namib-project / nftables-rs

Safe abstraction for nftables JSON API (libnftables-json).
https://crates.io/crates/nftables
Apache License 2.0
23 stars 13 forks source link

Cannot deserialize rule that references a named counter #45

Open r-birkner opened 2 months ago

r-birkner commented 2 months ago

Describe the bug The crate fails to deserialize the nftables output if the rule contains a named counter. For example, the following rule:

ct state new add @connection_limit { ip saddr ct count over 500 } counter name connection_limit_v4_counter drop

If one drops the part counter name connection_limit_v4_counter, it all works without issue.

Expected behavior The crate should deserialize properly

Nftables rulesets This is the resulting JSON:

{
    "rule": {
        "family": "ip",
        "table": "filter",
        "chain": "INPUT",
        "handle": 15,
        "expr": [
            {
                "match": {
                    "op": "in",
                    "left": {
                        "ct": {
                            "key": "state"
                        }
                    },
                    "right": "new"
                }
            },
            {
                "set": {
                    "op": "add",
                    "elem": {
                        "payload": {
                            "protocol": "ip",
                            "field": "saddr"
                        }
                    },
                    "set": "@connection_limit"
                }
            },
            {
                "counter": "connection_limit_v4_counter"
            },
            {
                "drop": null
            }
        ]
    }
}

Version information