[pve-devel] [PATCH proxmox-firewall v3 06/39] config: host: add helpers for host network configuration

[Stefan Hanreich]

Currently the helpers for obtaining the host network configuration
panic on error, which could be avoided by the use of
OnceLock::get_or_init, but this method is currently only available in
nightly versions.

Generally, if there is a problem with obtaining the network config for
the node I would deem it acceptable for now, since that would usually
mean something is amiss with the network configuration and a firewall
won't really do anything then anyway.

Reviewed-by: Lukas Wagner <l.wagner at proxmox.com>
Reviewed-by: Max Carrara <m.carrara at proxmox.com>
Co-authored-by: Wolfgang Bumiller <w.bumiller at proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
---
 proxmox-ve-config/Cargo.toml        |  5 +++
 proxmox-ve-config/src/host/mod.rs   |  1 +
 proxmox-ve-config/src/host/utils.rs | 70 +++++++++++++++++++++++++++++
 proxmox-ve-config/src/lib.rs        |  1 +
 4 files changed, 77 insertions(+)
 create mode 100644 proxmox-ve-config/src/host/mod.rs
 create mode 100644 proxmox-ve-config/src/host/utils.rs

diff --git a/proxmox-ve-config/Cargo.toml b/proxmox-ve-config/Cargo.toml
index 7bb391e..cc689c8 100644
--- a/proxmox-ve-config/Cargo.toml
+++ b/proxmox-ve-config/Cargo.toml
@@ -13,8 +13,13 @@ license = "AGPL-3"
 [dependencies]
 log = "0.4"
 anyhow = "1"
+nix = "0.26"
 
 serde = { version = "1", features = [ "derive" ] }
 serde_json = "1"
 serde_plain = "1"
 serde_with = "2.3.3"
+
+proxmox-schema = "3.1.0"
+proxmox-sys = "0.5.3"
+proxmox-sortable-macro = "0.1.3"
diff --git a/proxmox-ve-config/src/host/mod.rs b/proxmox-ve-config/src/host/mod.rs
new file mode 100644
index 0000000..b5614dd
--- /dev/null
+++ b/proxmox-ve-config/src/host/mod.rs
@@ -0,0 +1 @@
+pub mod utils;
diff --git a/proxmox-ve-config/src/host/utils.rs b/proxmox-ve-config/src/host/utils.rs
new file mode 100644
index 0000000..b1dc8e9
--- /dev/null
+++ b/proxmox-ve-config/src/host/utils.rs
@@ -0,0 +1,70 @@
+use std::net::{IpAddr, ToSocketAddrs};
+
+use crate::firewall::types::Cidr;
+
+use nix::sys::socket::{AddressFamily, SockaddrLike};
+use proxmox_sys::nodename;
+
+/// gets a list of IPs that the hostname of this node resolves to
+///
+/// panics if the local hostname is not resolvable
+pub fn host_ips() -> Vec<IpAddr> {
+    let hostname = nodename();
+
+    log::trace!("resolving hostname");
+
+    format!("{hostname}:0")
+        .to_socket_addrs()
+        .expect("local hostname is resolvable")
+        .map(|addr| addr.ip())
+        .collect()
+}
+
+/// gets a list of all configured CIDRs on all network interfaces of this host
+///
+/// panics if unable to query the current network configuration
+pub fn network_interface_cidrs() -> Vec<Cidr> {
+    use nix::ifaddrs::getifaddrs;
+
+    log::trace!("reading networking interface list");
+
+    let mut cidrs = Vec::new();
+
+    let interfaces = getifaddrs().expect("should be able to query network interfaces");
+
+    for interface in interfaces {
+        if let (Some(address), Some(netmask)) = (interface.address, interface.netmask) {
+            match (address.family(), netmask.family()) {
+                (Some(AddressFamily::Inet), Some(AddressFamily::Inet)) => {
+                    let address = address.as_sockaddr_in().expect("is an IPv4 address").ip();
+
+                    let netmask = netmask
+                        .as_sockaddr_in()
+                        .expect("is an IPv4 address")
+                        .ip()
+                        .count_ones()
+                        .try_into()
+                        .expect("count_ones of u32 is < u8_max");
+
+                    cidrs.push(Cidr::new_v4(address, netmask).expect("netmask is valid"));
+                }
+                (Some(AddressFamily::Inet6), Some(AddressFamily::Inet6)) => {
+                    let address = address.as_sockaddr_in6().expect("is an IPv6 address").ip();
+
+                    let netmask_address =
+                        netmask.as_sockaddr_in6().expect("is an IPv6 address").ip();
+
+                    let netmask = u128::from_be_bytes(netmask_address.octets())
+                        .count_ones()
+                        .try_into()
+                        .expect("count_ones of u128 is < u8_max");
+
+                    cidrs.push(Cidr::new_v6(address, netmask).expect("netmask is valid"));
+                }
+                _ => continue,
+            }
+        }
+    }
+
+    cidrs
+}
diff --git a/proxmox-ve-config/src/lib.rs b/proxmox-ve-config/src/lib.rs
index a0734b8..2bf9352 100644
--- a/proxmox-ve-config/src/lib.rs
+++ b/proxmox-ve-config/src/lib.rs
@@ -1 +1,2 @@
 pub mod firewall;
+pub mod host;
-- 
2.39.2