interesting
/
nftables
mirror of https://github.com/google/nftables.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Compare commits

base: interesting:944d1c01762d910048bc0257764774f9b37ee331
Branches Tags
interesting:main
interesting:v0.3.0
interesting:v0.2.0
interesting:v0.1.0
..
compare: interesting:8e29fbaa6ea4ae764c7c8b46ad73ccbce8c4b554
Branches Tags
interesting:main
interesting:v0.3.0
interesting:v0.2.0
interesting:v0.1.0

5 Commits
944d1c0176 ... 8e29fbaa6e

Author SHA1 Message Date
nickgarlis 8e29fbaa6e Add note about different behavior when using WithSockOptions 2025-07-01 09:57:38 +02:00
nickgarlis f8c01f0bf3 Address review comments 2025-06-30 21:28:35 +02:00
nickgarlis 0a7196fb65 Prevent buffer enlargement in specific scenarios 
We should not enlarge the socket buffers when:
 - We are using a test dial (there are no buffers to enlarge).
 - A connection has been initialized with socket options which means
   that the user could have specified fixed buffer sizes.
 2025-06-30 21:07:25 +02:00
nickgarlis 7d83c94f64 Address review comments 2025-06-28 18:00:17 +02:00
nickgarlis dc9df31dfa Automatically set socket read & write buffer sizes 
This is an attempt to port the logic that nftables uses to automatically
adjust the recvmsg & sndmsg buffer sizes. The implementation of setting
sndmsg size is not the same as nftables due to some limitations in the
underlying netlink & socket libraries.

- https://git.netfilter.org/nftables/tree/src/mnl.c?id=713592c6008a8c589a00d3d3d2e49709ff2de62c#n262
- https://git.netfilter.org/libmnl/tree/include/libmnl/libmnl.h?id=03da98bcd284d55212bc79e91dfb63da0ef7b937#n20
- https://git.netfilter.org/nftables/tree/src/mnl.c?id=713592c6008a8c589a00d3d3d2e49709ff2de62c#n391
- https://git.netfilter.org/nftables/tree/src/mnl.c?id=713592c6008a8c589a00d3d3d2e49709ff2de62c#n426
 2025-04-05 13:59:46 +02:00
4 changed files with 11 additions and 49 deletions
Show Stats Expand all files Collapse all files

26
expr/ct.go
View File

@ -110,12 +110,6 @@ const (
CtStateUDPREPLIED
)
const (
// https://git.netfilter.org/libnftnl/tree/src/expr/ct.c?id=116e95aa7b6358c917de8c69f6f173874030b46b#n31
CtDirOriginal = iota
CtDirReply
)
// https://git.netfilter.org/libnftnl/tree/src/obj/ct_timeout.c?id=116e95aa7b6358c917de8c69f6f173874030b46b#n57
var CtStateUDPTimeoutDefaults CtStatePolicyTimeout = map[uint16]uint32{
CtStateUDPUNREPLIED: 30,
@ -128,7 +122,6 @@ type Ct struct {
SourceRegister bool
Key CtKey
Direction uint32
OptDirection bool
}
func (e *Ct) marshal(fam byte) ([]byte, error) {
@ -172,16 +165,10 @@ func (e *Ct) marshalData(fam byte) ([]byte, error) {
exprData = append(exprData, regData...)
switch e.Key {
case CtKeyPKTS, CtKeyBYTES, CtKeyAVGPKT, CtKeyL3PROTOCOL, CtKeyPROTOCOL:
if !e.OptDirection {
break
}
fallthrough
case CtKeySRC, CtKeyDST, CtKeyPROTOSRC, CtKeyPROTODST, CtKeySRCIP, CtKeyDSTIP, CtKeySRCIP6, CtKeyDSTIP6:
regData, err = netlink.MarshalAttributes(
[]netlink.Attribute{
{Type: unix.NFTA_CT_DIRECTION, Data: []byte{uint8(e.Direction)}},
{Type: unix.NFTA_CT_DIRECTION, Data: binaryutil.BigEndian.PutUint32(e.Direction)},
},
)
if err != nil {
@ -199,8 +186,6 @@ func (e *Ct) unmarshal(fam byte, data []byte) error {
return err
}
ad.ByteOrder = binary.BigEndian
var hasDirection bool
for ad.Next() {
switch ad.Type() {
case unix.NFTA_CT_KEY:
@ -208,19 +193,12 @@ func (e *Ct) unmarshal(fam byte, data []byte) error {
case unix.NFTA_CT_DREG:
e.Register = ad.Uint32()
case unix.NFTA_CT_DIRECTION:
e.Direction = uint32(ad.Uint8())
hasDirection = true
e.Direction = ad.Uint32()
case unix.NFTA_CT_SREG:
e.SourceRegister = true
e.Register = ad.Uint32()
}
}
switch e.Key {
case CtKeyPKTS, CtKeyBYTES, CtKeyAVGPKT, CtKeyL3PROTOCOL, CtKeyPROTOCOL:
e.OptDirection = hasDirection
}
return ad.Err()
}

16
expr/ct_test.go
View File

@ -78,22 +78,6 @@ func TestCt(t *testing.T) {
Direction: 1,
},
},
{
name: "Unmarshal Ct packets direction original case",
ct: Ct{
Register: 1,
Key: CtKeyPKTS,
Direction: CtDirOriginal,
OptDirection: true,
},
},
{
name: "Unmarshal Ct bytes without direction case",
ct: Ct{
Register: 1,
Key: CtKeyBYTES,
},
},
}
for _, tt := range tests {

6
go.mod
View File

@ -4,14 +4,14 @@ go 1.23.0
require (
github.com/google/go-cmp v0.6.0
github.com/mdlayher/netlink v1.7.3-0.20250702063131-0f7746f74615
github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42
github.com/vishvananda/netlink v1.3.0
github.com/vishvananda/netns v0.0.4
golang.org/x/sys v0.31.0
)
require (
github.com/mdlayher/socket v0.5.1 // indirect
golang.org/x/net v0.38.0 // indirect
github.com/mdlayher/socket v0.5.0 // indirect
golang.org/x/net v0.37.0 // indirect
golang.org/x/sync v0.6.0 // indirect
)

12
go.sum
View File

@ -1,15 +1,15 @@
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/mdlayher/netlink v1.7.3-0.20250702063131-0f7746f74615 h1:5T2ai+PpYFKe+tyNj/ZxePZGiYoG5xDOylT30nywJUU=
github.com/mdlayher/netlink v1.7.3-0.20250702063131-0f7746f74615/go.mod h1:ZlWrPUV9wyD64k5skWrIv4WDQmmiUbkNnCkBtEWYKwU=
github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 h1:A1Cq6Ysb0GM0tpKMbdCXCIfBclan4oHk1Jb+Hrejirg=
github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42/go.mod h1:BB4YCPDOzfy7FniQ/lxuYQ3dgmM2cZumHbK8RpTjN2o=
github.com/mdlayher/socket v0.5.0 h1:ilICZmJcQz70vrWVes1MFera4jGiWNocSkykwwoy3XI=
github.com/mdlayher/socket v0.5.0/go.mod h1:WkcBFfvyG8QENs5+hfQPl1X6Jpd2yeLIYgrGFmJiJxI=
github.com/vishvananda/netlink v1.3.0 h1:X7l42GfcV4S6E4vHTsw48qbrV+9PVojNfIhZcwQdrZk=
github.com/vishvananda/netlink v1.3.0/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=