From: Stefan Hanreich <s.hanreich@proxmox.com>
To: pve-devel@lists.proxmox.com
Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
Subject: [pve-devel] [PATCH proxmox-firewall v3 19/39] nftables: expression: add types
Date: Thu, 18 Apr 2024 18:14:14 +0200 [thread overview]
Message-ID: <20240418161434.709473-20-s.hanreich@proxmox.com> (raw)
In-Reply-To: <20240418161434.709473-1-s.hanreich@proxmox.com>
Adds an enum containing most of the expressions defined in the
nftables-json schema [1].
[1] https://manpages.debian.org/bookworm/libnftables1/libnftables-json.5.en.html#EXPRESSIONS
Reviewed-by: Lukas Wagner <l.wagner@proxmox.com>
Reviewed-by: Max Carrara <m.carrara@proxmox.com>
Co-authored-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
proxmox-nftables/Cargo.toml | 2 +-
proxmox-nftables/src/expression.rs | 268 +++++++++++++++++++++++++++++
proxmox-nftables/src/lib.rs | 4 +
proxmox-nftables/src/types.rs | 53 ++++++
4 files changed, 326 insertions(+), 1 deletion(-)
create mode 100644 proxmox-nftables/src/expression.rs
create mode 100644 proxmox-nftables/src/types.rs
diff --git a/proxmox-nftables/Cargo.toml b/proxmox-nftables/Cargo.toml
index ebece9d..909869b 100644
--- a/proxmox-nftables/Cargo.toml
+++ b/proxmox-nftables/Cargo.toml
@@ -17,4 +17,4 @@ serde = { version = "1", features = [ "derive" ] }
serde_json = "1"
serde_plain = "1"
-proxmox-ve-config = { path = "../proxmox-ve-config", optional = true }
+proxmox-ve-config = { path = "../proxmox-ve-config" }
diff --git a/proxmox-nftables/src/expression.rs b/proxmox-nftables/src/expression.rs
new file mode 100644
index 0000000..5478291
--- /dev/null
+++ b/proxmox-nftables/src/expression.rs
@@ -0,0 +1,268 @@
+use crate::types::{ElemConfig, Verdict};
+use serde::{Deserialize, Serialize};
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+
+use crate::helper::NfVec;
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Expression {
+ Concat(Vec<Expression>),
+ Set(Vec<Expression>),
+ Range(Box<(Expression, Expression)>),
+ Map(Box<Map>),
+ Prefix(Prefix),
+ Payload(Payload),
+ Meta(Meta),
+ Ct(Ct),
+ Elem(Box<Element>),
+
+ #[serde(rename = "|")]
+ Or(Box<(Expression, Expression)>),
+ #[serde(rename = "&")]
+ And(Box<(Expression, Expression)>),
+ #[serde(rename = "^")]
+ Xor(Box<(Expression, Expression)>),
+ #[serde(rename = "<<")]
+ ShiftLeft(Box<(Expression, Expression)>),
+ #[serde(rename = ">>")]
+ ShiftRight(Box<(Expression, Expression)>),
+
+ #[serde(untagged)]
+ List(Vec<Expression>),
+
+ #[serde(untagged)]
+ Verdict(Verdict),
+
+ #[serde(untagged)]
+ Bool(bool),
+ #[serde(untagged)]
+ Number(i64),
+ #[serde(untagged)]
+ String(String),
+}
+
+impl Expression {
+ pub fn set(expressions: impl IntoIterator<Item = Expression>) -> Self {
+ Expression::Set(Vec::from_iter(expressions))
+ }
+
+ pub fn concat(expressions: impl IntoIterator<Item = Expression>) -> Self {
+ Expression::Concat(Vec::from_iter(expressions))
+ }
+}
+
+impl From<bool> for Expression {
+ #[inline]
+ fn from(v: bool) -> Self {
+ Expression::Bool(v)
+ }
+}
+
+impl From<i64> for Expression {
+ #[inline]
+ fn from(v: i64) -> Self {
+ Expression::Number(v)
+ }
+}
+
+impl From<u16> for Expression {
+ #[inline]
+ fn from(v: u16) -> Self {
+ Expression::Number(v.into())
+ }
+}
+
+impl From<u8> for Expression {
+ #[inline]
+ fn from(v: u8) -> Self {
+ Expression::Number(v.into())
+ }
+}
+
+impl From<&str> for Expression {
+ #[inline]
+ fn from(v: &str) -> Self {
+ Expression::String(v.to_string())
+ }
+}
+
+impl From<String> for Expression {
+ #[inline]
+ fn from(v: String) -> Self {
+ Expression::String(v)
+ }
+}
+
+impl From<Meta> for Expression {
+ #[inline]
+ fn from(meta: Meta) -> Self {
+ Expression::Meta(meta)
+ }
+}
+
+impl From<Ct> for Expression {
+ #[inline]
+ fn from(ct: Ct) -> Self {
+ Expression::Ct(ct)
+ }
+}
+
+impl From<Payload> for Expression {
+ #[inline]
+ fn from(payload: Payload) -> Self {
+ Expression::Payload(payload)
+ }
+}
+
+impl From<Prefix> for Expression {
+ #[inline]
+ fn from(prefix: Prefix) -> Self {
+ Expression::Prefix(prefix)
+ }
+}
+
+impl From<Verdict> for Expression {
+ #[inline]
+ fn from(value: Verdict) -> Self {
+ Expression::Verdict(value)
+ }
+}
+
+impl From<&IpAddr> for Expression {
+ fn from(value: &IpAddr) -> Self {
+ Expression::String(value.to_string())
+ }
+}
+
+impl From<&Ipv6Addr> for Expression {
+ fn from(address: &Ipv6Addr) -> Self {
+ Expression::String(address.to_string())
+ }
+}
+
+impl From<&Ipv4Addr> for Expression {
+ fn from(address: &Ipv4Addr) -> Self {
+ Expression::String(address.to_string())
+ }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum IpFamily {
+ Ip,
+ Ip6,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct Meta {
+ key: String,
+}
+
+impl Meta {
+ pub fn new(key: impl Into<String>) -> Self {
+ Self { key: key.into() }
+ }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct Map {
+ key: Expression,
+ data: Expression,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct Ct {
+ key: String,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ family: Option<IpFamily>,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ dir: Option<CtDirection>,
+}
+
+impl Ct {
+ pub fn new(key: impl Into<String>, family: impl Into<Option<IpFamily>>) -> Self {
+ Self {
+ key: key.into(),
+ family: family.into(),
+ dir: None,
+ }
+ }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum CtDirection {
+ Original,
+ Reply,
+}
+serde_plain::derive_display_from_serialize!(CtDirection);
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(untagged)]
+pub enum Payload {
+ Raw(PayloadRaw),
+ Field(PayloadField),
+}
+
+impl Payload {
+ pub fn field(protocol: impl Into<String>, field: impl Into<String>) -> Self {
+ Self::Field(PayloadField {
+ protocol: protocol.into(),
+ field: field.into(),
+ })
+ }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Serialize)]
+pub enum PayloadBase {
+ #[serde(rename = "ll")]
+ Link,
+ #[serde(rename = "nh")]
+ Network,
+ #[serde(rename = "th")]
+ Transport,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Serialize)]
+pub struct PayloadRaw {
+ base: PayloadBase,
+ offset: i64,
+ len: i64,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct PayloadField {
+ protocol: String,
+ field: String,
+}
+
+impl PayloadField {
+ pub fn protocol_for_ip_family(family: IpFamily) -> String {
+ match family {
+ IpFamily::Ip => "ip".to_string(),
+ IpFamily::Ip6 => "ip6".to_string(),
+ }
+ }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct Prefix {
+ addr: Box<Expression>,
+ len: u8,
+}
+
+impl Prefix {
+ pub fn new(addr: impl Into<Expression>, len: u8) -> Self {
+ Self {
+ addr: Box::new(addr.into()),
+ len,
+ }
+ }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct Element {
+ #[serde(flatten)]
+ config: ElemConfig,
+ val: Expression,
+}
diff --git a/proxmox-nftables/src/lib.rs b/proxmox-nftables/src/lib.rs
index 485bb81..712858b 100644
--- a/proxmox-nftables/src/lib.rs
+++ b/proxmox-nftables/src/lib.rs
@@ -1 +1,5 @@
+pub mod expression;
pub mod helper;
+pub mod types;
+
+pub use expression::Expression;
diff --git a/proxmox-nftables/src/types.rs b/proxmox-nftables/src/types.rs
new file mode 100644
index 0000000..942c866
--- /dev/null
+++ b/proxmox-nftables/src/types.rs
@@ -0,0 +1,53 @@
+use std::fmt::Display;
+
+use serde::{Deserialize, Serialize};
+
+use crate::helper::Null;
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Verdict {
+ Accept(Null),
+ Drop(Null),
+ Continue(Null),
+ Return(Null),
+ Goto { target: String },
+ Jump { target: String },
+}
+
+impl Display for Verdict {
+ fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+ let output = match self {
+ Verdict::Accept(_) => "ACCEPT",
+ Verdict::Drop(_) => "DROP",
+ Verdict::Continue(_) => "CONTINUE",
+ Verdict::Return(_) => "RETURN",
+ Verdict::Jump { .. } => "JUMP",
+ Verdict::Goto { .. } => "GOTO",
+ };
+
+ f.write_str(output)
+ }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ElemConfig {
+ timeout: Option<i64>,
+ expires: Option<i64>,
+ comment: Option<String>,
+}
+
+impl ElemConfig {
+ pub fn new(
+ timeout: impl Into<Option<i64>>,
+ expires: impl Into<Option<i64>>,
+ comment: impl Into<Option<String>>,
+ ) -> Self {
+ Self {
+ timeout: timeout.into(),
+ expires: expires.into(),
+ comment: comment.into(),
+ }
+ }
+}
+
--
2.39.2
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
next prev parent reply other threads:[~2024-04-19 7:31 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-18 16:13 [pve-devel] [PATCH container/docs/firewall/manager/proxmox-firewall/qemu-server v3 00/39] proxmox firewall nftables implementation Stefan Hanreich
2024-04-18 16:13 ` [pve-devel] [PATCH proxmox-firewall v3 01/39] config: add proxmox-ve-config crate Stefan Hanreich
2024-04-18 16:13 ` [pve-devel] [PATCH proxmox-firewall v3 02/39] config: firewall: add types for ip addresses Stefan Hanreich
2024-04-18 16:13 ` [pve-devel] [PATCH proxmox-firewall v3 03/39] config: firewall: add types for ports Stefan Hanreich
2024-04-18 16:13 ` [pve-devel] [PATCH proxmox-firewall v3 04/39] config: firewall: add types for log level and rate limit Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 05/39] config: firewall: add types for aliases Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 06/39] config: host: add helpers for host network configuration Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 07/39] config: guest: add helpers for parsing guest network config Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 08/39] config: firewall: add types for ipsets Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 09/39] config: firewall: add types for rules Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 10/39] config: firewall: add types for security groups Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 11/39] config: firewall: add generic parser for firewall configs Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 12/39] config: firewall: add cluster-specific config + option types Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 13/39] config: firewall: add host specific " Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 14/39] config: firewall: add guest-specific " Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 15/39] config: firewall: add firewall macros Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 16/39] config: firewall: add conntrack helper types Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 17/39] nftables: add crate for libnftables bindings Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 18/39] nftables: add helpers Stefan Hanreich
2024-04-18 16:14 ` Stefan Hanreich [this message]
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 20/39] nftables: expression: implement conversion traits for firewall config Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 21/39] nftables: statement: add types Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 22/39] nftables: statement: add conversion traits for config types Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 23/39] nftables: commands: add types Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 24/39] nftables: types: add conversion traits Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 25/39] nftables: add nft client Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 26/39] firewall: add firewall crate Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 27/39] firewall: add base ruleset Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 28/39] firewall: add config loader Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 29/39] firewall: add rule generation logic Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 30/39] firewall: add object " Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 31/39] firewall: add ruleset " Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 32/39] firewall: add proxmox-firewall binary and move existing code into lib Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 33/39] firewall: add files for debian packaging Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH proxmox-firewall v3 34/39] firewall: add integration test Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH qemu-server v3 35/39] firewall: add handling for new nft firewall Stefan Hanreich
2024-04-18 21:08 ` Thomas Lamprecht
2024-04-18 16:14 ` [pve-devel] [PATCH pve-container v3 36/39] " Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH pve-firewall v3 37/39] add configuration option for new nftables firewall Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH pve-manager v3 38/39] firewall: expose " Stefan Hanreich
2024-04-18 16:14 ` [pve-devel] [PATCH pve-docs v3 39/39] firewall: add documentation for proxmox-firewall Stefan Hanreich
2024-04-18 20:05 ` [pve-devel] partially-applied-series: [PATCH container/docs/firewall/manager/proxmox-firewall/qemu-server v3 00/39] proxmox firewall nftables implementation Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240418161434.709473-20-s.hanreich@proxmox.com \
--to=s.hanreich@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
--cc=w.bumiller@proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox