[pve-devel] [PATCH v1 proxmox-firewall] fix #7068: show rule comments in nftables output

[Robert Obkircher <r.obkircher@proxmox.com>]

Add rule comments from the config file to the generated nft rules.
Truncate them to at most 128 bytes to match the limit in libnftnl.

Signed-off-by: Robert Obkircher <r.obkircher@proxmox.com>
---
 proxmox-firewall/src/rule.rs | 37 +++++++++++++++++++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/proxmox-firewall/src/rule.rs b/proxmox-firewall/src/rule.rs
index b79f91c..f6c5e44 100644
--- a/proxmox-firewall/src/rule.rs
+++ b/proxmox-firewall/src/rule.rs
@@ -36,14 +36,19 @@ pub(crate) struct NftRule {
     family: Option<Family>,
     statements: Vec<Statement>,
     terminal_statements: Vec<Statement>,
+    comment: Option<String>,
 }
 
 impl NftRule {
+    /// from NFTNL_UDATA_COMMENT_MAXLEN
+    pub const MAX_COMMENT_LEN: usize = 128;
+
     pub fn from_terminal_statements(terminal_statements: Vec<Statement>) -> Self {
         Self {
             family: None,
             statements: Vec::new(),
             terminal_statements,
+            comment: None,
         }
     }
 
@@ -52,6 +57,7 @@ impl NftRule {
             family: None,
             statements: Vec::new(),
             terminal_statements: vec![terminal_statement],
+            comment: None,
         }
     }
 
@@ -81,6 +87,24 @@ impl NftRule {
         ipfilter.to_nft_rules(&mut rules, env)?;
         Ok(rules)
     }
+
+    pub fn set_comment(&mut self, comment: &str) {
+        self.comment =
+            Some(comment[..my_floor_char_boundary(comment, Self::MAX_COMMENT_LEN)].to_string());
+    }
+}
+
+// TODO: replace with str::floor_char_boundary once rustc 1.91.0 is available
+fn my_floor_char_boundary(s: &str, index: usize) -> usize {
+    if index >= s.len() {
+        s.len()
+    } else {
+        s.char_indices()
+            .map(|(i, _)| i)
+            .take_while(|i| *i <= index)
+            .last()
+            .unwrap_or(0)
+    }
 }
 
 impl Deref for NftRule {
@@ -101,7 +125,12 @@ impl NftRule {
     pub fn into_add_rule(self, chain: ChainPart) -> AddRule {
         let statements = self.statements.into_iter().chain(self.terminal_statements);
 
-        AddRule::from_statements(chain, statements)
+        let result = AddRule::from_statements(chain, statements);
+        if let Some(comment) = self.comment {
+            result.with_comment(comment)
+        } else {
+            result
+        }
     }
 
     pub fn family(&self) -> Option<Family> {
@@ -175,11 +204,17 @@ impl ToNftRules for Rule {
     fn to_nft_rules(&self, rules: &mut Vec<NftRule>, env: &NftRuleEnv) -> Result<(), Error> {
         log::trace!("generating nft rules for config rule {self:?}");
 
+        let before = rules.len();
         match self.kind() {
             Kind::Match(rule) => rule.to_nft_rules(rules, env)?,
             Kind::Group(group) => group.to_nft_rules(rules, env)?,
         };
 
+        if let Some(comment) = self.comment() {
+            for nft_rule in &mut rules[before..] {
+                nft_rule.set_comment(comment);
+            }
+        }
         Ok(())
     }
 }
-- 
2.47.3



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel