@push.rocks/smartnftables 1.2.0 → 1.3.1

package/rust/src/main.rs

@@ -0,0 +1,141 @@
+mod owner;
+mod policy;
+#[cfg(test)]
+mod tests;
+mod wire;
+
+use serde::Deserialize;
+use std::io::{BufRead, Read, Write};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Error {
+    Invalid,
+    Unsupported,
+    Permission,
+    ForeignOwner,
+    Conflict,
+    Absent,
+    Protocol,
+    Unavailable,
+}
+pub type Result<T> = std::result::Result<T, Error>;
+impl Error {
+    pub fn code(self) -> &'static str {
+        match self {
+            Self::Invalid => "INVALID",
+            Self::Unsupported => "UNSUPPORTED_KERNEL",
+            Self::Permission => "PERMISSION",
+            Self::ForeignOwner => "FOREIGN_OWNER",
+            Self::Conflict => "CONFLICT",
+            Self::Absent => "ABSENT",
+            Self::Protocol => "PROTOCOL",
+            Self::Unavailable => "UNAVAILABLE",
+        }
+    }
+    pub fn kernel(code: i32) -> Self {
+        match -code {
+            libc::ENOENT => Self::Absent,
+            libc::EPERM | libc::EACCES => Self::Permission,
+            libc::EEXIST | libc::EBUSY | libc::ERESTART => Self::Conflict,
+            libc::EOPNOTSUPP => Self::Unsupported,
+            _ => Self::Unavailable,
+        }
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Request {
+    id: String,
+    method: String,
+    params: Box<serde_json::value::RawValue>,
+}
+fn decode<T: serde::de::DeserializeOwned>(value: Box<serde_json::value::RawValue>) -> Result<T> {
+    serde_json::from_str(value.get()).map_err(|_| Error::Invalid)
+}
+fn encode(value: impl serde::Serialize) -> Result<serde_json::Value> {
+    serde_json::to_value(value).map_err(|_| Error::Protocol)
+}
+fn dispatch(owner: &mut Option<owner::Owner>, request: Request) -> Result<serde_json::Value> {
+    match request.method.as_str() {
+        "preparePolicy" => encode(decode::<policy::Policy>(request.params)?.prepare()?),
+        "openOwner" => {
+            if owner.is_some() {
+                return Err(Error::Conflict);
+            }
+            *owner = Some(owner::Owner::new(decode(request.params)?)?);
+            encode(owner.as_mut().unwrap().inspect())
+        }
+        "reconcilePolicy" => encode(
+            owner
+                .as_mut()
+                .ok_or(Error::Conflict)?
+                .reconcile(decode(request.params)?)?,
+        ),
+        "inspectPolicy" => {
+            if decode::<serde_json::Value>(request.params)? != serde_json::json!({}) {
+                return Err(Error::Invalid);
+            }
+            encode(owner.as_mut().ok_or(Error::Conflict)?.inspect())
+        }
+        "releasePolicy" => {
+            owner
+                .as_mut()
+                .ok_or(Error::Conflict)?
+                .release(decode(request.params)?)?;
+            Ok(serde_json::json!({"released":true}))
+        }
+        "closeOwner" => {
+            if decode::<serde_json::Value>(request.params)? != serde_json::json!({}) {
+                return Err(Error::Invalid);
+            }
+            owner.as_mut().ok_or(Error::Conflict)?.close()?;
+            Ok(serde_json::json!({"released":true}))
+        }
+        _ => Err(Error::Invalid),
+    }
+}
+
+fn main() {
+    if std::env::args().skip(1).collect::<Vec<_>>() != ["--management"] {
+        std::process::exit(2);
+    }
+    let mut output = std::io::stdout().lock();
+    writeln!(output, "{{\"event\":\"ready\",\"data\":{{}}}}").unwrap();
+    output.flush().unwrap();
+    let mut input = std::io::stdin().lock();
+    let mut owner = None;
+    loop {
+        let mut bytes = Vec::new();
+        let read = std::io::Read::by_ref(&mut input)
+            .take(262_145)
+            .read_until(b'\n', &mut bytes);
+        if matches!(read, Ok(0)) {
+            break;
+        }
+        if read.is_err() || bytes.len() > 262_144 || bytes.last() != Some(&b'\n') {
+            std::process::exit(2);
+        }
+        let request: Request = match serde_json::from_slice(&bytes) {
+            Ok(request) => request,
+            Err(_) => std::process::exit(2),
+        };
+        if request.id.is_empty() || request.id.len() > 128 {
+            std::process::exit(2);
+        }
+        let id = request.id.clone();
+        let response = match dispatch(&mut owner, request) {
+            Ok(result) => serde_json::json!({"id":id,"success":true,"result":result}),
+            Err(error) => {
+                serde_json::json!({"id":id,"success":false,"error":"Managed policy operation failed.","errorCode":error.code()})
+            }
+        };
+        if writeln!(output, "{response}")
+            .and_then(|_| output.flush())
+            .is_err()
+        {
+            break;
+        }
+    }
+    // EOF/process loss only drops socket ownership. PERSIST retains packet policy.
+}