Re: [pve-devel] [PATCH proxmox-firewall 21/37] nftables: statement: add types

["Max Carrara" <m.carrara@proxmox.com>]

On Tue Apr 2, 2024 at 7:16 PM CEST, Stefan Hanreich wrote:
> Adds an enum containing most of the statements defined in the
> nftables-json schema [1].
>
> [1] https://manpages.debian.org/bookworm/libnftables1/libnftables-json.5.en.html#STATEMENTS
>
> Co-authored-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
>  proxmox-nftables/Cargo.toml       |   1 +
>  proxmox-nftables/src/lib.rs       |   2 +
>  proxmox-nftables/src/statement.rs | 321 ++++++++++++++++++++++++++++++
>  proxmox-nftables/src/types.rs     |  17 ++
>  4 files changed, 341 insertions(+)
>  create mode 100644 proxmox-nftables/src/statement.rs
>
> diff --git a/proxmox-nftables/Cargo.toml b/proxmox-nftables/Cargo.toml
> index 7e607e8..153716d 100644
> --- a/proxmox-nftables/Cargo.toml
> +++ b/proxmox-nftables/Cargo.toml
> @@ -15,6 +15,7 @@ config-ext = ["dep:proxmox-ve-config"]
>  
>  [dependencies]
>  log = "0.4"
> +anyhow = "1"
>  
>  serde = { version = "1", features = [ "derive" ] }
>  serde_json = "1"
> diff --git a/proxmox-nftables/src/lib.rs b/proxmox-nftables/src/lib.rs
> index 712858b..40f6bab 100644
> --- a/proxmox-nftables/src/lib.rs
> +++ b/proxmox-nftables/src/lib.rs
> @@ -1,5 +1,7 @@
>  pub mod expression;
>  pub mod helper;
> +pub mod statement;
>  pub mod types;
>  
>  pub use expression::Expression;
> +pub use statement::Statement;
> diff --git a/proxmox-nftables/src/statement.rs b/proxmox-nftables/src/statement.rs
> new file mode 100644
> index 0000000..e569f33
> --- /dev/null
> +++ b/proxmox-nftables/src/statement.rs
> @@ -0,0 +1,321 @@
> +use anyhow::{bail, Error};

Hmm, you don't use either here - you sure you didn't mean to introduce
`anyhow` later?

> +use serde::{Deserialize, Serialize};
> +
> +use crate::expression::Meta;
> +use crate::helper::{NfVec, Null};
> +use crate::types::{RateTimescale, RateUnit, Verdict};
> +use crate::Expression;
> +
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +#[serde(rename_all = "lowercase")]
> +pub enum Statement {
> +    Match(Match),
> +    Mangle(Mangle),
> +    Limit(Limit),
> +    Notrack(Null),
> +    Reject(Reject),
> +    Set(Set),
> +    Log(Log),
> +    #[serde(rename = "ct helper")]
> +    CtHelper(String),
> +    Vmap(Vmap),
> +    Comment(String),
> +
> +    #[serde(untagged)]
> +    Verdict(Verdict),
> +}
> +
> +impl Statement {
> +    pub const fn make_accept() -> Self {
> +        Statement::Verdict(Verdict::Accept(Null))
> +    }
> +
> +    pub const fn make_drop() -> Self {
> +        Statement::Verdict(Verdict::Drop(Null))
> +    }
> +
> +    pub const fn make_return() -> Self {
> +        Statement::Verdict(Verdict::Return(Null))
> +    }
> +
> +    pub const fn make_continue() -> Self {
> +        Statement::Verdict(Verdict::Continue(Null))
> +    }
> +
> +    pub fn jump(target: impl Into<String>) -> Self {
> +        Statement::Verdict(Verdict::Jump {
> +            target: target.into(),
> +        })
> +    }
> +
> +    pub fn goto(target: impl Into<String>) -> Self {
> +        Statement::Verdict(Verdict::Goto {
> +            target: target.into(),
> +        })
> +    }
> +}
> +
> +impl From<Match> for Statement {
> +    #[inline]
> +    fn from(m: Match) -> Statement {
> +        Statement::Match(m)
> +    }
> +}
> +
> +impl From<Mangle> for Statement {
> +    #[inline]
> +    fn from(m: Mangle) -> Statement {
> +        Statement::Mangle(m)
> +    }
> +}
> +
> +impl From<Reject> for Statement {
> +    #[inline]
> +    fn from(m: Reject) -> Statement {
> +        Statement::Reject(m)
> +    }
> +}
> +
> +impl From<Set> for Statement {
> +    #[inline]
> +    fn from(m: Set) -> Statement {
> +        Statement::Set(m)
> +    }
> +}
> +
> +impl From<Vmap> for Statement {
> +    #[inline]
> +    fn from(m: Vmap) -> Statement {
> +        Statement::Vmap(m)
> +    }
> +}
> +
> +impl From<Log> for Statement {
> +    #[inline]
> +    fn from(log: Log) -> Statement {
> +        Statement::Log(log)
> +    }
> +}
> +
> +impl<T: Into<Limit>> From<T> for Statement {
> +    #[inline]
> +    fn from(limit: T) -> Statement {
> +        Statement::Limit(limit.into())
> +    }
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +#[serde(rename_all = "lowercase")]
> +pub enum RejectType {
> +    #[serde(rename = "tcp reset")]
> +    TcpRst,
> +    IcmpX,
> +    Icmp,
> +    IcmpV6,
> +}
> +
> +#[derive(Clone, Debug, Default, Deserialize, Serialize)]
> +pub struct Reject {
> +    #[serde(rename = "type", skip_serializing_if = "Option::is_none")]
> +    ty: Option<RejectType>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    expr: Option<Expression>,
> +}
> +
> +#[derive(Clone, Debug, Default, Deserialize, Serialize)]
> +#[serde(rename_all = "kebab-case")]
> +pub struct Log {
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    prefix: Option<String>,
> +
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    group: Option<i64>,
> +
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    snaplen: Option<i64>,
> +
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    queue_threshold: Option<i64>,
> +
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    level: Option<LogLevel>,
> +
> +    #[serde(default, skip_serializing_if = "Vec::is_empty")]
> +    flags: NfVec<LogFlag>,
> +}
> +
> +impl Log {
> +    pub fn new_nflog(prefix: String, group: i64) -> Self {
> +        Self {
> +            prefix: Some(prefix),
> +            group: Some(group),
> +            ..Default::default()
> +        }
> +    }
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +#[serde(rename_all = "lowercase")]
> +pub enum LogLevel {
> +    Emerg,
> +    Alert,
> +    Crit,
> +    Err,
> +    Warn,
> +    Notice,
> +    Info,
> +    Debug,
> +    Audit,
> +}
> +
> +impl LogLevel {
> +    pub fn nflog_level(&self) -> u8 {
> +        match self {
> +            LogLevel::Emerg => 0,
> +            LogLevel::Alert => 1,
> +            LogLevel::Crit => 2,
> +            LogLevel::Err => 3,
> +            LogLevel::Warn => 4,
> +            LogLevel::Notice => 5,
> +            LogLevel::Info => 6,
> +            LogLevel::Debug => 7,
> +            LogLevel::Audit => 7,
> +        }
> +    }
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +#[serde(rename_all = "lowercase")]
> +pub enum LogFlag {
> +    #[serde(rename = "tcp sequence")]
> +    TcpSequence,
> +    #[serde(rename = "tcp options")]
> +    TcpOptions,
> +    #[serde(rename = "ip options")]
> +    IpOptions,
> +
> +    Skuid,
> +    Ether,
> +    All,
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +#[serde(untagged)]
> +pub enum Limit {
> +    Named(String),
> +    Anonymous(AnonymousLimit),
> +}
> +
> +impl<T: Into<AnonymousLimit>> From<T> for Limit {
> +    fn from(value: T) -> Self {
> +        Limit::Anonymous(value.into())
> +    }
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize, Default)]
> +pub struct AnonymousLimit {
> +    pub rate: i64,
> +
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub rate_unit: Option<RateUnit>,
> +
> +    pub per: RateTimescale,
> +
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub burst: Option<i64>,
> +
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub burst_unit: Option<RateUnit>,
> +
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub inv: Option<bool>,
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +pub struct Vmap {
> +    key: Expression,
> +    data: Expression,
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +pub struct Match {
> +    op: Operator,
> +    left: Expression,
> +    right: Expression,
> +}
> +
> +impl Match {
> +    pub fn new(op: Operator, left: impl Into<Expression>, right: impl Into<Expression>) -> Self {
> +        Self {
> +            op,
> +            left: left.into(),
> +            right: right.into(),
> +        }
> +    }
> +
> +    pub fn new_eq(left: impl Into<Expression>, right: impl Into<Expression>) -> Self {
> +        Self::new(Operator::Eq, left, right)
> +    }
> +
> +    pub fn new_ne(left: impl Into<Expression>, right: impl Into<Expression>) -> Self {
> +        Self::new(Operator::Ne, left, right)
> +    }
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +pub enum Operator {
> +    #[serde(rename = "&")]
> +    And,
> +    #[serde(rename = "|")]
> +    Or,
> +    #[serde(rename = "^")]
> +    Xor,
> +    #[serde(rename = "<<")]
> +    ShiftLeft,
> +    #[serde(rename = ">>")]
> +    ShiftRight,
> +    #[serde(rename = "==")]
> +    Eq,
> +    #[serde(rename = "!=")]
> +    Ne,
> +    #[serde(rename = "<")]
> +    Lt,
> +    #[serde(rename = ">")]
> +    Gt,
> +    #[serde(rename = "<=")]
> +    Le,
> +    #[serde(rename = ">=")]
> +    Ge,
> +    #[serde(rename = "in")]
> +    In,
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +pub struct Mangle {
> +    pub key: Expression,
> +    pub value: Expression,
> +}
> +
> +impl Mangle {
> +    pub fn set_mark(value: impl Into<Expression>) -> Self {
> +        Self {
> +            key: Meta::new("mark").into(),
> +            value: value.into(),
> +        }
> +    }
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +#[serde(rename_all = "lowercase")]
> +pub enum SetOperation {
> +    Add,
> +    Update,
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +pub struct Set {
> +    pub op: SetOperation,
> +    pub elem: Expression,
> +    pub set: String,
> +    pub stmt: Option<NfVec<Statement>>,
> +}
> diff --git a/proxmox-nftables/src/types.rs b/proxmox-nftables/src/types.rs
> index 942c866..b99747b 100644
> --- a/proxmox-nftables/src/types.rs
> +++ b/proxmox-nftables/src/types.rs
> @@ -30,6 +30,23 @@ impl Display for Verdict {
>      }
>  }
>  
> +#[derive(Clone, Debug, Deserialize, Serialize)]
> +pub enum RateUnit {
> +    Packets,
> +    Bytes,
> +}
> +
> +#[derive(Clone, Debug, Deserialize, Serialize, Default)]
> +#[cfg_attr(test, derive(Eq, PartialEq))]
> +#[serde(rename_all = "lowercase")]
> +pub enum RateTimescale {
> +    #[default]
> +    Second,
> +    Minute,
> +    Hour,
> +    Day,
> +}
> +
>  #[derive(Clone, Debug, Deserialize, Serialize)]
>  pub struct ElemConfig {
>      timeout: Option<i64>,