From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 0A76E1FF37F for ; Thu, 18 Apr 2024 18:16:50 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id AF990314CF; Thu, 18 Apr 2024 18:15:10 +0200 (CEST) From: Stefan Hanreich To: pve-devel@lists.proxmox.com Date: Thu, 18 Apr 2024 18:14:01 +0200 Message-Id: <20240418161434.709473-7-s.hanreich@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240418161434.709473-1-s.hanreich@proxmox.com> References: <20240418161434.709473-1-s.hanreich@proxmox.com> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.299 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Subject: [pve-devel] [PATCH proxmox-firewall v3 06/39] config: host: add helpers for host network configuration X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Cc: Wolfgang Bumiller Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" Currently the helpers for obtaining the host network configuration panic on error, which could be avoided by the use of OnceLock::get_or_init, but this method is currently only available in nightly versions. Generally, if there is a problem with obtaining the network config for the node I would deem it acceptable for now, since that would usually mean something is amiss with the network configuration and a firewall won't really do anything then anyway. Reviewed-by: Lukas Wagner Reviewed-by: Max Carrara Co-authored-by: Wolfgang Bumiller Signed-off-by: Stefan Hanreich --- proxmox-ve-config/Cargo.toml | 5 +++ proxmox-ve-config/src/host/mod.rs | 1 + proxmox-ve-config/src/host/utils.rs | 70 +++++++++++++++++++++++++++++ proxmox-ve-config/src/lib.rs | 1 + 4 files changed, 77 insertions(+) create mode 100644 proxmox-ve-config/src/host/mod.rs create mode 100644 proxmox-ve-config/src/host/utils.rs diff --git a/proxmox-ve-config/Cargo.toml b/proxmox-ve-config/Cargo.toml index 7bb391e..cc689c8 100644 --- a/proxmox-ve-config/Cargo.toml +++ b/proxmox-ve-config/Cargo.toml @@ -13,8 +13,13 @@ license = "AGPL-3" [dependencies] log = "0.4" anyhow = "1" +nix = "0.26" serde = { version = "1", features = [ "derive" ] } serde_json = "1" serde_plain = "1" serde_with = "2.3.3" + +proxmox-schema = "3.1.0" +proxmox-sys = "0.5.3" +proxmox-sortable-macro = "0.1.3" diff --git a/proxmox-ve-config/src/host/mod.rs b/proxmox-ve-config/src/host/mod.rs new file mode 100644 index 0000000..b5614dd --- /dev/null +++ b/proxmox-ve-config/src/host/mod.rs @@ -0,0 +1 @@ +pub mod utils; diff --git a/proxmox-ve-config/src/host/utils.rs b/proxmox-ve-config/src/host/utils.rs new file mode 100644 index 0000000..b1dc8e9 --- /dev/null +++ b/proxmox-ve-config/src/host/utils.rs @@ -0,0 +1,70 @@ +use std::net::{IpAddr, ToSocketAddrs}; + +use crate::firewall::types::Cidr; + +use nix::sys::socket::{AddressFamily, SockaddrLike}; +use proxmox_sys::nodename; + +/// gets a list of IPs that the hostname of this node resolves to +/// +/// panics if the local hostname is not resolvable +pub fn host_ips() -> Vec { + let hostname = nodename(); + + log::trace!("resolving hostname"); + + format!("{hostname}:0") + .to_socket_addrs() + .expect("local hostname is resolvable") + .map(|addr| addr.ip()) + .collect() +} + +/// gets a list of all configured CIDRs on all network interfaces of this host +/// +/// panics if unable to query the current network configuration +pub fn network_interface_cidrs() -> Vec { + use nix::ifaddrs::getifaddrs; + + log::trace!("reading networking interface list"); + + let mut cidrs = Vec::new(); + + let interfaces = getifaddrs().expect("should be able to query network interfaces"); + + for interface in interfaces { + if let (Some(address), Some(netmask)) = (interface.address, interface.netmask) { + match (address.family(), netmask.family()) { + (Some(AddressFamily::Inet), Some(AddressFamily::Inet)) => { + let address = address.as_sockaddr_in().expect("is an IPv4 address").ip(); + + let netmask = netmask + .as_sockaddr_in() + .expect("is an IPv4 address") + .ip() + .count_ones() + .try_into() + .expect("count_ones of u32 is < u8_max"); + + cidrs.push(Cidr::new_v4(address, netmask).expect("netmask is valid")); + } + (Some(AddressFamily::Inet6), Some(AddressFamily::Inet6)) => { + let address = address.as_sockaddr_in6().expect("is an IPv6 address").ip(); + + let netmask_address = + netmask.as_sockaddr_in6().expect("is an IPv6 address").ip(); + + let netmask = u128::from_be_bytes(netmask_address.octets()) + .count_ones() + .try_into() + .expect("count_ones of u128 is < u8_max"); + + cidrs.push(Cidr::new_v6(address, netmask).expect("netmask is valid")); + } + _ => continue, + } + } + } + + cidrs +} diff --git a/proxmox-ve-config/src/lib.rs b/proxmox-ve-config/src/lib.rs index a0734b8..2bf9352 100644 --- a/proxmox-ve-config/src/lib.rs +++ b/proxmox-ve-config/src/lib.rs @@ -1 +1,2 @@ pub mod firewall; +pub mod host; -- 2.39.2 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel