rustables/
lib.rs

1// Copyryght (c) 2021-2022 GPL lafleur@boum.org and Simon Thoby
2//
3// This file is free software: you may copy, redistribute and/or modify it
4// under the terms of the GNU General Public License as published by the
5// Free Software Foundation, either version 3 of the License, or (at your
6// option) any later version.
7//
8// This file is distributed in the hope that it will be useful, but
9// WITHOUT ANY WARRANTY; without even the implied warranty of
10// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
11// General Public License for more details.
12//
13// You should have received a copy of the GNU General Public License
14// along with this program. If not, see the LICENSE file.
15//
16// This file incorporates work covered by the following copyright and
17// permission notice:
18//
19//     Copyright 2018 Amagicom AB.
20//
21//     Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
22//     http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
23//     <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
24//     option. This file may not be copied, modified, or distributed
25//     except according to those terms.
26
27//! Safe abstraction for userspace access to the in-kernel nf_tables subsystem.
28//! Can be used to create and remove tables, chains, sets and rules from the nftables
29//! firewall, the successor to iptables.
30//!
31//! This library currently has quite rough edges and does not make adding and removing netfilter
32//! entries super easy and elegant. That is partly because the library needs more work, but also
33//! partly because nftables is super low level and extremely customizable, making it hard, and
34//! probably wrong, to try and create a too simple/limited wrapper. See examples for inspiration.
35//!
36//! Understanding how to use the netlink subsystem and implementing this crate has mostly been done by
37//! reading the source code for the [`nftables`] userspace program and its corresponding kernel code,
38//! as well as attaching debuggers to the `nft` binary.
39//! Since the implementation is mostly based on trial and error, there might of course be
40//! a number of places where the forged netlink messages are used in an invalid or not intended way.
41//! Contributions are welcome!
42//!
43//! [`nftables`]: https://netfilter.org/projects/nftables/
44
45#[macro_use]
46extern crate log;
47
48use rustables_macros::nfnetlink_enum;
49use std::convert::TryFrom;
50
51mod batch;
52pub use batch::{Batch, default_batch_page_size};
53
54pub mod data_type;
55
56mod table;
57pub use table::Table;
58pub use table::list_tables;
59
60mod chain;
61pub use chain::list_chains_for_table;
62pub use chain::{Chain, ChainPolicy, ChainPriority, ChainType, Hook, HookClass};
63
64pub mod error;
65
66pub mod query;
67
68pub(crate) mod nlmsg;
69pub(crate) mod parser;
70pub(crate) mod parser_impls;
71
72mod rule;
73pub use rule::Rule;
74pub use rule::list_rules_for_chain;
75
76pub mod expr;
77
78mod rule_methods;
79pub use rule_methods::{Protocol, iface_index};
80
81pub mod set;
82pub use set::Set;
83
84pub mod sys;
85
86#[cfg(test)]
87mod tests;
88
89/// The type of the message as it's sent to netfilter. A message consists of an object, such as a
90/// [`Table`], [`Chain`] or [`Rule`] for example, and a [`MsgType`] to describe what to do with
91/// that object. If a [`Table`] object is sent with `MsgType::Add` then that table will be added
92/// to netfilter, if sent with `MsgType::Del` it will be removed.
93///
94/// [`Table`]: struct.Table.html
95/// [`Chain`]: struct.Chain.html
96/// [`Rule`]: struct.Rule.html
97/// [`MsgType`]: enum.MsgType.html
98#[derive(Debug, Copy, Clone, Eq, PartialEq)]
99pub enum MsgType {
100    /// Add the object to netfilter.
101    Add,
102    /// Remove the object from netfilter.
103    Del,
104}
105
106/// Denotes a protocol. Used to specify which protocol a table or set belongs to.
107#[derive(Default, Debug, Copy, Clone, PartialEq, Eq)]
108#[nfnetlink_enum(i32)]
109pub enum ProtocolFamily {
110    #[default]
111    Unspec = libc::NFPROTO_UNSPEC,
112    /// Inet - Means both IPv4 and IPv6
113    Inet = libc::NFPROTO_INET,
114    Ipv4 = libc::NFPROTO_IPV4,
115    Arp = libc::NFPROTO_ARP,
116    NetDev = libc::NFPROTO_NETDEV,
117    Bridge = libc::NFPROTO_BRIDGE,
118    Ipv6 = libc::NFPROTO_IPV6,
119    DecNet = libc::NFPROTO_DECNET,
120}
rustables/lib.rs

rustables/
lib.rs
