marcus/mitm-webserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test123
All checks were successful
Build and Deploy MITM Webserver / build (push) Successful in 8s
Details

Browse Source
This commit is contained in:
malmert
2026-01-11 17:12:19 +01:00
parent c33c529fbb
commit 57de326910
1 changed files with 70 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

134
backend/src/api/nft_api.py
View File

@@ -202,19 +202,6 @@ def ensure_nft_available():
def nft_list_rules(table: str = "filter", chain: str = "forward") -> Dict[str, Any]: def nft_list_rules(table: str = "filter", chain: str = "forward") -> Dict[str, Any]:
"""Return nft rules parsed from `nft --json list ruleset`.
For each rule we return a dict with at least:
- family, table, chain
- handle (if present)
- position (1-based index within chain)
- comment (if present in expr)
- verdict (best-effort string like 'accept'/'drop'/'reject')
- raw_exprs: the original expr list from nft JSON
This makes it easier for the frontend to show position and edit
or replace a specific rule by handle/position.
"""
ensure_nft_available() ensure_nft_available()
cmd = [NFT_BIN, "--json", "list", "ruleset"] cmd = [NFT_BIN, "--json", "list", "ruleset"]
try: try:
@@ -224,69 +211,88 @@ def nft_list_rules(table: str = "filter", chain: str = "forward") -> Dict[str, A
raise HTTPException(status_code=500, detail=f"nft failed: {e.stderr.decode()}") raise HTTPException(status_code=500, detail=f"nft failed: {e.stderr.decode()}")
results: List[Dict[str, Any]] = [] results: List[Dict[str, Any]] = []
# counters per chain to compute position
counters: Dict[str, int] = {} counters: Dict[str, int] = {}
# The JSON usually contains a top-level dict with key 'nftables' -> list
items = parsed.get("nftables") if isinstance(parsed, dict) else parsed items = parsed.get("nftables") if isinstance(parsed, dict) else parsed
if not isinstance(items, list): if not isinstance(items, list):
items = [] items = []
for item in items: for item in items:
# Keep a simple mapping of current table/chain context # skip table/chain metadata entries (we only need rule entries)
if 'table' in item: if "rule" not in item:
tbl = item['table']
# nothing to do for context; continue
continue continue
if 'chain' in item:
ch = item['chain'] r = item["rule"]
# continue; chain metadata present family = r.get("family")
continue table_name = r.get("table")
if 'rule' in item: chain_name = r.get("chain")
r = item['rule'] key = f"{family}:{table_name}:{chain_name}"
family = r.get('family') counters.setdefault(key, 0)
table_name = r.get('table') counters[key] += 1
chain_name = r.get('chain') position = counters[key]
key = f"{family}:{table_name}:{chain_name}" handle = r.get("handle")
counters.setdefault(key, 0)
counters[key] += 1 exprs = r.get("expr", []) # original expression list from nft JSON
position = counters[key] comment = None
handle = r.get('handle') verdict = None
# extract comment and verdict best-effort verdict_details = None
raw_exprs = r.get('expr', [])
comment = None # scan expressions to extract comment and verdict/action
verdict = None for expr in exprs:
for expr in raw_exprs: if not isinstance(expr, dict):
if isinstance(expr, dict): continue
if 'comment' in expr: # comment can appear as {"comment":"text"} or {"comment": {"text": "..."}} depending on nft json variant
comment = expr.get('comment') if "comment" in expr:
if 'verdict' in expr: # handle both simple and nested forms
# verdict might be dict like {'verdict': {'kind': 'accept'}} c = expr.get("comment")
v = expr['verdict'] if isinstance(c, str):
if isinstance(v, dict): comment = c
verdict = list(v.keys())[0] elif isinstance(c, dict):
else: # some representations: {"comment": {"text": "..."}} or {"comment": {"str": "..."}}
verdict = str(v) comment = c.get("text") or c.get("str") or comment
# some JSON formats have 'match' or 'payload' etc. look for 'type' fields
if 'reject' in expr: # verdict forms
verdict = 'reject' if "verdict" in expr:
results.append({ v = expr["verdict"]
'family': family, # v often looks like {"accept": None} or {"drop": None} or {"reject": {...}}
'table': table_name, if isinstance(v, dict):
'chain': chain_name, # take the first key as the action
'handle': handle, k = next(iter(v.keys()), None)
'position': position, verdict = k
'comment': comment, verdict_details = v.get(k)
'verdict': verdict, else:
'raw_exprs': raw_exprs, verdict = str(v)
'raw_rule': r, # older/alternate forms
}) if "drop" in expr and verdict is None:
# Optionally filter by table/chain if requested verdict = "drop"
verdict_details = expr.get("drop")
if "accept" in expr and verdict is None:
verdict = "accept"
verdict_details = expr.get("accept")
if "reject" in expr and verdict is None:
verdict = "reject"
verdict_details = expr.get("reject")
results.append({
"family": family,
"table": table_name,
"chain": chain_name,
"handle": handle,
"position": position,
"comment": comment,
"verdict": verdict, # e.g. "accept", "drop", "reject", or None
"verdict_details": verdict_details, # raw details for rejects/other actions
"exprs": exprs, # original expression list (renamed, clearer)
"nft_rule": r, # the original nft JSON dict for this rule
})
# filter by requested table/chain if provided
if table or chain: if table or chain:
results = [x for x in results if x['table'] == table and x['chain'] == chain] results = [x for x in results if x["table"] == table and x["chain"] == chain]
return {"rules": results} return {"rules": results}
def expr_to_nft_snippet(e: Expr) -> str: def expr_to_nft_snippet(e: Expr) -> str:
# runtime dispatch via model type # runtime dispatch via model type
if isinstance(e, MetaExpr): if isinstance(e, MetaExpr):