3 let fw4 = require("fw4");
7 * Unfortunately, terse mode (-t) is incompatible with JSON output so
8 * we either need to parse a potentially huge JSON just to get the set
9 * header data or scrape the ordinary nft output to obtain the same
10 * information. Opt for the latter to avoid parsing potentially huge
13 function find_existing_sets() {
14 let fd = fs.popen("nft -t list sets inet", "r");
17 warn(sprintf("Unable to execute 'nft' for listing existing sets: %s\n",
25 while ((line = fd.read("line")) !== "") {
28 if ((m = match(line, /^table inet (.+) \{\n$/)) != null) {
31 else if ((m = match(line, /^\tset (.+) \{\n$/)) != null) {
34 else if ((m = match(line, /^\t\ttype (.+)\n$/)) != null) {
35 if (table == "fw4" && set)
36 sets[set] = split(m[1], " . ");
47 function read_state() {
48 let state = fw4.read_state();
51 warn("Unable to read firewall state - do you need to start the firewall?\n");
58 function reload_sets() {
59 let state = read_state(),
60 sets = find_existing_sets();
62 for (let set in state.ipsets) {
63 if (!set.loadfile || !length(set.entries))
66 if (!exists(sets, set.name)) {
67 warn(sprintf("Named set '%s' does not exist - do you need to restart the firewall?\n",
71 else if (fw4.concat(sets[set.name]) != fw4.concat(set.types)) {
72 warn(sprintf("Named set '%s' has a different type - want '%s' but is '%s' - do you need to restart the firewall?\n",
73 set.name, fw4.concat(set.types), fw4.concat(sets[set.name])));
78 let printer = (entry) => {
80 print("add element inet fw4 ", set.name, " {\n");
84 print("\t", join(" . ", entry), ",\n");
87 print("flush set inet fw4 ", set.name, "\n");
89 map(set.entries, printer);
90 fw4.parse_setfile(set, printer);
97 function render_ruleset(use_statefile) {
100 fw4.load(use_statefile);
102 map(fw4.zones(), zone => push(devices, ...zone.match_devices));
104 include("templates/ruleset.uc", { fw4, type, exists, length, include, devices: sort(devices) });
107 function lookup_network(net) {
108 let state = read_state();
110 for (let zone in state.zones) {
111 for (let network in (zone.network || [])) {
112 if (network.device == net) {
113 print(zone.name, "\n");
122 function lookup_device(dev) {
123 let state = read_state();
125 for (let zone in state.zones) {
126 for (let rule in (zone.match_rules || [])) {
127 if (dev in rule.devices_pos) {
128 print(zone.name, "\n");
137 function lookup_zone(name, dev) {
138 let state = read_state();
140 for (let zone in state.zones) {
141 if (zone.name == name) {
143 map(zone.match_rules, (r) => push(devices, ...(r.devices_pos || [])));
146 if (dev in devices) {
155 print(join("\n", devices), "\n");
165 switch (getenv("ACTION")) {
167 return render_ruleset(true);
170 return render_ruleset(false);
173 return reload_sets();
176 return lookup_network(getenv("OBJECT"));
179 return lookup_device(getenv("OBJECT"));
182 return lookup_zone(getenv("OBJECT"), getenv("DEVICE"));