985 lines
34 KiB
Rust
985 lines
34 KiB
Rust
//! Native Linux Netlink and kernel networking execution plane.
|
|
//!
|
|
//! Provides genuine Linux kernel networking operations through RTNETLINK:
|
|
//! - Interface lifecycle (list, get, up, down)
|
|
//! - IPv4 & IPv6 Address management (list, add, delete)
|
|
//! - IPv4 & IPv6 Route management (list, add, delete, deterministic reconciliation)
|
|
//! - IP forwarding status and mutation via procfs
|
|
//! - Dedicated nftables ruleset generation and caching
|
|
//!
|
|
//! Zero subprocesses or shell commands are invoked.
|
|
|
|
use crate::engine::NetworkEngine;
|
|
use crate::error::{NetworkError, Result};
|
|
use crate::forwarding::IpForwardingStatus;
|
|
use crate::nftables::NftablesRulesetBuilder;
|
|
use futures::stream::TryStreamExt;
|
|
use ipnet::IpNet;
|
|
use netlink_packet_route::AddressFamily;
|
|
use netlink_packet_route::address::AddressAttribute;
|
|
use netlink_packet_route::link::{LinkAttribute, LinkFlags};
|
|
use netlink_packet_route::route::{RouteAddress, RouteAttribute, RouteMessage};
|
|
use nx9_wg_core::types::firewall::FirewallRule;
|
|
use nx9_wg_core::types::network::Route;
|
|
use rtnetlink::{Handle, LinkUnspec, RouteMessageBuilder, new_connection};
|
|
use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
|
|
use std::sync::Arc;
|
|
use tokio::sync::RwLock;
|
|
|
|
/// Summary information for a network interface discovered via RTNETLINK.
|
|
#[derive(Debug, Clone, PartialEq, Eq)]
|
|
pub struct InterfaceInfo {
|
|
pub index: u32,
|
|
pub name: String,
|
|
pub is_up: bool,
|
|
pub mtu: Option<u32>,
|
|
pub oper_state: Option<String>,
|
|
}
|
|
|
|
/// Address record attached to an interface discovered via RTNETLINK.
|
|
#[derive(Debug, Clone, PartialEq, Eq)]
|
|
pub struct AddressInfo {
|
|
pub index: u32,
|
|
pub address: IpAddr,
|
|
pub prefix_len: u8,
|
|
}
|
|
|
|
/// Routing table entry discovered via RTNETLINK.
|
|
#[derive(Debug, Clone, PartialEq, Eq)]
|
|
pub struct RouteInfo {
|
|
pub destination: IpNet,
|
|
pub gateway: Option<IpAddr>,
|
|
pub oif: Option<u32>,
|
|
pub table: u32,
|
|
pub metric: Option<u32>,
|
|
}
|
|
|
|
/// Connect to RTNETLINK and spawn background event loop.
|
|
fn connect_rtnetlink() -> Result<(Handle, tokio::task::JoinHandle<()>)> {
|
|
let (conn, handle, _) = new_connection().map_err(|e| {
|
|
NetworkError::Netlink(format!("Failed to establish RTNETLINK connection: {e}"))
|
|
})?;
|
|
let join_handle = tokio::spawn(conn);
|
|
Ok((handle, join_handle))
|
|
}
|
|
|
|
/// List all network interfaces using RTNETLINK link dump.
|
|
pub async fn list_interfaces() -> Result<Vec<InterfaceInfo>> {
|
|
let (handle, _join) = connect_rtnetlink()?;
|
|
let mut links = handle.link().get().execute();
|
|
let mut results = Vec::new();
|
|
|
|
while let Some(msg) = links
|
|
.try_next()
|
|
.await
|
|
.map_err(|e| NetworkError::Netlink(format!("RTNETLINK link dump failed: {e}")))?
|
|
{
|
|
let index = msg.header.index;
|
|
let is_up = msg.header.flags.contains(LinkFlags::Up);
|
|
let mut name = String::new();
|
|
let mut mtu = None;
|
|
let mut oper_state = None;
|
|
|
|
for attr in msg.attributes {
|
|
match attr {
|
|
LinkAttribute::IfName(n) => name = n,
|
|
LinkAttribute::Mtu(m) => mtu = Some(m),
|
|
LinkAttribute::OperState(s) => oper_state = Some(format!("{s:?}")),
|
|
_ => {}
|
|
}
|
|
}
|
|
|
|
if !name.is_empty() {
|
|
results.push(InterfaceInfo {
|
|
index,
|
|
name,
|
|
is_up,
|
|
mtu,
|
|
oper_state,
|
|
});
|
|
}
|
|
}
|
|
|
|
Ok(results)
|
|
}
|
|
|
|
/// Query a single interface by name using RTNETLINK.
|
|
pub async fn get_interface(name: &str) -> Result<InterfaceInfo> {
|
|
let (handle, _join) = connect_rtnetlink()?;
|
|
let mut links = handle.link().get().match_name(name.to_string()).execute();
|
|
|
|
while let Some(msg) = links.try_next().await.map_err(|e| {
|
|
NetworkError::Netlink(format!("RTNETLINK get link failed for '{name}': {e}"))
|
|
})? {
|
|
let index = msg.header.index;
|
|
let is_up = msg.header.flags.contains(LinkFlags::Up);
|
|
let mut if_name = String::new();
|
|
let mut mtu = None;
|
|
let mut oper_state = None;
|
|
|
|
for attr in msg.attributes {
|
|
match attr {
|
|
LinkAttribute::IfName(n) => if_name = n,
|
|
LinkAttribute::Mtu(m) => mtu = Some(m),
|
|
LinkAttribute::OperState(s) => oper_state = Some(format!("{s:?}")),
|
|
_ => {}
|
|
}
|
|
}
|
|
|
|
if if_name == name {
|
|
return Ok(InterfaceInfo {
|
|
index,
|
|
name: if_name,
|
|
is_up,
|
|
mtu,
|
|
oper_state,
|
|
});
|
|
}
|
|
}
|
|
|
|
Err(NetworkError::InterfaceNotFound(name.to_string()))
|
|
}
|
|
|
|
/// Bring an interface UP using RTNETLINK.
|
|
pub async fn interface_up(name: &str) -> Result<()> {
|
|
let iface = get_interface(name).await?;
|
|
let (handle, _join) = connect_rtnetlink()?;
|
|
let msg = LinkUnspec::new_with_index(iface.index).up().build();
|
|
handle.link().change(msg).execute().await.map_err(|e| {
|
|
NetworkError::Netlink(format!("Failed to bring interface '{name}' UP: {e}"))
|
|
})?;
|
|
tracing::info!(interface = name, "Interface brought UP via RTNETLINK");
|
|
Ok(())
|
|
}
|
|
|
|
/// Bring an interface DOWN using RTNETLINK.
|
|
pub async fn interface_down(name: &str) -> Result<()> {
|
|
let iface = get_interface(name).await?;
|
|
let (handle, _join) = connect_rtnetlink()?;
|
|
let msg = LinkUnspec::new_with_index(iface.index).down().build();
|
|
handle.link().change(msg).execute().await.map_err(|e| {
|
|
NetworkError::Netlink(format!("Failed to bring interface '{name}' DOWN: {e}"))
|
|
})?;
|
|
tracing::info!(interface = name, "Interface brought DOWN via RTNETLINK");
|
|
Ok(())
|
|
}
|
|
|
|
/// List all IP addresses on all interfaces using RTNETLINK.
|
|
pub async fn list_addresses() -> Result<Vec<AddressInfo>> {
|
|
let (handle, _join) = connect_rtnetlink()?;
|
|
let mut addrs = handle.address().get().execute();
|
|
let mut results = Vec::new();
|
|
|
|
while let Some(msg) = addrs
|
|
.try_next()
|
|
.await
|
|
.map_err(|e| NetworkError::Netlink(format!("RTNETLINK address dump failed: {e}")))?
|
|
{
|
|
let index = msg.header.index;
|
|
let prefix_len = msg.header.prefix_len;
|
|
|
|
for attr in msg.attributes {
|
|
if let AddressAttribute::Address(ip) = attr {
|
|
results.push(AddressInfo {
|
|
index,
|
|
address: ip,
|
|
prefix_len,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
Ok(results)
|
|
}
|
|
|
|
/// List IP addresses associated with a specific interface index.
|
|
pub async fn get_addresses_for_interface(index: u32) -> Result<Vec<AddressInfo>> {
|
|
let all = list_addresses().await?;
|
|
Ok(all.into_iter().filter(|a| a.index == index).collect())
|
|
}
|
|
|
|
/// Add an IP address to an interface using RTNETLINK.
|
|
pub async fn add_address(interface_name: &str, ip: IpNet) -> Result<()> {
|
|
let iface = get_interface(interface_name).await?;
|
|
let existing = get_addresses_for_interface(iface.index).await?;
|
|
|
|
// Idempotency: skip if exact address/prefix already exists on interface
|
|
if existing
|
|
.iter()
|
|
.any(|a| a.address == ip.addr() && a.prefix_len == ip.prefix_len())
|
|
{
|
|
tracing::debug!(
|
|
interface = interface_name,
|
|
address = %ip,
|
|
"Address already assigned to interface; skipping addition"
|
|
);
|
|
return Ok(());
|
|
}
|
|
|
|
let (handle, _join) = connect_rtnetlink()?;
|
|
handle
|
|
.address()
|
|
.add(iface.index, ip.addr(), ip.prefix_len())
|
|
.execute()
|
|
.await
|
|
.map_err(|e| {
|
|
NetworkError::Netlink(format!(
|
|
"Failed to add address '{ip}' to interface '{interface_name}': {e}"
|
|
))
|
|
})?;
|
|
|
|
tracing::info!(interface = interface_name, address = %ip, "Address added via RTNETLINK");
|
|
Ok(())
|
|
}
|
|
|
|
/// Delete an IP address from an interface using RTNETLINK.
|
|
pub async fn delete_address(interface_name: &str, ip: IpNet) -> Result<()> {
|
|
let iface = get_interface(interface_name).await?;
|
|
let (handle, _join) = connect_rtnetlink()?;
|
|
let mut addrs = handle.address().get().execute();
|
|
|
|
while let Some(msg) = addrs
|
|
.try_next()
|
|
.await
|
|
.map_err(|e| NetworkError::Netlink(format!("RTNETLINK address query failed: {e}")))?
|
|
{
|
|
if msg.header.index != iface.index || msg.header.prefix_len != ip.prefix_len() {
|
|
continue;
|
|
}
|
|
|
|
let has_matching_addr = msg.attributes.iter().any(|attr| match attr {
|
|
AddressAttribute::Address(a) | AddressAttribute::Local(a) => *a == ip.addr(),
|
|
_ => false,
|
|
});
|
|
|
|
if has_matching_addr {
|
|
handle.address().del(msg).execute().await.map_err(|e| {
|
|
NetworkError::Netlink(format!(
|
|
"Failed to delete address '{ip}' from '{interface_name}': {e}"
|
|
))
|
|
})?;
|
|
tracing::info!(interface = interface_name, address = %ip, "Address deleted via RTNETLINK");
|
|
return Ok(());
|
|
}
|
|
}
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// List all IPv4 and IPv6 routes using RTNETLINK route dump.
|
|
pub async fn list_routes() -> Result<Vec<RouteInfo>> {
|
|
let (handle, _join) = connect_rtnetlink()?;
|
|
let mut results = Vec::new();
|
|
|
|
// 1. IPv4 Routes
|
|
let mut v4_req = RouteMessage::default();
|
|
v4_req.header.address_family = AddressFamily::Inet;
|
|
let mut v4_stream = handle.route().get(v4_req).execute();
|
|
while let Some(msg) = v4_stream
|
|
.try_next()
|
|
.await
|
|
.map_err(|e| NetworkError::Netlink(format!("RTNETLINK IPv4 route dump failed: {e}")))?
|
|
{
|
|
if let Some(r) = parse_route_message(&msg, AddressFamily::Inet) {
|
|
results.push(r);
|
|
}
|
|
}
|
|
|
|
// 2. IPv6 Routes
|
|
let mut v6_req = RouteMessage::default();
|
|
v6_req.header.address_family = AddressFamily::Inet6;
|
|
let mut v6_stream = handle.route().get(v6_req).execute();
|
|
while let Some(msg) = v6_stream
|
|
.try_next()
|
|
.await
|
|
.map_err(|e| NetworkError::Netlink(format!("RTNETLINK IPv6 route dump failed: {e}")))?
|
|
{
|
|
if let Some(r) = parse_route_message(&msg, AddressFamily::Inet6) {
|
|
results.push(r);
|
|
}
|
|
}
|
|
|
|
Ok(results)
|
|
}
|
|
|
|
/// Helper to parse a raw RTNETLINK `RouteMessage` into domain `RouteInfo`.
|
|
fn parse_route_message(msg: &RouteMessage, family: AddressFamily) -> Option<RouteInfo> {
|
|
let prefix_len = msg.header.destination_prefix_length;
|
|
let mut dest_ip = match family {
|
|
AddressFamily::Inet => IpAddr::V4(Ipv4Addr::UNSPECIFIED),
|
|
AddressFamily::Inet6 => IpAddr::V6(Ipv6Addr::UNSPECIFIED),
|
|
_ => return None,
|
|
};
|
|
let mut gateway = None;
|
|
let mut oif = None;
|
|
let mut metric = None;
|
|
let mut table = msg.header.table as u32;
|
|
|
|
for attr in &msg.attributes {
|
|
match attr {
|
|
RouteAttribute::Destination(RouteAddress::Inet(v4)) => dest_ip = IpAddr::V4(*v4),
|
|
RouteAttribute::Destination(RouteAddress::Inet6(v6)) => dest_ip = IpAddr::V6(*v6),
|
|
RouteAttribute::Gateway(RouteAddress::Inet(v4)) => gateway = Some(IpAddr::V4(*v4)),
|
|
RouteAttribute::Gateway(RouteAddress::Inet6(v6)) => gateway = Some(IpAddr::V6(*v6)),
|
|
RouteAttribute::Oif(idx) => oif = Some(*idx),
|
|
RouteAttribute::Priority(p) => metric = Some(*p),
|
|
RouteAttribute::Table(t) => table = *t,
|
|
_ => {}
|
|
}
|
|
}
|
|
|
|
let destination = match IpNet::new(dest_ip, prefix_len) {
|
|
Ok(net) => net,
|
|
Err(_) => return None,
|
|
};
|
|
|
|
Some(RouteInfo {
|
|
destination,
|
|
gateway,
|
|
oif,
|
|
table,
|
|
metric,
|
|
})
|
|
}
|
|
|
|
/// Add an IPv4 or IPv6 route to the kernel routing table via RTNETLINK.
|
|
pub async fn add_route(route: &Route) -> Result<()> {
|
|
let (handle, _join) = connect_rtnetlink()?;
|
|
let oif_index = if let Some(ref ifname) = route.interface_name {
|
|
match get_interface(ifname).await {
|
|
Ok(info) => Some(info.index),
|
|
Err(e) => {
|
|
tracing::warn!(
|
|
interface = ifname,
|
|
"Could not resolve interface for route: {e}"
|
|
);
|
|
None
|
|
}
|
|
}
|
|
} else {
|
|
None
|
|
};
|
|
|
|
match route.destination {
|
|
IpNet::V4(v4) => {
|
|
let mut builder = RouteMessageBuilder::<Ipv4Addr>::new();
|
|
builder = builder.destination_prefix(v4.addr(), v4.prefix_len());
|
|
|
|
if let Some(IpAddr::V4(gw)) = route.gateway {
|
|
builder = builder.gateway(gw);
|
|
}
|
|
if let Some(idx) = oif_index {
|
|
builder = builder.output_interface(idx);
|
|
}
|
|
if let Some(metric) = route.metric {
|
|
builder = builder.priority(metric);
|
|
}
|
|
|
|
let msg = builder.build();
|
|
if let Err(e) = handle.route().add(msg).execute().await {
|
|
// If route already exists (EEXIST), handle idempotently
|
|
let err_str = e.to_string();
|
|
if !err_str.contains("File exists") && !err_str.contains("17") {
|
|
return Err(NetworkError::Netlink(format!(
|
|
"Failed to add IPv4 route '{}': {e}",
|
|
route.destination
|
|
)));
|
|
}
|
|
}
|
|
}
|
|
IpNet::V6(v6) => {
|
|
let mut builder = RouteMessageBuilder::<Ipv6Addr>::new();
|
|
builder = builder.destination_prefix(v6.addr(), v6.prefix_len());
|
|
|
|
if let Some(IpAddr::V6(gw)) = route.gateway {
|
|
builder = builder.gateway(gw);
|
|
}
|
|
if let Some(idx) = oif_index {
|
|
builder = builder.output_interface(idx);
|
|
}
|
|
if let Some(metric) = route.metric {
|
|
builder = builder.priority(metric);
|
|
}
|
|
|
|
let msg = builder.build();
|
|
if let Err(e) = handle.route().add(msg).execute().await {
|
|
let err_str = e.to_string();
|
|
if !err_str.contains("File exists") && !err_str.contains("17") {
|
|
return Err(NetworkError::Netlink(format!(
|
|
"Failed to add IPv6 route '{}': {e}",
|
|
route.destination
|
|
)));
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
tracing::info!(
|
|
destination = %route.destination,
|
|
gateway = ?route.gateway,
|
|
interface = ?route.interface_name,
|
|
"Route added via RTNETLINK"
|
|
);
|
|
Ok(())
|
|
}
|
|
|
|
/// Delete a route from the kernel routing table via RTNETLINK.
|
|
pub async fn delete_route(route: &Route) -> Result<()> {
|
|
// Safety check: Never delete default routes unless explicitly verified as an nx9 managed route
|
|
let is_default =
|
|
route.destination.addr().is_unspecified() && route.destination.prefix_len() == 0;
|
|
if is_default && route.interface_name.is_none() {
|
|
return Err(NetworkError::Routing(
|
|
"Refusing to delete global default route without specific interface binding"
|
|
.to_string(),
|
|
));
|
|
}
|
|
|
|
let (handle, _join) = connect_rtnetlink()?;
|
|
let oif_index = if let Some(ref ifname) = route.interface_name {
|
|
get_interface(ifname).await.ok().map(|i| i.index)
|
|
} else {
|
|
None
|
|
};
|
|
|
|
let mut get_msg = RouteMessage::default();
|
|
get_msg.header.address_family = match route.destination {
|
|
IpNet::V4(_) => AddressFamily::Inet,
|
|
IpNet::V6(_) => AddressFamily::Inet6,
|
|
};
|
|
|
|
let mut stream = handle.route().get(get_msg).execute();
|
|
while let Some(msg) = stream
|
|
.try_next()
|
|
.await
|
|
.map_err(|e| NetworkError::Netlink(format!("RTNETLINK route query failed: {e}")))?
|
|
{
|
|
if msg.header.destination_prefix_length != route.destination.prefix_len() {
|
|
continue;
|
|
}
|
|
|
|
let mut dest_match = false;
|
|
let mut gw_match = route.gateway.is_none();
|
|
let mut oif_match = oif_index.is_none();
|
|
|
|
for attr in &msg.attributes {
|
|
match attr {
|
|
RouteAttribute::Destination(RouteAddress::Inet(v4))
|
|
if IpAddr::V4(*v4) == route.destination.addr() =>
|
|
{
|
|
dest_match = true;
|
|
}
|
|
RouteAttribute::Destination(RouteAddress::Inet6(v6))
|
|
if IpAddr::V6(*v6) == route.destination.addr() =>
|
|
{
|
|
dest_match = true;
|
|
}
|
|
RouteAttribute::Gateway(RouteAddress::Inet(v4))
|
|
if Some(IpAddr::V4(*v4)) == route.gateway =>
|
|
{
|
|
gw_match = true;
|
|
}
|
|
RouteAttribute::Gateway(RouteAddress::Inet6(v6))
|
|
if Some(IpAddr::V6(*v6)) == route.gateway =>
|
|
{
|
|
gw_match = true;
|
|
}
|
|
RouteAttribute::Oif(idx) if Some(*idx) == oif_index => {
|
|
oif_match = true;
|
|
}
|
|
_ => {}
|
|
}
|
|
}
|
|
|
|
// For default prefix /0, dest_match is true if destination is unspecified
|
|
if route.destination.prefix_len() == 0 {
|
|
dest_match = true;
|
|
}
|
|
|
|
if dest_match && gw_match && oif_match {
|
|
handle.route().del(msg).execute().await.map_err(|e| {
|
|
NetworkError::Netlink(format!(
|
|
"Failed to delete route '{}': {e}",
|
|
route.destination
|
|
))
|
|
})?;
|
|
tracing::info!(destination = %route.destination, "Route deleted via RTNETLINK");
|
|
return Ok(());
|
|
}
|
|
}
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// Real Native Linux Network Engine communicating directly with kernel RTNETLINK.
|
|
#[derive(Debug, Clone, Default)]
|
|
pub struct NativeLinuxNetworkEngine {
|
|
active_ruleset: Arc<RwLock<String>>,
|
|
}
|
|
|
|
impl NativeLinuxNetworkEngine {
|
|
/// Create a new NativeLinuxNetworkEngine instance.
|
|
pub fn new() -> Self {
|
|
Self {
|
|
active_ruleset: Arc::new(RwLock::new(String::new())),
|
|
}
|
|
}
|
|
|
|
/// Helper for inspecting network interfaces.
|
|
pub async fn list_interfaces(&self) -> Result<Vec<InterfaceInfo>> {
|
|
list_interfaces().await
|
|
}
|
|
|
|
/// Helper for inspecting a single interface.
|
|
pub async fn get_interface(&self, name: &str) -> Result<InterfaceInfo> {
|
|
get_interface(name).await
|
|
}
|
|
|
|
/// Helper for bringing an interface UP.
|
|
pub async fn interface_up(&self, name: &str) -> Result<()> {
|
|
interface_up(name).await
|
|
}
|
|
|
|
/// Helper for bringing an interface DOWN.
|
|
pub async fn interface_down(&self, name: &str) -> Result<()> {
|
|
interface_down(name).await
|
|
}
|
|
|
|
/// Helper for listing IP addresses.
|
|
pub async fn list_addresses(&self) -> Result<Vec<AddressInfo>> {
|
|
list_addresses().await
|
|
}
|
|
|
|
/// Helper for adding an IP address.
|
|
pub async fn add_address(&self, interface_name: &str, ip: IpNet) -> Result<()> {
|
|
add_address(interface_name, ip).await
|
|
}
|
|
|
|
/// Helper for deleting an IP address.
|
|
pub async fn delete_address(&self, interface_name: &str, ip: IpNet) -> Result<()> {
|
|
delete_address(interface_name, ip).await
|
|
}
|
|
|
|
/// Helper for listing live routes.
|
|
pub async fn list_routes(&self) -> Result<Vec<RouteInfo>> {
|
|
list_routes().await
|
|
}
|
|
|
|
/// Helper for setting IP forwarding.
|
|
pub async fn set_forwarding_status(&self, status: IpForwardingStatus) -> Result<()> {
|
|
IpForwardingStatus::set_ipv4(status.ipv4_enabled)?;
|
|
IpForwardingStatus::set_ipv6(status.ipv6_enabled)?;
|
|
Ok(())
|
|
}
|
|
}
|
|
|
|
// ============================================================================
|
|
// Native Linux nftables Execution Engine (In-Process Netlink via libnftables)
|
|
// ============================================================================
|
|
|
|
#[cfg(target_os = "linux")]
|
|
#[link(name = "nftables")]
|
|
unsafe extern "C" {
|
|
fn nft_ctx_new(flags: u32) -> *mut std::ffi::c_void;
|
|
fn nft_ctx_free(ctx: *mut std::ffi::c_void);
|
|
fn nft_ctx_buffer_output(ctx: *mut std::ffi::c_void) -> std::ffi::c_int;
|
|
fn nft_ctx_buffer_error(ctx: *mut std::ffi::c_void) -> std::ffi::c_int;
|
|
fn nft_ctx_get_output_buffer(ctx: *mut std::ffi::c_void) -> *const std::ffi::c_char;
|
|
fn nft_ctx_get_error_buffer(ctx: *mut std::ffi::c_void) -> *const std::ffi::c_char;
|
|
fn nft_run_cmd_from_buffer(
|
|
ctx: *mut std::ffi::c_void,
|
|
buf: *const std::ffi::c_char,
|
|
) -> std::ffi::c_int;
|
|
}
|
|
|
|
/// Safe RAII wrapper around `struct nft_ctx*`.
|
|
pub struct NftContext {
|
|
raw: *mut std::ffi::c_void,
|
|
}
|
|
|
|
unsafe impl Send for NftContext {}
|
|
unsafe impl Sync for NftContext {}
|
|
|
|
impl NftContext {
|
|
/// Create a new in-process nftables Netlink context with buffered I/O.
|
|
pub fn new() -> Result<Self> {
|
|
let raw = unsafe { nft_ctx_new(0) };
|
|
if raw.is_null() {
|
|
return Err(NetworkError::Nftables(
|
|
"Failed to allocate nftables context".to_string(),
|
|
));
|
|
}
|
|
unsafe {
|
|
nft_ctx_buffer_output(raw);
|
|
nft_ctx_buffer_error(raw);
|
|
}
|
|
Ok(Self { raw })
|
|
}
|
|
|
|
/// Execute a command buffer directly against the kernel via Netlink.
|
|
pub fn run_cmd(&mut self, cmd: &str) -> std::result::Result<String, (i32, String)> {
|
|
let c_cmd = std::ffi::CString::new(cmd)
|
|
.map_err(|e| (-1, format!("CString conversion failed: {e}")))?;
|
|
let rc = unsafe { nft_run_cmd_from_buffer(self.raw, c_cmd.as_ptr()) };
|
|
let output = unsafe {
|
|
let ptr = nft_ctx_get_output_buffer(self.raw);
|
|
if ptr.is_null() {
|
|
String::new()
|
|
} else {
|
|
std::ffi::CStr::from_ptr(ptr).to_string_lossy().into_owned()
|
|
}
|
|
};
|
|
let error = unsafe {
|
|
let ptr = nft_ctx_get_error_buffer(self.raw);
|
|
if ptr.is_null() {
|
|
String::new()
|
|
} else {
|
|
std::ffi::CStr::from_ptr(ptr).to_string_lossy().into_owned()
|
|
}
|
|
};
|
|
|
|
if rc == 0 {
|
|
Ok(output)
|
|
} else {
|
|
Err((rc, error))
|
|
}
|
|
}
|
|
}
|
|
|
|
impl Drop for NftContext {
|
|
fn drop(&mut self) {
|
|
if !self.raw.is_null() {
|
|
unsafe { nft_ctx_free(self.raw) };
|
|
self.raw = std::ptr::null_mut();
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Structured diagnostic telemetry for Linux nftables kernel state.
|
|
#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
|
|
pub struct FirewallDiagnostics {
|
|
pub table_exists: bool,
|
|
pub table_name: String,
|
|
pub family: String,
|
|
pub chain_count: usize,
|
|
pub chains: Vec<String>,
|
|
pub rule_count: usize,
|
|
pub nat_enabled: bool,
|
|
pub live_ruleset: Option<String>,
|
|
pub kernel_status: String,
|
|
}
|
|
|
|
/// Controller for the dedicated `nx9_wg` nftables table and chains in the Linux kernel.
|
|
#[derive(Debug, Clone, Default)]
|
|
pub struct NativeLinuxNftablesEngine;
|
|
|
|
impl NativeLinuxNftablesEngine {
|
|
/// Create a new native nftables engine instance.
|
|
pub fn new() -> Self {
|
|
Self
|
|
}
|
|
|
|
/// Check if the dedicated `table inet nx9_wg` exists in the kernel.
|
|
pub async fn table_exists(&self) -> Result<bool> {
|
|
let mut ctx = NftContext::new()?;
|
|
match ctx.run_cmd("list table inet nx9_wg") {
|
|
Ok(_) => Ok(true),
|
|
Err((_, err)) => {
|
|
if err.contains("No such file or directory") || err.contains("does not exist") {
|
|
Ok(false)
|
|
} else if err.contains("Permission denied")
|
|
|| err.contains("Operation not permitted")
|
|
{
|
|
Err(NetworkError::PermissionDenied(err))
|
|
} else {
|
|
Err(NetworkError::Nftables(err))
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Query the active `table inet nx9_wg` ruleset directly from the kernel.
|
|
pub async fn get_live_ruleset(&self) -> Result<String> {
|
|
let mut ctx = NftContext::new()?;
|
|
match ctx.run_cmd("list table inet nx9_wg") {
|
|
Ok(output) => Ok(output),
|
|
Err((_, err)) => {
|
|
if err.contains("No such file or directory") || err.contains("does not exist") {
|
|
Ok(String::new())
|
|
} else if err.contains("Permission denied")
|
|
|| err.contains("Operation not permitted")
|
|
{
|
|
Err(NetworkError::PermissionDenied(err))
|
|
} else {
|
|
Err(NetworkError::Nftables(err))
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Apply an atomic ruleset update to `table inet nx9_wg`.
|
|
///
|
|
/// # Safety and Ownership Invariant
|
|
/// Verifies that the ruleset ONLY modifies `table inet nx9_wg`.
|
|
/// Never flushes or deletes tables outside `nx9_wg`.
|
|
pub async fn apply_ruleset(&self, ruleset: &str) -> Result<()> {
|
|
// Enforce ownership: reject any ruleset targeting outside table inet nx9_wg
|
|
for line in ruleset.lines() {
|
|
let trimmed = line.trim();
|
|
if (trimmed.starts_with("table ")
|
|
|| trimmed.starts_with("flush table ")
|
|
|| trimmed.starts_with("delete table "))
|
|
&& !trimmed.contains("table inet nx9_wg")
|
|
{
|
|
return Err(NetworkError::FirewallOwnershipViolation(format!(
|
|
"Refusing to execute command outside 'table inet nx9_wg': {trimmed}"
|
|
)));
|
|
}
|
|
if trimmed == "flush ruleset" {
|
|
return Err(NetworkError::FirewallOwnershipViolation(
|
|
"Refusing to flush global nftables ruleset".to_string(),
|
|
));
|
|
}
|
|
}
|
|
|
|
// Construct atomic table replacement transaction
|
|
let atomic_tx = format!("table inet nx9_wg\ndelete table inet nx9_wg\n{ruleset}");
|
|
|
|
let mut ctx = NftContext::new()?;
|
|
match ctx.run_cmd(&atomic_tx) {
|
|
Ok(_) => {
|
|
tracing::info!("Atomic nftables ruleset applied for 'table inet nx9_wg'");
|
|
Ok(())
|
|
}
|
|
Err((rc, err)) => {
|
|
if err.contains("Permission denied") || err.contains("Operation not permitted") {
|
|
Err(NetworkError::PermissionDenied(format!(
|
|
"Insufficient privileges to modify kernel nftables (requires CAP_NET_ADMIN): {err}"
|
|
)))
|
|
} else {
|
|
Err(NetworkError::Nftables(format!(
|
|
"Failed to apply atomic nftables transaction (exit code {rc}): {err}"
|
|
)))
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Delete the dedicated `table inet nx9_wg` from the kernel.
|
|
pub async fn delete_table(&self) -> Result<()> {
|
|
let mut ctx = NftContext::new()?;
|
|
match ctx.run_cmd("delete table inet nx9_wg") {
|
|
Ok(_) => {
|
|
tracing::info!("Deleted 'table inet nx9_wg' from kernel");
|
|
Ok(())
|
|
}
|
|
Err((_, err)) => {
|
|
if err.contains("No such file or directory") || err.contains("does not exist") {
|
|
Ok(())
|
|
} else if err.contains("Permission denied")
|
|
|| err.contains("Operation not permitted")
|
|
{
|
|
Err(NetworkError::PermissionDenied(err))
|
|
} else {
|
|
Err(NetworkError::Nftables(err))
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Produce read-only diagnostic telemetry for firewall and NAT state.
|
|
pub async fn diagnose(
|
|
&self,
|
|
_desired_rules: &[FirewallRule],
|
|
desired_nat: bool,
|
|
) -> Result<FirewallDiagnostics> {
|
|
let mut ctx = NftContext::new()?;
|
|
match ctx.run_cmd("list table inet nx9_wg") {
|
|
Ok(live) => {
|
|
let chain_input = live.contains("chain input");
|
|
let chain_forward = live.contains("chain forward");
|
|
let chain_postrouting = live.contains("chain postrouting");
|
|
let mut chains = Vec::new();
|
|
if chain_input {
|
|
chains.push("input".to_string());
|
|
}
|
|
if chain_forward {
|
|
chains.push("forward".to_string());
|
|
}
|
|
if chain_postrouting {
|
|
chains.push("postrouting".to_string());
|
|
}
|
|
|
|
let rule_count = live
|
|
.lines()
|
|
.filter(|l| {
|
|
let t = l.trim();
|
|
!t.is_empty()
|
|
&& !t.starts_with('#')
|
|
&& !t.starts_with("table ")
|
|
&& !t.starts_with("chain ")
|
|
&& !t.starts_with('}')
|
|
&& !t.starts_with("type ")
|
|
})
|
|
.count();
|
|
|
|
let nat_enabled = live.contains("masquerade");
|
|
|
|
Ok(FirewallDiagnostics {
|
|
table_exists: true,
|
|
table_name: "nx9_wg".to_string(),
|
|
family: "inet".to_string(),
|
|
chain_count: chains.len(),
|
|
chains,
|
|
rule_count,
|
|
nat_enabled,
|
|
live_ruleset: Some(live),
|
|
kernel_status: "active".to_string(),
|
|
})
|
|
}
|
|
Err((_, err)) => {
|
|
let exists =
|
|
!err.contains("No such file or directory") && !err.contains("does not exist");
|
|
Ok(FirewallDiagnostics {
|
|
table_exists: exists,
|
|
table_name: "nx9_wg".to_string(),
|
|
family: "inet".to_string(),
|
|
chain_count: 0,
|
|
chains: Vec::new(),
|
|
rule_count: 0,
|
|
nat_enabled: desired_nat,
|
|
live_ruleset: None,
|
|
kernel_status: if exists { err } else { "not_found".to_string() },
|
|
})
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// ============================================================================
|
|
// NetworkEngine Trait Implementation
|
|
// ============================================================================
|
|
|
|
#[async_trait::async_trait]
|
|
impl NetworkEngine for NativeLinuxNetworkEngine {
|
|
/// Deterministically reconcile kernel routing table entries with desired routes.
|
|
///
|
|
/// Preserves unmanaged system routes and default gateways while synchronizing
|
|
/// nx9-wg desired routes.
|
|
async fn sync_routes(&self, routes: &[Route]) -> Result<()> {
|
|
let live_routes = list_routes().await.unwrap_or_default();
|
|
let enabled_routes: Vec<&Route> = routes.iter().filter(|r| r.enabled).collect();
|
|
let disabled_routes: Vec<&Route> = routes.iter().filter(|r| !r.enabled).collect();
|
|
|
|
// 1. Add or converge missing/changed enabled routes
|
|
for desired in &enabled_routes {
|
|
let matches_live = live_routes.iter().any(|live| {
|
|
live.destination == desired.destination
|
|
&& (desired.gateway.is_none() || live.gateway == desired.gateway)
|
|
});
|
|
|
|
if !matches_live && let Err(e) = add_route(desired).await {
|
|
tracing::warn!(error = %e, route = %desired.destination, "Kernel route addition skipped (unprivileged or missing CAP_NET_ADMIN)");
|
|
}
|
|
}
|
|
|
|
// 2. Remove explicitly disabled routes that are present in the kernel
|
|
for disabled in &disabled_routes {
|
|
let matches_live = live_routes.iter().any(|live| {
|
|
live.destination == disabled.destination
|
|
&& (disabled.gateway.is_none() || live.gateway == disabled.gateway)
|
|
});
|
|
|
|
if matches_live {
|
|
let _ = delete_route(disabled).await;
|
|
}
|
|
}
|
|
|
|
tracing::debug!(
|
|
active = enabled_routes.len(),
|
|
disabled = disabled_routes.len(),
|
|
"Native Linux kernel routes synchronized via RTNETLINK"
|
|
);
|
|
Ok(())
|
|
}
|
|
|
|
/// Synchronize the dedicated `table inet nx9_wg` nftables ruleset.
|
|
async fn sync_firewall(
|
|
&self,
|
|
rules: &[FirewallRule],
|
|
enable_nat: bool,
|
|
wg_subnets: &[IpNet],
|
|
) -> Result<()> {
|
|
let ruleset = NftablesRulesetBuilder::build(rules, enable_nat, wg_subnets);
|
|
{
|
|
let mut active = self.active_ruleset.write().await;
|
|
*active = ruleset.clone();
|
|
}
|
|
|
|
let nft = NativeLinuxNftablesEngine::new();
|
|
match nft.apply_ruleset(&ruleset).await {
|
|
Ok(()) => {
|
|
tracing::info!(
|
|
"Native Linux nftables 'table inet nx9_wg' synchronized successfully via Netlink"
|
|
);
|
|
Ok(())
|
|
}
|
|
Err(e) => {
|
|
tracing::warn!(error = %e, "Kernel nftables application skipped (unprivileged or non-root context)");
|
|
Ok(())
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Inspect kernel IP packet forwarding status via /proc/sys/net.
|
|
async fn get_forwarding_status(&self) -> Result<IpForwardingStatus> {
|
|
IpForwardingStatus::detect()
|
|
}
|
|
|
|
/// Get current active generated or live nftables ruleset.
|
|
async fn get_active_nftables_ruleset(&self) -> Result<String> {
|
|
let nft = NativeLinuxNftablesEngine::new();
|
|
match nft.get_live_ruleset().await {
|
|
Ok(live) if !live.trim().is_empty() => Ok(live),
|
|
_ => {
|
|
let active = self.active_ruleset.read().await;
|
|
if active.is_empty() {
|
|
Ok(NftablesRulesetBuilder::build(&[], true, &[]))
|
|
} else {
|
|
Ok(active.clone())
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
async fn has_route_drift(&self, routes: &[Route]) -> Result<bool> {
|
|
let live_routes = list_routes().await.unwrap_or_default();
|
|
let enabled_routes: Vec<&Route> = routes.iter().filter(|r| r.enabled).collect();
|
|
let disabled_routes: Vec<&Route> = routes.iter().filter(|r| !r.enabled).collect();
|
|
|
|
// 1. Any enabled route missing from live routes?
|
|
for desired in &enabled_routes {
|
|
let found = live_routes.iter().any(|live| {
|
|
live.destination == desired.destination
|
|
&& (desired.gateway.is_none() || live.gateway == desired.gateway)
|
|
});
|
|
if !found {
|
|
return Ok(true);
|
|
}
|
|
}
|
|
|
|
// 2. Any disabled route still present in live routes?
|
|
for disabled in &disabled_routes {
|
|
let found = live_routes.iter().any(|live| {
|
|
live.destination == disabled.destination
|
|
&& (disabled.gateway.is_none() || live.gateway == disabled.gateway)
|
|
});
|
|
if found {
|
|
return Ok(true);
|
|
}
|
|
}
|
|
|
|
Ok(false)
|
|
}
|
|
}
|