dfw/nftables/
types.rs

1// Copyright Pit Kleyersburg <pitkley@googlemail.com>
2// SPDX-License-Identifier: MIT OR Apache-2.0
3//
4// Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
5// http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
6// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
7// option. This file may not be copied, modified or distributed
8// except according to those terms.
9
10//! The types in this module make up the structure of the nftables backend-specific configurations.
11//!
12//! # Example
13//!
14//! ```
15//! # use dfw::nftables::Nftables;
16//! # use dfw::types::*;
17//! # use toml;
18//! # toml::from_str::<DFW<Nftables>>(r#"
19//! [backend_defaults]
20//! custom_tables = { name = "filter", chains = ["input", "forward"]}
21//!
22//! [backend_defaults.initialization]
23//! rules = [
24//!     "add table inet custom",
25//! ]
26//! # "#).unwrap();
27//! ```
28
29use crate::de::*;
30use serde::Deserialize;
31
32/// The defaults/configuration for the nftables backend.
33#[derive(Deserialize, Debug, Clone, PartialEq, Eq, Default)]
34#[serde(deny_unknown_fields)]
35pub struct Defaults {
36    /// Specify the names of custom nft-tables that should be partially managed.
37    ///
38    /// # Explanation
39    ///
40    /// If you want to use or already use an existing nftables table to manage rules independently
41    /// from DFW, it is important that two conditions are met:
42    ///
43    /// 1. The priority-values of the chains are _lower_ than the priority-values used by DFW.
44    /// 2. The default-policy of the any input or forward chains in the table are set to `accept`.
45    ///
46    /// While DFW cannot ensure that the first condition is met (since changing the priority of a
47    /// chain is not possible without recreating the chain), it can set the policies of your input
48    /// and output chains to `accept` for you.
49    ///
50    /// # Example
51    ///
52    /// ```
53    /// # use dfw::nftables::types::*;
54    /// # use toml;
55    /// # toml::from_str::<Defaults>(r#"
56    /// custom_tables = { name = "filter", chains = ["input", "forward"] }
57    /// # "#).unwrap();
58    /// # toml::from_str::<Defaults>(r#"
59    /// custom_tables = [
60    ///     { name = "filter", chains = ["input", "forward"] },
61    ///     { name = "custom", chains = ["input", "forward"] }
62    /// ]
63    /// # "#).unwrap();
64    /// ```
65    #[serde(default, deserialize_with = "option_struct_or_seq_struct")]
66    pub custom_tables: Option<Vec<Table>>,
67
68    /// The optional initialization section.
69    ///
70    /// # Example
71    ///
72    /// ```
73    /// # use dfw::nftables::types::*;
74    /// # use toml;
75    /// # toml::from_str::<Defaults>(r#"
76    /// [initialization]
77    /// rules = [
78    ///     "add table inet custom",
79    ///     "flush table inet custom",
80    /// ]
81    /// # "#).unwrap();
82    /// ```
83    pub initialization: Option<Initialization>,
84}
85
86/// Reference to an nftables table, specifically to the input- and forward-chains within it.
87///
88/// This is used by DFW when managing other tables is required.
89#[derive(Deserialize, Debug, Clone, PartialEq, Eq, Hash, Default)]
90#[serde(deny_unknown_fields)]
91pub struct Table {
92    /// Name of the custom table.
93    pub name: String,
94
95    /// Names of the input and forward chains defined within the custom table.
96    pub chains: Vec<String>,
97}
98
99/// The initialization section allows you to execute any commands against nftables.
100#[derive(Deserialize, Debug, Clone, PartialEq, Eq, Default)]
101#[serde(deny_unknown_fields)]
102pub struct Initialization {
103    /// Initialization rules for nftables
104    ///
105    /// # Example
106    ///
107    /// ```
108    /// # use dfw::nftables::types::*;
109    /// # use toml;
110    /// # toml::from_str::<Defaults>(r#"
111    /// [initialization]
112    /// rules = [
113    ///     "add table inet custom",
114    ///     "flush table inet custom",
115    /// ]
116    /// # "#).unwrap();
117    /// ```
118    pub rules: Option<Vec<String>>,
119}
dfw/nftables/types.rs

dfw/nftables/
types.rs
