Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: safe creation of a base chain #64

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

my4ng
Copy link
Contributor

@my4ng my4ng commented Jun 7, 2024

As explained in the doc comments, this adds multiple checks to ensure that the base chains are in fact valid to set. Currently, the set_hook and set_type are separate and cannot check compatibility as a whole. This PR aims to forbid setting any invalid base chain, as defined in the nftables documentation, to provide greater safety and prevent UB. This is achieved through the BaseChainSetter, which is reusable and modifiable.

Example:

let setter = BaseChainSetter::new()
   .chain_type(ChainType::Nat)
   .hook(Hook::PreRouting)
   .priority(Priority::Integral(0));

let result = setter.try_set(&mut chain);

assert_eq!(result, Ok(()));

let setter = setter.hook(Hook::Forward);
let result = setter.try_set(&mut chain);

// NAT type **cannot** be used with forward hook, hence failed with `InvalidCombination`.
assert_eq!(result, Err(BaseChainError::InvalidCombination));

It also adds related error type BaseChainError and named/offset priority Priority.


This change is Reviewable

Add `BaseChainSetter` which checks and prevents invalid configurations of
base chains through the `try_set` function. `Err(BaseChainError)` is
returned in case of failed checks.

Add `Priority` struct which allows and checks named/offset priorities
through `PriorityName`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant