nftnl-rs icon indicating copy to clipboard operation
nftnl-rs copied to clipboard

feat: safe creation of a base chain

Open my4ng opened this issue 8 months ago • 0 comments

As explained in the doc comments, this adds multiple checks to ensure that the base chains are in fact valid to set. Currently, the set_hook and set_type are separate and cannot check compatibility as a whole. This PR aims to forbid setting any invalid base chain, as defined in the nftables documentation, to provide greater safety and prevent UB. This is achieved through the BaseChainSetter, which is reusable and modifiable.

Example:

let setter = BaseChainSetter::new()
   .chain_type(ChainType::Nat)
   .hook(Hook::PreRouting)
   .priority(Priority::Integral(0));

let result = setter.try_set(&mut chain);

assert_eq!(result, Ok(()));

let setter = setter.hook(Hook::Forward);
let result = setter.try_set(&mut chain);

// NAT type **cannot** be used with forward hook, hence failed with `InvalidCombination`.
assert_eq!(result, Err(BaseChainError::InvalidCombination));

It also adds related error type BaseChainError and named/offset priority Priority.


This change is Reviewable

my4ng avatar Jun 07 '24 03:06 my4ng