeoff is accepted to avoid fairness quotas, admission scans, and eviction.
|
||||
#[derive(Debug)]
|
||||
pub(crate) struct FlowTable {
|
||||
flows: HashMap<FlowKey, Flow>,
|
||||
next_sweep: Instant,
|
||||
}
|
||||
|
||||
/// A proposed flow-table entry awaiting policy authorization.
|
||||
pub(crate) struct PendingFlow {
|
||||
key: FlowKey,
|
||||
flow: Flow,
|
||||
}
|
||||
|
||||
/// Metadata stored for an admitted flow.
|
||||
#[derive(Clone, Copy, Debug)]
|
||||
struct Flow {
|
||||
initiating_direction: FlowDirection,
|
||||
expires_at: Instant,
|
||||
}
|
||||
|
||||
/// The result of classifying a packet against the flow table.
|
||||
pub(crate) enum FlowMatch {
|
||||
/// The packet is exact-tuple return traffic for an admitted flow.
|
||||
Allowed,
|
||||
|
||||
/// Policy must authorize this initiator-side packet before committing it.
|
||||
Candidate(PendingFlow),
|
||||
|
||||
/// The packet is malformed or violates a transport invariant that we deliberately enforce.
|
||||
Denied,
|
||||
|
||||
/// The flow table has no stateful interpretation for this packet.
|
||||
Untracked,
|
||||
}
|
||||
|
||||
impl FlowMatch {
|
||||
fn candidate(
|
||||
key: FlowKey,
|
||||
initiating_direction: FlowDirection,
|
||||
now: Instant,
|
||||
timeout: Duration,
|
||||
) -> Self {
|
||||
Self::Candidate(PendingFlow {
|
||||
key,
|
||||
flow: Flow {
|
||||
initiating_direction,
|
||||
expires_at: now + timeout,
|
||||
},
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
/// The canonical identity used to index a flow-table entry.
|
||||
#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
|
||||
enum FlowKey {
|
||||
IcmpEcho {
|
||||
host_addr: Ipv4Address,
|
||||
vm_addr: Ipv4Address,
|
||||
ident: u16,
|
||||
initiating_direction: FlowDirection,
|
||||
},
|
||||
Tcp {
|
||||
host_addr: Ipv4Address,
|
||||
host_port: u16,
|
||||
vm_addr: Ipv4Address,
|
||||
vm_port: u16,
|
||||
},
|
||||
Udp {
|
||||
host_addr: Ipv4Address,
|
||||
host_port: u16,
|
||||
vm_addr: Ipv4Address,
|
||||
vm_port: u16,
|
||||
},
|
||||
}
|
||||
|
||||
/// A packet direction across the host–VM boundary.
|
||||
#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
|
||||
pub(super) enum FlowDirection {
|
||||
FromHost,
|
||||
FromVm,
|
||||
}
|
||||
|
||||
impl FlowTable {
|
||||
pub(crate) fn new() -> Self {
|
||||
Self {
|
||||
flows: HashMap::new(),
|
||||
next_sweep: Instant::recent() + SWEEP_INTERVAL,
|
||||
}
|
||||
}
|
||||
|
||||
pub(super) fn inspect(
|
||||
&mut self,
|
||||
ipv4_pkt: &Ipv4Packet<&[u8]>,
|
||||
direction: FlowDirection,
|
||||
) -> FlowMatch {
|
||||
self.inspect_at(ipv4_pkt, direction, Instant::recent())
|
||||
}
|
||||
|
||||
fn inspect_at(
|
||||
&mut self,
|
||||
ipv4_pkt: &Ipv4Packet<&[u8]>,
|
||||
direction: FlowDirection,
|
||||
now: Instant,
|
||||
) -> FlowMatch {
|
||||
// Perform lazy garbage collection of expired flow entries
|
||||
self.sweep_if_due(now);
|
||||
|
||||
// Later fragments do not contain enough transport information to bind
|
||||
// them to an exact flow, so packet policy must decide
|
||||
if ipv4_pkt.more_frags() || ipv4_pkt.frag_offset() != 0 {
|
||||
return FlowMatch::Untracked;
|
||||
}
|
||||
|
||||
match ipv4_pkt.next_header() {
|
||||
IpProtocol::Icmp => self.inspect_icmp(ipv4_pkt, direction, now),
|
||||
IpProtocol::Tcp => self.inspect_tcp(ipv4_pkt, direction, now),
|
||||
IpProtocol::Udp => self.inspect_udp(ipv4_pkt, direction, now),
|
||||
_ => FlowMatch::Untracked,
|
||||
}
|
||||
}
|
||||
|
||||
pub(crate) fn commit(&mut self, pending: PendingFlow) -> bool {
|
||||
let PendingFlow { key, flow } = pending;
|
||||
|
||||
// Reject new entries when full while allowing existing entries to be updated
|
||||
if !self.flows.contains_key(&key) && self.flows.len() >= MAX_FLOWS {
|
||||
return false;
|
||||
}
|
||||
|
||||
self.flows.insert(key, flow);
|
||||
|
||||
true
|
||||
}
|
||||
|
||||
pub(crate) fn clear(&mut self) {
|
||||
self.flows.clear();
|
||||
}
|
||||
|
||||
fn sweep_if_due(&mut self, now: Instant) {
|
||||
if now < self.next_sweep {
|
||||
return;
|
||||
}
|
||||
|
||||
self.flows.retain(|_, flow| now < flow.expires_at);
|
||||
|
||||
self.next_sweep = now + SWEEP_INTERVAL;
|
||||
}
|
||||
|
||||
fn match_existing_flow(
|
||||
&self,
|
||||
key: FlowKey,
|
||||
direction: FlowDirection,
|
||||
now: Instant,
|
||||
timeout: Duration,
|
||||
) -> Option<FlowMatch> {
|
||||
let existing = self.flows.get(&key).copied()?;
|
||||
|
||||
// Treat expired entries as missing even before the next sweep
|
||||
if now >= existing.expires_at {
|
||||
return None;
|
||||
}
|
||||
|
||||
if direction == existing.initiating_direction {
|
||||
Some(FlowMatch::candidate(
|
||||
key,
|
||||
existing.initiating_direction,
|
||||
now,
|
||||
timeout,
|
||||
))
|
||||
} else {
|
||||
Some(FlowMatch::Allowed)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl FlowDirection {
|
||||
fn host_vm_pair<T>(self, src: T, dst: T) -> (T, T) {
|
||||
match self {
|
||||
Self::FromHost => (src, dst),
|
||||
Self::FromVm => (dst, src),
|
||||
}
|
||||
}
|
||||
|
||||
fn opposite(self) -> Self {
|
||||
match self {
|
||||
Self::FromHost => Self::FromVm,
|
||||
Self::FromVm => Self::FromHost,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::test_support::{HOST, VM, inspect_from_host, ipv4_packet, udp_packet};
|
||||
use super::{
|
||||
Duration, FlowDirection, FlowMatch, FlowTable, Instant, MAX_FLOWS, SWEEP_INTERVAL,
|
||||
};
|
||||
use smoltcp::wire::{IpProtocol, Ipv4Packet};
|
||||
|
||||
#[test]
|
||||
fn all_ipv4_fragments_are_untracked() {
|
||||
for (more_fragments, offset) in [(true, 0), (false, 8)] {
|
||||
let mut bytes = udp_packet(HOST, 50_000, VM, 53);
|
||||
let mut packet = Ipv4Packet::new_unchecked(bytes.as_mut_slice());
|
||||
packet.set_frag_offset(offset);
|
||||
packet.set_more_frags(more_fragments);
|
||||
|
||||
let mut tracker = FlowTable::new();
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &bytes),
|
||||
FlowMatch::Untracked
|
||||
));
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn expired_tuple_is_not_matched_before_the_next_sweep() {
|
||||
let mut tracker = FlowTable::new();
|
||||
let datagram = udp_packet(HOST, 50_000, VM, 53);
|
||||
let FlowMatch::Candidate(pending) = inspect_from_host(&mut tracker, &datagram) else {
|
||||
panic!("expected a candidate");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
|
||||
let now = Instant::recent();
|
||||
let flow = tracker.flows.values_mut().next().unwrap();
|
||||
flow.expires_at = now - Duration::from_secs(1);
|
||||
tracker.next_sweep = now + SWEEP_INTERVAL;
|
||||
|
||||
let reply = udp_packet(VM, 53, HOST, 50_000);
|
||||
assert!(matches!(
|
||||
tracker.inspect_at(
|
||||
&Ipv4Packet::new_checked(reply.as_slice()).unwrap(),
|
||||
FlowDirection::FromVm,
|
||||
now,
|
||||
),
|
||||
FlowMatch::Candidate(_)
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn global_limit_rejects_new_tuple_but_allows_replacement() {
|
||||
let mut tracker = FlowTable::new();
|
||||
for port in 10_000..10_000 + MAX_FLOWS as u16 {
|
||||
let datagram = udp_packet(HOST, port, VM, 53);
|
||||
let FlowMatch::Candidate(pending) = inspect_from_host(&mut tracker, &datagram) else {
|
||||
panic!("expected a candidate");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
}
|
||||
|
||||
let over_limit = udp_packet(HOST, 50_000, VM, 53);
|
||||
let FlowMatch::Candidate(pending) = inspect_from_host(&mut tracker, &over_limit) else {
|
||||
panic!("expected a candidate");
|
||||
};
|
||||
assert!(!tracker.commit(pending));
|
||||
|
||||
let replacement = udp_packet(HOST, 10_000, VM, 53);
|
||||
let FlowMatch::Candidate(pending) = inspect_from_host(&mut tracker, &replacement) else {
|
||||
panic!("expected a candidate");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn unsupported_protocol_is_untracked() {
|
||||
let bytes = ipv4_packet(HOST, VM, IpProtocol::Unknown(253), 0);
|
||||
let mut tracker = FlowTable::new();
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &bytes),
|
||||
FlowMatch::Untracked
|
||||
));
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod test_support {
|
||||
use super::{FlowDirection, FlowMatch, FlowTable};
|
||||
use smoltcp::wire::{IpProtocol, Ipv4Address, Ipv4Packet, TcpPacket, UdpPacket};
|
||||
|
||||
pub(super) const HOST: Ipv4Address = Ipv4Address::new(192, 168, 64, 1);
|
||||
pub(super) const VM: Ipv4Address = Ipv4Address::new(192, 168, 64, 2);
|
||||
|
||||
pub(super) fn inspect_from_host(tracker: &mut FlowTable, bytes: &[u8]) -> FlowMatch {
|
||||
let packet = Ipv4Packet::new_checked(bytes).unwrap();
|
||||
tracker.inspect(&packet, FlowDirection::FromHost)
|
||||
}
|
||||
|
||||
pub(super) fn inspect_from_vm(tracker: &mut FlowTable, bytes: &[u8]) -> FlowMatch {
|
||||
let packet = Ipv4Packet::new_checked(bytes).unwrap();
|
||||
tracker.inspect(&packet, FlowDirection::FromVm)
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy)]
|
||||
pub(super) struct TcpFlags {
|
||||
syn: bool,
|
||||
ack: bool,
|
||||
rst: bool,
|
||||
fin: bool,
|
||||
}
|
||||
|
||||
impl TcpFlags {
|
||||
pub(super) const SYN: Self = Self {
|
||||
syn: true,
|
||||
ack: false,
|
||||
rst: false,
|
||||
fin: false,
|
||||
};
|
||||
pub(super) const SYN_ACK: Self = Self {
|
||||
syn: true,
|
||||
ack: true,
|
||||
rst: false,
|
||||
fin: false,
|
||||
};
|
||||
pub(super) const ACK: Self = Self {
|
||||
syn: false,
|
||||
ack: true,
|
||||
rst: false,
|
||||
fin: false,
|
||||
};
|
||||
}
|
||||
|
||||
pub(super) fn tcp_packet(
|
||||
src_addr: Ipv4Address,
|
||||
src_port: u16,
|
||||
dst_addr: Ipv4Address,
|
||||
dst_port: u16,
|
||||
flags: TcpFlags,
|
||||
) -> Vec<u8> {
|
||||
let mut bytes = ipv4_packet(src_addr, dst_addr, IpProtocol::Tcp, 20);
|
||||
let mut tcp = TcpPacket::new_unchecked(&mut bytes[20..]);
|
||||
tcp.set_src_port(src_port);
|
||||
tcp.set_dst_port(dst_port);
|
||||
tcp.set_header_len(20);
|
||||
tcp.set_syn(flags.syn);
|
||||
tcp.set_ack(flags.ack);
|
||||
tcp.set_rst(flags.rst);
|
||||
tcp.set_fin(flags.fin);
|
||||
tcp.set_window_len(u16::MAX);
|
||||
bytes
|
||||
}
|
||||
|
||||
pub(super) fn udp_packet(
|
||||
src_addr: Ipv4Address,
|
||||
src_port: u16,
|
||||
dst_addr: Ipv4Address,
|
||||
dst_port: u16,
|
||||
) -> Vec<u8> {
|
||||
let mut bytes = ipv4_packet(src_addr, dst_addr, IpProtocol::Udp, 8);
|
||||
let mut udp = UdpPacket::new_unchecked(&mut bytes[20..]);
|
||||
udp.set_src_port(src_port);
|
||||
udp.set_dst_port(dst_port);
|
||||
udp.set_len(8);
|
||||
bytes
|
||||
}
|
||||
|
||||
pub(super) fn ipv4_packet(
|
||||
src_addr: Ipv4Address,
|
||||
dst_addr: Ipv4Address,
|
||||
protocol: IpProtocol,
|
||||
payload_len: usize,
|
||||
) -> Vec<u8> {
|
||||
let mut bytes = vec![0; 20 + payload_len];
|
||||
let total_len = bytes.len() as u16;
|
||||
let mut ipv4 = Ipv4Packet::new_unchecked(bytes.as_mut_slice());
|
||||
ipv4.set_version(4);
|
||||
ipv4.set_header_len(20);
|
||||
ipv4.set_total_len(total_len);
|
||||
ipv4.set_next_header(protocol);
|
||||
ipv4.set_src_addr(src_addr);
|
||||
ipv4.set_dst_addr(dst_addr);
|
||||
bytes
|
||||
}
|
||||
}
|
||||
|
|
@ -1,156 +0,0 @@
|
|||
use super::{FlowDirection, FlowKey, FlowMatch, FlowTable};
|
||||
use coarsetime::{Duration, Instant};
|
||||
use smoltcp::wire::{Ipv4Address, Ipv4Packet, TcpPacket};
|
||||
|
||||
const SYN_TIMEOUT: Duration = Duration::from_secs(60);
|
||||
const TCP_TIMEOUT: Duration = Duration::from_secs(5 * 60);
|
||||
|
||||
impl FlowTable {
|
||||
pub(super) fn inspect_tcp(
|
||||
&mut self,
|
||||
ipv4_pkt: &Ipv4Packet<&[u8]>,
|
||||
direction: FlowDirection,
|
||||
now: Instant,
|
||||
) -> FlowMatch {
|
||||
let Ok(tcp) = TcpPacket::new_checked(ipv4_pkt.payload()) else {
|
||||
return FlowMatch::Denied;
|
||||
};
|
||||
if tcp.src_port() == 0 || tcp.dst_port() == 0 {
|
||||
return FlowMatch::Denied;
|
||||
}
|
||||
|
||||
let key = FlowKey::tcp(
|
||||
direction,
|
||||
(ipv4_pkt.src_addr(), tcp.src_port()),
|
||||
(ipv4_pkt.dst_addr(), tcp.dst_port()),
|
||||
);
|
||||
|
||||
// A bare SYN may be either a retransmission or a new connection reusing
|
||||
// the tuple in either direction. Always return it to policy, and do not
|
||||
// replace an existing permission until the candidate is committed.
|
||||
let is_initial_syn = tcp.syn() && !tcp.ack() && !tcp.fin() && !tcp.rst();
|
||||
|
||||
if is_initial_syn {
|
||||
return FlowMatch::candidate(key, direction, now, SYN_TIMEOUT);
|
||||
}
|
||||
|
||||
self.match_existing_flow(key, direction, now, TCP_TIMEOUT)
|
||||
.unwrap_or(FlowMatch::Untracked)
|
||||
}
|
||||
}
|
||||
|
||||
impl FlowKey {
|
||||
fn tcp(direction: FlowDirection, src: (Ipv4Address, u16), dst: (Ipv4Address, u16)) -> Self {
|
||||
let ((host_addr, host_port), (vm_addr, vm_port)) = direction.host_vm_pair(src, dst);
|
||||
Self::Tcp {
|
||||
host_addr,
|
||||
host_port,
|
||||
vm_addr,
|
||||
vm_port,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::super::test_support::{
|
||||
HOST, TcpFlags, VM, inspect_from_host, inspect_from_vm, tcp_packet,
|
||||
};
|
||||
use super::super::{FlowMatch, FlowTable};
|
||||
|
||||
fn admit_host_syn(tracker: &mut FlowTable) {
|
||||
let syn = tcp_packet(HOST, 49_152, VM, 22, TcpFlags::SYN);
|
||||
let FlowMatch::Candidate(pending) = inspect_from_host(tracker, &syn) else {
|
||||
panic!("expected a candidate");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn admitted_syn_creates_an_exact_reverse_permission() {
|
||||
let mut tracker = FlowTable::new();
|
||||
admit_host_syn(&mut tracker);
|
||||
let original_expiry = tracker.flows.values().next().unwrap().expires_at;
|
||||
|
||||
let reply = tcp_packet(VM, 22, HOST, 49_152, TcpFlags::ACK);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &reply),
|
||||
FlowMatch::Allowed
|
||||
));
|
||||
assert_eq!(
|
||||
tracker.flows.values().next().unwrap().expires_at,
|
||||
original_expiry,
|
||||
"return traffic must not refresh a tuple"
|
||||
);
|
||||
|
||||
let initiator_data = tcp_packet(HOST, 49_152, VM, 22, TcpFlags::ACK);
|
||||
let FlowMatch::Candidate(pending) = inspect_from_host(&mut tracker, &initiator_data) else {
|
||||
panic!("expected an initiator candidate");
|
||||
};
|
||||
assert_eq!(
|
||||
tracker.flows.values().next().unwrap().expires_at,
|
||||
original_expiry,
|
||||
"inspection must not refresh a tuple before policy accepts it"
|
||||
);
|
||||
assert!(tracker.commit(pending));
|
||||
assert!(tracker.flows.values().next().unwrap().expires_at > original_expiry);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn new_tuple_requires_a_clean_syn() {
|
||||
let mut tracker = FlowTable::new();
|
||||
|
||||
for flags in [TcpFlags::ACK, TcpFlags::SYN_ACK] {
|
||||
let packet = tcp_packet(HOST, 49_152, VM, 22, flags);
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &packet),
|
||||
FlowMatch::Untracked
|
||||
));
|
||||
}
|
||||
|
||||
let syn = tcp_packet(HOST, 49_152, VM, 22, TcpFlags::SYN);
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &syn),
|
||||
FlowMatch::Candidate(_)
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn reply_requires_the_exact_tuple() {
|
||||
let mut tracker = FlowTable::new();
|
||||
admit_host_syn(&mut tracker);
|
||||
|
||||
let wrong_port = tcp_packet(VM, 22, HOST, 49_153, TcpFlags::ACK);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &wrong_port),
|
||||
FlowMatch::Untracked
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn reverse_bare_syn_is_a_new_policy_candidate() {
|
||||
let mut tracker = FlowTable::new();
|
||||
admit_host_syn(&mut tracker);
|
||||
|
||||
let reverse_syn = tcp_packet(VM, 22, HOST, 49_152, TcpFlags::SYN);
|
||||
let FlowMatch::Candidate(pending) = inspect_from_vm(&mut tracker, &reverse_syn) else {
|
||||
panic!("reverse SYN must return to policy");
|
||||
};
|
||||
|
||||
// Inspection is provisional: a policy rejection leaves the admitted
|
||||
// flow untouched.
|
||||
let old_flow_reply = tcp_packet(VM, 22, HOST, 49_152, TcpFlags::ACK);
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &old_flow_reply),
|
||||
FlowMatch::Allowed
|
||||
));
|
||||
|
||||
assert!(tracker.commit(pending));
|
||||
|
||||
let reverse_reply = tcp_packet(HOST, 49_152, VM, 22, TcpFlags::SYN_ACK);
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &reverse_reply),
|
||||
FlowMatch::Allowed
|
||||
));
|
||||
}
|
||||
}
|
||||
|
|
@ -1,92 +0,0 @@
|
|||
use super::{FlowDirection, FlowKey, FlowMatch, FlowTable};
|
||||
use coarsetime::{Duration, Instant};
|
||||
use smoltcp::wire::{Ipv4Address, Ipv4Packet, UdpPacket};
|
||||
|
||||
const UDP_TIMEOUT: Duration = Duration::from_secs(30);
|
||||
|
||||
impl FlowTable {
|
||||
pub(super) fn inspect_udp(
|
||||
&mut self,
|
||||
ipv4_pkt: &Ipv4Packet<&[u8]>,
|
||||
direction: FlowDirection,
|
||||
now: Instant,
|
||||
) -> FlowMatch {
|
||||
let Ok(udp) = UdpPacket::new_checked(ipv4_pkt.payload()) else {
|
||||
return FlowMatch::Denied;
|
||||
};
|
||||
if udp.dst_port() == 0 {
|
||||
return FlowMatch::Denied;
|
||||
}
|
||||
|
||||
// Deliberate policy, not merely a packet-format validation:
|
||||
// RFC 8085, §5.1 says UDP senders SHOULD NOT use source port zero.
|
||||
//
|
||||
// We enforce this recommendation to retain source-port entropy
|
||||
// and protection against off-path packet injection.
|
||||
if udp.src_port() == 0 {
|
||||
return FlowMatch::Denied;
|
||||
}
|
||||
|
||||
let key = FlowKey::udp(
|
||||
direction,
|
||||
(ipv4_pkt.src_addr(), udp.src_port()),
|
||||
(ipv4_pkt.dst_addr(), udp.dst_port()),
|
||||
);
|
||||
|
||||
if let Some(matched) = self.match_existing_flow(key, direction, now, UDP_TIMEOUT) {
|
||||
return matched;
|
||||
}
|
||||
|
||||
FlowMatch::candidate(key, direction, now, UDP_TIMEOUT)
|
||||
}
|
||||
}
|
||||
|
||||
impl FlowKey {
|
||||
fn udp(direction: FlowDirection, src: (Ipv4Address, u16), dst: (Ipv4Address, u16)) -> Self {
|
||||
let ((host_addr, host_port), (vm_addr, vm_port)) = direction.host_vm_pair(src, dst);
|
||||
Self::Udp {
|
||||
host_addr,
|
||||
host_port,
|
||||
vm_addr,
|
||||
vm_port,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::super::test_support::{HOST, VM, inspect_from_host, inspect_from_vm, udp_packet};
|
||||
use super::super::{FlowMatch, FlowTable};
|
||||
|
||||
#[test]
|
||||
fn rejects_zero_source_port_per_rfc_8085() {
|
||||
let mut tracker = FlowTable::new();
|
||||
let datagram = udp_packet(HOST, 0, VM, 5353);
|
||||
|
||||
assert!(matches!(
|
||||
inspect_from_host(&mut tracker, &datagram),
|
||||
FlowMatch::Denied
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn udp_reply_requires_an_exact_admitted_request() {
|
||||
let mut tracker = FlowTable::new();
|
||||
let request = udp_packet(HOST, 50_000, VM, 5353);
|
||||
let reply = udp_packet(VM, 5353, HOST, 50_000);
|
||||
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &reply),
|
||||
FlowMatch::Candidate(_)
|
||||
));
|
||||
|
||||
let FlowMatch::Candidate(pending) = inspect_from_host(&mut tracker, &request) else {
|
||||
panic!("expected a candidate");
|
||||
};
|
||||
assert!(tracker.commit(pending));
|
||||
assert!(matches!(
|
||||
inspect_from_vm(&mut tracker, &reply),
|
||||
FlowMatch::Allowed
|
||||
));
|
||||
}
|
||||
}
|
||||
|
|
@ -1,12 +1,7 @@
|
|||
use crate::dhcp_snooper::message_matches_bootp_client;
|
||||
use crate::proxy::flows::{FlowDirection, FlowMatch};
|
||||
use crate::proxy::Proxy;
|
||||
use crate::proxy::udp_packet_helper::UdpPacketHelper;
|
||||
use crate::proxy::{Direction, PolicyDecision, Proxy};
|
||||
use anyhow::{Context, Result};
|
||||
use dhcproto::Decodable;
|
||||
use dhcproto::v4::Opcode;
|
||||
use smoltcp::phy::ChecksumCapabilities;
|
||||
use smoltcp::wire::{EthernetFrame, EthernetProtocol, Ipv4Packet, Ipv4Repr, UdpPacket};
|
||||
use smoltcp::wire::{EthernetFrame, EthernetProtocol, Ipv4Packet, UdpPacket};
|
||||
|
||||
impl Proxy<'_> {
|
||||
pub(crate) fn process_frame_from_host(&mut self, frame: &EthernetFrame<&[u8]>) -> Result<()> {
|
||||
|
|
@ -17,7 +12,7 @@ impl Proxy<'_> {
|
|||
|
||||
// Snoop bootpd(8) replies from the host to
|
||||
// figure out the IP assigned to the VM
|
||||
if frame.dst_addr() == self.vm_mac_address || frame.dst_addr().is_broadcast() {
|
||||
if frame.dst_addr() == self.vm_mac_address {
|
||||
self.snoop(frame);
|
||||
}
|
||||
|
||||
|
|
@ -44,71 +39,11 @@ impl Proxy<'_> {
|
|||
fn allowed_from_host(&mut self, frame: &EthernetFrame<&[u8]>) -> Option<()> {
|
||||
match frame.ethertype() {
|
||||
EthernetProtocol::Arp => Some(()),
|
||||
EthernetProtocol::Ipv4 => {
|
||||
let ipv4_pkt = Ipv4Packet::new_unchecked(frame.payload());
|
||||
Ipv4Repr::parse(&ipv4_pkt, &ChecksumCapabilities::ignored()).ok()?;
|
||||
|
||||
self.allowed_from_host_ipv4(&ipv4_pkt)
|
||||
}
|
||||
EthernetProtocol::Ipv4 => Some(()),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
pub(super) fn allowed_from_host_ipv4(&mut self, ipv4_pkt: &Ipv4Packet<&[u8]>) -> Option<()> {
|
||||
// Backwards compatibility with Softnet consumers that only use stateless rules
|
||||
if self.flows.is_none() {
|
||||
return Some(());
|
||||
}
|
||||
|
||||
// DHCP is required to maintain the VM's lease and must bypass user-specified rules
|
||||
if self.is_allowed_dhcp_response(ipv4_pkt) {
|
||||
return Some(());
|
||||
}
|
||||
|
||||
// Consult the flow table before evaluating inbound policy
|
||||
// so established flows are not treated as new traffic
|
||||
let pending = if self
|
||||
.dhcp_snooper
|
||||
.lease()
|
||||
.as_ref()
|
||||
.is_some_and(|lease| lease.is_valid_for(ipv4_pkt.dst_addr()))
|
||||
{
|
||||
match self
|
||||
.flows
|
||||
.as_mut()?
|
||||
.inspect(ipv4_pkt, FlowDirection::FromHost)
|
||||
{
|
||||
FlowMatch::Allowed => return Some(()),
|
||||
FlowMatch::Denied => return None,
|
||||
FlowMatch::Candidate(pending) => Some(pending),
|
||||
FlowMatch::Untracked => None,
|
||||
}
|
||||
} else {
|
||||
None
|
||||
};
|
||||
|
||||
// The flow is either pending or untracked, evaluate it against inbound policy
|
||||
match self
|
||||
.rules
|
||||
.policy_decision(ipv4_pkt.src_addr(), Direction::In)
|
||||
{
|
||||
// Return traffic was handled above; enforce explicit inbound blocks here
|
||||
Some(PolicyDecision::Block) => None,
|
||||
|
||||
// Stateless policy is outbound-only; fail closed if this invariant is violated
|
||||
Some(PolicyDecision::AllowStateless) => None,
|
||||
|
||||
// Untracked packets cannot satisfy stateful policy
|
||||
Some(PolicyDecision::AllowStateful) => self.admit_with_tracking(pending?),
|
||||
|
||||
// No inbound rule matched, so allow by default. Track the flow when needed
|
||||
// so its reply is not treated as a new outbound flow
|
||||
None => {
|
||||
self.admit_with_tracking_if_stateful(pending, ipv4_pkt.src_addr(), Direction::Out)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn snoop(&mut self, frame: &EthernetFrame<&[u8]>) {
|
||||
if frame.ethertype() != EthernetProtocol::Ipv4 {
|
||||
return;
|
||||
|
|
@ -119,7 +54,11 @@ impl Proxy<'_> {
|
|||
_ => return,
|
||||
};
|
||||
|
||||
if !self.is_allowed_dhcp_response(&ipv4_pkt) {
|
||||
if ipv4_pkt.src_addr() != self.host.gateway_ip {
|
||||
return;
|
||||
}
|
||||
|
||||
if ipv4_pkt.next_header() != smoltcp::wire::IpProtocol::Udp {
|
||||
return;
|
||||
}
|
||||
|
||||
|
|
@ -128,91 +67,10 @@ impl Proxy<'_> {
|
|||
Err(_) => return,
|
||||
};
|
||||
|
||||
let address_and_dns_ips_saved = self.dhcp_snooper.address_and_dns_ips();
|
||||
self.dhcp_snooper.register_dhcp_reply(udp_pkt.payload());
|
||||
if address_and_dns_ips_saved != self.dhcp_snooper.address_and_dns_ips()
|
||||
&& let Some(flows) = &mut self.flows
|
||||
{
|
||||
flows.clear();
|
||||
}
|
||||
}
|
||||
|
||||
fn is_allowed_dhcp_response(&self, ipv4_pkt: &Ipv4Packet<&[u8]>) -> bool {
|
||||
if ipv4_pkt.src_addr() != self.host.gateway_ip
|
||||
|| ipv4_pkt.next_header() != smoltcp::wire::IpProtocol::Udp
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
let Ok(udp_pkt) = UdpPacket::new_checked(ipv4_pkt.payload()) else {
|
||||
return false;
|
||||
};
|
||||
|
||||
// Require the standard DHCP server and client ports
|
||||
if !udp_pkt.is_dhcp_response() {
|
||||
return false;
|
||||
return;
|
||||
}
|
||||
|
||||
// Require the BOOTP client hardware address to match this VM
|
||||
// (symmetric with is_allowed_dhcp_request / #191 on the VM→host path)
|
||||
let mut decoder = dhcproto::v4::Decoder::new(udp_pkt.payload());
|
||||
let Ok(message) = dhcproto::v4::Message::decode(&mut decoder) else {
|
||||
return false;
|
||||
};
|
||||
|
||||
message_matches_bootp_client(&message, Opcode::BootReply, self.vm_mac_address.0)
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use crate::dhcp_snooper::message_matches_bootp_client;
|
||||
use dhcproto::Decodable;
|
||||
use dhcproto::v4::{DhcpOption, Message, MessageType, Opcode};
|
||||
use dhcproto::{Encodable, Encoder};
|
||||
use smoltcp::wire::Ipv4Address;
|
||||
|
||||
const VM_MAC: [u8; 6] = [0x02, 0x00, 0x00, 0x00, 0x00, 0x01];
|
||||
const OTHER_MAC: [u8; 6] = [0x02, 0x00, 0x00, 0x00, 0x00, 0x02];
|
||||
|
||||
#[test]
|
||||
fn dhcp_boot_reply_chaddr_must_match_vm() {
|
||||
let own = encode_boot_reply(VM_MAC);
|
||||
let foreign = encode_boot_reply(OTHER_MAC);
|
||||
|
||||
let mut dec = dhcproto::v4::Decoder::new(&own);
|
||||
let own_msg = Message::decode(&mut dec).unwrap();
|
||||
let mut dec = dhcproto::v4::Decoder::new(&foreign);
|
||||
let foreign_msg = Message::decode(&mut dec).unwrap();
|
||||
|
||||
assert!(message_matches_bootp_client(
|
||||
&own_msg,
|
||||
Opcode::BootReply,
|
||||
VM_MAC
|
||||
));
|
||||
assert!(!message_matches_bootp_client(
|
||||
&foreign_msg,
|
||||
Opcode::BootReply,
|
||||
VM_MAC
|
||||
));
|
||||
}
|
||||
|
||||
fn encode_boot_reply(chaddr: [u8; 6]) -> Vec<u8> {
|
||||
let mut message = Message::new(
|
||||
Ipv4Address::UNSPECIFIED,
|
||||
Ipv4Address::new(192, 168, 64, 2),
|
||||
Ipv4Address::UNSPECIFIED,
|
||||
Ipv4Address::UNSPECIFIED,
|
||||
&chaddr,
|
||||
);
|
||||
message.set_opcode(Opcode::BootReply);
|
||||
message
|
||||
.opts_mut()
|
||||
.insert(DhcpOption::MessageType(MessageType::Ack));
|
||||
message.opts_mut().insert(DhcpOption::AddressLeaseTime(600));
|
||||
|
||||
let mut encoded = Vec::new();
|
||||
message.encode(&mut Encoder::new(&mut encoded)).unwrap();
|
||||
encoded
|
||||
self.dhcp_snooper.register_dhcp_reply(udp_pkt.payload());
|
||||
}
|
||||
}
|
||||
|
|
|
|||
312
lib/proxy/mod.rs
312
lib/proxy/mod.rs
|
|
@ -1,10 +1,6 @@
|
|||
mod control;
|
||||
mod exposed_port;
|
||||
mod flows;
|
||||
mod host;
|
||||
mod port_forwarder;
|
||||
mod rule;
|
||||
mod rules;
|
||||
mod udp_packet_helper;
|
||||
mod vm;
|
||||
|
||||
|
|
@ -14,17 +10,15 @@ use crate::host::NetType;
|
|||
use crate::poller::Poller;
|
||||
use crate::vm::VM;
|
||||
use anyhow::Result;
|
||||
use control::{Control, normalize_rules};
|
||||
pub use exposed_port::ExposedPort;
|
||||
use flows::{FlowTable, PendingFlow};
|
||||
use ipnet::Ipv4Net;
|
||||
use mac_address::MacAddress;
|
||||
use port_forwarder::PortForwarder;
|
||||
pub use rule::{Direction, Rule, Target};
|
||||
pub(crate) use rules::{PolicyDecision, Rules};
|
||||
use smoltcp::wire::{EthernetFrame, Ipv4Address};
|
||||
use prefix_trie::{Prefix, PrefixMap};
|
||||
use smoltcp::wire::EthernetFrame;
|
||||
use std::io::ErrorKind;
|
||||
use std::os::unix::io::{AsRawFd, RawFd};
|
||||
use std::str::FromStr;
|
||||
use std::time::Duration;
|
||||
use vmnet::Batch;
|
||||
|
||||
|
|
@ -34,59 +28,83 @@ pub struct Proxy<'proxy> {
|
|||
poller: Poller<'proxy>,
|
||||
vm_mac_address: smoltcp::wire::EthernetAddress,
|
||||
dhcp_snooper: DhcpSnooper,
|
||||
rules: Rules,
|
||||
control: Option<Control>,
|
||||
flows: Option<FlowTable>,
|
||||
rules: PrefixMap<Ipv4Net, Action>,
|
||||
enobufs_encountered: bool,
|
||||
port_forwarder: PortForwarder,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, PartialEq, Eq)]
|
||||
pub enum Target {
|
||||
Prefix(Ipv4Net),
|
||||
Host,
|
||||
}
|
||||
|
||||
impl FromStr for Target {
|
||||
type Err = ipnet::AddrParseError;
|
||||
|
||||
fn from_str(s: &str) -> std::result::Result<Self, Self::Err> {
|
||||
if s == "@host" {
|
||||
return Ok(Target::Host);
|
||||
}
|
||||
|
||||
Ipv4Net::from_str(s).map(Target::Prefix)
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, PartialEq)]
|
||||
pub(crate) enum Action {
|
||||
Block,
|
||||
Allow,
|
||||
}
|
||||
|
||||
impl Proxy<'_> {
|
||||
pub fn new<'proxy>(
|
||||
vm_fd: RawFd,
|
||||
vm_mac_address: MacAddress,
|
||||
vm_net_type: NetType,
|
||||
allow: Vec<Rule>,
|
||||
block: Vec<Rule>,
|
||||
allow: Vec<Target>,
|
||||
block: Vec<Target>,
|
||||
exposed_ports: Vec<ExposedPort>,
|
||||
control_fd: Option<RawFd>,
|
||||
) -> Result<Proxy<'proxy>> {
|
||||
let allow = normalize_rules(allow);
|
||||
let block = normalize_rules(block);
|
||||
|
||||
let vm = VM::new(vm_fd)?;
|
||||
let host = Host::new(
|
||||
vm_net_type,
|
||||
!allow.contains(&Rule::Stateless(Target::Prefix(Ipv4Net::default()))),
|
||||
!allow.contains(&Target::Prefix(Ipv4Net::zero())),
|
||||
)?;
|
||||
let poller_timeout = Duration::from_millis(100);
|
||||
let control = control_fd
|
||||
.map(|control_fd| {
|
||||
Control::new(control_fd, host.gateway_ip, allow.clone(), block.clone())
|
||||
})
|
||||
.transpose()?;
|
||||
let poller = Poller::new(
|
||||
vm.as_raw_fd(),
|
||||
host.as_raw_fd(),
|
||||
control.as_ref().map(AsRawFd::as_raw_fd),
|
||||
poller_timeout,
|
||||
)?;
|
||||
let poller = Poller::new(vm.as_raw_fd(), host.as_raw_fd(), poller_timeout)?;
|
||||
|
||||
let rules = Rules::new(host.gateway_ip, &allow, &block);
|
||||
// Craft packet filter rules
|
||||
//
|
||||
// SECURITY: blocking rules must always take precedence
|
||||
// over allowing rules when prefixes are identical.
|
||||
let mut rules = PrefixMap::new();
|
||||
|
||||
// Any stateful rule enables flow inspection for the whole VM, including
|
||||
// traffic admitted through implicit global, gateway, and DNS fallbacks
|
||||
let flows = rules.has_stateful().then(FlowTable::new);
|
||||
for allow_target in allow {
|
||||
let allow_prefix = match allow_target {
|
||||
Target::Prefix(prefix) => prefix,
|
||||
Target::Host => host.gateway_ip.into(),
|
||||
};
|
||||
|
||||
rules.insert(allow_prefix, Action::Allow);
|
||||
}
|
||||
|
||||
for block_target in block {
|
||||
let block_prefix = match block_target {
|
||||
Target::Prefix(prefix) => prefix,
|
||||
Target::Host => host.gateway_ip.into(),
|
||||
};
|
||||
|
||||
rules.insert(block_prefix, Action::Block);
|
||||
}
|
||||
|
||||
Ok(Proxy {
|
||||
vm,
|
||||
host,
|
||||
poller,
|
||||
vm_mac_address: smoltcp::wire::EthernetAddress(vm_mac_address.bytes()),
|
||||
dhcp_snooper: DhcpSnooper::new(poller_timeout, vm_mac_address.bytes()),
|
||||
dhcp_snooper: DhcpSnooper::new(poller_timeout),
|
||||
rules,
|
||||
control,
|
||||
flows,
|
||||
enobufs_encountered: false,
|
||||
port_forwarder: PortForwarder::new(exposed_ports),
|
||||
})
|
||||
|
|
@ -108,18 +126,9 @@ impl Proxy<'_> {
|
|||
loop {
|
||||
let (vm_readable, host_readable, interrupt) = self.poller.wait()?;
|
||||
|
||||
// kqueue does not report peer disconnects for Unix datagram sockets.
|
||||
if !self.vm.is_connected()? {
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
// Update coarse time for DHCP snooping and flows
|
||||
// Update coarse time for the DHCP snooper
|
||||
coarsetime::Instant::update();
|
||||
|
||||
// Service control on every wake (including timeouts) so a bounded read or a pending
|
||||
// response continues making progress even when no new edge is generated.
|
||||
self.service_control();
|
||||
|
||||
if vm_readable {
|
||||
self.read_from_vm(buf.as_mut_slice())?;
|
||||
}
|
||||
|
|
@ -144,23 +153,15 @@ impl Proxy<'_> {
|
|||
}
|
||||
|
||||
fn read_from_vm(&mut self, buf: &mut [u8]) -> Result<()> {
|
||||
let mut packets_read = 0;
|
||||
|
||||
loop {
|
||||
match self.vm.read(buf) {
|
||||
Ok(n) => {
|
||||
// Update coarse time for DHCP snooping and flows
|
||||
// Update coarse time for the DHCP snooper
|
||||
coarsetime::Instant::update();
|
||||
|
||||
if let Ok(frame) = EthernetFrame::new_checked(&buf[..n]) {
|
||||
self.process_frame_from_vm(frame)?;
|
||||
}
|
||||
|
||||
packets_read += 1;
|
||||
if packets_read == 128 {
|
||||
self.service_control();
|
||||
packets_read = 0;
|
||||
}
|
||||
}
|
||||
Err(err) => {
|
||||
if err.kind() == ErrorKind::WouldBlock {
|
||||
|
|
@ -177,7 +178,7 @@ impl Proxy<'_> {
|
|||
loop {
|
||||
match self.host.read(batch, bufs) {
|
||||
Ok(pktcnt) => {
|
||||
// Update coarse time for DHCP snooping and flows
|
||||
// Update coarse time for the DHCP snooper
|
||||
coarsetime::Instant::update();
|
||||
|
||||
for buf in batch.packet_sized_bufs(bufs).take(pktcnt) {
|
||||
|
|
@ -185,8 +186,6 @@ impl Proxy<'_> {
|
|||
self.process_frame_from_host(&pkt)?;
|
||||
}
|
||||
}
|
||||
|
||||
self.service_control();
|
||||
}
|
||||
Err(err) => {
|
||||
if let vmnet::Error::VmnetReadNothing = err {
|
||||
|
|
@ -198,77 +197,19 @@ impl Proxy<'_> {
|
|||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn service_control(&mut self) {
|
||||
let Some(control) = self.control.as_mut() else {
|
||||
return;
|
||||
};
|
||||
|
||||
let keep_open = match control.service(&mut self.rules) {
|
||||
Ok(keep_open) => keep_open,
|
||||
Err(err) => {
|
||||
log::warn!("disabling Softnet control socket: {err:#}");
|
||||
false
|
||||
}
|
||||
};
|
||||
|
||||
// Invalidate tracked flows whenever the policy changes
|
||||
if control.policy_changed() {
|
||||
self.flows = self.rules.has_stateful().then(FlowTable::new);
|
||||
}
|
||||
|
||||
if keep_open {
|
||||
return;
|
||||
}
|
||||
|
||||
if let Err(err) = self.poller.remove_control() {
|
||||
log::warn!("failed to remove Softnet control socket from the poller: {err:#}");
|
||||
}
|
||||
|
||||
if let Some(control) = self.control.take()
|
||||
&& let Err(err) = control.shutdown()
|
||||
{
|
||||
log::warn!("failed to shut down Softnet control socket: {err:#}");
|
||||
}
|
||||
}
|
||||
|
||||
/// Commits the pending flow, rejecting the packet if the table cannot store it.
|
||||
fn admit_with_tracking(&mut self, pending: PendingFlow) -> Option<()> {
|
||||
self.flows.as_mut()?.commit(pending).then_some(())
|
||||
}
|
||||
|
||||
/// Commits a pending flow for trackable packets; untracked packets proceed without one.
|
||||
fn admit_with_tracking_if_trackable(&mut self, pending: Option<PendingFlow>) -> Option<()> {
|
||||
match pending {
|
||||
Some(pending) => self.admit_with_tracking(pending),
|
||||
None => Some(()),
|
||||
}
|
||||
}
|
||||
|
||||
/// Commits a pending flow when the return-direction rule is stateful.
|
||||
fn admit_with_tracking_if_stateful(
|
||||
&mut self,
|
||||
pending: Option<PendingFlow>,
|
||||
peer_addr: Ipv4Address,
|
||||
return_direction: Direction,
|
||||
) -> Option<()> {
|
||||
if self.rules.is_stateful(peer_addr, return_direction) {
|
||||
self.admit_with_tracking_if_trackable(pending)
|
||||
} else {
|
||||
Some(())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use crate::NetType;
|
||||
use crate::dhcp_snooper::Lease;
|
||||
use crate::proxy::Proxy;
|
||||
use crate::proxy::{Action, Proxy};
|
||||
use ipnet::Ipv4Net;
|
||||
use mac_address::MacAddress;
|
||||
use nix::sys::socket::{AddressFamily, SockFlag, SockType, socketpair};
|
||||
use prefix_trie::PrefixMap;
|
||||
use serial_test::serial;
|
||||
use smoltcp::wire::{IpProtocol, Ipv4Address, Ipv4Packet, UdpPacket};
|
||||
use smoltcp::wire::{Ipv4Address, Ipv4Packet};
|
||||
use std::collections::HashSet;
|
||||
use std::os::fd::AsRawFd;
|
||||
use std::str::FromStr;
|
||||
|
|
@ -278,97 +219,57 @@ mod tests {
|
|||
#[serial]
|
||||
fn test_blocking_takes_precedence() {
|
||||
let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
|
||||
let mut proxy = create_proxy(vm_ip, vec!["66.66.0.0/16"], vec!["66.66.0.0/16"]);
|
||||
let proxy = create_proxy(vm_ip, vec!["66.66.0.0/16"], vec!["66.66.0.0/16"]);
|
||||
|
||||
assert_eq!(proxy.rules.len(), 1);
|
||||
assert_eq!(
|
||||
proxy.rules,
|
||||
PrefixMap::<Ipv4Net, Action>::from_iter(vec![(
|
||||
Ipv4Net::from_str("66.66.0.0/16").unwrap(),
|
||||
Action::Block
|
||||
),])
|
||||
);
|
||||
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, "66.66.66.66").is_none());
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "66.66.66.66").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial]
|
||||
fn test_longest_prefix_match_wins() {
|
||||
let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
|
||||
let mut proxy = create_proxy(vm_ip, vec!["33.33.33.33/32"], vec!["33.33.33.0/24"]);
|
||||
let proxy = create_proxy(vm_ip, vec!["33.33.33.33/32"], vec!["33.33.33.0/24"]);
|
||||
|
||||
assert_eq!(proxy.rules.len(), 2);
|
||||
assert_eq!(
|
||||
proxy.rules,
|
||||
PrefixMap::<Ipv4Net, Action>::from_iter(vec![
|
||||
(Ipv4Net::from_str("33.33.33.33/32").unwrap(), Action::Allow),
|
||||
(Ipv4Net::from_str("33.33.33.0/24").unwrap(), Action::Block),
|
||||
])
|
||||
);
|
||||
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, "33.33.33.32").is_none());
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, "33.33.33.33").is_some());
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, "33.33.33.34").is_none());
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.32").is_none());
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.33").is_some());
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.34").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial]
|
||||
fn test_allow_host() {
|
||||
let vm_ip = Ipv4Address::from_str("192.168.0.2").unwrap();
|
||||
let mut proxy = create_proxy(vm_ip, vec!["@host"], vec!["0.0.0.0/0"]);
|
||||
let proxy = create_proxy(vm_ip, vec!["@host"], vec!["0.0.0.0/0"]);
|
||||
|
||||
assert_eq!(proxy.rules.len(), 2);
|
||||
assert_eq!(
|
||||
proxy.rules,
|
||||
PrefixMap::from_iter(vec![
|
||||
(proxy.host.gateway_ip.into(), Action::Allow),
|
||||
(Ipv4Net::from_str("0.0.0.0/0").unwrap(), Action::Block),
|
||||
])
|
||||
);
|
||||
|
||||
// Access to global IPs should be disallowed because of --block=0.0.0.0/0
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, "8.8.8.8").is_none());
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "8.8.8.8").is_none());
|
||||
|
||||
// Despite the above, access to host IP address should be possible because of --allow=@host
|
||||
let gateway_ip = proxy.host.gateway_ip.to_string();
|
||||
assert!(allowed_from_vm_ipv4(&mut proxy, vm_ip, &gateway_ip).is_some());
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial]
|
||||
fn test_bare_default_block_applies_in_both_directions_in_stateful_mode() {
|
||||
let vm_ip = Ipv4Address::new(192, 168, 0, 2);
|
||||
let fallback_peer = Ipv4Address::new(203, 0, 113, 1);
|
||||
let explicitly_allowed_peer = Ipv4Address::new(192, 0, 2, 1);
|
||||
let mut proxy = create_proxy(vm_ip, vec!["in 192.0.2.0/24"], vec!["0.0.0.0/0"]);
|
||||
|
||||
let fallback_request = udp_packet(fallback_peer, 40_000, vm_ip, 1_234);
|
||||
let fallback_request = Ipv4Packet::new_checked(fallback_request.as_slice()).unwrap();
|
||||
assert!(proxy.allowed_from_host_ipv4(&fallback_request).is_none());
|
||||
|
||||
let fallback_reply = udp_packet(vm_ip, 1_234, fallback_peer, 40_000);
|
||||
let fallback_reply = Ipv4Packet::new_checked(fallback_reply.as_slice()).unwrap();
|
||||
assert!(proxy.allowed_from_vm_ipv4(fallback_reply).is_none());
|
||||
|
||||
let allowed_request = udp_packet(explicitly_allowed_peer, 40_000, vm_ip, 1_234);
|
||||
let allowed_request = Ipv4Packet::new_checked(allowed_request.as_slice()).unwrap();
|
||||
assert!(proxy.allowed_from_host_ipv4(&allowed_request).is_some());
|
||||
|
||||
let allowed_reply = udp_packet(vm_ip, 1_234, explicitly_allowed_peer, 40_000);
|
||||
let allowed_reply = Ipv4Packet::new_checked(allowed_reply.as_slice()).unwrap();
|
||||
assert!(proxy.allowed_from_vm_ipv4(allowed_reply).is_some());
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial]
|
||||
fn test_directional_egress_block_does_not_block_reply_to_unmatched_inbound_flow() {
|
||||
let vm_ip = Ipv4Address::new(192, 168, 0, 2);
|
||||
let peer = Ipv4Address::new(203, 0, 113, 1);
|
||||
let mut proxy = create_proxy(vm_ip, vec![], vec!["out 203.0.113.0/24"]);
|
||||
|
||||
let request = udp_packet(peer, 40_000, vm_ip, 1_234);
|
||||
let request = Ipv4Packet::new_checked(request.as_slice()).unwrap();
|
||||
assert!(proxy.allowed_from_host_ipv4(&request).is_some());
|
||||
|
||||
let reply = udp_packet(vm_ip, 1_234, peer, 40_000);
|
||||
let reply = Ipv4Packet::new_checked(reply.as_slice()).unwrap();
|
||||
assert!(proxy.allowed_from_vm_ipv4(reply).is_some());
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial]
|
||||
fn test_directional_ingress_block_does_not_block_reply_to_bare_outbound_allow() {
|
||||
let vm_ip = Ipv4Address::new(192, 168, 0, 2);
|
||||
let peer = Ipv4Address::new(203, 0, 113, 1);
|
||||
let mut proxy = create_proxy(vm_ip, vec!["203.0.113.0/24"], vec!["in 203.0.113.0/24"]);
|
||||
|
||||
let request = udp_packet(vm_ip, 1_234, peer, 40_000);
|
||||
let request = Ipv4Packet::new_checked(request.as_slice()).unwrap();
|
||||
assert!(proxy.allowed_from_vm_ipv4(request).is_some());
|
||||
|
||||
let reply = udp_packet(peer, 40_000, vm_ip, 1_234);
|
||||
let reply = Ipv4Packet::new_checked(reply.as_slice()).unwrap();
|
||||
assert!(proxy.allowed_from_host_ipv4(&reply).is_some());
|
||||
assert!(allowed_from_vm_ipv4(&proxy, vm_ip, &proxy.host.gateway_ip.to_string()).is_some());
|
||||
}
|
||||
|
||||
fn create_proxy<'test>(vm_ip: Ipv4Address, allow: Vec<&str>, block: Vec<&str>) -> Proxy<'test> {
|
||||
|
|
@ -387,14 +288,13 @@ mod tests {
|
|||
NetType::Nat,
|
||||
allow
|
||||
.into_iter()
|
||||
.map(|value| value.parse().unwrap())
|
||||
.map(|cidr| cidr.parse().unwrap())
|
||||
.collect(),
|
||||
block
|
||||
.into_iter()
|
||||
.map(|value| value.parse().unwrap())
|
||||
.map(|cidr| cidr.parse().unwrap())
|
||||
.collect(),
|
||||
Vec::default(),
|
||||
None,
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
|
|
@ -407,7 +307,7 @@ mod tests {
|
|||
proxy
|
||||
}
|
||||
|
||||
fn allowed_from_vm_ipv4(proxy: &mut Proxy, src: Ipv4Address, dst: &str) -> Option<()> {
|
||||
fn allowed_from_vm_ipv4(proxy: &Proxy, src: Ipv4Address, dst: &str) -> Option<()> {
|
||||
let mut buf = vec![0; 1500];
|
||||
|
||||
let mut ipv4_pkt_mut = Ipv4Packet::new_unchecked(&mut buf[..]);
|
||||
|
|
@ -418,26 +318,4 @@ mod tests {
|
|||
|
||||
proxy.allowed_from_vm_ipv4(ipv4_pkt)
|
||||
}
|
||||
|
||||
fn udp_packet(
|
||||
src_addr: Ipv4Address,
|
||||
src_port: u16,
|
||||
dst_addr: Ipv4Address,
|
||||
dst_port: u16,
|
||||
) -> Vec<u8> {
|
||||
let mut bytes = vec![0; 28];
|
||||
let mut ipv4 = Ipv4Packet::new_unchecked(bytes.as_mut_slice());
|
||||
ipv4.set_version(4);
|
||||
ipv4.set_header_len(20);
|
||||
ipv4.set_total_len(28);
|
||||
ipv4.set_next_header(IpProtocol::Udp);
|
||||
ipv4.set_src_addr(src_addr);
|
||||
ipv4.set_dst_addr(dst_addr);
|
||||
|
||||
let mut udp = UdpPacket::new_unchecked(ipv4.payload_mut());
|
||||
udp.set_src_port(src_port);
|
||||
udp.set_dst_port(dst_port);
|
||||
udp.set_len(8);
|
||||
bytes
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,158 +0,0 @@
|
|||
use ipnet::Ipv4Net;
|
||||
use std::fmt::{self, Display, Formatter};
|
||||
use std::str::FromStr;
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum Rule {
|
||||
Stateless(Target),
|
||||
Stateful {
|
||||
direction: Direction,
|
||||
target: Target,
|
||||
},
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum Target {
|
||||
Prefix(Ipv4Net),
|
||||
Host,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum Direction {
|
||||
In,
|
||||
Out,
|
||||
}
|
||||
|
||||
impl Rule {
|
||||
pub(super) fn normalized(self) -> Self {
|
||||
match self {
|
||||
Rule::Stateless(target) => Rule::Stateless(target.normalized()),
|
||||
Rule::Stateful { direction, target } => Rule::Stateful {
|
||||
direction,
|
||||
target: target.normalized(),
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl FromStr for Rule {
|
||||
type Err = ipnet::AddrParseError;
|
||||
|
||||
fn from_str(input: &str) -> Result<Self, Self::Err> {
|
||||
let (direction, target) = if let Some(target) = input.strip_prefix("in ") {
|
||||
(Direction::In, target)
|
||||
} else if let Some(target) = input.strip_prefix("out ") {
|
||||
(Direction::Out, target)
|
||||
} else {
|
||||
return input.parse().map(Rule::Stateless);
|
||||
};
|
||||
|
||||
let target = target.trim_start_matches(' ').parse()?;
|
||||
Ok(Rule::Stateful { direction, target })
|
||||
}
|
||||
}
|
||||
|
||||
impl Display for Rule {
|
||||
fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
|
||||
match self {
|
||||
Rule::Stateless(target) => Display::fmt(target, formatter),
|
||||
Rule::Stateful { direction, target } => match direction {
|
||||
Direction::In => write!(formatter, "in {target}"),
|
||||
Direction::Out => write!(formatter, "out {target}"),
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Target {
|
||||
fn normalized(self) -> Self {
|
||||
match self {
|
||||
Target::Prefix(prefix) => Target::Prefix(prefix.trunc()),
|
||||
Target::Host => Target::Host,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl FromStr for Target {
|
||||
type Err = ipnet::AddrParseError;
|
||||
|
||||
fn from_str(input: &str) -> Result<Self, Self::Err> {
|
||||
if input == "@host" {
|
||||
Ok(Target::Host)
|
||||
} else {
|
||||
input.parse().map(Target::Prefix)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Display for Target {
|
||||
fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
|
||||
match self {
|
||||
Target::Prefix(prefix) => Display::fmt(prefix, formatter),
|
||||
Target::Host => formatter.write_str("@host"),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::{Direction, Rule, Target};
|
||||
use ipnet::Ipv4Net;
|
||||
use std::str::FromStr;
|
||||
|
||||
#[test]
|
||||
fn parses_stateless_target() {
|
||||
assert_eq!(
|
||||
"@host".parse::<Rule>().unwrap(),
|
||||
Rule::Stateless(Target::Host)
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_stateful_directions() {
|
||||
let private_network = Target::Prefix(Ipv4Net::from_str("10.0.0.0/8").unwrap());
|
||||
|
||||
assert_eq!(
|
||||
"in @host".parse::<Rule>().unwrap(),
|
||||
Rule::Stateful {
|
||||
direction: Direction::In,
|
||||
target: Target::Host,
|
||||
}
|
||||
);
|
||||
assert_eq!(
|
||||
"out 10.0.0.0/8".parse::<Rule>().unwrap(),
|
||||
Rule::Stateful {
|
||||
direction: Direction::Out,
|
||||
target: private_network,
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn displays_normalized_rules() {
|
||||
for (input, expected) in [("in 10.1.2.3/8", "in 10.0.0.0/8"), ("@host", "@host")] {
|
||||
assert_eq!(
|
||||
input.parse::<Rule>().unwrap().normalized().to_string(),
|
||||
expected
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn rejects_invalid_rules() {
|
||||
for input in [
|
||||
"",
|
||||
"from @host",
|
||||
"in",
|
||||
"out",
|
||||
"in from @host",
|
||||
"out to @host",
|
||||
"infrom @host",
|
||||
" in @host",
|
||||
"in @host ",
|
||||
"in\t@host",
|
||||
] {
|
||||
assert!(input.parse::<Rule>().is_err(), "{input:?} should fail");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,279 +0,0 @@
|
|||
use super::{Direction, Rule, Target};
|
||||
use ipnet::Ipv4Net;
|
||||
use prefix_trie::PrefixMap;
|
||||
use smoltcp::wire::Ipv4Address;
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub(crate) enum Action {
|
||||
Block,
|
||||
Allow,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub(crate) enum PolicyDecision {
|
||||
Block,
|
||||
AllowStateless,
|
||||
AllowStateful,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
|
||||
enum Mode {
|
||||
#[default]
|
||||
Legacy,
|
||||
Stateful,
|
||||
}
|
||||
|
||||
#[derive(Default)]
|
||||
pub(crate) struct Rules {
|
||||
mode: Mode,
|
||||
inbound: PrefixMap<Ipv4Net, Action>,
|
||||
outbound: PrefixMap<Ipv4Net, Action>,
|
||||
}
|
||||
|
||||
impl Rules {
|
||||
pub(crate) fn new(host_address: Ipv4Address, allow: &[Rule], block: &[Rule]) -> Self {
|
||||
// Preserve legacy behavior for bare-only policies. Once a directional rule
|
||||
// is present, compile the whole policy using directional semantics.
|
||||
let mode = if allow
|
||||
.iter()
|
||||
.chain(block)
|
||||
.any(|rule| matches!(rule, Rule::Stateful { .. }))
|
||||
{
|
||||
Mode::Stateful
|
||||
} else {
|
||||
Mode::Legacy
|
||||
};
|
||||
|
||||
let mut rules = Self {
|
||||
mode,
|
||||
..Self::default()
|
||||
};
|
||||
|
||||
for &rule in allow {
|
||||
rules.insert(rule, Action::Allow, host_address);
|
||||
}
|
||||
|
||||
// SECURITY: blocking rules must always take precedence
|
||||
// over allowing rules when the rules are identical.
|
||||
for &rule in block {
|
||||
rules.insert(rule, Action::Block, host_address);
|
||||
}
|
||||
|
||||
rules
|
||||
}
|
||||
|
||||
pub(crate) fn policy_decision(
|
||||
&self,
|
||||
address: Ipv4Address,
|
||||
direction: Direction,
|
||||
) -> Option<PolicyDecision> {
|
||||
match (self.select(address, direction)?, self.mode) {
|
||||
(Action::Block, _) => Some(PolicyDecision::Block),
|
||||
(Action::Allow, Mode::Legacy) => Some(PolicyDecision::AllowStateless),
|
||||
(Action::Allow, Mode::Stateful) => Some(PolicyDecision::AllowStateful),
|
||||
}
|
||||
}
|
||||
|
||||
pub(crate) fn is_stateful(&self, address: Ipv4Address, direction: Direction) -> bool {
|
||||
self.mode == Mode::Stateful && self.select(address, direction).is_some()
|
||||
}
|
||||
|
||||
pub(crate) fn len(&self) -> usize {
|
||||
self.inbound.len() + self.outbound.len()
|
||||
}
|
||||
|
||||
pub(crate) fn has_stateful(&self) -> bool {
|
||||
self.mode == Mode::Stateful
|
||||
}
|
||||
|
||||
fn select(&self, address: Ipv4Address, direction: Direction) -> Option<Action> {
|
||||
let entries = match direction {
|
||||
Direction::In => &self.inbound,
|
||||
Direction::Out => &self.outbound,
|
||||
};
|
||||
|
||||
entries
|
||||
.get_lpm(&Ipv4Net::from(address))
|
||||
.map(|(_, action)| *action)
|
||||
}
|
||||
|
||||
fn insert(&mut self, rule: Rule, action: Action, host_address: Ipv4Address) {
|
||||
match rule {
|
||||
Rule::Stateless(target) => {
|
||||
// Bare rules apply in both directions in stateful mode
|
||||
if self.mode == Mode::Stateful {
|
||||
self.insert_direction(Direction::In, target, action, host_address);
|
||||
}
|
||||
|
||||
self.insert_direction(Direction::Out, target, action, host_address);
|
||||
}
|
||||
Rule::Stateful { direction, target } => {
|
||||
self.insert_direction(direction, target, action, host_address);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn insert_direction(
|
||||
&mut self,
|
||||
direction: Direction,
|
||||
target: Target,
|
||||
action: Action,
|
||||
host_address: Ipv4Address,
|
||||
) {
|
||||
let prefix = match target {
|
||||
Target::Prefix(prefix) => prefix,
|
||||
Target::Host => host_address.into(),
|
||||
};
|
||||
let entries = match direction {
|
||||
Direction::In => &mut self.inbound,
|
||||
Direction::Out => &mut self.outbound,
|
||||
};
|
||||
|
||||
entries.insert(prefix, action);
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::{Action, Mode, PolicyDecision, Rules};
|
||||
use crate::proxy::Direction;
|
||||
use smoltcp::wire::Ipv4Address;
|
||||
|
||||
const HOST: Ipv4Address = Ipv4Address::new(192, 168, 64, 1);
|
||||
|
||||
fn stateful_rules() -> Rules {
|
||||
Rules {
|
||||
mode: Mode::Stateful,
|
||||
..Rules::default()
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_policy_precedence() {
|
||||
let target = Ipv4Address::new(10, 0, 0, 1);
|
||||
let mut rules = stateful_rules();
|
||||
|
||||
rules.insert("0.0.0.0/0".parse().unwrap(), Action::Block, HOST);
|
||||
rules.insert("in 10.0.0.0/8".parse().unwrap(), Action::Allow, HOST);
|
||||
|
||||
assert_eq!(
|
||||
rules.policy_decision(target, Direction::In),
|
||||
Some(PolicyDecision::AllowStateful)
|
||||
);
|
||||
assert_eq!(
|
||||
rules.policy_decision(target, Direction::Out),
|
||||
Some(PolicyDecision::Block)
|
||||
);
|
||||
|
||||
rules.insert("10.0.0.1/32".parse().unwrap(), Action::Allow, HOST);
|
||||
assert_eq!(
|
||||
rules.policy_decision(target, Direction::Out),
|
||||
Some(PolicyDecision::AllowStateful)
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_directional_rules_at_same_prefix_are_independent() {
|
||||
let mut rules = stateful_rules();
|
||||
|
||||
for (target, action) in [
|
||||
("in @host", Action::Allow),
|
||||
("out @host", Action::Allow),
|
||||
("in @host", Action::Block),
|
||||
] {
|
||||
rules.insert(target.parse().unwrap(), action, HOST);
|
||||
}
|
||||
|
||||
assert_eq!(
|
||||
rules.policy_decision(HOST, Direction::In),
|
||||
Some(PolicyDecision::Block)
|
||||
);
|
||||
assert_eq!(
|
||||
rules.policy_decision(HOST, Direction::Out),
|
||||
Some(PolicyDecision::AllowStateful)
|
||||
);
|
||||
assert_eq!(rules.len(), 2);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_stateless_rules_are_outbound_only() {
|
||||
let target = Ipv4Address::new(10, 1, 2, 3);
|
||||
let mut rules = Rules::default();
|
||||
|
||||
rules.insert("10.0.0.0/8".parse().unwrap(), Action::Block, HOST);
|
||||
|
||||
assert!(rules.policy_decision(target, Direction::In).is_none());
|
||||
assert_eq!(
|
||||
rules.policy_decision(target, Direction::Out),
|
||||
Some(PolicyDecision::Block)
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_inbound_selection_uses_more_specific_bare_rule() {
|
||||
let target = Ipv4Address::new(10, 1, 2, 3);
|
||||
let mut rules = stateful_rules();
|
||||
|
||||
rules.insert("10.1.0.0/16".parse().unwrap(), Action::Allow, HOST);
|
||||
rules.insert("in 10.0.0.0/8".parse().unwrap(), Action::Block, HOST);
|
||||
|
||||
assert_eq!(
|
||||
rules.policy_decision(target, Direction::In),
|
||||
Some(PolicyDecision::AllowStateful)
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_block_wins_over_allow_at_same_outbound_prefix() {
|
||||
let target = Ipv4Address::new(10, 1, 2, 3);
|
||||
|
||||
for (allow, block) in [
|
||||
("10.0.0.0/8", "out 10.0.0.0/8"),
|
||||
("out 10.0.0.0/8", "10.0.0.0/8"),
|
||||
] {
|
||||
let mut rules = stateful_rules();
|
||||
rules.insert(allow.parse().unwrap(), Action::Allow, HOST);
|
||||
rules.insert(block.parse().unwrap(), Action::Block, HOST);
|
||||
|
||||
assert_eq!(
|
||||
rules.policy_decision(target, Direction::Out),
|
||||
Some(PolicyDecision::Block)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_directional_rule_makes_bare_rules_stateful() {
|
||||
let allow = "out @host".parse().unwrap();
|
||||
let block = "0.0.0.0/0".parse().unwrap();
|
||||
let rules = Rules::new(HOST, &[allow], &[block]);
|
||||
|
||||
assert_eq!(rules.len(), 3);
|
||||
assert!(rules.has_stateful());
|
||||
assert_eq!(
|
||||
rules.policy_decision(HOST, Direction::In),
|
||||
Some(PolicyDecision::Block)
|
||||
);
|
||||
assert_eq!(
|
||||
rules.policy_decision(HOST, Direction::Out),
|
||||
Some(PolicyDecision::AllowStateful)
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_return_tracking_applies_to_all_rules_in_stateful_mode() {
|
||||
let stateful_target = Ipv4Address::new(10, 1, 2, 3);
|
||||
let stateless_target = Ipv4Address::new(192, 0, 2, 1);
|
||||
let mut rules = stateful_rules();
|
||||
|
||||
rules.insert("0.0.0.0/0".parse().unwrap(), Action::Block, HOST);
|
||||
rules.insert("out 10.0.0.0/8".parse().unwrap(), Action::Block, HOST);
|
||||
|
||||
assert!(rules.is_stateful(stateful_target, Direction::Out));
|
||||
assert!(rules.is_stateful(stateless_target, Direction::Out));
|
||||
assert!(rules.is_stateful(stateful_target, Direction::In));
|
||||
|
||||
rules.insert("10.0.0.0/8".parse().unwrap(), Action::Allow, HOST);
|
||||
assert!(rules.is_stateful(stateful_target, Direction::Out));
|
||||
}
|
||||
}
|
||||
|
|
@ -17,50 +17,10 @@ impl UdpPacketHelper for UdpPacket<&[u8]> {
|
|||
}
|
||||
|
||||
fn is_dhcp_request(&self) -> bool {
|
||||
self.src_port() == Self::BOOTPC_PORT && self.dst_port() == Self::BOOTPS_PORT
|
||||
self.src_port() == Self::BOOTPC_PORT || self.dst_port() == Self::BOOTPS_PORT
|
||||
}
|
||||
|
||||
fn is_dhcp_response(&self) -> bool {
|
||||
self.src_port() == Self::BOOTPS_PORT && self.dst_port() == Self::BOOTPC_PORT
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::UdpPacketHelper;
|
||||
use smoltcp::wire::UdpPacket;
|
||||
|
||||
#[test]
|
||||
fn test_is_dhcp_request_requires_both_standard_ports() {
|
||||
assert!(is_dhcp_request(68, 67));
|
||||
assert!(!is_dhcp_request(68, 9999));
|
||||
assert!(!is_dhcp_request(9999, 67));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_is_dhcp_response_requires_both_standard_ports() {
|
||||
assert!(is_dhcp_response(67, 68));
|
||||
assert!(!is_dhcp_response(67, 9999));
|
||||
assert!(!is_dhcp_response(9999, 68));
|
||||
}
|
||||
|
||||
fn is_dhcp_request(src_port: u16, dst_port: u16) -> bool {
|
||||
let buffer = udp_packet_buffer(src_port, dst_port);
|
||||
let udp_pkt = UdpPacket::new_unchecked(&buffer[..]);
|
||||
udp_pkt.is_dhcp_request()
|
||||
}
|
||||
|
||||
fn is_dhcp_response(src_port: u16, dst_port: u16) -> bool {
|
||||
let buffer = udp_packet_buffer(src_port, dst_port);
|
||||
let udp_pkt = UdpPacket::new_unchecked(&buffer[..]);
|
||||
udp_pkt.is_dhcp_response()
|
||||
}
|
||||
|
||||
fn udp_packet_buffer(src_port: u16, dst_port: u16) -> [u8; 8] {
|
||||
let mut buffer = [0; 8];
|
||||
let mut udp_pkt = UdpPacket::new_unchecked(&mut buffer[..]);
|
||||
udp_pkt.set_src_port(src_port);
|
||||
udp_pkt.set_dst_port(dst_port);
|
||||
buffer
|
||||
self.src_port() == Self::BOOTPS_PORT || self.dst_port() == Self::BOOTPC_PORT
|
||||
}
|
||||
}
|
||||
|
|
|
|||
392
lib/proxy/vm.rs
392
lib/proxy/vm.rs
|
|
@ -1,18 +1,12 @@
|
|||
use crate::dhcp_snooper::{Lease, message_matches_bootp_client};
|
||||
use crate::proxy::flows::{FlowDirection, FlowMatch};
|
||||
use crate::proxy::udp_packet_helper::UdpPacketHelper;
|
||||
use crate::proxy::{Direction, PolicyDecision, Proxy};
|
||||
use crate::proxy::{Action, Proxy};
|
||||
use anyhow::Context;
|
||||
use anyhow::Result;
|
||||
use dhcproto::Decodable;
|
||||
use dhcproto::v4::Opcode;
|
||||
use smoltcp::phy::ChecksumCapabilities;
|
||||
use ipnet::Ipv4Net;
|
||||
use smoltcp::wire::{
|
||||
ArpOperation, ArpPacket, ArpRepr, EthernetFrame, EthernetProtocol, IpProtocol, Ipv4Address,
|
||||
Ipv4Packet, Ipv4Repr, UdpPacket,
|
||||
ArpPacket, EthernetFrame, EthernetProtocol, IpProtocol, Ipv4Packet, UdpPacket,
|
||||
};
|
||||
|
||||
const IPV4_HEADER_LEN_WITHOUT_OPTIONS: u8 = 20;
|
||||
use std::net::Ipv4Addr;
|
||||
|
||||
impl Proxy<'_> {
|
||||
pub(crate) fn process_frame_from_vm(&mut self, frame: EthernetFrame<&[u8]>) -> Result<()> {
|
||||
|
|
@ -27,7 +21,7 @@ impl Proxy<'_> {
|
|||
.context("failed to write to the host")
|
||||
}
|
||||
|
||||
fn allowed_from_vm(&mut self, frame: &EthernetFrame<&[u8]>) -> Option<()> {
|
||||
fn allowed_from_vm(&self, frame: &EthernetFrame<&[u8]>) -> Option<()> {
|
||||
if frame.src_addr() != self.vm_mac_address {
|
||||
return None;
|
||||
}
|
||||
|
|
@ -38,14 +32,7 @@ impl Proxy<'_> {
|
|||
self.allowed_from_vm_arp(arp_pkt)
|
||||
}
|
||||
EthernetProtocol::Ipv4 => {
|
||||
let ipv4_pkt = Ipv4Packet::new_unchecked(frame.payload());
|
||||
Ipv4Repr::parse(&ipv4_pkt, &ChecksumCapabilities::ignored()).ok()?;
|
||||
|
||||
// Reject IPv4 options because source routing could bypass destination-based policy
|
||||
if ipv4_pkt.header_len() != IPV4_HEADER_LEN_WITHOUT_OPTIONS {
|
||||
return None;
|
||||
}
|
||||
|
||||
let ipv4_pkt = Ipv4Packet::new_checked(frame.payload()).ok()?;
|
||||
self.allowed_from_vm_ipv4(ipv4_pkt)
|
||||
}
|
||||
_ => None,
|
||||
|
|
@ -53,68 +40,52 @@ impl Proxy<'_> {
|
|||
}
|
||||
|
||||
fn allowed_from_vm_arp(&self, arp_pkt: ArpPacket<&[u8]>) -> Option<()> {
|
||||
vm_arp_allowed(arp_pkt, self.vm_mac_address, self.dhcp_snooper.lease())
|
||||
}
|
||||
if arp_pkt.source_hardware_addr() != self.vm_mac_address.0 {
|
||||
return None;
|
||||
}
|
||||
|
||||
pub(crate) fn allowed_from_vm_ipv4(&mut self, ipv4_pkt: Ipv4Packet<&[u8]>) -> Option<()> {
|
||||
// Is this packet coming from VM's IP address that we've learned from DHCP snooping?
|
||||
if let Some(lease) = &self.dhcp_snooper.lease()
|
||||
&& lease.is_valid_for(ipv4_pkt.src_addr())
|
||||
{
|
||||
// Unicast DHCP renewal is required to maintain the VM's lease
|
||||
// and must bypass user-specified rules
|
||||
if is_allowed_dhcp_request(
|
||||
&ipv4_pkt,
|
||||
Some(self.host.gateway_ip),
|
||||
self.vm_mac_address,
|
||||
self.dhcp_snooper.lease(),
|
||||
) {
|
||||
let source_protocol_addr: [u8; 4] = arp_pkt.source_protocol_addr().try_into().unwrap();
|
||||
let source_protocol_addr = Ipv4Addr::from(source_protocol_addr);
|
||||
|
||||
if let Some(lease) = self.dhcp_snooper.lease() {
|
||||
if lease.valid_ip_source(source_protocol_addr) {
|
||||
return Some(());
|
||||
}
|
||||
} else if source_protocol_addr.is_unspecified() {
|
||||
return Some(());
|
||||
}
|
||||
|
||||
// Consult the flow table before evaluating outbound policy
|
||||
// so established flows are not treated as new traffic
|
||||
let pending = match self
|
||||
.flows
|
||||
.as_mut()
|
||||
.map(|flows| flows.inspect(&ipv4_pkt, FlowDirection::FromVm))
|
||||
.unwrap_or(FlowMatch::Untracked)
|
||||
{
|
||||
FlowMatch::Allowed => return Some(()),
|
||||
FlowMatch::Denied => return None,
|
||||
FlowMatch::Candidate(pending) => Some(pending),
|
||||
FlowMatch::Untracked => None,
|
||||
};
|
||||
None
|
||||
}
|
||||
|
||||
// The flow is either pending or untracked, evaluate it against outbound policy
|
||||
pub(crate) fn allowed_from_vm_ipv4(&self, ipv4_pkt: Ipv4Packet<&[u8]>) -> Option<()> {
|
||||
// Is this packet coming from VM's IP address that we've learned from DHCP snooping?
|
||||
if let Some(lease) = &self.dhcp_snooper.lease()
|
||||
&& lease.valid_ip_source(ipv4_pkt.src_addr())
|
||||
{
|
||||
let dst_addr = ipv4_pkt.dst_addr();
|
||||
|
||||
match self.rules.policy_decision(dst_addr, Direction::Out) {
|
||||
// Return traffic was handled above; enforce explicit outbound blocks here
|
||||
Some(PolicyDecision::Block) => return None,
|
||||
// Filter traffic based on user-specified rules first
|
||||
if !self.rules.is_empty() {
|
||||
let dst_net = Ipv4Net::from(dst_addr);
|
||||
|
||||
// Track statelessly allowed traffic only when needed so its reply is not
|
||||
// treated as a new inbound flow
|
||||
Some(PolicyDecision::AllowStateless) => {
|
||||
return self.admit_with_tracking_if_stateful(pending, dst_addr, Direction::In);
|
||||
if let Some((_, action)) = self.rules.get_lpm(&dst_net) {
|
||||
return match action {
|
||||
Action::Allow => Some(()),
|
||||
Action::Block => None,
|
||||
};
|
||||
}
|
||||
|
||||
// Untracked packets cannot satisfy stateful policy
|
||||
Some(PolicyDecision::AllowStateful) => return self.admit_with_tracking(pending?),
|
||||
|
||||
// No outbound rule matched; apply the built-in fallbacks below
|
||||
None => {}
|
||||
}
|
||||
|
||||
// When no user-specified rules matched, simply allow all global traffic
|
||||
if ip_network::IpNetwork::from(dst_addr).is_global() {
|
||||
return self.admit_with_tracking_if_trackable(pending);
|
||||
return Some(());
|
||||
}
|
||||
|
||||
// Additionally, allow communication with the host,
|
||||
// otherwise things like SSH to a VM won't work
|
||||
if dst_addr == self.host.gateway_ip {
|
||||
return self.admit_with_tracking_if_trackable(pending);
|
||||
if ipv4_pkt.dst_addr() == self.host.gateway_ip {
|
||||
return Some(());
|
||||
}
|
||||
|
||||
// Additionally, allow DNS requests to DNS-servers
|
||||
|
|
@ -122,294 +93,25 @@ impl Proxy<'_> {
|
|||
if ipv4_pkt.next_header() == IpProtocol::Udp {
|
||||
let udp_pkt = UdpPacket::new_checked(ipv4_pkt.payload()).ok()?;
|
||||
|
||||
if udp_pkt.is_dns_request() && self.dhcp_snooper.valid_dns_target(&dst_addr) {
|
||||
return self.admit_with_tracking_if_trackable(pending);
|
||||
if udp_pkt.is_dns_request()
|
||||
&& self.dhcp_snooper.valid_dns_target(&ipv4_pkt.dst_addr())
|
||||
{
|
||||
return Some(());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Allow outgoing DHCP requests to the bootpd(8) broadcast address,
|
||||
// Allow outgoing DHCP requests to broadcast addresses,
|
||||
// otherwise DHCP snooper will never be populated
|
||||
if is_allowed_dhcp_request(
|
||||
&ipv4_pkt,
|
||||
None,
|
||||
self.vm_mac_address,
|
||||
self.dhcp_snooper.lease(),
|
||||
) {
|
||||
return Some(());
|
||||
if ipv4_pkt.next_header() == IpProtocol::Udp {
|
||||
let udp_pkt = UdpPacket::new_checked(ipv4_pkt.payload()).ok()?;
|
||||
|
||||
// Allow DHCP communication with the bootpd(8) on host via broadcast address
|
||||
if udp_pkt.is_dhcp_request() && ipv4_pkt.dst_addr().is_broadcast() {
|
||||
return Some(());
|
||||
}
|
||||
}
|
||||
|
||||
None
|
||||
}
|
||||
}
|
||||
|
||||
fn is_allowed_dhcp_request(
|
||||
ipv4_pkt: &Ipv4Packet<&[u8]>,
|
||||
unicast_target: Option<Ipv4Address>,
|
||||
vm_mac_address: smoltcp::wire::EthernetAddress,
|
||||
lease: &Option<Lease>,
|
||||
) -> bool {
|
||||
// Require the source address to be either:
|
||||
// * covered by the VM's current lease
|
||||
// * unspecified on the broadcast DHCP path
|
||||
let src_addr = ipv4_pkt.src_addr();
|
||||
let src_has_valid_lease = lease
|
||||
.as_ref()
|
||||
.is_some_and(|lease| lease.is_valid_for(src_addr));
|
||||
if !src_has_valid_lease && !(unicast_target.is_none() && src_addr.is_unspecified()) {
|
||||
return false;
|
||||
}
|
||||
|
||||
let dst_addr = ipv4_pkt.dst_addr();
|
||||
|
||||
// Keep the common path cheap and inspect UDP only for a permitted DHCP target
|
||||
if !dst_addr.is_broadcast() && unicast_target != Some(dst_addr) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if ipv4_pkt.next_header() != IpProtocol::Udp {
|
||||
return false;
|
||||
}
|
||||
|
||||
let Ok(udp_pkt) = UdpPacket::new_checked(ipv4_pkt.payload()) else {
|
||||
return false;
|
||||
};
|
||||
|
||||
// Require the standard DHCP client and server ports
|
||||
if !udp_pkt.is_dhcp_request() {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Require the BOOTP client hardware address to match this VM
|
||||
let mut decoder = dhcproto::v4::Decoder::new(udp_pkt.payload());
|
||||
let Ok(message) = dhcproto::v4::Message::decode(&mut decoder) else {
|
||||
return false;
|
||||
};
|
||||
|
||||
message_matches_bootp_client(&message, Opcode::BootRequest, vm_mac_address.0)
|
||||
}
|
||||
|
||||
fn vm_arp_allowed(
|
||||
arp_pkt: ArpPacket<&[u8]>,
|
||||
vm_mac_address: smoltcp::wire::EthernetAddress,
|
||||
lease: &Option<Lease>,
|
||||
) -> Option<()> {
|
||||
let (operation, source_hardware_addr, source_protocol_addr) =
|
||||
match ArpRepr::parse(&arp_pkt).ok()? {
|
||||
ArpRepr::EthernetIpv4 {
|
||||
operation,
|
||||
source_hardware_addr,
|
||||
source_protocol_addr,
|
||||
..
|
||||
} => (operation, source_hardware_addr, source_protocol_addr),
|
||||
_ => return None,
|
||||
};
|
||||
|
||||
if !matches!(operation, ArpOperation::Request | ArpOperation::Reply) {
|
||||
return None;
|
||||
}
|
||||
|
||||
if source_hardware_addr != vm_mac_address {
|
||||
return None;
|
||||
}
|
||||
|
||||
if let Some(lease) = lease {
|
||||
if lease.is_valid_for(source_protocol_addr) {
|
||||
return Some(());
|
||||
}
|
||||
} else if source_protocol_addr.is_unspecified() {
|
||||
return Some(());
|
||||
}
|
||||
|
||||
None
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use crate::dhcp_snooper::Lease;
|
||||
use dhcproto::v4::{DhcpOption, Message, MessageType};
|
||||
use dhcproto::{Encodable, Encoder};
|
||||
use smoltcp::wire::{
|
||||
ArpHardware, ArpOperation, ArpPacket, EthernetAddress, EthernetProtocol, IpProtocol,
|
||||
Ipv4Address, Ipv4Packet, UdpPacket,
|
||||
};
|
||||
use std::collections::HashSet;
|
||||
use std::time::Duration;
|
||||
|
||||
const VM_MAC: EthernetAddress = EthernetAddress([0x02, 0x00, 0x00, 0x00, 0x00, 0x01]);
|
||||
|
||||
#[test]
|
||||
fn test_allowed_dhcp_request_policy() {
|
||||
let gateway = Ipv4Address::new(192, 168, 64, 1);
|
||||
let lease_ip = Ipv4Address::new(192, 168, 64, 2);
|
||||
let other = Ipv4Address::new(192, 168, 64, 3);
|
||||
let no_lease = None;
|
||||
let lease = Some(Lease::new(
|
||||
lease_ip,
|
||||
Duration::from_secs(600),
|
||||
HashSet::new(),
|
||||
));
|
||||
let initial = |src, chaddr| {
|
||||
allowed_dhcp_request(src, Ipv4Address::BROADCAST, None, chaddr, &no_lease)
|
||||
};
|
||||
let renewal = |src, dst| allowed_dhcp_request(src, dst, Some(gateway), VM_MAC.0, &lease);
|
||||
let other_mac = [0x02, 0x00, 0x00, 0x00, 0x00, 0x02];
|
||||
|
||||
assert!(initial(Ipv4Address::UNSPECIFIED, VM_MAC.0));
|
||||
assert!(renewal(lease_ip, gateway));
|
||||
assert!(!renewal(other, gateway));
|
||||
assert!(!renewal(Ipv4Address::UNSPECIFIED, gateway));
|
||||
assert!(!renewal(lease_ip, other));
|
||||
assert!(!initial(Ipv4Address::UNSPECIFIED, other_mac));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_allowed_from_vm_arp_allows_unspecified_request_without_lease() {
|
||||
let vm_mac_address = EthernetAddress([0x02, 0x00, 0x00, 0x00, 0x00, 0x01]);
|
||||
let buf = arp_packet(vm_mac_address.0, [0, 0, 0, 0], ArpOperation::Request, 6, 4);
|
||||
let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
|
||||
|
||||
assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &None).is_some());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_allowed_from_vm_arp_allows_reply_for_leased_ip() {
|
||||
let vm_mac_address = EthernetAddress([0x02, 0x00, 0x00, 0x00, 0x00, 0x01]);
|
||||
let lease_ip = Ipv4Address::new(192, 168, 0, 2);
|
||||
let lease = Some(Lease::new(
|
||||
lease_ip,
|
||||
Duration::from_secs(600),
|
||||
HashSet::new(),
|
||||
));
|
||||
let buf = arp_packet(
|
||||
vm_mac_address.0,
|
||||
lease_ip.octets(),
|
||||
ArpOperation::Reply,
|
||||
6,
|
||||
4,
|
||||
);
|
||||
let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
|
||||
|
||||
assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &lease).is_some());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_allowed_from_vm_arp_rejects_unknown_operation() {
|
||||
let vm_mac_address = EthernetAddress([0x02, 0x00, 0x00, 0x00, 0x00, 0x01]);
|
||||
let buf = arp_packet(
|
||||
vm_mac_address.0,
|
||||
[0, 0, 0, 0],
|
||||
ArpOperation::Unknown(3),
|
||||
6,
|
||||
4,
|
||||
);
|
||||
let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
|
||||
|
||||
assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &None).is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_allowed_from_vm_arp_rejects_non_ethernet_hardware_type() {
|
||||
let vm_mac_address = EthernetAddress([0x02, 0x00, 0x00, 0x00, 0x00, 0x01]);
|
||||
let mut buf = arp_packet(vm_mac_address.0, [0, 0, 0, 0], ArpOperation::Request, 6, 4);
|
||||
let mut arp_pkt = ArpPacket::new_unchecked(buf.as_mut_slice());
|
||||
arp_pkt.set_hardware_type(ArpHardware::Unknown(2));
|
||||
let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
|
||||
|
||||
assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &None).is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_allowed_from_vm_arp_rejects_non_ipv4_protocol_type() {
|
||||
let vm_mac_address = EthernetAddress([0x02, 0x00, 0x00, 0x00, 0x00, 0x01]);
|
||||
let mut buf = arp_packet(vm_mac_address.0, [0, 0, 0, 0], ArpOperation::Request, 6, 4);
|
||||
let mut arp_pkt = ArpPacket::new_unchecked(buf.as_mut_slice());
|
||||
arp_pkt.set_protocol_type(EthernetProtocol::Ipv6);
|
||||
let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
|
||||
|
||||
assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &None).is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_allowed_from_vm_arp_rejects_non_ipv4_protocol_length() {
|
||||
let vm_mac_address = EthernetAddress([0x02, 0x00, 0x00, 0x00, 0x00, 0x01]);
|
||||
let buf = arp_packet(vm_mac_address.0, [0, 0, 0], ArpOperation::Request, 6, 3);
|
||||
let arp_pkt = ArpPacket::new_checked(buf.as_slice()).unwrap();
|
||||
|
||||
assert!(super::vm_arp_allowed(arp_pkt, vm_mac_address, &None).is_none());
|
||||
}
|
||||
|
||||
fn arp_packet(
|
||||
source_hardware_addr: [u8; 6],
|
||||
source_protocol_addr: impl AsRef<[u8]>,
|
||||
operation: ArpOperation,
|
||||
hardware_len: u8,
|
||||
protocol_len: u8,
|
||||
) -> Vec<u8> {
|
||||
let source_protocol_addr = source_protocol_addr.as_ref();
|
||||
let payload_len = 8 + 2 * (hardware_len as usize + protocol_len as usize);
|
||||
let mut buf = vec![0; payload_len];
|
||||
let mut arp_pkt = ArpPacket::new_unchecked(buf.as_mut_slice());
|
||||
arp_pkt.set_hardware_type(ArpHardware::Ethernet);
|
||||
arp_pkt.set_protocol_type(EthernetProtocol::Ipv4);
|
||||
arp_pkt.set_hardware_len(hardware_len);
|
||||
arp_pkt.set_protocol_len(protocol_len);
|
||||
arp_pkt.set_operation(operation);
|
||||
arp_pkt.set_source_hardware_addr(&source_hardware_addr[..hardware_len as usize]);
|
||||
arp_pkt.set_source_protocol_addr(source_protocol_addr);
|
||||
arp_pkt.set_target_hardware_addr(&[0; 6][..hardware_len as usize]);
|
||||
arp_pkt.set_target_protocol_addr(&vec![0; protocol_len as usize]);
|
||||
buf
|
||||
}
|
||||
|
||||
fn allowed_dhcp_request(
|
||||
src_addr: Ipv4Address,
|
||||
dst_addr: Ipv4Address,
|
||||
unicast_target: Option<Ipv4Address>,
|
||||
chaddr: [u8; 6],
|
||||
lease: &Option<Lease>,
|
||||
) -> bool {
|
||||
let mut buf = dhcp_request(chaddr);
|
||||
let mut ipv4_pkt = Ipv4Packet::new_unchecked(buf.as_mut_slice());
|
||||
ipv4_pkt.set_src_addr(src_addr);
|
||||
ipv4_pkt.set_dst_addr(dst_addr);
|
||||
|
||||
let ipv4_pkt = Ipv4Packet::new_checked(buf.as_slice()).unwrap();
|
||||
super::is_allowed_dhcp_request(&ipv4_pkt, unicast_target, VM_MAC, lease)
|
||||
}
|
||||
|
||||
fn dhcp_request(chaddr: [u8; 6]) -> Vec<u8> {
|
||||
let mut message = Message::new(
|
||||
Ipv4Address::UNSPECIFIED,
|
||||
Ipv4Address::UNSPECIFIED,
|
||||
Ipv4Address::UNSPECIFIED,
|
||||
Ipv4Address::UNSPECIFIED,
|
||||
&chaddr,
|
||||
);
|
||||
message
|
||||
.opts_mut()
|
||||
.insert(DhcpOption::MessageType(MessageType::Discover));
|
||||
|
||||
let mut dhcp_payload = Vec::new();
|
||||
message
|
||||
.encode(&mut Encoder::new(&mut dhcp_payload))
|
||||
.unwrap();
|
||||
|
||||
let total_len = 20 + 8 + dhcp_payload.len();
|
||||
let mut buf = vec![0; total_len];
|
||||
let mut ipv4_pkt = Ipv4Packet::new_unchecked(buf.as_mut_slice());
|
||||
ipv4_pkt.set_version(4);
|
||||
ipv4_pkt.set_header_len(20);
|
||||
ipv4_pkt.set_total_len(total_len as u16);
|
||||
ipv4_pkt.set_next_header(IpProtocol::Udp);
|
||||
ipv4_pkt.set_src_addr(Ipv4Address::UNSPECIFIED);
|
||||
ipv4_pkt.set_dst_addr(Ipv4Address::BROADCAST);
|
||||
|
||||
let mut udp_pkt = UdpPacket::new_unchecked(ipv4_pkt.payload_mut());
|
||||
udp_pkt.set_src_port(68);
|
||||
udp_pkt.set_dst_port(67);
|
||||
udp_pkt.set_len((8 + dhcp_payload.len()) as u16);
|
||||
udp_pkt.payload_mut().copy_from_slice(&dhcp_payload);
|
||||
buf
|
||||
}
|
||||
}
|
||||
|
|
|
|||
232
lib/vm.rs
232
lib/vm.rs
|
|
@ -1,7 +1,5 @@
|
|||
use anyhow::{Context, Result, bail};
|
||||
use std::io;
|
||||
use std::mem::{size_of, zeroed};
|
||||
use std::os::fd::{AsRawFd, FromRawFd, RawFd};
|
||||
use anyhow::Result;
|
||||
use std::os::unix::io::{AsRawFd, FromRawFd, RawFd};
|
||||
use std::os::unix::net::UnixDatagram;
|
||||
|
||||
pub struct VM {
|
||||
|
|
@ -10,9 +8,6 @@ pub struct VM {
|
|||
|
||||
impl VM {
|
||||
pub fn new(vm_fd: RawFd) -> Result<VM> {
|
||||
let vm_fd = duplicate_vm_fd(vm_fd)?;
|
||||
|
||||
// SAFETY: duplicate_vm_fd only returns a valid descriptor that it owns.
|
||||
let sock = unsafe { UnixDatagram::from_raw_fd(vm_fd) };
|
||||
sock.set_nonblocking(true)?;
|
||||
|
||||
|
|
@ -26,92 +21,6 @@ impl VM {
|
|||
pub fn read(&self, buf: &mut [u8]) -> std::io::Result<usize> {
|
||||
self.sock.recv(buf)
|
||||
}
|
||||
|
||||
pub fn is_connected(&self) -> io::Result<bool> {
|
||||
match self.sock.peer_addr() {
|
||||
Ok(_) => Ok(true),
|
||||
Err(error) if error.kind() == io::ErrorKind::NotConnected => Ok(false),
|
||||
Err(error) => Err(error),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn duplicate_vm_fd(vm_fd: RawFd) -> Result<RawFd> {
|
||||
if vm_fd < 0 {
|
||||
bail!("invalid VM file descriptor {vm_fd}: value must be non-negative");
|
||||
}
|
||||
|
||||
// SAFETY: fcntl duplicates the descriptor without transferring ownership of vm_fd.
|
||||
let duplicated_fd = unsafe { libc::fcntl(vm_fd, libc::F_DUPFD_CLOEXEC, 0) };
|
||||
if duplicated_fd == -1 {
|
||||
return Err(io::Error::last_os_error())
|
||||
.with_context(|| format!("failed to duplicate VM file descriptor {vm_fd}"));
|
||||
}
|
||||
|
||||
if let Err(error) = validate_vm_fd(duplicated_fd) {
|
||||
// SAFETY: duplicated_fd is an open descriptor owned by this function.
|
||||
unsafe { libc::close(duplicated_fd) };
|
||||
return Err(error);
|
||||
}
|
||||
|
||||
Ok(duplicated_fd)
|
||||
}
|
||||
|
||||
fn validate_vm_fd(vm_fd: RawFd) -> Result<()> {
|
||||
// SAFETY: fcntl only reads descriptor state and does not take ownership.
|
||||
if unsafe { libc::fcntl(vm_fd, libc::F_GETFD) } == -1 {
|
||||
return Err(io::Error::last_os_error())
|
||||
.with_context(|| format!("failed to inspect VM file descriptor {vm_fd}"));
|
||||
}
|
||||
|
||||
let mut socket_type = 0;
|
||||
let mut socket_type_len = size_of::<libc::c_int>() as libc::socklen_t;
|
||||
|
||||
// SAFETY: socket_type and socket_type_len are valid writable buffers of the sizes given.
|
||||
if unsafe {
|
||||
libc::getsockopt(
|
||||
vm_fd,
|
||||
libc::SOL_SOCKET,
|
||||
libc::SO_TYPE,
|
||||
(&mut socket_type as *mut libc::c_int).cast(),
|
||||
&mut socket_type_len,
|
||||
)
|
||||
} == -1
|
||||
{
|
||||
return Err(io::Error::last_os_error())
|
||||
.with_context(|| format!("VM file descriptor {vm_fd} is not a socket"));
|
||||
}
|
||||
|
||||
if socket_type != libc::SOCK_DGRAM {
|
||||
bail!("VM file descriptor {vm_fd} is not a Unix datagram socket");
|
||||
}
|
||||
|
||||
let mut address: libc::sockaddr_storage = unsafe { zeroed() };
|
||||
let mut address_len = size_of::<libc::sockaddr_storage>() as libc::socklen_t;
|
||||
|
||||
// SAFETY: address and address_len are valid writable buffers of the sizes given.
|
||||
if unsafe {
|
||||
libc::getsockname(
|
||||
vm_fd,
|
||||
(&mut address as *mut libc::sockaddr_storage).cast(),
|
||||
&mut address_len,
|
||||
)
|
||||
} == -1
|
||||
{
|
||||
return Err(io::Error::last_os_error()).with_context(|| {
|
||||
format!("failed to inspect the address family of VM file descriptor {vm_fd}")
|
||||
});
|
||||
}
|
||||
|
||||
// macOS returns a zero-length address for unnamed UNIX-domain sockets,
|
||||
// including socketpair descriptors. Other socket families return their
|
||||
// address family when getsockname succeeds.
|
||||
let is_unix_socket = address_len == 0 || address.ss_family as libc::c_int == libc::AF_UNIX;
|
||||
if !is_unix_socket {
|
||||
bail!("VM file descriptor {vm_fd} is not a Unix socket");
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
impl AsRawFd for VM {
|
||||
|
|
@ -119,140 +28,3 @@ impl AsRawFd for VM {
|
|||
self.sock.as_raw_fd()
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::VM;
|
||||
use polling::{Event, Events, PollMode, Poller};
|
||||
use std::fs::File;
|
||||
use std::net::UdpSocket;
|
||||
use std::os::fd::AsRawFd;
|
||||
use std::os::unix::net::{UnixDatagram, UnixStream};
|
||||
use std::time::Duration;
|
||||
|
||||
#[test]
|
||||
fn test_new_rejects_negative_fd() {
|
||||
let error = VM::new(-1).err().unwrap();
|
||||
|
||||
assert_eq!(
|
||||
error.to_string(),
|
||||
"invalid VM file descriptor -1: value must be non-negative"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_new_rejects_non_socket_fd_without_taking_ownership() {
|
||||
let file = File::open("/dev/null").unwrap();
|
||||
let error = VM::new(file.as_raw_fd()).err().unwrap();
|
||||
|
||||
assert!(error.to_string().contains("is not a socket"));
|
||||
assert!(file.metadata().is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_new_rejects_closed_fd() {
|
||||
let (socket, _peer) = UnixDatagram::pair().unwrap();
|
||||
let vm_fd = socket.as_raw_fd();
|
||||
drop(socket);
|
||||
|
||||
let error = VM::new(vm_fd).err().unwrap();
|
||||
|
||||
assert!(
|
||||
error
|
||||
.to_string()
|
||||
.contains("failed to duplicate VM file descriptor")
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_new_rejects_non_datagram_socket() {
|
||||
let (stream, _peer) = UnixStream::pair().unwrap();
|
||||
let error = VM::new(stream.as_raw_fd()).err().unwrap();
|
||||
|
||||
assert!(error.to_string().contains("not a Unix datagram socket"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_new_rejects_internet_datagram_socket() {
|
||||
let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
|
||||
let error = VM::new(socket.as_raw_fd()).err().unwrap();
|
||||
|
||||
assert!(error.to_string().contains("not a Unix socket"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_new_does_not_close_original_fd_when_vm_is_dropped() {
|
||||
let (socket, _peer) = UnixDatagram::pair().unwrap();
|
||||
let vm = VM::new(socket.as_raw_fd()).unwrap();
|
||||
drop(vm);
|
||||
|
||||
let socket_fd_is_open = unsafe { libc::fcntl(socket.as_raw_fd(), libc::F_GETFD) != -1 };
|
||||
|
||||
if socket_fd_is_open {
|
||||
drop(socket);
|
||||
} else {
|
||||
// Avoid double-closing the descriptor if this test catches an unsafe implementation.
|
||||
std::mem::forget(socket);
|
||||
}
|
||||
|
||||
assert!(socket_fd_is_open);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_connected_socket_has_peer() {
|
||||
let (socket, _peer) = UnixDatagram::pair().unwrap();
|
||||
let vm = VM::new(socket.as_raw_fd()).unwrap();
|
||||
|
||||
assert!(vm.is_connected().unwrap());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_disconnected_peer_is_detected_without_kqueue_event() {
|
||||
let (socket, peer) = UnixDatagram::pair().unwrap();
|
||||
let vm = VM::new(socket.as_raw_fd()).unwrap();
|
||||
let poller = Poller::new().unwrap();
|
||||
let mut events = Events::new();
|
||||
|
||||
unsafe {
|
||||
poller
|
||||
.add_with_mode(vm.as_raw_fd(), Event::readable(0), PollMode::Edge)
|
||||
.unwrap();
|
||||
}
|
||||
drop(peer);
|
||||
|
||||
poller
|
||||
.wait(&mut events, Some(Duration::from_millis(20)))
|
||||
.unwrap();
|
||||
|
||||
assert!(events.is_empty());
|
||||
assert!(!vm.is_connected().unwrap());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_disconnected_peer_is_detected_when_another_socket_wakes_kqueue() {
|
||||
let (socket, peer) = UnixDatagram::pair().unwrap();
|
||||
let (host, host_peer) = UnixDatagram::pair().unwrap();
|
||||
let vm = VM::new(socket.as_raw_fd()).unwrap();
|
||||
let poller = Poller::new().unwrap();
|
||||
let mut events = Events::new();
|
||||
|
||||
unsafe {
|
||||
poller
|
||||
.add_with_mode(vm.as_raw_fd(), Event::readable(0), PollMode::Edge)
|
||||
.unwrap();
|
||||
poller
|
||||
.add_with_mode(host.as_raw_fd(), Event::readable(1), PollMode::Edge)
|
||||
.unwrap();
|
||||
}
|
||||
drop(peer);
|
||||
host_peer.send(&[1]).unwrap();
|
||||
|
||||
poller
|
||||
.wait(&mut events, Some(Duration::from_millis(20)))
|
||||
.unwrap();
|
||||
|
||||
assert!(events.iter().any(|event| event.key == 1));
|
||||
assert!(!events.iter().any(|event| event.key == 0));
|
||||
assert!(!vm.is_connected().unwrap());
|
||||
}
|
||||
}
|
||||
|
|
|
|||
195
src/main.rs
195
src/main.rs
|
|
@ -7,46 +7,29 @@ use privdrop::PrivDrop;
|
|||
use softnet::NetType;
|
||||
use softnet::proxy::ExposedPort;
|
||||
use softnet::proxy::Proxy;
|
||||
use softnet::proxy::Rule;
|
||||
use softnet::proxy::Target;
|
||||
use std::borrow::Cow;
|
||||
use std::env;
|
||||
use std::os::raw::c_int;
|
||||
use std::os::unix::io::RawFd;
|
||||
use std::os::unix::process::CommandExt;
|
||||
use std::process::{Command, ExitCode};
|
||||
use system_configuration::core_foundation::base::TCFType;
|
||||
use system_configuration::core_foundation::boolean::CFBoolean;
|
||||
use system_configuration::core_foundation::dictionary::CFDictionary;
|
||||
use system_configuration::core_foundation::number::CFNumber;
|
||||
use system_configuration::core_foundation::string::CFString;
|
||||
use system_configuration::preferences::SCPreferences;
|
||||
use system_configuration::sys::preferences::{
|
||||
SCPreferencesApplyChanges, SCPreferencesCommitChanges, SCPreferencesLock,
|
||||
SCPreferencesSetValue, SCPreferencesUnlock,
|
||||
};
|
||||
use system_configuration::sys::preferences::{SCPreferencesCommitChanges, SCPreferencesSetValue};
|
||||
use uzers::{get_current_groupname, get_current_username, get_effective_uid};
|
||||
|
||||
const VERSION: &str = match option_env!("SOFTNET_VERSION") {
|
||||
Some(version) => version,
|
||||
None => "unknown-unknown",
|
||||
};
|
||||
|
||||
#[derive(Parser, Debug)]
|
||||
#[command(version = VERSION)]
|
||||
struct Args {
|
||||
#[clap(
|
||||
long,
|
||||
value_parser = parse_vm_fd,
|
||||
help = "FD number to use for communicating with the VM's networking stack"
|
||||
)]
|
||||
vm_fd: c_int,
|
||||
|
||||
#[clap(
|
||||
long,
|
||||
value_parser = parse_vm_fd,
|
||||
help = "connected Unix stream FD for newline-delimited JSON-RPC policy control"
|
||||
)]
|
||||
control_fd: Option<c_int>,
|
||||
|
||||
#[clap(long, help = "MAC address to enforce for the VM")]
|
||||
vm_mac_address: mac_address::MacAddress,
|
||||
|
||||
|
|
@ -68,51 +51,34 @@ struct Args {
|
|||
|
||||
#[clap(
|
||||
long,
|
||||
help = "Comma-separated rules for allowing traffic, in the following forms:\n\n\
|
||||
* TARGET: traffic sent from the VM to TARGET; reverse traffic is not filtered by this rule\n\
|
||||
* in TARGET: flows initiated from TARGET to the VM\n\
|
||||
* out TARGET: flows initiated from the VM to TARGET\n\n\
|
||||
Targets are:\n\n\
|
||||
* IPv4 CIDRs\n\
|
||||
* @host, which matches the vmnet bridge gateway IP\n\n\
|
||||
Directional rules make bare TARGET rules stateful in both directions.\n\n\
|
||||
When used with --block, the longest prefix match wins. If an identical rule is both \
|
||||
allowed and blocked, blocking takes precedence.\n\n\
|
||||
--allow=0.0.0.0/0 additionally disables bridge isolation, even when \
|
||||
--block=0.0.0.0/0 is specified.\n\n\
|
||||
Examples:\n\n\
|
||||
* --allow=192.168.0.0/24 — allow stateless traffic with this LAN\n\
|
||||
* --allow=\"in @host\" — allow stateful flows initiated from @host\n\
|
||||
* --allow=\"out 192.168.0.0/24\" — allow stateful flows initiated toward this LAN\n\
|
||||
* --allow=\"in @host,out 192.168.0.0/24\" — multiple rules may be comma-separated",
|
||||
value_name = "comma-separated rules",
|
||||
help = "Comma-separated list of CIDRs to allow the traffic to \
|
||||
(e.g. --allow=192.168.0.0/24 may be used to allow a LAN access for a VM), \
|
||||
plus supported @-aliases. Currently the only supported @-alias is @host, \
|
||||
which matches the vmnet bridge gateway IP. \
|
||||
When used with --block, the longest prefix match always wins. \
|
||||
In case an identical prefix is both --allow'ed and --block'ed, \
|
||||
blocking will take precedence. --allow=0.0.0.0/0 is a special case, \
|
||||
it additionally disables bridge isolation (even when --block=0.0.0.0/0 is specified).",
|
||||
value_name = "comma-separated CIDRs or @-alias",
|
||||
use_value_delimiter = true,
|
||||
action = clap::ArgAction::Set
|
||||
)]
|
||||
allow: Vec<Rule>,
|
||||
allow: Vec<Target>,
|
||||
|
||||
#[clap(
|
||||
long,
|
||||
help = "Comma-separated rules for blocking traffic, in the following forms:\n\n\
|
||||
* TARGET: traffic sent from the VM to TARGET; reverse traffic is not filtered by this rule\n\
|
||||
* in TARGET: flows initiated from TARGET to the VM\n\
|
||||
* out TARGET: flows initiated from the VM to TARGET\n\n\
|
||||
Targets are:\n\n\
|
||||
* IPv4 CIDRs\n\
|
||||
* @host, which matches the vmnet bridge gateway IP\n\n\
|
||||
Directional rules make bare TARGET rules stateful in both directions.\n\n\
|
||||
When used with --allow, the longest prefix match wins. If an identical rule is both \
|
||||
allowed and blocked, blocking takes precedence.\n\n\
|
||||
Examples:\n\n\
|
||||
* --block=0.0.0.0/0 — establish a stateless default-deny egress policy\n\
|
||||
* --block=\"out @host\" — block stateful flows initiated toward @host\n\
|
||||
* --block=\"out 66.66.66.0/24\" — block stateful flows initiated toward this CIDR\n\
|
||||
* --block=\"out @host,out 66.66.66.0/24\" — multiple rules may be comma-separated",
|
||||
value_name = "comma-separated rules",
|
||||
help = "Comma-separated list of CIDRs to block the traffic to \
|
||||
(e.g. --block=0.0.0.0/0 may be used to establish a default deny policy \
|
||||
that is further relaxed with --allow), plus supported @-aliases. \
|
||||
Currently the only supported @-alias is @host, which matches the vmnet bridge gateway IP. \
|
||||
When used with --allow, the longest prefix match always wins. \
|
||||
In case an identical prefix is both --allow'ed and --block'ed, \
|
||||
blocking will take precedence.",
|
||||
value_name = "comma-separated CIDRs or @-alias",
|
||||
use_value_delimiter = true,
|
||||
action = clap::ArgAction::Set
|
||||
)]
|
||||
block: Vec<Rule>,
|
||||
block: Vec<Target>,
|
||||
|
||||
#[clap(
|
||||
long,
|
||||
|
|
@ -139,10 +105,10 @@ fn main() -> ExitCode {
|
|||
}
|
||||
|
||||
// Initialize Sentry
|
||||
let _sentry = sentry::init(
|
||||
sentry::ClientOptions::default()
|
||||
.maybe_release(option_env!("CIRRUS_TAG").map(|tag| format!("softnet@{tag}"))),
|
||||
);
|
||||
let _sentry = sentry::init(sentry::ClientOptions {
|
||||
release: option_env!("CIRRUS_TAG").map(|tag| Cow::from(format!("softnet@{tag}"))),
|
||||
..Default::default()
|
||||
});
|
||||
|
||||
// Enrich future events with Cirrus CI-specific tags
|
||||
if let Ok(tags) = env::var("CIRRUS_SENTRY_TAGS") {
|
||||
|
|
@ -225,8 +191,8 @@ fn try_main() -> anyhow::Result<()> {
|
|||
));
|
||||
}
|
||||
|
||||
// Configure bootpd(8) while still having the root privileges
|
||||
configure_bootpd(args.bootpd_lease_time)?;
|
||||
// Set bootpd(8) min/max lease time while still having the root privileges
|
||||
set_bootpd_lease_time(args.bootpd_lease_time);
|
||||
|
||||
// Initialize the proxy while still having the root privileges
|
||||
let mut proxy = Proxy::new(
|
||||
|
|
@ -236,7 +202,6 @@ fn try_main() -> anyhow::Result<()> {
|
|||
args.allow,
|
||||
args.block,
|
||||
args.expose,
|
||||
args.control_fd.map(|fd| fd as RawFd),
|
||||
)
|
||||
.context("failed to initialize proxy")?;
|
||||
|
||||
|
|
@ -252,18 +217,6 @@ fn try_main() -> anyhow::Result<()> {
|
|||
proxy.run()
|
||||
}
|
||||
|
||||
fn parse_vm_fd(value: &str) -> Result<c_int, String> {
|
||||
let vm_fd = value
|
||||
.parse::<c_int>()
|
||||
.map_err(|err| format!("invalid file descriptor: {err}"))?;
|
||||
|
||||
if vm_fd < 0 {
|
||||
return Err("file descriptor must be non-negative".to_string());
|
||||
}
|
||||
|
||||
Ok(vm_fd)
|
||||
}
|
||||
|
||||
fn sudo_escalation_works() -> bool {
|
||||
let exe = std::env::current_exe().unwrap();
|
||||
let args = std::env::args().skip(1);
|
||||
|
|
@ -278,96 +231,24 @@ fn sudo_escalation_works() -> bool {
|
|||
.unwrap_or(false)
|
||||
}
|
||||
|
||||
fn configure_bootpd(lease_time: u32) -> anyhow::Result<()> {
|
||||
fn set_bootpd_lease_time(lease_time: u32) {
|
||||
let prefs = SCPreferences::group(
|
||||
&CFString::new("softnet"),
|
||||
&CFString::new("com.apple.InternetSharing.default.plist"),
|
||||
);
|
||||
|
||||
let bootpd_dict = CFDictionary::from_CFType_pairs(&[
|
||||
(
|
||||
CFString::new("DHCPLeaseTimeSecs"),
|
||||
CFNumber::from(lease_time as i32).as_CFType(),
|
||||
),
|
||||
(
|
||||
CFString::new("dhcp_ignore_client_identifier"),
|
||||
CFBoolean::true_value().as_CFType(),
|
||||
),
|
||||
]);
|
||||
let bootpd_dict = CFDictionary::from_CFType_pairs(&[(
|
||||
CFString::new("DHCPLeaseTimeSecs"),
|
||||
CFNumber::from(lease_time as i32),
|
||||
)]);
|
||||
|
||||
unsafe {
|
||||
let prefs = prefs.as_concrete_TypeRef();
|
||||
anyhow::ensure!(
|
||||
SCPreferencesLock(prefs, 1) != 0,
|
||||
"failed to lock bootpd preferences"
|
||||
SCPreferencesSetValue(
|
||||
prefs.as_concrete_TypeRef(),
|
||||
CFString::new("bootpd").as_concrete_TypeRef(),
|
||||
bootpd_dict.as_concrete_TypeRef().cast(),
|
||||
);
|
||||
|
||||
let result = (|| -> anyhow::Result<()> {
|
||||
anyhow::ensure!(
|
||||
SCPreferencesSetValue(
|
||||
prefs,
|
||||
CFString::new("bootpd").as_concrete_TypeRef(),
|
||||
bootpd_dict.as_concrete_TypeRef().cast(),
|
||||
) != 0,
|
||||
"failed to set bootpd preferences"
|
||||
);
|
||||
|
||||
anyhow::ensure!(
|
||||
SCPreferencesCommitChanges(prefs) != 0,
|
||||
"failed to commit bootpd preferences"
|
||||
);
|
||||
|
||||
anyhow::ensure!(
|
||||
SCPreferencesApplyChanges(prefs) != 0,
|
||||
"failed to apply bootpd preferences"
|
||||
);
|
||||
|
||||
Ok(())
|
||||
})();
|
||||
|
||||
let unlocked = SCPreferencesUnlock(prefs) != 0;
|
||||
result?;
|
||||
anyhow::ensure!(unlocked, "failed to unlock bootpd preferences");
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::Args;
|
||||
use clap::Parser;
|
||||
|
||||
#[test]
|
||||
fn test_cli_rejects_negative_vm_fd_before_startup() {
|
||||
let error = Args::try_parse_from([
|
||||
"softnet",
|
||||
"--vm-fd=-1",
|
||||
"--vm-mac-address=02:00:00:00:00:01",
|
||||
])
|
||||
.unwrap_err();
|
||||
|
||||
assert!(
|
||||
error
|
||||
.to_string()
|
||||
.contains("file descriptor must be non-negative")
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_cli_rejects_negative_control_fd_before_startup() {
|
||||
let error = Args::try_parse_from([
|
||||
"softnet",
|
||||
"--vm-fd=0",
|
||||
"--control-fd=-1",
|
||||
"--vm-mac-address=02:00:00:00:00:01",
|
||||
])
|
||||
.unwrap_err();
|
||||
|
||||
assert!(
|
||||
error
|
||||
.to_string()
|
||||
.contains("file descriptor must be non-negative")
|
||||
);
|
||||
SCPreferencesCommitChanges(prefs.as_concrete_TypeRef());
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue