Add log expression and test (#42)

Signed-off-by: Serguei Bezverkhi <sbezverk@cisco.com>

expr/log.go

@@ -0,0 +1,86 @@
+// Copyright 2019 Google LLC. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package expr
+
+import (
+	"encoding/binary"
+
+	"github.com/mdlayher/netlink"
+	"golang.org/x/sys/unix"
+)
+
+// Log defines type for NFT logging
+type Log struct {
+	Key  uint32
+	Data []byte
+}
+
+func (e *Log) marshal() ([]byte, error) {
+	var data []byte
+	var err error
+	switch e.Key {
+	case unix.NFTA_LOG_GROUP:
+		data, err = netlink.MarshalAttributes([]netlink.Attribute{
+			{Type: unix.NFTA_LOG_GROUP, Data: e.Data},
+		})
+	case unix.NFTA_LOG_PREFIX:
+		prefix := append(e.Data, '\x00')
+		data, err = netlink.MarshalAttributes([]netlink.Attribute{
+			{Type: unix.NFTA_LOG_PREFIX, Data: prefix},
+		})
+	case unix.NFTA_LOG_SNAPLEN:
+		data, err = netlink.MarshalAttributes([]netlink.Attribute{
+			{Type: unix.NFTA_LOG_SNAPLEN, Data: e.Data},
+		})
+	case unix.NFTA_LOG_QTHRESHOLD:
+		data, err = netlink.MarshalAttributes([]netlink.Attribute{
+			{Type: unix.NFTA_LOG_QTHRESHOLD, Data: e.Data},
+		})
+	case unix.NFTA_LOG_LEVEL:
+		level := append(e.Data, '\x00')
+		data, err = netlink.MarshalAttributes([]netlink.Attribute{
+			{Type: unix.NFTA_LOG_LEVEL, Data: level},
+		})
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return netlink.MarshalAttributes([]netlink.Attribute{
+		{Type: unix.NFTA_EXPR_NAME, Data: []byte("log\x00")},
+		{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
+	})
+}
+
+func (e *Log) unmarshal(data []byte) error {
+	ad, err := netlink.NewAttributeDecoder(data)
+	if err != nil {
+		return err
+	}
+
+	ad.ByteOrder = binary.BigEndian
+	if ad.Next() {
+		e.Key = uint32(ad.Type())
+		e.Data = ad.Bytes()
+		switch e.Key {
+		case unix.NFTA_LOG_PREFIX:
+			fallthrough
+		case unix.NFTA_LOG_LEVEL:
+			// Getting rid of \x00 at the end of string
+			e.Data = e.Data[:len(e.Data)-1]
+		}
+	}
+	return ad.Err()
+}

nftables_test.go

@@ -606,6 +606,56 @@ func TestDelRule(t *testing.T) {
 	}
 }
 
+func TestLog(t *testing.T) {
+	want := [][]byte{
+		// batch begin
+		[]byte("\x00\x00\x00\x0a"),
+		//  nft add rule ipv4table ipv4chain-1  log prefix nftables
+		[]byte("\x02\x00\x00\x00\x0e\x00\x01\x00\x69\x70\x76\x34\x74\x61\x62\x6c\x65\x00\x00\x00\x10\x00\x02\x00\x69\x70\x76\x34\x63\x68\x61\x69\x6e\x2d\x31\x00\x24\x00\x04\x80\x20\x00\x01\x80\x08\x00\x01\x00\x6c\x6f\x67\x00\x14\x00\x02\x80\x0d\x00\x02\x00\x6e\x66\x74\x61\x62\x6c\x65\x73\x00\x00\x00\x00"),
+		// batch end
+		[]byte("\x00\x00\x00\x0a"),
+	}
+
+	c := &nftables.Conn{
+		TestDial: func(req []netlink.Message) ([]netlink.Message, error) {
+			for idx, msg := range req {
+				b, err := msg.MarshalBinary()
+				if err != nil {
+					t.Fatal(err)
+				}
+				if len(b) < 16 {
+					continue
+				}
+				b = b[16:]
+				if len(want) == 0 {
+					t.Errorf("no want entry for message %d: %x", idx, b)
+					continue
+				}
+				if got, want := b, want[0]; !bytes.Equal(got, want) {
+					t.Errorf("message %d: %s", idx, linediff(nfdump(got), nfdump(want)))
+				}
+				want = want[1:]
+			}
+			return req, nil
+		},
+	}
+
+	c.AddRule(&nftables.Rule{
+		Table: &nftables.Table{Name: "ipv4table", Family: nftables.TableFamilyIPv4},
+		Chain: &nftables.Chain{Name: "ipv4chain-1", Type: nftables.ChainTypeFilter},
+		Exprs: []expr.Any{
+			&expr.Log{
+				Key:  unix.NFTA_LOG_PREFIX,
+				Data: []byte("nftables"),
+			},
+		},
+	})
+
+	if err := c.Flush(); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestTProxy(t *testing.T) {
 	want := [][]byte{
 		// batch begin