Merge e01db4c5b9 into 6d4c531bb6

fixes https://github.com/google/nftables/issues/224

chain.go

@@ -223,9 +223,10 @@ func (cc *Conn) ListChainsOfTableFamily(family TableFamily) ([]*Chain, error) {
 }
 
 func chainFromMsg(msg netlink.Message) (*Chain, error) {
-	chainHeaderType := netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWCHAIN)
+	newChainHeaderType := netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWCHAIN)
-	if got, want := msg.Header.Type, chainHeaderType; got != want {
+	delChainHeaderType := netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_DELCHAIN)
-		return nil, fmt.Errorf("unexpected header type: got %v, want %v", got, want)
+	if got, want1, want2 := msg.Header.Type, newChainHeaderType, delChainHeaderType; got != want1 && got != want2 {
+		return nil, fmt.Errorf("unexpected header type: got %v, want %v or %v", got, want1, want2)
 	}
 
 	var c Chain

go.mod

@@ -1,6 +1,6 @@
 module github.com/google/nftables
 
-go 1.17
+go 1.18
 
 require (
 	github.com/mdlayher/netlink v1.7.1

monitor.go

@@ -0,0 +1,319 @@
+// Copyright 2018 Google LLC. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package nftables
+
+import (
+	"math"
+	"strings"
+	"sync"
+
+	"github.com/mdlayher/netlink"
+	"golang.org/x/sys/unix"
+)
+
+type MonitorAction uint8
+
+// Possible MonitorAction values.
+const (
+	MonitorActionNew MonitorAction = 1 << iota
+	MonitorActionDel
+	MonitorActionMask MonitorAction = (1 << iota) - 1
+	MonitorActionAny  MonitorAction = MonitorActionMask
+)
+
+type MonitorObject uint32
+
+// Possible MonitorObject values.
+const (
+	MonitorObjectTables MonitorObject = 1 << iota
+	MonitorObjectChains
+	MonitorObjectSets
+	MonitorObjectRules
+	MonitorObjectElements
+	MonitorObjectRuleset
+	MonitorObjectMask MonitorObject = (1 << iota) - 1
+	MonitorObjectAny  MonitorObject = MonitorObjectMask
+)
+
+var (
+	monitorFlags = map[MonitorAction]map[MonitorObject]uint32{
+		MonitorActionAny: {
+			MonitorObjectAny:      0xffffffff,
+			MonitorObjectTables:   1<<unix.NFT_MSG_NEWTABLE | 1<<unix.NFT_MSG_DELTABLE,
+			MonitorObjectChains:   1<<unix.NFT_MSG_NEWCHAIN | 1<<unix.NFT_MSG_DELCHAIN,
+			MonitorObjectRules:    1<<unix.NFT_MSG_NEWRULE | 1<<unix.NFT_MSG_DELRULE,
+			MonitorObjectSets:     1<<unix.NFT_MSG_NEWSET | 1<<unix.NFT_MSG_DELSET,
+			MonitorObjectElements: 1<<unix.NFT_MSG_NEWSETELEM | 1<<unix.NFT_MSG_DELSETELEM,
+			MonitorObjectRuleset: 1<<unix.NFT_MSG_NEWTABLE | 1<<unix.NFT_MSG_DELTABLE |
+				1<<unix.NFT_MSG_NEWCHAIN | 1<<unix.NFT_MSG_DELCHAIN |
+				1<<unix.NFT_MSG_NEWRULE | 1<<unix.NFT_MSG_DELRULE |
+				1<<unix.NFT_MSG_NEWSET | 1<<unix.NFT_MSG_DELSET |
+				1<<unix.NFT_MSG_NEWSETELEM | 1<<unix.NFT_MSG_DELSETELEM |
+				1<<unix.NFT_MSG_NEWOBJ | 1<<unix.NFT_MSG_DELOBJ,
+		},
+		MonitorActionNew: {
+			MonitorObjectAny: 1<<unix.NFT_MSG_NEWTABLE |
+				1<<unix.NFT_MSG_NEWCHAIN |
+				1<<unix.NFT_MSG_NEWRULE |
+				1<<unix.NFT_MSG_NEWSET |
+				1<<unix.NFT_MSG_NEWSETELEM,
+			MonitorObjectTables: 1 << unix.NFT_MSG_NEWTABLE,
+			MonitorObjectChains: 1 << unix.NFT_MSG_NEWCHAIN,
+			MonitorObjectRules:  1 << unix.NFT_MSG_NEWRULE,
+			MonitorObjectSets:   1 << unix.NFT_MSG_NEWSET,
+			MonitorObjectRuleset: 1<<unix.NFT_MSG_NEWTABLE |
+				1<<unix.NFT_MSG_NEWCHAIN |
+				1<<unix.NFT_MSG_NEWRULE |
+				1<<unix.NFT_MSG_NEWSET |
+				1<<unix.NFT_MSG_NEWSETELEM |
+				1<<unix.NFT_MSG_NEWOBJ,
+		},
+		MonitorActionDel: {
+			MonitorObjectAny: 1<<unix.NFT_MSG_DELTABLE |
+				1<<unix.NFT_MSG_DELCHAIN |
+				1<<unix.NFT_MSG_DELRULE |
+				1<<unix.NFT_MSG_DELSET |
+				1<<unix.NFT_MSG_DELSETELEM |
+				1<<unix.NFT_MSG_DELOBJ,
+		},
+	}
+)
+
+type MonitorEventType int
+
+const (
+	MonitorEventTypeNewTable   MonitorEventType = unix.NFT_MSG_NEWTABLE
+	MonitorEventTypeDelTable   MonitorEventType = unix.NFT_MSG_DELTABLE
+	MonitorEventTypeNewChain   MonitorEventType = unix.NFT_MSG_NEWCHAIN
+	MonitorEventTypeDelChain   MonitorEventType = unix.NFT_MSG_DELCHAIN
+	MonitorEventTypeNewRule    MonitorEventType = unix.NFT_MSG_NEWRULE
+	MonitorEventTypeDelRule    MonitorEventType = unix.NFT_MSG_DELRULE
+	MonitorEventTypeNewSet     MonitorEventType = unix.NFT_MSG_NEWSET
+	MonitorEventTypeDelSet     MonitorEventType = unix.NFT_MSG_DELSET
+	MonitorEventTypeNewSetElem MonitorEventType = unix.NFT_MSG_NEWSETELEM
+	MonitorEventTypeDelSetElem MonitorEventType = unix.NFT_MSG_DELSETELEM
+	MonitorEventTypeNewObj     MonitorEventType = unix.NFT_MSG_NEWOBJ
+	MonitorEventTypeDelObj     MonitorEventType = unix.NFT_MSG_DELOBJ
+	MonitorEventTypeOOB        MonitorEventType = math.MaxInt // out of band event
+)
+
+// A MonitorEvent represents a single change received via a [Monitor].
+//
+// Depending on the Type, the Data field can be type-asserted to the specific
+// data type for this event, e.g. when Type is
+// nftables.MonitorEventTypeNewTable, you can access the corresponding table
+// details via Data.(*nftables.Table).
+type MonitorEvent struct {
+	Type  MonitorEventType
+	Data  any
+	Error error
+}
+
+const (
+	monitorOK = iota
+	monitorClosed
+)
+
+// A Monitor is an event-based nftables monitor that will receive one event per
+// new (or deleted) table, chain, rule, set, etc., depending on the monitor
+// configuration.
+type Monitor struct {
+	action       MonitorAction
+	object       MonitorObject
+	monitorFlags uint32
+
+	conn   *netlink.Conn
+	closer netlinkCloser
+
+	// mu covers eventCh and status
+	mu      sync.Mutex
+	eventCh chan *MonitorEvent
+	status  int
+}
+
+type MonitorOption func(*Monitor)
+
+func WithMonitorEventBuffer(size int) MonitorOption {
+	return func(monitor *Monitor) {
+		monitor.eventCh = make(chan *MonitorEvent, size)
+	}
+}
+
+// WithMonitorAction to set monitor actions like new, del or any.
+func WithMonitorAction(action MonitorAction) MonitorOption {
+	return func(monitor *Monitor) {
+		monitor.action = action
+	}
+}
+
+// WithMonitorObject to set monitor objects.
+func WithMonitorObject(object MonitorObject) MonitorOption {
+	return func(monitor *Monitor) {
+		monitor.object = object
+	}
+}
+
+// NewMonitor returns a Monitor with options to be started.
+//
+// Note that NewMonitor only prepares a Monitor. To install the monitor, call
+// [Conn.AddMonitor].
+func NewMonitor(opts ...MonitorOption) *Monitor {
+	monitor := &Monitor{
+		status: monitorOK,
+	}
+	for _, opt := range opts {
+		opt(monitor)
+	}
+	if monitor.eventCh == nil {
+		monitor.eventCh = make(chan *MonitorEvent)
+	}
+	objects, ok := monitorFlags[monitor.action]
+	if !ok {
+		objects = monitorFlags[MonitorActionAny]
+	}
+	flags, ok := objects[monitor.object]
+	if !ok {
+		flags = objects[MonitorObjectAny]
+	}
+	monitor.monitorFlags = flags
+	return monitor
+}
+
+func (monitor *Monitor) monitor() {
+	for {
+		msgs, err := monitor.conn.Receive()
+		if err != nil {
+			if strings.Contains(err.Error(), "use of closed file") {
+				// ignore the error that be closed
+				break
+			} else {
+				// any other errors will be send to user, and then to close eventCh
+				event := &MonitorEvent{
+					Type:  MonitorEventTypeOOB,
+					Data:  nil,
+					Error: err,
+				}
+				monitor.eventCh <- event
+				break
+			}
+		}
+		for _, msg := range msgs {
+			if msg.Header.Type&0xff00>>8 != netlink.HeaderType(unix.NFNL_SUBSYS_NFTABLES) {
+				continue
+			}
+			msgType := msg.Header.Type & 0x00ff
+			if monitor.monitorFlags&1<<msgType == 0 {
+				continue
+			}
+			switch msgType {
+			case unix.NFT_MSG_NEWTABLE, unix.NFT_MSG_DELTABLE:
+				table, err := tableFromMsg(msg)
+				event := &MonitorEvent{
+					Type:  MonitorEventType(msgType),
+					Data:  table,
+					Error: err,
+				}
+				monitor.eventCh <- event
+			case unix.NFT_MSG_NEWCHAIN, unix.NFT_MSG_DELCHAIN:
+				chain, err := chainFromMsg(msg)
+				event := &MonitorEvent{
+					Type:  MonitorEventType(msgType),
+					Data:  chain,
+					Error: err,
+				}
+				monitor.eventCh <- event
+			case unix.NFT_MSG_NEWRULE, unix.NFT_MSG_DELRULE:
+				rule, err := parseRuleFromMsg(msg)
+				event := &MonitorEvent{
+					Type:  MonitorEventType(msgType),
+					Data:  rule,
+					Error: err,
+				}
+				monitor.eventCh <- event
+			case unix.NFT_MSG_NEWSET, unix.NFT_MSG_DELSET:
+				set, err := setsFromMsg(msg)
+				event := &MonitorEvent{
+					Type:  MonitorEventType(msgType),
+					Data:  set,
+					Error: err,
+				}
+				monitor.eventCh <- event
+			case unix.NFT_MSG_NEWSETELEM, unix.NFT_MSG_DELSETELEM:
+				elems, err := elementsFromMsg(uint8(TableFamilyUnspecified), msg)
+				event := &MonitorEvent{
+					Type:  MonitorEventType(msgType),
+					Data:  elems,
+					Error: err,
+				}
+				monitor.eventCh <- event
+			case unix.NFT_MSG_NEWOBJ, unix.NFT_MSG_DELOBJ:
+				obj, err := objFromMsg(msg)
+				event := &MonitorEvent{
+					Type:  MonitorEventType(msgType),
+					Data:  obj,
+					Error: err,
+				}
+				monitor.eventCh <- event
+			}
+		}
+	}
+	monitor.mu.Lock()
+	defer monitor.mu.Unlock()
+
+	if monitor.status != monitorClosed {
+		monitor.status = monitorClosed
+	}
+	close(monitor.eventCh)
+}
+
+func (monitor *Monitor) Close() error {
+	monitor.mu.Lock()
+	defer monitor.mu.Unlock()
+
+	if monitor.status != monitorClosed {
+		monitor.status = monitorClosed
+		return monitor.closer()
+	}
+	return nil
+}
+
+// AddMonitor to perform the monitor immediately. The channel will be closed after
+// calling Close on Monitor or encountering a netlink conn error while Receive.
+// Caller may receive a MonitorEventTypeOOB event which contains an error we didn't
+// handle, for now.
+func (cc *Conn) AddMonitor(monitor *Monitor) (chan *MonitorEvent, error) {
+	conn, closer, err := cc.netlinkConn()
+	if err != nil {
+		return nil, err
+	}
+	monitor.conn = conn
+	monitor.closer = closer
+
+	if monitor.monitorFlags != 0 {
+		if err = conn.JoinGroup(uint32(unix.NFNLGRP_NFTABLES)); err != nil {
+			monitor.closer()
+			return nil, err
+		}
+	}
+
+	go monitor.monitor()
+	return monitor.eventCh, nil
+}
+
+func parseRuleFromMsg(msg netlink.Message) (*Rule, error) {
+	genmsg := &NFGenMsg{}
+	genmsg.Decode(msg.Data[:4])
+	return ruleFromMsg(TableFamily(genmsg.NFGenFamily), msg)
+}

monitor_test.go

@@ -0,0 +1,142 @@
+package nftables_test
+
+import (
+	"fmt"
+	"log"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/google/nftables"
+	"github.com/google/nftables/expr"
+	"github.com/google/nftables/internal/nftest"
+)
+
+func ExampleNewMonitor() {
+	conn, err := nftables.New()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	mon := nftables.NewMonitor()
+	defer mon.Close()
+	events, err := conn.AddMonitor(mon)
+	if err != nil {
+		log.Fatal(err)
+	}
+	for ev := range events {
+		log.Printf("ev: %+v, data = %T", ev, ev.Data)
+		switch ev.Type {
+		case nftables.MonitorEventTypeNewTable:
+			log.Printf("data = %+v", ev.Data.(*nftables.Table))
+
+			// …more cases if needed…
+		}
+	}
+}
+
+func TestMonitor(t *testing.T) {
+	// Create a new network namespace to test these operations,
+	// and tear down the namespace at test completion.
+	c, newNS := nftest.OpenSystemConn(t, *enableSysTests)
+	defer nftest.CleanupSystemConn(t, newNS)
+	// Clear all rules at the beginning + end of the test.
+	c.FlushRuleset()
+	defer c.FlushRuleset()
+
+	// default to monitor all
+	monitor := nftables.NewMonitor()
+	events, err := c.AddMonitor(monitor)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer monitor.Close()
+
+	var gotTable *nftables.Table
+	var gotChain *nftables.Chain
+	var gotRule *nftables.Rule
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		count := int32(0)
+		for {
+			select {
+			case event, ok := <-events:
+				if !ok {
+					return
+				}
+				if event.Error != nil {
+					err = fmt.Errorf("monitor err: %s", event.Error)
+					return
+				}
+				switch event.Type {
+				case nftables.MonitorEventTypeNewTable:
+					gotTable = event.Data.(*nftables.Table)
+					atomic.AddInt32(&count, 1)
+				case nftables.MonitorEventTypeNewChain:
+					gotChain = event.Data.(*nftables.Chain)
+					atomic.AddInt32(&count, 1)
+				case nftables.MonitorEventTypeNewRule:
+					gotRule = event.Data.(*nftables.Rule)
+					atomic.AddInt32(&count, 1)
+				}
+				if atomic.LoadInt32(&count) == 3 {
+					return
+				}
+			}
+		}
+	}()
+
+	nat := c.AddTable(&nftables.Table{
+		Family: nftables.TableFamilyIPv4,
+		Name:   "nat",
+	})
+
+	postrouting := c.AddChain(&nftables.Chain{
+		Name:     "postrouting",
+		Hooknum:  nftables.ChainHookPostrouting,
+		Priority: nftables.ChainPriorityNATSource,
+		Table:    nat,
+		Type:     nftables.ChainTypeNAT,
+	})
+
+	rule := c.AddRule(&nftables.Rule{
+		Table: nat,
+		Chain: postrouting,
+		Exprs: []expr.Any{
+			// payload load 4b @ network header + 12 => reg 1
+			&expr.Payload{
+				DestRegister: 1,
+				Base:         expr.PayloadBaseNetworkHeader,
+				Offset:       12,
+				Len:          4,
+			},
+			// cmp eq reg 1 0x0245a8c0
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     net.ParseIP("192.168.69.2").To4(),
+			},
+
+			// masq
+			&expr.Masq{},
+		},
+	})
+
+	if err := c.Flush(); err != nil {
+		t.Fatal(err)
+	}
+	wg.Wait()
+	if gotTable.Family != nat.Family || gotTable.Name != nat.Name {
+		t.Fatal("no want table", gotTable.Family, gotTable.Name)
+	}
+	if gotChain.Type != postrouting.Type || gotChain.Name != postrouting.Name ||
+		*gotChain.Hooknum != *postrouting.Hooknum {
+		t.Fatal("no want chain", gotChain.Type, gotChain.Name, gotChain.Hooknum)
+	}
+	if len(gotRule.Exprs) != len(rule.Exprs) {
+		t.Fatal("no want rule")
+	}
+}

nftables_test.go

@@ -6077,6 +6077,198 @@ func TestGetRulesObjref(t *testing.T) {
 	}
 }
 
+func TestAddQuotaObj(t *testing.T) {
+	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
+	defer nftest.CleanupSystemConn(t, newNS)
+	conn.FlushRuleset()
+	defer conn.FlushRuleset()
+
+	table := &nftables.Table{
+		Name:   "quota_demo",
+		Family: nftables.TableFamilyIPv4,
+	}
+	tr := conn.AddTable(table)
+
+	c := &nftables.Chain{
+		Name:  "filter",
+		Table: table,
+	}
+	conn.AddChain(c)
+
+	o := &nftables.QuotaObj{
+		Table:    tr,
+		Name:     "q_test",
+		Bytes:    0x06400000,
+		Consumed: 0,
+		Over:     true,
+	}
+	conn.AddObj(o)
+
+	if err := conn.Flush(); err != nil {
+		t.Errorf("conn.Flush() failed: %v", err)
+	}
+
+	obj, err := conn.GetObj(&nftables.QuotaObj{
+		Table: table,
+		Name:  "q_test",
+	})
+	if err != nil {
+		t.Fatalf("conn.GetObj() failed: %v", err)
+	}
+
+	if got, want := len(obj), 1; got != want {
+		t.Fatalf("unexpected object list length: got %d, want %d", got, want)
+	}
+
+	o1, ok := obj[0].(*nftables.QuotaObj)
+	if !ok {
+		t.Fatalf("unexpected type: got %T, want *QuotaObj", obj[0])
+	}
+	if got, want := o1.Name, o.Name; got != want {
+		t.Fatalf("quota name mismatch: got %s, want %s", got, want)
+	}
+	if got, want := o1.Bytes, o.Bytes; got != want {
+		t.Fatalf("quota bytes mismatch: got %d, want %d", got, want)
+	}
+	if got, want := o1.Consumed, o.Consumed; got != want {
+		t.Fatalf("quota consumed mismatch: got %d, want %d", got, want)
+	}
+	if got, want := o1.Over, o.Over; got != want {
+		t.Fatalf("quota over mismatch: got %v, want %v", got, want)
+	}
+}
+
+func TestAddQuotaObjRef(t *testing.T) {
+	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
+	defer nftest.CleanupSystemConn(t, newNS)
+	conn.FlushRuleset()
+	defer conn.FlushRuleset()
+
+	table := &nftables.Table{
+		Name:   "quota_demo",
+		Family: nftables.TableFamilyIPv4,
+	}
+	tr := conn.AddTable(table)
+
+	c := &nftables.Chain{
+		Name:  "filter",
+		Table: table,
+	}
+	conn.AddChain(c)
+
+	o := &nftables.QuotaObj{
+		Table:    tr,
+		Name:     "q_test",
+		Bytes:    0x06400000,
+		Consumed: 0,
+		Over:     true,
+	}
+	conn.AddObj(o)
+
+	r := &nftables.Rule{
+		Table: table,
+		Chain: c,
+		Exprs: []expr.Any{
+			&expr.Objref{
+				Type: 2,
+				Name: "q_test",
+			},
+		},
+	}
+	conn.AddRule(r)
+	if err := conn.Flush(); err != nil {
+		t.Fatalf("failed to flush: %v", err)
+	}
+
+	rules, err := conn.GetRules(table, c)
+	if err != nil {
+		t.Fatalf("failed to get rules: %v", err)
+	}
+
+	if got, want := len(rules), 1; got != want {
+		t.Fatalf("unexpected number of rules: got %d, want %d", got, want)
+	}
+	if got, want := len(rules[0].Exprs), 1; got != want {
+		t.Fatalf("unexpected number of exprs: got %d, want %d", got, want)
+	}
+
+	objref, ok := rules[0].Exprs[0].(*expr.Objref)
+	if !ok {
+		t.Fatalf("Exprs[0] is type %T, want *expr.Objref", rules[0].Exprs[0])
+	}
+	if want := r.Exprs[0]; !reflect.DeepEqual(objref, want) {
+		t.Errorf("objref expr = %+v, wanted %+v", objref, want)
+	}
+}
+
+func TestDeleteQuotaObj(t *testing.T) {
+	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
+	defer nftest.CleanupSystemConn(t, newNS)
+	conn.FlushRuleset()
+	defer conn.FlushRuleset()
+
+	table := &nftables.Table{
+		Name:   "quota_demo",
+		Family: nftables.TableFamilyIPv4,
+	}
+	tr := conn.AddTable(table)
+
+	c := &nftables.Chain{
+		Name:  "filter",
+		Table: table,
+	}
+	conn.AddChain(c)
+
+	o := &nftables.QuotaObj{
+		Table:    tr,
+		Name:     "q_test",
+		Bytes:    0x06400000,
+		Consumed: 0,
+		Over:     true,
+	}
+	conn.AddObj(o)
+
+	if err := conn.Flush(); err != nil {
+		t.Fatalf("conn.Flush() failed: %v", err)
+	}
+
+	obj, err := conn.GetObj(&nftables.QuotaObj{
+		Table: table,
+		Name:  "q_test",
+	})
+	if err != nil {
+		t.Fatalf("conn.GetObj() failed: %v", err)
+	}
+
+	if got, want := len(obj), 1; got != want {
+		t.Fatalf("unexpected number of objects: got %d, want %d", got, want)
+	}
+
+	if got, want := obj[0], o; !reflect.DeepEqual(got, want) {
+		t.Errorf("got = %+v, want = %+v", got, want)
+	}
+
+	conn.DeleteObject(&nftables.QuotaObj{
+		Table: tr,
+		Name:  "q_test",
+	})
+
+	if err := conn.Flush(); err != nil {
+		t.Fatalf("conn.Flush() failed: %v", err)
+	}
+
+	obj, err = conn.GetObj(&nftables.QuotaObj{
+		Table: table,
+		Name:  "q_test",
+	})
+	if err != nil {
+		t.Fatalf("conn.GetObj() failed: %v", err)
+	}
+	if got, want := len(obj), 0; got != want {
+		t.Fatalf("unexpected object list length: got %d, want %d", got, want)
+	}
+}
+
 func TestGetRulesQueue(t *testing.T) {
 	// Create a new network namespace to test these operations,
 	// and tear down the namespace at test completion.

obj.go

@@ -22,7 +22,10 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-var objHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWOBJ)
+var (
+	newObjHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWOBJ)
+	delObjHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_DELOBJ)
+)
 
 // Obj represents a netfilter stateful object. See also
 // https://wiki.nftables.org/wiki-nftables/index.php/Stateful_objects
@@ -125,8 +128,8 @@ func (cc *Conn) ResetObjects(t *Table) ([]Obj, error) {
 }
 
 func objFromMsg(msg netlink.Message) (Obj, error) {
-	if got, want := msg.Header.Type, objHeaderType; got != want {
+	if got, want1, want2 := msg.Header.Type, newObjHeaderType, delObjHeaderType; got != want1 && got != want2 {
-		return nil, fmt.Errorf("unexpected header type: got %v, want %v", got, want)
+		return nil, fmt.Errorf("unexpected header type: got %v, want %v or %v", got, want1, want2)
 	}
 	ad, err := netlink.NewAttributeDecoder(msg.Data[4:])
 	if err != nil {
@@ -155,6 +158,21 @@ func objFromMsg(msg netlink.Message) (Obj, error) {
 					Name:  name,
 				}
 
+				ad.Do(func(b []byte) error {
+					ad, err := netlink.NewAttributeDecoder(b)
+					if err != nil {
+						return err
+					}
+					ad.ByteOrder = binary.BigEndian
+					return o.unmarshal(ad)
+				})
+				return &o, ad.Err()
+			case NFT_OBJECT_QUOTA:
+				o := QuotaObj{
+					Table: table,
+					Name:  name,
+				}
+
 				ad.Do(func(b []byte) error {
 					ad, err := netlink.NewAttributeDecoder(b)
 					if err != nil {

quota.go

@@ -0,0 +1,80 @@
+// Copyright 2023 Google LLC. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package nftables
+
+import (
+	"github.com/google/nftables/binaryutil"
+	"github.com/mdlayher/netlink"
+	"golang.org/x/sys/unix"
+)
+
+const (
+	NFTA_OBJ_USERDATA = 8
+	NFT_OBJECT_QUOTA  = 2
+)
+
+type QuotaObj struct {
+	Table    *Table
+	Name     string
+	Bytes    uint64
+	Consumed uint64
+	Over     bool
+}
+
+func (q *QuotaObj) unmarshal(ad *netlink.AttributeDecoder) error {
+	for ad.Next() {
+		switch ad.Type() {
+		case unix.NFTA_QUOTA_BYTES:
+			q.Bytes = ad.Uint64()
+		case unix.NFTA_QUOTA_CONSUMED:
+			q.Consumed = ad.Uint64()
+		case unix.NFTA_QUOTA_FLAGS:
+			q.Over = (ad.Uint32() & unix.NFT_QUOTA_F_INV) == 1
+		}
+	}
+	return nil
+}
+
+func (q *QuotaObj) marshal(data bool) ([]byte, error) {
+	flags := uint32(0)
+	if q.Over {
+		flags = unix.NFT_QUOTA_F_INV
+	}
+	obj, err := netlink.MarshalAttributes([]netlink.Attribute{
+		{Type: unix.NFTA_QUOTA_BYTES, Data: binaryutil.BigEndian.PutUint64(q.Bytes)},
+		{Type: unix.NFTA_QUOTA_CONSUMED, Data: binaryutil.BigEndian.PutUint64(q.Consumed)},
+		{Type: unix.NFTA_QUOTA_FLAGS, Data: binaryutil.BigEndian.PutUint32(flags)},
+	})
+	if err != nil {
+		return nil, err
+	}
+	attrs := []netlink.Attribute{
+		{Type: unix.NFTA_OBJ_TABLE, Data: []byte(q.Table.Name + "\x00")},
+		{Type: unix.NFTA_OBJ_NAME, Data: []byte(q.Name + "\x00")},
+		{Type: unix.NFTA_OBJ_TYPE, Data: binaryutil.BigEndian.PutUint32(NFT_OBJECT_QUOTA)},
+	}
+	if data {
+		attrs = append(attrs, netlink.Attribute{Type: unix.NLA_F_NESTED | unix.NFTA_OBJ_DATA, Data: obj})
+	}
+	return netlink.MarshalAttributes(attrs)
+}
+
+func (q *QuotaObj) table() *Table {
+	return q.Table
+}
+
+func (q *QuotaObj) family() TableFamily {
+	return q.Table.Family
+}

rule.go

@@ -25,7 +25,10 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-var ruleHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWRULE)
+var (
+	newRuleHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWRULE)
+	delRuleHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_DELRULE)
+)
 
 type ruleOperation uint32
 
@@ -168,7 +171,7 @@ func (cc *Conn) newRule(r *Rule, op ruleOperation) *Rule {
 
 	cc.messages = append(cc.messages, netlink.Message{
 		Header: netlink.Header{
-			Type:  ruleHeaderType,
+			Type:  newRuleHeaderType,
 			Flags: flags,
 		},
 		Data: append(extraHeader(uint8(r.Table.Family), 0), msgData...),
@@ -215,7 +218,7 @@ func (cc *Conn) DelRule(r *Rule) error {
 
 	cc.messages = append(cc.messages, netlink.Message{
 		Header: netlink.Header{
-			Type:  netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_DELRULE),
+			Type:  delRuleHeaderType,
 			Flags: flags,
 		},
 		Data: append(extraHeader(uint8(r.Table.Family), 0), data...),
@@ -225,8 +228,8 @@ func (cc *Conn) DelRule(r *Rule) error {
 }
 
 func ruleFromMsg(fam TableFamily, msg netlink.Message) (*Rule, error) {
-	if got, want := msg.Header.Type, ruleHeaderType; got != want {
+	if got, want1, want2 := msg.Header.Type, newRuleHeaderType, delRuleHeaderType; got != want1 && got != want2 {
-		return nil, fmt.Errorf("unexpected header type: got %v, want %v", got, want)
+		return nil, fmt.Errorf("unexpected header type: got %v, want %v or %v", msg.Header.Type, want1, want2)
 	}
 	ad, err := netlink.NewAttributeDecoder(msg.Data[4:])
 	if err != nil {

set.go

@@ -684,11 +684,14 @@ func (cc *Conn) FlushSet(s *Set) {
 	})
 }
 
-var setHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWSET)
+var (
+	newSetHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWSET)
+	delSetHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_DELSET)
+)
 
 func setsFromMsg(msg netlink.Message) (*Set, error) {
-	if got, want := msg.Header.Type, setHeaderType; got != want {
+	if got, want1, want2 := msg.Header.Type, newSetHeaderType, delSetHeaderType; got != want1 && got != want2 {
-		return nil, fmt.Errorf("unexpected header type: got %v, want %v", got, want)
+		return nil, fmt.Errorf("unexpected header type: got %v, want %v or %v", got, want1, want2)
 	}
 	ad, err := netlink.NewAttributeDecoder(msg.Data[4:])
 	if err != nil {
@@ -762,11 +765,14 @@ func parseSetDatatype(magic uint32) (SetDatatype, error) {
 	return dt, nil
 }
 
-var elemHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWSETELEM)
+var (
+	newElemHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWSETELEM)
+	delElemHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_DELSETELEM)
+)
 
 func elementsFromMsg(fam byte, msg netlink.Message) ([]SetElement, error) {
-	if got, want := msg.Header.Type, elemHeaderType; got != want {
+	if got, want1, want2 := msg.Header.Type, newElemHeaderType, delElemHeaderType; got != want1 && got != want2 {
-		return nil, fmt.Errorf("unexpected header type: got %v, want %v", got, want)
+		return nil, fmt.Errorf("unexpected header type: got %v, want %v or %v", got, want1, want2)
 	}
 	ad, err := netlink.NewAttributeDecoder(msg.Data[4:])
 	if err != nil {

table.go

@@ -21,7 +21,10 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-var tableHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWTABLE)
+var (
+	newTableHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWTABLE)
+	delTableHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_DELTABLE)
+)
 
 // TableFamily specifies the address family for this table.
 type TableFamily byte
@@ -150,8 +153,8 @@ func (cc *Conn) ListTablesOfFamily(family TableFamily) ([]*Table, error) {
 }
 
 func tableFromMsg(msg netlink.Message) (*Table, error) {
-	if got, want := msg.Header.Type, tableHeaderType; got != want {
+	if got, want1, want2 := msg.Header.Type, newTableHeaderType, delTableHeaderType; got != want1 && got != want2 {
-		return nil, fmt.Errorf("unexpected header type: got %v, want %v", got, want)
+		return nil, fmt.Errorf("unexpected header type: got %v, want %v or %v", got, want1, want2)
 	}
 
 	var t Table

util.go

@@ -15,6 +15,8 @@
 package nftables
 
 import (
+	"encoding/binary"
+
 	"github.com/google/nftables/binaryutil"
 	"golang.org/x/sys/unix"
 )
@@ -25,3 +27,20 @@ func extraHeader(family uint8, resID uint16) []byte {
 		unix.NFNETLINK_V0,
 	}, binaryutil.BigEndian.PutUint16(resID)...)
 }
+
+// General form of address family dependent message, see
+// https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nfnetlink.h#29
+type NFGenMsg struct {
+	NFGenFamily uint8
+	Version     uint8
+	ResourceID  uint16
+}
+
+func (genmsg *NFGenMsg) Decode(b []byte) {
+	if len(b) < 16 {
+		return
+	}
+	genmsg.NFGenFamily = b[0]
+	genmsg.Version = b[1]
+	genmsg.ResourceID = binary.BigEndian.Uint16(b[2:])
+}