mesh-host/internal/outward/links.go

// Package outward reads which of this machine's links face outside it (novox/hq ADR 0140).
//
// The filter the mesh derives constrains traffic arriving from outside the machine and says nothing
// about traffic that did not. To write that rule the mesh has to know which links "outside" arrives
// on, and that is a thing only the machine can say — so it says it, once per report, the way it
// already reports the kind of firewall it found and the tunnel it carried.
//
// **It replaces a list of addresses.** The filter used to allow the machine's own containers back
// through by naming the address ranges they sit on: two ranges fixed in the control plane's source
// and the rest typed by an operator. A range describes one machine and goes stale silently
// (novox/hq 04-ISSUES/137 and /141). A link that carries the default route is a fact the machine
// reads afresh every time, and it does not change when a module is added or removed.
//
// It reads the kernel's routing tables directly rather than asking a program. A module naming a
// program the machine does not have is how the mesh already reported success while doing nothing
// (novox/hq 04-ISSUES/136), and every machine has /proc.
package outward

import (
	"bufio"
	"fmt"
	"os"
	"path/filepath"
	"sort"
	"strings"
)

// ProcNet is where the kernel publishes its routing tables. A parameter so a test can hold a
// routing table without one.
const ProcNet = "/proc/net"

// SysClassNet is where the kernel lists the machine's network interfaces, one directory each. A
// parameter for the same reason.
const SysClassNet = "/sys/class/net"

// Links are the interfaces carrying a default route, for both address families, and every interface
// backed by a physical device, sorted and without repeats.
//
// **A physical link faces outside whether or not it is up** (novox/hq issue 197). The filter accepts
// whatever did not arrive on a link named here, so a link left out of this list is not filtered at
// all. A cable unplugged when the machine last reported carries no default route, and was left out:
// plugged in, everything arriving on it was accepted until the next report and the next push — and a
// second physical link that never carries the default route was never filtered. A physical device is
// read from the kernel's own list, where it has a `device` entry; a bridge, a veth, the tunnel and the
// loopback have none, and stay what they are, this machine's own.
//
// A machine may have more than one: a laptop with a cable and a radio has two, and both face
// outside. A machine with none — no route off itself — returns nothing, and the mesh refuses to
// compose a filter for it rather than writing a rule around a link with no name, which would be a
// rule set that does not load and a machine filtering nothing while its unit reports success.
func Links(procNet, sysClassNet string) ([]string, error) {
	if procNet == "" {
		procNet = ProcNet
	}
	if sysClassNet == "" {
		sysClassNet = SysClassNet
	}
	seen := map[string]bool{}

	four, err := defaultsV4(filepath.Join(procNet, "route"))
	if err != nil {
		return nil, err
	}
	six, err := defaultsV6(filepath.Join(procNet, "ipv6_route"))
	if err != nil {
		return nil, err
	}
	devices, err := physical(sysClassNet)
	if err != nil {
		return nil, err
	}
	for _, name := range append(append(four, six...), devices...) {
		if name != "" && name != "lo" {
			seen[name] = true
		}
	}

	out := make([]string, 0, len(seen))
	for name := range seen {
		out = append(out, name)
	}
	sort.Strings(out)
	return out, nil
}

// physical is every interface the kernel lists with a device behind it. A list that is not there is
// not an error — a machine without sysfs mounted reports what its routing table says, as before.
func physical(sysClassNet string) ([]string, error) {
	entries, err := os.ReadDir(sysClassNet)
	if os.IsNotExist(err) {
		return nil, nil
	}
	if err != nil {
		return nil, err
	}
	var out []string
	for _, e := range entries {
		if _, err := os.Stat(filepath.Join(sysClassNet, e.Name(), "device")); err == nil {
			out = append(out, e.Name())
		}
	}
	return out, nil
}

// defaultsV4 reads /proc/net/route, whose columns are
//
//	Iface Destination Gateway Flags RefCnt Use Metric Mask ...
//
// with addresses in hexadecimal. A default route is destination zero with mask zero — the mask
// matters, because a route to the zero address with a real mask is not a default route.
func defaultsV4(path string) ([]string, error) {
	lines, err := rows(path)
	if err != nil {
		return nil, err
	}
	var out []string
	for _, fields := range lines {
		if len(fields) < 8 {
			continue
		}
		if isZeroHex(fields[1]) && isZeroHex(fields[7]) {
			out = append(out, fields[0])
		}
	}
	return out, nil
}

// defaultsV6 reads /proc/net/ipv6_route, whose columns are
//
//	dest destprefix src srcprefix nexthop metric refcnt use flags iface
//
// A default route is the zero destination with a zero prefix length.
func defaultsV6(path string) ([]string, error) {
	lines, err := rows(path)
	if err != nil {
		return nil, err
	}
	var out []string
	for _, fields := range lines {
		if len(fields) < 10 {
			continue
		}
		if isZeroHex(fields[0]) && isZeroHex(fields[1]) {
			out = append(out, fields[9])
		}
	}
	return out, nil
}

// rows reads a routing table into fields per line, skipping a header and blank lines. A table that
// is not there is not an error: a machine without the second address family has no file for it,
// and that is not a machine that cannot be filtered.
func rows(path string) ([][]string, error) {
	file, err := os.Open(path)
	if os.IsNotExist(err) {
		return nil, nil
	}
	if err != nil {
		return nil, fmt.Errorf("cannot read the routing table at %s: %w", path, err)
	}
	defer file.Close()

	var out [][]string
	scanner := bufio.NewScanner(file)
	for scanner.Scan() {
		line := strings.TrimSpace(scanner.Text())
		if line == "" || strings.HasPrefix(line, "Iface") {
			continue
		}
		out = append(out, strings.Fields(line))
	}
	if err := scanner.Err(); err != nil {
		return nil, fmt.Errorf("cannot read the routing table at %s: %w", path, err)
	}
	return out, nil
}

// isZeroHex is whether a hexadecimal field is all zeroes, whatever its width — the v4 table writes
// eight digits and the v6 table thirty-two, and a prefix length is two.
func isZeroHex(field string) bool {
	if field == "" {
		return false
	}
	return strings.Trim(strings.ToLower(field), "0") == ""
}