1032 lines
35 KiB
Rust
1032 lines
35 KiB
Rust
//! The per-port bindings behind the `bridge hive_egress` anti-spoofing table
|
|
//! (`nix/host-modules/hive-egress.nix`), as three sub-commands run by systemd
|
|
//! units and by dnsmasq, never through the socket.
|
|
//!
|
|
//! - `egress-load <ruleset-file>` replaces the tables with the ruleset, the
|
|
//! current bindings and the leases of dnsmasq's lease file, in one nft
|
|
//! transaction. The bindings are looked up first, while the old tables still
|
|
//! filter. A lease load that fails is a warning; the ruleset then loads with
|
|
//! the bindings alone.
|
|
//! - `egress-pin [<port>]` binds each port of the agent bridge to the MAC its
|
|
//! container uses. A port nobody owns stays unbound, and the table drops
|
|
//! everything it sends. With `<port>` the command first waits for that port
|
|
//! to be bound or to vanish. udev runs it per new port, a timer for the ports
|
|
//! still unbound.
|
|
//! - `egress-lease <action> [<mac> <ip> [<host>]]` is dnsmasq's `dhcp-script`:
|
|
//! it keeps the table's set of leased MAC and IPv4 pairs in step.
|
|
//!
|
|
//! A port's owner is found from the host side: the port's peer index is the
|
|
//! index of one link in a registered container's network namespace (the leader
|
|
//! comes from `/run/systemd/machines`), and that link's peer index is the port's
|
|
//! own index. A veth pair the container makes inside its namespace can't claim
|
|
//! another port.
|
|
//!
|
|
//! The bound MAC is the one the link has when the port is first looked at. The
|
|
//! binding stays for as long as the port exists (`/run/hive-egress-pins`), and
|
|
//! a kept binding is never given up: a port that claims a MAC a kept binding
|
|
//! holds, or that another new claim shares, stays unbound and is looked at
|
|
//! again on the next pass.
|
|
|
|
use std::fmt::Write as _;
|
|
use std::fs::{File, OpenOptions};
|
|
use std::io::Write as _;
|
|
use std::path::Path;
|
|
use std::process::{Command, Stdio};
|
|
use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
|
|
|
|
use anyhow::{Context as _, Result, bail};
|
|
|
|
/// The sub-command that binds ports.
|
|
pub(crate) const PIN: &str = "egress-pin";
|
|
|
|
/// The sub-command dnsmasq's `dhcp-script` runs.
|
|
pub(crate) const LEASE: &str = "egress-lease";
|
|
|
|
/// The sub-command that loads the tables.
|
|
pub(crate) const LOAD: &str = "egress-load";
|
|
|
|
/// The bridge the table guards, set by the unit that runs the command.
|
|
const BRIDGE_ENV: &str = "HIVE_EGRESS_BRIDGE";
|
|
|
|
/// Where systemd-machined keeps one file per registered machine.
|
|
const MACHINES_DIR: &str = "/run/systemd/machines";
|
|
|
|
/// dnsmasq's lease file, when `HIVE_EGRESS_LEASEFILE` does not name another.
|
|
const LEASEFILE: &str = "/var/lib/dnsmasq/dnsmasq.leases";
|
|
|
|
/// How long `egress-pin <port>` waits for a registered container to own the
|
|
/// port: machined learns of the machine after the veth pair exists.
|
|
const WAIT: Duration = Duration::from_secs(30);
|
|
|
|
/// The pause between two looks while waiting.
|
|
const POLL: Duration = Duration::from_millis(250);
|
|
|
|
/// A lease timeout when dnsmasq names no remaining time.
|
|
const DEFAULT_LEASE_SECS: u64 = 3600;
|
|
|
|
/// Where the bindings are kept between passes, when `HIVE_EGRESS_STATE` names
|
|
/// no other file. It is on tmpfs: a reboot starts every port afresh.
|
|
const STATE: &str = "/run/hive-egress-pins";
|
|
|
|
/// The lock that makes one pass at a time read and replace the bindings, when
|
|
/// `HIVE_EGRESS_LOCK` names no other file.
|
|
const LOCK: &str = "/run/lock/hive-egress-pin.lock";
|
|
|
|
/// The nft table the commands write into.
|
|
const TABLE: &str = "bridge hive_egress";
|
|
|
|
/// An Ethernet address.
|
|
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
|
|
pub(crate) struct Mac([u8; 6]);
|
|
|
|
impl Mac {
|
|
/// Parse `aa:bb:cc:dd:ee:ff`, either case.
|
|
pub(crate) fn parse(text: &str) -> Option<Self> {
|
|
let mut bytes = [0_u8; 6];
|
|
let mut parts = text.split(':');
|
|
for byte in &mut bytes {
|
|
let part = parts.next()?;
|
|
if part.len() != 2 {
|
|
return None;
|
|
}
|
|
*byte = u8::from_str_radix(part, 16).ok()?;
|
|
}
|
|
parts.next().is_none().then_some(Self(bytes))
|
|
}
|
|
|
|
/// A unicast address that is not all zero: the only kind a port may use.
|
|
fn is_usable(self) -> bool {
|
|
self.0[0] & 1 == 0 && self.0 != [0; 6]
|
|
}
|
|
|
|
/// `0x…` with twelve digits: how the table's `chaddr` set spells the
|
|
/// address, as the 48 bits it compares in the DHCP payload.
|
|
fn as_integer(self) -> String {
|
|
let mut text = String::from("0x");
|
|
for byte in self.0 {
|
|
let _ = write!(text, "{byte:02x}");
|
|
}
|
|
text
|
|
}
|
|
}
|
|
|
|
impl std::fmt::Display for Mac {
|
|
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
|
let b = self.0;
|
|
write!(
|
|
f,
|
|
"{:02x}:{:02x}:{:02x}:{:02x}:{:02x}:{:02x}",
|
|
b[0], b[1], b[2], b[3], b[4], b[5]
|
|
)
|
|
}
|
|
}
|
|
|
|
/// A port of the agent bridge, as the host sees it.
|
|
#[derive(Clone, Debug, PartialEq, Eq)]
|
|
pub(crate) struct HostPort {
|
|
pub(crate) name: String,
|
|
pub(crate) ifindex: u64,
|
|
/// The index of the other end of the veth pair, in its own namespace.
|
|
pub(crate) peer_index: u64,
|
|
}
|
|
|
|
/// A link in a container's network namespace.
|
|
#[derive(Clone, Debug, PartialEq, Eq)]
|
|
pub(crate) struct NsLink {
|
|
pub(crate) ifindex: u64,
|
|
pub(crate) peer_index: Option<u64>,
|
|
pub(crate) mac: Mac,
|
|
}
|
|
|
|
/// A port bound to a MAC.
|
|
#[derive(Clone, Debug, PartialEq, Eq)]
|
|
pub(crate) struct Pin {
|
|
pub(crate) port: String,
|
|
/// The port's index when it was bound: a port made again under the same
|
|
/// name has another.
|
|
pub(crate) ifindex: u64,
|
|
pub(crate) mac: Mac,
|
|
/// The machine that owned the port when it was bound.
|
|
pub(crate) machine: String,
|
|
}
|
|
|
|
/// What [`resolve`] decided about the ports.
|
|
#[derive(Debug, Default, PartialEq, Eq)]
|
|
pub(crate) struct Resolution {
|
|
pub(crate) pins: Vec<Pin>,
|
|
/// Port name and why it stays unbound.
|
|
pub(crate) unbound: Vec<(String, String)>,
|
|
}
|
|
|
|
/// Bind each port to the MAC of the link at the other end of its veth pair.
|
|
///
|
|
/// `machines` holds each registered container's links. `earlier` holds the
|
|
/// bindings of a previous pass: a port that has the same name and index keeps
|
|
/// its binding whatever its link says now, and no other port takes its MAC. A
|
|
/// kept binding is never given up, so a port can only get a binding for a MAC
|
|
/// nobody holds. A port no machine owns, an unusable MAC, a MAC a kept binding
|
|
/// holds and a MAC two new claims share all leave the port unbound.
|
|
pub(crate) fn resolve(
|
|
ports: &[HostPort],
|
|
machines: &[(String, Vec<NsLink>)],
|
|
earlier: &[Pin],
|
|
) -> Resolution {
|
|
let mut kept: Vec<Pin> = Vec::new();
|
|
let mut claims: Vec<Pin> = Vec::new();
|
|
let mut out = Resolution::default();
|
|
for port in ports {
|
|
if let Some(pin) = earlier
|
|
.iter()
|
|
.find(|p| p.port == port.name && p.ifindex == port.ifindex)
|
|
{
|
|
kept.push(pin.clone());
|
|
continue;
|
|
}
|
|
let owner = machines.iter().find_map(|(machine, links)| {
|
|
links
|
|
.iter()
|
|
.find(|l| l.ifindex == port.peer_index && l.peer_index == Some(port.ifindex))
|
|
.map(|l| (machine.as_str(), l.mac))
|
|
});
|
|
match owner {
|
|
None => out
|
|
.unbound
|
|
.push((port.name.clone(), "no registered container owns it".into())),
|
|
Some((machine, mac)) if !mac.is_usable() => out.unbound.push((
|
|
port.name.clone(),
|
|
format!("{machine} has the unusable address {mac}"),
|
|
)),
|
|
Some((machine, mac)) => claims.push(Pin {
|
|
port: port.name.clone(),
|
|
ifindex: port.ifindex,
|
|
mac,
|
|
machine: machine.to_string(),
|
|
}),
|
|
}
|
|
}
|
|
for claim in &claims {
|
|
let holders: Vec<&str> = kept
|
|
.iter()
|
|
.chain(claims.iter())
|
|
.filter(|p| p.mac == claim.mac && p.port != claim.port)
|
|
.map(|p| p.port.as_str())
|
|
.collect();
|
|
if holders.is_empty() {
|
|
out.pins.push(claim.clone());
|
|
} else {
|
|
out.unbound.push((
|
|
claim.port.clone(),
|
|
format!(
|
|
"{} has {}, which {} also has",
|
|
claim.machine,
|
|
claim.mac,
|
|
holders.join(", ")
|
|
),
|
|
));
|
|
}
|
|
}
|
|
kept.append(&mut out.pins);
|
|
out.pins = kept;
|
|
out
|
|
}
|
|
|
|
/// The bindings as the state file spells them: `<port> <ifindex> <mac>
|
|
/// <machine>` per line.
|
|
pub(crate) fn state_text(pins: &[Pin]) -> String {
|
|
let mut text = String::new();
|
|
for p in pins {
|
|
let _ = writeln!(text, "{} {} {} {}", p.port, p.ifindex, p.mac, p.machine);
|
|
}
|
|
text
|
|
}
|
|
|
|
/// The bindings in a state file. A line that does not parse is left out.
|
|
pub(crate) fn parse_state(text: &str) -> Vec<Pin> {
|
|
text.lines()
|
|
.filter_map(|line| {
|
|
let mut cols = line.split_whitespace();
|
|
Some(Pin {
|
|
port: cols.next()?.to_string(),
|
|
ifindex: cols.next()?.parse().ok()?,
|
|
mac: Mac::parse(cols.next()?)?,
|
|
machine: cols.next()?.to_string(),
|
|
})
|
|
})
|
|
.collect()
|
|
}
|
|
|
|
/// Whether a name is safe to put into an nft script as a quoted string.
|
|
fn is_plain_name(name: &str) -> bool {
|
|
!name.is_empty()
|
|
&& name.len() < 16
|
|
&& name
|
|
.bytes()
|
|
.all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'_' | b'-'))
|
|
}
|
|
|
|
/// The nft input that adds the bindings `pins` to the two sets.
|
|
pub(crate) fn pin_elements(pins: &[Pin]) -> String {
|
|
let mut script = String::new();
|
|
for Pin { port, mac, .. } in pins {
|
|
let _ = writeln!(
|
|
script,
|
|
"add element {TABLE} port_mac {{ \"{port}\" . {mac} }}\n\
|
|
add element {TABLE} port_chaddr {{ \"{port}\" . {} }}",
|
|
mac.as_integer()
|
|
);
|
|
}
|
|
script
|
|
}
|
|
|
|
/// The nft input that makes the table's bindings exactly `pins`, in one
|
|
/// transaction: a reader never sees the sets empty in between.
|
|
pub(crate) fn pin_script(pins: &[Pin]) -> String {
|
|
format!(
|
|
"flush set {TABLE} port_mac\nflush set {TABLE} port_chaddr\n{}",
|
|
pin_elements(pins)
|
|
)
|
|
}
|
|
|
|
/// The nft input for one lease event, or `None` for an event that changes
|
|
/// nothing: `init`, an IPv6 address, an address or MAC that does not parse.
|
|
///
|
|
/// `add` and `old` replace the pair with one that times out after
|
|
/// `remaining_secs`; `del` removes it. The first `add element` makes the
|
|
/// `delete element` that follows succeed whether or not the pair was there.
|
|
pub(crate) fn lease_script(
|
|
action: &str,
|
|
mac: &str,
|
|
ip: &str,
|
|
remaining_secs: u64,
|
|
) -> Option<String> {
|
|
let mac = Mac::parse(mac)?;
|
|
let ip: std::net::Ipv4Addr = ip.parse().ok()?;
|
|
let set = format!("{TABLE} lease_v4");
|
|
let pair = format!("{mac} . {ip}");
|
|
match action {
|
|
"add" | "old" => Some(format!(
|
|
"add element {set} {{ {pair} }}\n\
|
|
delete element {set} {{ {pair} }}\n\
|
|
add element {set} {{ {pair} timeout {remaining_secs}s }}\n"
|
|
)),
|
|
"del" => Some(format!(
|
|
"add element {set} {{ {pair} }}\ndelete element {set} {{ {pair} }}\n"
|
|
)),
|
|
_ => None,
|
|
}
|
|
}
|
|
|
|
/// The nft input that loads the leases of a dnsmasq lease file that have not
|
|
/// run out at `now` (seconds since the epoch). A line is `<expiry> <mac> <ip>
|
|
/// <host> <client-id>`; expiry 0 is a lease without end.
|
|
pub(crate) fn seed_script(leasefile: &str, now: u64) -> String {
|
|
let mut script = String::new();
|
|
for line in leasefile.lines() {
|
|
let mut cols = line.split_whitespace();
|
|
let (Some(expiry), Some(mac), Some(ip)) = (cols.next(), cols.next(), cols.next()) else {
|
|
continue;
|
|
};
|
|
let Ok(expiry) = expiry.parse::<u64>() else {
|
|
continue;
|
|
};
|
|
let remaining = if expiry == 0 {
|
|
DEFAULT_LEASE_SECS
|
|
} else if expiry > now {
|
|
expiry - now
|
|
} else {
|
|
continue;
|
|
};
|
|
if let Some(text) = lease_script("add", mac, ip, remaining) {
|
|
script.push_str(&text);
|
|
}
|
|
}
|
|
script
|
|
}
|
|
|
|
/// The links of one `ip -j link` listing.
|
|
pub(crate) fn parse_links(json: &str) -> Result<Vec<NsLink>> {
|
|
let value: serde_json::Value = serde_json::from_str(json).context("parse ip -j link")?;
|
|
let Some(items) = value.as_array() else {
|
|
bail!("ip -j link did not print a list");
|
|
};
|
|
Ok(items
|
|
.iter()
|
|
.filter_map(|item| {
|
|
Some(NsLink {
|
|
ifindex: item.get("ifindex")?.as_u64()?,
|
|
peer_index: item.get("link_index").and_then(serde_json::Value::as_u64),
|
|
mac: Mac::parse(item.get("address")?.as_str()?)?,
|
|
})
|
|
})
|
|
.collect())
|
|
}
|
|
|
|
/// The bridge's ports from `ip -j link show master <bridge>`. A port whose
|
|
/// name is not plain is left out: it never gets a binding.
|
|
pub(crate) fn parse_ports(json: &str) -> Result<Vec<HostPort>> {
|
|
let value: serde_json::Value = serde_json::from_str(json).context("parse ip -j link")?;
|
|
let Some(items) = value.as_array() else {
|
|
bail!("ip -j link did not print a list");
|
|
};
|
|
Ok(items
|
|
.iter()
|
|
.filter_map(|item| {
|
|
let name = item.get("ifname")?.as_str()?;
|
|
if !is_plain_name(name) {
|
|
return None;
|
|
}
|
|
Some(HostPort {
|
|
name: name.to_string(),
|
|
ifindex: item.get("ifindex")?.as_u64()?,
|
|
peer_index: item.get("link_index")?.as_u64()?,
|
|
})
|
|
})
|
|
.collect())
|
|
}
|
|
|
|
/// The leader of a machine's state file, or `None` when it is not a container.
|
|
pub(crate) fn container_leader(state: &str) -> Option<u32> {
|
|
let mut leader = None;
|
|
let mut container = false;
|
|
for line in state.lines() {
|
|
match line.split_once('=') {
|
|
Some(("CLASS", "container")) => container = true,
|
|
Some(("LEADER", pid)) => leader = pid.parse().ok(),
|
|
_ => {}
|
|
}
|
|
}
|
|
leader.filter(|_| container)
|
|
}
|
|
|
|
/// Run `program` with `args` and return its stdout.
|
|
fn output_of(program: &str, args: &[&str]) -> Result<String> {
|
|
let out = Command::new(program)
|
|
.args(args)
|
|
.output()
|
|
.with_context(|| format!("run {program}"))?;
|
|
if !out.status.success() {
|
|
bail!(
|
|
"{program} {} exited {}: {}",
|
|
args.join(" "),
|
|
out.status,
|
|
String::from_utf8_lossy(&out.stderr).trim()
|
|
);
|
|
}
|
|
Ok(String::from_utf8_lossy(&out.stdout).into_owned())
|
|
}
|
|
|
|
/// Feed `script` to `nft -f -`.
|
|
fn nft(script: &str) -> Result<()> {
|
|
let mut child = Command::new("nft")
|
|
.args(["-f", "-"])
|
|
.stdin(Stdio::piped())
|
|
.stderr(Stdio::piped())
|
|
.spawn()
|
|
.context("run nft")?;
|
|
child
|
|
.stdin
|
|
.take()
|
|
.context("nft stdin")?
|
|
.write_all(script.as_bytes())
|
|
.context("write to nft")?;
|
|
let out = child.wait_with_output().context("wait for nft")?;
|
|
if !out.status.success() {
|
|
bail!(
|
|
"nft exited {}: {}",
|
|
out.status,
|
|
String::from_utf8_lossy(&out.stderr).trim()
|
|
);
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
/// The links of every registered container, by machine name. A machine whose
|
|
/// namespace cannot be read is reported and skipped.
|
|
fn machine_links(dir: &Path) -> Vec<(String, Vec<NsLink>)> {
|
|
let Ok(entries) = std::fs::read_dir(dir) else {
|
|
return Vec::new();
|
|
};
|
|
let mut machines = Vec::new();
|
|
for entry in entries.flatten() {
|
|
let Some(name) = entry.file_name().to_str().map(str::to_string) else {
|
|
continue;
|
|
};
|
|
let Ok(state) = std::fs::read_to_string(entry.path()) else {
|
|
continue;
|
|
};
|
|
let Some(leader) = container_leader(&state) else {
|
|
continue;
|
|
};
|
|
let links = output_of(
|
|
"nsenter",
|
|
&[
|
|
"--target",
|
|
&leader.to_string(),
|
|
"--net",
|
|
"ip",
|
|
"-j",
|
|
"link",
|
|
"show",
|
|
],
|
|
)
|
|
.and_then(|json| parse_links(&json));
|
|
match links {
|
|
Ok(links) => machines.push((name, links)),
|
|
Err(e) => eprintln!("{PIN}: machine {name}: {e:#}"),
|
|
}
|
|
}
|
|
machines
|
|
}
|
|
|
|
/// The ports no kept binding covers: the ones a pass has to look up.
|
|
pub(crate) fn ports_to_resolve<'a>(ports: &'a [HostPort], earlier: &[Pin]) -> Vec<&'a HostPort> {
|
|
ports
|
|
.iter()
|
|
.filter(|p| {
|
|
!earlier
|
|
.iter()
|
|
.any(|k| k.port == p.name && k.ifindex == p.ifindex)
|
|
})
|
|
.collect()
|
|
}
|
|
|
|
/// What a pass found out.
|
|
struct Survey {
|
|
earlier: Vec<Pin>,
|
|
resolution: Resolution,
|
|
}
|
|
|
|
fn state_path() -> String {
|
|
std::env::var("HIVE_EGRESS_STATE").unwrap_or_else(|_| STATE.into())
|
|
}
|
|
|
|
/// Look at the bridge's ports, the earlier bindings and, when a port has none,
|
|
/// the containers. Changes nothing.
|
|
fn survey(bridge: &str) -> Result<Survey> {
|
|
let ports = parse_ports(&output_of("ip", &["-j", "link", "show", "master", bridge])?)?;
|
|
let earlier = parse_state(&std::fs::read_to_string(state_path()).unwrap_or_default());
|
|
let machines = if ports_to_resolve(&ports, &earlier).is_empty() {
|
|
Vec::new()
|
|
} else {
|
|
machine_links(Path::new(MACHINES_DIR))
|
|
};
|
|
let resolution = resolve(&ports, &machines, &earlier);
|
|
Ok(Survey {
|
|
earlier,
|
|
resolution,
|
|
})
|
|
}
|
|
|
|
/// Keep the bindings for the next pass and print the new ones.
|
|
fn commit(survey: &Survey) -> Result<()> {
|
|
let path = state_path();
|
|
std::fs::write(&path, state_text(&survey.resolution.pins))
|
|
.with_context(|| format!("write {path}"))?;
|
|
for pin in survey
|
|
.resolution
|
|
.pins
|
|
.iter()
|
|
.filter(|p| !survey.earlier.contains(p))
|
|
{
|
|
eprintln!("{PIN}: {} bound to {} ({})", pin.port, pin.mac, pin.machine);
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
/// Wait for the lock of the bindings. It is released when the file is dropped.
|
|
fn lock() -> Result<File> {
|
|
let path = std::env::var("HIVE_EGRESS_LOCK").unwrap_or_else(|_| LOCK.into());
|
|
let file = OpenOptions::new()
|
|
.write(true)
|
|
.create(true)
|
|
.truncate(false)
|
|
.open(&path)
|
|
.with_context(|| format!("open {path}"))?;
|
|
file.lock().with_context(|| format!("lock {path}"))?;
|
|
Ok(file)
|
|
}
|
|
|
|
fn now_secs() -> u64 {
|
|
SystemTime::now()
|
|
.duration_since(UNIX_EPOCH)
|
|
.map_or(0, |d| d.as_secs())
|
|
}
|
|
|
|
/// Whose "stays unbound" lines a pass prints.
|
|
#[derive(Clone, Copy)]
|
|
enum Report<'a> {
|
|
All,
|
|
Port(&'a str),
|
|
Nothing,
|
|
}
|
|
|
|
fn report(resolution: &Resolution, which: Report<'_>) {
|
|
for (name, why) in &resolution.unbound {
|
|
let show = match which {
|
|
Report::All => true,
|
|
Report::Port(port) => port == name,
|
|
Report::Nothing => false,
|
|
};
|
|
if show {
|
|
eprintln!("{PIN}: {name} stays unbound: {why}");
|
|
}
|
|
}
|
|
}
|
|
|
|
/// `egress-pin [<port>]`: one pass, or with `<port>` passes until that port is
|
|
/// bound or gone. Without `<port>` it prints only what it binds: the timer
|
|
/// runs it again and again for the ports still unbound.
|
|
fn pin(args: &[String]) -> Result<()> {
|
|
let bridge = std::env::var(BRIDGE_ENV).with_context(|| format!("{BRIDGE_ENV} is not set"))?;
|
|
let wait_for = match args {
|
|
[] => None,
|
|
[port] if is_plain_name(port) => Some(port.as_str()),
|
|
_ => bail!("usage: hive-priv {PIN} [<port>]"),
|
|
};
|
|
let deadline = Instant::now() + WAIT;
|
|
loop {
|
|
let survey = {
|
|
let _lock = lock()?;
|
|
let survey = survey(&bridge)?;
|
|
nft(&pin_script(&survey.resolution.pins))?;
|
|
commit(&survey)?;
|
|
survey
|
|
};
|
|
let Some(port) = wait_for else {
|
|
report(&survey.resolution, Report::Nothing);
|
|
return Ok(());
|
|
};
|
|
let bound = survey.resolution.pins.iter().any(|p| p.port == port);
|
|
let present = port_exists(port);
|
|
if bound || !present || Instant::now() >= deadline {
|
|
report(&survey.resolution, Report::Port(port));
|
|
if present && !bound {
|
|
bail!("port {port} stays unbound");
|
|
}
|
|
return Ok(());
|
|
}
|
|
std::thread::sleep(POLL);
|
|
}
|
|
}
|
|
|
|
/// Whether an interface of this name exists, on any bridge or none: a port is
|
|
/// created before it joins the bridge.
|
|
fn port_exists(name: &str) -> bool {
|
|
Command::new("ip")
|
|
.args(["link", "show", "dev", name])
|
|
.output()
|
|
.is_ok_and(|o| o.status.success())
|
|
}
|
|
|
|
/// Load `ruleset` with the bindings and the leases in the same transaction, so
|
|
/// no frame meets the new table with empty sets. A lease load that `run`
|
|
/// refuses is a warning: the ruleset loads again with the bindings alone.
|
|
pub(crate) fn load_ruleset(
|
|
ruleset: &str,
|
|
pins: &str,
|
|
leases: &str,
|
|
run: impl Fn(&str) -> Result<()>,
|
|
) -> Result<()> {
|
|
match run(&format!("{ruleset}\n{pins}{leases}")) {
|
|
Err(e) if !leases.is_empty() => {
|
|
eprintln!("{LOAD}: loading the leases failed, loading without them: {e:#}");
|
|
run(&format!("{ruleset}\n{pins}")).context("load the ruleset")
|
|
}
|
|
other => other,
|
|
}
|
|
}
|
|
|
|
/// `egress-load <ruleset-file>`: replace the tables with the ruleset and the
|
|
/// current bindings and leases. The bindings are looked up first, while the old
|
|
/// tables still filter. A lookup that fails loads the ruleset with none: the
|
|
/// ports stay unbound until the timer or udev binds them.
|
|
fn load(args: &[String]) -> Result<()> {
|
|
let bridge = std::env::var(BRIDGE_ENV).with_context(|| format!("{BRIDGE_ENV} is not set"))?;
|
|
let [file] = args else {
|
|
bail!("usage: hive-priv {LOAD} <ruleset-file>");
|
|
};
|
|
let ruleset = std::fs::read_to_string(file).with_context(|| format!("read {file}"))?;
|
|
let path = std::env::var("HIVE_EGRESS_LEASEFILE").unwrap_or_else(|_| LEASEFILE.into());
|
|
let leases = seed_script(
|
|
&std::fs::read_to_string(&path).unwrap_or_default(),
|
|
now_secs(),
|
|
);
|
|
let _lock = lock()?;
|
|
let found = survey(&bridge);
|
|
let pins = match &found {
|
|
Ok(found) => pin_elements(&found.resolution.pins),
|
|
Err(e) => {
|
|
eprintln!("{LOAD}: binding the ports failed, loading without bindings: {e:#}");
|
|
String::new()
|
|
}
|
|
};
|
|
load_ruleset(&ruleset, &pins, &leases, nft)?;
|
|
if let Ok(found) = &found {
|
|
commit(found)?;
|
|
report(&found.resolution, Report::All);
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
/// `egress-lease <action> [<mac> <ip> [<host>]]`. Nothing is loaded for an event
|
|
/// that changes no lease.
|
|
fn lease(args: &[String]) -> Result<()> {
|
|
let [action, mac, ip, ..] = args else {
|
|
return Ok(());
|
|
};
|
|
let remaining = std::env::var("DNSMASQ_TIME_REMAINING")
|
|
.ok()
|
|
.and_then(|v| v.parse().ok())
|
|
.unwrap_or(DEFAULT_LEASE_SECS);
|
|
match lease_script(action, mac, ip, remaining) {
|
|
Some(script) => nft(&script),
|
|
None => Ok(()),
|
|
}
|
|
}
|
|
|
|
/// Run `egress-pin` or `egress-lease` when `args` name one; `None` otherwise.
|
|
/// Returns the exit code.
|
|
pub(crate) fn run(args: &[String]) -> Option<i32> {
|
|
let (name, rest) = args.split_first()?;
|
|
let result = match name.as_str() {
|
|
PIN => pin(rest),
|
|
LOAD => load(rest),
|
|
LEASE => lease(rest),
|
|
_ => return None,
|
|
};
|
|
Some(match result {
|
|
Ok(()) => 0,
|
|
Err(e) => {
|
|
eprintln!("{name}: {e:#}");
|
|
1
|
|
}
|
|
})
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
fn mac(last: u8) -> Mac {
|
|
Mac([0x02, 0, 0, 0, 0, last])
|
|
}
|
|
|
|
fn port(name: &str, ifindex: u64, peer_index: u64) -> HostPort {
|
|
HostPort {
|
|
name: name.into(),
|
|
ifindex,
|
|
peer_index,
|
|
}
|
|
}
|
|
|
|
fn pin(port: &str, ifindex: u64, last: u8, machine: &str) -> Pin {
|
|
Pin {
|
|
port: port.into(),
|
|
ifindex,
|
|
mac: mac(last),
|
|
machine: machine.into(),
|
|
}
|
|
}
|
|
|
|
fn link(ifindex: u64, peer_index: Option<u64>, m: Mac) -> NsLink {
|
|
NsLink {
|
|
ifindex,
|
|
peer_index,
|
|
mac: m,
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn mac_round_trip_and_rejects() {
|
|
assert_eq!(Mac::parse("02:00:00:00:00:0A"), Some(mac(10)));
|
|
assert_eq!(mac(10).to_string(), "02:00:00:00:00:0a");
|
|
assert_eq!(mac(10).as_integer(), "0x02000000000a");
|
|
for bad in [
|
|
"",
|
|
"02:00:00:00:00",
|
|
"02:00:00:00:00:0a:01",
|
|
"2:0:0:0:0:a",
|
|
"zz:00:00:00:00:00",
|
|
] {
|
|
assert_eq!(Mac::parse(bad), None, "{bad}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn a_port_is_bound_to_the_link_at_the_other_end_of_its_pair() {
|
|
let ports = [port("vb-a", 10, 2), port("vb-b", 11, 2)];
|
|
let machines = [
|
|
("a".to_string(), vec![link(2, Some(10), mac(1))]),
|
|
("b".to_string(), vec![link(2, Some(11), mac(2))]),
|
|
];
|
|
let got = resolve(&ports, &machines, &[]);
|
|
assert_eq!(
|
|
got.pins,
|
|
vec![pin("vb-a", 10, 1, "a"), pin("vb-b", 11, 2, "b")]
|
|
);
|
|
assert!(got.unbound.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn a_link_a_container_made_in_its_own_namespace_claims_nothing() {
|
|
// The container `evil` makes a veth pair whose peer index is 10, the
|
|
// index of `vb-a` on the host; its link's own index is not the one
|
|
// `vb-a` points at, so it does not match.
|
|
let ports = [port("vb-a", 10, 2)];
|
|
let machines = [(
|
|
"evil".to_string(),
|
|
vec![link(7, Some(10), mac(9)), link(3, Some(11), mac(1))],
|
|
)];
|
|
let got = resolve(&ports, &machines, &[]);
|
|
assert!(got.pins.is_empty());
|
|
assert_eq!(got.unbound.len(), 1);
|
|
}
|
|
|
|
#[test]
|
|
fn a_bound_port_keeps_its_mac_when_the_link_changes() {
|
|
let ports = [port("vb-a", 10, 2)];
|
|
let earlier = [pin("vb-a", 10, 1, "a")];
|
|
let changed = [("a".to_string(), vec![link(2, Some(10), mac(9))])];
|
|
let kept = resolve(&ports, &changed, &earlier);
|
|
assert_eq!(kept.pins, earlier);
|
|
// The same name with another index is a new port: it is read again.
|
|
let remade = resolve(
|
|
&[port("vb-a", 12, 2)],
|
|
&[("a".to_string(), vec![link(2, Some(12), mac(9))])],
|
|
&earlier,
|
|
);
|
|
assert_eq!(remade.pins, vec![pin("vb-a", 12, 9, "a")]);
|
|
}
|
|
|
|
#[test]
|
|
fn the_state_file_round_trips() {
|
|
let pins = vec![pin("vb-a", 10, 1, "a"), pin("vb-b", 11, 2, "b")];
|
|
assert_eq!(parse_state(&state_text(&pins)), pins);
|
|
assert_eq!(parse_state("junk\nvb-a x 02:00:00:00:00:01 a\n"), vec![]);
|
|
}
|
|
|
|
#[test]
|
|
fn a_port_nobody_owns_stays_unbound() {
|
|
let got = resolve(&[port("vb-a", 10, 2)], &[], &[]);
|
|
assert!(got.pins.is_empty());
|
|
assert_eq!(got.unbound[0].0, "vb-a");
|
|
}
|
|
|
|
#[test]
|
|
fn a_mac_two_ports_have_binds_neither() {
|
|
let ports = [
|
|
port("vb-a", 10, 2),
|
|
port("vb-b", 11, 2),
|
|
port("vb-c", 12, 2),
|
|
];
|
|
let machines = [
|
|
("a".to_string(), vec![link(2, Some(10), mac(1))]),
|
|
("b".to_string(), vec![link(2, Some(11), mac(1))]),
|
|
("c".to_string(), vec![link(2, Some(12), mac(3))]),
|
|
];
|
|
let got = resolve(&ports, &machines, &[]);
|
|
assert_eq!(got.pins, vec![pin("vb-c", 12, 3, "c")]);
|
|
assert_eq!(got.unbound.len(), 2);
|
|
}
|
|
|
|
#[test]
|
|
fn a_multicast_or_zero_mac_is_not_bound() {
|
|
let ports = [port("vb-a", 10, 2), port("vb-b", 11, 2)];
|
|
let machines = [
|
|
("a".to_string(), vec![link(2, Some(10), Mac([0xff; 6]))]),
|
|
("b".to_string(), vec![link(2, Some(11), Mac([0; 6]))]),
|
|
];
|
|
assert!(resolve(&ports, &machines, &[]).pins.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn a_kept_binding_is_never_given_up_to_a_new_claim_on_its_mac() {
|
|
let ports = [port("vb-a", 10, 2), port("vb-b", 11, 2)];
|
|
let earlier = [pin("vb-a", 10, 1, "a")];
|
|
let machines = [
|
|
("a".to_string(), vec![link(2, Some(10), mac(1))]),
|
|
("b".to_string(), vec![link(2, Some(11), mac(1))]),
|
|
];
|
|
let got = resolve(&ports, &machines, &earlier);
|
|
assert_eq!(got.pins, vec![pin("vb-a", 10, 1, "a")]);
|
|
assert_eq!(got.unbound.len(), 1);
|
|
assert_eq!(got.unbound[0].0, "vb-b");
|
|
}
|
|
|
|
#[test]
|
|
fn a_new_claim_on_a_free_mac_binds_next_to_a_kept_binding() {
|
|
let ports = [port("vb-a", 10, 2), port("vb-b", 11, 2)];
|
|
let earlier = [pin("vb-a", 10, 1, "a")];
|
|
let machines = [("b".to_string(), vec![link(2, Some(11), mac(2))])];
|
|
let got = resolve(&ports, &machines, &earlier);
|
|
assert_eq!(
|
|
got.pins,
|
|
vec![pin("vb-a", 10, 1, "a"), pin("vb-b", 11, 2, "b")]
|
|
);
|
|
assert!(got.unbound.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn a_port_refused_for_a_taken_mac_binds_on_a_later_pass_once_it_has_its_own() {
|
|
let ports = [port("vb-a", 10, 2), port("vb-b", 11, 2)];
|
|
let earlier = [pin("vb-a", 10, 1, "a")];
|
|
let rival = [("b".to_string(), vec![link(2, Some(11), mac(1))])];
|
|
assert!(resolve(&ports, &rival, &earlier).pins.len() == 1);
|
|
// The rival restores its own MAC; the next pass reads its link again.
|
|
let restored = [("b".to_string(), vec![link(2, Some(11), mac(2))])];
|
|
let got = resolve(&ports, &restored, &earlier);
|
|
assert_eq!(
|
|
got.pins,
|
|
vec![pin("vb-a", 10, 1, "a"), pin("vb-b", 11, 2, "b")]
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn only_ports_without_a_kept_binding_are_looked_up() {
|
|
let ports = [port("vb-a", 10, 2), port("vb-b", 11, 2)];
|
|
let a = pin("vb-a", 10, 1, "a");
|
|
assert_eq!(ports_to_resolve(&ports, &[]).len(), 2);
|
|
assert_eq!(
|
|
ports_to_resolve(&ports, std::slice::from_ref(&a))[0].name,
|
|
"vb-b"
|
|
);
|
|
let b = pin("vb-b", 11, 2, "b");
|
|
assert!(ports_to_resolve(&ports, &[a, b]).is_empty());
|
|
// The same name with another index is a new port.
|
|
assert_eq!(
|
|
ports_to_resolve(&[port("vb-a", 12, 2)], &[pin("vb-a", 10, 1, "a")]).len(),
|
|
1
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn the_ruleset_loads_with_the_bindings_and_leases_in_one_script() {
|
|
let calls = std::cell::RefCell::new(Vec::new());
|
|
let pins = pin_elements(&[pin("vb-a", 10, 10, "a")]);
|
|
let leases = lease_script("add", "02:00:00:00:00:0a", "10.42.0.10", 90).unwrap();
|
|
load_ruleset("table bridge hive_egress { }", &pins, &leases, |s| {
|
|
calls.borrow_mut().push(s.to_string());
|
|
Ok(())
|
|
})
|
|
.unwrap();
|
|
let calls = calls.into_inner();
|
|
assert_eq!(calls.len(), 1, "one transaction");
|
|
let script = &calls[0];
|
|
assert!(script.starts_with("table bridge hive_egress { }"));
|
|
assert!(script.contains("port_mac { \"vb-a\" . 02:00:00:00:00:0a }"));
|
|
assert!(script.contains("lease_v4 { 02:00:00:00:00:0a . 10.42.0.10 timeout 90s }"));
|
|
assert!(!script.contains("flush set"), "the sets are new");
|
|
}
|
|
|
|
#[test]
|
|
fn a_lease_load_that_fails_is_a_warning_and_the_bindings_still_load() {
|
|
let calls = std::cell::RefCell::new(Vec::new());
|
|
let pins = pin_elements(&[pin("vb-a", 10, 10, "a")]);
|
|
let leases = lease_script("add", "02:00:00:00:00:0a", "10.42.0.10", 90).unwrap();
|
|
let result = load_ruleset("RULESET", &pins, &leases, |s| {
|
|
calls.borrow_mut().push(s.to_string());
|
|
if s.contains("lease_v4") {
|
|
anyhow::bail!("lease_v4 refused")
|
|
}
|
|
Ok(())
|
|
});
|
|
assert!(result.is_ok());
|
|
let calls = calls.into_inner();
|
|
assert_eq!(calls.len(), 2);
|
|
assert!(calls[1].contains("port_mac") && !calls[1].contains("lease_v4"));
|
|
}
|
|
|
|
#[test]
|
|
fn a_ruleset_that_fails_without_leases_is_an_error() {
|
|
let fails = |_: &str| -> Result<()> { anyhow::bail!("refused") };
|
|
assert!(load_ruleset("RULESET", "", "", fails).is_err());
|
|
assert!(load_ruleset("RULESET", "", "x", fails).is_err());
|
|
}
|
|
|
|
#[test]
|
|
fn pin_script_replaces_both_sets_in_one_script() {
|
|
let script = pin_script(&[pin("vb-a", 10, 10, "a")]);
|
|
assert_eq!(
|
|
script,
|
|
"flush set bridge hive_egress port_mac\n\
|
|
flush set bridge hive_egress port_chaddr\n\
|
|
add element bridge hive_egress port_mac { \"vb-a\" . 02:00:00:00:00:0a }\n\
|
|
add element bridge hive_egress port_chaddr { \"vb-a\" . 0x02000000000a }\n"
|
|
);
|
|
assert!(!pin_script(&[]).contains("add element"));
|
|
}
|
|
|
|
#[test]
|
|
fn lease_events_become_nft_input() {
|
|
let add = lease_script("add", "02:00:00:00:00:0a", "10.42.0.10", 90).unwrap();
|
|
assert!(add.ends_with("add element bridge hive_egress lease_v4 { 02:00:00:00:00:0a . 10.42.0.10 timeout 90s }\n"));
|
|
assert!(add.contains("delete element"));
|
|
assert_eq!(
|
|
lease_script("old", "02:00:00:00:00:0a", "10.42.0.10", 90),
|
|
Some(add)
|
|
);
|
|
let del = lease_script("del", "02:00:00:00:00:0a", "10.42.0.10", 90).unwrap();
|
|
assert!(del.contains("delete element") && !del.contains("timeout"));
|
|
assert_eq!(
|
|
lease_script("init", "02:00:00:00:00:0a", "10.42.0.10", 90),
|
|
None
|
|
);
|
|
assert_eq!(
|
|
lease_script("add", "02:00:00:00:00:0a", "fe80::1", 90),
|
|
None
|
|
);
|
|
assert_eq!(lease_script("add", "nonsense", "10.42.0.10", 90), None);
|
|
}
|
|
|
|
#[test]
|
|
fn seeding_skips_expired_and_malformed_leases() {
|
|
let leases = "2000 02:00:00:00:00:0a 10.42.0.10 a *\n\
|
|
900 02:00:00:00:00:0b 10.42.0.11 b *\n\
|
|
0 02:00:00:00:00:0c 10.42.0.12 c *\n\
|
|
garbage\n";
|
|
let script = seed_script(leases, 1000);
|
|
assert!(script.contains("02:00:00:00:00:0a . 10.42.0.10 timeout 1000s"));
|
|
assert!(!script.contains("10.42.0.11"));
|
|
assert!(script.contains("10.42.0.12 timeout 3600s"));
|
|
}
|
|
|
|
#[test]
|
|
fn ip_json_is_read_for_links_and_ports() {
|
|
let json = r#"[{"ifindex":1,"ifname":"lo","address":"00:00:00:00:00:00"},
|
|
{"ifindex":2,"link_index":10,"ifname":"eth0","address":"7a:38:b5:d1:ff:84","link_netnsid":0}]"#;
|
|
let links = parse_links(json).unwrap();
|
|
assert_eq!(links[1].ifindex, 2);
|
|
assert_eq!(links[1].peer_index, Some(10));
|
|
assert_eq!(links[0].peer_index, None);
|
|
let ports = parse_ports(
|
|
r#"[{"ifindex":10,"link_index":2,"ifname":"vb-a"},{"ifindex":11,"link_index":2,"ifname":"bad\"name"}]"#,
|
|
)
|
|
.unwrap();
|
|
assert_eq!(ports, vec![port("vb-a", 10, 2)]);
|
|
assert!(parse_links("{}").is_err());
|
|
}
|
|
|
|
#[test]
|
|
fn only_a_container_with_a_leader_is_read() {
|
|
assert_eq!(
|
|
container_leader("CLASS=container\nLEADER=1234\n"),
|
|
Some(1234)
|
|
);
|
|
assert_eq!(container_leader("CLASS=vm\nLEADER=1234\n"), None);
|
|
assert_eq!(container_leader("CLASS=container\n"), None);
|
|
}
|
|
|
|
#[test]
|
|
fn plain_names_only() {
|
|
assert!(is_plain_name("vb-h-atlas"));
|
|
for bad in ["", "a b", "a\"b", "0123456789abcdef"] {
|
|
assert!(!is_plain_name(bad), "{bad:?}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn other_sub_commands_are_not_ours() {
|
|
assert_eq!(run(&["check-rootfs".into()]), None);
|
|
assert_eq!(run(&[]), None);
|
|
}
|
|
}
|