aboutsummaryrefslogtreecommitdiff
path: root/src/rule.rs
diff options
context:
space:
mode:
authorSimon THOBY <git@nightmared.fr>2022-12-03 22:32:42 +0100
committerSimon THOBY <git@nightmared.fr>2022-12-03 22:32:42 +0100
commit3b11070076f0509f9423d6c4f582f6cf636df65a (patch)
tree683a85842adec25d2a2f9d047523d35d0ece97c5 /src/rule.rs
parenta11bbd5bf7854d714861ad9d56472c1402415123 (diff)
convert Rule to the new macros
Diffstat (limited to 'src/rule.rs')
-rw-r--r--src/rule.rs186
1 files changed, 24 insertions, 162 deletions
diff --git a/src/rule.rs b/src/rule.rs
index 5f2889e..5d13ac4 100644
--- a/src/rule.rs
+++ b/src/rule.rs
@@ -1,23 +1,36 @@
+use rustables_macros::nfnetlink_struct;
+
use crate::expr::ExpressionList;
use crate::nlmsg::{NfNetlinkAttribute, NfNetlinkDeserializable, NfNetlinkObject, NfNetlinkWriter};
-use crate::parser::{DecodeError, InnerFormat, Parsable};
+use crate::parser::{DecodeError, Parsable};
use crate::query::list_objects_with_data;
-use crate::sys::{self, NFT_MSG_DELRULE, NFT_MSG_NEWRULE, NLM_F_ACK, NLM_F_CREATE};
+use crate::sys::{
+ NFTA_RULE_CHAIN, NFTA_RULE_EXPRESSIONS, NFTA_RULE_HANDLE, NFTA_RULE_ID, NFTA_RULE_POSITION,
+ NFTA_RULE_TABLE, NFTA_RULE_USERDATA, NFT_MSG_DELRULE, NFT_MSG_NEWRULE, NLM_F_ACK, NLM_F_CREATE,
+};
+use crate::ProtocolFamily;
use crate::{chain::Chain, MsgType};
-use crate::{impl_attr_getters_and_setters, impl_nfnetlinkattribute, ProtocolFamily};
use std::convert::TryFrom;
use std::fmt::Debug;
/// A nftables firewall rule.
-#[derive(Clone, PartialEq, Eq, Default)]
+#[derive(Clone, PartialEq, Eq, Default, Debug)]
+#[nfnetlink_struct(derive_deserialize = false)]
pub struct Rule {
- id: Option<u32>,
- handle: Option<u64>,
- position: Option<u64>,
- table: Option<String>,
- chain: Option<String>,
- userdata: Option<Vec<u8>>,
- expressions: Option<ExpressionList>,
+ #[field(NFTA_RULE_TABLE)]
+ table: String,
+ #[field(NFTA_RULE_CHAIN)]
+ chain: String,
+ #[field(NFTA_RULE_HANDLE)]
+ handle: u64,
+ #[field(NFTA_RULE_EXPRESSIONS)]
+ expressions: ExpressionList,
+ #[field(NFTA_RULE_POSITION)]
+ position: u64,
+ #[field(NFTA_RULE_USERDATA)]
+ userdata: Vec<u8>,
+ #[field(NFTA_RULE_ID)]
+ id: u32,
family: ProtocolFamily,
}
@@ -52,122 +65,6 @@ impl Rule {
self.set_family(family);
self
}
-
- /*
- /// Adds an expression to this rule. Expressions are evaluated from first to last added.
- /// As soon as an expression does not match the packet it's being evaluated for, evaluation
- /// stops and the packet is evaluated against the next rule in the chain.
- pub fn add_expr(&mut self, expr: &impl Expression) {
- unsafe { sys::nftnl_rule_add_expr(self.rule, expr.to_expr(self)) }
- }
-
- /// Returns a reference to the [`Chain`] this rule lives in.
- ///
- /// [`Chain`]: struct.Chain.html
- pub fn get_chain(&self) -> Rc<Chain> {
- self.chain.clone()
- }
-
- /// Returns the userdata of this chain.
- pub fn get_userdata(&self) -> Option<&CStr> {
- unsafe {
- let ptr = sys::nftnl_rule_get_str(self.rule, sys::NFTNL_RULE_USERDATA as u16);
- if !ptr.is_null() {
- Some(CStr::from_ptr(ptr))
- } else {
- None
- }
- }
- }
-
- /// Updates the userdata of this chain.
- pub fn set_userdata(&self, data: &CStr) {
- unsafe {
- sys::nftnl_rule_set_str(self.rule, sys::NFTNL_RULE_USERDATA as u16, data.as_ptr());
- }
- }
-
- /// Returns a textual description of the rule.
- pub fn get_str(&self) -> CString {
- let mut descr_buf = vec![0i8; 4096];
- unsafe {
- sys::nftnl_rule_snprintf(
- descr_buf.as_mut_ptr() as *mut c_char,
- (descr_buf.len() - 1) as u64,
- self.rule,
- sys::NFTNL_OUTPUT_DEFAULT,
- 0,
- );
- CStr::from_ptr(descr_buf.as_ptr() as *mut c_char).to_owned()
- }
- }
-
- /// Retrieves an iterator to loop over the expressions of the rule.
- pub fn get_exprs(self: &Rc<Self>) -> RuleExprsIter {
- RuleExprsIter::new(self.clone())
- }
-
- /// Performs a deep comparizon of rules, by checking they have the same expressions inside.
- /// This is not enabled by default in our PartialEq implementation because of the difficulty to
- /// compare an expression generated by the library with the expressions returned by the kernel
- /// when iterating over the currently in-use rules. The kernel-returned expressions may have
- /// additional attributes despite being generated from the same rule. This is particularly true
- /// for the 'nat' expression).
- pub fn deep_eq(&self, other: &Self) -> bool {
- if self != other {
- return false;
- }
-
- let self_exprs =
- try_alloc!(unsafe { sys::nftnl_expr_iter_create(self.rule as *const sys::nftnl_rule) });
- let other_exprs = try_alloc!(unsafe {
- sys::nftnl_expr_iter_create(other.rule as *const sys::nftnl_rule)
- });
-
- loop {
- let self_next = unsafe { sys::nftnl_expr_iter_next(self_exprs) };
- let other_next = unsafe { sys::nftnl_expr_iter_next(other_exprs) };
- if self_next.is_null() && other_next.is_null() {
- return true;
- } else if self_next.is_null() || other_next.is_null() {
- return false;
- }
-
- // we are falling back on comparing the strings, because there is no easy mechanism to
- // perform a memcmp() between the two expressions :/
- let mut self_str = [0; 256];
- let mut other_str = [0; 256];
- unsafe {
- sys::nftnl_expr_snprintf(
- self_str.as_mut_ptr(),
- (self_str.len() - 1) as u64,
- self_next,
- sys::NFTNL_OUTPUT_DEFAULT,
- 0,
- );
- sys::nftnl_expr_snprintf(
- other_str.as_mut_ptr(),
- (other_str.len() - 1) as u64,
- other_next,
- sys::NFTNL_OUTPUT_DEFAULT,
- 0,
- );
- }
-
- if self_str != other_str {
- return false;
- }
- }
- }
- */
-}
-
-impl Debug for Rule {
- fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
- let mut res = f.debug_struct("Rule");
- res.field("family", &self.family);
- self.inner_format_struct(res)?.finish()
- }
}
impl NfNetlinkObject for Rule {
@@ -205,41 +102,6 @@ impl NfNetlinkDeserializable for Rule {
}
}
-impl_attr_getters_and_setters!(
- Rule,
- [
- (get_table, set_table, with_table, sys::NFTA_RULE_TABLE, table, String),
- (get_chain, set_chain, with_chain, sys::NFTA_RULE_CHAIN, chain, String),
- (get_handle, set_handle, with_handle, sys::NFTA_RULE_HANDLE, handle, u64),
- (get_expressions, set_expressions, with_expressions, sys::NFTA_RULE_EXPRESSIONS, expressions, ExpressionList),
- // Sets the position of this rule within the chain it lives in. By default a new rule is added
- // to the end of the chain.
- (get_position, set_position, with_position, sys::NFTA_RULE_POSITION, position, u64),
- (
- get_userdata,
- set_userdata,
- with_userdata,
- sys::NFTA_RULE_USERDATA,
- userdata,
- Vec<u8>
- ),
- (get_id, set_id, with_id, sys::NFTA_RULE_ID, id, u32)
- ]
-);
-
-impl_nfnetlinkattribute!(inline : Rule, [
- (sys::NFTA_RULE_TABLE, table),
- (sys::NFTA_RULE_CHAIN, chain),
- (sys::NFTA_RULE_HANDLE, handle),
- (sys::NFTA_RULE_EXPRESSIONS, expressions),
- (sys::NFTA_RULE_POSITION, position),
- (
- sys::NFTA_RULE_USERDATA,
- userdata
- ),
- (sys::NFTA_RULE_ID, id)
-]);
-
pub fn list_rules_for_chain(chain: &Chain) -> Result<Vec<Rule>, crate::query::Error> {
let mut result = Vec::new();
list_objects_with_data(