[PATCH proxmox-ve-rs v6 02/24] prefix lists: implement validation for prefix lists

[Stefan Hanreich <s.hanreich@proxmox.com>]

Implement validation for prefix list entries, that enforces the
invariants that are required for entries to be valid. Since FRR
rejects invalid prefix lists and refuses to start, it is important
that invalid prefix lists are caught early by the stack to prevent
potentially crashing the FRR daemon.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
 proxmox-ve-config/src/sdn/prefix_list.rs | 246 +++++++++++++++++++++++
 1 file changed, 246 insertions(+)

diff --git a/proxmox-ve-config/src/sdn/prefix_list.rs b/proxmox-ve-config/src/sdn/prefix_list.rs
index 0efe81d..672ee88 100644
--- a/proxmox-ve-config/src/sdn/prefix_list.rs
+++ b/proxmox-ve-config/src/sdn/prefix_list.rs
@@ -31,6 +31,8 @@ use proxmox_schema::{
     UpdaterType,
 };
 
+use crate::common::valid::Validatable;
+
 pub const PREFIX_LIST_ID_REGEX_STR: &str =
     r"(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-_]){0,30}(?:[a-zA-Z0-9]){0,1})";
 
@@ -82,7 +84,26 @@ pub struct PrefixListSection {
     pub(crate) entries: Vec<PropertyString<PrefixListEntry>>,
 }
 
+impl Validatable for PrefixListSection {
+    type Error = anyhow::Error;
+
+    fn validate(&self) -> Result<(), Self::Error> {
+        for entry in &self.entries {
+            entry.validate()?
+        }
+
+        Ok(())
+    }
+}
+
 impl PrefixListSection {
+    pub fn new(id: PrefixListId) -> Self {
+        Self {
+            id,
+            entries: Vec::new(),
+        }
+    }
+
     /// Return the ID of the Prefix List.
     pub fn id(&self) -> &PrefixListId {
         &self.id
@@ -202,6 +223,8 @@ impl PrefixListSection {
             anyhow::bail!("entry with sequence number {} already exists", entry.seq);
         }
 
+        entry.validate()?;
+
         self.entries.push(entry.into());
         Ok(())
     }
@@ -300,6 +323,48 @@ impl PrefixListEntry {
     }
 }
 
+impl Validatable for PrefixListEntry {
+    type Error = anyhow::Error;
+
+    fn validate(&self) -> Result<(), Self::Error> {
+        // Ensure that:
+        // prefixmask <= ge <= le
+
+        let (max_mask, current_mask) = match self.prefix {
+            Cidr::Ipv4(ipv4_cidr) => (32, ipv4_cidr.mask() as u32),
+            Cidr::Ipv6(ipv6_cidr) => (128, ipv6_cidr.mask() as u32),
+        };
+
+        if let Some(le) = self.le {
+            if le > max_mask {
+                anyhow::bail!("Prefix <= must not be greater than {max_mask}");
+            }
+
+            if current_mask > le {
+                anyhow::bail!("Prefix <= must not be greater than {current_mask}");
+            }
+
+            if let Some(ge) = self.ge {
+                if ge > le {
+                    anyhow::bail!("Prefix >= must not be greater than Prefix <= ({ge})");
+                }
+            }
+        }
+
+        if let Some(ge) = self.ge {
+            if ge > max_mask {
+                anyhow::bail!("Prefix >= must not be greater than {max_mask}");
+            }
+
+            if current_mask > ge {
+                anyhow::bail!("Prefix >= must be greater than {current_mask}");
+            }
+        }
+
+        Ok(())
+    }
+}
+
 #[api(
     "id-property": "id",
     "id-schema": {
@@ -317,6 +382,15 @@ pub enum PrefixList {
     PrefixList(PrefixListSection),
 }
 
+impl Validatable for PrefixList {
+    type Error = anyhow::Error;
+
+    fn validate(&self) -> Result<(), Self::Error> {
+        let PrefixList::PrefixList(prefix_list_section) = self;
+        prefix_list_section.validate()
+    }
+}
+
 #[cfg(feature = "frr")]
 pub mod frr {
     use super::*;
@@ -492,4 +566,176 @@ prefix-list: somelist
         PrefixList::parse_section_config("prefix-lists.cfg", section_config)?;
         Ok(())
     }
+
+    #[test]
+    fn test_prefix_list_seq_nr() -> Result<(), anyhow::Error> {
+        let mut prefix_list = PrefixListSection::new(
+            PrefixListId::from_string("test".to_string()).expect("valid prefix list id"),
+        );
+
+        assert_eq!(prefix_list.next_seq_number(), 5);
+
+        prefix_list
+            .try_insert_entry(PrefixListEntry {
+                action: PrefixListAction::Permit,
+                prefix: Cidr::new_v4([192, 0, 2, 0], 24).expect("valid cidr"),
+                le: None,
+                ge: None,
+                seq: 100,
+            })
+            .expect("valid entry");
+
+        assert_eq!(prefix_list.next_seq_number(), 105);
+
+        prefix_list.remove_entry(100).expect("could be removed");
+        assert_eq!(prefix_list.next_seq_number(), 5);
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_prefix_list_entry_update() -> Result<(), anyhow::Error> {
+        let mut prefix_list = PrefixListSection::new(
+            PrefixListId::from_string("test".to_string()).expect("valid prefix list id"),
+        );
+
+        assert_eq!(prefix_list.next_seq_number(), 5);
+
+        prefix_list
+            .try_insert_entry(PrefixListEntry {
+                action: PrefixListAction::Permit,
+                prefix: Cidr::new_v4([192, 0, 2, 0], 24).expect("valid cidr"),
+                le: None,
+                ge: None,
+                seq: 100,
+            })
+            .expect("valid entry");
+
+        prefix_list
+            .try_insert_entry(PrefixListEntry {
+                action: PrefixListAction::Permit,
+                prefix: Cidr::new_v4([192, 0, 2, 0], 24).expect("valid cidr"),
+                le: None,
+                ge: None,
+                seq: 200,
+            })
+            .expect("valid entry");
+
+        prefix_list
+            .try_update_entry(
+                100,
+                api::PrefixListEntryUpdater {
+                    action: None,
+                    prefix: None,
+                    le: None,
+                    ge: None,
+                    seq: Some(200),
+                },
+                Vec::new(),
+            )
+            .expect_err("seq nr already exists");
+
+        prefix_list
+            .try_update_entry(
+                150,
+                api::PrefixListEntryUpdater {
+                    action: None,
+                    prefix: None,
+                    le: None,
+                    ge: None,
+                    seq: Some(100),
+                },
+                Vec::new(),
+            )
+            .expect_err("old seq nr doesn't exist");
+
+        prefix_list
+            .try_update_entry(
+                100,
+                api::PrefixListEntryUpdater {
+                    action: None,
+                    prefix: None,
+                    le: None,
+                    ge: None,
+                    seq: Some(10),
+                },
+                Vec::new(),
+            )
+            .expect("changing sequence number from 100 to 10 works");
+
+        prefix_list
+            .entry(10)
+            .expect("entry has been successfully updated");
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_invalid_prefix_list_entry() -> Result<(), anyhow::Error> {
+        let mut prefix_list = PrefixListSection::new(
+            PrefixListId::from_string("test".to_string()).expect("valid prefix list id"),
+        );
+
+        prefix_list
+            .try_insert_entry(PrefixListEntry {
+                action: PrefixListAction::Permit,
+                prefix: Cidr::new_v4([192, 0, 2, 0], 24).expect("valid cidr"),
+                le: Some(23),
+                ge: None,
+                seq: 100,
+            })
+            .expect_err("le is larger than prefix size");
+
+        prefix_list
+            .try_insert_entry(PrefixListEntry {
+                action: PrefixListAction::Permit,
+                prefix: Cidr::new_v4([192, 0, 2, 0], 24).expect("valid cidr"),
+                le: Some(23),
+                ge: None,
+                seq: 100,
+            })
+            .expect_err("le is larger than prefix size");
+
+        prefix_list
+            .try_insert_entry(PrefixListEntry {
+                action: PrefixListAction::Permit,
+                prefix: Cidr::new_v4([192, 0, 2, 0], 24).expect("valid cidr"),
+                le: None,
+                ge: Some(23),
+                seq: 100,
+            })
+            .expect_err("ge is larger than prefix size");
+
+        prefix_list
+            .try_insert_entry(PrefixListEntry {
+                action: PrefixListAction::Permit,
+                prefix: Cidr::new_v4([192, 0, 2, 0], 24).expect("valid cidr"),
+                le: Some(25),
+                ge: Some(27),
+                seq: 100,
+            })
+            .expect_err("le is larger than ge");
+
+        prefix_list
+            .try_insert_entry(PrefixListEntry {
+                action: PrefixListAction::Permit,
+                prefix: Cidr::new_v4([192, 0, 2, 0], 24).expect("valid cidr"),
+                le: None,
+                ge: None,
+                seq: 100,
+            })
+            .expect("valid entry");
+
+        prefix_list
+            .try_insert_entry(PrefixListEntry {
+                action: PrefixListAction::Permit,
+                prefix: Cidr::new_v4([192, 0, 2, 0], 24).expect("valid cidr"),
+                le: None,
+                ge: None,
+                seq: 100,
+            })
+            .expect_err("entry with seq already exists");
+
+        Ok(())
+    }
 }
-- 
2.47.3