interesting
/
nftables
mirror of https://github.com/google/nftables.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

set: add set support auto-merge (#271) 

Signed-off-by: Asutorufa <16442314+Asutorufa@users.noreply.github.com>
This commit is contained in:
Asutorufa 2024-09-03 00:48:06 +08:00 committed by GitHub
parent 7a6c4ef3e7
commit 9a9f2ce6b3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 99 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
nftables_test.go
View File

@ -3498,6 +3498,66 @@ func TestCreateUseNamedSet(t *testing.T) {
}
}
func TestCreateAutoMergeSet(t *testing.T) {
// Create a new network namespace to test these operations,
// and tear down the namespace at test completion.
c, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)
// Clear all rules at the beginning + end of the test.
c.FlushRuleset()
defer c.FlushRuleset()
filter := c.AddTable(&nftables.Table{
Family: nftables.TableFamilyIPv4,
Name: "filter",
})
portSet := &nftables.Set{
Table: filter,
Name: "test",
KeyType: nftables.TypeInetService,
Interval: true,
AutoMerge: true,
}
if err := c.AddSet(portSet, nil); err != nil {
t.Errorf("c.AddSet(portSet) failed: %v", err)
}
if err := c.SetAddElements(portSet, []nftables.SetElement{{Key: binaryutil.BigEndian.PutUint16(22)}}); err != nil {
t.Errorf("c.SetVal(portSet) failed: %v", err)
}
ipSet := &nftables.Set{
Table: filter,
Name: "IPs_4_dayz",
KeyType: nftables.TypeIPAddr,
Interval: true,
AutoMerge: true,
}
if err := c.AddSet(ipSet, []nftables.SetElement{{Key: []byte(net.ParseIP("192.168.1.64").To4())}}); err != nil {
t.Errorf("c.AddSet(ipSet) failed: %v", err)
}
if err := c.SetAddElements(ipSet, []nftables.SetElement{{Key: []byte(net.ParseIP("192.168.1.42").To4())}}); err != nil {
t.Errorf("c.SetVal(ipSet) failed: %v", err)
}
if err := c.Flush(); err != nil {
t.Errorf("c.Flush() failed: %v", err)
}
sets, err := c.GetSets(filter)
if err != nil {
t.Errorf("c.GetSets() failed: %v", err)
}
if len(sets) != 2 {
t.Fatalf("len(sets) = %d, want 2", len(sets))
}
if !sets[0].AutoMerge {
t.Errorf("set[0].AutoMerge = %v, want true", sets[0].AutoMerge)
}
if !sets[1].AutoMerge {
t.Errorf("set[1].AutoMerge = %v, want true", sets[1].AutoMerge)
}
}
func TestIP6SetAddElements(t *testing.T) {
// Create a new network namespace to test these operations,
// and tear down the namespace at test completion.

31
set.go
View File

@ -21,10 +21,10 @@ import (
"strings"
"time"
"github.com/google/nftables/binaryutil"
"github.com/google/nftables/expr"
"github.com/google/nftables/internal/parseexprfunc"
"github.com/google/nftables/binaryutil"
"github.com/google/nftables/userdata"
"github.com/mdlayher/netlink"
"golang.org/x/sys/unix"
)
@ -249,6 +249,7 @@ type Set struct {
Anonymous bool
Constant bool
Interval bool
AutoMerge bool
IsMap bool
HasTimeout bool
Counter bool
@ -580,15 +581,27 @@ func (cc *Conn) AddSet(s *Set, vals []SetElement) error {
// Marshal concat size description as set description
tableInfo = append(tableInfo, netlink.Attribute{Type: unix.NLA_F_NESTED | unix.NFTA_SET_DESC, Data: concatBytes})
}
// https://git.netfilter.org/libnftnl/tree/include/udata.h#n17
var userData []byte
if s.Anonymous || s.Constant || s.Interval || s.KeyByteOrder == binaryutil.BigEndian {
tableInfo = append(tableInfo,
// Semantically useless - kept for binary compatability with nft
netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: []byte("\x00\x04\x02\x00\x00\x00")})
// Semantically useless - kept for binary compatability with nft
userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_KEYBYTEORDER, 2)
} else if s.KeyByteOrder == binaryutil.NativeEndian {
// Per https://git.netfilter.org/nftables/tree/src/mnl.c?id=187c6d01d35722618c2711bbc49262c286472c8f#n1165
tableInfo = append(tableInfo,
netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: []byte("\x00\x04\x01\x00\x00\x00")})
userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_KEYBYTEORDER, 1)
}
if s.Interval && s.AutoMerge {
// https://git.netfilter.org/nftables/tree/src/mnl.c?id=187c6d01d35722618c2711bbc49262c286472c8f#n1174
userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_MERGE_ELEMENTS, 1)
}
if len(userData) > 0 {
tableInfo = append(tableInfo, netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: userData})
}
if s.Counter {
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_LIST_ELEM, Data: []byte("counter\x00")},
@ -740,6 +753,10 @@ func setsFromMsg(msg netlink.Message) (*Set, error) {
set.DataType = dt
case unix.NFTA_SET_DATA_LEN:
set.DataType.Bytes = binary.BigEndian.Uint32(ad.Bytes())
case unix.NFTA_SET_USERDATA:
data := ad.Bytes()
value, ok := userdata.GetUint32(data, userdata.NFTNL_UDATA_SET_MERGE_ELEMENTS)
set.AutoMerge = ok && value == 1
}
}
return &set, nil

15
userdata/userdata.go
View File

@ -31,6 +31,21 @@ const (
TypesCount
)
// TLV type values are defined in:
// https://git.netfilter.org/libnftnl/tree/include/libnftnl/udata.h#n39
const (
NFTNL_UDATA_SET_KEYBYTEORDER Type = iota
NFTNL_UDATA_SET_DATABYTEORDER
NFTNL_UDATA_SET_MERGE_ELEMENTS
NFTNL_UDATA_SET_KEY_TYPEOF
NFTNL_UDATA_SET_DATA_TYPEOF
NFTNL_UDATA_SET_EXPR
NFTNL_UDATA_SET_DATA_INTERVAL
NFTNL_UDATA_SET_COMMENT
NFTNL_UDATA_SET_MAX
)
func Append(udata []byte, typ Type, data []byte) []byte {
udata = append(udata, byte(typ), byte(len(data)))
udata = append(udata, data...)