nftblock 0.1.2

Atomically apply CIDR lists with nftables netlink batches
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

use crate::{
    config::Direction,
    zones::{Chain, ResolvedRule},
};

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AddressField {
    Source,
    Destination,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct RenderedRule {
    pub chain: Chain,
    pub direction: Direction,
    pub ingress: Option<String>,
    pub egress: Option<String>,
    pub address: AddressField,
}

/// Expand zone alternatives to concrete rules. nftables expressions inside one rule are ANDed,
/// while separate rules provide the intended OR semantics for interfaces in a zone.
pub fn render(rules: &[ResolvedRule]) -> Vec<RenderedRule> {
    let mut out = Vec::new();
    for rule in rules {
        let ingress: Vec<Option<&String>> = if rule.ingress.is_empty() {
            vec![None]
        } else {
            rule.ingress.iter().map(Some).collect()
        };
        let egress: Vec<Option<&String>> = if rule.egress.is_empty() {
            vec![None]
        } else {
            rule.egress.iter().map(Some).collect()
        };
        for iif in &ingress {
            for oif in &egress {
                out.push(RenderedRule {
                    chain: rule.chain,
                    direction: rule.blocklist,
                    ingress: iif.map(|v| (*v).clone()),
                    egress: oif.map(|v| (*v).clone()),
                    address: match rule.blocklist {
                        Direction::Inbound => AddressField::Source,
                        Direction::Outbound => AddressField::Destination,
                    },
                });
            }
        }
    }
    out
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn forward_mapping_is_a_cross_product() {
        let mappings = vec![ResolvedRule {
            chain: Chain::Forward,
            blocklist: Direction::Inbound,
            ingress: vec!["wan0".into(), "wan1".into()],
            egress: vec!["lan0".into(), "lan1".into()],
        }];
        let rendered = render(&mappings);
        assert_eq!(rendered.len(), 4);
        assert!(rendered.iter().all(|r| r.address == AddressField::Source));
    }
}