From 4dc522ae121ef9c8379b9efe248d0dc9625812cb Mon Sep 17 00:00:00 2001 From: Simon THOBY Date: Thu, 21 Oct 2021 22:37:23 +0200 Subject: Extend the `Expression` trait to allow for "deserialization" --- rustables/src/expr/log.rs | 50 +++++++++++++++++++++++++---------------------- 1 file changed, 27 insertions(+), 23 deletions(-) (limited to 'rustables/src/expr/log.rs') diff --git a/rustables/src/expr/log.rs b/rustables/src/expr/log.rs index aa7a8b7..8f52686 100644 --- a/rustables/src/expr/log.rs +++ b/rustables/src/expr/log.rs @@ -1,34 +1,28 @@ use super::{Expression, Rule}; use rustables_sys as sys; -use std::os::raw::c_char; use std::ffi::CString; +use std::os::raw::c_char; use thiserror::Error; /// A Log expression will log all packets that match the rule. pub struct Log { pub group: Option, - pub prefix: Option + pub prefix: Option, } impl Expression for Log { + fn get_raw_name() -> *const sys::libc::c_char { + b"log\0" as *const _ as *const c_char + } + fn to_expr(&self, _rule: &Rule) -> *mut sys::nftnl_expr { unsafe { - let expr = try_alloc!(sys::nftnl_expr_alloc( - b"log\0" as *const _ as *const c_char - )); + let expr = try_alloc!(sys::nftnl_expr_alloc(b"log\0" as *const _ as *const c_char)); if let Some(log_group) = self.group { - sys::nftnl_expr_set_u32( - expr, - sys::NFTNL_EXPR_LOG_GROUP as u16, - log_group.0 as u32, - ); + sys::nftnl_expr_set_u32(expr, sys::NFTNL_EXPR_LOG_GROUP as u16, log_group.0 as u32); }; if let Some(LogPrefix(prefix)) = &self.prefix { - sys::nftnl_expr_set_str( - expr, - sys::NFTNL_EXPR_LOG_PREFIX as u16, - prefix.as_ptr() - ); + sys::nftnl_expr_set_str(expr, sys::NFTNL_EXPR_LOG_PREFIX as u16, prefix.as_ptr()); }; expr @@ -41,8 +35,7 @@ pub enum LogPrefixError { #[error("The log prefix string is more than 128 characters long")] TooLongPrefix, #[error("The log prefix string contains an invalid Nul character.")] - PrefixContainsANul(#[from] std::ffi::NulError) - + PrefixContainsANul(#[from] std::ffi::NulError), } /// The NFLOG group that will be assigned to each log line. @@ -58,25 +51,36 @@ impl LogPrefix { /// that LogPrefix should not be more than 127 characters long. pub fn new(prefix: &str) -> Result { if prefix.chars().count() > 127 { - return Err(LogPrefixError::TooLongPrefix) + return Err(LogPrefixError::TooLongPrefix); } Ok(LogPrefix(CString::new(prefix)?)) } } - #[macro_export] macro_rules! nft_expr_log { (group $group:ident prefix $prefix:expr) => { - $crate::expr::Log { group: $group, prefix: $prefix } + $crate::expr::Log { + group: $group, + prefix: $prefix, + } }; (prefix $prefix:expr) => { - $crate::expr::Log { group: None, prefix: $prefix } + $crate::expr::Log { + group: None, + prefix: $prefix, + } }; (group $group:ident) => { - $crate::expr::Log { group: $group, prefix: None } + $crate::expr::Log { + group: $group, + prefix: None, + } }; () => { - $crate::expr::Log { group: None, prefix: None } + $crate::expr::Log { + group: None, + prefix: None, + } }; } -- cgit v1.2.3 From 867e2df78a0e92cab93f647c3eeccabca5b869a2 Mon Sep 17 00:00:00 2001 From: Simon THOBY Date: Fri, 22 Oct 2021 22:56:45 +0200 Subject: Add a (memory unsafe) manner to unserialize a few other expressions --- rustables/src/batch.rs | 1 + rustables/src/chain.rs | 3 +- rustables/src/expr/cmp.rs | 49 ++++++++++++++++++++++++++++-- rustables/src/expr/ct.rs | 18 +++++++++++ rustables/src/expr/immediate.rs | 38 ++++++++++++++++++++++- rustables/src/expr/log.rs | 28 ++++++++++++++++- rustables/src/expr/lookup.rs | 21 ++++++++++++- rustables/src/expr/masquerade.rs | 8 +++++ rustables/src/expr/mod.rs | 12 ++++++++ rustables/src/expr/nat.rs | 65 +++++++++++++++++++++++++++++++++++++++- 10 files changed, 236 insertions(+), 7 deletions(-) (limited to 'rustables/src/expr/log.rs') diff --git a/rustables/src/batch.rs b/rustables/src/batch.rs index c4cd6cb..3cdd52b 100644 --- a/rustables/src/batch.rs +++ b/rustables/src/batch.rs @@ -10,6 +10,7 @@ use thiserror::Error; #[error("Error while communicating with netlink")] pub struct NetlinkError(()); +#[cfg(feature = "query")] /// Check if the kernel supports batched netlink messages to netfilter. pub fn batch_is_supported() -> std::result::Result { match unsafe { sys::nftnl_batch_is_supported() } { diff --git a/rustables/src/chain.rs b/rustables/src/chain.rs index a616f90..3e28ab0 100644 --- a/rustables/src/chain.rs +++ b/rustables/src/chain.rs @@ -1,7 +1,8 @@ use crate::{MsgType, Table}; use rustables_sys::{self as sys, libc}; +#[cfg(feature = "query")] +use std::convert::TryFrom; use std::{ - convert::TryFrom, ffi::{c_void, CStr, CString}, fmt, os::raw::c_char, diff --git a/rustables/src/expr/cmp.rs b/rustables/src/expr/cmp.rs index b14aa1d..e4cfb0f 100644 --- a/rustables/src/expr/cmp.rs +++ b/rustables/src/expr/cmp.rs @@ -9,7 +9,7 @@ use std::{ }; /// Comparison operator. -#[derive(Copy, Clone, Eq, PartialEq)] +#[derive(Debug, Copy, Clone, Eq, PartialEq)] pub enum CmpOp { /// Equals. Eq, @@ -38,9 +38,23 @@ impl CmpOp { Gte => libc::NFT_CMP_GTE as u32, } } + + pub fn from_raw(val: u32) -> Option { + use self::CmpOp::*; + match val as i32 { + libc::NFT_CMP_EQ => Some(Eq), + libc::NFT_CMP_NEQ => Some(Neq), + libc::NFT_CMP_LT => Some(Lt), + libc::NFT_CMP_LTE => Some(Lte), + libc::NFT_CMP_GT => Some(Gt), + libc::NFT_CMP_GTE => Some(Gte), + _ => None, + } + } } /// Comparator expression. Allows comparing the content of the netfilter register with any value. +#[derive(Debug, PartialEq)] pub struct Cmp { op: CmpOp, data: T, @@ -54,11 +68,42 @@ impl Cmp { } } -impl Expression for Cmp { +impl Expression for Cmp { fn get_raw_name() -> *const c_char { b"cmp\0" as *const _ as *const c_char } + fn from_expr(expr: *const sys::nftnl_expr) -> Option + where + Self: Sized, + { + unsafe { + let ref_len = std::mem::size_of::() as u32; + let mut data_len = 0; + let data = sys::nftnl_expr_get( + expr, + sys::NFTNL_EXPR_CMP_DATA as u16, + &mut data_len as *mut u32, + ); + + if data.is_null() { + return None; + } else if data_len != ref_len { + debug!("Invalid size requested for deserializing a 'cmp' expression: expected {} bytes, got {}", ref_len, data_len); + return None; + } + + // Warning: this is *very* dangerous safety wise if the user supply us with + // a type that have the same size as T but a different memory layout. + // Is there a better way? And if there isn't, shouldn't we gate this behind + // an "unsafe" boundary? + let data = *(data as *const T); + + let op = CmpOp::from_raw(sys::nftnl_expr_get_u32(expr, sys::NFTNL_EXPR_CMP_OP as u16)); + op.map(|op| Cmp { op, data }) + } + } + fn to_expr(&self, _rule: &Rule) -> *mut sys::nftnl_expr { unsafe { let expr = try_alloc!(sys::nftnl_expr_alloc(Self::get_raw_name())); diff --git a/rustables/src/expr/ct.rs b/rustables/src/expr/ct.rs index 1f15858..9d58591 100644 --- a/rustables/src/expr/ct.rs +++ b/rustables/src/expr/ct.rs @@ -31,6 +31,24 @@ impl Expression for Conntrack { b"ct\0" as *const _ as *const c_char } + fn from_expr(expr: *const sys::nftnl_expr) -> Option + where + Self: Sized, + { + unsafe { + let ct_key = sys::nftnl_expr_get_u32(expr, sys::NFTNL_EXPR_CT_KEY as u16); + let ct_sreg_is_set = sys::nftnl_expr_is_set(expr, sys::NFTNL_EXPR_CT_SREG as u16); + + match ct_key as i32 { + libc::NFT_CT_STATE => Some(Conntrack::State), + libc::NFT_CT_MARK => Some(Conntrack::Mark { + set: ct_sreg_is_set, + }), + _ => None, + } + } + } + fn to_expr(&self, _rule: &Rule) -> *mut sys::nftnl_expr { unsafe { let expr = try_alloc!(sys::nftnl_expr_alloc(Self::get_raw_name())); diff --git a/rustables/src/expr/immediate.rs b/rustables/src/expr/immediate.rs index 15eb452..e8823b1 100644 --- a/rustables/src/expr/immediate.rs +++ b/rustables/src/expr/immediate.rs @@ -18,11 +18,47 @@ impl Immediate { } } -impl Expression for Immediate { +// The Copy requirement is present to allow us to dereference the newly created raw pointer in `from_expr` +impl Expression for Immediate { fn get_raw_name() -> *const c_char { b"immediate\0" as *const _ as *const c_char } + fn from_expr(expr: *const sys::nftnl_expr) -> Option + where + Self: Sized, + { + unsafe { + let ref_len = std::mem::size_of::() as u32; + let mut data_len = 0; + let data = sys::nftnl_expr_get( + expr, + sys::NFTNL_EXPR_IMM_DATA as u16, + &mut data_len as *mut u32, + ); + + if data.is_null() { + return None; + } else if data_len != ref_len { + debug!("Invalid size requested for deserializing an 'immediate' expression: expected {} bytes, got {}", ref_len, data_len); + return None; + } + + // Warning: this is *very* dangerous safety wise if the user supply us with + // a type that have the same size as T but a different memory layout. + // Is there a better way? And if there isn't, shouldn't we gate this behind + // an "unsafe" boundary? + let data = *(data as *const T); + + let register = Register::from_raw(sys::nftnl_expr_get_u32( + expr, + sys::NFTNL_EXPR_IMM_DREG as u16, + )); + + register.map(|register| Immediate { data, register }) + } + } + fn to_expr(&self, _rule: &Rule) -> *mut sys::nftnl_expr { unsafe { let expr = try_alloc!(sys::nftnl_expr_alloc(Self::get_raw_name())); diff --git a/rustables/src/expr/log.rs b/rustables/src/expr/log.rs index 8f52686..ba1244a 100644 --- a/rustables/src/expr/log.rs +++ b/rustables/src/expr/log.rs @@ -1,10 +1,11 @@ use super::{Expression, Rule}; use rustables_sys as sys; -use std::ffi::CString; +use std::ffi::{CStr, CString}; use std::os::raw::c_char; use thiserror::Error; /// A Log expression will log all packets that match the rule. +#[derive(Debug, PartialEq)] pub struct Log { pub group: Option, pub prefix: Option, @@ -15,6 +16,31 @@ impl Expression for Log { b"log\0" as *const _ as *const c_char } + fn from_expr(expr: *const sys::nftnl_expr) -> Option + where + Self: Sized, + { + unsafe { + let mut group = None; + if sys::nftnl_expr_is_set(expr, sys::NFTNL_EXPR_LOG_GROUP as u16) { + group = Some(LogGroup(sys::nftnl_expr_get_u32( + expr, + sys::NFTNL_EXPR_LOG_GROUP as u16, + ) as u16)); + } + let mut prefix = None; + if sys::nftnl_expr_is_set(expr, sys::NFTNL_EXPR_LOG_PREFIX as u16) { + let raw_prefix = sys::nftnl_expr_get_str(expr, sys::NFTNL_EXPR_LOG_PREFIX as u16); + if raw_prefix.is_null() { + trace!("Unexpected empty prefix in a 'log' expression"); + } else { + prefix = Some(LogPrefix(CStr::from_ptr(raw_prefix).to_owned())); + } + } + Some(Log { group, prefix }) + } + } + fn to_expr(&self, _rule: &Rule) -> *mut sys::nftnl_expr { unsafe { let expr = try_alloc!(sys::nftnl_expr_alloc(b"log\0" as *const _ as *const c_char)); diff --git a/rustables/src/expr/lookup.rs b/rustables/src/expr/lookup.rs index d9acbe6..b9a03d9 100644 --- a/rustables/src/expr/lookup.rs +++ b/rustables/src/expr/lookup.rs @@ -1,9 +1,10 @@ use super::{Expression, Rule}; use crate::set::Set; use rustables_sys::{self as sys, libc}; -use std::ffi::CString; +use std::ffi::{CStr, CString}; use std::os::raw::c_char; +#[derive(Debug, PartialEq)] pub struct Lookup { set_name: CString, set_id: u32, @@ -25,6 +26,24 @@ impl Expression for Lookup { b"lookup\0" as *const _ as *const c_char } + fn from_expr(expr: *const sys::nftnl_expr) -> Option + where + Self: Sized, + { + unsafe { + let set_name = sys::nftnl_expr_get_str(expr, sys::NFTNL_EXPR_LOOKUP_SET as u16); + let set_id = sys::nftnl_expr_get_u32(expr, sys::NFTNL_EXPR_LOOKUP_SET_ID as u16); + + if set_name.is_null() { + return None; + } + + let set_name = CStr::from_ptr(set_name).to_owned(); + + Some(Lookup { set_id, set_name }) + } + } + fn to_expr(&self, _rule: &Rule) -> *mut sys::nftnl_expr { unsafe { let expr = try_alloc!(sys::nftnl_expr_alloc(Self::get_raw_name())); diff --git a/rustables/src/expr/masquerade.rs b/rustables/src/expr/masquerade.rs index 31b98c0..bf4e0de 100644 --- a/rustables/src/expr/masquerade.rs +++ b/rustables/src/expr/masquerade.rs @@ -3,6 +3,7 @@ use rustables_sys as sys; use std::os::raw::c_char; /// Sets the source IP to that of the output interface. +#[derive(Debug, PartialEq)] pub struct Masquerade; impl Expression for Masquerade { @@ -10,6 +11,13 @@ impl Expression for Masquerade { b"masq\0" as *const _ as *const c_char } + fn from_expr(_expr: *const sys::nftnl_expr) -> Option + where + Self: Sized, + { + Some(Masquerade) + } + fn to_expr(&self, _rule: &Rule) -> *mut sys::nftnl_expr { try_alloc!(unsafe { sys::nftnl_expr_alloc(Self::get_raw_name()) }) } diff --git a/rustables/src/expr/mod.rs b/rustables/src/expr/mod.rs index 39ab2e0..f2a4d5e 100644 --- a/rustables/src/expr/mod.rs +++ b/rustables/src/expr/mod.rs @@ -89,6 +89,7 @@ pub trait Expression { #[derive(Debug, Copy, Clone, Eq, PartialEq, Hash)] #[repr(i32)] pub enum Register { + Verdict = libc::NFT_REG_VERDICT, Reg1 = libc::NFT_REG_1, Reg2 = libc::NFT_REG_2, Reg3 = libc::NFT_REG_3, @@ -99,6 +100,17 @@ impl Register { pub fn to_raw(self) -> u32 { self as u32 } + + pub fn from_raw(val: u32) -> Option { + match val as i32 { + libc::NFT_REG_VERDICT => Some(Self::Verdict), + libc::NFT_REG_1 => Some(Self::Reg1), + libc::NFT_REG_2 => Some(Self::Reg2), + libc::NFT_REG_3 => Some(Self::Reg3), + libc::NFT_REG_4 => Some(Self::Reg4), + _ => None, + } + } } mod bitwise; diff --git a/rustables/src/expr/nat.rs b/rustables/src/expr/nat.rs index 0970134..6bd0619 100644 --- a/rustables/src/expr/nat.rs +++ b/rustables/src/expr/nat.rs @@ -1,7 +1,7 @@ use super::{Expression, Register, Rule}; use crate::ProtoFamily; use rustables_sys::{self as sys, libc}; -use std::os::raw::c_char; +use std::{convert::TryFrom, os::raw::c_char}; #[derive(Debug, Copy, Clone, Eq, PartialEq, Hash)] #[repr(i32)] @@ -12,8 +12,19 @@ pub enum NatType { DNat = libc::NFT_NAT_DNAT, } +impl NatType { + fn from_raw(val: u32) -> Option { + match val as i32 { + libc::NFT_NAT_SNAT => Some(NatType::SNat), + libc::NFT_NAT_DNAT => Some(NatType::DNat), + _ => None, + } + } +} + /// A source or destination NAT statement. Modifies the source or destination address /// (and possibly port) of packets. +#[derive(Debug, PartialEq)] pub struct Nat { pub nat_type: NatType, pub family: ProtoFamily, @@ -26,6 +37,58 @@ impl Expression for Nat { b"nat\0" as *const _ as *const c_char } + fn from_expr(expr: *const sys::nftnl_expr) -> Option + where + Self: Sized, + { + unsafe { + let nat_type = NatType::from_raw(sys::nftnl_expr_get_u32( + expr, + sys::NFTNL_EXPR_NAT_TYPE as u16, + )); + let nat_type = match nat_type { + Some(x) => x, + None => return None, + }; + + let family = ProtoFamily::try_from(sys::nftnl_expr_get_u32( + expr, + sys::NFTNL_EXPR_NAT_FAMILY as u16, + ) as i32); + let family = match family { + Ok(x) => x, + Err(_) => return None, + }; + + let ip_register = Register::from_raw(sys::nftnl_expr_get_u32( + expr, + sys::NFTNL_EXPR_NAT_REG_ADDR_MIN as u16, + )); + let ip_register = match ip_register { + Some(x) => x, + None => return None, + }; + + let mut port_register = None; + if sys::nftnl_expr_is_set(expr, sys::NFTNL_EXPR_NAT_REG_PROTO_MIN as u16) { + port_register = Register::from_raw(sys::nftnl_expr_get_u32( + expr, + sys::NFTNL_EXPR_NAT_REG_PROTO_MIN as u16, + )); + if port_register.is_none() { + trace!("Invalid register in expression 'nat'"); + } + } + + Some(Nat { + ip_register, + nat_type, + family, + port_register, + }) + } + } + fn to_expr(&self, _rule: &Rule) -> *mut sys::nftnl_expr { let expr = try_alloc!(unsafe { sys::nftnl_expr_alloc(Self::get_raw_name()) }); -- cgit v1.2.3 From 7f7b2c3af6e6f7a596a85ada823408bdd0b02118 Mon Sep 17 00:00:00 2001 From: Simon THOBY Date: Sat, 23 Oct 2021 23:02:22 +0200 Subject: replace Optionnals by Results for a better error propagation when deserializing expressions --- rustables/src/expr/bitwise.rs | 3 +- rustables/src/expr/cmp.rs | 116 +++++-------------------------------- rustables/src/expr/counter.rs | 6 +- rustables/src/expr/ct.rs | 10 ++-- rustables/src/expr/immediate.rs | 54 ++++------------- rustables/src/expr/log.rs | 8 +-- rustables/src/expr/lookup.rs | 8 +-- rustables/src/expr/masquerade.rs | 6 +- rustables/src/expr/meta.rs | 46 +++++++-------- rustables/src/expr/mod.rs | 122 ++++++++++++++++++++++++++++++++++++++- rustables/src/expr/nat.rs | 39 ++++--------- rustables/src/expr/payload.rs | 80 +++++++++++++------------ rustables/src/expr/register.rs | 16 ++--- rustables/src/expr/reject.rs | 23 ++++---- rustables/src/expr/verdict.rs | 37 +++++++----- rustables/src/expr/wrapper.rs | 8 +-- 16 files changed, 285 insertions(+), 297 deletions(-) (limited to 'rustables/src/expr/log.rs') diff --git a/rustables/src/expr/bitwise.rs b/rustables/src/expr/bitwise.rs index 0c6c33c..a5d9343 100644 --- a/rustables/src/expr/bitwise.rs +++ b/rustables/src/expr/bitwise.rs @@ -1,5 +1,4 @@ -use super::{Expression, Rule}; -use crate::expr::cmp::ToSlice; +use super::{Expression, Rule, ToSlice}; use rustables_sys::{self as sys, libc}; use std::ffi::c_void; use std::os::raw::c_char; diff --git a/rustables/src/expr/cmp.rs b/rustables/src/expr/cmp.rs index 11825d6..f24b4ad 100644 --- a/rustables/src/expr/cmp.rs +++ b/rustables/src/expr/cmp.rs @@ -1,11 +1,9 @@ -use super::{Expression, Rule}; +use super::{DeserializationError, Expression, Rule, ToSlice}; use rustables_sys::{self as sys, libc}; use std::{ borrow::Cow, ffi::{c_void, CString}, - net::{IpAddr, Ipv4Addr, Ipv6Addr}, os::raw::c_char, - slice, }; /// Comparison operator. @@ -39,16 +37,16 @@ impl CmpOp { } } - pub fn from_raw(val: u32) -> Option { + pub fn from_raw(val: u32) -> Result { use self::CmpOp::*; match val as i32 { - libc::NFT_CMP_EQ => Some(Eq), - libc::NFT_CMP_NEQ => Some(Neq), - libc::NFT_CMP_LT => Some(Lt), - libc::NFT_CMP_LTE => Some(Lte), - libc::NFT_CMP_GT => Some(Gt), - libc::NFT_CMP_GTE => Some(Gte), - _ => None, + libc::NFT_CMP_EQ => Ok(Eq), + libc::NFT_CMP_NEQ => Ok(Neq), + libc::NFT_CMP_LT => Ok(Lt), + libc::NFT_CMP_LTE => Ok(Lte), + libc::NFT_CMP_GT => Ok(Gt), + libc::NFT_CMP_GTE => Ok(Gte), + _ => Err(DeserializationError::InvalidValue), } } } @@ -89,7 +87,7 @@ impl Expression for Cmp { sys::nftnl_expr_set( expr, sys::NFTNL_EXPR_CMP_DATA as u16, - data.as_ref() as *const _ as *const c_void, + data.as_ptr() as *const c_void, data.len() as u32, ); @@ -107,7 +105,7 @@ impl Expression for Cmp<[u8; N]> { // be *extremely* dangerous in terms of memory safety, // rustables only accept to deserialize expressions with variable-size data // to arrays of bytes, so that the memory layout cannot be invalid. - fn from_expr(expr: *const sys::nftnl_expr) -> Option { + fn from_expr(expr: *const sys::nftnl_expr) -> Result { unsafe { let ref_len = std::mem::size_of::<[u8; N]>() as u32; let mut data_len = 0; @@ -118,23 +116,22 @@ impl Expression for Cmp<[u8; N]> { ); if data.is_null() { - return None; + return Err(DeserializationError::NullPointer); } else if data_len != ref_len { - debug!("Invalid size requested for deserializing a 'cmp' expression: expected {} bytes, got {}", ref_len, data_len); - return None; + return Err(DeserializationError::InvalidDataSize); } let data = *(data as *const [u8; N]); - let op = CmpOp::from_raw(sys::nftnl_expr_get_u32(expr, sys::NFTNL_EXPR_CMP_OP as u16)); - op.map(|op| Cmp { op, data }) + let op = CmpOp::from_raw(sys::nftnl_expr_get_u32(expr, sys::NFTNL_EXPR_CMP_OP as u16))?; + Ok(Cmp { op, data }) } } // call to the other implementation to generate the expression fn to_expr(&self, rule: &Rule) -> *mut sys::nftnl_expr { Cmp { - data: self.data.as_ref(), + data: &self.data as &[u8], op: self.op, } .to_expr(rule) @@ -166,87 +163,6 @@ macro_rules! nft_expr_cmp { }; } -/// A type that can be converted into a byte buffer. -pub trait ToSlice { - /// Returns the data this type represents. - fn to_slice(&self) -> Cow<'_, [u8]>; -} - -impl<'a> ToSlice for &'a [u8] { - fn to_slice(&self) -> Cow<'_, [u8]> { - Cow::Borrowed(self) - } -} - -impl<'a> ToSlice for &'a [u16] { - fn to_slice(&self) -> Cow<'_, [u8]> { - let ptr = self.as_ptr() as *const u8; - let len = self.len() * 2; - Cow::Borrowed(unsafe { slice::from_raw_parts(ptr, len) }) - } -} - -impl ToSlice for IpAddr { - fn to_slice(&self) -> Cow<'_, [u8]> { - match *self { - IpAddr::V4(ref addr) => addr.to_slice(), - IpAddr::V6(ref addr) => addr.to_slice(), - } - } -} - -impl ToSlice for Ipv4Addr { - fn to_slice(&self) -> Cow<'_, [u8]> { - Cow::Owned(self.octets().to_vec()) - } -} - -impl ToSlice for Ipv6Addr { - fn to_slice(&self) -> Cow<'_, [u8]> { - Cow::Owned(self.octets().to_vec()) - } -} - -impl ToSlice for u8 { - fn to_slice(&self) -> Cow<'_, [u8]> { - Cow::Owned(vec![*self]) - } -} - -impl ToSlice for u16 { - fn to_slice(&self) -> Cow<'_, [u8]> { - let b0 = (*self & 0x00ff) as u8; - let b1 = (*self >> 8) as u8; - Cow::Owned(vec![b0, b1]) - } -} - -impl ToSlice for u32 { - fn to_slice(&self) -> Cow<'_, [u8]> { - let b0 = *self as u8; - let b1 = (*self >> 8) as u8; - let b2 = (*self >> 16) as u8; - let b3 = (*self >> 24) as u8; - Cow::Owned(vec![b0, b1, b2, b3]) - } -} - -impl ToSlice for i32 { - fn to_slice(&self) -> Cow<'_, [u8]> { - let b0 = *self as u8; - let b1 = (*self >> 8) as u8; - let b2 = (*self >> 16) as u8; - let b3 = (*self >> 24) as u8; - Cow::Owned(vec![b0, b1, b2, b3]) - } -} - -impl<'a> ToSlice for &'a str { - fn to_slice(&self) -> Cow<'_, [u8]> { - Cow::from(self.as_bytes()) - } -} - /// Can be used to compare the value loaded by [`Meta::IifName`] and [`Meta::OifName`]. Please /// note that it is faster to check interface index than name. /// diff --git a/rustables/src/expr/counter.rs b/rustables/src/expr/counter.rs index b507e80..099e7fa 100644 --- a/rustables/src/expr/counter.rs +++ b/rustables/src/expr/counter.rs @@ -1,4 +1,4 @@ -use super::{Expression, Rule}; +use super::{DeserializationError, Expression, Rule}; use rustables_sys as sys; use std::os::raw::c_char; @@ -24,11 +24,11 @@ impl Expression for Counter { b"counter\0" as *const _ as *const c_char } - fn from_expr(expr: *const sys::nftnl_expr) -> Option { + fn from_expr(expr: *const sys::nftnl_expr) -> Result { unsafe { let nb_bytes = sys::nftnl_expr_get_u64(expr, sys::NFTNL_EXPR_CTR_BYTES as u16); let nb_packets = sys::nftnl_expr_get_u64(expr, sys::NFTNL_EXPR_CTR_PACKETS as u16); - Some(Counter { + Ok(Counter { nb_bytes, nb_packets, }) diff --git a/rustables/src/expr/ct.rs b/rustables/src/expr/ct.rs index 9d58591..001aef8 100644 --- a/rustables/src/expr/ct.rs +++ b/rustables/src/expr/ct.rs @@ -1,4 +1,4 @@ -use super::{Expression, Rule}; +use super::{DeserializationError, Expression, Rule}; use rustables_sys::{self as sys, libc}; use std::os::raw::c_char; @@ -31,7 +31,7 @@ impl Expression for Conntrack { b"ct\0" as *const _ as *const c_char } - fn from_expr(expr: *const sys::nftnl_expr) -> Option + fn from_expr(expr: *const sys::nftnl_expr) -> Result where Self: Sized, { @@ -40,11 +40,11 @@ impl Expression for Conntrack { let ct_sreg_is_set = sys::nftnl_expr_is_set(expr, sys::NFTNL_EXPR_CT_SREG as u16); match ct_key as i32 { - libc::NFT_CT_STATE => Some(Conntrack::State), - libc::NFT_CT_MARK => Some(Conntrack::Mark { + libc::NFT_CT_STATE => Ok(Conntrack::State), + libc::NFT_CT_MARK => Ok(Conntrack::Mark { set: ct_sreg_is_set, }), - _ => None, + _ => Err(DeserializationError::InvalidValue), } } } diff --git a/rustables/src/expr/immediate.rs b/rustables/src/expr/immediate.rs index 1196211..b5be101 100644 --- a/rustables/src/expr/immediate.rs +++ b/rustables/src/expr/immediate.rs @@ -1,7 +1,6 @@ -use super::{Expression, Register, Rule, ToSlice}; +use super::{DeserializationError, Expression, Register, Rule, ToSlice}; use rustables_sys as sys; use std::ffi::c_void; -use std::mem::size_of_val; use std::os::raw::c_char; /// An immediate expression. Used to set immediate data. @@ -33,11 +32,12 @@ impl Expression for Immediate { self.register.to_raw(), ); + let data = self.data.to_slice(); sys::nftnl_expr_set( expr, sys::NFTNL_EXPR_IMM_DATA as u16, - &self.data.to_slice() as *const _ as *const c_void, - size_of_val(&self.data) as u32, + data.as_ptr() as *const c_void, + data.len() as u32, ); expr @@ -54,7 +54,7 @@ impl Expression for Immediate<[u8; N]> { // be *extremely* dangerous in terms of memory safety, // rustables only accept to deserialize expressions with variable-size data // to arrays of bytes, so that the memory layout cannot be invalid. - fn from_expr(expr: *const sys::nftnl_expr) -> Option { + fn from_expr(expr: *const sys::nftnl_expr) -> Result { unsafe { let ref_len = std::mem::size_of::<[u8; N]>() as u32; let mut data_len = 0; @@ -65,10 +65,9 @@ impl Expression for Immediate<[u8; N]> { ); if data.is_null() { - return None; + return Err(DeserializationError::NullPointer); } else if data_len != ref_len { - debug!("Invalid size requested for deserializing an 'immediate' expression: expected {} bytes, got {}", ref_len, data_len); - return None; + return Err(DeserializationError::InvalidDataSize); } let data = *(data as *const [u8; N]); @@ -76,9 +75,9 @@ impl Expression for Immediate<[u8; N]> { let register = Register::from_raw(sys::nftnl_expr_get_u32( expr, sys::NFTNL_EXPR_IMM_DREG as u16, - )); + ))?; - register.map(|register| Immediate { data, register }) + Ok(Immediate { data, register }) } } @@ -86,44 +85,11 @@ impl Expression for Immediate<[u8; N]> { fn to_expr(&self, rule: &Rule) -> *mut sys::nftnl_expr { Immediate { register: self.register, - data: self.data.as_ref(), + data: &self.data as &[u8], } .to_expr(rule) } } -// As casting bytes to any type of the same size as the input would -// be *extremely* dangerous in terms of memory safety, -// rustables only accept to deserialize expressions with variable-size data -// to arrays of bytes, so that the memory layout cannot be invalid. -impl Immediate<[u8; N]> { - pub fn from_expr(expr: *const sys::nftnl_expr) -> Option { - unsafe { - let ref_len = std::mem::size_of::<[u8; N]>() as u32; - let mut data_len = 0; - let data = sys::nftnl_expr_get( - expr, - sys::NFTNL_EXPR_IMM_DATA as u16, - &mut data_len as *mut u32, - ); - - if data.is_null() { - return None; - } else if data_len != ref_len { - debug!("Invalid size requested for deserializing an 'immediate' expression: expected {} bytes, got {}", ref_len, data_len); - return None; - } - - let data = *(data as *const [u8; N]); - - let register = Register::from_raw(sys::nftnl_expr_get_u32( - expr, - sys::NFTNL_EXPR_IMM_DREG as u16, - )); - - register.map(|register| Immediate { data, register }) - } - } -} #[macro_export] macro_rules! nft_expr_immediate { diff --git a/rustables/src/expr/log.rs b/rustables/src/expr/log.rs index ba1244a..db96ba9 100644 --- a/rustables/src/expr/log.rs +++ b/rustables/src/expr/log.rs @@ -1,4 +1,4 @@ -use super::{Expression, Rule}; +use super::{DeserializationError, Expression, Rule}; use rustables_sys as sys; use std::ffi::{CStr, CString}; use std::os::raw::c_char; @@ -16,7 +16,7 @@ impl Expression for Log { b"log\0" as *const _ as *const c_char } - fn from_expr(expr: *const sys::nftnl_expr) -> Option + fn from_expr(expr: *const sys::nftnl_expr) -> Result where Self: Sized, { @@ -32,12 +32,12 @@ impl Expression for Log { if sys::nftnl_expr_is_set(expr, sys::NFTNL_EXPR_LOG_PREFIX as u16) { let raw_prefix = sys::nftnl_expr_get_str(expr, sys::NFTNL_EXPR_LOG_PREFIX as u16); if raw_prefix.is_null() { - trace!("Unexpected empty prefix in a 'log' expression"); + return Err(DeserializationError::NullPointer); } else { prefix = Some(LogPrefix(CStr::from_ptr(raw_prefix).to_owned())); } } - Some(Log { group, prefix }) + Ok(Log { group, prefix }) } } diff --git a/rustables/src/expr/lookup.rs b/rustables/src/expr/lookup.rs index b9a03d9..7796b29 100644 --- a/rustables/src/expr/lookup.rs +++ b/rustables/src/expr/lookup.rs @@ -1,4 +1,4 @@ -use super::{Expression, Rule}; +use super::{DeserializationError, Expression, Rule}; use crate::set::Set; use rustables_sys::{self as sys, libc}; use std::ffi::{CStr, CString}; @@ -26,7 +26,7 @@ impl Expression for Lookup { b"lookup\0" as *const _ as *const c_char } - fn from_expr(expr: *const sys::nftnl_expr) -> Option + fn from_expr(expr: *const sys::nftnl_expr) -> Result where Self: Sized, { @@ -35,12 +35,12 @@ impl Expression for Lookup { let set_id = sys::nftnl_expr_get_u32(expr, sys::NFTNL_EXPR_LOOKUP_SET_ID as u16); if set_name.is_null() { - return None; + return Err(DeserializationError::NullPointer); } let set_name = CStr::from_ptr(set_name).to_owned(); - Some(Lookup { set_id, set_name }) + Ok(Lookup { set_id, set_name }) } } diff --git a/rustables/src/expr/masquerade.rs b/rustables/src/expr/masquerade.rs index bf4e0de..40565d5 100644 --- a/rustables/src/expr/masquerade.rs +++ b/rustables/src/expr/masquerade.rs @@ -1,4 +1,4 @@ -use super::{Expression, Rule}; +use super::{DeserializationError, Expression, Rule}; use rustables_sys as sys; use std::os::raw::c_char; @@ -11,11 +11,11 @@ impl Expression for Masquerade { b"masq\0" as *const _ as *const c_char } - fn from_expr(_expr: *const sys::nftnl_expr) -> Option + fn from_expr(_expr: *const sys::nftnl_expr) -> Result where Self: Sized, { - Some(Masquerade) + Ok(Masquerade) } fn to_expr(&self, _rule: &Rule) -> *mut sys::nftnl_expr { diff --git a/rustables/src/expr/meta.rs b/rustables/src/expr/meta.rs index ba803ac..199f3d3 100644 --- a/rustables/src/expr/meta.rs +++ b/rustables/src/expr/meta.rs @@ -1,4 +1,4 @@ -use super::{Expression, Rule}; +use super::{DeserializationError, Expression, Rule}; use rustables_sys::{self as sys, libc}; use std::os::raw::c_char; @@ -58,24 +58,23 @@ impl Meta { } } - fn from_raw(val: u32) -> Option { + fn from_raw(val: u32) -> Result { match val as i32 { - libc::NFT_META_PROTOCOL => Some(Self::Protocol), - libc::NFT_META_MARK => Some(Self::Mark { set: false }), - libc::NFT_META_IIF => Some(Self::Iif), - libc::NFT_META_OIF => Some(Self::Oif), - libc::NFT_META_IIFNAME => Some(Self::IifName), - libc::NFT_META_OIFNAME => Some(Self::OifName), - libc::NFT_META_IIFTYPE => Some(Self::IifType), - libc::NFT_META_OIFTYPE => Some(Self::OifType), - libc::NFT_META_SKUID => Some(Self::SkUid), - libc::NFT_META_SKGID => Some(Self::SkGid), - libc::NFT_META_NFPROTO => Some(Self::NfProto), - libc::NFT_META_L4PROTO => Some(Self::L4Proto), - libc::NFT_META_CGROUP => Some(Self::Cgroup), - libc::NFT_META_PRANDOM => Some(Self::PRandom), - - _ => None, + libc::NFT_META_PROTOCOL => Ok(Self::Protocol), + libc::NFT_META_MARK => Ok(Self::Mark { set: false }), + libc::NFT_META_IIF => Ok(Self::Iif), + libc::NFT_META_OIF => Ok(Self::Oif), + libc::NFT_META_IIFNAME => Ok(Self::IifName), + libc::NFT_META_OIFNAME => Ok(Self::OifName), + libc::NFT_META_IIFTYPE => Ok(Self::IifType), + libc::NFT_META_OIFTYPE => Ok(Self::OifType), + libc::NFT_META_SKUID => Ok(Self::SkUid), + libc::NFT_META_SKGID => Ok(Self::SkGid), + libc::NFT_META_NFPROTO => Ok(Self::NfProto), + libc::NFT_META_L4PROTO => Ok(Self::L4Proto), + libc::NFT_META_CGROUP => Ok(Self::Cgroup), + libc::NFT_META_PRANDOM => Ok(Self::PRandom), + _ => Err(DeserializationError::InvalidValue), } } } @@ -85,24 +84,21 @@ impl Expression for Meta { b"meta\0" as *const _ as *const c_char } - fn from_expr(expr: *const sys::nftnl_expr) -> Option + fn from_expr(expr: *const sys::nftnl_expr) -> Result where Self: Sized, { unsafe { - let mut ret = match Self::from_raw(sys::nftnl_expr_get_u32( + let mut ret = Self::from_raw(sys::nftnl_expr_get_u32( expr, sys::NFTNL_EXPR_META_KEY as u16, - )) { - Some(x) => x, - None => return None, - }; + ))?; if let Self::Mark { ref mut set } = ret { *set = sys::nftnl_expr_is_set(expr, sys::NFTNL_EXPR_META_SREG as u16); } - Some(ret) + Ok(ret) } } diff --git a/rustables/src/expr/mod.rs b/rustables/src/expr/mod.rs index 431a0b9..b20a752 100644 --- a/rustables/src/expr/mod.rs +++ b/rustables/src/expr/mod.rs @@ -3,8 +3,14 @@ //! //! [`Rule`]: struct.Rule.html +use std::borrow::Cow; +use std::net::IpAddr; +use std::net::Ipv4Addr; +use std::net::Ipv6Addr; + use super::rule::Rule; use rustables_sys::{self as sys, libc}; +use thiserror::Error; mod bitwise; pub use self::bitwise::*; @@ -51,18 +57,47 @@ pub use self::verdict::*; mod wrapper; pub use self::wrapper::ExpressionWrapper; +#[derive(Debug, Error)] +pub enum DeserializationError { + #[error("The expected expression type doesn't match the name of the raw expression")] + /// The expected expression type doesn't match the name of the raw expression + InvalidExpressionKind, + + #[error("Deserializing the requested type isn't implemented yet")] + /// Deserializing the requested type isn't implemented yet + NotImplemented, + + #[error("The expression value cannot be deserialized to the requested type")] + /// The expression value cannot be deserialized to the requested type + InvalidValue, + + #[error("A pointer was null while a non-null pointer was expected")] + /// A pointer was null while a non-null pointer was expected + NullPointer, + + #[error( + "The size of a raw value was incoherent with the expected type of the deserialized value" + )] + /// The size of a raw value was incoherent with the expected type of the deserialized value + InvalidDataSize, + + #[error(transparent)] + /// Couldn't find a matching protocol + InvalidProtolFamily(#[from] super::InvalidProtocolFamily), +} + /// Trait for every safe wrapper of an nftables expression. pub trait Expression { /// Returns the raw name used by nftables to identify the rule. fn get_raw_name() -> *const libc::c_char; /// Try to parse the expression from a raw nftables expression, - /// returning None if the attempted parsing failed. - fn from_expr(_expr: *const sys::nftnl_expr) -> Option + /// returning a [DeserializationError] if the attempted parsing failed. + fn from_expr(_expr: *const sys::nftnl_expr) -> Result where Self: Sized, { - None + Err(DeserializationError::NotImplemented) } /// Allocates and returns the low level `nftnl_expr` representation of this expression. @@ -70,6 +105,87 @@ pub trait Expression { fn to_expr(&self, rule: &Rule) -> *mut sys::nftnl_expr; } +/// A type that can be converted into a byte buffer. +pub trait ToSlice { + /// Returns the data this type represents. + fn to_slice(&self) -> Cow<'_, [u8]>; +} + +impl<'a> ToSlice for &'a [u8] { + fn to_slice(&self) -> Cow<'_, [u8]> { + Cow::Borrowed(self) + } +} + +impl<'a> ToSlice for &'a [u16] { + fn to_slice(&self) -> Cow<'_, [u8]> { + let ptr = self.as_ptr() as *const u8; + let len = self.len() * 2; + Cow::Borrowed(unsafe { std::slice::from_raw_parts(ptr, len) }) + } +} + +impl ToSlice for IpAddr { + fn to_slice(&self) -> Cow<'_, [u8]> { + match *self { + IpAddr::V4(ref addr) => addr.to_slice(), + IpAddr::V6(ref addr) => addr.to_slice(), + } + } +} + +impl ToSlice for Ipv4Addr { + fn to_slice(&self) -> Cow<'_, [u8]> { + Cow::Owned(self.octets().to_vec()) + } +} + +impl ToSlice for Ipv6Addr { + fn to_slice(&self) -> Cow<'_, [u8]> { + Cow::Owned(self.octets().to_vec()) + } +} + +impl ToSlice for u8 { + fn to_slice(&self) -> Cow<'_, [u8]> { + Cow::Owned(vec![*self]) + } +} + +impl ToSlice for u16 { + fn to_slice(&self) -> Cow<'_, [u8]> { + let b0 = (*self & 0x00ff) as u8; + let b1 = (*self >> 8) as u8; + Cow::Owned(vec![b0, b1]) + } +} + +impl ToSlice for u32 { + fn to_slice(&self) -> Cow<'_, [u8]> { + let b0 = *self as u8; + let b1 = (*self >> 8) as u8; + let b2 = (*self >> 16) as u8; + let b3 = (*self >> 24) as u8; + Cow::Owned(vec![b0, b1, b2, b3]) + } +} + +impl ToSlice for i32 { + fn to_slice(&self) -> Cow<'_, [u8]> { + let b0 = *self as u8; + let b1 = (*self >> 8) as u8; + let b2 = (*self >> 16) as u8; + let b3 = (*self >> 24) as u8; + Cow::Owned(vec![b0, b1, b2, b3]) + } +} + +impl<'a> ToSlice for &'a str { + fn to_slice(&self) -> Cow<'_, [u8]> { + Cow::from(self.as_bytes()) + } +} + #[macro_export(local_inner_macros)] macro_rules! nft_expr { (bitwise mask $mask:expr,xor $xor:expr) => { diff --git a/rustables/src/expr/nat.rs b/rustables/src/expr/nat.rs index 6bd0619..51f439f 100644 --- a/rustables/src/expr/nat.rs +++ b/rustables/src/expr/nat.rs @@ -1,4 +1,4 @@ -use super::{Expression, Register, Rule}; +use super::{DeserializationError, Expression, Register, Rule}; use crate::ProtoFamily; use rustables_sys::{self as sys, libc}; use std::{convert::TryFrom, os::raw::c_char}; @@ -13,11 +13,11 @@ pub enum NatType { } impl NatType { - fn from_raw(val: u32) -> Option { + fn from_raw(val: u32) -> Result { match val as i32 { - libc::NFT_NAT_SNAT => Some(NatType::SNat), - libc::NFT_NAT_DNAT => Some(NatType::DNat), - _ => None, + libc::NFT_NAT_SNAT => Ok(NatType::SNat), + libc::NFT_NAT_DNAT => Ok(NatType::DNat), + _ => Err(DeserializationError::InvalidValue), } } } @@ -37,7 +37,7 @@ impl Expression for Nat { b"nat\0" as *const _ as *const c_char } - fn from_expr(expr: *const sys::nftnl_expr) -> Option + fn from_expr(expr: *const sys::nftnl_expr) -> Result where Self: Sized, { @@ -45,42 +45,27 @@ impl Expression for Nat { let nat_type = NatType::from_raw(sys::nftnl_expr_get_u32( expr, sys::NFTNL_EXPR_NAT_TYPE as u16, - )); - let nat_type = match nat_type { - Some(x) => x, - None => return None, - }; + ))?; let family = ProtoFamily::try_from(sys::nftnl_expr_get_u32( expr, sys::NFTNL_EXPR_NAT_FAMILY as u16, - ) as i32); - let family = match family { - Ok(x) => x, - Err(_) => return None, - }; + ) as i32)?; let ip_register = Register::from_raw(sys::nftnl_expr_get_u32( expr, sys::NFTNL_EXPR_NAT_REG_ADDR_MIN as u16, - )); - let ip_register = match ip_register { - Some(x) => x, - None => return None, - }; + ))?; let mut port_register = None; if sys::nftnl_expr_is_set(expr, sys::NFTNL_EXPR_NAT_REG_PROTO_MIN as u16) { - port_register = Register::from_raw(sys::nftnl_expr_get_u32( + port_register = Some(Register::from_raw(sys::nftnl_expr_get_u32( expr, sys::NFTNL_EXPR_NAT_REG_PROTO_MIN as u16, - )); - if port_register.is_none() { - trace!("Invalid register in expression 'nat'"); - } + ))?); } - Some(Nat { + Ok(Nat { ip_register, nat_type, family, diff --git a/rustables/src/expr/payload.rs b/rustables/src/expr/payload.rs index a6b5ddf..25a71ad 100644 --- a/rustables/src/expr/payload.rs +++ b/rustables/src/expr/payload.rs @@ -1,4 +1,4 @@ -use super::{Expression, Rule}; +use super::{DeserializationError, Expression, Rule}; use rustables_sys::{self as sys, libc}; use std::os::raw::c_char; @@ -22,11 +22,11 @@ impl Payload { offset: f.offset(), len: f.len(), }), - Payload::Network(ref f) => RawPayload::LinkLayer(RawPayloadData { + Payload::Network(ref f) => RawPayload::Network(RawPayloadData { offset: f.offset(), len: f.len(), }), - Payload::Transport(ref f) => RawPayload::LinkLayer(RawPayloadData { + Payload::Transport(ref f) => RawPayload::Transport(RawPayloadData { offset: f.offset(), len: f.offset(), }), @@ -88,23 +88,21 @@ impl Expression for RawPayload { b"payload\0" as *const _ as *const c_char } - fn from_expr(expr: *const sys::nftnl_expr) -> Option { + fn from_expr(expr: *const sys::nftnl_expr) -> Result { unsafe { let base = sys::nftnl_expr_get_u32(expr, sys::NFTNL_EXPR_PAYLOAD_BASE as u16); let offset = sys::nftnl_expr_get_u32(expr, sys::NFTNL_EXPR_PAYLOAD_OFFSET as u16); let len = sys::nftnl_expr_get_u32(expr, sys::NFTNL_EXPR_PAYLOAD_LEN as u16); match base as i32 { - libc::NFT_PAYLOAD_LL_HEADER => { - Some(Self::LinkLayer(RawPayloadData { offset, len })) - } + libc::NFT_PAYLOAD_LL_HEADER => Ok(Self::LinkLayer(RawPayloadData { offset, len })), libc::NFT_PAYLOAD_NETWORK_HEADER => { - Some(Self::Network(RawPayloadData { offset, len })) + Ok(Self::Network(RawPayloadData { offset, len })) } libc::NFT_PAYLOAD_TRANSPORT_HEADER => { - Some(Self::Transport(RawPayloadData { offset, len })) + Ok(Self::Transport(RawPayloadData { offset, len })) } - _ => return None, + _ => return Err(DeserializationError::InvalidValue), } } } @@ -156,18 +154,18 @@ impl HeaderField for LLHeaderField { } impl LLHeaderField { - pub fn from_raw_data(data: &RawPayloadData) -> Option { + pub fn from_raw_data(data: &RawPayloadData) -> Result { let off = data.offset; let len = data.len; if off == 0 && len == 6 { - Some(Self::Daddr) + Ok(Self::Daddr) } else if off == 6 && len == 6 { - Some(Self::Saddr) + Ok(Self::Saddr) } else if off == 12 && len == 2 { - Some(Self::EtherType) + Ok(Self::EtherType) } else { - None + Err(DeserializationError::InvalidValue) } } } @@ -228,20 +226,20 @@ impl HeaderField for Ipv4HeaderField { } impl Ipv4HeaderField { - pub fn from_raw_data(data: &RawPayloadData) -> Option { + pub fn from_raw_data(data: &RawPayloadData) -> Result { let off = data.offset; let len = data.len; if off == 8 && len == 1 { - Some(Self::Ttl) + Ok(Self::Ttl) } else if off == 9 && len == 1 { - Some(Self::Protocol) + Ok(Self::Protocol) } else if off == 12 && len == 4 { - Some(Self::Saddr) + Ok(Self::Saddr) } else if off == 16 && len == 4 { - Some(Self::Daddr) + Ok(Self::Daddr) } else { - None + Err(DeserializationError::InvalidValue) } } } @@ -278,20 +276,20 @@ impl HeaderField for Ipv6HeaderField { } impl Ipv6HeaderField { - pub fn from_raw_data(data: &RawPayloadData) -> Option { + pub fn from_raw_data(data: &RawPayloadData) -> Result { let off = data.offset; let len = data.len; if off == 6 && len == 1 { - Some(Self::NextHeader) + Ok(Self::NextHeader) } else if off == 7 && len == 1 { - Some(Self::HopLimit) + Ok(Self::HopLimit) } else if off == 8 && len == 16 { - Some(Self::Saddr) + Ok(Self::Saddr) } else if off == 24 && len == 16 { - Some(Self::Daddr) + Ok(Self::Daddr) } else { - None + Err(DeserializationError::InvalidValue) } } } @@ -350,16 +348,16 @@ impl HeaderField for TcpHeaderField { } impl TcpHeaderField { - pub fn from_raw_data(data: &RawPayloadData) -> Option { + pub fn from_raw_data(data: &RawPayloadData) -> Result { let off = data.offset; let len = data.len; if off == 0 && len == 2 { - Some(Self::Sport) + Ok(Self::Sport) } else if off == 2 && len == 2 { - Some(Self::Dport) + Ok(Self::Dport) } else { - None + Err(DeserializationError::InvalidValue) } } } @@ -393,18 +391,18 @@ impl HeaderField for UdpHeaderField { } impl UdpHeaderField { - pub fn from_raw_data(data: &RawPayloadData) -> Option { + pub fn from_raw_data(data: &RawPayloadData) -> Result { let off = data.offset; let len = data.len; if off == 0 && len == 2 { - Some(Self::Sport) + Ok(Self::Sport) } else if off == 2 && len == 2 { - Some(Self::Dport) + Ok(Self::Dport) } else if off == 4 && len == 2 { - Some(Self::Len) + Ok(Self::Len) } else { - None + Err(DeserializationError::InvalidValue) } } } @@ -438,18 +436,18 @@ impl HeaderField for Icmpv6HeaderField { } impl Icmpv6HeaderField { - pub fn from_raw_data(data: &RawPayloadData) -> Option { + pub fn from_raw_data(data: &RawPayloadData) -> Result { let off = data.offset; let len = data.len; if off == 0 && len == 1 { - Some(Self::Type) + Ok(Self::Type) } else if off == 1 && len == 1 { - Some(Self::Code) + Ok(Self::Code) } else if off == 2 && len == 2 { - Some(Self::Checksum) + Ok(Self::Checksum) } else { - None + Err(DeserializationError::InvalidValue) } } } diff --git a/rustables/src/expr/register.rs b/rustables/src/expr/register.rs index 3013451..2cfcc3b 100644 --- a/rustables/src/expr/register.rs +++ b/rustables/src/expr/register.rs @@ -2,6 +2,8 @@ use std::fmt::Debug; use rustables_sys::libc; +use super::DeserializationError; + /// A netfilter data register. The expressions store and read data to and from these /// when evaluating rule statements. #[derive(Debug, Copy, Clone, Eq, PartialEq, Hash)] @@ -19,14 +21,14 @@ impl Register { self as u32 } - pub fn from_raw(val: u32) -> Option { + pub fn from_raw(val: u32) -> Result { match val as i32 { - libc::NFT_REG_VERDICT => Some(Self::Verdict), - libc::NFT_REG_1 => Some(Self::Reg1), - libc::NFT_REG_2 => Some(Self::Reg2), - libc::NFT_REG_3 => Some(Self::Reg3), - libc::NFT_REG_4 => Some(Self::Reg4), - _ => None, + libc::NFT_REG_VERDICT => Ok(Self::Verdict), + libc::NFT_REG_1 => Ok(Self::Reg1), + libc::NFT_REG_2 => Ok(Self::Reg2), + libc::NFT_REG_3 => Ok(Self::Reg3), + libc::NFT_REG_4 => Ok(Self::Reg4), + _ => Err(DeserializationError::InvalidValue), } } } diff --git a/rustables/src/expr/reject.rs b/rustables/src/expr/reject.rs index f94079b..550a287 100644 --- a/rustables/src/expr/reject.rs +++ b/rustables/src/expr/reject.rs @@ -1,4 +1,4 @@ -use super::{Expression, Rule}; +use super::{DeserializationError, Expression, Rule}; use crate::ProtoFamily; use rustables_sys::{ self as sys, @@ -34,7 +34,7 @@ impl Expression for Reject { b"reject\0" as *const _ as *const c_char } - fn from_expr(expr: *const sys::nftnl_expr) -> Option + fn from_expr(expr: *const sys::nftnl_expr) -> Result where Self: Sized, { @@ -42,13 +42,12 @@ impl Expression for Reject { if sys::nftnl_expr_get_u32(expr, sys::NFTNL_EXPR_REJECT_TYPE as u16) == libc::NFT_REJECT_TCP_RST as u32 { - Some(Self::TcpRst) + Ok(Self::TcpRst) } else { - IcmpCode::from_raw(sys::nftnl_expr_get_u8( + Ok(Self::Icmp(IcmpCode::from_raw(sys::nftnl_expr_get_u8( expr, sys::NFTNL_EXPR_REJECT_CODE as u16, - )) - .map(Self::Icmp) + ))?)) } } } @@ -88,13 +87,13 @@ pub enum IcmpCode { } impl IcmpCode { - fn from_raw(code: u8) -> Option { + fn from_raw(code: u8) -> Result { match code as i32 { - libc::NFT_REJECT_ICMPX_NO_ROUTE => Some(Self::NoRoute), - libc::NFT_REJECT_ICMPX_PORT_UNREACH => Some(Self::PortUnreach), - libc::NFT_REJECT_ICMPX_HOST_UNREACH => Some(Self::HostUnreach), - libc::NFT_REJECT_ICMPX_ADMIN_PROHIBITED => Some(Self::AdminProhibited), - _ => None, + libc::NFT_REJECT_ICMPX_NO_ROUTE => Ok(Self::NoRoute), + libc::NFT_REJECT_ICMPX_PORT_UNREACH => Ok(Self::PortUnreach), + libc::NFT_REJECT_ICMPX_HOST_UNREACH => Ok(Self::HostUnreach), + libc::NFT_REJECT_ICMPX_ADMIN_PROHIBITED => Ok(Self::AdminProhibited), + _ => Err(DeserializationError::InvalidValue), } } } diff --git a/rustables/src/expr/verdict.rs b/rustables/src/expr/verdict.rs index 772da52..6a6b802 100644 --- a/rustables/src/expr/verdict.rs +++ b/rustables/src/expr/verdict.rs @@ -1,4 +1,4 @@ -use super::{Expression, Rule}; +use super::{DeserializationError, Expression, Rule}; use rustables_sys::{ self as sys, libc::{self, c_char}, @@ -40,15 +40,14 @@ impl Expression for Verdict { b"immediate\0" as *const _ as *const c_char } - fn from_expr(expr: *const sys::nftnl_expr) -> Option { + fn from_expr(expr: *const sys::nftnl_expr) -> Result { unsafe { let mut chain = None; if sys::nftnl_expr_is_set(expr, sys::NFTNL_EXPR_IMM_CHAIN as u16) { let raw_chain = sys::nftnl_expr_get_str(expr, sys::NFTNL_EXPR_IMM_CHAIN as u16); if raw_chain.is_null() { - trace!("Unexpected empty chain name when deserializing 'verdict' expression"); - return None; + return Err(DeserializationError::NullPointer); } chain = Some(CStr::from_ptr(raw_chain).to_owned()); } @@ -56,15 +55,27 @@ impl Expression for Verdict { let verdict = sys::nftnl_expr_get_u32(expr, sys::NFTNL_EXPR_IMM_VERDICT as u16); match verdict as i32 { - libc::NF_DROP => Some(Verdict::Drop), - libc::NF_ACCEPT => Some(Verdict::Accept), - libc::NF_QUEUE => Some(Verdict::Queue), - libc::NFT_CONTINUE => Some(Verdict::Continue), - libc::NFT_BREAK => Some(Verdict::Break), - libc::NFT_JUMP => chain.map(|chain| Verdict::Jump { chain }), - libc::NFT_GOTO => chain.map(|chain| Verdict::Goto { chain }), - libc::NFT_RETURN => Some(Verdict::Return), - _ => None, + libc::NF_DROP => Ok(Verdict::Drop), + libc::NF_ACCEPT => Ok(Verdict::Accept), + libc::NF_QUEUE => Ok(Verdict::Queue), + libc::NFT_CONTINUE => Ok(Verdict::Continue), + libc::NFT_BREAK => Ok(Verdict::Break), + libc::NFT_JUMP => { + if let Some(chain) = chain { + Ok(Verdict::Jump { chain }) + } else { + Err(DeserializationError::InvalidValue) + } + } + libc::NFT_GOTO => { + if let Some(chain) = chain { + Ok(Verdict::Goto { chain }) + } else { + Err(DeserializationError::InvalidValue) + } + } + libc::NFT_RETURN => Ok(Verdict::Return), + _ => Err(DeserializationError::InvalidValue), } } } diff --git a/rustables/src/expr/wrapper.rs b/rustables/src/expr/wrapper.rs index b9b90b3..5162c21 100644 --- a/rustables/src/expr/wrapper.rs +++ b/rustables/src/expr/wrapper.rs @@ -3,6 +3,7 @@ use std::ffi::CString; use std::fmt::Debug; use std::rc::Rc; +use super::DeserializationError; use super::Expression; use crate::Rule; use rustables_sys as sys; @@ -48,15 +49,14 @@ impl ExpressionWrapper { } } - /// Attempt to decode the expression as the type T, returning None if such - /// conversion is not possible or failed. - pub fn decode_expr(&self) -> Option { + /// Attempt to decode the expression as the type T. + pub fn decode_expr(&self) -> Result { if let Some(kind) = self.get_kind() { let raw_name = unsafe { CStr::from_ptr(T::get_raw_name()) }; if kind == raw_name { return T::from_expr(self.expr); } } - None + Err(DeserializationError::InvalidExpressionKind) } } -- cgit v1.2.3