merge: port-range lowering + #18-21 fail-closed locks (bpf-portrange)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Copilot

regorus-bpf/bpf/egress.bpf.c

@@ -33,6 +33,7 @@
 // Scalar match kinds (must match regorus_bpf::plan::ScalarMatch).
 #define MATCH_ANY 0
 #define MATCH_EXACT 1
+#define MATCH_RANGE 2
 
 // Verdict ABI (must match regorus_bpf::abi::Verdict). UNDECIDED collapses to
 // DENY at the boundary, which for cgroup/connect4 means "return 0" (block).
@@ -42,13 +43,22 @@
 
 // One clause row: a full conjunction over the three observable fields. All
 // integer values are HOST byte order.
+//
+// The `port_kind` selects how the port is matched (mirrors
+// regorus_bpf::plan::ScalarMatch<u16>):
+//   * MATCH_ANY   -> wildcard (port ignored),
+//   * MATCH_EXACT -> port == port_value,
+//   * MATCH_RANGE -> port_min <= port <= port_max (inclusive). A range always
+//                    requires a present port, matching the Rust enforcer.
 struct clause_entry {
 	__u8 ip_kind;     // IP_ANY | IP_EXACT | IP_CIDR
 	__u8 prefix_len;  // valid when ip_kind == IP_CIDR (0..=32)
-	__u8 port_kind;   // MATCH_ANY | MATCH_EXACT
+	__u8 port_kind;   // MATCH_ANY | MATCH_EXACT | MATCH_RANGE
 	__u8 proto_kind;  // MATCH_ANY | MATCH_EXACT
 	__u32 ip_value;   // exact address or CIDR network (host order)
-	__u16 port_value; // exact port (host order)
+	__u16 port_value; // exact port (host order), valid when MATCH_EXACT
+	__u16 port_min;   // inclusive low bound, valid when MATCH_RANGE
+	__u16 port_max;   // inclusive high bound, valid when MATCH_RANGE
 	__u8 proto_value; // exact IPPROTO_*
 	__u8 _pad;
 };
@@ -102,7 +112,11 @@ static __always_inline bool port_matches(const struct clause_entry *c, __u16 por
 {
 	if (c->port_kind == MATCH_ANY)
 		return true;
-	return c->port_kind == MATCH_EXACT && port == c->port_value;
+	if (c->port_kind == MATCH_EXACT)
+		return port == c->port_value;
+	if (c->port_kind == MATCH_RANGE)
+		return port >= c->port_min && port <= c->port_max;
+	return false;
 }
 
 static __always_inline bool proto_matches(const struct clause_entry *c, __u8 proto)

regorus-bpf/src/enforcer.rs

@@ -73,10 +73,13 @@ fn ip_matches(m: IpMatch, value: Option<u32>) -> bool {
     }
 }
 
-fn scalar_matches<T: PartialEq + Copy>(m: ScalarMatch<T>, value: Option<T>) -> bool {
+fn scalar_matches<T: PartialOrd + Copy>(m: ScalarMatch<T>, value: Option<T>) -> bool {
     match m {
         ScalarMatch::Any => true,
         ScalarMatch::Exact(t) => value == Some(t),
+        // A range requires the field to be present (None never matches), which
+        // mirrors a Rego comparison over a missing field (fail-closed).
+        ScalarMatch::Range { min, max } => value.is_some_and(|v| v >= min && v <= max),
     }
 }
 

regorus-bpf/src/lib.rs

@@ -19,10 +19,11 @@
 //! - `input.proto`     — L4 protocol (`ctx->protocol`, e.g. `tcp`/`udp`).
 //!
 //! Supported atoms per allow-clause: `Eq` and `Membership` over those fields,
-//! and non-negated IPv4 `Cidr` over `input.dest_ip`. Everything else makes the
-//! clause **non-lowerable** and it is dropped from the exported plan (it stays
-//! in user-space RVM). Dropping a clause can only *remove* allows, never add
-//! them.
+//! non-negated IPv4 `Cidr` over `input.dest_ip`, and `Cmp` (`>=`/`>`/`<=`/`<`)
+//! port ranges over `input.dest_port` (multiple comparisons in one clause are
+//! intersected into a single inclusive range). Everything else makes the clause
+//! **non-lowerable** and it is dropped from the exported plan (it stays in
+//! user-space RVM). Dropping a clause can only *remove* allows, never add them.
 //!
 //! # The non-negotiable invariant
 //!

regorus-bpf/src/plan.rs

@@ -11,21 +11,42 @@
 //!
 //! Any atom this hook cannot represent (a non-observable field, a second atom
 //! on the same field, an unparseable/typed-wrong value, IPv6, negated CIDR, or
-//! any non-`Eq`/`Membership`/`Cidr` atom) makes the **whole clause**
-//! non-lowerable, and the clause is dropped from the plan. Dropping an allow
-//! clause can only remove allows, never add them — fail-closed.
+//! any non-`Eq`/`Membership`/`Cidr`/representable-`Cmp` atom) makes the
+//! **whole clause** non-lowerable, and the clause is dropped from the plan.
+//! Dropping an allow clause can only remove allows, never add them —
+//! fail-closed.
+//!
+//! ## Port ranges
+//!
+//! As a special case, the `dest_port` field accepts **multiple** `Cmp` atoms
+//! in one clause (e.g. `input.dest_port >= 1024` AND `input.dest_port <= 2048`).
+//! These are intersected into a single inclusive [`ScalarMatch::Range`]. The
+//! ordered comparisons `Ge`/`Gt`/`Le`/`Lt` map to half-open bounds clamped to
+//! `[0, u16::MAX]`; if the intersection is empty the clause matches nothing and
+//! is dropped (sound). Any `Cmp` that cannot be represented as a range bound
+//! (e.g. `Ne`, or a `negation_complement` where a missing field would match),
+//! or any mix of a `Cmp` with an `Eq`/`Membership` on the same `dest_port`
+//! field, makes the whole clause non-lowerable (fail-closed).
 
 use std::net::Ipv4Addr;
 
-use regorus_lift::ir::{Atom, Clause, EnforcerConfig, IpFamily, LiftScalar};
+use regorus_lift::ir::{Atom, Clause, CmpOp, EnforcerConfig, IpFamily, LiftScalar};
 
 use crate::abi::{FieldId, Proto, Verdict, MAX_CLAUSES};
 
-/// Per-field scalar match: wildcard or an exact value.
+/// Per-field scalar match: wildcard, an exact value, or an inclusive range.
+///
+/// `Range { min, max }` matches a present value `v` iff `min <= v <= max`
+/// (inclusive on both ends). A `Range` therefore requires the field to be
+/// **present** — a missing/None value never matches a `Range`, mirroring the
+/// fail-closed semantics of a Rego comparison over a missing field
+/// (`missing_matches = false`). Only `dest_port` ever lowers to a `Range`
+/// (from `>=`/`>`/`<=`/`<` comparisons); `proto` only ever uses `Any`/`Exact`.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ScalarMatch<T> {
     Any,
     Exact(T),
+    Range { min: T, max: T },
 }
 
 /// `dest_ip` match: wildcard, exact host-order IPv4, or an IPv4 CIDR network.
@@ -102,38 +123,24 @@ fn map_verdict(v: regorus_lift::Verdict) -> Verdict {
 /// Lower a single conjunction clause to one or more [`ClauseEntry`] rows, or
 /// `None` if any atom is not representable by this hook (reject the clause).
 fn lower_clause(clause: &Clause) -> Option<Vec<ClauseEntry>> {
-    // Alternatives per field. `None` = no constraining atom yet (wildcard).
-    let mut ip_alts: Option<Vec<IpMatch>> = None;
-    let mut port_alts: Option<Vec<ScalarMatch<u16>>> = None;
-    let mut proto_alts: Option<Vec<ScalarMatch<u8>>> = None;
+    // Gather atoms per field. The `dest_port` field may carry more than one
+    // atom (intersected `Cmp` range bounds); the others accept at most one.
+    let mut ip_atoms: Vec<&Atom> = Vec::new();
+    let mut port_atoms: Vec<&Atom> = Vec::new();
+    let mut proto_atoms: Vec<&Atom> = Vec::new();
 
     for atom in &clause.atoms {
         let field = FieldId::from_input_path(atom.input_path())?; // non-observable -> reject
         match field {
-            FieldId::DestIp => {
-                if ip_alts.is_some() {
-                    return None; // two atoms on the same field -> reject (fail-closed)
-                }
-                ip_alts = Some(lower_ip_atom(atom)?);
-            }
-            FieldId::DestPort => {
-                if port_alts.is_some() {
-                    return None;
-                }
-                port_alts = Some(lower_port_atom(atom)?);
-            }
-            FieldId::Proto => {
-                if proto_alts.is_some() {
-                    return None;
-                }
-                proto_alts = Some(lower_proto_atom(atom)?);
-            }
+            FieldId::DestIp => ip_atoms.push(atom),
+            FieldId::DestPort => port_atoms.push(atom),
+            FieldId::Proto => proto_atoms.push(atom),
         }
     }
 
-    let ip_alts = ip_alts.unwrap_or_else(|| vec![IpMatch::Any]);
-    let port_alts = port_alts.unwrap_or_else(|| vec![ScalarMatch::Any]);
-    let proto_alts = proto_alts.unwrap_or_else(|| vec![ScalarMatch::Any]);
+    let ip_alts = lower_ip_field(&ip_atoms)?;
+    let port_alts = lower_port_atoms(&port_atoms)?;
+    let proto_alts = lower_single_field(&proto_atoms, lower_proto_atom)?;
 
     // Bounded cross-product across the per-field alternatives.
     let product = ip_alts.len() * port_alts.len() * proto_alts.len();
@@ -151,6 +158,29 @@ fn lower_clause(clause: &Clause) -> Option<Vec<ClauseEntry>> {
     Some(entries)
 }
 
+/// Lower a field that accepts at most one constraining atom. Zero atoms is a
+/// wildcard; two or more atoms on the same field reject the clause (fail-closed).
+fn lower_single_field<T: Copy>(
+    atoms: &[&Atom],
+    lower: impl Fn(&Atom) -> Option<Vec<ScalarMatch<T>>>,
+) -> Option<Vec<ScalarMatch<T>>> {
+    match atoms {
+        [] => Some(vec![ScalarMatch::Any]),
+        [atom] => lower(atom),
+        _ => None, // two atoms on the same field -> reject (fail-closed)
+    }
+}
+
+/// Specialised variant of [`lower_single_field`] for the `dest_ip` field, whose
+/// matches use [`IpMatch`] rather than [`ScalarMatch`].
+fn lower_ip_field(atoms: &[&Atom]) -> Option<Vec<IpMatch>> {
+    match atoms {
+        [] => Some(vec![IpMatch::Any]),
+        [atom] => lower_ip_atom(atom),
+        _ => None,
+    }
+}
+
 fn lower_ip_atom(atom: &Atom) -> Option<Vec<IpMatch>> {
     match atom {
         Atom::Eq(eq) => Some(vec![IpMatch::Exact(parse_ipv4_scalar(&eq.scalar)?)]),
@@ -191,6 +221,60 @@ fn lower_ip_atom(atom: &Atom) -> Option<Vec<IpMatch>> {
     }
 }
 
+/// Lower the `dest_port` atoms of a clause.
+///
+/// - Zero atoms -> wildcard (`Any`).
+/// - A single `Eq` or `Membership` atom -> exact value(s), as before.
+/// - One or more `Cmp` atoms -> intersect into a single inclusive
+///   [`ScalarMatch::Range`]. An empty intersection drops the clause (sound).
+/// - Any other combination (a second `Eq`/`Membership`, or a `Cmp` mixed with
+///   an `Eq`/`Membership`, or an unrepresentable `Cmp`) -> reject (fail-closed).
+fn lower_port_atoms(atoms: &[&Atom]) -> Option<Vec<ScalarMatch<u16>>> {
+    if atoms.is_empty() {
+        return Some(vec![ScalarMatch::Any]);
+    }
+
+    // If every atom is a comparison, fold them into one intersected range.
+    if atoms.iter().all(|a| matches!(a, Atom::Cmp(_))) {
+        // Work in i64 so half-open adjustments and out-of-`u16` bounds can be
+        // represented before clamping to the observable `[0, u16::MAX]` window.
+        let mut lo: i64 = 0;
+        let mut hi: i64 = u16::MAX as i64;
+        for atom in atoms {
+            let Atom::Cmp(cmp) = atom else { return None };
+            // A comparison whose missing field would still match cannot be
+            // soundly represented by a presence-requiring range; reject.
+            if cmp.missing_matches {
+                return None;
+            }
+            let n = scalar_to_i64(&cmp.scalar)?;
+            match cmp.op {
+                CmpOp::Ge => lo = lo.max(n),
+                CmpOp::Gt => lo = lo.max(n.saturating_add(1)),
+                CmpOp::Le => hi = hi.min(n),
+                CmpOp::Lt => hi = hi.min(n.saturating_sub(1)),
+                CmpOp::Ne => return None, // not a single contiguous range
+            }
+        }
+        // Clamp to the observable u16 window, then test for emptiness.
+        let min = lo.max(0);
+        let max = hi.min(u16::MAX as i64);
+        if min > max {
+            return None; // empty range -> clause matches nothing -> drop
+        }
+        return Some(vec![ScalarMatch::Range {
+            min: min as u16,
+            max: max as u16,
+        }]);
+    }
+
+    // Otherwise only a single Eq/Membership atom is representable.
+    match atoms {
+        [atom] => lower_port_atom(atom),
+        _ => None,
+    }
+}
+
 fn lower_port_atom(atom: &Atom) -> Option<Vec<ScalarMatch<u16>>> {
     match atom {
         Atom::Eq(eq) => Some(vec![ScalarMatch::Exact(scalar_to_u16(&eq.scalar)?)]),
@@ -238,6 +322,17 @@ fn scalar_to_u16(scalar: &LiftScalar) -> Option<u16> {
     }
 }
 
+/// Convert an integer scalar to `i64` for range-bound arithmetic. A `Uint`
+/// larger than `i64::MAX` saturates to `i64::MAX` (a port bound far above the
+/// observable `u16` window, which clamps to an empty/degenerate range — sound).
+fn scalar_to_i64(scalar: &LiftScalar) -> Option<i64> {
+    match scalar {
+        LiftScalar::Int(i) => Some(*i),
+        LiftScalar::Uint(u) => Some(i64::try_from(*u).unwrap_or(i64::MAX)),
+        _ => None,
+    }
+}
+
 fn scalar_to_proto(scalar: &LiftScalar) -> Option<u8> {
     match scalar {
         LiftScalar::Str(s) => Proto::from_name(s).map(Proto::as_u8),