[pve-devel] [PATCH proxmox-firewall v3 04/39] config: firewall: add types for log level and rate limit
Stefan Hanreich
s.hanreich at proxmox.com
Thu Apr 18 18:13:59 CEST 2024
Adds types for log and (log-)rate-limiting firewall config options as
well as FromStr implementations for parsing them from the config.
Reviewed-by: Lukas Wagner <l.wagner at proxmox.com>
Reviewed-by: Max Carrara <m.carrara at proxmox.com>
Co-authored-by: Wolfgang Bumiller <w.bumiller at proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
---
proxmox-ve-config/Cargo.toml | 1 +
proxmox-ve-config/src/firewall/mod.rs | 2 +
proxmox-ve-config/src/firewall/parse.rs | 21 ++
proxmox-ve-config/src/firewall/types/log.rs | 222 ++++++++++++++++++++
proxmox-ve-config/src/firewall/types/mod.rs | 1 +
5 files changed, 247 insertions(+)
create mode 100644 proxmox-ve-config/src/firewall/parse.rs
create mode 100644 proxmox-ve-config/src/firewall/types/log.rs
diff --git a/proxmox-ve-config/Cargo.toml b/proxmox-ve-config/Cargo.toml
index 80b336a..7bb391e 100644
--- a/proxmox-ve-config/Cargo.toml
+++ b/proxmox-ve-config/Cargo.toml
@@ -16,4 +16,5 @@ anyhow = "1"
serde = { version = "1", features = [ "derive" ] }
serde_json = "1"
+serde_plain = "1"
serde_with = "2.3.3"
diff --git a/proxmox-ve-config/src/firewall/mod.rs b/proxmox-ve-config/src/firewall/mod.rs
index a9f65bf..2e0f31e 100644
--- a/proxmox-ve-config/src/firewall/mod.rs
+++ b/proxmox-ve-config/src/firewall/mod.rs
@@ -1,2 +1,4 @@
pub mod ports;
pub mod types;
+
+pub(crate) mod parse;
diff --git a/proxmox-ve-config/src/firewall/parse.rs b/proxmox-ve-config/src/firewall/parse.rs
new file mode 100644
index 0000000..a75daee
--- /dev/null
+++ b/proxmox-ve-config/src/firewall/parse.rs
@@ -0,0 +1,21 @@
+use anyhow::{bail, format_err, Error};
+
+pub fn parse_bool(value: &str) -> Result<bool, Error> {
+ Ok(
+ if value == "0"
+ || value.eq_ignore_ascii_case("false")
+ || value.eq_ignore_ascii_case("off")
+ || value.eq_ignore_ascii_case("no")
+ {
+ false
+ } else if value == "1"
+ || value.eq_ignore_ascii_case("true")
+ || value.eq_ignore_ascii_case("on")
+ || value.eq_ignore_ascii_case("yes")
+ {
+ true
+ } else {
+ bail!("not a boolean: {value:?}");
+ },
+ )
+}
diff --git a/proxmox-ve-config/src/firewall/types/log.rs b/proxmox-ve-config/src/firewall/types/log.rs
new file mode 100644
index 0000000..72344e4
--- /dev/null
+++ b/proxmox-ve-config/src/firewall/types/log.rs
@@ -0,0 +1,222 @@
+use std::fmt;
+use std::str::FromStr;
+
+use crate::firewall::parse::parse_bool;
+use anyhow::{bail, Error};
+use serde::{Deserialize, Serialize};
+
+#[derive(Copy, Clone, Debug, Deserialize, Serialize, Default)]
+#[cfg_attr(test, derive(Eq, PartialEq))]
+#[serde(rename_all = "lowercase")]
+pub enum LogRateLimitTimescale {
+ #[default]
+ Second,
+ Minute,
+ Hour,
+ Day,
+}
+
+impl FromStr for LogRateLimitTimescale {
+ type Err = Error;
+
+ fn from_str(str: &str) -> Result<Self, Error> {
+ match str {
+ "second" => Ok(LogRateLimitTimescale::Second),
+ "minute" => Ok(LogRateLimitTimescale::Minute),
+ "hour" => Ok(LogRateLimitTimescale::Hour),
+ "day" => Ok(LogRateLimitTimescale::Day),
+ _ => bail!("Invalid time scale provided"),
+ }
+ }
+}
+
+#[derive(Debug, Deserialize, Clone)]
+#[cfg_attr(test, derive(Eq, PartialEq))]
+pub struct LogRateLimit {
+ enabled: bool,
+ rate: i64, // in packets
+ per: LogRateLimitTimescale,
+ burst: i64, // in packets
+}
+
+impl LogRateLimit {
+ pub fn new(enabled: bool, rate: i64, per: LogRateLimitTimescale, burst: i64) -> Self {
+ Self {
+ enabled,
+ rate,
+ per,
+ burst,
+ }
+ }
+
+ pub fn enabled(&self) -> bool {
+ self.enabled
+ }
+
+ pub fn rate(&self) -> i64 {
+ self.rate
+ }
+
+ pub fn burst(&self) -> i64 {
+ self.burst
+ }
+
+ pub fn per(&self) -> LogRateLimitTimescale {
+ self.per
+ }
+}
+
+impl Default for LogRateLimit {
+ fn default() -> Self {
+ Self {
+ enabled: true,
+ rate: 1,
+ burst: 5,
+ per: LogRateLimitTimescale::Second,
+ }
+ }
+}
+
+impl FromStr for LogRateLimit {
+ type Err = Error;
+
+ fn from_str(str: &str) -> Result<Self, Error> {
+ let mut limit = Self::default();
+
+ for element in str.split(',') {
+ match element.split_once('=') {
+ None => {
+ limit.enabled = parse_bool(element)?;
+ }
+ Some((key, value)) if !key.is_empty() && !value.is_empty() => match key {
+ "enable" => limit.enabled = parse_bool(value)?,
+ "burst" => limit.burst = i64::from_str(value)?,
+ "rate" => match value.split_once('/') {
+ None => {
+ limit.rate = i64::from_str(value)?;
+ }
+ Some((rate, unit)) => {
+ if unit.is_empty() {
+ bail!("empty unit specification")
+ }
+
+ limit.rate = i64::from_str(rate)?;
+ limit.per = LogRateLimitTimescale::from_str(unit)?;
+ }
+ },
+ _ => bail!("Invalid value for Key found in log_ratelimit!"),
+ },
+ _ => bail!("invalid value in log_ratelimit"),
+ }
+ }
+
+ Ok(limit)
+ }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Default)]
+pub enum LogLevel {
+ #[default]
+ Nolog,
+ Emergency,
+ Alert,
+ Critical,
+ Error,
+ Warning,
+ Notice,
+ Info,
+ Debug,
+}
+
+impl std::str::FromStr for LogLevel {
+ type Err = Error;
+
+ fn from_str(s: &str) -> Result<Self, Error> {
+ Ok(match s {
+ "nolog" => LogLevel::Nolog,
+ "emerg" => LogLevel::Emergency,
+ "alert" => LogLevel::Alert,
+ "crit" => LogLevel::Critical,
+ "err" => LogLevel::Error,
+ "warn" => LogLevel::Warning,
+ "warning" => LogLevel::Warning,
+ "notice" => LogLevel::Notice,
+ "info" => LogLevel::Info,
+ "debug" => LogLevel::Debug,
+ _ => bail!("invalid log level {s:?}"),
+ })
+ }
+}
+
+impl fmt::Display for LogLevel {
+ fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+ f.write_str(match self {
+ LogLevel::Nolog => "nolog",
+ LogLevel::Emergency => "emerg",
+ LogLevel::Alert => "alert",
+ LogLevel::Critical => "crit",
+ LogLevel::Error => "err",
+ LogLevel::Warning => "warn",
+ LogLevel::Notice => "notice",
+ LogLevel::Info => "info",
+ LogLevel::Debug => "debug",
+ })
+ }
+}
+
+serde_plain::derive_deserialize_from_fromstr!(LogLevel, "valid log level");
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn test_parse_rate_limit() {
+ let mut parsed_rate_limit = "1,burst=123,rate=44"
+ .parse::<LogRateLimit>()
+ .expect("valid rate limit");
+
+ assert_eq!(
+ parsed_rate_limit,
+ LogRateLimit {
+ enabled: true,
+ burst: 123,
+ rate: 44,
+ per: LogRateLimitTimescale::Second,
+ }
+ );
+
+ parsed_rate_limit = "1".parse::<LogRateLimit>().expect("valid rate limit");
+
+ assert_eq!(parsed_rate_limit, LogRateLimit::default());
+
+ parsed_rate_limit = "enable=0,rate=123/hour"
+ .parse::<LogRateLimit>()
+ .expect("valid rate limit");
+
+ assert_eq!(
+ parsed_rate_limit,
+ LogRateLimit {
+ enabled: false,
+ burst: 5,
+ rate: 123,
+ per: LogRateLimitTimescale::Hour,
+ }
+ );
+
+ "2".parse::<LogRateLimit>()
+ .expect_err("invalid value for enable");
+
+ "enabled=0,rate=123"
+ .parse::<LogRateLimit>()
+ .expect_err("invalid key in log ratelimit");
+
+ "enable=0,rate=123,"
+ .parse::<LogRateLimit>()
+ .expect_err("trailing comma in log rate limit specification");
+
+ "enable=0,rate=123/proxmox,"
+ .parse::<LogRateLimit>()
+ .expect_err("invalid unit for rate");
+ }
+}
diff --git a/proxmox-ve-config/src/firewall/types/mod.rs b/proxmox-ve-config/src/firewall/types/mod.rs
index b740e5d..8bf31b8 100644
--- a/proxmox-ve-config/src/firewall/types/mod.rs
+++ b/proxmox-ve-config/src/firewall/types/mod.rs
@@ -1,4 +1,5 @@
pub mod address;
+pub mod log;
pub mod port;
pub use address::Cidr;
--
2.39.2
More information about the pve-devel
mailing list