mirror of
https://git.proxmox.com/git/proxmox-firewall
synced 2025-10-04 20:52:30 +00:00
config: firewall: add generic parser for firewall configs
Since the basic format of cluster, host and guest firewall configurations is the same, we create a generic parser that can handle the common config format. The main difference is in the available options, which can be passed via a generic parameter. Co-authored-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com> Reviewed-by: Lukas Wagner <l.wagner@proxmox.com> Reviewed-by: Max Carrara <m.carrara@proxmox.com>
This commit is contained in:
Stefan Hanreich
Thomas Lamprecht
parent
10923cd270
commit
225d78e7ca
184
proxmox-ve-config/src/firewall/common.rs
Normal file
184
proxmox-ve-config/src/firewall/common.rs
Normal file
@ -0,0 +1,184 @@
|
||||
use std::collections::{BTreeMap, HashMap};
|
||||
use std::io;
|
||||
|
||||
use anyhow::{bail, format_err, Error};
|
||||
use serde::de::IntoDeserializer;
|
||||
|
||||
use crate::firewall::parse::{parse_named_section_tail, split_key_value, SomeString};
|
||||
use crate::firewall::types::ipset::{IpsetName, IpsetScope};
|
||||
use crate::firewall::types::{Alias, Group, Ipset, Rule};
|
||||
|
||||
#[derive(Debug, Default)]
|
||||
pub struct Config<O>
|
||||
where
|
||||
O: Default + std::fmt::Debug + serde::de::DeserializeOwned,
|
||||
{
|
||||
pub(crate) options: O,
|
||||
pub(crate) rules: Vec<Rule>,
|
||||
pub(crate) aliases: BTreeMap<String, Alias>,
|
||||
pub(crate) ipsets: BTreeMap<String, Ipset>,
|
||||
pub(crate) groups: BTreeMap<String, Group>,
|
||||
}
|
||||
|
||||
enum Sec {
|
||||
None,
|
||||
Options,
|
||||
Aliases,
|
||||
Rules,
|
||||
Ipset(String, Ipset),
|
||||
Group(String, Group),
|
||||
}
|
||||
|
||||
#[derive(Default)]
|
||||
pub struct ParserConfig {
|
||||
/// Network interfaces must be of the form `netX`.
|
||||
pub guest_iface_names: bool,
|
||||
pub ipset_scope: Option<IpsetScope>,
|
||||
}
|
||||
|
||||
impl<O> Config<O>
|
||||
where
|
||||
O: Default + std::fmt::Debug + serde::de::DeserializeOwned,
|
||||
{
|
||||
pub fn new() -> Self {
|
||||
Self::default()
|
||||
}
|
||||
|
||||
pub fn parse<R: io::BufRead>(input: R, parser_cfg: &ParserConfig) -> Result<Self, Error> {
|
||||
let mut section = Sec::None;
|
||||
|
||||
let mut this = Self::new();
|
||||
let mut options = HashMap::new();
|
||||
|
||||
for line in input.lines() {
|
||||
let line = line?;
|
||||
let line = line.trim();
|
||||
|
||||
if line.is_empty() || line.starts_with('#') {
|
||||
continue;
|
||||
}
|
||||
|
||||
log::trace!("parsing config line {line}");
|
||||
|
||||
if line.eq_ignore_ascii_case("[OPTIONS]") {
|
||||
this.set_section(&mut section, Sec::Options)?;
|
||||
} else if line.eq_ignore_ascii_case("[ALIASES]") {
|
||||
this.set_section(&mut section, Sec::Aliases)?;
|
||||
} else if line.eq_ignore_ascii_case("[RULES]") {
|
||||
this.set_section(&mut section, Sec::Rules)?;
|
||||
} else if let Some(line) = line.strip_prefix("[IPSET") {
|
||||
let (name, comment) = parse_named_section_tail("ipset", line)?;
|
||||
|
||||
let scope = parser_cfg.ipset_scope.ok_or_else(|| {
|
||||
format_err!("IPSET in config, but no scope set in parser config")
|
||||
})?;
|
||||
|
||||
let ipset_name = IpsetName::new(scope, name.to_string());
|
||||
let mut ipset = Ipset::new(ipset_name);
|
||||
ipset.comment = comment.map(str::to_owned);
|
||||
|
||||
this.set_section(&mut section, Sec::Ipset(name.to_string(), ipset))?;
|
||||
} else if let Some(line) = line.strip_prefix("[group") {
|
||||
let (name, comment) = parse_named_section_tail("group", line)?;
|
||||
let mut group = Group::new();
|
||||
|
||||
group.set_comment(comment.map(str::to_owned));
|
||||
|
||||
this.set_section(&mut section, Sec::Group(name.to_owned(), group))?;
|
||||
} else if line.starts_with('[') {
|
||||
bail!("invalid section {line:?}");
|
||||
} else {
|
||||
match &mut section {
|
||||
Sec::None => bail!("config line with no section: {line:?}"),
|
||||
Sec::Options => Self::parse_option(line, &mut options)?,
|
||||
Sec::Aliases => this.parse_alias(line)?,
|
||||
Sec::Rules => this.parse_rule(line, parser_cfg)?,
|
||||
Sec::Ipset(_name, ipset) => ipset.parse_entry(line)?,
|
||||
Sec::Group(_name, group) => group.parse_entry(line)?,
|
||||
}
|
||||
}
|
||||
}
|
||||
this.set_section(&mut section, Sec::None)?;
|
||||
|
||||
this.options = O::deserialize(IntoDeserializer::<
|
||||
'_,
|
||||
crate::firewall::parse::SerdeStringError,
|
||||
>::into_deserializer(options))?;
|
||||
|
||||
Ok(this)
|
||||
}
|
||||
|
||||
fn parse_option(line: &str, options: &mut HashMap<String, SomeString>) -> Result<(), Error> {
|
||||
let (key, value) = split_key_value(line)
|
||||
.ok_or_else(|| format_err!("expected colon separated key and value, found {line:?}"))?;
|
||||
|
||||
if options.insert(key.to_string(), value.into()).is_some() {
|
||||
bail!("duplicate option {key:?}");
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn parse_alias(&mut self, line: &str) -> Result<(), Error> {
|
||||
let alias: Alias = line.parse()?;
|
||||
|
||||
if self
|
||||
.aliases
|
||||
.insert(alias.name().to_string(), alias)
|
||||
.is_some()
|
||||
{
|
||||
bail!("duplicate alias: {line}");
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn parse_rule(&mut self, line: &str, parser_cfg: &ParserConfig) -> Result<(), Error> {
|
||||
let rule: Rule = line.parse()?;
|
||||
|
||||
if parser_cfg.guest_iface_names {
|
||||
if let Some(iface) = rule.iface() {
|
||||
let _ = iface
|
||||
.strip_prefix("net")
|
||||
.ok_or_else(|| {
|
||||
format_err!("interface name must be of the form \"net<number>\"")
|
||||
})?
|
||||
.parse::<u16>()
|
||||
.map_err(|_| {
|
||||
format_err!("interface name must be of the form \"net<number>\"")
|
||||
})?;
|
||||
}
|
||||
}
|
||||
|
||||
self.rules.push(rule);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn set_section(&mut self, sec: &mut Sec, to: Sec) -> Result<(), Error> {
|
||||
let prev = std::mem::replace(sec, to);
|
||||
|
||||
match prev {
|
||||
Sec::Ipset(name, ipset) => {
|
||||
if self.ipsets.insert(name.clone(), ipset).is_some() {
|
||||
bail!("duplicate ipset: {name:?}");
|
||||
}
|
||||
}
|
||||
Sec::Group(name, group) => {
|
||||
if self.groups.insert(name.clone(), group).is_some() {
|
||||
bail!("duplicate group: {name:?}");
|
||||
}
|
||||
}
|
||||
_ => (),
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn ipsets(&self) -> &BTreeMap<String, Ipset> {
|
||||
&self.ipsets
|
||||
}
|
||||
|
||||
pub fn alias(&self, name: &str) -> Option<&Alias> {
|
||||
self.aliases.get(name)
|
||||
}
|
||||
}
|
||||
@ -1,3 +1,4 @@
|
||||
pub mod common;
|
||||
pub mod ports;
|
||||
pub mod types;
|
||||
|
||||
|
||||
@ -74,6 +74,26 @@ pub fn match_digits(line: &str) -> Option<(&str, &str)> {
|
||||
|
||||
None
|
||||
}
|
||||
|
||||
/// Separate a `key: value` line, trimming whitespace.
|
||||
///
|
||||
/// Returns `None` if the `key` would be empty.
|
||||
pub fn split_key_value(line: &str) -> Option<(&str, &str)> {
|
||||
line.split_once(':')
|
||||
.map(|(key, value)| (key.trim(), value.trim()))
|
||||
}
|
||||
|
||||
/// Parse a boolean.
|
||||
///
|
||||
/// values that parse as [`false`]: 0, false, off, no
|
||||
/// values that parse as [`true`]: 1, true, on, yes
|
||||
///
|
||||
/// # Examples
|
||||
/// ```ignore
|
||||
/// assert_eq!(parse_bool("false"), Ok(false));
|
||||
/// assert_eq!(parse_bool("on"), Ok(true));
|
||||
/// assert!(parse_bool("proxmox").is_err());
|
||||
/// ```
|
||||
pub fn parse_bool(value: &str) -> Result<bool, Error> {
|
||||
Ok(
|
||||
if value == "0"
|
||||
@ -94,6 +114,196 @@ pub fn parse_bool(value: &str) -> Result<bool, Error> {
|
||||
)
|
||||
}
|
||||
|
||||
/// Parse the *remainder* of a section line, that is `<whitespace>NAME] #optional comment`.
|
||||
/// The `kind` parameter is used for error messages and should be the section type.
|
||||
///
|
||||
/// Return the name and the optional comment.
|
||||
pub fn parse_named_section_tail<'a>(
|
||||
kind: &'static str,
|
||||
line: &'a str,
|
||||
) -> Result<(&'a str, Option<&'a str>), Error> {
|
||||
if line.is_empty() || !line.as_bytes()[0].is_ascii_whitespace() {
|
||||
bail!("incomplete {kind} section");
|
||||
}
|
||||
|
||||
let line = line.trim_start();
|
||||
let (name, line) = match_name(line)
|
||||
.ok_or_else(|| format_err!("expected a name for the {kind} at {line:?}"))?;
|
||||
|
||||
let line = line
|
||||
.strip_prefix(']')
|
||||
.ok_or_else(|| format_err!("expected closing ']' in {kind} section header"))?
|
||||
.trim_start();
|
||||
|
||||
Ok(match line.strip_prefix('#') {
|
||||
Some(comment) => (name, Some(comment.trim())),
|
||||
None if !line.is_empty() => bail!("trailing characters after {kind} section: {line:?}"),
|
||||
None => (name, None),
|
||||
})
|
||||
}
|
||||
|
||||
// parses a number from a string OR number
|
||||
pub mod serde_option_number {
|
||||
use std::fmt;
|
||||
|
||||
use serde::de::{Deserializer, Error, Visitor};
|
||||
|
||||
pub fn deserialize<'de, D: Deserializer<'de>>(
|
||||
deserializer: D,
|
||||
) -> Result<Option<i64>, D::Error> {
|
||||
struct V;
|
||||
|
||||
impl<'de> Visitor<'de> for V {
|
||||
type Value = Option<i64>;
|
||||
|
||||
fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
|
||||
f.write_str("a numerical value")
|
||||
}
|
||||
|
||||
fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
|
||||
v.parse().map_err(E::custom).map(Some)
|
||||
}
|
||||
|
||||
fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
|
||||
Ok(None)
|
||||
}
|
||||
|
||||
fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
|
||||
where
|
||||
D: Deserializer<'de>,
|
||||
{
|
||||
deserializer.deserialize_any(self)
|
||||
}
|
||||
}
|
||||
|
||||
deserializer.deserialize_any(V)
|
||||
}
|
||||
}
|
||||
|
||||
// parses a bool from a string OR bool
|
||||
pub mod serde_option_bool {
|
||||
use std::fmt;
|
||||
|
||||
use serde::de::{Deserializer, Error, Visitor};
|
||||
|
||||
pub fn deserialize<'de, D: Deserializer<'de>>(
|
||||
deserializer: D,
|
||||
) -> Result<Option<bool>, D::Error> {
|
||||
struct V;
|
||||
|
||||
impl<'de> Visitor<'de> for V {
|
||||
type Value = Option<bool>;
|
||||
|
||||
fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
|
||||
f.write_str("a boolean-like value")
|
||||
}
|
||||
|
||||
fn visit_bool<E: Error>(self, v: bool) -> Result<Self::Value, E> {
|
||||
Ok(Some(v))
|
||||
}
|
||||
|
||||
fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
|
||||
super::parse_bool(v).map_err(E::custom).map(Some)
|
||||
}
|
||||
|
||||
fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
|
||||
Ok(None)
|
||||
}
|
||||
|
||||
fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
|
||||
where
|
||||
D: Deserializer<'de>,
|
||||
{
|
||||
deserializer.deserialize_any(self)
|
||||
}
|
||||
}
|
||||
|
||||
deserializer.deserialize_any(V)
|
||||
}
|
||||
}
|
||||
|
||||
// parses a comma_separated list of strings
|
||||
pub mod serde_option_conntrack_helpers {
|
||||
use std::fmt;
|
||||
|
||||
use serde::de::{Deserializer, Error, Visitor};
|
||||
|
||||
pub fn deserialize<'de, D: Deserializer<'de>>(
|
||||
deserializer: D,
|
||||
) -> Result<Option<Vec<String>>, D::Error> {
|
||||
struct V;
|
||||
|
||||
impl<'de> Visitor<'de> for V {
|
||||
type Value = Option<Vec<String>>;
|
||||
|
||||
fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
|
||||
f.write_str("A list of conntrack helpers")
|
||||
}
|
||||
|
||||
fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
|
||||
if v.is_empty() {
|
||||
return Ok(None);
|
||||
}
|
||||
|
||||
Ok(Some(v.split(',').map(String::from).collect()))
|
||||
}
|
||||
|
||||
fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
|
||||
Ok(None)
|
||||
}
|
||||
|
||||
fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
|
||||
where
|
||||
D: Deserializer<'de>,
|
||||
{
|
||||
deserializer.deserialize_any(self)
|
||||
}
|
||||
}
|
||||
|
||||
deserializer.deserialize_any(V)
|
||||
}
|
||||
}
|
||||
|
||||
// parses a log_ratelimit string: '[enable=]<1|0> [,burst=<integer>] [,rate=<rate>]'
|
||||
pub mod serde_option_log_ratelimit {
|
||||
use std::fmt;
|
||||
|
||||
use serde::de::{Deserializer, Error, Visitor};
|
||||
|
||||
use crate::firewall::types::log::LogRateLimit;
|
||||
|
||||
pub fn deserialize<'de, D: Deserializer<'de>>(
|
||||
deserializer: D,
|
||||
) -> Result<Option<LogRateLimit>, D::Error> {
|
||||
struct V;
|
||||
|
||||
impl<'de> Visitor<'de> for V {
|
||||
type Value = Option<LogRateLimit>;
|
||||
|
||||
fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
|
||||
f.write_str("a boolean-like value")
|
||||
}
|
||||
|
||||
fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
|
||||
v.parse().map_err(E::custom).map(Some)
|
||||
}
|
||||
|
||||
fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
|
||||
Ok(None)
|
||||
}
|
||||
|
||||
fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
|
||||
where
|
||||
D: Deserializer<'de>,
|
||||
{
|
||||
deserializer.deserialize_any(self)
|
||||
}
|
||||
}
|
||||
|
||||
deserializer.deserialize_any(V)
|
||||
}
|
||||
}
|
||||
|
||||
/// `&str` deserializer which also accepts an `Option`.
|
||||
///
|
||||
/// Serde's `StringDeserializer` does not.
|
||||
|
||||
Loading…
Reference in New Issue
Block a user