[pve-devel] [PATCH proxmox-firewall 06/37] config: host: add helpers for host network configuration

[Stefan Hanreich]

Currently the helpers for obtaining the host network configuration
panic on error, which could be avoided by the use of
OnceLock::get_or_init, but this method is currently only available in
nightly versions.

Generally, if there is a problem with obtaining a hostname for the
current node then something else is probably already quite broken, so
I would deem it acceptable for now, same goes for obtaining the
current network configuration.

Co-authored-by: Wolfgang Bumiller <w.bumiller at proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
---
 proxmox-ve-config/Cargo.toml        |  1 +
 proxmox-ve-config/src/host/mod.rs   |  1 +
 proxmox-ve-config/src/host/utils.rs | 97 +++++++++++++++++++++++++++++
 proxmox-ve-config/src/lib.rs        |  1 +
 4 files changed, 100 insertions(+)
 create mode 100644 proxmox-ve-config/src/host/mod.rs
 create mode 100644 proxmox-ve-config/src/host/utils.rs

diff --git a/proxmox-ve-config/Cargo.toml b/proxmox-ve-config/Cargo.toml
index 7bb391e..480eb58 100644
--- a/proxmox-ve-config/Cargo.toml
+++ b/proxmox-ve-config/Cargo.toml
@@ -13,6 +13,7 @@ license = "AGPL-3"
 [dependencies]
 log = "0.4"
 anyhow = "1"
+nix = "0.26"
 
 serde = { version = "1", features = [ "derive" ] }
 serde_json = "1"
diff --git a/proxmox-ve-config/src/host/mod.rs b/proxmox-ve-config/src/host/mod.rs
new file mode 100644
index 0000000..b5614dd
--- /dev/null
+++ b/proxmox-ve-config/src/host/mod.rs
@@ -0,0 +1 @@
+pub mod utils;
diff --git a/proxmox-ve-config/src/host/utils.rs b/proxmox-ve-config/src/host/utils.rs
new file mode 100644
index 0000000..1636f95
--- /dev/null
+++ b/proxmox-ve-config/src/host/utils.rs
@@ -0,0 +1,97 @@
+use std::net::{IpAddr, ToSocketAddrs};
+use std::sync::OnceLock;
+
+use crate::firewall::types::Cidr;
+
+use nix::sys::socket::{AddressFamily, SockaddrLike};
+
+pub fn hostname() -> &'static str {
+    static HOSTNAME: OnceLock<String> = OnceLock::new();
+
+    // We should rather use get_or_try_init to avoid needing to panic
+    // but it is currently experimental
+    HOSTNAME.get_or_init(|| {
+        use nix::libc::{c_char, gethostname, sysconf, _SC_HOST_NAME_MAX};
+        use std::ffi::CStr;
+
+        let max_len = unsafe { sysconf(_SC_HOST_NAME_MAX) } as usize + 1;
+        let mut buffer = vec![0; max_len];
+
+        let ret = unsafe { gethostname(buffer.as_mut_ptr() as *mut c_char, buffer.len()) };
+
+        if ret != 0 {
+            // failing to get the hostname means something is *really* off
+            panic!("gethostname failed with returncode {ret}");
+        }
+
+        let c_str = CStr::from_bytes_until_nul(&buffer).expect("buffer contains a NUL byte");
+
+        String::from_utf8_lossy(c_str.to_bytes()).to_string()
+    })
+}
+
+pub fn host_ips() -> &'static [IpAddr] {
+    static IP_ADDRESSES: OnceLock<Vec<IpAddr>> = OnceLock::new();
+
+    // We should rather use get_or_try_init to avoid needing to panic
+    // but it is currently experimental
+    IP_ADDRESSES.get_or_init(|| {
+        let hostname = hostname();
+
+        format!("{hostname}:0")
+            .to_socket_addrs()
+            .expect("local hostname is resolvable")
+            .map(|addr| addr.ip())
+            .collect()
+    })
+}
+
+pub fn network_interface_cidrs() -> &'static [Cidr] {
+    static INTERFACES: OnceLock<Vec<Cidr>> = OnceLock::new();
+
+    // We should rather use get_or_try_init to avoid needing to panic
+    // but it is currently experimental
+    INTERFACES.get_or_init(|| {
+        use nix::ifaddrs::getifaddrs;
+
+        let mut cidrs = Vec::new();
+
+        let interfaces = getifaddrs().expect("should be able to query network interfaces");
+
+        for interface in interfaces {
+            if let (Some(address), Some(netmask)) = (interface.address, interface.netmask) {
+                match (address.family(), netmask.family()) {
+                    (Some(AddressFamily::Inet), Some(AddressFamily::Inet)) => {
+                        let address = address.as_sockaddr_in().expect("is an IPv4 address").ip();
+
+                        let netmask = netmask
+                            .as_sockaddr_in()
+                            .expect("is an IPv4 address")
+                            .ip()
+                            .count_ones()
+                            .try_into()
+                            .expect("count_ones of u32 is < u8_max");
+
+                        cidrs.push(Cidr::new_v4(address, netmask).expect("netmask is valid"));
+                    }
+                    (Some(AddressFamily::Inet6), Some(AddressFamily::Inet6)) => {
+                        let address = address.as_sockaddr_in6().expect("is an IPv6 address").ip();
+
+                        let netmask_address =
+                            netmask.as_sockaddr_in6().expect("is an IPv6 address").ip();
+
+                        let netmask = u128::from_be_bytes(netmask_address.octets())
+                            .count_ones()
+                            .try_into()
+                            .expect("count_ones of u128 is < u8_max");
+
+                        cidrs.push(Cidr::new_v6(address, netmask).expect("netmask is valid"));
+                    }
+                    _ => continue,
+                }
+            }
+        }
+
+        cidrs
+    })
+}
diff --git a/proxmox-ve-config/src/lib.rs b/proxmox-ve-config/src/lib.rs
index a0734b8..2bf9352 100644
--- a/proxmox-ve-config/src/lib.rs
+++ b/proxmox-ve-config/src/lib.rs
@@ -1 +1,2 @@
 pub mod firewall;
+pub mod host;
-- 
2.39.2