|
|
|
@ -1,7 +1,7 @@
|
|
|
|
|
from dataclasses import dataclass, field
|
|
|
|
|
from itertools import chain
|
|
|
|
|
from pydantic import IPvAnyNetwork
|
|
|
|
|
from typing import Any, TypeVar
|
|
|
|
|
from ipaddress import IPv4Network, IPv6Network
|
|
|
|
|
from typing import Any, Generic, TypeVar
|
|
|
|
|
|
|
|
|
|
T = TypeVar("T")
|
|
|
|
|
JsonNftables = dict[str, Any]
|
|
|
|
@ -11,38 +11,20 @@ def flatten(l: list[list[T]]) -> list[T]:
|
|
|
|
|
return list(chain.from_iterable(l))
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def ip_to_nft(ip: IPvAnyNetwork) -> JsonNftables:
|
|
|
|
|
def ip_to_nft(ip: IPv4Network | IPv6Network) -> JsonNftables:
|
|
|
|
|
return {"prefix": {"addr": str(ip.network_address), "len": ip.prefixlen}}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@dataclass
|
|
|
|
|
class Set:
|
|
|
|
|
name: str
|
|
|
|
|
flags: list[str]
|
|
|
|
|
type: str | list[str]
|
|
|
|
|
@dataclass(eq=True, frozen=True)
|
|
|
|
|
class Immediate(Generic[T]):
|
|
|
|
|
value: T
|
|
|
|
|
|
|
|
|
|
elements: list[IPvAnyNetwork] = field(default_factory=list)
|
|
|
|
|
def to_nft(self) -> Any:
|
|
|
|
|
if isinstance(self.value, IPv4Network) or isinstance(
|
|
|
|
|
self.value, IPv6Network
|
|
|
|
|
):
|
|
|
|
|
return ip_to_nft(self.value)
|
|
|
|
|
|
|
|
|
|
def to_nft(self, family: str, table: str) -> JsonNftables:
|
|
|
|
|
set: JsonNftables = {
|
|
|
|
|
"name": self.name,
|
|
|
|
|
"family": family,
|
|
|
|
|
"table": table,
|
|
|
|
|
"flags": self.flags,
|
|
|
|
|
"type": self.type,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if self.elements:
|
|
|
|
|
set["elem"] = [ip_to_nft(ip) for ip in self.elements]
|
|
|
|
|
|
|
|
|
|
return {"add": {"set": set}}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@dataclass
|
|
|
|
|
class Immediate:
|
|
|
|
|
value: str
|
|
|
|
|
|
|
|
|
|
def to_nft(self) -> str:
|
|
|
|
|
return self.value
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@ -75,34 +57,55 @@ class Match:
|
|
|
|
|
right: Expression
|
|
|
|
|
|
|
|
|
|
def to_nft(self) -> JsonNftables:
|
|
|
|
|
return {
|
|
|
|
|
"match": {
|
|
|
|
|
"op": self.op,
|
|
|
|
|
"left": self.left.to_nft(),
|
|
|
|
|
"right": self.right.to_nft(),
|
|
|
|
|
}
|
|
|
|
|
match = {
|
|
|
|
|
"op": self.op,
|
|
|
|
|
"left": self.left.to_nft(),
|
|
|
|
|
"right": self.right.to_nft(),
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return {"match": match}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Statement = Verdict | Match
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@dataclass
|
|
|
|
|
class Set:
|
|
|
|
|
name: str
|
|
|
|
|
flags: list[str]
|
|
|
|
|
type: str | list[str]
|
|
|
|
|
|
|
|
|
|
elements: list[Immediate] = field(default_factory=list)
|
|
|
|
|
|
|
|
|
|
def to_nft(self, family: str, table: str) -> JsonNftables:
|
|
|
|
|
set: JsonNftables = {
|
|
|
|
|
"name": self.name,
|
|
|
|
|
"family": family,
|
|
|
|
|
"table": table,
|
|
|
|
|
"flags": self.flags,
|
|
|
|
|
"type": self.type,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if self.elements:
|
|
|
|
|
set["elem"] = [element.to_nft() for element in self.elements]
|
|
|
|
|
|
|
|
|
|
return {"add": {"set": set}}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@dataclass
|
|
|
|
|
class Rule:
|
|
|
|
|
stmts: list[Statement]
|
|
|
|
|
|
|
|
|
|
def to_nft(self, family: str, table: str, chain: str) -> JsonNftables:
|
|
|
|
|
return {
|
|
|
|
|
"add": {
|
|
|
|
|
"rule": {
|
|
|
|
|
"family": family,
|
|
|
|
|
"table": table,
|
|
|
|
|
"chain": chain,
|
|
|
|
|
"expr": [stmt.to_nft() for stmt in self.stmts],
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
rule = {
|
|
|
|
|
"family": family,
|
|
|
|
|
"table": table,
|
|
|
|
|
"chain": chain,
|
|
|
|
|
"expr": [stmt.to_nft() for stmt in self.stmts],
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return {"add": {"rule": rule}}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@dataclass
|
|
|
|
|
class Chain:
|
|
|
|
@ -151,7 +154,9 @@ class Table:
|
|
|
|
|
sets: list[Set] = field(default_factory=list)
|
|
|
|
|
|
|
|
|
|
def to_nft(self) -> list[JsonNftables]:
|
|
|
|
|
commands = [{"add": {"table": {"family": self.family, "name": self.name}}}]
|
|
|
|
|
commands = [
|
|
|
|
|
{"add": {"table": {"family": self.family, "name": self.name}}}
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
for set in self.sets:
|
|
|
|
|
commands.append(set.to_nft(self.family, self.name))
|
|
|
|
|