From 919abdc34fbc29b73b218046b653cc124c3cd08b Mon Sep 17 00:00:00 2001 From: Nikita Vorontsov Date: Thu, 7 Aug 2025 12:03:00 +0300 Subject: [PATCH 1/3] add DelTable(force) --- nftables_test.go | 42 ++++++++++++++++++++++++++++++++++++++++++ table.go | 16 ++++++++++++++-- 2 files changed, 56 insertions(+), 2 deletions(-) diff --git a/nftables_test.go b/nftables_test.go index fe12566..867e529 100644 --- a/nftables_test.go +++ b/nftables_test.go @@ -128,6 +128,48 @@ func ifname(n string) []byte { return b } +func TestTableCreateDestroy(t *testing.T) { + c, newNS := nftest.OpenSystemConn(t, *enableSysTests) + defer nftest.CleanupSystemConn(t, newNS) + defer c.FlushRuleset() + + filter := &nftables.Table{ + Family: nftables.TableFamilyIPv4, + Name: "filter", + } + c.DelTable(filter, true) + c.AddTable(filter) + err := c.Flush() + if err != nil { + t.Fatalf("on Flush: %q", err.Error()) + } + + LookupMyTable := func() bool { + ts, err := c.ListTables() + if err != nil { + t.Fatalf("on ListTables: %q", err.Error()) + } + return slices.ContainsFunc(ts, func(t *nftables.Table) bool { + return t.Name == filter.Name && t.Family == filter.Family + }) + } + if !LookupMyTable() { + t.Fatal("AddTable doesn't create my table!") + } + + c.DelTable(filter) + err = c.Flush() + if err != nil { + t.Fatalf("on Flush: %q", err.Error()) + } + + if LookupMyTable() { + t.Fatal("DelTable doesn't delete my table!") + } + + c.DelTable(filter, true) // just for test that 'force' ignore error 'not found' +} + func TestRuleOperations(t *testing.T) { // Create a new network namespace to test these operations, // and tear down the namespace at test completion. diff --git a/table.go b/table.go index 3686b7a..43390cd 100644 --- a/table.go +++ b/table.go @@ -16,6 +16,7 @@ package nftables import ( "fmt" + "slices" "github.com/mdlayher/netlink" "golang.org/x/sys/unix" @@ -24,6 +25,10 @@ import ( const ( newTableHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWTABLE) delTableHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_DELTABLE) + + // FIXME: in sys@v0.34.0 no unix.NFT_MSG_DESTROYTABLE const yet. + // See nf_tables_msg_types enum in https://git.netfilter.org/nftables/tree/include/linux/netfilter/nf_tables.h + destroyTableHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | 0x1a) ) // TableFamily specifies the address family for this table. @@ -50,16 +55,23 @@ type Table struct { } // DelTable deletes a specific table, along with all chains/rules it contains. -func (cc *Conn) DelTable(t *Table) { +func (cc *Conn) DelTable(t *Table, force ...bool) { cc.mu.Lock() defer cc.mu.Unlock() data := cc.marshalAttr([]netlink.Attribute{ {Type: unix.NFTA_TABLE_NAME, Data: []byte(t.Name + "\x00")}, {Type: unix.NFTA_TABLE_FLAGS, Data: []byte{0, 0, 0, 0}}, }) + + var hdrType netlink.HeaderType + if slices.Contains(force, true) { + hdrType = destroyTableHeaderType + } else { + hdrType = delTableHeaderType + } cc.messages = append(cc.messages, netlinkMessage{ Header: netlink.Header{ - Type: netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_DELTABLE), + Type: hdrType, Flags: netlink.Request | netlink.Acknowledge, }, Data: append(extraHeader(uint8(t.Family), 0), data...), From 3c0f824cccb3469be45897d9aff4bae98f8fa685 Mon Sep 17 00:00:00 2001 From: Nikita Vorontsov Date: Thu, 28 Aug 2025 16:48:33 +0300 Subject: [PATCH 2/3] CR fixes --- nftables_test.go | 11 +++++------ table.go | 18 ++++++++++-------- 2 files changed, 15 insertions(+), 14 deletions(-) diff --git a/nftables_test.go b/nftables_test.go index 867e529..844f481 100644 --- a/nftables_test.go +++ b/nftables_test.go @@ -137,7 +137,7 @@ func TestTableCreateDestroy(t *testing.T) { Family: nftables.TableFamilyIPv4, Name: "filter", } - c.DelTable(filter, true) + c.DestroyTable(filter) c.AddTable(filter) err := c.Flush() if err != nil { @@ -157,17 +157,16 @@ func TestTableCreateDestroy(t *testing.T) { t.Fatal("AddTable doesn't create my table!") } - c.DelTable(filter) - err = c.Flush() - if err != nil { + c.DestroyTable(filter) + if err = c.Flush(); err != nil { t.Fatalf("on Flush: %q", err.Error()) } if LookupMyTable() { - t.Fatal("DelTable doesn't delete my table!") + t.Fatal("DestroyTable doesn't delete my table!") } - c.DelTable(filter, true) // just for test that 'force' ignore error 'not found' + c.DestroyTable(filter) // just for test that 'destroy' ignore error 'not found' } func TestRuleOperations(t *testing.T) { diff --git a/table.go b/table.go index 43390cd..ce737a6 100644 --- a/table.go +++ b/table.go @@ -16,7 +16,6 @@ package nftables import ( "fmt" - "slices" "github.com/mdlayher/netlink" "golang.org/x/sys/unix" @@ -55,7 +54,16 @@ type Table struct { } // DelTable deletes a specific table, along with all chains/rules it contains. -func (cc *Conn) DelTable(t *Table, force ...bool) { +func (cc *Conn) DelTable(t *Table) { + cc.delTable(t, delTableHeaderType) +} + +// DestroyTable is like DelTable, but not an error if table doesn't exists +func (cc *Conn) DestroyTable(t *Table) { + cc.delTable(t, destroyTableHeaderType) +} + +func (cc *Conn) delTable(t *Table, hdrType netlink.HeaderType) { cc.mu.Lock() defer cc.mu.Unlock() data := cc.marshalAttr([]netlink.Attribute{ @@ -63,12 +71,6 @@ func (cc *Conn) DelTable(t *Table, force ...bool) { {Type: unix.NFTA_TABLE_FLAGS, Data: []byte{0, 0, 0, 0}}, }) - var hdrType netlink.HeaderType - if slices.Contains(force, true) { - hdrType = destroyTableHeaderType - } else { - hdrType = delTableHeaderType - } cc.messages = append(cc.messages, netlinkMessage{ Header: netlink.Header{ Type: hdrType, From 6baf2cbc05140271796e979ba974979103c31aa6 Mon Sep 17 00:00:00 2001 From: Nikita Vorontsov Date: Thu, 28 Aug 2025 16:50:04 +0300 Subject: [PATCH 3/3] spell fixes --- nftables_test.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nftables_test.go b/nftables_test.go index 844f481..b6d0f1c 100644 --- a/nftables_test.go +++ b/nftables_test.go @@ -144,7 +144,7 @@ func TestTableCreateDestroy(t *testing.T) { t.Fatalf("on Flush: %q", err.Error()) } - LookupMyTable := func() bool { + lookupMyTable := func() bool { ts, err := c.ListTables() if err != nil { t.Fatalf("on ListTables: %q", err.Error()) @@ -153,7 +153,7 @@ func TestTableCreateDestroy(t *testing.T) { return t.Name == filter.Name && t.Family == filter.Family }) } - if !LookupMyTable() { + if !lookupMyTable() { t.Fatal("AddTable doesn't create my table!") } @@ -162,7 +162,7 @@ func TestTableCreateDestroy(t *testing.T) { t.Fatalf("on Flush: %q", err.Error()) } - if LookupMyTable() { + if lookupMyTable() { t.Fatal("DestroyTable doesn't delete my table!") }