[pve-devel] [PATCH proxmox-firewall 06/37] config: host: add helpers for host network configuration

[Max Carrara]

On Tue Apr 2, 2024 at 7:15 PM CEST, Stefan Hanreich wrote:
> Currently the helpers for obtaining the host network configuration
> panic on error, which could be avoided by the use of
> OnceLock::get_or_init, but this method is currently only available in
> nightly versions.
>
> Generally, if there is a problem with obtaining a hostname for the
> current node then something else is probably already quite broken, so
> I would deem it acceptable for now, same goes for obtaining the
> current network configuration.
>
> Co-authored-by: Wolfgang Bumiller <w.bumiller at proxmox.com>
> Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
> ---
>  proxmox-ve-config/Cargo.toml        |  1 +
>  proxmox-ve-config/src/host/mod.rs   |  1 +
>  proxmox-ve-config/src/host/utils.rs | 97 +++++++++++++++++++++++++++++
>  proxmox-ve-config/src/lib.rs        |  1 +
>  4 files changed, 100 insertions(+)
>  create mode 100644 proxmox-ve-config/src/host/mod.rs
>  create mode 100644 proxmox-ve-config/src/host/utils.rs
>
> diff --git a/proxmox-ve-config/Cargo.toml b/proxmox-ve-config/Cargo.toml
> index 7bb391e..480eb58 100644
> --- a/proxmox-ve-config/Cargo.toml
> +++ b/proxmox-ve-config/Cargo.toml
> @@ -13,6 +13,7 @@ license = "AGPL-3"
>  [dependencies]
>  log = "0.4"
>  anyhow = "1"
> +nix = "0.26"
>  
>  serde = { version = "1", features = [ "derive" ] }
>  serde_json = "1"
> diff --git a/proxmox-ve-config/src/host/mod.rs b/proxmox-ve-config/src/host/mod.rs
> new file mode 100644
> index 0000000..b5614dd
> --- /dev/null
> +++ b/proxmox-ve-config/src/host/mod.rs
> @@ -0,0 +1 @@
> +pub mod utils;
> diff --git a/proxmox-ve-config/src/host/utils.rs b/proxmox-ve-config/src/host/utils.rs
> new file mode 100644
> index 0000000..1636f95
> --- /dev/null
> +++ b/proxmox-ve-config/src/host/utils.rs
> @@ -0,0 +1,97 @@
> +use std::net::{IpAddr, ToSocketAddrs};
> +use std::sync::OnceLock;
> +
> +use crate::firewall::types::Cidr;
> +
> +use nix::sys::socket::{AddressFamily, SockaddrLike};
> +
> +pub fn hostname() -> &'static str {
> +    static HOSTNAME: OnceLock<String> = OnceLock::new();
> +
> +    // We should rather use get_or_try_init to avoid needing to panic
> +    // but it is currently experimental
> +    HOSTNAME.get_or_init(|| {
> +        use nix::libc::{c_char, gethostname, sysconf, _SC_HOST_NAME_MAX};
> +        use std::ffi::CStr;
> +
> +        let max_len = unsafe { sysconf(_SC_HOST_NAME_MAX) } as usize + 1;
> +        let mut buffer = vec![0; max_len];
> +
> +        let ret = unsafe { gethostname(buffer.as_mut_ptr() as *mut c_char, buffer.len()) };
> +
> +        if ret != 0 {
> +            // failing to get the hostname means something is *really* off
> +            panic!("gethostname failed with returncode {ret}");
> +        }
> +
> +        let c_str = CStr::from_bytes_until_nul(&buffer).expect("buffer contains a NUL byte");
> +
> +        String::from_utf8_lossy(c_str.to_bytes()).to_string()
> +    })

IMO the closures here and below could later be put into something like
proxmox-sys (or similar) as freestanding functions without static data
and then called here - but this is fine as it is; just an idea!

> +}
> +
> +pub fn host_ips() -> &'static [IpAddr] {
> +    static IP_ADDRESSES: OnceLock<Vec<IpAddr>> = OnceLock::new();
> +
> +    // We should rather use get_or_try_init to avoid needing to panic
> +    // but it is currently experimental
> +    IP_ADDRESSES.get_or_init(|| {
> +        let hostname = hostname();
> +
> +        format!("{hostname}:0")
> +            .to_socket_addrs()
> +            .expect("local hostname is resolvable")
> +            .map(|addr| addr.ip())
> +            .collect()
> +    })

^ Here as well.

> +}
> +
> +pub fn network_interface_cidrs() -> &'static [Cidr] {
> +    static INTERFACES: OnceLock<Vec<Cidr>> = OnceLock::new();
> +
> +    // We should rather use get_or_try_init to avoid needing to panic
> +    // but it is currently experimental
> +    INTERFACES.get_or_init(|| {
> +        use nix::ifaddrs::getifaddrs;
> +
> +        let mut cidrs = Vec::new();
> +
> +        let interfaces = getifaddrs().expect("should be able to query network interfaces");
> +
> +        for interface in interfaces {
> +            if let (Some(address), Some(netmask)) = (interface.address, interface.netmask) {
> +                match (address.family(), netmask.family()) {
> +                    (Some(AddressFamily::Inet), Some(AddressFamily::Inet)) => {
> +                        let address = address.as_sockaddr_in().expect("is an IPv4 address").ip();
> +
> +                        let netmask = netmask
> +                            .as_sockaddr_in()
> +                            .expect("is an IPv4 address")
> +                            .ip()
> +                            .count_ones()
> +                            .try_into()
> +                            .expect("count_ones of u32 is < u8_max");
> +
> +                        cidrs.push(Cidr::new_v4(address, netmask).expect("netmask is valid"));
> +                    }
> +                    (Some(AddressFamily::Inet6), Some(AddressFamily::Inet6)) => {
> +                        let address = address.as_sockaddr_in6().expect("is an IPv6 address").ip();
> +
> +                        let netmask_address =
> +                            netmask.as_sockaddr_in6().expect("is an IPv6 address").ip();
> +
> +                        let netmask = u128::from_be_bytes(netmask_address.octets())
> +                            .count_ones()
> +                            .try_into()
> +                            .expect("count_ones of u128 is < u8_max");
> +
> +                        cidrs.push(Cidr::new_v6(address, netmask).expect("netmask is valid"));
> +                    }
> +                    _ => continue,
> +                }
> +            }
> +        }
> +
> +        cidrs
> +    })

^ And this chonker too.

> +}
> diff --git a/proxmox-ve-config/src/lib.rs b/proxmox-ve-config/src/lib.rs
> index a0734b8..2bf9352 100644
> --- a/proxmox-ve-config/src/lib.rs
> +++ b/proxmox-ve-config/src/lib.rs
> @@ -1 +1,2 @@
>  pub mod firewall;
> +pub mod host;