Merge dae73eaa9c into adb98462ee

Before this commit: the printing of a rule results in
a pointer address.

After this commit: the printing of a rules results in
a human-readable text.

Resolves: #104

Signed-off-by: Paul Greenberg <greenpau@outlook.com>

.gitignore

@@ -0,0 +1 @@
+nftables.test

README.md

@@ -21,4 +21,12 @@ the data types/API will be identified as more functionality is added.
 
 Contributions are very welcome!
 
+### Testing Changes
 
+Run the following commands to test your changes:
+
+```bash
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests
+```

expr/expr.go

@@ -199,6 +199,8 @@ func exprFromName(name string) Any {
 		e = &Hash{}
 	case "cthelper":
 		e = &CtHelper{}
+	case "synproxy":
+		e = &SynProxy{}
 	}
 	return e
 }

expr/synproxy.go

@@ -0,0 +1,118 @@
+// Copyright 2024 Google LLC. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package expr
+
+import (
+	"encoding/binary"
+
+	"github.com/google/nftables/binaryutil"
+	"github.com/mdlayher/netlink"
+	"golang.org/x/sys/unix"
+)
+
+type SynProxy struct {
+	Mss       uint16
+	Wscale    uint8
+	Timestamp bool
+	SackPerm  bool
+	// Probably not expected to be set by users
+	// https://github.com/torvalds/linux/blob/521b1e7f4cf0b05a47995b103596978224b380a8/net/netfilter/nft_synproxy.c#L30-L31
+	Ecn bool
+	// True when Mss is set to a value or if 0 is an intended value of Mss
+	MssValueSet bool
+	// True when Wscale is set to a value or if 0 is an intended value of Wscale
+	WscaleValueSet bool
+}
+
+// From https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=be0bae0ad31b0adb506f96de083f52a2bd0d4fbf#n1723
+// Currently not available in golang.org/x/sys/unix
+const (
+	NFTA_SYNPROXY_MSS    = 0x01
+	NFTA_SYNPROXY_WSCALE = 0x02
+	NFTA_SYNPROXY_FLAGS  = 0x03
+)
+
+// From https://github.com/torvalds/linux/blob/521b1e7f4cf0b05a47995b103596978224b380a8/include/uapi/linux/netfilter/nf_synproxy.h#L7-L15
+// Currently not available in golang.org/x/sys/unix
+const (
+	NF_SYNPROXY_OPT_MSS       = 0x01
+	NF_SYNPROXY_OPT_WSCALE    = 0x02
+	NF_SYNPROXY_OPT_SACK_PERM = 0x04
+	NF_SYNPROXY_OPT_TIMESTAMP = 0x08
+	NF_SYNPROXY_OPT_ECN       = 0x10
+)
+
+func (e *SynProxy) marshal(fam byte) ([]byte, error) {
+	data, err := e.marshalData(fam)
+	if err != nil {
+		return nil, err
+	}
+	return netlink.MarshalAttributes([]netlink.Attribute{
+		{Type: unix.NFTA_EXPR_NAME, Data: []byte("synproxy\x00")},
+		{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
+	})
+}
+
+func (e *SynProxy) marshalData(fam byte) ([]byte, error) {
+	var flags uint32
+	if e.Mss != 0 || e.MssValueSet {
+		flags |= NF_SYNPROXY_OPT_MSS
+	}
+	if e.Wscale != 0 || e.WscaleValueSet {
+		flags |= NF_SYNPROXY_OPT_WSCALE
+	}
+	if e.SackPerm {
+		flags |= NF_SYNPROXY_OPT_SACK_PERM
+	}
+	if e.Timestamp {
+		flags |= NF_SYNPROXY_OPT_TIMESTAMP
+	}
+	if e.Ecn {
+		flags |= NF_SYNPROXY_OPT_ECN
+	}
+	attrs := []netlink.Attribute{
+		{Type: NFTA_SYNPROXY_MSS, Data: binaryutil.BigEndian.PutUint16(e.Mss)},
+		{Type: NFTA_SYNPROXY_WSCALE, Data: []byte{e.Wscale}},
+		{Type: NFTA_SYNPROXY_FLAGS, Data: binaryutil.BigEndian.PutUint32(flags)},
+	}
+	return netlink.MarshalAttributes(attrs)
+}
+
+func (e *SynProxy) unmarshal(fam byte, data []byte) error {
+	ad, err := netlink.NewAttributeDecoder(data)
+	if err != nil {
+		return err
+	}
+	ad.ByteOrder = binary.BigEndian
+	for ad.Next() {
+		switch ad.Type() {
+		case NFTA_SYNPROXY_MSS:
+			e.Mss = ad.Uint16()
+		case NFTA_SYNPROXY_WSCALE:
+			e.Wscale = ad.Uint8()
+		case NFTA_SYNPROXY_FLAGS:
+			flags := ad.Uint32()
+			checkFlag := func(flag uint32) bool {
+				return (flags & flag) == flag
+			}
+			e.MssValueSet = checkFlag(NF_SYNPROXY_OPT_MSS)
+			e.WscaleValueSet = checkFlag(NF_SYNPROXY_OPT_WSCALE)
+			e.SackPerm = checkFlag(NF_SYNPROXY_OPT_SACK_PERM)
+			e.Timestamp = checkFlag(NF_SYNPROXY_OPT_TIMESTAMP)
+			e.Ecn = checkFlag(NF_SYNPROXY_OPT_ECN)
+		}
+	}
+	return ad.Err()
+}

expr/verdict.go

@@ -24,6 +24,15 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+const (
+	NFT_DROP   = 0
+	NFT_ACCEPT = 1
+	NFT_STOLEN = 2
+	NFT_QUEUE  = 3
+	NFT_REPEAT = 4
+	NFT_STOP   = 5
+)
+
 // This code assembles the verdict structure, as expected by the
 // nftables netlink API.
 // For further information, consult:
@@ -129,3 +138,37 @@ func (e *Verdict) unmarshal(fam byte, data []byte) error {
 	}
 	return ad.Err()
 }
+
+func (e *Verdict) String() string {
+	var v string
+	switch e.Kind {
+	case unix.NFT_RETURN:
+		v = "return" // -0x5
+	case unix.NFT_GOTO:
+		v = "goto" // -0x4
+	case unix.NFT_JUMP:
+		v = "jump" // NFT_JUMP = -0x3
+	case unix.NFT_BREAK:
+		v = "break" // NFT_BREAK = -0x2
+	case unix.NFT_CONTINUE:
+		v = "continue" // NFT_CONTINUE = -0x1
+	case NFT_DROP:
+		v = "drop"
+	case NFT_ACCEPT:
+		v = "accept"
+	case NFT_STOLEN:
+		v = "stolen"
+	case NFT_QUEUE:
+		v = "queue"
+	case NFT_REPEAT:
+		v = "repeat"
+	case NFT_STOP:
+		v = "stop"
+	default:
+		v = fmt.Sprintf("verdict %v", e.Kind)
+	}
+	if e.Chain != "" {
+		return v + " " + e.Chain
+	}
+	return v
+}

nftables_test.go

@@ -221,12 +221,27 @@ func TestRuleOperations(t *testing.T) {
 		expr.VerdictDrop,
 	}
 
+	wantStrings := []string{
+		"queue",
+		"accept",
+		"queue",
+		"accept",
+		"drop",
+		"drop",
+	}
+
 	for i, r := range rules {
 		rr, _ := r.Exprs[0].(*expr.Verdict)
 
 		if rr.Kind != want[i] {
 			t.Fatalf("bad verdict kind at %d", i)
 		}
+
+		if rr.String() != wantStrings[i] {
+			t.Fatalf("bad verdict string at %d: %s (received) vs. %s (expected)", i, rr.String(), wantStrings[i])
+		}
+
+		t.Logf("%s", rr)
 	}
 }
 
@@ -1383,6 +1398,104 @@ func TestCt(t *testing.T) {
 	}
 }
 
+func TestSynProxyObject(t *testing.T) {
+	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
+	defer nftest.CleanupSystemConn(t, newNS)
+	conn.FlushRuleset()
+	defer conn.FlushRuleset()
+
+	table := conn.AddTable(&nftables.Table{
+		Family: nftables.TableFamilyINet,
+		Name:   "filter",
+	})
+
+	syn1 := &nftables.NamedObj{
+		Table: table,
+		Name:  "https-synproxy",
+		Type:  nftables.ObjTypeSynProxy,
+		Obj: &expr.SynProxy{
+			Mss:       1,
+			Wscale:    2,
+			Timestamp: true,
+			SackPerm:  true,
+			// set for equals test below
+			MssValueSet:    true,
+			WscaleValueSet: true,
+		},
+	}
+	syn2 := &nftables.NamedObj{
+		Table: table,
+		Name:  "https-synproxy-empty",
+		Type:  nftables.ObjTypeSynProxy,
+		Obj:   &expr.SynProxy{},
+	}
+	syn3 := &nftables.NamedObj{
+		Table: table,
+		Name:  "https-synproxy-zero",
+		Type:  nftables.ObjTypeSynProxy,
+		Obj: &expr.SynProxy{
+			Mss:            0,
+			Wscale:         0,
+			MssValueSet:    true,
+			WscaleValueSet: true,
+		},
+	}
+	conn.AddObj(syn1)
+	conn.AddObj(syn2)
+	conn.AddObj(syn3)
+
+	if err := conn.Flush(); err != nil {
+		t.Fatalf(err.Error())
+	}
+
+	objs, err := conn.GetNamedObjects(table)
+	if err != nil {
+		t.Errorf("c.GetObjects(table) failed: %v", err)
+	}
+
+	if got, want := len(objs), 3; got != want {
+		t.Fatalf("received %d objects, expected %d", got, want)
+	}
+
+	synObjs := []*nftables.NamedObj{syn1, syn2, syn3}
+	for i := 0; i < len(objs); i++ {
+		obj := objs[i].(*nftables.NamedObj)
+		syn := synObjs[i]
+		if got, want := obj.Name, syn.Name; got != want {
+			t.Errorf("object %d names are not equal: got %s, want %s", i, got, want)
+		}
+		if got, want := obj.Type, syn.Type; got != want {
+			t.Errorf("object %d types are not equal: got %v, want %v", i, got, want)
+		}
+		if got, want := obj.Table.Name, syn.Table.Name; got != want {
+			t.Errorf("object %d tables are not equal: got %s, want %s", i, got, want)
+		}
+		sp1 := obj.Obj.(*expr.SynProxy)
+		sp2 := syn.Obj.(*expr.SynProxy)
+		if got, want := sp1.Mss, sp2.Mss; got != want {
+			t.Errorf("object %d mss' are not equal: got %d, want %d", i, got, want)
+		}
+		if got, want := sp1.Wscale, sp2.Wscale; got != want {
+			t.Errorf("object %d wscales are not equal: got %d, want %d", i, got, want)
+		}
+		if got, want := sp1.Timestamp, sp2.Timestamp; got != want {
+			t.Errorf("object %d timestamp flags are not equal: got %v, want %v", i, got, want)
+		}
+		if got, want := sp1.SackPerm, sp2.SackPerm; got != want {
+			t.Errorf("object %d sack-perm flags are not equal: got %v, want %v", i, got, want)
+		}
+		if got, want := sp1.MssValueSet, sp2.MssValueSet; got != want {
+			t.Errorf("object %d MssValueSet flags are not equal: got %v, want %v", i, got, want)
+		}
+		if got, want := sp1.WscaleValueSet, sp2.WscaleValueSet; got != want {
+			t.Errorf("object %d WscaleValueSet flags are not equal: got %v, want %v", i, got, want)
+		}
+		if got, want := sp1.Ecn, sp2.Ecn; got != want {
+			t.Errorf("object %d Ecn flags are not equal: got %v, want %v", i, got, want)
+		}
+	}
+}
+
 func TestCtHelper(t *testing.T) {
 	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
 	defer nftest.CleanupSystemConn(t, newNS)

nftables_test.sh

@@ -0,0 +1,3 @@
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests