Merge dae73eaa9c into 9a9f2ce6b3

Signed-off-by: Asutorufa <16442314+Asutorufa@users.noreply.github.com>

.gitignore

@@ -0,0 +1 @@
+nftables.test

README.md

@@ -21,4 +21,12 @@ the data types/API will be identified as more functionality is added.
 
 Contributions are very welcome!
 
+### Testing Changes
 
+Run the following commands to test your changes:
+
+```bash
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests
+```

expr/verdict.go

@@ -24,6 +24,15 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+const (
+	NFT_DROP   = 0
+	NFT_ACCEPT = 1
+	NFT_STOLEN = 2
+	NFT_QUEUE  = 3
+	NFT_REPEAT = 4
+	NFT_STOP   = 5
+)
+
 // This code assembles the verdict structure, as expected by the
 // nftables netlink API.
 // For further information, consult:
@@ -129,3 +138,37 @@ func (e *Verdict) unmarshal(fam byte, data []byte) error {
 	}
 	return ad.Err()
 }
+
+func (e *Verdict) String() string {
+	var v string
+	switch e.Kind {
+	case unix.NFT_RETURN:
+		v = "return" // -0x5
+	case unix.NFT_GOTO:
+		v = "goto" // -0x4
+	case unix.NFT_JUMP:
+		v = "jump" // NFT_JUMP = -0x3
+	case unix.NFT_BREAK:
+		v = "break" // NFT_BREAK = -0x2
+	case unix.NFT_CONTINUE:
+		v = "continue" // NFT_CONTINUE = -0x1
+	case NFT_DROP:
+		v = "drop"
+	case NFT_ACCEPT:
+		v = "accept"
+	case NFT_STOLEN:
+		v = "stolen"
+	case NFT_QUEUE:
+		v = "queue"
+	case NFT_REPEAT:
+		v = "repeat"
+	case NFT_STOP:
+		v = "stop"
+	default:
+		v = fmt.Sprintf("verdict %v", e.Kind)
+	}
+	if e.Chain != "" {
+		return v + " " + e.Chain
+	}
+	return v
+}

nftables_test.go

@@ -221,12 +221,27 @@ func TestRuleOperations(t *testing.T) {
 		expr.VerdictDrop,
 	}
 
+	wantStrings := []string{
+		"queue",
+		"accept",
+		"queue",
+		"accept",
+		"drop",
+		"drop",
+	}
+
 	for i, r := range rules {
 		rr, _ := r.Exprs[0].(*expr.Verdict)
 
 		if rr.Kind != want[i] {
 			t.Fatalf("bad verdict kind at %d", i)
 		}
+
+		if rr.String() != wantStrings[i] {
+			t.Fatalf("bad verdict string at %d: %s (received) vs. %s (expected)", i, rr.String(), wantStrings[i])
+		}
+
+		t.Logf("%s", rr)
 	}
 }
 
@@ -3498,6 +3513,66 @@ func TestCreateUseNamedSet(t *testing.T) {
 	}
 }
 
+func TestCreateAutoMergeSet(t *testing.T) {
+	// Create a new network namespace to test these operations,
+	// and tear down the namespace at test completion.
+	c, newNS := nftest.OpenSystemConn(t, *enableSysTests)
+	defer nftest.CleanupSystemConn(t, newNS)
+	// Clear all rules at the beginning + end of the test.
+	c.FlushRuleset()
+	defer c.FlushRuleset()
+
+	filter := c.AddTable(&nftables.Table{
+		Family: nftables.TableFamilyIPv4,
+		Name:   "filter",
+	})
+
+	portSet := &nftables.Set{
+		Table:     filter,
+		Name:      "test",
+		KeyType:   nftables.TypeInetService,
+		Interval:  true,
+		AutoMerge: true,
+	}
+	if err := c.AddSet(portSet, nil); err != nil {
+		t.Errorf("c.AddSet(portSet) failed: %v", err)
+	}
+	if err := c.SetAddElements(portSet, []nftables.SetElement{{Key: binaryutil.BigEndian.PutUint16(22)}}); err != nil {
+		t.Errorf("c.SetVal(portSet) failed: %v", err)
+	}
+
+	ipSet := &nftables.Set{
+		Table:     filter,
+		Name:      "IPs_4_dayz",
+		KeyType:   nftables.TypeIPAddr,
+		Interval:  true,
+		AutoMerge: true,
+	}
+	if err := c.AddSet(ipSet, []nftables.SetElement{{Key: []byte(net.ParseIP("192.168.1.64").To4())}}); err != nil {
+		t.Errorf("c.AddSet(ipSet) failed: %v", err)
+	}
+	if err := c.SetAddElements(ipSet, []nftables.SetElement{{Key: []byte(net.ParseIP("192.168.1.42").To4())}}); err != nil {
+		t.Errorf("c.SetVal(ipSet) failed: %v", err)
+	}
+	if err := c.Flush(); err != nil {
+		t.Errorf("c.Flush() failed: %v", err)
+	}
+
+	sets, err := c.GetSets(filter)
+	if err != nil {
+		t.Errorf("c.GetSets() failed: %v", err)
+	}
+	if len(sets) != 2 {
+		t.Fatalf("len(sets) = %d, want 2", len(sets))
+	}
+	if !sets[0].AutoMerge {
+		t.Errorf("set[0].AutoMerge = %v, want true", sets[0].AutoMerge)
+	}
+	if !sets[1].AutoMerge {
+		t.Errorf("set[1].AutoMerge = %v, want true", sets[1].AutoMerge)
+	}
+}
+
 func TestIP6SetAddElements(t *testing.T) {
 	// Create a new network namespace to test these operations,
 	// and tear down the namespace at test completion.

nftables_test.sh

@@ -0,0 +1,3 @@
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests

set.go

@@ -21,10 +21,10 @@ import (
 	"strings"
 	"time"
 
+	"github.com/google/nftables/binaryutil"
 	"github.com/google/nftables/expr"
 	"github.com/google/nftables/internal/parseexprfunc"
-
+	"github.com/google/nftables/userdata"
-	"github.com/google/nftables/binaryutil"
 	"github.com/mdlayher/netlink"
 	"golang.org/x/sys/unix"
 )
@@ -249,6 +249,7 @@ type Set struct {
 	Anonymous  bool
 	Constant   bool
 	Interval   bool
+	AutoMerge  bool
 	IsMap      bool
 	HasTimeout bool
 	Counter    bool
@@ -580,15 +581,27 @@ func (cc *Conn) AddSet(s *Set, vals []SetElement) error {
 		// Marshal concat size description as set description
 		tableInfo = append(tableInfo, netlink.Attribute{Type: unix.NLA_F_NESTED | unix.NFTA_SET_DESC, Data: concatBytes})
 	}
+
+	// https://git.netfilter.org/libnftnl/tree/include/udata.h#n17
+	var userData []byte
+
 	if s.Anonymous || s.Constant || s.Interval || s.KeyByteOrder == binaryutil.BigEndian {
-		tableInfo = append(tableInfo,
 		// Semantically useless - kept for binary compatability with nft
-			netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: []byte("\x00\x04\x02\x00\x00\x00")})
+		userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_KEYBYTEORDER, 2)
 	} else if s.KeyByteOrder == binaryutil.NativeEndian {
 		// Per https://git.netfilter.org/nftables/tree/src/mnl.c?id=187c6d01d35722618c2711bbc49262c286472c8f#n1165
-		tableInfo = append(tableInfo,
+		userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_KEYBYTEORDER, 1)
-			netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: []byte("\x00\x04\x01\x00\x00\x00")})
 	}
+
+	if s.Interval && s.AutoMerge {
+		// https://git.netfilter.org/nftables/tree/src/mnl.c?id=187c6d01d35722618c2711bbc49262c286472c8f#n1174
+		userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_MERGE_ELEMENTS, 1)
+	}
+
+	if len(userData) > 0 {
+		tableInfo = append(tableInfo, netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: userData})
+	}
+
 	if s.Counter {
 		data, err := netlink.MarshalAttributes([]netlink.Attribute{
 			{Type: unix.NFTA_LIST_ELEM, Data: []byte("counter\x00")},
@@ -740,6 +753,10 @@ func setsFromMsg(msg netlink.Message) (*Set, error) {
 			set.DataType = dt
 		case unix.NFTA_SET_DATA_LEN:
 			set.DataType.Bytes = binary.BigEndian.Uint32(ad.Bytes())
+		case unix.NFTA_SET_USERDATA:
+			data := ad.Bytes()
+			value, ok := userdata.GetUint32(data, userdata.NFTNL_UDATA_SET_MERGE_ELEMENTS)
+			set.AutoMerge = ok && value == 1
 		}
 	}
 	return &set, nil

userdata/userdata.go

@@ -31,6 +31,21 @@ const (
 	TypesCount
 )
 
+// TLV type values are defined in:
+// https://git.netfilter.org/libnftnl/tree/include/libnftnl/udata.h#n39
+const (
+	NFTNL_UDATA_SET_KEYBYTEORDER Type = iota
+	NFTNL_UDATA_SET_DATABYTEORDER
+	NFTNL_UDATA_SET_MERGE_ELEMENTS
+	NFTNL_UDATA_SET_KEY_TYPEOF
+	NFTNL_UDATA_SET_DATA_TYPEOF
+	NFTNL_UDATA_SET_EXPR
+	NFTNL_UDATA_SET_DATA_INTERVAL
+	NFTNL_UDATA_SET_COMMENT
+
+	NFTNL_UDATA_SET_MAX
+)
+
 func Append(udata []byte, typ Type, data []byte) []byte {
 	udata = append(udata, byte(typ), byte(len(data)))
 	udata = append(udata, data...)