Merge dae73eaa9c into 0b98a7af91

Replace some hardcoded consts by the ones provided in
golang.org/x/sys/unix

.gitignore

@@ -0,0 +1 @@
+nftables.test

README.md

@@ -21,4 +21,12 @@ the data types/API will be identified as more functionality is added.
 
 Contributions are very welcome!
 
+### Testing Changes
 
+Run the following commands to test your changes:
+
+```bash
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests
+```

counter.go

@@ -57,11 +57,10 @@ func (c *CounterObj) marshal(data bool) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	const NFT_OBJECT_COUNTER = 1 // TODO: get into x/sys/unix
 	attrs := []netlink.Attribute{
 		{Type: unix.NFTA_OBJ_TABLE, Data: []byte(c.Table.Name + "\x00")},
 		{Type: unix.NFTA_OBJ_NAME, Data: []byte(c.Name + "\x00")},
-		{Type: unix.NFTA_OBJ_TYPE, Data: binaryutil.BigEndian.PutUint32(NFT_OBJECT_COUNTER)},
+		{Type: unix.NFTA_OBJ_TYPE, Data: binaryutil.BigEndian.PutUint32(unix.NFT_OBJECT_COUNTER)},
 	}
 	if data {
 		attrs = append(attrs, netlink.Attribute{Type: unix.NLA_F_NESTED | unix.NFTA_OBJ_DATA, Data: obj})

expr/expr.go

@@ -279,16 +279,15 @@ type Masq struct {
 	RegProtoMax uint32
 }
 
-// TODO, Once the constants below are available in golang.org/x/sys/unix, switch to use those.
 const (
 	// NF_NAT_RANGE_PROTO_RANDOM defines flag for a random masquerade
-	NF_NAT_RANGE_PROTO_RANDOM = 0x4
+	NF_NAT_RANGE_PROTO_RANDOM = unix.NF_NAT_RANGE_PROTO_RANDOM
 	// NF_NAT_RANGE_PROTO_RANDOM_FULLY defines flag for a fully random masquerade
-	NF_NAT_RANGE_PROTO_RANDOM_FULLY = 0x10
+	NF_NAT_RANGE_PROTO_RANDOM_FULLY = unix.NF_NAT_RANGE_PROTO_RANDOM_FULLY
 	// NF_NAT_RANGE_PERSISTENT defines flag for a persistent masquerade
-	NF_NAT_RANGE_PERSISTENT = 0x8
+	NF_NAT_RANGE_PERSISTENT = unix.NF_NAT_RANGE_PERSISTENT
 	// NF_NAT_RANGE_PREFIX defines flag for a prefix masquerade
-	NF_NAT_RANGE_PREFIX = 0x40
+	NF_NAT_RANGE_PREFIX = unix.NF_NAT_RANGE_NETMAP
 )
 
 func (e *Masq) marshal(fam byte) ([]byte, error) {

expr/queue.go

@@ -32,10 +32,9 @@ const (
 	QueueTotal QueueAttribute = unix.NFTA_QUEUE_TOTAL
 	QueueFlags QueueAttribute = unix.NFTA_QUEUE_FLAGS
 
-	// TODO: get into x/sys/unix
-	QueueFlagBypass QueueFlag = 0x01
-	QueueFlagFanout QueueFlag = 0x02
-	QueueFlagMask   QueueFlag = 0x03
+	QueueFlagBypass QueueFlag = unix.NFT_QUEUE_FLAG_BYPASS
+	QueueFlagFanout QueueFlag = unix.NFT_QUEUE_FLAG_CPU_FANOUT
+	QueueFlagMask   QueueFlag = unix.NFT_QUEUE_FLAG_MASK
 )
 
 type Queue struct {

expr/verdict.go

@@ -24,6 +24,15 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+const (
+	NFT_DROP   = 0
+	NFT_ACCEPT = 1
+	NFT_STOLEN = 2
+	NFT_QUEUE  = 3
+	NFT_REPEAT = 4
+	NFT_STOP   = 5
+)
+
 // This code assembles the verdict structure, as expected by the
 // nftables netlink API.
 // For further information, consult:
@@ -126,3 +135,37 @@ func (e *Verdict) unmarshal(fam byte, data []byte) error {
 	}
 	return ad.Err()
 }
+
+func (e *Verdict) String() string {
+	var v string
+	switch e.Kind {
+	case unix.NFT_RETURN:
+		v = "return" // -0x5
+	case unix.NFT_GOTO:
+		v = "goto" // -0x4
+	case unix.NFT_JUMP:
+		v = "jump" // NFT_JUMP = -0x3
+	case unix.NFT_BREAK:
+		v = "break" // NFT_BREAK = -0x2
+	case unix.NFT_CONTINUE:
+		v = "continue" // NFT_CONTINUE = -0x1
+	case NFT_DROP:
+		v = "drop"
+	case NFT_ACCEPT:
+		v = "accept"
+	case NFT_STOLEN:
+		v = "stolen"
+	case NFT_QUEUE:
+		v = "queue"
+	case NFT_REPEAT:
+		v = "repeat"
+	case NFT_STOP:
+		v = "stop"
+	default:
+		v = fmt.Sprintf("verdict %v", e.Kind)
+	}
+	if e.Chain != "" {
+		return v + " " + e.Chain
+	}
+	return v
+}

nftables_test.go

@@ -221,12 +221,27 @@ func TestRuleOperations(t *testing.T) {
 		expr.VerdictDrop,
 	}
 
+	wantStrings := []string{
+		"queue",
+		"accept",
+		"queue",
+		"accept",
+		"drop",
+		"drop",
+	}
+
 	for i, r := range rules {
 		rr, _ := r.Exprs[0].(*expr.Verdict)
 
 		if rr.Kind != want[i] {
 			t.Fatalf("bad verdict kind at %d", i)
 		}
+
+		if rr.String() != wantStrings[i] {
+			t.Fatalf("bad verdict string at %d: %s (received) vs. %s (expected)", i, rr.String(), wantStrings[i])
+		}
+
+		t.Logf("%s", rr)
 	}
 }
 

nftables_test.sh

@@ -0,0 +1,3 @@
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests

obj.go

@@ -141,7 +141,6 @@ func objFromMsg(msg netlink.Message) (Obj, error) {
 		name       string
 		objectType uint32
 	)
-	const NFT_OBJECT_COUNTER = 1 // TODO: get into x/sys/unix
 	for ad.Next() {
 		switch ad.Type() {
 		case unix.NFTA_OBJ_TABLE:
@@ -152,7 +151,7 @@ func objFromMsg(msg netlink.Message) (Obj, error) {
 			objectType = ad.Uint32()
 		case unix.NFTA_OBJ_DATA:
 			switch objectType {
-			case NFT_OBJECT_COUNTER:
+			case unix.NFT_OBJECT_COUNTER:
 				o := CounterObj{
 					Table: table,
 					Name:  name,