Add dynset expression and unit test
Signed-off-by: Serguei Bezverkhi <sbezverk@cisco.com>
This commit is contained in:
Serguei Bezverkhi
parent
9cdc3d048a
commit
616b82e0c4
|
|
@ -0,0 +1,85 @@
|
|||
// Copyright 2020 Google LLC. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package expr
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
|
||||
"github.com/google/nftables/binaryutil"
|
||||
"github.com/mdlayher/netlink"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
// Dynset represent a rule dynamically adding or updating a set or a map based on an incoming packet.
|
||||
type Dynset struct {
|
||||
SrcRegKey uint32
|
||||
SrcRegData uint32
|
||||
SetID uint32
|
||||
SetName string
|
||||
Operation uint32
|
||||
Timeout uint64
|
||||
Invert bool
|
||||
}
|
||||
|
||||
func (e *Dynset) marshal() ([]byte, error) {
|
||||
// See: https://git.netfilter.org/libnftnl/tree/src/expr/dynset.c
|
||||
var opAttrs []netlink.Attribute
|
||||
opAttrs = append(opAttrs, netlink.Attribute{Type: unix.NFTA_DYNSET_SREG_KEY, Data: binaryutil.BigEndian.PutUint32(e.SrcRegKey)})
|
||||
opAttrs = append(opAttrs, netlink.Attribute{Type: unix.NFTA_DYNSET_SREG_DATA, Data: binaryutil.BigEndian.PutUint32(e.SrcRegData)})
|
||||
opAttrs = append(opAttrs, netlink.Attribute{Type: unix.NFTA_DYNSET_OP, Data: binaryutil.BigEndian.PutUint32(e.Operation)})
|
||||
if e.Timeout != 0 {
|
||||
opAttrs = append(opAttrs, netlink.Attribute{Type: unix.NFTA_DYNSET_TIMEOUT, Data: binaryutil.BigEndian.PutUint64(e.Timeout)})
|
||||
}
|
||||
if e.Invert {
|
||||
opAttrs = append(opAttrs, netlink.Attribute{Type: unix.NFTA_DYNSET_FLAGS, Data: binaryutil.BigEndian.PutUint32(unix.NFT_DYNSET_F_INV)})
|
||||
}
|
||||
opAttrs = append(opAttrs,
|
||||
netlink.Attribute{Type: unix.NFTA_DYNSET_SET_NAME, Data: []byte(e.SetName + "\x00")},
|
||||
netlink.Attribute{Type: unix.NFTA_DYNSET_SET_ID, Data: binaryutil.BigEndian.PutUint32(e.SetID)})
|
||||
opData, err := netlink.MarshalAttributes(opAttrs)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return netlink.MarshalAttributes([]netlink.Attribute{
|
||||
{Type: unix.NFTA_EXPR_NAME, Data: []byte("dynset\x00")},
|
||||
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: opData},
|
||||
})
|
||||
}
|
||||
|
||||
func (e *Dynset) unmarshal(data []byte) error {
|
||||
ad, err := netlink.NewAttributeDecoder(data)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
ad.ByteOrder = binary.BigEndian
|
||||
for ad.Next() {
|
||||
switch ad.Type() {
|
||||
case unix.NFTA_DYNSET_SET_NAME:
|
||||
e.SetName = ad.String()
|
||||
case unix.NFTA_DYNSET_SET_ID:
|
||||
e.SetID = ad.Uint32()
|
||||
case unix.NFTA_DYNSET_SREG_KEY:
|
||||
e.SrcRegKey = ad.Uint32()
|
||||
case unix.NFTA_DYNSET_SREG_DATA:
|
||||
e.SrcRegData = ad.Uint32()
|
||||
case unix.NFTA_DYNSET_TIMEOUT:
|
||||
e.Timeout = ad.Uint64()
|
||||
case unix.NFTA_DYNSET_FLAGS:
|
||||
e.Invert = (ad.Uint32() & unix.NFT_DYNSET_F_INV) != 0
|
||||
}
|
||||
}
|
||||
return ad.Err()
|
||||
}
|
||||
|
|
@ -2487,6 +2487,104 @@ func TestGetRuleLookupVerdictImmediate(t *testing.T) {
|
|||
}
|
||||
}
|
||||
|
||||
func TestDynset(t *testing.T) {
|
||||
// Create a new network namespace to test these operations,
|
||||
// and tear down the namespace at test completion.
|
||||
c, newNS := openSystemNFTConn(t)
|
||||
defer cleanupSystemNFTConn(t, newNS)
|
||||
// Clear all rules at the beginning + end of the test.
|
||||
c.FlushRuleset()
|
||||
defer c.FlushRuleset()
|
||||
|
||||
filter := c.AddTable(&nftables.Table{
|
||||
Family: nftables.TableFamilyIPv4,
|
||||
Name: "filter",
|
||||
})
|
||||
forward := c.AddChain(&nftables.Chain{
|
||||
Name: "forward",
|
||||
Table: filter,
|
||||
Type: nftables.ChainTypeFilter,
|
||||
Hooknum: nftables.ChainHookForward,
|
||||
Priority: nftables.ChainPriorityFilter,
|
||||
})
|
||||
|
||||
set := &nftables.Set{
|
||||
Table: filter,
|
||||
Name: "dynamic-set",
|
||||
KeyType: nftables.TypeIPAddr,
|
||||
HasTimeout: true,
|
||||
Timeout: 600 * 1000, // Timeout is specified in milliseconds
|
||||
}
|
||||
if err := c.AddSet(set, nil); err != nil {
|
||||
t.Errorf("c.AddSet(portSet) failed: %v", err)
|
||||
}
|
||||
if err := c.Flush(); err != nil {
|
||||
t.Errorf("c.Flush() failed: %v", err)
|
||||
}
|
||||
|
||||
c.AddRule(&nftables.Rule{
|
||||
Table: filter,
|
||||
Chain: forward,
|
||||
Exprs: []expr.Any{
|
||||
&expr.Payload{
|
||||
DestRegister: 1,
|
||||
Base: expr.PayloadBaseNetworkHeader,
|
||||
Offset: 12,
|
||||
Len: 4,
|
||||
},
|
||||
&expr.Immediate{
|
||||
Register: 2,
|
||||
Data: []byte{0x0, 0x0, 0x0, 0x2},
|
||||
},
|
||||
&expr.Dynset{
|
||||
SrcRegKey: 1,
|
||||
SrcRegData: 2,
|
||||
SetName: set.Name,
|
||||
SetID: set.ID,
|
||||
Operation: uint32(unix.NFT_DYNSET_OP_UPDATE),
|
||||
},
|
||||
},
|
||||
})
|
||||
|
||||
if err := c.Flush(); err != nil {
|
||||
t.Errorf("c.Flush() failed: %v", err)
|
||||
}
|
||||
|
||||
rules, err := c.GetRule(
|
||||
&nftables.Table{
|
||||
Family: nftables.TableFamilyIPv4,
|
||||
Name: "filter",
|
||||
},
|
||||
&nftables.Chain{
|
||||
Name: "forward",
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if got, want := len(rules), 1; got != want {
|
||||
t.Fatalf("unexpected number of rules: got %d, want %d", got, want)
|
||||
}
|
||||
if got, want := len(rules[0].Exprs), 3; got != want {
|
||||
t.Fatalf("unexpected number of exprs: got %d, want %d", got, want)
|
||||
}
|
||||
|
||||
dynset, dynsetOk := rules[0].Exprs[2].(*expr.Dynset)
|
||||
if !dynsetOk {
|
||||
t.Fatalf("Exprs[3] is type %T, want *expr.Dynset", rules[0].Exprs[2])
|
||||
}
|
||||
if want := (&expr.Dynset{
|
||||
SrcRegKey: 1,
|
||||
SrcRegData: 2,
|
||||
SetName: set.Name,
|
||||
SetID: set.ID,
|
||||
Operation: uint32(unix.NFT_DYNSET_OP_UPDATE),
|
||||
}); !reflect.DeepEqual(dynset, want) {
|
||||
t.Errorf("dynset expr = %+v, wanted %+v", dynset, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestConfigureNATRedirect(t *testing.T) {
|
||||
// The want byte sequences come from stracing nft(8), e.g.:
|
||||
// strace -f -v -x -s 2048 -eraw=sendto nft add table ip nat
|
||||
|
|
|
|||
Loading…
Reference in New Issue