diff --git a/expr/fib.go b/expr/fib.go new file mode 100644 index 0000000..fdac832 --- /dev/null +++ b/expr/fib.go @@ -0,0 +1,128 @@ +// Copyright 2018 Google LLC. All Rights Reserved. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package expr + +import ( + "encoding/binary" + + "github.com/google/nftables/binaryutil" + "github.com/mdlayher/netlink" + "golang.org/x/sys/unix" +) + +// Fib defines fib expression structure +type Fib struct { + Register uint32 + ResultOIF bool + ResultOIFNAME bool + ResultADDRTYPE bool + FlagSADDR bool + FlagDADDR bool + FlagMARK bool + FlagIIF bool + FlagOIF bool + FlagPRESENT bool +} + +func (e *Fib) marshal() ([]byte, error) { + data := []byte{} + reg, err := netlink.MarshalAttributes([]netlink.Attribute{ + {Type: unix.NFTA_FIB_DREG, Data: binaryutil.BigEndian.PutUint32(e.Register)}, + }) + if err != nil { + return nil, err + } + data = append(data, reg...) + flags := uint32(0) + if e.FlagSADDR { + flags |= unix.NFTA_FIB_F_SADDR + } + if e.FlagDADDR { + flags |= unix.NFTA_FIB_F_DADDR + } + if e.FlagMARK { + flags |= unix.NFTA_FIB_F_MARK + } + if e.FlagIIF { + flags |= unix.NFTA_FIB_F_IIF + } + if e.FlagOIF { + flags |= unix.NFTA_FIB_F_OIF + } + if e.FlagPRESENT { + flags |= unix.NFTA_FIB_F_PRESENT + } + if flags != 0 { + flg, err := netlink.MarshalAttributes([]netlink.Attribute{ + {Type: unix.NFTA_FIB_FLAGS, Data: binaryutil.BigEndian.PutUint32(flags)}, + }) + if err != nil { + return nil, err + } + data = append(data, flg...) + } + results := uint32(0) + if e.ResultOIF { + results |= unix.NFT_FIB_RESULT_OIF + } + if e.ResultOIFNAME { + results |= unix.NFT_FIB_RESULT_OIFNAME + } + if e.ResultADDRTYPE { + results |= unix.NFT_FIB_RESULT_ADDRTYPE + } + if results != 0 { + rslt, err := netlink.MarshalAttributes([]netlink.Attribute{ + {Type: unix.NFTA_FIB_RESULT, Data: binaryutil.BigEndian.PutUint32(results)}, + }) + if err != nil { + return nil, err + } + data = append(data, rslt...) + } + + return netlink.MarshalAttributes([]netlink.Attribute{ + {Type: unix.NFTA_EXPR_NAME, Data: []byte("fib\x00")}, + {Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data}, + }) +} + +func (e *Fib) unmarshal(data []byte) error { + ad, err := netlink.NewAttributeDecoder(data) + if err != nil { + return err + } + ad.ByteOrder = binary.BigEndian + for ad.Next() { + switch ad.Type() { + case unix.NFTA_FIB_DREG: + e.Register = ad.Uint32() + case unix.NFTA_FIB_RESULT: + result := ad.Uint32() + e.ResultOIF = (result & unix.NFT_FIB_RESULT_OIF) == 1 + e.ResultOIFNAME = (result & unix.NFT_FIB_RESULT_OIFNAME) == 1 + e.ResultADDRTYPE = (result & unix.NFT_FIB_RESULT_ADDRTYPE) == 1 + case unix.NFTA_FIB_FLAGS: + flags := ad.Uint32() + e.FlagSADDR = (flags & unix.NFTA_FIB_F_SADDR) == 1 + e.FlagDADDR = (flags & unix.NFTA_FIB_F_DADDR) == 1 + e.FlagMARK = (flags & unix.NFTA_FIB_F_MARK) == 1 + e.FlagIIF = (flags & unix.NFTA_FIB_F_IIF) == 1 + e.FlagOIF = (flags & unix.NFTA_FIB_F_OIF) == 1 + e.FlagPRESENT = (flags & unix.NFTA_FIB_F_PRESENT) == 1 + } + } + return ad.Err() +} diff --git a/nftables_test.go b/nftables_test.go index fbecae0..a76b46b 100644 --- a/nftables_test.go +++ b/nftables_test.go @@ -2656,3 +2656,131 @@ func TestReject(t *testing.T) { } } } + +func TestFib(t *testing.T) { + tests := []struct { + name string + chain *nftables.Chain + want [][]byte + fibExprs []expr.Any + }{ + { + name: "fib saddr type local", + chain: &nftables.Chain{ + Name: "base-chain", + }, + want: [][]byte{ + // batch begin + []byte("\x00\x00\x00\x0a"), + // nft add table ip filter + []byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00"), + // nft add chain ip filter base-chain + []byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x03\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00"), + // nft add rule ip filter base-chain fib saddr type local + []byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x02\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00\x2c\x00\x04\x80\x28\x00\x01\x80\x08\x00\x01\x00\x66\x69\x62\x00\x1c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x03"), + // batch end + []byte("\x00\x00\x00\x0a"), + }, + fibExprs: []expr.Any{ + &expr.Fib{ + Register: 1, + FlagSADDR: true, + ResultADDRTYPE: true, + }, + }, + }, + { + name: "fib daddr type broadcast", + chain: &nftables.Chain{ + Name: "base-chain", + }, + want: [][]byte{ + // batch begin + []byte("\x00\x00\x00\x0a"), + // nft add table ip filter + []byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00"), + // nft add chain ip filter base-chain + []byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x03\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00"), + // nft add rule ip filter base-chain fib daddr type broadcast + []byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x02\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00\x2c\x00\x04\x80\x28\x00\x01\x80\x08\x00\x01\x00\x66\x69\x62\x00\x1c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x02\x08\x00\x02\x00\x00\x00\x00\x03"), + // batch end + []byte("\x00\x00\x00\x0a"), + }, + fibExprs: []expr.Any{ + &expr.Fib{ + Register: 1, + FlagDADDR: true, + ResultADDRTYPE: true, + }, + }, + }, + { + name: "fib saddr . iif oif missing", + chain: &nftables.Chain{ + Name: "base-chain", + }, + want: [][]byte{ + // batch begin + []byte("\x00\x00\x00\x0a"), + // nft add table ip filter + []byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00"), + // nft add chain ip filter base-chain + []byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x03\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00"), + // nft add rule ip filter base-chain fib saddr . iif oif missing + []byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x66\x69\x6c\x74\x65\x72\x00\x00\x0f\x00\x02\x00\x62\x61\x73\x65\x2d\x63\x68\x61\x69\x6e\x00\x00\x2c\x00\x04\x80\x28\x00\x01\x80\x08\x00\x01\x00\x66\x69\x62\x00\x1c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x09\x08\x00\x02\x00\x00\x00\x00\x01"), + // batch end + []byte("\x00\x00\x00\x0a"), + }, + fibExprs: []expr.Any{ + &expr.Fib{ + Register: 1, + FlagSADDR: true, + FlagIIF: true, + ResultOIF: true, + }, + }, + }, + } + + for _, tt := range tests { + c := &nftables.Conn{ + TestDial: func(req []netlink.Message) ([]netlink.Message, error) { + for idx, msg := range req { + b, err := msg.MarshalBinary() + if err != nil { + t.Fatal(err) + } + if len(b) < 16 { + continue + } + b = b[16:] + if len(tt.want[idx]) == 0 { + t.Errorf("no want entry for message %d: %x", idx, b) + continue + } + got := b + if !bytes.Equal(got, tt.want[idx]) { + t.Errorf("message %d: %s", idx, linediff(nfdump(got), nfdump(tt.want[idx]))) + } + } + return req, nil + }, + } + + filter := c.AddTable(&nftables.Table{ + Family: nftables.TableFamilyIPv4, + Name: "filter", + }) + + tt.chain.Table = filter + chain := c.AddChain(tt.chain) + c.AddRule(&nftables.Rule{ + Table: filter, + Chain: chain, + Exprs: tt.fibExprs, + }) + if err := c.Flush(); err != nil { + t.Fatalf("Test \"%s\" failed with error: %+v", tt.name, err) + } + } +}