[pve-devel] [PATCH proxmox-firewall 11/37] config: firewall: add generic parser for firewall configs
Stefan Hanreich
s.hanreich at proxmox.com
Tue Apr 2 19:16:03 CEST 2024
Since the basic format of cluster, host and guest firewall
configurations is the same, we create a generic parser that can handle
the common config format. The main difference is in the available
options, which can be passed via a generic parameter.
Co-authored-by: Wolfgang Bumiller <w.bumiller at proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
---
proxmox-ve-config/src/firewall/common.rs | 182 +++++++++++++++++++++
proxmox-ve-config/src/firewall/mod.rs | 1 +
proxmox-ve-config/src/firewall/parse.rs | 200 +++++++++++++++++++++++
3 files changed, 383 insertions(+)
create mode 100644 proxmox-ve-config/src/firewall/common.rs
diff --git a/proxmox-ve-config/src/firewall/common.rs b/proxmox-ve-config/src/firewall/common.rs
new file mode 100644
index 0000000..887339b
--- /dev/null
+++ b/proxmox-ve-config/src/firewall/common.rs
@@ -0,0 +1,182 @@
+use std::collections::HashMap;
+use std::io;
+
+use anyhow::{bail, format_err, Error};
+use serde::de::IntoDeserializer;
+
+use crate::firewall::parse::{parse_named_section_tail, split_key_value, SomeString};
+use crate::firewall::types::ipset::{IpsetName, IpsetScope};
+use crate::firewall::types::{Alias, Group, Ipset, Rule};
+
+#[derive(Debug, Default)]
+pub struct Config<O>
+where
+ O: Default + std::fmt::Debug + serde::de::DeserializeOwned,
+{
+ pub(crate) options: O,
+ pub(crate) rules: Vec<Rule>,
+ pub(crate) aliases: HashMap<String, Alias>,
+ pub(crate) ipsets: HashMap<String, Ipset>,
+ pub(crate) groups: HashMap<String, Group>,
+}
+
+enum Sec {
+ None,
+ Options,
+ Aliases,
+ Rules,
+ Ipset(String, Ipset),
+ Group(String, Group),
+}
+
+#[derive(Default)]
+pub struct ParserConfig {
+ /// Network interfaces must be of the form `netX`.
+ pub guest_iface_names: bool,
+ pub ipset_scope: Option<IpsetScope>,
+}
+
+impl<O> Config<O>
+where
+ O: Default + std::fmt::Debug + serde::de::DeserializeOwned,
+{
+ pub fn new() -> Self {
+ Self::default()
+ }
+
+ pub fn parse<R: io::BufRead>(input: R, parser_cfg: &ParserConfig) -> Result<Self, Error> {
+ let mut section = Sec::None;
+
+ let mut this = Self::new();
+ let mut options = HashMap::new();
+
+ for line in input.lines() {
+ let line = line?;
+ let line = line.trim();
+
+ if line.is_empty() || line.starts_with('#') {
+ continue;
+ }
+
+ if line.eq_ignore_ascii_case("[OPTIONS]") {
+ this.set_section(&mut section, Sec::Options)?;
+ } else if line.eq_ignore_ascii_case("[ALIASES]") {
+ this.set_section(&mut section, Sec::Aliases)?;
+ } else if line.eq_ignore_ascii_case("[RULES]") {
+ this.set_section(&mut section, Sec::Rules)?;
+ } else if let Some(line) = line.strip_prefix("[IPSET") {
+ let (name, comment) = parse_named_section_tail("ipset", line)?;
+
+ let scope = parser_cfg.ipset_scope.ok_or_else(|| {
+ format_err!("IPSET in config, but no scope set in parser config")
+ })?;
+
+ let ipset_name = IpsetName::new(scope, name.to_string());
+ let mut ipset = Ipset::new(ipset_name);
+ ipset.comment = comment.map(str::to_owned);
+
+ this.set_section(&mut section, Sec::Ipset(name.to_string(), ipset))?;
+ } else if let Some(line) = line.strip_prefix("[group") {
+ let (name, comment) = parse_named_section_tail("group", line)?;
+ let mut group = Group::new();
+
+ group.set_comment(comment.map(str::to_owned));
+
+ this.set_section(&mut section, Sec::Group(name.to_owned(), group))?;
+ } else if line.starts_with('[') {
+ bail!("invalid section {line:?}");
+ } else {
+ match &mut section {
+ Sec::None => bail!("config line with no section: {line:?}"),
+ Sec::Options => Self::parse_option(line, &mut options)?,
+ Sec::Aliases => this.parse_alias(line)?,
+ Sec::Rules => this.parse_rule(line, parser_cfg)?,
+ Sec::Ipset(_name, ipset) => ipset.parse_entry(line)?,
+ Sec::Group(_name, group) => group.parse_entry(line)?,
+ }
+ }
+ }
+ this.set_section(&mut section, Sec::None)?;
+
+ this.options = O::deserialize(IntoDeserializer::<
+ '_,
+ crate::firewall::parse::SerdeStringError,
+ >::into_deserializer(options))?;
+
+ Ok(this)
+ }
+
+ fn parse_option(line: &str, options: &mut HashMap<String, SomeString>) -> Result<(), Error> {
+ let (key, value) = split_key_value(line)
+ .ok_or_else(|| format_err!("expected colon separated key and value, found {line:?}"))?;
+
+ if options.insert(key.to_string(), value.into()).is_some() {
+ bail!("duplicate option {key:?}");
+ }
+
+ Ok(())
+ }
+
+ fn parse_alias(&mut self, line: &str) -> Result<(), Error> {
+ let alias: Alias = line.parse()?;
+
+ if self
+ .aliases
+ .insert(alias.name().to_string(), alias)
+ .is_some()
+ {
+ bail!("duplicate alias: {line}");
+ }
+
+ Ok(())
+ }
+
+ fn parse_rule(&mut self, line: &str, parser_cfg: &ParserConfig) -> Result<(), Error> {
+ let rule: Rule = line.parse()?;
+
+ if parser_cfg.guest_iface_names {
+ if let Some(iface) = rule.iface() {
+ let _ = iface
+ .strip_prefix("net")
+ .ok_or_else(|| {
+ format_err!("interface name must be of the form \"net<number>\"")
+ })?
+ .parse::<u16>()
+ .map_err(|_| {
+ format_err!("interface name must be of the form \"net<number>\"")
+ })?;
+ }
+ }
+
+ self.rules.push(rule);
+ Ok(())
+ }
+
+ fn set_section(&mut self, sec: &mut Sec, to: Sec) -> Result<(), Error> {
+ let prev = std::mem::replace(sec, to);
+
+ match prev {
+ Sec::Ipset(name, ipset) => {
+ if self.ipsets.insert(name.clone(), ipset).is_some() {
+ bail!("duplicate ipset: {name:?}");
+ }
+ }
+ Sec::Group(name, group) => {
+ if self.groups.insert(name.clone(), group).is_some() {
+ bail!("duplicate group: {name:?}");
+ }
+ }
+ _ => (),
+ }
+
+ Ok(())
+ }
+
+ pub fn ipsets(&self) -> &HashMap<String, Ipset> {
+ &self.ipsets
+ }
+
+ pub fn alias(&self, name: &str) -> Option<&Alias> {
+ self.aliases.get(name)
+ }
+}
diff --git a/proxmox-ve-config/src/firewall/mod.rs b/proxmox-ve-config/src/firewall/mod.rs
index 2e0f31e..591ee52 100644
--- a/proxmox-ve-config/src/firewall/mod.rs
+++ b/proxmox-ve-config/src/firewall/mod.rs
@@ -1,3 +1,4 @@
+pub mod common;
pub mod ports;
pub mod types;
diff --git a/proxmox-ve-config/src/firewall/parse.rs b/proxmox-ve-config/src/firewall/parse.rs
index 227e045..9cc2b8a 100644
--- a/proxmox-ve-config/src/firewall/parse.rs
+++ b/proxmox-ve-config/src/firewall/parse.rs
@@ -61,6 +61,16 @@ pub fn match_digits(line: &str) -> Option<(&str, &str)> {
None
}
+
+/// Separate a `key: value` line, trimming whitespace.
+///
+/// Returns `None` if the `key` would be empty.
+pub fn split_key_value(line: &str) -> Option<(&str, &str)> {
+ line.split_once(':')
+ .map(|(key, value)| (key.trim(), value.trim()))
+}
+
+/// Parse a boolean.
pub fn parse_bool(value: &str) -> Result<bool, Error> {
Ok(
if value == "0"
@@ -81,6 +91,196 @@ pub fn parse_bool(value: &str) -> Result<bool, Error> {
)
}
+/// Parse the *remainder* of a section line, that is `<whitespace>NAME] #optional comment`.
+/// The `kind` parameter is used for error messages and should be the section type.
+///
+/// Return the name and the optional comment.
+pub fn parse_named_section_tail<'a>(
+ kind: &'static str,
+ line: &'a str,
+) -> Result<(&'a str, Option<&'a str>), Error> {
+ if line.is_empty() || !line.as_bytes()[0].is_ascii_whitespace() {
+ bail!("incomplete {kind} section");
+ }
+
+ let line = line.trim_start();
+ let (name, line) = match_name(line)
+ .ok_or_else(|| format_err!("expected a name for the {kind} at {line:?}"))?;
+
+ let line = line
+ .strip_prefix(']')
+ .ok_or_else(|| format_err!("expected closing ']' in {kind} section header"))?
+ .trim_start();
+
+ Ok(match line.strip_prefix('#') {
+ Some(comment) => (name, Some(comment.trim())),
+ None if !line.is_empty() => bail!("trailing characters after {kind} section: {line:?}"),
+ None => (name, None),
+ })
+}
+
+// parses a number from a string OR number
+pub mod serde_option_number {
+ use std::fmt;
+
+ use serde::de::{Deserializer, Error, Visitor};
+
+ pub fn deserialize<'de, D: Deserializer<'de>>(
+ deserializer: D,
+ ) -> Result<Option<i64>, D::Error> {
+ struct V;
+
+ impl<'de> Visitor<'de> for V {
+ type Value = Option<i64>;
+
+ fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+ f.write_str("a numerical value")
+ }
+
+ fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
+ v.parse().map_err(E::custom).map(Some)
+ }
+
+ fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
+ Ok(None)
+ }
+
+ fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
+ where
+ D: Deserializer<'de>,
+ {
+ deserializer.deserialize_any(self)
+ }
+ }
+
+ deserializer.deserialize_any(V)
+ }
+}
+
+// parses a bool from a string OR bool
+pub mod serde_option_bool {
+ use std::fmt;
+
+ use serde::de::{Deserializer, Error, Visitor};
+
+ pub fn deserialize<'de, D: Deserializer<'de>>(
+ deserializer: D,
+ ) -> Result<Option<bool>, D::Error> {
+ struct V;
+
+ impl<'de> Visitor<'de> for V {
+ type Value = Option<bool>;
+
+ fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+ f.write_str("a boolean-like value")
+ }
+
+ fn visit_bool<E: Error>(self, v: bool) -> Result<Self::Value, E> {
+ Ok(Some(v))
+ }
+
+ fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
+ super::parse_bool(v).map_err(E::custom).map(Some)
+ }
+
+ fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
+ Ok(None)
+ }
+
+ fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
+ where
+ D: Deserializer<'de>,
+ {
+ deserializer.deserialize_any(self)
+ }
+ }
+
+ deserializer.deserialize_any(V)
+ }
+}
+
+// parses a comma_separated list of strings
+pub mod serde_option_conntrack_helpers {
+ use std::fmt;
+
+ use serde::de::{Deserializer, Error, Visitor};
+
+ pub fn deserialize<'de, D: Deserializer<'de>>(
+ deserializer: D,
+ ) -> Result<Option<Vec<String>>, D::Error> {
+ struct V;
+
+ impl<'de> Visitor<'de> for V {
+ type Value = Option<Vec<String>>;
+
+ fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+ f.write_str("A list of conntrack helpers")
+ }
+
+ fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
+ if v.is_empty() {
+ return Ok(None);
+ }
+
+ Ok(Some(v.split(',').map(String::from).collect()))
+ }
+
+ fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
+ Ok(None)
+ }
+
+ fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
+ where
+ D: Deserializer<'de>,
+ {
+ deserializer.deserialize_any(self)
+ }
+ }
+
+ deserializer.deserialize_any(V)
+ }
+}
+
+// parses a log_ratelimit string: '[enable=]<1|0> [,burst=<integer>] [,rate=<rate>]'
+pub mod serde_option_log_ratelimit {
+ use std::fmt;
+
+ use serde::de::{Deserializer, Error, Visitor};
+
+ use crate::firewall::types::log::LogRateLimit;
+
+ pub fn deserialize<'de, D: Deserializer<'de>>(
+ deserializer: D,
+ ) -> Result<Option<LogRateLimit>, D::Error> {
+ struct V;
+
+ impl<'de> Visitor<'de> for V {
+ type Value = Option<LogRateLimit>;
+
+ fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+ f.write_str("a boolean-like value")
+ }
+
+ fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
+ v.parse().map_err(E::custom).map(Some)
+ }
+
+ fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
+ Ok(None)
+ }
+
+ fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
+ where
+ D: Deserializer<'de>,
+ {
+ deserializer.deserialize_any(self)
+ }
+ }
+
+ deserializer.deserialize_any(V)
+ }
+}
+
/// `&str` deserializer which also accepts an `Option`.
///
/// Serde's `StringDeserializer` does not.
--
2.39.2
More information about the pve-devel
mailing list