nftables: Add support for representing ACLs in nftables as regular chains.

PiperOrigin-RevId: 667514971

Author: Capirca Team

capirca/lib/nftables.py

@@ -707,7 +707,8 @@ def _TranslatePolicy(self, pol, exp_info):
           filter_policy_default_action,
           verbose,
           base_chain_name,
-          table_name
+          table_name,
+          as_regular_chain,
       ) = self._ProcessHeader(filter_options)
 
       # Base chain determine name based on iteration of header.
@@ -767,7 +768,8 @@ def _TranslatePolicy(self, pol, exp_info):
       pol_counter += 1
       self.nftables_policies.append(
           (header, base_chain_name, nf_af, nf_hook, nf_priority,
-           filter_policy_default_action, verbose, child_chains, table_name))
+           filter_policy_default_action, verbose,
+           child_chains, table_name, as_regular_chain))
 
   def _ProcessHeader(self, header_options):
     """Capirca policy header processing.
@@ -824,6 +826,7 @@ def _ProcessHeader(self, header_options):
         base_chain_name = option.split('=')[1].strip()
       if option.startswith('table_name='):
         table_name = option.split('=')[1].strip()
+    as_regular_chain = True if 'as_regular_chain' in header_options else False
     return (
         netfilter_family,
         netfilter_hook,
@@ -832,6 +835,7 @@ def _ProcessHeader(self, header_options):
         verbose,
         base_chain_name,
         table_name,
+        as_regular_chain,
     )
 
   def _ConfigurationDictionary(self, nft_pol):
@@ -857,6 +861,7 @@ def _ConfigurationDictionary(self, nft_pol):
         verbose,
         child_chains,
         table_name,
+        as_regular_chain,
     ) in nft_pol:
       base_chain_comment = ''
       # TODO: If child_chain ruleset is empty don't store term.
@@ -870,6 +875,7 @@ def _ConfigurationDictionary(self, nft_pol):
           'priority': nf_priority,
           'policy': filter_policy_default_action,
           'rules': child_chains,
+          'as_regular_chain': as_regular_chain,
       }
     return nftables
 
@@ -898,12 +904,13 @@ def __str__(self):
             # First time we comment it out so .nft file is human-readable.
             nft_config.append(
                 TabSpacer(8, '#' + ' '.join(base_chain_dict[item]['comment'])))
-          nft_config.append(
-              TabSpacer(
-                  8, 'type filter hook %s priority %s; policy %s;' %
-                  (base_chain_dict[item]['hook'],
-                  base_chain_dict[item]['priority'],
-                  base_chain_dict[item]['policy'])))
+          if not base_chain_dict[item]['as_regular_chain']:
+            nft_config.append(
+                TabSpacer(
+                    8, 'type filter hook %s priority %s; policy %s;' %
+                    (base_chain_dict[item]['hook'],
+                     base_chain_dict[item]['priority'],
+                     base_chain_dict[item]['policy'])))
           # Add policy header comment after stateful firewall rule.
           if base_chain_dict[item]['comment']:
             nft_config.append(TabSpacer(8, 'ct state established,related accept'

tests/lib/nftables_test.py

@@ -593,7 +593,7 @@ def testBadHeader(self, case):
   def testVerboseHeader(self, header_to_use, expected_output):
     pol = policy.ParsePolicy(header_to_use + GOOD_TERM_1, self.naming)
     data = nftables.Nftables(pol, EXP_INFO)
-    for _, _, _, _, _, _, verbose, _, _ in data.nftables_policies:
+    for _, _, _, _, _, _, verbose, _, _, _ in data.nftables_policies:
       result = verbose
     self.assertEqual(result, expected_output)
 
@@ -667,7 +667,7 @@ def testOverridePolicyHeader(self):
         HEAD_OVERRIDE_DEFAULT_ACTION + GOOD_TERM_1, self.naming
     )
     data = nftables.Nftables(pol, EXP_INFO)
-    for _, _, _, _, _, default_policy, _, _, _ in data.nftables_policies:
+    for _, _, _, _, _, default_policy, _, _, _, _ in data.nftables_policies:
       result = default_policy
     self.assertEqual(result, expected_output)
 
@@ -887,7 +887,7 @@ def testRulesetGeneratorAF(self, policy_data: str, expected_inet: str):
     )
     for header, terms in nft.policy.filters:
       filter_options = header.FilterOptions('nftables')
-      nf_af, nf_hook, _, _, verbose, _, _ = nft._ProcessHeader(filter_options)
+      nf_af, nf_hook, _, _, verbose, _, _, _ = nft._ProcessHeader(filter_options)
       for term in terms:
         term_object = nftables.Term(term, nf_af, nf_hook, verbose)