diff options
author | Simon THOBY <git@nightmared.fr> | 2022-12-03 22:32:42 +0100 |
---|---|---|
committer | Simon THOBY <git@nightmared.fr> | 2022-12-03 22:32:42 +0100 |
commit | 3b11070076f0509f9423d6c4f582f6cf636df65a (patch) | |
tree | 683a85842adec25d2a2f9d047523d35d0ece97c5 /src/rule.rs | |
parent | a11bbd5bf7854d714861ad9d56472c1402415123 (diff) |
convert Rule to the new macros
Diffstat (limited to 'src/rule.rs')
-rw-r--r-- | src/rule.rs | 186 |
1 files changed, 24 insertions, 162 deletions
diff --git a/src/rule.rs b/src/rule.rs index 5f2889e..5d13ac4 100644 --- a/src/rule.rs +++ b/src/rule.rs @@ -1,23 +1,36 @@ +use rustables_macros::nfnetlink_struct; + use crate::expr::ExpressionList; use crate::nlmsg::{NfNetlinkAttribute, NfNetlinkDeserializable, NfNetlinkObject, NfNetlinkWriter}; -use crate::parser::{DecodeError, InnerFormat, Parsable}; +use crate::parser::{DecodeError, Parsable}; use crate::query::list_objects_with_data; -use crate::sys::{self, NFT_MSG_DELRULE, NFT_MSG_NEWRULE, NLM_F_ACK, NLM_F_CREATE}; +use crate::sys::{ + NFTA_RULE_CHAIN, NFTA_RULE_EXPRESSIONS, NFTA_RULE_HANDLE, NFTA_RULE_ID, NFTA_RULE_POSITION, + NFTA_RULE_TABLE, NFTA_RULE_USERDATA, NFT_MSG_DELRULE, NFT_MSG_NEWRULE, NLM_F_ACK, NLM_F_CREATE, +}; +use crate::ProtocolFamily; use crate::{chain::Chain, MsgType}; -use crate::{impl_attr_getters_and_setters, impl_nfnetlinkattribute, ProtocolFamily}; use std::convert::TryFrom; use std::fmt::Debug; /// A nftables firewall rule. -#[derive(Clone, PartialEq, Eq, Default)] +#[derive(Clone, PartialEq, Eq, Default, Debug)] +#[nfnetlink_struct(derive_deserialize = false)] pub struct Rule { - id: Option<u32>, - handle: Option<u64>, - position: Option<u64>, - table: Option<String>, - chain: Option<String>, - userdata: Option<Vec<u8>>, - expressions: Option<ExpressionList>, + #[field(NFTA_RULE_TABLE)] + table: String, + #[field(NFTA_RULE_CHAIN)] + chain: String, + #[field(NFTA_RULE_HANDLE)] + handle: u64, + #[field(NFTA_RULE_EXPRESSIONS)] + expressions: ExpressionList, + #[field(NFTA_RULE_POSITION)] + position: u64, + #[field(NFTA_RULE_USERDATA)] + userdata: Vec<u8>, + #[field(NFTA_RULE_ID)] + id: u32, family: ProtocolFamily, } @@ -52,122 +65,6 @@ impl Rule { self.set_family(family); self } - - /* - /// Adds an expression to this rule. Expressions are evaluated from first to last added. - /// As soon as an expression does not match the packet it's being evaluated for, evaluation - /// stops and the packet is evaluated against the next rule in the chain. - pub fn add_expr(&mut self, expr: &impl Expression) { - unsafe { sys::nftnl_rule_add_expr(self.rule, expr.to_expr(self)) } - } - - /// Returns a reference to the [`Chain`] this rule lives in. - /// - /// [`Chain`]: struct.Chain.html - pub fn get_chain(&self) -> Rc<Chain> { - self.chain.clone() - } - - /// Returns the userdata of this chain. - pub fn get_userdata(&self) -> Option<&CStr> { - unsafe { - let ptr = sys::nftnl_rule_get_str(self.rule, sys::NFTNL_RULE_USERDATA as u16); - if !ptr.is_null() { - Some(CStr::from_ptr(ptr)) - } else { - None - } - } - } - - /// Updates the userdata of this chain. - pub fn set_userdata(&self, data: &CStr) { - unsafe { - sys::nftnl_rule_set_str(self.rule, sys::NFTNL_RULE_USERDATA as u16, data.as_ptr()); - } - } - - /// Returns a textual description of the rule. - pub fn get_str(&self) -> CString { - let mut descr_buf = vec![0i8; 4096]; - unsafe { - sys::nftnl_rule_snprintf( - descr_buf.as_mut_ptr() as *mut c_char, - (descr_buf.len() - 1) as u64, - self.rule, - sys::NFTNL_OUTPUT_DEFAULT, - 0, - ); - CStr::from_ptr(descr_buf.as_ptr() as *mut c_char).to_owned() - } - } - - /// Retrieves an iterator to loop over the expressions of the rule. - pub fn get_exprs(self: &Rc<Self>) -> RuleExprsIter { - RuleExprsIter::new(self.clone()) - } - - /// Performs a deep comparizon of rules, by checking they have the same expressions inside. - /// This is not enabled by default in our PartialEq implementation because of the difficulty to - /// compare an expression generated by the library with the expressions returned by the kernel - /// when iterating over the currently in-use rules. The kernel-returned expressions may have - /// additional attributes despite being generated from the same rule. This is particularly true - /// for the 'nat' expression). - pub fn deep_eq(&self, other: &Self) -> bool { - if self != other { - return false; - } - - let self_exprs = - try_alloc!(unsafe { sys::nftnl_expr_iter_create(self.rule as *const sys::nftnl_rule) }); - let other_exprs = try_alloc!(unsafe { - sys::nftnl_expr_iter_create(other.rule as *const sys::nftnl_rule) - }); - - loop { - let self_next = unsafe { sys::nftnl_expr_iter_next(self_exprs) }; - let other_next = unsafe { sys::nftnl_expr_iter_next(other_exprs) }; - if self_next.is_null() && other_next.is_null() { - return true; - } else if self_next.is_null() || other_next.is_null() { - return false; - } - - // we are falling back on comparing the strings, because there is no easy mechanism to - // perform a memcmp() between the two expressions :/ - let mut self_str = [0; 256]; - let mut other_str = [0; 256]; - unsafe { - sys::nftnl_expr_snprintf( - self_str.as_mut_ptr(), - (self_str.len() - 1) as u64, - self_next, - sys::NFTNL_OUTPUT_DEFAULT, - 0, - ); - sys::nftnl_expr_snprintf( - other_str.as_mut_ptr(), - (other_str.len() - 1) as u64, - other_next, - sys::NFTNL_OUTPUT_DEFAULT, - 0, - ); - } - - if self_str != other_str { - return false; - } - } - } - */ -} - -impl Debug for Rule { - fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { - let mut res = f.debug_struct("Rule"); - res.field("family", &self.family); - self.inner_format_struct(res)?.finish() - } } impl NfNetlinkObject for Rule { @@ -205,41 +102,6 @@ impl NfNetlinkDeserializable for Rule { } } -impl_attr_getters_and_setters!( - Rule, - [ - (get_table, set_table, with_table, sys::NFTA_RULE_TABLE, table, String), - (get_chain, set_chain, with_chain, sys::NFTA_RULE_CHAIN, chain, String), - (get_handle, set_handle, with_handle, sys::NFTA_RULE_HANDLE, handle, u64), - (get_expressions, set_expressions, with_expressions, sys::NFTA_RULE_EXPRESSIONS, expressions, ExpressionList), - // Sets the position of this rule within the chain it lives in. By default a new rule is added - // to the end of the chain. - (get_position, set_position, with_position, sys::NFTA_RULE_POSITION, position, u64), - ( - get_userdata, - set_userdata, - with_userdata, - sys::NFTA_RULE_USERDATA, - userdata, - Vec<u8> - ), - (get_id, set_id, with_id, sys::NFTA_RULE_ID, id, u32) - ] -); - -impl_nfnetlinkattribute!(inline : Rule, [ - (sys::NFTA_RULE_TABLE, table), - (sys::NFTA_RULE_CHAIN, chain), - (sys::NFTA_RULE_HANDLE, handle), - (sys::NFTA_RULE_EXPRESSIONS, expressions), - (sys::NFTA_RULE_POSITION, position), - ( - sys::NFTA_RULE_USERDATA, - userdata - ), - (sys::NFTA_RULE_ID, id) -]); - pub fn list_rules_for_chain(chain: &Chain) -> Result<Vec<Rule>, crate::query::Error> { let mut result = Vec::new(); list_objects_with_data( |