Add ct expect support

Signed-off-by: Asutorufa <16442314+Asutorufa@users.noreply.github.com>

expr/ct.go

@@ -194,3 +194,74 @@ func (c *CtHelper) unmarshal(fam byte, data []byte) error {
 	}
 	return ad.Err()
 }
+
+// From https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=be0bae0ad31b0adb506f96de083f52a2bd0d4fbf#n1601
+// Currently not available in sys/unix
+const (
+	NFTA_CT_EXPECT_L3PROTO = 0x01
+	NFTA_CT_EXPECT_L4PROTO = 0x02
+	NFTA_CT_EXPECT_DPORT   = 0x03
+	NFTA_CT_EXPECT_TIMEOUT = 0x04
+	NFTA_CT_EXPECT_SIZE    = 0x05
+)
+
+type CtExpect struct {
+	L3Proto uint16
+	L4Proto uint8
+	DPort   uint16
+	Timeout uint32
+	Size    uint8
+}
+
+func (c *CtExpect) marshal(fam byte) ([]byte, error) {
+	exprData, err := c.marshalData(fam)
+	if err != nil {
+		return nil, err
+	}
+
+	return netlink.MarshalAttributes([]netlink.Attribute{
+		{Type: unix.NFTA_EXPR_NAME, Data: []byte("ctexpect\x00")},
+		{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
+	})
+}
+
+func (c *CtExpect) marshalData(fam byte) ([]byte, error) {
+	// all elements except l3proto must be defined
+	// per https://git.netfilter.org/nftables/tree/doc/stateful-objects.txt?id=db70959a5ccf2952b218f51c3d529e186a5a43bb#n119
+	// from man page: l3proto is derived from the table family by default
+	exprData := []netlink.Attribute{
+		{Type: NFTA_CT_EXPECT_L4PROTO, Data: []byte{c.L4Proto}},
+		{Type: NFTA_CT_EXPECT_DPORT, Data: binaryutil.BigEndian.PutUint16(c.DPort)},
+		{Type: NFTA_CT_EXPECT_TIMEOUT, Data: binaryutil.BigEndian.PutUint32(c.Timeout)},
+		{Type: NFTA_CT_EXPECT_SIZE, Data: []byte{c.Size}},
+	}
+
+	if c.L3Proto != 0 {
+		attr := netlink.Attribute{Type: NFTA_CT_EXPECT_L3PROTO, Data: binaryutil.BigEndian.PutUint16(c.L3Proto)}
+		exprData = append(exprData, attr)
+	}
+	return netlink.MarshalAttributes(exprData)
+}
+
+func (c *CtExpect) unmarshal(fam byte, data []byte) error {
+	ad, err := netlink.NewAttributeDecoder(data)
+	if err != nil {
+		return err
+	}
+	ad.ByteOrder = binary.BigEndian
+	for ad.Next() {
+		switch ad.Type() {
+		case NFTA_CT_EXPECT_L3PROTO:
+			c.L3Proto = ad.Uint16()
+		case NFTA_CT_EXPECT_L4PROTO:
+			c.L4Proto = ad.Uint8()
+		case NFTA_CT_EXPECT_DPORT:
+			c.DPort = ad.Uint16()
+		case NFTA_CT_EXPECT_TIMEOUT:
+			c.Timeout = ad.Uint32()
+		case NFTA_CT_EXPECT_SIZE:
+			c.Size = ad.Uint8()
+		}
+	}
+	return ad.Err()
+}

expr/expr.go

@@ -201,6 +201,8 @@ func exprFromName(name string) Any {
 		e = &CtHelper{}
 	case "synproxy":
 		e = &SynProxy{}
+	case "ctexpect":
+		e = &CtExpect{}
 	}
 	return e
 }

nftables_test.go

@@ -1428,7 +1428,6 @@ func TestSynProxyObject(t *testing.T) {
 	conn.AddObj(syn1)
 	conn.AddObj(syn2)
 	conn.AddObj(syn3)
-
 	if err := conn.Flush(); err != nil {
 		t.Fatalf(err.Error())
 	}
@@ -1437,7 +1436,6 @@ func TestSynProxyObject(t *testing.T) {
 	if err != nil {
 		t.Errorf("c.GetObjects(table) failed: %v", err)
 	}
-
 	if got, want := len(objs), 3; got != want {
 		t.Fatalf("received %d objects, expected %d", got, want)
 	}
@@ -1481,6 +1479,74 @@ func TestSynProxyObject(t *testing.T) {
 	}
 }
 
+func TestCtExpect(t *testing.T) {
+	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
+	defer nftest.CleanupSystemConn(t, newNS)
+	conn.FlushRuleset()
+	defer conn.FlushRuleset()
+
+	table := conn.AddTable(&nftables.Table{
+		Family: nftables.TableFamilyIPv4,
+		Name:   "filter",
+	})
+
+	cte := &nftables.NamedObj{
+		Table: table,
+		Name:  "expect",
+		Type:  nftables.ObjTypeCtExpect,
+		Obj: &expr.CtExpect{
+			L3Proto: unix.NFPROTO_IPV4,
+			L4Proto: unix.IPPROTO_TCP,
+			DPort:   53,
+			Timeout: 20,
+			Size:    100,
+		},
+	}
+
+	conn.AddObj(cte)
+	if err := conn.Flush(); err != nil {
+		t.Fatalf(err.Error())
+	}
+
+	objs, err := conn.GetNamedObjects(table)
+	if err != nil {
+		t.Errorf("c.GetObjects(table) failed: %v", err)
+	}
+
+	if got, want := len(objs), 1; got != want {
+		t.Fatalf("received %d objects, expected %d", got, want)
+	}
+
+	obj := objs[0].(*nftables.NamedObj)
+	if got, want := obj.Name, cte.Name; got != want {
+		t.Errorf("object names are not equal: got %s, want %s", got, want)
+	}
+	if got, want := obj.Type, cte.Type; got != want {
+		t.Errorf("object types are not equal: got %v, want %v", got, want)
+	}
+	if got, want := obj.Table.Name, cte.Table.Name; got != want {
+		t.Errorf("object tables are not equal: got %s, want %s", got, want)
+	}
+
+	ce1 := obj.Obj.(*expr.CtExpect)
+	ce2 := cte.Obj.(*expr.CtExpect)
+	if got, want := ce1.L3Proto, ce2.L3Proto; got != want {
+		t.Errorf("object l3proto not equal: got %d, want %d", got, want)
+	}
+	if got, want := ce1.L4Proto, ce2.L4Proto; got != want {
+		t.Errorf("object l4proto not equal: got %d, want %d", got, want)
+	}
+	if got, want := ce1.DPort, ce2.DPort; got != want {
+		t.Errorf("object dport not equal: got %d, want %d", got, want)
+	}
+	if got, want := ce1.Size, ce2.Size; got != want {
+		t.Errorf("object Size not equal: got %d, want %d", got, want)
+	}
+	if got, want := ce1.Timeout, ce2.Timeout; got != want {
+		t.Errorf("object timeout not equal: got %d, want %d", got, want)
+	}
+}
+
 func TestCtHelper(t *testing.T) {
 	conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
 	defer nftest.CleanupSystemConn(t, newNS)
@@ -3498,6 +3564,66 @@ func TestCreateUseNamedSet(t *testing.T) {
 	}
 }
 
+func TestCreateAutoMergeSet(t *testing.T) {
+	// Create a new network namespace to test these operations,
+	// and tear down the namespace at test completion.
+	c, newNS := nftest.OpenSystemConn(t, *enableSysTests)
+	defer nftest.CleanupSystemConn(t, newNS)
+	// Clear all rules at the beginning + end of the test.
+	c.FlushRuleset()
+	defer c.FlushRuleset()
+
+	filter := c.AddTable(&nftables.Table{
+		Family: nftables.TableFamilyIPv4,
+		Name:   "filter",
+	})
+
+	portSet := &nftables.Set{
+		Table:     filter,
+		Name:      "test",
+		KeyType:   nftables.TypeInetService,
+		Interval:  true,
+		AutoMerge: true,
+	}
+	if err := c.AddSet(portSet, nil); err != nil {
+		t.Errorf("c.AddSet(portSet) failed: %v", err)
+	}
+	if err := c.SetAddElements(portSet, []nftables.SetElement{{Key: binaryutil.BigEndian.PutUint16(22)}}); err != nil {
+		t.Errorf("c.SetVal(portSet) failed: %v", err)
+	}
+
+	ipSet := &nftables.Set{
+		Table:     filter,
+		Name:      "IPs_4_dayz",
+		KeyType:   nftables.TypeIPAddr,
+		Interval:  true,
+		AutoMerge: true,
+	}
+	if err := c.AddSet(ipSet, []nftables.SetElement{{Key: []byte(net.ParseIP("192.168.1.64").To4())}}); err != nil {
+		t.Errorf("c.AddSet(ipSet) failed: %v", err)
+	}
+	if err := c.SetAddElements(ipSet, []nftables.SetElement{{Key: []byte(net.ParseIP("192.168.1.42").To4())}}); err != nil {
+		t.Errorf("c.SetVal(ipSet) failed: %v", err)
+	}
+	if err := c.Flush(); err != nil {
+		t.Errorf("c.Flush() failed: %v", err)
+	}
+
+	sets, err := c.GetSets(filter)
+	if err != nil {
+		t.Errorf("c.GetSets() failed: %v", err)
+	}
+	if len(sets) != 2 {
+		t.Fatalf("len(sets) = %d, want 2", len(sets))
+	}
+	if !sets[0].AutoMerge {
+		t.Errorf("set[0].AutoMerge = %v, want true", sets[0].AutoMerge)
+	}
+	if !sets[1].AutoMerge {
+		t.Errorf("set[1].AutoMerge = %v, want true", sets[1].AutoMerge)
+	}
+}
+
 func TestIP6SetAddElements(t *testing.T) {
 	// Create a new network namespace to test these operations,
 	// and tear down the namespace at test completion.

obj.go

@@ -55,8 +55,8 @@ var objByObjTypeMagic = map[ObjType]string{
 	ObjTypeTunnel:    "tunnel",    // not implemented in expr
 	ObjTypeCtTimeout: "cttimeout", // not implemented in expr
 	ObjTypeSecMark:   "secmark",   // not implemented in expr
-	ObjTypeCtExpect:  "ctexpect",  // not implemented in expr
-	ObjTypeSynProxy:  "synproxy",  // not implemented in expr
+	ObjTypeCtExpect:  "ctexpect",
+	ObjTypeSynProxy:  "synproxy",
 }
 
 // Obj represents a netfilter stateful object. See also

set.go

@@ -21,10 +21,10 @@ import (
 	"strings"
 	"time"
 
+	"github.com/google/nftables/binaryutil"
 	"github.com/google/nftables/expr"
 	"github.com/google/nftables/internal/parseexprfunc"
-
-	"github.com/google/nftables/binaryutil"
+	"github.com/google/nftables/userdata"
 	"github.com/mdlayher/netlink"
 	"golang.org/x/sys/unix"
 )
@@ -249,6 +249,7 @@ type Set struct {
 	Anonymous  bool
 	Constant   bool
 	Interval   bool
+	AutoMerge  bool
 	IsMap      bool
 	HasTimeout bool
 	Counter    bool
@@ -580,15 +581,27 @@ func (cc *Conn) AddSet(s *Set, vals []SetElement) error {
 		// Marshal concat size description as set description
 		tableInfo = append(tableInfo, netlink.Attribute{Type: unix.NLA_F_NESTED | unix.NFTA_SET_DESC, Data: concatBytes})
 	}
+
+	// https://git.netfilter.org/libnftnl/tree/include/udata.h#n17
+	var userData []byte
+
 	if s.Anonymous || s.Constant || s.Interval || s.KeyByteOrder == binaryutil.BigEndian {
-		tableInfo = append(tableInfo,
-			// Semantically useless - kept for binary compatability with nft
-			netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: []byte("\x00\x04\x02\x00\x00\x00")})
+		// Semantically useless - kept for binary compatability with nft
+		userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_KEYBYTEORDER, 2)
 	} else if s.KeyByteOrder == binaryutil.NativeEndian {
 		// Per https://git.netfilter.org/nftables/tree/src/mnl.c?id=187c6d01d35722618c2711bbc49262c286472c8f#n1165
-		tableInfo = append(tableInfo,
-			netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: []byte("\x00\x04\x01\x00\x00\x00")})
+		userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_KEYBYTEORDER, 1)
 	}
+
+	if s.Interval && s.AutoMerge {
+		// https://git.netfilter.org/nftables/tree/src/mnl.c?id=187c6d01d35722618c2711bbc49262c286472c8f#n1174
+		userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_MERGE_ELEMENTS, 1)
+	}
+
+	if len(userData) > 0 {
+		tableInfo = append(tableInfo, netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: userData})
+	}
+
 	if s.Counter {
 		data, err := netlink.MarshalAttributes([]netlink.Attribute{
 			{Type: unix.NFTA_LIST_ELEM, Data: []byte("counter\x00")},
@@ -740,6 +753,10 @@ func setsFromMsg(msg netlink.Message) (*Set, error) {
 			set.DataType = dt
 		case unix.NFTA_SET_DATA_LEN:
 			set.DataType.Bytes = binary.BigEndian.Uint32(ad.Bytes())
+		case unix.NFTA_SET_USERDATA:
+			data := ad.Bytes()
+			value, ok := userdata.GetUint32(data, userdata.NFTNL_UDATA_SET_MERGE_ELEMENTS)
+			set.AutoMerge = ok && value == 1
 		}
 	}
 	return &set, nil

userdata/userdata.go

@@ -31,6 +31,21 @@ const (
 	TypesCount
 )
 
+// TLV type values are defined in:
+// https://git.netfilter.org/libnftnl/tree/include/libnftnl/udata.h#n39
+const (
+	NFTNL_UDATA_SET_KEYBYTEORDER Type = iota
+	NFTNL_UDATA_SET_DATABYTEORDER
+	NFTNL_UDATA_SET_MERGE_ELEMENTS
+	NFTNL_UDATA_SET_KEY_TYPEOF
+	NFTNL_UDATA_SET_DATA_TYPEOF
+	NFTNL_UDATA_SET_EXPR
+	NFTNL_UDATA_SET_DATA_INTERVAL
+	NFTNL_UDATA_SET_COMMENT
+
+	NFTNL_UDATA_SET_MAX
+)
+
 func Append(udata []byte, typ Type, data []byte) []byte {
 	udata = append(udata, byte(typ), byte(len(data)))
 	udata = append(udata, data...)