[PATCH v11 00/23] Dynamic configuration update implementation

[Stefano Brivio <sbrivio@redhat.com>]

Changes in v11:
 * Drop debugging left-overs in 10/23, reported by Paul
 * In 9/23, don't declare argv as const argument for conf_pasta_ns(),
   because some versions of gcc (perhaps depending on the glibc
   version?), at least gcc 16.0.1 from Fedora Rawhide, are not happy
   with that. Suppress the cppcheck warning instead
 
Changes in v10:
 * For some reason, changes in 9/23 now trigger seemingly unrelated,
   but valid, cppcheck warnings: fix them directly there
 * In 19/23, only consider exact matches for rules we're deleting,
   report an error if there are conflicts that are not exact matches.
   Further, address (other) comments by Laurent: a typo in the man
   page, a typo in a comment in fwd_rule_del(), and a serious issue
   in pesto's main where we would use the "inbound" table for -T / -U

Changes in v9:
 * Rework Makefile changes and solve conflicts so that we can drop the
   dependency on "Improvements to static checker invocation"
 * In 8/23, drop the "experimental" note from the man page
 * In 10/23, switch to protocol version 1, add basil to the magic sauce
 * In 11/23, initialise struct pesto_pif_info sent by the server
   (details in commit message)
 * In 15/23, add description for -s / --show to pesto.1 as well
 * In 18/23, make comments about redundant checks more verbose
 * In 19/23, make it clear that tables handled by fwd_rule_del() can't
   refer to any open socket, add a TODO to fwd_rule_clear() in that
   sense as well, and use pif_conf_by_name() in pesto to find the
   table we need to clear
 * Add 19/23 to 23/23 (LSM policies, packaging stuff) to make pesto
   ready for shipping

Changes in v8:
 * Implement --add, --delete, and --clear in 19/19, to add forwarding
   rules instead of replacing tables, delete existing rules, and
   explicitly clear tables
 * Address Laurent's comments for 15/19 and 17/19
 * In 10/19, instead of passing SOCK_NONBLOCK to accept4(), explicitly
   set O_NONBLOCK on the listening socket. Using SOCK_NONBLOCK doesn't
   do what we want, as it results in setting O_NONBLOCK on the new
   socket rather than on the listening one
 * Note: 18/19 is left as it is, I didn't address pending comments
   yet
 * Note: this doesn't include yet changes for AppArmor and SELinux
   policies, as well as changes for the template Fedora spec file.
   I'm still working on them

Changes in v7:
 * Addressed comments from Laurent in 6/18, 8/18, 9/18, 10/18, 11/18,
   12/18, 14/18, 15/18 (details in commit messages of single patches,
   before my Signed-off-by)
 * Note: this doesn't include yet --add and --delete, I'm still
   working on that

Changes in v6:
 * Addressed comments from Jon in 10/18, 11/18, 14/18, and 16/18
 * Dodged all warnings from static checkers (Coverity Scan and
   clang-tidy) with changes in 10/18, 11/18, 16/18, and with a
   new patch, 18/18
 * This does *not* include yet the implementation of --add and
   --delete switches for pesto as I originally intended, I'm
   rather far from being done with those. At the moment I just
   have a "mode selection" implementation for command line
   parsing but merging rules to / removing rules from / clearing
   the current table is something I barely started (and what I
   have at the moment isn't really valuable anyway)

David wrote:

---
Here's the next draft of dynamic configuration updates.  This now can
successfully update rules, though I've not tested it very extensively.

Patches 1..8/18 are preliminary reworks that make sense even without
pesto - feel free to apply if you're happy with them.  I don't think
the rest should be applied yet; we need to at least harden it so passt
can't be blocked indefinitely by a client which sends a partial update
then waits.

Based on my earlier series reworking static checking invocation.

TODO:
 - Don't allow a client which sends a partial configuration then
   blocks also block passt
 - Allow pesto to clear existing configuration, not just add
 - Allow pesto selectively delete existing rules, not just add

Changes in v5:
 * If multiple clients connect at once, they're now blocked until the
   first one finishes, instead of later ones being discarded
Changes in v4:
 * Merged with remainder of forward rule parsing rework series
   * Fix some bugs in rule checking pointed out by Laurent
 * Significantly cleaned up option parsing code
 * Changed from replacing all existing rules to adding new rules
   (clear and remove still TBD)
 * Somewhat simplified protocol (pif names and rules sent in a single
   pass)
 * pesto is now allocation free
 * Fixed commit message and style nits pointed out by Stefano
Changes in v3:
 * Removed already applied ASSERT() rename
 * Renamed serialisation functions
 * Incorporated Stefano's extensions, reworked and fixed
 * Several additional cleanups / preliminary reworks
Changes in v2:
 * Removed already applied cleanups
 * Reworked assert() patch to handle -DNDEBUG properly
 * Numerous extra patches:
   * Factored out serialisation helpers and use them for migration as
     well
   * Reworked to allow ip.[ch] and inany.[ch] to be shared with pesto
   * Reworks to share some forwarding rule datatypes with pesto
   * Implemented sending pif names and current ruleset to pesto
---

David Gibson (17):
  conf, fwd: Stricter rule checking in fwd_rule_add()
  fwd_rule: Move ephemeral port probing to fwd_rule.c
  fwd, conf: Move rule parsing code to fwd_rule.[ch]
  fwd_rule: Move conflict checking back within fwd_rule_add()
  fwd: Generalise fwd_rules_info()
  pif: Limit pif names to 128 bytes
  fwd_rule: Fix some format specifiers
  pesto: Introduce stub configuration tool
  pesto, log: Share log.h (but not log.c) with pesto tool
  pesto, conf: Have pesto connect to passt and check versions
  pesto: Expose list of pifs to pesto and display them
  ip: Prepare ip.[ch] for sharing with pesto tool
  inany: Prepare inany.[ch] for sharing with pesto tool
  pesto: Read current ruleset from passt/pasta and optionally display it
  pesto: Parse and add new rules from command line
  pesto, conf: Send updated rules from pesto back to passt/pasta
  conf, fwd: Allow switching to new rules received from pesto

Stefano Brivio (6):
  fwd_rule: Fix static checkers warnings in fwd_rule_add()
  pesto, conf, fwd_rule: Add options and modes to add, delete, clear
    rules
  apparmor: Add policy file for pesto
  selinux: Add file context and type enforcement for pesto
  fedora: Install pesto, its SELinux policy, and the man page from the
    spec file
  hooks: Copy static build of pesto and related man page to server

 .gitignore                     |   2 +
 Makefile                       |  35 +-
 common.h                       | 116 ++++++
 conf.c                         | 696 ++++++++++++++------------------
 conf.h                         |   2 +
 contrib/apparmor/usr.bin.pesto |  23 ++
 contrib/fedora/passt.spec      |  14 +-
 contrib/selinux/pesto.fc       |  11 +
 contrib/selinux/pesto.te       |  95 +++++
 epoll_type.h                   |   4 +
 flow.c                         |   4 +-
 fwd.c                          | 169 ++------
 fwd.h                          |  41 +-
 fwd_rule.c                     | 705 +++++++++++++++++++++++++++++++--
 fwd_rule.h                     |  68 +++-
 hooks/pre-push                 |   1 +
 inany.c                        |  19 +-
 inany.h                        |  17 +-
 ip.c                           |  56 +--
 ip.h                           |   4 +-
 lineread.c                     |   2 +-
 log.h                          |  53 ++-
 passt.1                        |   5 +
 passt.c                        |   8 +
 passt.h                        |   8 +
 pasta.c                        |   4 +-
 pesto.1                        | 275 +++++++++++++
 pesto.c                        | 522 ++++++++++++++++++++++++
 pesto.h                        |  54 +++
 pif.c                          |   2 +-
 pif.h                          |   7 +-
 serialise.c                    |   7 +
 serialise.h                    |   1 +
 siphash.h                      |  13 +
 tap.c                          |  64 ++-
 util.h                         | 110 +----
 36 files changed, 2419 insertions(+), 798 deletions(-)
 create mode 100644 common.h
 create mode 100644 contrib/apparmor/usr.bin.pesto
 create mode 100644 contrib/selinux/pesto.fc
 create mode 100644 contrib/selinux/pesto.te
 create mode 100644 pesto.1
 create mode 100644 pesto.c
 create mode 100644 pesto.h

-- 
2.43.0