nftables 1.000

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 1b6b43d401eac94c7a2dc1432207ddd7f554139f760d0b1e5583749d5fe4e48c
+  data.tar.gz: 0ce94e30a941ee4ffdf868d5573a86d1e825d504e64261a4ac4ff939600ac117
+SHA512:
+  metadata.gz: 6c0f4820cc4e5d1c9f0158018a6a1311bc3690dbffcb232a3a0b94391274fb9e21d9bef8e2af28898d74a76ebd427772ee864184e06e31ef006a47fe18deacc7
+  data.tar.gz: 05f9f6cf6aabe2428ec85adc2539ab4fcac4d1b3ecb4ff68e1a49af5bac823d11ad00e5605e675e687b1e872e97262c8027a695935d1005df2d0c19f9de70db6

data/lib/nft/ctx.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require_relative 'library'
+require_relative 'misc/file_descriptor'
+
+module NFT
+  module Ctx
+    include FileDescriptor
+
+    private
+
+    def ctx_create
+      ctx = NFT::Library.nft_ctx_new(NFT::Library::NFT_CTX_DEFAULT)
+
+      NFT::Library.nft_ctx_output_set_flags(ctx, 16)
+      NFT::Library.nft_ctx_output_set_debug(ctx, @debug) if @debug
+
+      @ctx = ctx
+    end
+
+    def ctx_free
+      NFT::Library.nft_ctx_free(@ctx)
+    end
+
+    def ctx_run
+      stdout_origin, stdout_tmpfile = fd_redirect($stdout)
+      stderr_origin, stderr_tmpfile = fd_redirect($stderr)
+
+      yield
+
+      stdout_tmpfile.rewind
+      stderr_tmpfile.rewind
+      [stdout_tmpfile.read, stderr_tmpfile.read]
+    ensure
+      fd_restore($stdout, stdout_origin, stdout_tmpfile)
+      fd_restore($stderr, stderr_origin, stderr_tmpfile)
+    end
+
+    def ctx_debug!(data)
+      return data if @debug.nil?
+
+      warn data.slice!(0, data.index('{"nftables":') || 0)
+      data
+    end
+  end
+end

data/lib/nft/library.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'ffi'
+
+module NFT
+  module Library
+    extend FFI::Library
+    ffi_lib 'nftables'
+
+    NFT_CTX_DEFAULT = 0
+
+    NFT_DEBUG_SCANNER       = 0x1
+    NFT_DEBUG_PARSER        = 0x2
+    NFT_DEBUG_EVALUATION    = 0x4
+    NFT_DEBUG_NETLINK       = 0x8
+    NFT_DEBUG_MNL           = 0x10
+    NFT_DEBUG_PROTO_CTX     = 0x20
+    NFT_DEBUG_SEGTREE       = 0x40
+
+    attach_function :nft_ctx_new, %i[int], :pointer
+    attach_function :nft_ctx_free, %i[pointer], :void
+    attach_function :nft_run_cmd_from_buffer, %i[pointer string], :int
+    attach_function :nft_ctx_output_set_flags, %i[pointer int], :void
+    attach_function :nft_ctx_output_set_debug, %i[pointer int], :void
+  end
+end

data/lib/nft/misc/file_descriptor.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'tempfile'
+
+module NFT
+  module FileDescriptor
+    private
+
+    def fd_redirect(name)
+      origin = name.clone
+      tempfile = Tempfile.new("nft.#{(0...8).map { rand(65..90).chr }.join}")
+      name.reopen(tempfile)
+
+      [origin, tempfile]
+    end
+
+    def fd_restore(name, origin, tempfile)
+      name.reopen(origin)
+      tempfile.close
+      tempfile.unlink
+    end
+  end
+end

data/lib/nft/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module NFT
+  VERSION = '1.000'
+end

data/lib/nft.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'json'
+
+require_relative 'nft/library'
+require_relative 'nft/ctx'
+
+##
+# The NFT module is a foreign function interface for the high-level
+# userspace netfilter nftables library.
+#
+# It provides a basic run method, to execute nftables commands. For valid
+# commands see the +nftables+(8) manpage and the {nftables wiki}[https://wiki.nftables.org].
+module NFT
+  class << self
+    include NFT::Ctx
+
+    ##
+    # Enable and control debugging output.
+    #
+    # For options see the libnftables(3) manpage.
+    # The information is printed to stderr.
+    #
+    #    NFT.debug = NFT::Library::NFT_DEBUG_SCANNER | NFT::Library::NFT_DEBUG_PARSER
+    attr_accessor :debug
+
+    ##
+    # Run given nftables command.
+    #
+    # The method returns an array of hashes if the command presents any output
+    # or an empty array otherwise. On execution failure it raises a runtime
+    # error.
+    #
+    #    NFT.run('list ruleset')
+    def run(cmd)
+      begin
+        ctx_create
+        rc = 0
+        stdout, stderror = ctx_run { rc = NFT::Library.nft_run_cmd_from_buffer(@ctx, cmd) }
+      ensure
+        ctx_free
+      end
+      return raise stderror unless rc.zero?
+
+      return [] if stdout.nil? || stdout.empty?
+
+      stdout = ctx_debug!(stdout)
+      stdout.split("\n").map(&:strip).reject(&:empty?).map { |line| JSON.parse(line) }
+    end
+  end
+end

metadata

@@ -0,0 +1,71 @@
+--- !ruby/object:Gem::Specification
+name: nftables
+version: !ruby/object:Gem::Version
+  version: '1.000'
+platform: ruby
+authors:
+- Tobias Schäfer
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2024-12-15 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: ffi
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.16.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.16.1
+description: |
+  Ruby high-level userspace netfilter nftables package.
+
+  This package is a foreign function interface for the high-level userspace
+  netfilter nftables library.
+
+  It provides a basic run method, to execute nftables commands.
+email:
+- github@blackox.org
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/nft.rb
+- lib/nft/ctx.rb
+- lib/nft/library.rb
+- lib/nft/misc/file_descriptor.rb
+- lib/nft/version.rb
+homepage: https://github.com/tschaefer/ruby-nftables
+licenses:
+- GPL-3.0-or-later
+metadata:
+  rubygems_mfa_required: 'true'
+  source_code_uri: https://github.com/tschaefer/ruby-nftables
+  bug_tracker_uri: https://github.com/tschaefer/ruby-nftables/issues
+post_install_message: All your nftables are belong to us!
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.23
+signing_key:
+specification_version: 4
+summary: Ruby high-level userspace netfilter nftables package.
+test_files: []