Re: [pve-devel] [PATCH proxmox-firewall 11/37] config: firewall: add generic parser for firewall configs

["Max Carrara" <m.carrara@proxmox.com>]

On Tue Apr 2, 2024 at 7:16 PM CEST, Stefan Hanreich wrote:
> Since the basic format of cluster, host and guest firewall
> configurations is the same, we create a generic parser that can handle
> the common config format. The main difference is in the available
> options, which can be passed via a generic parameter.
>
> Co-authored-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
>  proxmox-ve-config/src/firewall/common.rs | 182 +++++++++++++++++++++
>  proxmox-ve-config/src/firewall/mod.rs    |   1 +
>  proxmox-ve-config/src/firewall/parse.rs  | 200 +++++++++++++++++++++++
>  3 files changed, 383 insertions(+)
>  create mode 100644 proxmox-ve-config/src/firewall/common.rs
>
> diff --git a/proxmox-ve-config/src/firewall/common.rs b/proxmox-ve-config/src/firewall/common.rs
> new file mode 100644
> index 0000000..887339b
> --- /dev/null
> +++ b/proxmox-ve-config/src/firewall/common.rs
> @@ -0,0 +1,182 @@
> +use std::collections::HashMap;
> +use std::io;
> +
> +use anyhow::{bail, format_err, Error};
> +use serde::de::IntoDeserializer;
> +
> +use crate::firewall::parse::{parse_named_section_tail, split_key_value, SomeString};
> +use crate::firewall::types::ipset::{IpsetName, IpsetScope};
> +use crate::firewall::types::{Alias, Group, Ipset, Rule};
> +
> +#[derive(Debug, Default)]
> +pub struct Config<O>
> +where
> +    O: Default + std::fmt::Debug + serde::de::DeserializeOwned,
> +{
> +    pub(crate) options: O,
> +    pub(crate) rules: Vec<Rule>,
> +    pub(crate) aliases: HashMap<String, Alias>,
> +    pub(crate) ipsets: HashMap<String, Ipset>,
> +    pub(crate) groups: HashMap<String, Group>,
> +}
> +
> +enum Sec {
> +    None,
> +    Options,
> +    Aliases,
> +    Rules,
> +    Ipset(String, Ipset),
> +    Group(String, Group),
> +}
> +
> +#[derive(Default)]
> +pub struct ParserConfig {
> +    /// Network interfaces must be of the form `netX`.
> +    pub guest_iface_names: bool,
> +    pub ipset_scope: Option<IpsetScope>,
> +}
> +
> +impl<O> Config<O>
> +where
> +    O: Default + std::fmt::Debug + serde::de::DeserializeOwned,
> +{
> +    pub fn new() -> Self {
> +        Self::default()
> +    }
> +
> +    pub fn parse<R: io::BufRead>(input: R, parser_cfg: &ParserConfig) -> Result<Self, Error> {
> +        let mut section = Sec::None;
> +
> +        let mut this = Self::new();
> +        let mut options = HashMap::new();
> +
> +        for line in input.lines() {
> +            let line = line?;
> +            let line = line.trim();
> +
> +            if line.is_empty() || line.starts_with('#') {
> +                continue;
> +            }
> +
> +            if line.eq_ignore_ascii_case("[OPTIONS]") {
> +                this.set_section(&mut section, Sec::Options)?;
> +            } else if line.eq_ignore_ascii_case("[ALIASES]") {
> +                this.set_section(&mut section, Sec::Aliases)?;
> +            } else if line.eq_ignore_ascii_case("[RULES]") {
> +                this.set_section(&mut section, Sec::Rules)?;
> +            } else if let Some(line) = line.strip_prefix("[IPSET") {
> +                let (name, comment) = parse_named_section_tail("ipset", line)?;
> +
> +                let scope = parser_cfg.ipset_scope.ok_or_else(|| {
> +                    format_err!("IPSET in config, but no scope set in parser config")
> +                })?;
> +
> +                let ipset_name = IpsetName::new(scope, name.to_string());
> +                let mut ipset = Ipset::new(ipset_name);
> +                ipset.comment = comment.map(str::to_owned);
> +
> +                this.set_section(&mut section, Sec::Ipset(name.to_string(), ipset))?;
> +            } else if let Some(line) = line.strip_prefix("[group") {
> +                let (name, comment) = parse_named_section_tail("group", line)?;
> +                let mut group = Group::new();
> +
> +                group.set_comment(comment.map(str::to_owned));
> +
> +                this.set_section(&mut section, Sec::Group(name.to_owned(), group))?;
> +            } else if line.starts_with('[') {
> +                bail!("invalid section {line:?}");
> +            } else {
> +                match &mut section {
> +                    Sec::None => bail!("config line with no section: {line:?}"),
> +                    Sec::Options => Self::parse_option(line, &mut options)?,
> +                    Sec::Aliases => this.parse_alias(line)?,
> +                    Sec::Rules => this.parse_rule(line, parser_cfg)?,
> +                    Sec::Ipset(_name, ipset) => ipset.parse_entry(line)?,
> +                    Sec::Group(_name, group) => group.parse_entry(line)?,
> +                }
> +            }
> +        }
> +        this.set_section(&mut section, Sec::None)?;
> +
> +        this.options = O::deserialize(IntoDeserializer::<
> +            '_,
> +            crate::firewall::parse::SerdeStringError,
> +        >::into_deserializer(options))?;
> +
> +        Ok(this)
> +    }
> +
> +    fn parse_option(line: &str, options: &mut HashMap<String, SomeString>) -> Result<(), Error> {
> +        let (key, value) = split_key_value(line)
> +            .ok_or_else(|| format_err!("expected colon separated key and value, found {line:?}"))?;
> +
> +        if options.insert(key.to_string(), value.into()).is_some() {
> +            bail!("duplicate option {key:?}");
> +        }
> +
> +        Ok(())
> +    }
> +
> +    fn parse_alias(&mut self, line: &str) -> Result<(), Error> {
> +        let alias: Alias = line.parse()?;
> +
> +        if self
> +            .aliases
> +            .insert(alias.name().to_string(), alias)
> +            .is_some()
> +        {
> +            bail!("duplicate alias: {line}");
> +        }
> +
> +        Ok(())
> +    }
> +
> +    fn parse_rule(&mut self, line: &str, parser_cfg: &ParserConfig) -> Result<(), Error> {
> +        let rule: Rule = line.parse()?;
> +
> +        if parser_cfg.guest_iface_names {
> +            if let Some(iface) = rule.iface() {
> +                let _ = iface
> +                    .strip_prefix("net")
> +                    .ok_or_else(|| {
> +                        format_err!("interface name must be of the form \"net<number>\"")
> +                    })?
> +                    .parse::<u16>()
> +                    .map_err(|_| {
> +                        format_err!("interface name must be of the form \"net<number>\"")
> +                    })?;
> +            }
> +        }
> +
> +        self.rules.push(rule);
> +        Ok(())
> +    }
> +
> +    fn set_section(&mut self, sec: &mut Sec, to: Sec) -> Result<(), Error> {
> +        let prev = std::mem::replace(sec, to);
> +
> +        match prev {
> +            Sec::Ipset(name, ipset) => {
> +                if self.ipsets.insert(name.clone(), ipset).is_some() {
> +                    bail!("duplicate ipset: {name:?}");
> +                }
> +            }
> +            Sec::Group(name, group) => {
> +                if self.groups.insert(name.clone(), group).is_some() {
> +                    bail!("duplicate group: {name:?}");
> +                }
> +            }
> +            _ => (),
> +        }
> +
> +        Ok(())
> +    }
> +
> +    pub fn ipsets(&self) -> &HashMap<String, Ipset> {
> +        &self.ipsets
> +    }
> +
> +    pub fn alias(&self, name: &str) -> Option<&Alias> {
> +        self.aliases.get(name)
> +    }
> +}
> diff --git a/proxmox-ve-config/src/firewall/mod.rs b/proxmox-ve-config/src/firewall/mod.rs
> index 2e0f31e..591ee52 100644
> --- a/proxmox-ve-config/src/firewall/mod.rs
> +++ b/proxmox-ve-config/src/firewall/mod.rs
> @@ -1,3 +1,4 @@
> +pub mod common;
>  pub mod ports;
>  pub mod types;
>  
> diff --git a/proxmox-ve-config/src/firewall/parse.rs b/proxmox-ve-config/src/firewall/parse.rs
> index 227e045..9cc2b8a 100644
> --- a/proxmox-ve-config/src/firewall/parse.rs
> +++ b/proxmox-ve-config/src/firewall/parse.rs
> @@ -61,6 +61,16 @@ pub fn match_digits(line: &str) -> Option<(&str, &str)> {
>  
>      None
>  }
> +
> +/// Separate a `key: value` line, trimming whitespace.
> +///
> +/// Returns `None` if the `key` would be empty.
> +pub fn split_key_value(line: &str) -> Option<(&str, &str)> {
> +    line.split_once(':')
> +        .map(|(key, value)| (key.trim(), value.trim()))
> +}
> +
> +/// Parse a boolean.
>  pub fn parse_bool(value: &str) -> Result<bool, Error> {
>      Ok(
>          if value == "0"
> @@ -81,6 +91,196 @@ pub fn parse_bool(value: &str) -> Result<bool, Error> {
>      )
>  }
>  
> +/// Parse the *remainder* of a section line, that is `<whitespace>NAME] #optional comment`.
> +/// The `kind` parameter is used for error messages and should be the section type.
> +///
> +/// Return the name and the optional comment.
> +pub fn parse_named_section_tail<'a>(
> +    kind: &'static str,
> +    line: &'a str,
> +) -> Result<(&'a str, Option<&'a str>), Error> {
> +    if line.is_empty() || !line.as_bytes()[0].is_ascii_whitespace() {
> +        bail!("incomplete {kind} section");
> +    }
> +
> +    let line = line.trim_start();
> +    let (name, line) = match_name(line)
> +        .ok_or_else(|| format_err!("expected a name for the {kind} at {line:?}"))?;
> +
> +    let line = line
> +        .strip_prefix(']')
> +        .ok_or_else(|| format_err!("expected closing ']' in {kind} section header"))?
> +        .trim_start();
> +
> +    Ok(match line.strip_prefix('#') {
> +        Some(comment) => (name, Some(comment.trim())),
> +        None if !line.is_empty() => bail!("trailing characters after {kind} section: {line:?}"),
> +        None => (name, None),
> +    })
> +}
> +
> +// parses a number from a string OR number
> +pub mod serde_option_number {

Since this is `pub`, I think a more complete docstring here would be
better instead of a comment. Though I haven't generated the docs for all
of this (yet) I have to admit, so I'm not sure if this actually shows
up.

> +    use std::fmt;
> +
> +    use serde::de::{Deserializer, Error, Visitor};
> +
> +    pub fn deserialize<'de, D: Deserializer<'de>>(
> +        deserializer: D,
> +    ) -> Result<Option<i64>, D::Error> {
> +        struct V;
> +
> +        impl<'de> Visitor<'de> for V {
> +            type Value = Option<i64>;
> +
> +            fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
> +                f.write_str("a numerical value")
> +            }
> +
> +            fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
> +                v.parse().map_err(E::custom).map(Some)
> +            }
> +
> +            fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
> +                Ok(None)
> +            }
> +
> +            fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
> +            where
> +                D: Deserializer<'de>,
> +            {
> +                deserializer.deserialize_any(self)
> +            }
> +        }
> +
> +        deserializer.deserialize_any(V)
> +    }
> +}
> +
> +// parses a bool from a string OR bool
> +pub mod serde_option_bool {

^ Same as above.

> +    use std::fmt;
> +
> +    use serde::de::{Deserializer, Error, Visitor};
> +
> +    pub fn deserialize<'de, D: Deserializer<'de>>(
> +        deserializer: D,
> +    ) -> Result<Option<bool>, D::Error> {
> +        struct V;
> +
> +        impl<'de> Visitor<'de> for V {
> +            type Value = Option<bool>;
> +
> +            fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
> +                f.write_str("a boolean-like value")
> +            }
> +
> +            fn visit_bool<E: Error>(self, v: bool) -> Result<Self::Value, E> {
> +                Ok(Some(v))
> +            }
> +
> +            fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
> +                super::parse_bool(v).map_err(E::custom).map(Some)
> +            }
> +
> +            fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
> +                Ok(None)
> +            }
> +
> +            fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
> +            where
> +                D: Deserializer<'de>,
> +            {
> +                deserializer.deserialize_any(self)
> +            }
> +        }
> +
> +        deserializer.deserialize_any(V)
> +    }
> +}
> +
> +// parses a comma_separated list of strings
> +pub mod serde_option_conntrack_helpers {

^ Same as above here as well.

> +    use std::fmt;
> +
> +    use serde::de::{Deserializer, Error, Visitor};
> +
> +    pub fn deserialize<'de, D: Deserializer<'de>>(
> +        deserializer: D,
> +    ) -> Result<Option<Vec<String>>, D::Error> {
> +        struct V;
> +
> +        impl<'de> Visitor<'de> for V {
> +            type Value = Option<Vec<String>>;
> +
> +            fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
> +                f.write_str("A list of conntrack helpers")
> +            }
> +
> +            fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
> +                if v.is_empty() {
> +                    return Ok(None);
> +                }
> +
> +                Ok(Some(v.split(',').map(String::from).collect()))
> +            }
> +
> +            fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
> +                Ok(None)
> +            }
> +
> +            fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
> +            where
> +                D: Deserializer<'de>,
> +            {
> +                deserializer.deserialize_any(self)
> +            }
> +        }
> +
> +        deserializer.deserialize_any(V)
> +    }
> +}
> +
> +// parses a log_ratelimit string: '[enable=]<1|0> [,burst=<integer>] [,rate=<rate>]'
> +pub mod serde_option_log_ratelimit {

^ And here.

> +    use std::fmt;
> +
> +    use serde::de::{Deserializer, Error, Visitor};
> +
> +    use crate::firewall::types::log::LogRateLimit;
> +
> +    pub fn deserialize<'de, D: Deserializer<'de>>(
> +        deserializer: D,
> +    ) -> Result<Option<LogRateLimit>, D::Error> {
> +        struct V;
> +
> +        impl<'de> Visitor<'de> for V {
> +            type Value = Option<LogRateLimit>;
> +
> +            fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
> +                f.write_str("a boolean-like value")
> +            }
> +
> +            fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
> +                v.parse().map_err(E::custom).map(Some)
> +            }
> +
> +            fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
> +                Ok(None)
> +            }
> +
> +            fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
> +            where
> +                D: Deserializer<'de>,
> +            {
> +                deserializer.deserialize_any(self)
> +            }
> +        }
> +
> +        deserializer.deserialize_any(V)
> +    }
> +}
> +
>  /// `&str` deserializer which also accepts an `Option`.
>  ///
>  /// Serde's `StringDeserializer` does not.