From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <shanreich@lana.proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by lists.proxmox.com (Postfix) with ESMTPS id 8338C9095B
for <pve-devel@lists.proxmox.com>; Tue, 2 Apr 2024 19:17:03 +0200 (CEST)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id E4018A828
for <pve-devel@lists.proxmox.com>; Tue, 2 Apr 2024 19:16:43 +0200 (CEST)
Received: from lana.proxmox.com (unknown [94.136.29.99])
by firstgate.proxmox.com (Proxmox) with ESMTP
for <pve-devel@lists.proxmox.com>; Tue, 2 Apr 2024 19:16:38 +0200 (CEST)
Received: by lana.proxmox.com (Postfix, from userid 10043)
id 75F8B2C3782; Tue, 2 Apr 2024 19:16:31 +0200 (CEST)
From: Stefan Hanreich <s.hanreich@proxmox.com>
To: pve-devel@lists.proxmox.com
Cc: Stefan Hanreich <s.hanreich@proxmox.com>,
Wolfgang Bumiller <w.bumiller@proxmox.com>
Date: Tue, 2 Apr 2024 19:16:13 +0200
Message-Id: <20240402171629.536804-22-s.hanreich@proxmox.com>
X-Mailer: git-send-email 2.39.2
In-Reply-To: <20240402171629.536804-1-s.hanreich@proxmox.com>
References: <20240402171629.536804-1-s.hanreich@proxmox.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-SPAM-LEVEL: Spam detection results: 0
AWL -0.319 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
DMARC_MISSING 0.1 Missing DMARC policy
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery
methods
RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_NONE 0.001 SPF: sender does not publish an SPF Record
Subject: [pve-devel] [PATCH proxmox-firewall 21/37] nftables: statement: add
types
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Tue, 02 Apr 2024 17:17:03 -0000
Adds an enum containing most of the statements defined in the
nftables-json schema [1].
[1] https://manpages.debian.org/bookworm/libnftables1/libnftables-json.5.en.html#STATEMENTS
Co-authored-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
proxmox-nftables/Cargo.toml | 1 +
proxmox-nftables/src/lib.rs | 2 +
proxmox-nftables/src/statement.rs | 321 ++++++++++++++++++++++++++++++
proxmox-nftables/src/types.rs | 17 ++
4 files changed, 341 insertions(+)
create mode 100644 proxmox-nftables/src/statement.rs
diff --git a/proxmox-nftables/Cargo.toml b/proxmox-nftables/Cargo.toml
index 7e607e8..153716d 100644
--- a/proxmox-nftables/Cargo.toml
+++ b/proxmox-nftables/Cargo.toml
@@ -15,6 +15,7 @@ config-ext = ["dep:proxmox-ve-config"]
[dependencies]
log = "0.4"
+anyhow = "1"
serde = { version = "1", features = [ "derive" ] }
serde_json = "1"
diff --git a/proxmox-nftables/src/lib.rs b/proxmox-nftables/src/lib.rs
index 712858b..40f6bab 100644
--- a/proxmox-nftables/src/lib.rs
+++ b/proxmox-nftables/src/lib.rs
@@ -1,5 +1,7 @@
pub mod expression;
pub mod helper;
+pub mod statement;
pub mod types;
pub use expression::Expression;
+pub use statement::Statement;
diff --git a/proxmox-nftables/src/statement.rs b/proxmox-nftables/src/statement.rs
new file mode 100644
index 0000000..e569f33
--- /dev/null
+++ b/proxmox-nftables/src/statement.rs
@@ -0,0 +1,321 @@
+use anyhow::{bail, Error};
+use serde::{Deserialize, Serialize};
+
+use crate::expression::Meta;
+use crate::helper::{NfVec, Null};
+use crate::types::{RateTimescale, RateUnit, Verdict};
+use crate::Expression;
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Statement {
+ Match(Match),
+ Mangle(Mangle),
+ Limit(Limit),
+ Notrack(Null),
+ Reject(Reject),
+ Set(Set),
+ Log(Log),
+ #[serde(rename = "ct helper")]
+ CtHelper(String),
+ Vmap(Vmap),
+ Comment(String),
+
+ #[serde(untagged)]
+ Verdict(Verdict),
+}
+
+impl Statement {
+ pub const fn make_accept() -> Self {
+ Statement::Verdict(Verdict::Accept(Null))
+ }
+
+ pub const fn make_drop() -> Self {
+ Statement::Verdict(Verdict::Drop(Null))
+ }
+
+ pub const fn make_return() -> Self {
+ Statement::Verdict(Verdict::Return(Null))
+ }
+
+ pub const fn make_continue() -> Self {
+ Statement::Verdict(Verdict::Continue(Null))
+ }
+
+ pub fn jump(target: impl Into<String>) -> Self {
+ Statement::Verdict(Verdict::Jump {
+ target: target.into(),
+ })
+ }
+
+ pub fn goto(target: impl Into<String>) -> Self {
+ Statement::Verdict(Verdict::Goto {
+ target: target.into(),
+ })
+ }
+}
+
+impl From<Match> for Statement {
+ #[inline]
+ fn from(m: Match) -> Statement {
+ Statement::Match(m)
+ }
+}
+
+impl From<Mangle> for Statement {
+ #[inline]
+ fn from(m: Mangle) -> Statement {
+ Statement::Mangle(m)
+ }
+}
+
+impl From<Reject> for Statement {
+ #[inline]
+ fn from(m: Reject) -> Statement {
+ Statement::Reject(m)
+ }
+}
+
+impl From<Set> for Statement {
+ #[inline]
+ fn from(m: Set) -> Statement {
+ Statement::Set(m)
+ }
+}
+
+impl From<Vmap> for Statement {
+ #[inline]
+ fn from(m: Vmap) -> Statement {
+ Statement::Vmap(m)
+ }
+}
+
+impl From<Log> for Statement {
+ #[inline]
+ fn from(log: Log) -> Statement {
+ Statement::Log(log)
+ }
+}
+
+impl<T: Into<Limit>> From<T> for Statement {
+ #[inline]
+ fn from(limit: T) -> Statement {
+ Statement::Limit(limit.into())
+ }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum RejectType {
+ #[serde(rename = "tcp reset")]
+ TcpRst,
+ IcmpX,
+ Icmp,
+ IcmpV6,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct Reject {
+ #[serde(rename = "type", skip_serializing_if = "Option::is_none")]
+ ty: Option<RejectType>,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ expr: Option<Expression>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub struct Log {
+ #[serde(skip_serializing_if = "Option::is_none")]
+ prefix: Option<String>,
+
+ #[serde(skip_serializing_if = "Option::is_none")]
+ group: Option<i64>,
+
+ #[serde(skip_serializing_if = "Option::is_none")]
+ snaplen: Option<i64>,
+
+ #[serde(skip_serializing_if = "Option::is_none")]
+ queue_threshold: Option<i64>,
+
+ #[serde(skip_serializing_if = "Option::is_none")]
+ level: Option<LogLevel>,
+
+ #[serde(default, skip_serializing_if = "Vec::is_empty")]
+ flags: NfVec<LogFlag>,
+}
+
+impl Log {
+ pub fn new_nflog(prefix: String, group: i64) -> Self {
+ Self {
+ prefix: Some(prefix),
+ group: Some(group),
+ ..Default::default()
+ }
+ }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum LogLevel {
+ Emerg,
+ Alert,
+ Crit,
+ Err,
+ Warn,
+ Notice,
+ Info,
+ Debug,
+ Audit,
+}
+
+impl LogLevel {
+ pub fn nflog_level(&self) -> u8 {
+ match self {
+ LogLevel::Emerg => 0,
+ LogLevel::Alert => 1,
+ LogLevel::Crit => 2,
+ LogLevel::Err => 3,
+ LogLevel::Warn => 4,
+ LogLevel::Notice => 5,
+ LogLevel::Info => 6,
+ LogLevel::Debug => 7,
+ LogLevel::Audit => 7,
+ }
+ }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum LogFlag {
+ #[serde(rename = "tcp sequence")]
+ TcpSequence,
+ #[serde(rename = "tcp options")]
+ TcpOptions,
+ #[serde(rename = "ip options")]
+ IpOptions,
+
+ Skuid,
+ Ether,
+ All,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(untagged)]
+pub enum Limit {
+ Named(String),
+ Anonymous(AnonymousLimit),
+}
+
+impl<T: Into<AnonymousLimit>> From<T> for Limit {
+ fn from(value: T) -> Self {
+ Limit::Anonymous(value.into())
+ }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, Default)]
+pub struct AnonymousLimit {
+ pub rate: i64,
+
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub rate_unit: Option<RateUnit>,
+
+ pub per: RateTimescale,
+
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub burst: Option<i64>,
+
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub burst_unit: Option<RateUnit>,
+
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub inv: Option<bool>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct Vmap {
+ key: Expression,
+ data: Expression,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct Match {
+ op: Operator,
+ left: Expression,
+ right: Expression,
+}
+
+impl Match {
+ pub fn new(op: Operator, left: impl Into<Expression>, right: impl Into<Expression>) -> Self {
+ Self {
+ op,
+ left: left.into(),
+ right: right.into(),
+ }
+ }
+
+ pub fn new_eq(left: impl Into<Expression>, right: impl Into<Expression>) -> Self {
+ Self::new(Operator::Eq, left, right)
+ }
+
+ pub fn new_ne(left: impl Into<Expression>, right: impl Into<Expression>) -> Self {
+ Self::new(Operator::Ne, left, right)
+ }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub enum Operator {
+ #[serde(rename = "&")]
+ And,
+ #[serde(rename = "|")]
+ Or,
+ #[serde(rename = "^")]
+ Xor,
+ #[serde(rename = "<<")]
+ ShiftLeft,
+ #[serde(rename = ">>")]
+ ShiftRight,
+ #[serde(rename = "==")]
+ Eq,
+ #[serde(rename = "!=")]
+ Ne,
+ #[serde(rename = "<")]
+ Lt,
+ #[serde(rename = ">")]
+ Gt,
+ #[serde(rename = "<=")]
+ Le,
+ #[serde(rename = ">=")]
+ Ge,
+ #[serde(rename = "in")]
+ In,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct Mangle {
+ pub key: Expression,
+ pub value: Expression,
+}
+
+impl Mangle {
+ pub fn set_mark(value: impl Into<Expression>) -> Self {
+ Self {
+ key: Meta::new("mark").into(),
+ value: value.into(),
+ }
+ }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum SetOperation {
+ Add,
+ Update,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct Set {
+ pub op: SetOperation,
+ pub elem: Expression,
+ pub set: String,
+ pub stmt: Option<NfVec<Statement>>,
+}
diff --git a/proxmox-nftables/src/types.rs b/proxmox-nftables/src/types.rs
index 942c866..b99747b 100644
--- a/proxmox-nftables/src/types.rs
+++ b/proxmox-nftables/src/types.rs
@@ -30,6 +30,23 @@ impl Display for Verdict {
}
}
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub enum RateUnit {
+ Packets,
+ Bytes,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, Default)]
+#[cfg_attr(test, derive(Eq, PartialEq))]
+#[serde(rename_all = "lowercase")]
+pub enum RateTimescale {
+ #[default]
+ Second,
+ Minute,
+ Hour,
+ Day,
+}
+
#[derive(Clone, Debug, Deserialize, Serialize)]
pub struct ElemConfig {
timeout: Option<i64>,
--
2.39.2