path: root/src/rule.rs

use crate::expr::ExpressionList;
use crate::nlmsg::{NfNetlinkAttribute, NfNetlinkDeserializable, NfNetlinkObject, NfNetlinkWriter};
use crate::parser::{DecodeError, InnerFormat, Parsable};
use crate::query::list_objects_with_data;
use crate::sys::{self, NFT_MSG_DELRULE, NFT_MSG_NEWRULE, NLM_F_ACK, NLM_F_CREATE};
use crate::{chain::Chain, MsgType};
use crate::{impl_attr_getters_and_setters, impl_nfnetlinkattribute, ProtocolFamily};
use std::convert::TryFrom;
use std::fmt::Debug;

/// A nftables firewall rule.
#[derive(Clone, PartialEq, Eq, Default)]
pub struct Rule {
    id: Option<u32>,
    handle: Option<u64>,
    position: Option<u64>,
    table: Option<String>,
    chain: Option<String>,
    userdata: Option<Vec<u8>>,
    expressions: Option<ExpressionList>,
    family: ProtocolFamily,
}

impl Rule {
    /// Creates a new rule object in the given [`Chain`].
    ///
    /// [`Chain`]: struct.Chain.html
    pub fn new(chain: &Chain) -> Result<Rule, DecodeError> {
        Ok(Rule::default()
            .with_family(chain.get_family())
            .with_table(
                chain
                    .get_table()
                    .ok_or(DecodeError::MissingChainInformationError)?,
            )
            .with_chain(
                chain
                    .get_name()
                    .ok_or(DecodeError::MissingChainInformationError)?,
            ))
    }

    pub fn get_family(&self) -> ProtocolFamily {
        self.family
    }

    pub fn set_family(&mut self, family: ProtocolFamily) {
        self.family = family;
    }

    pub fn with_family(mut self, family: ProtocolFamily) -> Self {
        self.set_family(family);
        self
    }

    /*
    /// Adds an expression to this rule. Expressions are evaluated from first to last added.
    /// As soon as an expression does not match the packet it's being evaluated for, evaluation
    /// stops and the packet is evaluated against the next rule in the chain.
    pub fn add_expr(&mut self, expr: &impl Expression) {
        unsafe { sys::nftnl_rule_add_expr(self.rule, expr.to_expr(self)) }
    }

    /// Returns a reference to the [`Chain`] this rule lives in.
    ///
    /// [`Chain`]: struct.Chain.html
    pub fn get_chain(&self) -> Rc<Chain> {
        self.chain.clone()
    }

    /// Returns the userdata of this chain.
    pub fn get_userdata(&self) -> Option<&CStr> {
        unsafe {
            let ptr = sys::nftnl_rule_get_str(self.rule, sys::NFTNL_RULE_USERDATA as u16);
            if !ptr.is_null() {
                Some(CStr::from_ptr(ptr))
            } else {
                None
            }
        }
    }

    /// Updates the userdata of this chain.
    pub fn set_userdata(&self, data: &CStr) {
        unsafe {
            sys::nftnl_rule_set_str(self.rule, sys::NFTNL_RULE_USERDATA as u16, data.as_ptr());
        }
    }

    /// Returns a textual description of the rule.
    pub fn get_str(&self) -> CString {
        let mut descr_buf = vec![0i8; 4096];
        unsafe {
            sys::nftnl_rule_snprintf(
                descr_buf.as_mut_ptr() as *mut c_char,
                (descr_buf.len() - 1) as u64,
                self.rule,
                sys::NFTNL_OUTPUT_DEFAULT,
                0,
            );
            CStr::from_ptr(descr_buf.as_ptr() as *mut c_char).to_owned()
        }
    }

    /// Retrieves an iterator to loop over the expressions of the rule.
    pub fn get_exprs(self: &Rc<Self>) -> RuleExprsIter {
        RuleExprsIter::new(self.clone())
    }

    /// Performs a deep comparizon of rules, by checking they have the same expressions inside.
    /// This is not enabled by default in our PartialEq implementation because of the difficulty to
    /// compare an expression generated by the library with the expressions returned by the kernel
    /// when iterating over the currently in-use rules. The kernel-returned expressions may have
    /// additional attributes despite being generated from the same rule. This is particularly true
    /// for the 'nat' expression).
    pub fn deep_eq(&self, other: &Self) -> bool {
        if self != other {
            return false;
        }

        let self_exprs =
            try_alloc!(unsafe { sys::nftnl_expr_iter_create(self.rule as *const sys::nftnl_rule) });
        let other_exprs = try_alloc!(unsafe {
            sys::nftnl_expr_iter_create(other.rule as *const sys::nftnl_rule)
        });

        loop {
            let self_next = unsafe { sys::nftnl_expr_iter_next(self_exprs) };
            let other_next = unsafe { sys::nftnl_expr_iter_next(other_exprs) };
            if self_next.is_null() && other_next.is_null() {
                return true;
            } else if self_next.is_null() || other_next.is_null() {
                return false;
            }

            // we are falling back on comparing the strings, because there is no easy mechanism to
            // perform a memcmp() between the two expressions :/
            let mut self_str = [0; 256];
            let mut other_str = [0; 256];
            unsafe {
                sys::nftnl_expr_snprintf(
                    self_str.as_mut_ptr(),
                    (self_str.len() - 1) as u64,
                    self_next,
                    sys::NFTNL_OUTPUT_DEFAULT,
                    0,
                );
                sys::nftnl_expr_snprintf(
                    other_str.as_mut_ptr(),
                    (other_str.len() - 1) as u64,
                    other_next,
                    sys::NFTNL_OUTPUT_DEFAULT,
                    0,
                );
            }

            if self_str != other_str {
                return false;
            }
        }
    }
        */
}

impl Debug for Rule {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        let mut res = f.debug_struct("Rule");
        res.field("family", &self.family);
        self.inner_format_struct(res)?.finish()
    }
}

impl NfNetlinkObject for Rule {
    fn add_or_remove<'a>(&self, writer: &mut NfNetlinkWriter<'a>, msg_type: MsgType, seq: u32) {
        let raw_msg_type = match msg_type {
            MsgType::Add => NFT_MSG_NEWRULE,
            MsgType::Del => NFT_MSG_DELRULE,
        } as u16;
        writer.write_header(
            raw_msg_type,
            self.family,
            (if let MsgType::Add = msg_type {
                NLM_F_CREATE
            } else {
                0
            } | NLM_F_ACK) as u16,
            seq,
            None,
        );
        let buf = writer.add_data_zeroed(self.get_size());
        unsafe {
            self.write_payload(buf.as_mut_ptr());
        }
        writer.finalize_writing_object();
    }
}

impl NfNetlinkDeserializable for Rule {
    fn deserialize(buf: &[u8]) -> Result<(Self, &[u8]), DecodeError> {
        let (mut obj, nfgenmsg, remaining_data) =
            Self::parse_object(buf, NFT_MSG_NEWRULE, NFT_MSG_DELRULE)?;
        obj.family = ProtocolFamily::try_from(nfgenmsg.nfgen_family as i32)?;

        Ok((obj, remaining_data))
    }
}

impl_attr_getters_and_setters!(
    Rule,
    [
        (get_table, set_table, with_table, sys::NFTA_RULE_TABLE, table, String),
        (get_chain, set_chain, with_chain, sys::NFTA_RULE_CHAIN, chain, String),
        (get_handle, set_handle, with_handle, sys::NFTA_RULE_HANDLE, handle, u64),
        (get_expressions, set_expressions, with_expressions, sys::NFTA_RULE_EXPRESSIONS, expressions, ExpressionList),
        // Sets the position of this rule within the chain it lives in. By default a new rule is added
        // to the end of the chain.
        (get_position, set_position, with_position, sys::NFTA_RULE_POSITION, position, u64),
        (
            get_userdata,
            set_userdata,
            with_userdata,
            sys::NFTA_RULE_USERDATA,
            userdata,
            Vec<u8>
        ),
        (get_id, set_id, with_id, sys::NFTA_RULE_ID, id, u32)
    ]
);

impl_nfnetlinkattribute!(inline : Rule, [
        (sys::NFTA_RULE_TABLE, table),
        (sys::NFTA_RULE_CHAIN, chain),
        (sys::NFTA_RULE_HANDLE, handle),
        (sys::NFTA_RULE_EXPRESSIONS, expressions),
        (sys::NFTA_RULE_POSITION, position),
        (
            sys::NFTA_RULE_USERDATA,
            userdata
        ),
        (sys::NFTA_RULE_ID, id)
]);

pub fn list_rules_for_chain(chain: &Chain) -> Result<Vec<Rule>, crate::query::Error> {
    let mut result = Vec::new();
    list_objects_with_data(
        libc::NFT_MSG_GETRULE as u16,
        &|rule: Rule, rules: &mut Vec<Rule>| {
            rules.push(rule);
            Ok(())
        },
        // only retrieve rules from the currently targetted chain
        Some(&Rule::new(chain)?),
        &mut result,
    )?;
    Ok(result)
}