[pve-devel] [PATCH proxmox-firewall 11/37] config: firewall: add generic parser for firewall configs
Max Carrara
m.carrara at proxmox.com
Wed Apr 3 12:47:05 CEST 2024
On Tue Apr 2, 2024 at 7:16 PM CEST, Stefan Hanreich wrote:
> Since the basic format of cluster, host and guest firewall
> configurations is the same, we create a generic parser that can handle
> the common config format. The main difference is in the available
> options, which can be passed via a generic parameter.
>
> Co-authored-by: Wolfgang Bumiller <w.bumiller at proxmox.com>
> Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
> ---
> proxmox-ve-config/src/firewall/common.rs | 182 +++++++++++++++++++++
> proxmox-ve-config/src/firewall/mod.rs | 1 +
> proxmox-ve-config/src/firewall/parse.rs | 200 +++++++++++++++++++++++
> 3 files changed, 383 insertions(+)
> create mode 100644 proxmox-ve-config/src/firewall/common.rs
>
> diff --git a/proxmox-ve-config/src/firewall/common.rs b/proxmox-ve-config/src/firewall/common.rs
> new file mode 100644
> index 0000000..887339b
> --- /dev/null
> +++ b/proxmox-ve-config/src/firewall/common.rs
> @@ -0,0 +1,182 @@
> +use std::collections::HashMap;
> +use std::io;
> +
> +use anyhow::{bail, format_err, Error};
> +use serde::de::IntoDeserializer;
> +
> +use crate::firewall::parse::{parse_named_section_tail, split_key_value, SomeString};
> +use crate::firewall::types::ipset::{IpsetName, IpsetScope};
> +use crate::firewall::types::{Alias, Group, Ipset, Rule};
> +
> +#[derive(Debug, Default)]
> +pub struct Config<O>
> +where
> + O: Default + std::fmt::Debug + serde::de::DeserializeOwned,
> +{
> + pub(crate) options: O,
> + pub(crate) rules: Vec<Rule>,
> + pub(crate) aliases: HashMap<String, Alias>,
> + pub(crate) ipsets: HashMap<String, Ipset>,
> + pub(crate) groups: HashMap<String, Group>,
> +}
> +
> +enum Sec {
> + None,
> + Options,
> + Aliases,
> + Rules,
> + Ipset(String, Ipset),
> + Group(String, Group),
> +}
> +
> +#[derive(Default)]
> +pub struct ParserConfig {
> + /// Network interfaces must be of the form `netX`.
> + pub guest_iface_names: bool,
> + pub ipset_scope: Option<IpsetScope>,
> +}
> +
> +impl<O> Config<O>
> +where
> + O: Default + std::fmt::Debug + serde::de::DeserializeOwned,
> +{
> + pub fn new() -> Self {
> + Self::default()
> + }
> +
> + pub fn parse<R: io::BufRead>(input: R, parser_cfg: &ParserConfig) -> Result<Self, Error> {
> + let mut section = Sec::None;
> +
> + let mut this = Self::new();
> + let mut options = HashMap::new();
> +
> + for line in input.lines() {
> + let line = line?;
> + let line = line.trim();
> +
> + if line.is_empty() || line.starts_with('#') {
> + continue;
> + }
> +
> + if line.eq_ignore_ascii_case("[OPTIONS]") {
> + this.set_section(&mut section, Sec::Options)?;
> + } else if line.eq_ignore_ascii_case("[ALIASES]") {
> + this.set_section(&mut section, Sec::Aliases)?;
> + } else if line.eq_ignore_ascii_case("[RULES]") {
> + this.set_section(&mut section, Sec::Rules)?;
> + } else if let Some(line) = line.strip_prefix("[IPSET") {
> + let (name, comment) = parse_named_section_tail("ipset", line)?;
> +
> + let scope = parser_cfg.ipset_scope.ok_or_else(|| {
> + format_err!("IPSET in config, but no scope set in parser config")
> + })?;
> +
> + let ipset_name = IpsetName::new(scope, name.to_string());
> + let mut ipset = Ipset::new(ipset_name);
> + ipset.comment = comment.map(str::to_owned);
> +
> + this.set_section(&mut section, Sec::Ipset(name.to_string(), ipset))?;
> + } else if let Some(line) = line.strip_prefix("[group") {
> + let (name, comment) = parse_named_section_tail("group", line)?;
> + let mut group = Group::new();
> +
> + group.set_comment(comment.map(str::to_owned));
> +
> + this.set_section(&mut section, Sec::Group(name.to_owned(), group))?;
> + } else if line.starts_with('[') {
> + bail!("invalid section {line:?}");
> + } else {
> + match &mut section {
> + Sec::None => bail!("config line with no section: {line:?}"),
> + Sec::Options => Self::parse_option(line, &mut options)?,
> + Sec::Aliases => this.parse_alias(line)?,
> + Sec::Rules => this.parse_rule(line, parser_cfg)?,
> + Sec::Ipset(_name, ipset) => ipset.parse_entry(line)?,
> + Sec::Group(_name, group) => group.parse_entry(line)?,
> + }
> + }
> + }
> + this.set_section(&mut section, Sec::None)?;
> +
> + this.options = O::deserialize(IntoDeserializer::<
> + '_,
> + crate::firewall::parse::SerdeStringError,
> + >::into_deserializer(options))?;
> +
> + Ok(this)
> + }
> +
> + fn parse_option(line: &str, options: &mut HashMap<String, SomeString>) -> Result<(), Error> {
> + let (key, value) = split_key_value(line)
> + .ok_or_else(|| format_err!("expected colon separated key and value, found {line:?}"))?;
> +
> + if options.insert(key.to_string(), value.into()).is_some() {
> + bail!("duplicate option {key:?}");
> + }
> +
> + Ok(())
> + }
> +
> + fn parse_alias(&mut self, line: &str) -> Result<(), Error> {
> + let alias: Alias = line.parse()?;
> +
> + if self
> + .aliases
> + .insert(alias.name().to_string(), alias)
> + .is_some()
> + {
> + bail!("duplicate alias: {line}");
> + }
> +
> + Ok(())
> + }
> +
> + fn parse_rule(&mut self, line: &str, parser_cfg: &ParserConfig) -> Result<(), Error> {
> + let rule: Rule = line.parse()?;
> +
> + if parser_cfg.guest_iface_names {
> + if let Some(iface) = rule.iface() {
> + let _ = iface
> + .strip_prefix("net")
> + .ok_or_else(|| {
> + format_err!("interface name must be of the form \"net<number>\"")
> + })?
> + .parse::<u16>()
> + .map_err(|_| {
> + format_err!("interface name must be of the form \"net<number>\"")
> + })?;
> + }
> + }
> +
> + self.rules.push(rule);
> + Ok(())
> + }
> +
> + fn set_section(&mut self, sec: &mut Sec, to: Sec) -> Result<(), Error> {
> + let prev = std::mem::replace(sec, to);
> +
> + match prev {
> + Sec::Ipset(name, ipset) => {
> + if self.ipsets.insert(name.clone(), ipset).is_some() {
> + bail!("duplicate ipset: {name:?}");
> + }
> + }
> + Sec::Group(name, group) => {
> + if self.groups.insert(name.clone(), group).is_some() {
> + bail!("duplicate group: {name:?}");
> + }
> + }
> + _ => (),
> + }
> +
> + Ok(())
> + }
> +
> + pub fn ipsets(&self) -> &HashMap<String, Ipset> {
> + &self.ipsets
> + }
> +
> + pub fn alias(&self, name: &str) -> Option<&Alias> {
> + self.aliases.get(name)
> + }
> +}
> diff --git a/proxmox-ve-config/src/firewall/mod.rs b/proxmox-ve-config/src/firewall/mod.rs
> index 2e0f31e..591ee52 100644
> --- a/proxmox-ve-config/src/firewall/mod.rs
> +++ b/proxmox-ve-config/src/firewall/mod.rs
> @@ -1,3 +1,4 @@
> +pub mod common;
> pub mod ports;
> pub mod types;
>
> diff --git a/proxmox-ve-config/src/firewall/parse.rs b/proxmox-ve-config/src/firewall/parse.rs
> index 227e045..9cc2b8a 100644
> --- a/proxmox-ve-config/src/firewall/parse.rs
> +++ b/proxmox-ve-config/src/firewall/parse.rs
> @@ -61,6 +61,16 @@ pub fn match_digits(line: &str) -> Option<(&str, &str)> {
>
> None
> }
> +
> +/// Separate a `key: value` line, trimming whitespace.
> +///
> +/// Returns `None` if the `key` would be empty.
> +pub fn split_key_value(line: &str) -> Option<(&str, &str)> {
> + line.split_once(':')
> + .map(|(key, value)| (key.trim(), value.trim()))
> +}
> +
> +/// Parse a boolean.
> pub fn parse_bool(value: &str) -> Result<bool, Error> {
> Ok(
> if value == "0"
> @@ -81,6 +91,196 @@ pub fn parse_bool(value: &str) -> Result<bool, Error> {
> )
> }
>
> +/// Parse the *remainder* of a section line, that is `<whitespace>NAME] #optional comment`.
> +/// The `kind` parameter is used for error messages and should be the section type.
> +///
> +/// Return the name and the optional comment.
> +pub fn parse_named_section_tail<'a>(
> + kind: &'static str,
> + line: &'a str,
> +) -> Result<(&'a str, Option<&'a str>), Error> {
> + if line.is_empty() || !line.as_bytes()[0].is_ascii_whitespace() {
> + bail!("incomplete {kind} section");
> + }
> +
> + let line = line.trim_start();
> + let (name, line) = match_name(line)
> + .ok_or_else(|| format_err!("expected a name for the {kind} at {line:?}"))?;
> +
> + let line = line
> + .strip_prefix(']')
> + .ok_or_else(|| format_err!("expected closing ']' in {kind} section header"))?
> + .trim_start();
> +
> + Ok(match line.strip_prefix('#') {
> + Some(comment) => (name, Some(comment.trim())),
> + None if !line.is_empty() => bail!("trailing characters after {kind} section: {line:?}"),
> + None => (name, None),
> + })
> +}
> +
> +// parses a number from a string OR number
> +pub mod serde_option_number {
Since this is `pub`, I think a more complete docstring here would be
better instead of a comment. Though I haven't generated the docs for all
of this (yet) I have to admit, so I'm not sure if this actually shows
up.
> + use std::fmt;
> +
> + use serde::de::{Deserializer, Error, Visitor};
> +
> + pub fn deserialize<'de, D: Deserializer<'de>>(
> + deserializer: D,
> + ) -> Result<Option<i64>, D::Error> {
> + struct V;
> +
> + impl<'de> Visitor<'de> for V {
> + type Value = Option<i64>;
> +
> + fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
> + f.write_str("a numerical value")
> + }
> +
> + fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
> + v.parse().map_err(E::custom).map(Some)
> + }
> +
> + fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
> + Ok(None)
> + }
> +
> + fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
> + where
> + D: Deserializer<'de>,
> + {
> + deserializer.deserialize_any(self)
> + }
> + }
> +
> + deserializer.deserialize_any(V)
> + }
> +}
> +
> +// parses a bool from a string OR bool
> +pub mod serde_option_bool {
^ Same as above.
> + use std::fmt;
> +
> + use serde::de::{Deserializer, Error, Visitor};
> +
> + pub fn deserialize<'de, D: Deserializer<'de>>(
> + deserializer: D,
> + ) -> Result<Option<bool>, D::Error> {
> + struct V;
> +
> + impl<'de> Visitor<'de> for V {
> + type Value = Option<bool>;
> +
> + fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
> + f.write_str("a boolean-like value")
> + }
> +
> + fn visit_bool<E: Error>(self, v: bool) -> Result<Self::Value, E> {
> + Ok(Some(v))
> + }
> +
> + fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
> + super::parse_bool(v).map_err(E::custom).map(Some)
> + }
> +
> + fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
> + Ok(None)
> + }
> +
> + fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
> + where
> + D: Deserializer<'de>,
> + {
> + deserializer.deserialize_any(self)
> + }
> + }
> +
> + deserializer.deserialize_any(V)
> + }
> +}
> +
> +// parses a comma_separated list of strings
> +pub mod serde_option_conntrack_helpers {
^ Same as above here as well.
> + use std::fmt;
> +
> + use serde::de::{Deserializer, Error, Visitor};
> +
> + pub fn deserialize<'de, D: Deserializer<'de>>(
> + deserializer: D,
> + ) -> Result<Option<Vec<String>>, D::Error> {
> + struct V;
> +
> + impl<'de> Visitor<'de> for V {
> + type Value = Option<Vec<String>>;
> +
> + fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
> + f.write_str("A list of conntrack helpers")
> + }
> +
> + fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
> + if v.is_empty() {
> + return Ok(None);
> + }
> +
> + Ok(Some(v.split(',').map(String::from).collect()))
> + }
> +
> + fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
> + Ok(None)
> + }
> +
> + fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
> + where
> + D: Deserializer<'de>,
> + {
> + deserializer.deserialize_any(self)
> + }
> + }
> +
> + deserializer.deserialize_any(V)
> + }
> +}
> +
> +// parses a log_ratelimit string: '[enable=]<1|0> [,burst=<integer>] [,rate=<rate>]'
> +pub mod serde_option_log_ratelimit {
^ And here.
> + use std::fmt;
> +
> + use serde::de::{Deserializer, Error, Visitor};
> +
> + use crate::firewall::types::log::LogRateLimit;
> +
> + pub fn deserialize<'de, D: Deserializer<'de>>(
> + deserializer: D,
> + ) -> Result<Option<LogRateLimit>, D::Error> {
> + struct V;
> +
> + impl<'de> Visitor<'de> for V {
> + type Value = Option<LogRateLimit>;
> +
> + fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
> + f.write_str("a boolean-like value")
> + }
> +
> + fn visit_str<E: Error>(self, v: &str) -> Result<Self::Value, E> {
> + v.parse().map_err(E::custom).map(Some)
> + }
> +
> + fn visit_none<E: Error>(self) -> Result<Self::Value, E> {
> + Ok(None)
> + }
> +
> + fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
> + where
> + D: Deserializer<'de>,
> + {
> + deserializer.deserialize_any(self)
> + }
> + }
> +
> + deserializer.deserialize_any(V)
> + }
> +}
> +
> /// `&str` deserializer which also accepts an `Option`.
> ///
> /// Serde's `StringDeserializer` does not.
More information about the pve-devel
mailing list