Merge dae73eaa9c into aa8348f790

Signed-off-by: thediveo <thediveo@gmx.eu>

.gitignore

@@ -0,0 +1 @@
+nftables.test

README.md

@@ -21,4 +21,12 @@ the data types/API will be identified as more functionality is added.
 
 Contributions are very welcome!
 
+### Testing Changes
 
+Run the following commands to test your changes:
+
+```bash
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests
+```

expr/verdict.go

@@ -24,6 +24,15 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+const (
+	NFT_DROP   = 0
+	NFT_ACCEPT = 1
+	NFT_STOLEN = 2
+	NFT_QUEUE  = 3
+	NFT_REPEAT = 4
+	NFT_STOP   = 5
+)
+
 // This code assembles the verdict structure, as expected by the
 // nftables netlink API.
 // For further information, consult:
@@ -126,3 +135,37 @@ func (e *Verdict) unmarshal(fam byte, data []byte) error {
 	}
 	return ad.Err()
 }
+
+func (e *Verdict) String() string {
+	var v string
+	switch e.Kind {
+	case unix.NFT_RETURN:
+		v = "return" // -0x5
+	case unix.NFT_GOTO:
+		v = "goto" // -0x4
+	case unix.NFT_JUMP:
+		v = "jump" // NFT_JUMP = -0x3
+	case unix.NFT_BREAK:
+		v = "break" // NFT_BREAK = -0x2
+	case unix.NFT_CONTINUE:
+		v = "continue" // NFT_CONTINUE = -0x1
+	case NFT_DROP:
+		v = "drop"
+	case NFT_ACCEPT:
+		v = "accept"
+	case NFT_STOLEN:
+		v = "stolen"
+	case NFT_QUEUE:
+		v = "queue"
+	case NFT_REPEAT:
+		v = "repeat"
+	case NFT_STOP:
+		v = "stop"
+	default:
+		v = fmt.Sprintf("verdict %v", e.Kind)
+	}
+	if e.Chain != "" {
+		return v + " " + e.Chain
+	}
+	return v
+}

nftables_test.go

@@ -221,12 +221,27 @@ func TestRuleOperations(t *testing.T) {
 		expr.VerdictDrop,
 	}
 
+	wantStrings := []string{
+		"queue",
+		"accept",
+		"queue",
+		"accept",
+		"drop",
+		"drop",
+	}
+
 	for i, r := range rules {
 		rr, _ := r.Exprs[0].(*expr.Verdict)
 
 		if rr.Kind != want[i] {
 			t.Fatalf("bad verdict kind at %d", i)
 		}
+
+		if rr.String() != wantStrings[i] {
+			t.Fatalf("bad verdict string at %d: %s (received) vs. %s (expected)", i, rr.String(), wantStrings[i])
+		}
+
+		t.Logf("%s", rr)
 	}
 }
 

nftables_test.sh

@@ -0,0 +1,3 @@
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests

xt/comment.go

@@ -0,0 +1,34 @@
+package xt
+
+import (
+	"bytes"
+	"fmt"
+)
+
+// CommentSize is the fixed size of a comment info xt blob, see:
+// https://elixir.bootlin.com/linux/v6.8.7/source/include/uapi/linux/netfilter/xt_comment.h#L5
+const CommentSize = 256
+
+// Comment gets marshalled and unmarshalled as a fixed-sized char array, filled
+// with zeros as necessary, see:
+// https://elixir.bootlin.com/linux/v6.8.7/source/include/uapi/linux/netfilter/xt_comment.h#L7
+type Comment string
+
+func (c *Comment) marshal(fam TableFamily, rev uint32) ([]byte, error) {
+	if len(*c) >= CommentSize {
+		return nil, fmt.Errorf("comment must be less than %d bytes, got %d bytes",
+			CommentSize, len(*c))
+	}
+	data := make([]byte, CommentSize)
+	copy(data, []byte(*c))
+	return data, nil
+}
+
+func (c *Comment) unmarshal(fam TableFamily, rev uint32, data []byte) error {
+	if len(data) != CommentSize {
+		return fmt.Errorf("malformed comment: got %d bytes, expected exactly %d bytes",
+			len(data), CommentSize)
+	}
+	*c = Comment(bytes.TrimRight(data, "\x00"))
+	return nil
+}

xt/comment_test.go

@@ -0,0 +1,62 @@
+package xt
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestComment(t *testing.T) {
+	t.Parallel()
+	payload := Comment("The quick brown fox jumps over the lazy dog.")
+	oversized := Comment(strings.Repeat("foobar", 100))
+	tests := []struct {
+		name   string
+		info   InfoAny
+		errmsg string
+	}{
+		{
+			name: "un/marshal Comment round-trip",
+			info: &payload,
+		},
+		{
+			name:   "marshal oversized Comment",
+			info:   &oversized,
+			errmsg: "comment must be less than 256 bytes, got 600 bytes",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			data, err := tt.info.marshal(0, 0)
+			if err != nil {
+				if tt.errmsg != "" && err.Error() == tt.errmsg {
+					return
+				}
+				t.Fatalf("marshal error: %+v", err)
+
+			}
+			if len(data) != CommentSize {
+				t.Fatalf("marshal error: invalid size %d", len(data))
+			}
+			if data[len(data)-1] != 0 {
+				t.Fatalf("marshal error: invalid termination")
+			}
+			var comment Comment
+			var recoveredInfo InfoAny = &comment
+			err = recoveredInfo.unmarshal(0, 0, data)
+			if err != nil {
+				t.Fatalf("unmarshal error: %+v", err)
+			}
+			if !reflect.DeepEqual(tt.info, recoveredInfo) {
+				t.Fatalf("original %+v and recovered %+v are different", tt.info, recoveredInfo)
+			}
+		})
+	}
+
+	oversizeddata := []byte(oversized)
+	var comment Comment
+	if err := (&comment).unmarshal(0, 0, oversizeddata); err == nil {
+		t.Fatalf("unmarshal: expected error, but got nil")
+	}
+}

xt/info.go

@@ -34,6 +34,9 @@ func Unmarshal(name string, fam TableFamily, rev uint32, data []byte) (InfoAny,
 		case 1:
 			i = &AddrTypeV1{}
 		}
+	case "comment":
+		var c Comment
+		i = &c
 	case "conntrack":
 		switch rev {
 		case 1: