Merge dae73eaa9c into 5cbea79940

Before this commit: the printing of a rule results in
a pointer address.

After this commit: the printing of a rules results in
a human-readable text.

Resolves: #104

Signed-off-by: Paul Greenberg <greenpau@outlook.com>

.gitignore

@@ -0,0 +1 @@
+nftables.test

README.md

@@ -21,4 +21,12 @@ the data types/API will be identified as more functionality is added.
 
 Contributions are very welcome!
 
+### Testing Changes
 
+Run the following commands to test your changes:
+
+```bash
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests
+```

expr/ct.go

@@ -56,6 +56,58 @@ const (
 	CtStateBitUNTRACKED   uint32 = 64
 )
 
+// Missing ct timeout consts
+// https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=be0bae0ad31b0adb506f96de083f52a2bd0d4fbf#n1592
+const (
+	NFTA_CT_TIMEOUT_L3PROTO = 0x01
+	NFTA_CT_TIMEOUT_L4PROTO = 0x02
+	NFTA_CT_TIMEOUT_DATA    = 0x03
+)
+
+type CtStatePolicyTimeout map[uint16]uint32
+
+const (
+	// https://git.netfilter.org/libnftnl/tree/src/obj/ct_timeout.c?id=116e95aa7b6358c917de8c69f6f173874030b46b#n24
+	CtStateTCPSYNSENT = iota
+	CtStateTCPSYNRECV
+	CtStateTCPESTABLISHED
+	CtStateTCPFINWAIT
+	CtStateTCPCLOSEWAIT
+	CtStateTCPLASTACK
+	CtStateTCPTIMEWAIT
+	CtStateTCPCLOSE
+	CtStateTCPSYNSENT2
+	CtStateTCPRETRANS
+	CtStateTCPUNACK
+)
+
+// https://git.netfilter.org/libnftnl/tree/src/obj/ct_timeout.c?id=116e95aa7b6358c917de8c69f6f173874030b46b#n38
+var CtStateTCPTimeoutDefaults CtStatePolicyTimeout = map[uint16]uint32{
+	CtStateTCPSYNSENT:     120,
+	CtStateTCPSYNRECV:     60,
+	CtStateTCPESTABLISHED: 43200,
+	CtStateTCPFINWAIT:     120,
+	CtStateTCPCLOSEWAIT:   60,
+	CtStateTCPLASTACK:     30,
+	CtStateTCPTIMEWAIT:    120,
+	CtStateTCPCLOSE:       10,
+	CtStateTCPSYNSENT2:    120,
+	CtStateTCPRETRANS:     300,
+	CtStateTCPUNACK:       300,
+}
+
+const (
+	// https://git.netfilter.org/libnftnl/tree/src/obj/ct_timeout.c?id=116e95aa7b6358c917de8c69f6f173874030b46b#n57
+	CtStateUDPUNREPLIED = iota
+	CtStateUDPREPLIED
+)
+
+// https://git.netfilter.org/libnftnl/tree/src/obj/ct_timeout.c?id=116e95aa7b6358c917de8c69f6f173874030b46b#n57
+var CtStateUDPTimeoutDefaults CtStatePolicyTimeout = map[uint16]uint32{
+	CtStateUDPUNREPLIED: 30,
+	CtStateUDPREPLIED:   180,
+}
+
 // Ct defines type for NFT connection tracking
 type Ct struct {
 	Register       uint32
@@ -265,3 +317,84 @@ func (c *CtExpect) unmarshal(fam byte, data []byte) error {
 	}
 	return ad.Err()
 }
+
+type CtTimeout struct {
+	L3Proto uint16
+	L4Proto uint8
+	Policy  CtStatePolicyTimeout
+}
+
+func (c *CtTimeout) marshal(fam byte) ([]byte, error) {
+	exprData, err := c.marshalData(fam)
+	if err != nil {
+		return nil, err
+	}
+
+	return netlink.MarshalAttributes([]netlink.Attribute{
+		{Type: unix.NFTA_EXPR_NAME, Data: []byte("cttimeout\x00")},
+		{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
+	})
+}
+
+func (c *CtTimeout) marshalData(fam byte) ([]byte, error) {
+	var policy CtStatePolicyTimeout
+	switch c.L4Proto {
+	case unix.IPPROTO_UDP:
+		policy = CtStateUDPTimeoutDefaults
+	default:
+		policy = CtStateTCPTimeoutDefaults
+	}
+
+	for k, v := range c.Policy {
+		policy[k] = v
+	}
+
+	var policyAttrs []netlink.Attribute
+	for k, v := range policy {
+		policyAttrs = append(policyAttrs, netlink.Attribute{Type: k + 1, Data: binaryutil.BigEndian.PutUint32(v)})
+	}
+	policyData, err := netlink.MarshalAttributes(policyAttrs)
+	if err != nil {
+		return nil, err
+	}
+
+	exprData := []netlink.Attribute{
+		{Type: NFTA_CT_TIMEOUT_L3PROTO, Data: binaryutil.BigEndian.PutUint16(c.L3Proto)},
+		{Type: NFTA_CT_TIMEOUT_L4PROTO, Data: []byte{c.L4Proto}},
+		{Type: unix.NLA_F_NESTED | NFTA_CT_TIMEOUT_DATA, Data: policyData},
+	}
+
+	return netlink.MarshalAttributes(exprData)
+}
+
+func (c *CtTimeout) unmarshal(fam byte, data []byte) error {
+	ad, err := netlink.NewAttributeDecoder(data)
+	if err != nil {
+		return err
+	}
+	ad.ByteOrder = binary.BigEndian
+	for ad.Next() {
+		switch ad.Type() {
+		case NFTA_CT_TIMEOUT_L3PROTO:
+			c.L3Proto = ad.Uint16()
+		case NFTA_CT_TIMEOUT_L4PROTO:
+			c.L4Proto = ad.Uint8()
+		case NFTA_CT_TIMEOUT_DATA:
+			decoder, err := netlink.NewAttributeDecoder(ad.Bytes())
+			decoder.ByteOrder = binary.BigEndian
+			if err != nil {
+				return err
+			}
+			for decoder.Next() {
+				switch c.L4Proto {
+				case unix.IPPROTO_UDP:
+					c.Policy = CtStateUDPTimeoutDefaults
+				default:
+					c.Policy = CtStateTCPTimeoutDefaults
+				}
+				c.Policy[decoder.Type()-1] = decoder.Uint32()
+			}
+		}
+	}
+	return ad.Err()
+}

expr/expr.go

@@ -205,6 +205,8 @@ func exprFromName(name string) Any {
 		e = &CtExpect{}
 	case "secmark":
 		e = &SecMark{}
+	case "cttimeout":
+		e = &CtTimeout{}
 	}
 	return e
 }

expr/verdict.go

@@ -24,6 +24,15 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+const (
+	NFT_DROP   = 0
+	NFT_ACCEPT = 1
+	NFT_STOLEN = 2
+	NFT_QUEUE  = 3
+	NFT_REPEAT = 4
+	NFT_STOP   = 5
+)
+
 // This code assembles the verdict structure, as expected by the
 // nftables netlink API.
 // For further information, consult:
@@ -129,3 +138,37 @@ func (e *Verdict) unmarshal(fam byte, data []byte) error {
 	}
 	return ad.Err()
 }
+
+func (e *Verdict) String() string {
+	var v string
+	switch e.Kind {
+	case unix.NFT_RETURN:
+		v = "return" // -0x5
+	case unix.NFT_GOTO:
+		v = "goto" // -0x4
+	case unix.NFT_JUMP:
+		v = "jump" // NFT_JUMP = -0x3
+	case unix.NFT_BREAK:
+		v = "break" // NFT_BREAK = -0x2
+	case unix.NFT_CONTINUE:
+		v = "continue" // NFT_CONTINUE = -0x1
+	case NFT_DROP:
+		v = "drop"
+	case NFT_ACCEPT:
+		v = "accept"
+	case NFT_STOLEN:
+		v = "stolen"
+	case NFT_QUEUE:
+		v = "queue"
+	case NFT_REPEAT:
+		v = "repeat"
+	case NFT_STOP:
+		v = "stop"
+	default:
+		v = fmt.Sprintf("verdict %v", e.Kind)
+	}
+	if e.Chain != "" {
+		return v + " " + e.Chain
+	}
+	return v
+}

nftables_test.go

@@ -221,12 +221,27 @@ func TestRuleOperations(t *testing.T) {
 		expr.VerdictDrop,
 	}
 
+	wantStrings := []string{
+		"queue",
+		"accept",
+		"queue",
+		"accept",
+		"drop",
+		"drop",
+	}
+
 	for i, r := range rules {
 		rr, _ := r.Exprs[0].(*expr.Verdict)
 
 		if rr.Kind != want[i] {
 			t.Fatalf("bad verdict kind at %d", i)
 		}
+
+		if rr.String() != wantStrings[i] {
+			t.Fatalf("bad verdict string at %d: %s (received) vs. %s (expected)", i, rr.String(), wantStrings[i])
+		}
+
+		t.Logf("%s", rr)
 	}
 }
 
@@ -1541,6 +1556,131 @@ func TestSynProxyObject(t *testing.T) {
 	}
 }
 
+func TestCtTimeout(t *testing.T) {
+	t.Parallel()
+	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
+	defer nftest.CleanupSystemConn(t, newNS)
+	conn.FlushRuleset()
+	defer conn.FlushRuleset()
+
+	table := conn.AddTable(&nftables.Table{
+		Family: nftables.TableFamilyIPv4,
+		Name:   "filter",
+	})
+
+	tests := [...]struct {
+		Name   string
+		Input  expr.CtTimeout
+		Expect expr.CtTimeout
+	}{
+		{
+			Name:  "timeout-blank-tcp-policy",
+			Input: expr.CtTimeout{L4Proto: unix.IPPROTO_TCP},
+			Expect: expr.CtTimeout{
+				L4Proto: unix.IPPROTO_TCP,
+				L3Proto: unix.NFPROTO_UNSPEC,
+				Policy:  expr.CtStateTCPTimeoutDefaults,
+			},
+		},
+		{
+			Name:  "timeout-blank-udp-policy",
+			Input: expr.CtTimeout{L4Proto: unix.IPPROTO_UDP},
+			Expect: expr.CtTimeout{
+				L4Proto: unix.IPPROTO_UDP,
+				L3Proto: unix.NFPROTO_UNSPEC,
+				Policy:  expr.CtStateUDPTimeoutDefaults,
+			},
+		},
+		{
+			Name: "timeout-partial-tcp-policy",
+			Input: expr.CtTimeout{
+				L4Proto: unix.IPPROTO_TCP,
+				L3Proto: unix.NFPROTO_IPV4,
+				Policy: expr.CtStatePolicyTimeout{
+					expr.CtStateTCPSYNSENT:     100,
+					expr.CtStateTCPESTABLISHED: 5,
+					expr.CtStateTCPCLOSEWAIT:   9,
+				},
+			},
+			Expect: expr.CtTimeout{
+				L4Proto: unix.IPPROTO_TCP,
+				L3Proto: unix.NFPROTO_IPV4,
+				Policy: expr.CtStatePolicyTimeout{
+					expr.CtStateTCPSYNSENT:     100,
+					expr.CtStateTCPSYNRECV:     60,
+					expr.CtStateTCPESTABLISHED: 5,
+					expr.CtStateTCPFINWAIT:     120,
+					expr.CtStateTCPCLOSEWAIT:   9,
+					expr.CtStateTCPLASTACK:     30,
+					expr.CtStateTCPTIMEWAIT:    120,
+					expr.CtStateTCPCLOSE:       10,
+					expr.CtStateTCPSYNSENT2:    120,
+					expr.CtStateTCPRETRANS:     300,
+					expr.CtStateTCPUNACK:       300,
+				},
+			},
+		},
+		{
+			Name: "timeout-complete-udp-policy",
+			Input: expr.CtTimeout{
+				L4Proto: unix.IPPROTO_UDP,
+				L3Proto: unix.NFPROTO_IPV6,
+				Policy: expr.CtStatePolicyTimeout{
+					expr.CtStateUDPUNREPLIED: 500,
+					expr.CtStateUDPREPLIED:   10000,
+				},
+			},
+			Expect: expr.CtTimeout{
+				L4Proto: unix.IPPROTO_UDP,
+				L3Proto: unix.NFPROTO_IPV6,
+				Policy: expr.CtStatePolicyTimeout{
+					expr.CtStateUDPUNREPLIED: 500,
+					expr.CtStateUDPREPLIED:   10000,
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.Name, func(t *testing.T) {
+			ctt1 := conn.AddObj(&nftables.NamedObj{
+				Table: table,
+				Name:  tt.Name,
+				Type:  nftables.ObjTypeCtTimeout,
+				Obj:   &tt.Input,
+			})
+
+			if err := conn.Flush(); err != nil {
+				t.Fatalf(err.Error())
+			}
+
+			obj, err := conn.GetObject(ctt1)
+			if err != nil {
+				t.Errorf("c.GetObject(ctt1) failed: %v failed", err)
+			}
+
+			ctt2, ok := obj.(*nftables.NamedObj)
+			if !ok {
+				t.Fatalf("unexpected type: got %T, want *nftables.NamedObj", ctt2)
+			}
+
+			o1 := ctt2.Obj.(*expr.CtTimeout)
+			o2 := &tt.Expect
+			if got, want := o1.L3Proto, o2.L3Proto; got != want {
+				t.Fatalf("unexpected l3proto: got %d, want %d", got, want)
+			}
+
+			if got, want := o1.L4Proto, o2.L4Proto; got != want {
+				t.Fatalf("unexpected l4proto: got %d, want %d", got, want)
+			}
+
+			if got, want := o1.Policy, o2.Policy; !reflect.DeepEqual(got, want) {
+				t.Fatalf("unexpected policy: got %v, want %v", got, want)
+			}
+		})
+	}
+}
+
 func TestCtExpect(t *testing.T) {
 	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
 	defer nftest.CleanupSystemConn(t, newNS)
@@ -1642,7 +1782,7 @@ func TestCtHelper(t *testing.T) {
 
 	helper, ok := obj1.(*nftables.NamedObj)
 	if !ok {
-		t.Fatalf("unexpected type: got %T, want *nftables.ObjAttr", obj1)
+		t.Fatalf("unexpected type: got %T, want *nftables.NamedObj", obj1)
 	}
 
 	if got, want := helper.Name, "ftp-standard"; got != want {

nftables_test.sh

@@ -0,0 +1,3 @@
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests

obj.go

@@ -53,7 +53,7 @@ var objByObjTypeMagic = map[ObjType]string{
 	ObjTypeConnLimit: "connlimit",
 	ObjTypeCtHelper:  "cthelper",
 	ObjTypeTunnel:    "tunnel", // not implemented in expr
-	ObjTypeCtTimeout: "cttimeout", // not implemented in expr
+	ObjTypeCtTimeout: "cttimeout",
 	ObjTypeSecMark:   "secmark",
 	ObjTypeCtExpect:  "ctexpect",
 	ObjTypeSynProxy:  "synproxy",