nftnl-rs
nftnl-rs copied to clipboard
feat: safe creation of a base chain
As explained in the doc comments, this adds multiple checks to ensure that the base chains are in fact valid to set. Currently, the set_hook
and set_type
are separate and cannot check compatibility as a whole. This PR aims to forbid setting any invalid base chain, as defined in the nftables documentation, to provide greater safety and prevent UB. This is achieved through the BaseChainSetter
, which is reusable and modifiable.
Example:
let setter = BaseChainSetter::new()
.chain_type(ChainType::Nat)
.hook(Hook::PreRouting)
.priority(Priority::Integral(0));
let result = setter.try_set(&mut chain);
assert_eq!(result, Ok(()));
let setter = setter.hook(Hook::Forward);
let result = setter.try_set(&mut chain);
// NAT type **cannot** be used with forward hook, hence failed with `InvalidCombination`.
assert_eq!(result, Err(BaseChainError::InvalidCombination));
It also adds related error type BaseChainError
and named/offset priority Priority
.