[pve-devel] [PATCH proxmox-firewall v2 06/39] config: host: add helpers for host network configuration

[Stefan Hanreich]

Currently the helpers for obtaining the host network configuration
panic on error, which could be avoided by the use of
OnceLock::get_or_init, but this method is currently only available in
nightly versions.

Generally, if there is a problem with obtaining the network config for
the node I would deem it acceptable for now, since that would usually
mean something is amiss with the network configuration and a firewall
won't really do anything then anyway.

Reviewed-by: Lukas Wagner <l.wagner at proxmox.com>
Reviewed-by: Max Carrara <m.carrara at proxmox.com>
Co-authored-by: Wolfgang Bumiller <w.bumiller at proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
---
 proxmox-ve-config/Cargo.toml        |  5 ++
 proxmox-ve-config/src/host/mod.rs   |  1 +
 proxmox-ve-config/src/host/utils.rs | 77 +++++++++++++++++++++++++++++
 proxmox-ve-config/src/lib.rs        |  1 +
 4 files changed, 84 insertions(+)
 create mode 100644 proxmox-ve-config/src/host/mod.rs
 create mode 100644 proxmox-ve-config/src/host/utils.rs

diff --git a/proxmox-ve-config/Cargo.toml b/proxmox-ve-config/Cargo.toml
index 7bb391e..cc689c8 100644
--- a/proxmox-ve-config/Cargo.toml
+++ b/proxmox-ve-config/Cargo.toml
@@ -13,8 +13,13 @@ license = "AGPL-3"
 [dependencies]
 log = "0.4"
 anyhow = "1"
+nix = "0.26"
 
 serde = { version = "1", features = [ "derive" ] }
 serde_json = "1"
 serde_plain = "1"
 serde_with = "2.3.3"
+
+proxmox-schema = "3.1.0"
+proxmox-sys = "0.5.3"
+proxmox-sortable-macro = "0.1.3"
diff --git a/proxmox-ve-config/src/host/mod.rs b/proxmox-ve-config/src/host/mod.rs
new file mode 100644
index 0000000..b5614dd
--- /dev/null
+++ b/proxmox-ve-config/src/host/mod.rs
@@ -0,0 +1 @@
+pub mod utils;
diff --git a/proxmox-ve-config/src/host/utils.rs b/proxmox-ve-config/src/host/utils.rs
new file mode 100644
index 0000000..08c40c9
--- /dev/null
+++ b/proxmox-ve-config/src/host/utils.rs
@@ -0,0 +1,77 @@
+use std::net::{IpAddr, ToSocketAddrs};
+use std::sync::OnceLock;
+
+use crate::firewall::types::Cidr;
+
+use nix::sys::socket::{AddressFamily, SockaddrLike};
+use proxmox_sys::nodename;
+
+pub fn host_ips() -> &'static [IpAddr] {
+    static IP_ADDRESSES: OnceLock<Vec<IpAddr>> = OnceLock::new();
+
+    // We should rather use get_or_try_init to avoid needing to panic
+    // but it is currently experimental
+    IP_ADDRESSES.get_or_init(|| {
+        let hostname = nodename();
+
+        log::trace!("resolving hostname");
+
+        format!("{hostname}:0")
+            .to_socket_addrs()
+            .expect("local hostname is resolvable")
+            .map(|addr| addr.ip())
+            .collect()
+    })
+}
+
+pub fn network_interface_cidrs() -> &'static [Cidr] {
+    static INTERFACES: OnceLock<Vec<Cidr>> = OnceLock::new();
+
+    // We should rather use get_or_try_init to avoid needing to panic
+    // but it is currently experimental
+    INTERFACES.get_or_init(|| {
+        use nix::ifaddrs::getifaddrs;
+
+        log::trace!("reading networking interface list");
+
+        let mut cidrs = Vec::new();
+
+        let interfaces = getifaddrs().expect("should be able to query network interfaces");
+
+        for interface in interfaces {
+            if let (Some(address), Some(netmask)) = (interface.address, interface.netmask) {
+                match (address.family(), netmask.family()) {
+                    (Some(AddressFamily::Inet), Some(AddressFamily::Inet)) => {
+                        let address = address.as_sockaddr_in().expect("is an IPv4 address").ip();
+
+                        let netmask = netmask
+                            .as_sockaddr_in()
+                            .expect("is an IPv4 address")
+                            .ip()
+                            .count_ones()
+                            .try_into()
+                            .expect("count_ones of u32 is < u8_max");
+
+                        cidrs.push(Cidr::new_v4(address, netmask).expect("netmask is valid"));
+                    }
+                    (Some(AddressFamily::Inet6), Some(AddressFamily::Inet6)) => {
+                        let address = address.as_sockaddr_in6().expect("is an IPv6 address").ip();
+
+                        let netmask_address =
+                            netmask.as_sockaddr_in6().expect("is an IPv6 address").ip();
+
+                        let netmask = u128::from_be_bytes(netmask_address.octets())
+                            .count_ones()
+                            .try_into()
+                            .expect("count_ones of u128 is < u8_max");
+
+                        cidrs.push(Cidr::new_v6(address, netmask).expect("netmask is valid"));
+                    }
+                    _ => continue,
+                }
+            }
+        }
+
+        cidrs
+    })
+}
diff --git a/proxmox-ve-config/src/lib.rs b/proxmox-ve-config/src/lib.rs
index a0734b8..2bf9352 100644
--- a/proxmox-ve-config/src/lib.rs
+++ b/proxmox-ve-config/src/lib.rs
@@ -1 +1,2 @@
 pub mod firewall;
+pub mod host;
-- 
2.39.2