Merge dae73eaa9c into 38e481bfc4

Before this commit: the printing of a rule results in
a pointer address.

After this commit: the printing of a rules results in
a human-readable text.

Resolves: #104

Signed-off-by: Paul Greenberg <greenpau@outlook.com>

.gitignore

@@ -0,0 +1 @@
+nftables.test

README.md

@@ -21,4 +21,12 @@ the data types/API will be identified as more functionality is added.
 
 Contributions are very welcome!
 
+### Testing Changes
 
+Run the following commands to test your changes:
+
+```bash
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests
+```

expr/verdict.go

@@ -24,6 +24,15 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+const (
+	NFT_DROP   = 0
+	NFT_ACCEPT = 1
+	NFT_STOLEN = 2
+	NFT_QUEUE  = 3
+	NFT_REPEAT = 4
+	NFT_STOP   = 5
+)
+
 // This code assembles the verdict structure, as expected by the
 // nftables netlink API.
 // For further information, consult:
@@ -129,3 +138,37 @@ func (e *Verdict) unmarshal(fam byte, data []byte) error {
 	}
 	return ad.Err()
 }
+
+func (e *Verdict) String() string {
+	var v string
+	switch e.Kind {
+	case unix.NFT_RETURN:
+		v = "return" // -0x5
+	case unix.NFT_GOTO:
+		v = "goto" // -0x4
+	case unix.NFT_JUMP:
+		v = "jump" // NFT_JUMP = -0x3
+	case unix.NFT_BREAK:
+		v = "break" // NFT_BREAK = -0x2
+	case unix.NFT_CONTINUE:
+		v = "continue" // NFT_CONTINUE = -0x1
+	case NFT_DROP:
+		v = "drop"
+	case NFT_ACCEPT:
+		v = "accept"
+	case NFT_STOLEN:
+		v = "stolen"
+	case NFT_QUEUE:
+		v = "queue"
+	case NFT_REPEAT:
+		v = "repeat"
+	case NFT_STOP:
+		v = "stop"
+	default:
+		v = fmt.Sprintf("verdict %v", e.Kind)
+	}
+	if e.Chain != "" {
+		return v + " " + e.Chain
+	}
+	return v
+}

nftables_test.go

@@ -221,12 +221,27 @@ func TestRuleOperations(t *testing.T) {
 		expr.VerdictDrop,
 	}
 
+	wantStrings := []string{
+		"queue",
+		"accept",
+		"queue",
+		"accept",
+		"drop",
+		"drop",
+	}
+
 	for i, r := range rules {
 		rr, _ := r.Exprs[0].(*expr.Verdict)
 
 		if rr.Kind != want[i] {
 			t.Fatalf("bad verdict kind at %d", i)
 		}
+
+		if rr.String() != wantStrings[i] {
+			t.Fatalf("bad verdict string at %d: %s (received) vs. %s (expected)", i, rr.String(), wantStrings[i])
+		}
+
+		t.Logf("%s", rr)
 	}
 }
 
@@ -2136,6 +2151,83 @@ func TestGetObjReset(t *testing.T) {
 	}
 }
 
+func TestGetResetNamedObj(t *testing.T) {
+	c, newNS := nftest.OpenSystemConn(t, *enableSysTests)
+	defer nftest.CleanupSystemConn(t, newNS)
+	c.FlushRuleset()
+	defer c.FlushRuleset()
+
+	table := c.AddTable(&nftables.Table{
+		Family: nftables.TableFamilyIPv4,
+		Name:   "filter",
+	})
+
+	c.AddObj(&nftables.NamedObj{
+		Table: table,
+		Name:  "fwded1",
+		Type:  nftables.ObjTypeCounter,
+		Obj: &expr.Counter{
+			Bytes:   1,
+			Packets: 1,
+		},
+	})
+
+	c.AddObj(&nftables.NamedObj{
+		Table: table,
+		Name:  "fwded2",
+		Type:  nftables.ObjTypeQuota,
+		Obj: &expr.Quota{
+			Consumed: 1,
+			Over:     true,
+			Bytes:    0x6400,
+		},
+	})
+
+	c.AddObj(&nftables.NamedObj{
+		Table: table,
+		Name:  "fwded3",
+		Type:  nftables.ObjTypeConnLimit,
+		Obj: &expr.Connlimit{
+			Count: 20,
+			Flags: 1,
+		},
+	})
+
+	if err := c.Flush(); err != nil {
+		t.Fatalf(err.Error())
+	}
+
+	objsNamed, err := c.GetNamedObjects(table)
+	if err != nil {
+		t.Errorf("c.GetNamedObjects(table) failed: %v failed", err)
+	}
+
+	if got := len(objsNamed); got != 3 {
+		t.Fatalf("unexpected number of objects: got %d, want %d", got, 3)
+	}
+
+	for _, o := range objsNamed {
+		switch v := o.(type) {
+		case *nftables.NamedObj:
+		default:
+			t.Fatalf("unexpected type in objsNamed: got %v, want *nftables.NamedObj", v)
+		}
+	}
+
+	objsReset, err := c.ResetNamedObjects(table)
+	if err != nil {
+		t.Errorf("c.ResetObjects(table) failed: %v failed", err)
+	}
+
+	for _, o := range objsReset {
+		switch v := o.(type) {
+		case *nftables.NamedObj:
+		default:
+			t.Fatalf("unexpected type in objsReset: got %v, want *nftables.NamedObj", v)
+		}
+	}
+}
+
 func TestObjAPI(t *testing.T) {
 	if os.Getenv("TRAVIS") == "true" {
 		t.SkipNow()

nftables_test.sh

@@ -0,0 +1,3 @@
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests

obj.go

@@ -194,6 +194,12 @@ func (cc *Conn) GetObjects(t *Table) ([]Obj, error) {
 	return cc.getObj(nil, t, unix.NFT_MSG_GETOBJ)
 }
 
+// GetNamedObjects get all the Obj that belongs to the given table
+// This function always return NamedObj types
+func (cc *Conn) GetNamedObjects(t *Table) ([]Obj, error) {
+	return cc.getObjWithLegacyType(nil, t, unix.NFT_MSG_GETOBJ, false)
+}
+
 // ResetObject reset the given Obj
 // This function returns the same concrete type as passed,
 // e.g. QuotaObj, CounterObj or NamedObj. Prefer using the more
@@ -215,6 +221,12 @@ func (cc *Conn) ResetObjects(t *Table) ([]Obj, error) {
 	return cc.getObj(nil, t, unix.NFT_MSG_GETOBJ_RESET)
 }
 
+// ResetNamedObjects reset all the Obj that belongs to the given table
+// This function always return NamedObj types
+func (cc *Conn) ResetNamedObjects(t *Table) ([]Obj, error) {
+	return cc.getObjWithLegacyType(nil, t, unix.NFT_MSG_GETOBJ_RESET, false)
+}
+
 func objFromMsg(msg netlink.Message, returnLegacyType bool) (Obj, error) {
 	if got, want1, want2 := msg.Header.Type, newObjHeaderType, delObjHeaderType; got != want1 && got != want2 {
 		return nil, fmt.Errorf("unexpected header type: got %v, want %v or %v", got, want1, want2)