Merge dae73eaa9c into 9a9f2ce6b3

expr/ct.go

@@ -194,74 +194,3 @@ func (c *CtHelper) unmarshal(fam byte, data []byte) error {
 	}
 	return ad.Err()
 }
-
-// From https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=be0bae0ad31b0adb506f96de083f52a2bd0d4fbf#n1601
-// Currently not available in sys/unix
-const (
-	NFTA_CT_EXPECT_L3PROTO = 0x01
-	NFTA_CT_EXPECT_L4PROTO = 0x02
-	NFTA_CT_EXPECT_DPORT   = 0x03
-	NFTA_CT_EXPECT_TIMEOUT = 0x04
-	NFTA_CT_EXPECT_SIZE    = 0x05
-)
-
-type CtExpect struct {
-	L3Proto uint16
-	L4Proto uint8
-	DPort   uint16
-	Timeout uint32
-	Size    uint8
-}
-
-func (c *CtExpect) marshal(fam byte) ([]byte, error) {
-	exprData, err := c.marshalData(fam)
-	if err != nil {
-		return nil, err
-	}
-
-	return netlink.MarshalAttributes([]netlink.Attribute{
-		{Type: unix.NFTA_EXPR_NAME, Data: []byte("ctexpect\x00")},
-		{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
-	})
-}
-
-func (c *CtExpect) marshalData(fam byte) ([]byte, error) {
-	// all elements except l3proto must be defined
-	// per https://git.netfilter.org/nftables/tree/doc/stateful-objects.txt?id=db70959a5ccf2952b218f51c3d529e186a5a43bb#n119
-	// from man page: l3proto is derived from the table family by default
-	exprData := []netlink.Attribute{
-		{Type: NFTA_CT_EXPECT_L4PROTO, Data: []byte{c.L4Proto}},
-		{Type: NFTA_CT_EXPECT_DPORT, Data: binaryutil.BigEndian.PutUint16(c.DPort)},
-		{Type: NFTA_CT_EXPECT_TIMEOUT, Data: binaryutil.BigEndian.PutUint32(c.Timeout)},
-		{Type: NFTA_CT_EXPECT_SIZE, Data: []byte{c.Size}},
-	}
-
-	if c.L3Proto != 0 {
-		attr := netlink.Attribute{Type: NFTA_CT_EXPECT_L3PROTO, Data: binaryutil.BigEndian.PutUint16(c.L3Proto)}
-		exprData = append(exprData, attr)
-	}
-	return netlink.MarshalAttributes(exprData)
-}
-
-func (c *CtExpect) unmarshal(fam byte, data []byte) error {
-	ad, err := netlink.NewAttributeDecoder(data)
-	if err != nil {
-		return err
-	}
-	ad.ByteOrder = binary.BigEndian
-	for ad.Next() {
-		switch ad.Type() {
-		case NFTA_CT_EXPECT_L3PROTO:
-			c.L3Proto = ad.Uint16()
-		case NFTA_CT_EXPECT_L4PROTO:
-			c.L4Proto = ad.Uint8()
-		case NFTA_CT_EXPECT_DPORT:
-			c.DPort = ad.Uint16()
-		case NFTA_CT_EXPECT_TIMEOUT:
-			c.Timeout = ad.Uint32()
-		case NFTA_CT_EXPECT_SIZE:
-			c.Size = ad.Uint8()
-		}
-	}
-	return ad.Err()
-}

expr/expr.go

@@ -201,10 +201,6 @@ func exprFromName(name string) Any {
 		e = &CtHelper{}
 	case "synproxy":
 		e = &SynProxy{}
-	case "ctexpect":
-		e = &CtExpect{}
-	case "secmark":
-		e = &SecMark{}
 	}
 	return e
 }

expr/secmark.go

@@ -1,64 +0,0 @@
-// Copyright 2024 Google LLC. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package expr
-
-import (
-	"encoding/binary"
-
-	"github.com/mdlayher/netlink"
-	"golang.org/x/sys/unix"
-)
-
-// From https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=be0bae0ad31b0adb506f96de083f52a2bd0d4fbf#n1338
-const (
-	NFTA_SECMARK_CTX = 0x01
-)
-
-type SecMark struct {
-	Ctx string
-}
-
-func (e *SecMark) marshal(fam byte) ([]byte, error) {
-	data, err := e.marshalData(fam)
-	if err != nil {
-		return nil, err
-	}
-	return netlink.MarshalAttributes([]netlink.Attribute{
-		{Type: unix.NFTA_EXPR_NAME, Data: []byte("secmark\x00")},
-		{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
-	})
-}
-
-func (e *SecMark) marshalData(fam byte) ([]byte, error) {
-	attrs := []netlink.Attribute{
-		{Type: NFTA_SECMARK_CTX, Data: []byte(e.Ctx)},
-	}
-	return netlink.MarshalAttributes(attrs)
-}
-
-func (e *SecMark) unmarshal(fam byte, data []byte) error {
-	ad, err := netlink.NewAttributeDecoder(data)
-	if err != nil {
-		return err
-	}
-	ad.ByteOrder = binary.BigEndian
-	for ad.Next() {
-		switch ad.Type() {
-		case NFTA_SECMARK_CTX:
-			e.Ctx = ad.String()
-		}
-	}
-	return ad.Err()
-}

nftables_test.go

@@ -1398,68 +1398,6 @@ func TestCt(t *testing.T) {
 	}
 }
 
-func TestSecMarkMarshaling(t *testing.T) {
-	// Testing marshaling since secmark requires live selinux tag otherwise
-	// errors with conn.Receive: netlink receive: no such file or directory.
-	// More information available here:
-	// https://git.netfilter.org/nftables/tree/files/examples/secmark.nft?id=26d9cbefb10e6bc3765df7e9e7a4fc3b951a80f3#n6
-	want := [][]byte{
-		// batch begin
-		[]byte("\x00\x00\x00\x0a"),
-		// sudo nft add table inet filter
-		[]byte("\x01\x00\x00\x00\x0b\x00\x01\x00filter\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00"),
-		// sudo nft add secmark inet filter sshtag '{ ctx "system_u:object_r:ssh_server_packet_t:s0" }'
-		[]byte("\x01\x00\x00\x00\x0b\x00\x01\x00filter\x00\x00\x0b\x00\x02\x00sshtag\x00\x00\x08\x00\x03\x00\x00\x00\x00\x080\x00\x04\x80,\x00\x01\x00system_u:object_r:ssh_server_packet_t:s0"),
-		// batch end
-		[]byte("\x00\x00\x00\x0a"),
-	}
-
-	conn, err := nftables.New(nftables.WithTestDial(
-		func(req []netlink.Message) ([]netlink.Message, error) {
-			for idx, msg := range req {
-				b, err := msg.MarshalBinary()
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(b) < 16 {
-					continue
-				}
-				b = b[16:]
-				if len(want) == 0 {
-					t.Errorf("no want entry for message %d: %x", idx, b)
-					continue
-				}
-				if got, want := b, want[0]; !bytes.Equal(got, want) {
-					t.Errorf("message %d: %s", idx, linediff(nfdump(got), nfdump(want)))
-				}
-				want = want[1:]
-			}
-			return req, nil
-		}))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	table := conn.AddTable(&nftables.Table{
-		Family: nftables.TableFamilyINet,
-		Name:   "filter",
-	})
-
-	sec := &nftables.NamedObj{
-		Table: table,
-		Name:  "sshtag",
-		Type:  nftables.ObjTypeSecMark,
-		Obj: &expr.SecMark{
-			Ctx: "system_u:object_r:ssh_server_packet_t:s0",
-		},
-	}
-	conn.AddObj(sec)
-
-	if err := conn.Flush(); err != nil {
-		t.Fatalf(err.Error())
-	}
-}
-
 func TestSynProxyObject(t *testing.T) {
 	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
 	defer nftest.CleanupSystemConn(t, newNS)
@@ -1505,6 +1443,7 @@ func TestSynProxyObject(t *testing.T) {
 	conn.AddObj(syn1)
 	conn.AddObj(syn2)
 	conn.AddObj(syn3)
+
 	if err := conn.Flush(); err != nil {
 		t.Fatalf(err.Error())
 	}
@@ -1513,6 +1452,7 @@ func TestSynProxyObject(t *testing.T) {
 	if err != nil {
 		t.Errorf("c.GetObjects(table) failed: %v", err)
 	}
+
 	if got, want := len(objs), 3; got != want {
 		t.Fatalf("received %d objects, expected %d", got, want)
 	}
@@ -1556,74 +1496,6 @@ func TestSynProxyObject(t *testing.T) {
 	}
 }
 
-func TestCtExpect(t *testing.T) {
-	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
-	defer nftest.CleanupSystemConn(t, newNS)
-	conn.FlushRuleset()
-	defer conn.FlushRuleset()
-
-	table := conn.AddTable(&nftables.Table{
-		Family: nftables.TableFamilyIPv4,
-		Name:   "filter",
-	})
-
-	cte := &nftables.NamedObj{
-		Table: table,
-		Name:  "expect",
-		Type:  nftables.ObjTypeCtExpect,
-		Obj: &expr.CtExpect{
-			L3Proto: unix.NFPROTO_IPV4,
-			L4Proto: unix.IPPROTO_TCP,
-			DPort:   53,
-			Timeout: 20,
-			Size:    100,
-		},
-	}
-
-	conn.AddObj(cte)
-	if err := conn.Flush(); err != nil {
-		t.Fatalf(err.Error())
-	}
-
-	objs, err := conn.GetNamedObjects(table)
-	if err != nil {
-		t.Errorf("c.GetObjects(table) failed: %v", err)
-	}
-
-	if got, want := len(objs), 1; got != want {
-		t.Fatalf("received %d objects, expected %d", got, want)
-	}
-
-	obj := objs[0].(*nftables.NamedObj)
-	if got, want := obj.Name, cte.Name; got != want {
-		t.Errorf("object names are not equal: got %s, want %s", got, want)
-	}
-	if got, want := obj.Type, cte.Type; got != want {
-		t.Errorf("object types are not equal: got %v, want %v", got, want)
-	}
-	if got, want := obj.Table.Name, cte.Table.Name; got != want {
-		t.Errorf("object tables are not equal: got %s, want %s", got, want)
-	}
-
-	ce1 := obj.Obj.(*expr.CtExpect)
-	ce2 := cte.Obj.(*expr.CtExpect)
-	if got, want := ce1.L3Proto, ce2.L3Proto; got != want {
-		t.Errorf("object l3proto not equal: got %d, want %d", got, want)
-	}
-	if got, want := ce1.L4Proto, ce2.L4Proto; got != want {
-		t.Errorf("object l4proto not equal: got %d, want %d", got, want)
-	}
-	if got, want := ce1.DPort, ce2.DPort; got != want {
-		t.Errorf("object dport not equal: got %d, want %d", got, want)
-	}
-	if got, want := ce1.Size, ce2.Size; got != want {
-		t.Errorf("object Size not equal: got %d, want %d", got, want)
-	}
-	if got, want := ce1.Timeout, ce2.Timeout; got != want {
-		t.Errorf("object timeout not equal: got %d, want %d", got, want)
-	}
-}
-
 func TestCtHelper(t *testing.T) {
 	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
 	defer nftest.CleanupSystemConn(t, newNS)

obj.go

@@ -54,9 +54,9 @@ var objByObjTypeMagic = map[ObjType]string{
 	ObjTypeCtHelper:  "cthelper",
 	ObjTypeTunnel:    "tunnel",    // not implemented in expr
 	ObjTypeCtTimeout: "cttimeout", // not implemented in expr
-	ObjTypeSecMark:   "secmark",
+	ObjTypeSecMark:   "secmark",   // not implemented in expr
-	ObjTypeCtExpect:  "ctexpect",
+	ObjTypeCtExpect:  "ctexpect",  // not implemented in expr
-	ObjTypeSynProxy:  "synproxy",
+	ObjTypeSynProxy:  "synproxy",  // not implemented in expr
 }
 
 // Obj represents a netfilter stateful object. See also