Merge dae73eaa9c into 4d451ef75f

Before this commit: the printing of a rule results in
a pointer address.

After this commit: the printing of a rules results in
a human-readable text.

Resolves: #104

Signed-off-by: Paul Greenberg <greenpau@outlook.com>

.gitignore

@@ -0,0 +1 @@
+nftables.test

README.md

@@ -21,4 +21,12 @@ the data types/API will be identified as more functionality is added.
 
 Contributions are very welcome!
 
+### Testing Changes
 
+Run the following commands to test your changes:
+
+```bash
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests
+```

expr/verdict.go

@@ -24,6 +24,15 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+const (
+	NFT_DROP   = 0
+	NFT_ACCEPT = 1
+	NFT_STOLEN = 2
+	NFT_QUEUE  = 3
+	NFT_REPEAT = 4
+	NFT_STOP   = 5
+)
+
 // This code assembles the verdict structure, as expected by the
 // nftables netlink API.
 // For further information, consult:
@@ -129,3 +138,37 @@ func (e *Verdict) unmarshal(fam byte, data []byte) error {
 	}
 	return ad.Err()
 }
+
+func (e *Verdict) String() string {
+	var v string
+	switch e.Kind {
+	case unix.NFT_RETURN:
+		v = "return" // -0x5
+	case unix.NFT_GOTO:
+		v = "goto" // -0x4
+	case unix.NFT_JUMP:
+		v = "jump" // NFT_JUMP = -0x3
+	case unix.NFT_BREAK:
+		v = "break" // NFT_BREAK = -0x2
+	case unix.NFT_CONTINUE:
+		v = "continue" // NFT_CONTINUE = -0x1
+	case NFT_DROP:
+		v = "drop"
+	case NFT_ACCEPT:
+		v = "accept"
+	case NFT_STOLEN:
+		v = "stolen"
+	case NFT_QUEUE:
+		v = "queue"
+	case NFT_REPEAT:
+		v = "repeat"
+	case NFT_STOP:
+		v = "stop"
+	default:
+		v = fmt.Sprintf("verdict %v", e.Kind)
+	}
+	if e.Chain != "" {
+		return v + " " + e.Chain
+	}
+	return v
+}

flowtable.go

@@ -219,7 +219,7 @@ func (cc *Conn) getFlowtables(t *Table) ([]netlink.Message, error) {
 
 	reply, err := receiveAckAware(conn, message.Header.Flags)
 	if err != nil {
-		return nil, fmt.Errorf("Receive: %v", err)
+		return nil, fmt.Errorf("receiveAckAware: %v", err)
 	}
 
 	return reply, nil

monitor_test.go

@@ -62,29 +62,27 @@ func TestMonitor(t *testing.T) {
 		defer wg.Done()
 		count := int32(0)
 		for {
-			select {
+			event, ok := <-events
-			case event, ok := <-events:
+			if !ok {
-				if !ok {
+				return
-					return
+			}
-				}
+			if event.Error != nil {
-				if event.Error != nil {
+				err = fmt.Errorf("monitor err: %s", event.Error)
-					err = fmt.Errorf("monitor err: %s", event.Error)
+				return
-					return
+			}
-				}
+			switch event.Type {
-				switch event.Type {
+			case nftables.MonitorEventTypeNewTable:
-				case nftables.MonitorEventTypeNewTable:
+				gotTable = event.Data.(*nftables.Table)
-					gotTable = event.Data.(*nftables.Table)
+				atomic.AddInt32(&count, 1)
-					atomic.AddInt32(&count, 1)
+			case nftables.MonitorEventTypeNewChain:
-				case nftables.MonitorEventTypeNewChain:
+				gotChain = event.Data.(*nftables.Chain)
-					gotChain = event.Data.(*nftables.Chain)
+				atomic.AddInt32(&count, 1)
-					atomic.AddInt32(&count, 1)
+			case nftables.MonitorEventTypeNewRule:
-				case nftables.MonitorEventTypeNewRule:
+				gotRule = event.Data.(*nftables.Rule)
-					gotRule = event.Data.(*nftables.Rule)
+				atomic.AddInt32(&count, 1)
-					atomic.AddInt32(&count, 1)
+			}
-				}
+			if atomic.LoadInt32(&count) == 3 {
-				if atomic.LoadInt32(&count) == 3 {
+				return
-					return
-				}
 			}
 		}
 	}()

nftables_test.go

@@ -221,12 +221,27 @@ func TestRuleOperations(t *testing.T) {
 		expr.VerdictDrop,
 	}
 
+	wantStrings := []string{
+		"queue",
+		"accept",
+		"queue",
+		"accept",
+		"drop",
+		"drop",
+	}
+
 	for i, r := range rules {
 		rr, _ := r.Exprs[0].(*expr.Verdict)
 
 		if rr.Kind != want[i] {
 			t.Fatalf("bad verdict kind at %d", i)
 		}
+
+		if rr.String() != wantStrings[i] {
+			t.Fatalf("bad verdict string at %d: %s (received) vs. %s (expected)", i, rr.String(), wantStrings[i])
+		}
+
+		t.Logf("%s", rr)
 	}
 }
 

nftables_test.sh

@@ -0,0 +1,3 @@
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests

obj.go

@@ -354,7 +354,7 @@ func (cc *Conn) getObjWithLegacyType(o Obj, t *Table, msgType uint16, returnLega
 
 	reply, err := receiveAckAware(conn, message.Header.Flags)
 	if err != nil {
-		return nil, fmt.Errorf("Receive: %v", err)
+		return nil, fmt.Errorf("receiveAckAware: %v", err)
 	}
 	var objs []Obj
 	for _, msg := range reply {

rule.go

@@ -92,7 +92,7 @@ func (cc *Conn) GetRules(t *Table, c *Chain) ([]*Rule, error) {
 
 	reply, err := receiveAckAware(conn, message.Header.Flags)
 	if err != nil {
-		return nil, fmt.Errorf("Receive: %v", err)
+		return nil, fmt.Errorf("receiveAckAware: %v", err)
 	}
 	var rules []*Rule
 	for _, msg := range reply {

set.go

@@ -832,7 +832,7 @@ func (cc *Conn) GetSets(t *Table) ([]*Set, error) {
 
 	reply, err := receiveAckAware(conn, message.Header.Flags)
 	if err != nil {
-		return nil, fmt.Errorf("Receive: %v", err)
+		return nil, fmt.Errorf("receiveAckAware: %v", err)
 	}
 	var sets []*Set
 	for _, msg := range reply {
@@ -877,11 +877,11 @@ func (cc *Conn) GetSetByName(t *Table, name string) (*Set, error) {
 
 	reply, err := receiveAckAware(conn, message.Header.Flags)
 	if err != nil {
-		return nil, fmt.Errorf("Receive: %w", err)
+		return nil, fmt.Errorf("receiveAckAware: %w", err)
 	}
 
 	if len(reply) != 1 {
-		return nil, fmt.Errorf("Receive: expected to receive 1 message but got %d", len(reply))
+		return nil, fmt.Errorf("receiveAckAware: expected to receive 1 message but got %d", len(reply))
 	}
 	rs, err := setsFromMsg(reply[0])
 	if err != nil {
@@ -922,7 +922,7 @@ func (cc *Conn) GetSetElements(s *Set) ([]SetElement, error) {
 
 	reply, err := receiveAckAware(conn, message.Header.Flags)
 	if err != nil {
-		return nil, fmt.Errorf("Receive: %v", err)
+		return nil, fmt.Errorf("receiveAckAware: %v", err)
 	}
 	var elems []SetElement
 	for _, msg := range reply {