childflow 0.2.0

Forces DNS/proxy/interface for a child process tree and captures only its packets
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114

// Copyright (c) 2026 Blacknon. All rights reserved.
// Use of this source code is governed by an MIT license
// that can be found in the LICENSE file.

pub mod rootful;
pub mod rootless_internal;
pub mod types;

use anyhow::Result;
use nix::unistd::Pid;

use crate::capture::CaptureMode;
use crate::cli::Cli;
use crate::dns::DnsPlan;
use crate::namespace::{ChildNetworkBootstrap, NamespaceMode};
use crate::proxy::ProxyPlan;

pub use types::{NetworkBackend, NetworkPlan};

pub enum ChildBootstrap {
    Rootful,
    RootlessInternal(rootless_internal::ChildBootstrap),
}

impl ChildBootstrap {
    pub fn namespace_bootstrap(&self) -> Option<ChildNetworkBootstrap> {
        match self {
            Self::Rootful => None,
            Self::RootlessInternal(bootstrap) => Some(bootstrap.namespace_bootstrap()),
        }
    }
}

pub enum NetworkContext {
    Rootful(Box<rootful::NetworkContext>),
    RootlessInternal(rootless_internal::NetworkContext),
}

impl NetworkContext {
    pub fn capture_mode(&self) -> Option<CaptureMode> {
        match self {
            Self::Rootful(ctx) => Some(CaptureMode::AfPacket {
                interface_name: ctx.host_veth().to_string(),
            }),
            Self::RootlessInternal(ctx) => ctx.capture_mode(),
        }
    }

    pub fn dns_bind_addrs(&self) -> Option<(std::net::Ipv4Addr, std::net::Ipv6Addr)> {
        match self {
            Self::Rootful(ctx) => Some(ctx.dns_bind_addrs()),
            Self::RootlessInternal(_) => None,
        }
    }
}

pub fn namespace_mode(backend: NetworkBackend) -> NamespaceMode {
    match backend {
        NetworkBackend::Rootful => NamespaceMode::Rootful,
        NetworkBackend::RootlessInternal => NamespaceMode::RootlessInternal,
    }
}

pub fn prepare_child_bootstrap(cli: &Cli, plan: &NetworkPlan) -> Result<ChildBootstrap> {
    match cli.selected_backend() {
        NetworkBackend::Rootful => Ok(ChildBootstrap::Rootful),
        NetworkBackend::RootlessInternal => {
            rootless_internal::ChildBootstrap::prepare(plan).map(ChildBootstrap::RootlessInternal)
        }
    }
}

pub fn setup(params: NetworkSetupParams<'_>) -> Result<NetworkContext> {
    match params.cli.selected_backend() {
        NetworkBackend::Rootful => rootful::NetworkContext::setup(
            params.plan,
            params.run_id,
            params.child_pid,
            params.cli,
            params.tproxy_port,
        )
        .map(Box::new)
        .map(NetworkContext::Rootful),
        NetworkBackend::RootlessInternal => match params.child_bootstrap {
            ChildBootstrap::RootlessInternal(bootstrap) => rootless_internal::setup(
                params.plan,
                params.run_id,
                params.child_pid,
                params.cli,
                params.tproxy_port,
                rootless_internal::RootlessSetupParams {
                    dns_plan: params.dns_plan,
                    child_bootstrap: bootstrap,
                    proxy_plan: params.proxy_plan,
                },
            )
            .map(NetworkContext::RootlessInternal),
            ChildBootstrap::Rootful => unreachable!(
                "rootless-internal backend must not be paired with rootful child bootstrap"
            ),
        },
    }
}

pub struct NetworkSetupParams<'a> {
    pub plan: &'a NetworkPlan,
    pub run_id: &'a str,
    pub child_pid: Pid,
    pub cli: &'a Cli,
    pub dns_plan: &'a DnsPlan,
    pub tproxy_port: Option<u16>,
    pub child_bootstrap: &'a mut ChildBootstrap,
    pub proxy_plan: Option<&'a ProxyPlan>,
}