refactored nftable managment, and fixed stop of the container

backend/modules/nfregex/firegex.py

@@ -1,10 +1,12 @@
 from typing import Dict, List, Set
-from utils.firegextables import FiregexFilter, FiregexTables
-from utils import ip_parse, ip_family, run_func
+from modules.nfregex.nftables import FiregexFilter, FiregexTables
+from utils import ip_parse, run_func
 from modules.nfregex.models import Service, Regex
 import re, os, asyncio
 import traceback
 
+nft = FiregexTables()
+
 class RegexFilter:
     def __init__(
         self, regex,
@@ -68,9 +70,9 @@ class FiregexInterceptor:
         self.update_config_lock = asyncio.Lock()
         input_range, output_range = await self._start_binary()
         self.update_task = asyncio.create_task(self.update_blocked())
-        if not filter in FiregexTables().get():
-            FiregexTables().add_input(queue_range=input_range, proto=self.filter.proto, port=self.filter.port, ip_int=self.filter.ip_int)
-            FiregexTables().add_output(queue_range=output_range, proto=self.filter.proto, port=self.filter.port, ip_int=self.filter.ip_int)
+        if not filter in nft.get():
+            nft.add_input(queue_range=input_range, proto=self.filter.proto, port=self.filter.port, ip_int=self.filter.ip_int)
+            nft.add_output(queue_range=output_range, proto=self.filter.proto, port=self.filter.port, ip_int=self.filter.ip_int)
         return self
     
     async def _start_binary(self):
@@ -140,7 +142,6 @@ class FiregexInterceptor:
         return res
 
 def delete_by_srv(srv:Service):
-    nft = FiregexTables()
     for filter in nft.get():
         if filter.port == srv.port and filter.proto == srv.proto and ip_parse(filter.ip_int) == ip_parse(srv.ip_int):
             nft.cmd({"delete":{"rule": {"handle": filter.id, "table": nft.table_name, "chain": filter.target, "family": "inet"}}})

backend/modules/nfregex/firewall.py

@@ -1,6 +1,7 @@
 import asyncio
 from typing import Dict
-from modules.nfregex.firegex import FiregexFilter, FiregexInterceptor, FiregexTables, RegexFilter, delete_by_srv
+from modules.nfregex.firegex import FiregexInterceptor, RegexFilter, delete_by_srv
+from modules.nfregex.nftables import FiregexTables, FiregexFilter
 from modules.nfregex.models import Regex, Service
 from utils.sqlite import SQLite
 

backend/modules/nfregex/nftables.py

@@ -0,0 +1,104 @@
+from typing import List
+from utils import ip_parse, ip_family, NFTableManager
+
+class FiregexFilter():
+    def __init__(self, proto:str, port:int, ip_int:str, queue=None, target:str=None, id=None):
+        self.id = int(id) if id else None
+        self.queue = queue
+        self.target = target
+        self.proto = proto
+        self.port = int(port)
+        self.ip_int = str(ip_int)
+
+    def __eq__(self, o: object) -> bool:
+        if isinstance(o, FiregexFilter):
+            return self.port == o.port and self.proto == o.proto and ip_parse(self.ip_int) == ip_parse(o.ip_int)
+        return False
+
+class FiregexTables(NFTableManager):
+    input_chain = "nfregex_input"
+    output_chain = "nfregex_output"
+    
+    def __init__(self):
+        super().__init__([
+            {"create":{"chain":{
+                "family":"inet",
+                "table":self.table_name,
+                "name":self.input_chain,
+                "type":"filter",
+                "hook":"prerouting",
+                "prio":-150,
+                "policy":"accept"
+            }}},
+            {"create":{"chain":{
+                "family":"inet",
+                "table":self.table_name,
+                "name":self.output_chain,
+                "type":"filter",
+                "hook":"postrouting",
+                "prio":-150,
+                "policy":"accept"
+            }}}
+        ],[
+            {"flush":{"chain":{"table":self.table_name,"family":"inet", "name":self.input_chain}}},
+            {"delete":{"chain":{"table":self.table_name,"family":"inet", "name":self.input_chain}}},
+            {"flush":{"chain":{"table":self.table_name,"family":"inet", "name":self.output_chain}}},
+            {"delete":{"chain":{"table":self.table_name,"family":"inet", "name":self.output_chain}}},
+        ])
+
+    def add_output(self, queue_range, proto, port, ip_int):
+        init, end = queue_range
+        if init > end: init, end = end, init
+        ip_int = ip_parse(ip_int)
+        ip_addr = str(ip_int).split("/")[0]
+        ip_addr_cidr = int(str(ip_int).split("/")[1])
+        self.cmd({ "insert":{ "rule": {
+            "family": "inet",
+            "table": self.table_name,
+            "chain": self.output_chain,
+            "expr": [
+                    {'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'saddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}},
+                    {'match': {"left": { "payload": {"protocol": str(proto), "field": "sport"}}, "op": "==", "right": int(port)}},
+                    {"queue": {"num": str(init) if init == end else {"range":[init, end] }, "flags": ["bypass"]}}
+                ]
+        }}})
+
+    def add_input(self, queue_range, proto = None, port = None, ip_int = None):
+        init, end = queue_range
+        if init > end: init, end = end, init
+        ip_int = ip_parse(ip_int)
+        ip_addr = str(ip_int).split("/")[0]
+        ip_addr_cidr = int(str(ip_int).split("/")[1])
+        self.cmd({"insert":{"rule":{
+            "family": "inet",
+            "table": self.table_name,
+            "chain": self.input_chain,
+            "expr": [
+                    {'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'daddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}},
+                    {'match': {"left": { "payload": {"protocol": str(proto), "field": "dport"}}, "op": "==", "right": int(port)}},
+                    {"queue": {"num": str(init) if init == end else {"range":[init, end] }, "flags": ["bypass"]}}
+                ]
+        }}})
+
+    def get(self) -> List[FiregexFilter]:
+        res = []
+        for filter in [ele["rule"] for ele in self.list() if "rule" in ele and ele["rule"]["table"] == self.table_name]:
+            queue_str = filter["expr"][2]["queue"]["num"]
+            queue = None
+            if isinstance(queue_str,dict): queue = int(queue_str["range"][0]), int(queue_str["range"][1])
+            else: queue = int(queue_str), int(queue_str)
+            ip_int = None
+            if isinstance(filter["expr"][0]["match"]["right"],str):
+                ip_int = str(ip_parse(filter["expr"][0]["match"]["right"]))
+            else:
+                ip_int = f'{filter["expr"][0]["match"]["right"]["prefix"]["addr"]}/{filter["expr"][0]["match"]["right"]["prefix"]["len"]}'
+            res.append(FiregexFilter(
+                target=filter["chain"],
+                id=int(filter["handle"]),
+                queue=queue,
+                proto=filter["expr"][1]["match"]["left"]["payload"]["protocol"],
+                port=filter["expr"][1]["match"]["right"],
+                ip_int=ip_int
+            ))
+        return res
+