interesting
/
nftables
mirror of https://github.com/google/nftables.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Compare commits

base: interesting:ae8f84674dee9ee04f789519b2a8d93d493bcee8
Branches Tags
interesting:main
interesting:v0.3.0
interesting:v0.2.0
interesting:v0.1.0
..
compare: interesting:06c1ca210e96eb449a34209d3fdd811dc661b29f
Branches Tags
interesting:main
interesting:v0.3.0
interesting:v0.2.0
interesting:v0.1.0

1 Commits
ae8f84674d ... 06c1ca210e

Author SHA1 Message Date
Aleksei Ilin 06c1ca210e ct: Specify direction for saddr, daddr, proto-src, proto-dst 
The CT keys require direction parameter.
 2024-07-22 02:38:59 +02:00
40 changed files with 426 additions and 1268 deletions
Show Stats Expand all files Collapse all files

36
counter.go
View File

@ -15,11 +15,12 @@
package nftables
import (
"github.com/google/nftables/expr"
"github.com/google/nftables/binaryutil"
"github.com/mdlayher/netlink"
"golang.org/x/sys/unix"
)
// CounterObj implements Obj.
type CounterObj struct {
Table *Table
Name string // e.g. “fwded”
@ -40,20 +41,6 @@ func (c *CounterObj) unmarshal(ad *netlink.AttributeDecoder) error {
return ad.Err()
}
func (c *CounterObj) data() expr.Any {
return &expr.Counter{
Bytes: c.Bytes,
Packets: c.Packets,
}
}
func (c *CounterObj) name() string {
return c.Name
}
func (c *CounterObj) objType() ObjType {
return ObjTypeCounter
}
func (c *CounterObj) table() *Table {
return c.Table
}
@ -61,3 +48,22 @@ func (c *CounterObj) table() *Table {
func (c *CounterObj) family() TableFamily {
return c.Table.Family
}
func (c *CounterObj) marshal(data bool) ([]byte, error) {
obj, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_COUNTER_BYTES, Data: binaryutil.BigEndian.PutUint64(c.Bytes)},
{Type: unix.NFTA_COUNTER_PACKETS, Data: binaryutil.BigEndian.PutUint64(c.Packets)},
})
if err != nil {
return nil, err
}
attrs := []netlink.Attribute{
{Type: unix.NFTA_OBJ_TABLE, Data: []byte(c.Table.Name + "\x00")},
{Type: unix.NFTA_OBJ_NAME, Data: []byte(c.Name + "\x00")},
{Type: unix.NFTA_OBJ_TYPE, Data: binaryutil.BigEndian.PutUint32(unix.NFT_OBJECT_COUNTER)},
}
if data {
attrs = append(attrs, netlink.Attribute{Type: unix.NLA_F_NESTED | unix.NFTA_OBJ_DATA, Data: obj})
}
return netlink.MarshalAttributes(attrs)
}

20
expr/bitwise.go
View File

@ -31,17 +31,6 @@ type Bitwise struct {
}
func (e *Bitwise) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("bitwise\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Bitwise) marshalData(fam byte) ([]byte, error) {
mask, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_DATA_VALUE, Data: e.Mask},
})
@ -55,13 +44,20 @@ func (e *Bitwise) marshalData(fam byte) ([]byte, error) {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_BITWISE_SREG, Data: binaryutil.BigEndian.PutUint32(e.SourceRegister)},
{Type: unix.NFTA_BITWISE_DREG, Data: binaryutil.BigEndian.PutUint32(e.DestRegister)},
{Type: unix.NFTA_BITWISE_LEN, Data: binaryutil.BigEndian.PutUint32(e.Len)},
{Type: unix.NLA_F_NESTED | unix.NFTA_BITWISE_MASK, Data: mask},
{Type: unix.NLA_F_NESTED | unix.NFTA_BITWISE_XOR, Data: xor},
})
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("bitwise\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Bitwise) unmarshal(fam byte, data []byte) error {

18
expr/byteorder.go
View File

@ -38,7 +38,13 @@ type Byteorder struct {
}
func (e *Byteorder) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_BYTEORDER_SREG, Data: binaryutil.BigEndian.PutUint32(e.SourceRegister)},
{Type: unix.NFTA_BYTEORDER_DREG, Data: binaryutil.BigEndian.PutUint32(e.DestRegister)},
{Type: unix.NFTA_BYTEORDER_OP, Data: binaryutil.BigEndian.PutUint32(uint32(e.Op))},
{Type: unix.NFTA_BYTEORDER_LEN, Data: binaryutil.BigEndian.PutUint32(e.Len)},
{Type: unix.NFTA_BYTEORDER_SIZE, Data: binaryutil.BigEndian.PutUint32(e.Size)},
})
if err != nil {
return nil, err
}
@ -48,16 +54,6 @@ func (e *Byteorder) marshal(fam byte) ([]byte, error) {
})
}
func (e *Byteorder) marshalData(fam byte) ([]byte, error) {
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_BYTEORDER_SREG, Data: binaryutil.BigEndian.PutUint32(e.SourceRegister)},
{Type: unix.NFTA_BYTEORDER_DREG, Data: binaryutil.BigEndian.PutUint32(e.DestRegister)},
{Type: unix.NFTA_BYTEORDER_OP, Data: binaryutil.BigEndian.PutUint32(uint32(e.Op))},
{Type: unix.NFTA_BYTEORDER_LEN, Data: binaryutil.BigEndian.PutUint32(e.Len)},
{Type: unix.NFTA_BYTEORDER_SIZE, Data: binaryutil.BigEndian.PutUint32(e.Size)},
})
}
func (e *Byteorder) unmarshal(fam byte, data []byte) error {
return fmt.Errorf("not yet implemented")
}

12
expr/connlimit.go
View File

@ -37,7 +37,10 @@ type Connlimit struct {
}
func (e *Connlimit) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: NFTA_CONNLIMIT_COUNT, Data: binaryutil.BigEndian.PutUint32(e.Count)},
{Type: NFTA_CONNLIMIT_FLAGS, Data: binaryutil.BigEndian.PutUint32(e.Flags)},
})
if err != nil {
return nil, err
}
@ -48,13 +51,6 @@ func (e *Connlimit) marshal(fam byte) ([]byte, error) {
})
}
func (e *Connlimit) marshalData(fam byte) ([]byte, error) {
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: NFTA_CONNLIMIT_COUNT, Data: binaryutil.BigEndian.PutUint32(e.Count)},
{Type: NFTA_CONNLIMIT_FLAGS, Data: binaryutil.BigEndian.PutUint32(e.Flags)},
})
}
func (e *Connlimit) unmarshal(fam byte, data []byte) error {
ad, err := netlink.NewAttributeDecoder(data)
if err != nil {

12
expr/counter.go
View File

@ -28,7 +28,10 @@ type Counter struct {
}
func (e *Counter) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_COUNTER_BYTES, Data: binaryutil.BigEndian.PutUint64(e.Bytes)},
{Type: unix.NFTA_COUNTER_PACKETS, Data: binaryutil.BigEndian.PutUint64(e.Packets)},
})
if err != nil {
return nil, err
}
@ -39,13 +42,6 @@ func (e *Counter) marshal(fam byte) ([]byte, error) {
})
}
func (e *Counter) marshalData(fam byte) ([]byte, error) {
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_COUNTER_BYTES, Data: binaryutil.BigEndian.PutUint64(e.Bytes)},
{Type: unix.NFTA_COUNTER_PACKETS, Data: binaryutil.BigEndian.PutUint64(e.Packets)},
})
}
func (e *Counter) unmarshal(fam byte, data []byte) error {
ad, err := netlink.NewAttributeDecoder(data)
if err != nil {

19
expr/ct.go
View File

@ -65,19 +65,7 @@ type Ct struct {
}
func (e *Ct) marshal(fam byte) ([]byte, error) {
exprData, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("ct\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
})
}
func (e *Ct) marshalData(fam byte) ([]byte, error) {
var regData []byte
regData := []byte{}
exprData, err := netlink.MarshalAttributes(
[]netlink.Attribute{
{Type: unix.NFTA_CT_KEY, Data: binaryutil.BigEndian.PutUint32(uint32(e.Key))},
@ -117,7 +105,10 @@ func (e *Ct) marshalData(fam byte) ([]byte, error) {
exprData = append(exprData, regData...)
}
return exprData, nil
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("ct\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
})
}
func (e *Ct) unmarshal(fam byte, data []byte) error {

69
expr/ct_test.go
View File

@ -1,69 +0,0 @@
package expr
import (
"encoding/binary"
"reflect"
"testing"
"github.com/mdlayher/netlink"
"golang.org/x/sys/unix"
)
func TestCt(t *testing.T) {
t.Parallel()
tests := []struct {
name string
ct Ct
}{
{
name: "Unmarshal Ct status case",
ct: Ct{
Register: 1,
Key: CtKeySTATUS,
},
},
{
name: "Unmarshal Ct proto-dst direction original case",
ct: Ct{
Register: 1,
Key: CtKeyPROTODST,
Direction: 0, // direction: original
},
},
{
name: "Unmarshal Ct src direction reply case",
ct: Ct{
Register: 1,
Key: CtKeySRC,
Direction: 1, // direction: reply
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
nct := Ct{}
data, err := tt.ct.marshal(0 /* don't care in this test */)
if err != nil {
t.Fatalf("marshal error: %+v", err)
}
ad, err := netlink.NewAttributeDecoder(data)
if err != nil {
t.Fatalf("NewAttributeDecoder() error: %+v", err)
}
ad.ByteOrder = binary.BigEndian
for ad.Next() {
if ad.Type() == unix.NFTA_EXPR_DATA {
if err := nct.unmarshal(0, ad.Bytes()); err != nil {
t.Errorf("unmarshal error: %+v", err)
break
}
}
}
if !reflect.DeepEqual(tt.ct, nct) {
t.Fatalf("original %+v and recovered %+v Ct structs are different", tt.ct, nct)
}
})
}
}

23
expr/dup.go
View File

@ -29,18 +29,6 @@ type Dup struct {
}
func (e *Dup) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("dup\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Dup) marshalData(fam byte) ([]byte, error) {
attrs := []netlink.Attribute{
{Type: unix.NFTA_DUP_SREG_ADDR, Data: binaryutil.BigEndian.PutUint32(e.RegAddr)},
}
@ -49,7 +37,16 @@ func (e *Dup) marshalData(fam byte) ([]byte, error) {
attrs = append(attrs, netlink.Attribute{Type: unix.NFTA_DUP_SREG_DEV, Data: binaryutil.BigEndian.PutUint32(e.RegDev)})
}
return netlink.MarshalAttributes(attrs)
data, err := netlink.MarshalAttributes(attrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("dup\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Dup) unmarshal(fam byte, data []byte) error {

26
expr/dynset.go
View File

@ -44,18 +44,6 @@ type Dynset struct {
}
func (e *Dynset) marshal(fam byte) ([]byte, error) {
opData, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("dynset\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: opData},
})
}
func (e *Dynset) marshalData(fam byte) ([]byte, error) {
// See: https://git.netfilter.org/libnftnl/tree/src/expr/dynset.c
var opAttrs []netlink.Attribute
opAttrs = append(opAttrs, netlink.Attribute{Type: unix.NFTA_DYNSET_SREG_KEY, Data: binaryutil.BigEndian.PutUint32(e.SrcRegKey)})
@ -101,9 +89,17 @@ func (e *Dynset) marshalData(fam byte) ([]byte, error) {
opAttrs = append(opAttrs, netlink.Attribute{Type: NFTA_DYNSET_EXPRESSIONS, Data: elemData})
}
}
opAttrs = append(opAttrs, netlink.Attribute{Type: unix.NFTA_DYNSET_FLAGS, Data: binaryutil.BigEndian.PutUint32(flags)})
return netlink.MarshalAttributes(opAttrs)
opData, err := netlink.MarshalAttributes(opAttrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("dynset\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: opData},
})
}
func (e *Dynset) unmarshal(fam byte, data []byte) error {
@ -129,7 +125,7 @@ func (e *Dynset) unmarshal(fam byte, data []byte) error {
case unix.NFTA_DYNSET_FLAGS:
e.Invert = (ad.Uint32() & unix.NFT_DYNSET_F_INV) != 0
case unix.NFTA_DYNSET_EXPR:
exprs, err := parseexprfunc.ParseExprBytesFunc(fam, ad)
exprs, err := parseexprfunc.ParseExprBytesFunc(fam, ad, ad.Bytes())
if err != nil {
return err
}

154
expr/expr.go
View File

@ -25,8 +25,8 @@ import (
)
func init() {
parseExprBytesCommonFunc := func(exprsFromBytesFunc func() ([]Any, error)) ([]interface{}, error) {
exprs, err := exprsFromBytesFunc()
parseexprfunc.ParseExprBytesFunc = func(fam byte, ad *netlink.AttributeDecoder, b []byte) ([]interface{}, error) {
exprs, err := exprsFromBytes(fam, ad, b)
if err != nil {
return nil, err
}
@ -36,17 +36,6 @@ func init() {
}
return result, nil
}
parseexprfunc.ParseExprBytesFromNameFunc = func(fam byte, ad *netlink.AttributeDecoder, exprName string) ([]interface{}, error) {
return parseExprBytesCommonFunc(func() ([]Any, error) {
return exprsBytesFromName(fam, ad, exprName)
})
}
parseexprfunc.ParseExprBytesFunc = func(fam byte, ad *netlink.AttributeDecoder) ([]interface{}, error) {
return parseExprBytesCommonFunc(func() ([]Any, error) {
return exprsFromBytes(fam, ad)
})
}
parseexprfunc.ParseExprMsgFunc = func(fam byte, b []byte) ([]interface{}, error) {
ad, err := netlink.NewAttributeDecoder(b)
if err != nil {
@ -55,7 +44,7 @@ func init() {
ad.ByteOrder = binary.BigEndian
var exprs []interface{}
for ad.Next() {
e, err := parseexprfunc.ParseExprBytesFunc(fam, ad)
e, err := parseexprfunc.ParseExprBytesFunc(fam, ad, b)
if err != nil {
return e, err
}
@ -70,35 +59,15 @@ func Marshal(fam byte, e Any) ([]byte, error) {
return e.marshal(fam)
}
func MarshalExprData(fam byte, e Any) ([]byte, error) {
return e.marshalData(fam)
}
// Unmarshal fills an expression from the specified byte slice.
func Unmarshal(fam byte, data []byte, e Any) error {
return e.unmarshal(fam, data)
}
// exprsBytesFromName parses raw expressions bytes
// based on provided expr name
func exprsBytesFromName(fam byte, ad *netlink.AttributeDecoder, name string) ([]Any, error) {
var exprs []Any
e := exprFromName(name)
ad.Do(func(b []byte) error {
if err := Unmarshal(fam, b, e); err != nil {
return err
}
exprs = append(exprs, e)
return nil
})
return exprs, ad.Err()
}
// exprsFromBytes parses nested raw expressions bytes
// to construct nftables expressions
func exprsFromBytes(fam byte, ad *netlink.AttributeDecoder) ([]Any, error) {
func exprsFromBytes(fam byte, ad *netlink.AttributeDecoder, b []byte) ([]Any, error) {
var exprs []Any
ad.Do(func(b []byte) error {
ad, err := netlink.NewAttributeDecoder(b)
if err != nil {
@ -115,36 +84,6 @@ func exprsFromBytes(fam byte, ad *netlink.AttributeDecoder) ([]Any, error) {
exprs = append(exprs, e)
}
case unix.NFTA_EXPR_DATA:
e := exprFromName(name)
if e == nil {
// TODO: introduce an opaque expression type so that users know
// something is here.
continue // unsupported expression type
}
ad.Do(func(b []byte) error {
if err := Unmarshal(fam, b, e); err != nil {
return err
}
// Verdict expressions are a special-case of immediate expressions, so
// if the expression is an immediate writing nothing into the verdict
// register (invalid), re-parse it as a verdict expression.
if imm, isImmediate := e.(*Immediate); isImmediate && imm.Register == unix.NFT_REG_VERDICT && len(imm.Data) == 0 {
e = &Verdict{}
if err := Unmarshal(fam, b, e); err != nil {
return err
}
}
exprs = append(exprs, e)
return nil
})
}
}
return ad.Err()
})
return exprs, ad.Err()
}
func exprFromName(name string) Any {
var e Any
switch name {
case "ct":
@ -198,13 +137,38 @@ func exprFromName(name string) Any {
case "hash":
e = &Hash{}
}
return e
if e == nil {
// TODO: introduce an opaque expression type so that users know
// something is here.
continue // unsupported expression type
}
ad.Do(func(b []byte) error {
if err := Unmarshal(fam, b, e); err != nil {
return err
}
// Verdict expressions are a special-case of immediate expressions, so
// if the expression is an immediate writing nothing into the verdict
// register (invalid), re-parse it as a verdict expression.
if imm, isImmediate := e.(*Immediate); isImmediate && imm.Register == unix.NFT_REG_VERDICT && len(imm.Data) == 0 {
e = &Verdict{}
if err := Unmarshal(fam, b, e); err != nil {
return err
}
}
exprs = append(exprs, e)
return nil
})
}
}
return ad.Err()
})
return exprs, ad.Err()
}
// Any is an interface implemented by any expression type.
type Any interface {
marshal(fam byte) ([]byte, error)
marshalData(fam byte) ([]byte, error)
unmarshal(fam byte, data []byte) error
}
@ -250,19 +214,7 @@ type Meta struct {
}
func (e *Meta) marshal(fam byte) ([]byte, error) {
exprData, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("meta\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
})
}
func (e *Meta) marshalData(fam byte) ([]byte, error) {
var regData []byte
regData := []byte{}
exprData, err := netlink.MarshalAttributes(
[]netlink.Attribute{
{Type: unix.NFTA_META_KEY, Data: binaryutil.BigEndian.PutUint32(uint32(e.Key))},
@ -288,7 +240,11 @@ func (e *Meta) marshalData(fam byte) ([]byte, error) {
return nil, err
}
exprData = append(exprData, regData...)
return exprData, nil
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("meta\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
})
}
func (e *Meta) unmarshal(fam byte, data []byte) error {
@ -335,17 +291,6 @@ const (
)
func (e *Masq) marshal(fam byte) ([]byte, error) {
msgData, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("masq\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: msgData},
})
}
func (e *Masq) marshalData(fam byte) ([]byte, error) {
msgData := []byte{}
if !e.ToPorts {
flags := uint32(0)
@ -382,7 +327,10 @@ func (e *Masq) marshalData(fam byte) ([]byte, error) {
msgData = append(msgData, regsData...)
}
}
return msgData, nil
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("masq\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: msgData},
})
}
func (e *Masq) unmarshal(fam byte, data []byte) error {
@ -429,28 +377,24 @@ type Cmp struct {
}
func (e *Cmp) marshal(fam byte) ([]byte, error) {
exprData, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("cmp\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
})
}
func (e *Cmp) marshalData(fam byte) ([]byte, error) {
cmpData, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_DATA_VALUE, Data: e.Data},
})
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
exprData, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_CMP_SREG, Data: binaryutil.BigEndian.PutUint32(e.Register)},
{Type: unix.NFTA_CMP_OP, Data: binaryutil.BigEndian.PutUint32(uint32(e.Op))},
{Type: unix.NLA_F_NESTED | unix.NFTA_CMP_DATA, Data: cmpData},
})
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("cmp\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
})
}
func (e *Cmp) unmarshal(fam byte, data []byte) error {

20
expr/exthdr.go
View File

@ -40,17 +40,6 @@ type Exthdr struct {
}
func (e *Exthdr) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("exthdr\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Exthdr) marshalData(fam byte) ([]byte, error) {
var attr []netlink.Attribute
// Operations are differentiated by the Op and whether the SourceRegister
@ -75,7 +64,14 @@ func (e *Exthdr) marshalData(fam byte) ([]byte, error) {
netlink.Attribute{Type: unix.NFTA_EXTHDR_FLAGS, Data: binaryutil.BigEndian.PutUint32(e.Flags)})
}
return netlink.MarshalAttributes(attr)
data, err := netlink.MarshalAttributes(attr)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("exthdr\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Exthdr) unmarshal(fam byte, data []byte) error {

17
expr/fib.go
View File

@ -37,17 +37,6 @@ type Fib struct {
}
func (e *Fib) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("fib\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Fib) marshalData(fam byte) ([]byte, error) {
data := []byte{}
reg, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_FIB_DREG, Data: binaryutil.BigEndian.PutUint32(e.Register)},
@ -103,7 +92,11 @@ func (e *Fib) marshalData(fam byte) ([]byte, error) {
}
data = append(data, rslt...)
}
return data, nil
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("fib\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Fib) unmarshal(fam byte, data []byte) error {

10
expr/flow_offload.go
View File

@ -28,7 +28,9 @@ type FlowOffload struct {
}
func (e *FlowOffload) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: NFTNL_EXPR_FLOW_TABLE_NAME, Data: []byte(e.Name)},
})
if err != nil {
return nil, err
}
@ -39,12 +41,6 @@ func (e *FlowOffload) marshal(fam byte) ([]byte, error) {
})
}
func (e *FlowOffload) marshalData(fam byte) ([]byte, error) {
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: NFTNL_EXPR_FLOW_TABLE_NAME, Data: []byte(e.Name)},
})
}
func (e *FlowOffload) unmarshal(fam byte, data []byte) error {
ad, err := netlink.NewAttributeDecoder(data)
if err != nil {

20
expr/hash.go
View File

@ -41,17 +41,6 @@ type Hash struct {
}
func (e *Hash) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("hash\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Hash) marshalData(fam byte) ([]byte, error) {
hashAttrs := []netlink.Attribute{
{Type: unix.NFTA_HASH_SREG, Data: binaryutil.BigEndian.PutUint32(uint32(e.SourceRegister))},
{Type: unix.NFTA_HASH_DREG, Data: binaryutil.BigEndian.PutUint32(uint32(e.DestRegister))},
@ -67,7 +56,14 @@ func (e *Hash) marshalData(fam byte) ([]byte, error) {
{Type: unix.NFTA_HASH_OFFSET, Data: binaryutil.BigEndian.PutUint32(uint32(e.Offset))},
{Type: unix.NFTA_HASH_TYPE, Data: binaryutil.BigEndian.PutUint32(uint32(e.Type))},
}...)
return netlink.MarshalAttributes(hashAttrs)
data, err := netlink.MarshalAttributes(hashAttrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("hash\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Hash) unmarshal(fam byte, data []byte) error {

20
expr/immediate.go
View File

@ -29,17 +29,6 @@ type Immediate struct {
}
func (e *Immediate) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("immediate\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Immediate) marshalData(fam byte) ([]byte, error) {
immData, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_DATA_VALUE, Data: e.Data},
})
@ -47,10 +36,17 @@ func (e *Immediate) marshalData(fam byte) ([]byte, error) {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_IMMEDIATE_DREG, Data: binaryutil.BigEndian.PutUint32(e.Register)},
{Type: unix.NLA_F_NESTED | unix.NFTA_IMMEDIATE_DATA, Data: immData},
})
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("immediate\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Immediate) unmarshal(fam byte, data []byte) error {

22
expr/limit.go
View File

@ -72,18 +72,6 @@ type Limit struct {
}
func (l *Limit) marshal(fam byte) ([]byte, error) {
data, err := l.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("limit\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (l *Limit) marshalData(fam byte) ([]byte, error) {
var flags uint32
if l.Over {
flags = unix.NFT_LIMIT_F_INV
@ -96,7 +84,15 @@ func (l *Limit) marshalData(fam byte) ([]byte, error) {
{Type: unix.NFTA_LIMIT_FLAGS, Data: binaryutil.BigEndian.PutUint32(flags)},
}
return netlink.MarshalAttributes(attrs)
data, err := netlink.MarshalAttributes(attrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("limit\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (l *Limit) unmarshal(fam byte, data []byte) error {

22
expr/log.go
View File

@ -69,18 +69,6 @@ type Log struct {
}
func (e *Log) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("log\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Log) marshalData(fam byte) ([]byte, error) {
// Per https://git.netfilter.org/libnftnl/tree/src/expr/log.c?id=09456c720e9c00eecc08e41ac6b7c291b3821ee5#n129
attrs := make([]netlink.Attribute, 0)
if e.Key&(1<<unix.NFTA_LOG_GROUP) != 0 {
@ -121,7 +109,15 @@ func (e *Log) marshalData(fam byte) ([]byte, error) {
})
}
return netlink.MarshalAttributes(attrs)
data, err := netlink.MarshalAttributes(attrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("log\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Log) unmarshal(fam byte, data []byte) error {

22
expr/lookup.go
View File

@ -34,18 +34,6 @@ type Lookup struct {
}
func (e *Lookup) marshal(fam byte) ([]byte, error) {
opData, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("lookup\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: opData},
})
}
func (e *Lookup) marshalData(fam byte) ([]byte, error) {
// See: https://git.netfilter.org/libnftnl/tree/src/expr/lookup.c?id=6dc1c3d8bb64077da7f3f28c7368fb087d10a492#n115
var opAttrs []netlink.Attribute
if e.SourceRegister != 0 {
@ -61,7 +49,15 @@ func (e *Lookup) marshalData(fam byte) ([]byte, error) {
netlink.Attribute{Type: unix.NFTA_LOOKUP_SET, Data: []byte(e.SetName + "\x00")},
netlink.Attribute{Type: unix.NFTA_LOOKUP_SET_ID, Data: binaryutil.BigEndian.PutUint32(e.SetID)},
)
return netlink.MarshalAttributes(opAttrs)
opData, err := netlink.MarshalAttributes(opAttrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("lookup\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: opData},
})
}
func (e *Lookup) unmarshal(fam byte, data []byte) error {

21
expr/match.go
View File

@ -18,17 +18,6 @@ type Match struct {
}
func (e *Match) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("match\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Match) marshalData(fam byte) ([]byte, error) {
// Per https://git.netfilter.org/libnftnl/tree/src/expr/match.c?id=09456c720e9c00eecc08e41ac6b7c291b3821ee5#n38
name := e.Name
// limit the extension name as (some) user-space tools do and leave room for
@ -47,7 +36,15 @@ func (e *Match) marshalData(fam byte) ([]byte, error) {
{Type: unix.NFTA_MATCH_REV, Data: binaryutil.BigEndian.PutUint32(e.Rev)},
{Type: unix.NFTA_MATCH_INFO, Data: info},
}
return netlink.MarshalAttributes(attrs)
data, err := netlink.MarshalAttributes(attrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("match\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Match) unmarshal(fam byte, data []byte) error {

20
expr/nat.go
View File

@ -57,17 +57,6 @@ type NAT struct {
// | 00 00 00 02 | | data | reg 2
func (e *NAT) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("nat\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *NAT) marshalData(fam byte) ([]byte, error) {
attrs := []netlink.Attribute{
{Type: unix.NFTA_NAT_TYPE, Data: binaryutil.BigEndian.PutUint32(uint32(e.Type))},
{Type: unix.NFTA_NAT_FAMILY, Data: binaryutil.BigEndian.PutUint32(e.Family)},
@ -101,7 +90,14 @@ func (e *NAT) marshalData(fam byte) ([]byte, error) {
attrs = append(attrs, netlink.Attribute{Type: unix.NFTA_NAT_FLAGS, Data: binaryutil.BigEndian.PutUint32(flags)})
}
return netlink.MarshalAttributes(attrs)
data, err := netlink.MarshalAttributes(attrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("nat\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *NAT) unmarshal(fam byte, data []byte) error {

4
expr/notrack.go
View File

@ -27,10 +27,6 @@ func (e *Notrack) marshal(fam byte) ([]byte, error) {
})
}
func (e *Notrack) marshalData(fam byte) ([]byte, error) {
return []byte("notrack\x00"), nil
}
func (e *Notrack) unmarshal(fam byte, data []byte) error {
ad, err := netlink.NewAttributeDecoder(data)

22
expr/numgen.go
View File

@ -32,18 +32,6 @@ type Numgen struct {
}
func (e *Numgen) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("numgen\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Numgen) marshalData(fam byte) ([]byte, error) {
// Currently only two types are supported, failing if Type is not of two known types
switch e.Type {
case unix.NFT_NG_INCREMENTAL:
@ -52,12 +40,20 @@ func (e *Numgen) marshalData(fam byte) ([]byte, error) {
return nil, fmt.Errorf("unsupported numgen type %d", e.Type)
}
return netlink.MarshalAttributes([]netlink.Attribute{
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_NG_DREG, Data: binaryutil.BigEndian.PutUint32(e.Register)},
{Type: unix.NFTA_NG_MODULUS, Data: binaryutil.BigEndian.PutUint32(e.Modulus)},
{Type: unix.NFTA_NG_TYPE, Data: binaryutil.BigEndian.PutUint32(e.Type)},
{Type: unix.NFTA_NG_OFFSET, Data: binaryutil.BigEndian.PutUint32(e.Offset)},
})
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("numgen\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Numgen) unmarshal(fam byte, data []byte) error {

12
expr/objref.go
View File

@ -28,7 +28,10 @@ type Objref struct {
}
func (e *Objref) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_OBJREF_IMM_TYPE, Data: binaryutil.BigEndian.PutUint32(uint32(e.Type))},
{Type: unix.NFTA_OBJREF_IMM_NAME, Data: []byte(e.Name)}, // NOT \x00-terminated?!
})
if err != nil {
return nil, err
}
@ -39,13 +42,6 @@ func (e *Objref) marshal(fam byte) ([]byte, error) {
})
}
func (e *Objref) marshalData(fam byte) ([]byte, error) {
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_OBJREF_IMM_TYPE, Data: binaryutil.BigEndian.PutUint32(uint32(e.Type))},
{Type: unix.NFTA_OBJREF_IMM_NAME, Data: []byte(e.Name)}, // NOT \x00-terminated?!
})
}
func (e *Objref) unmarshal(fam byte, data []byte) error {
ad, err := netlink.NewAttributeDecoder(data)
if err != nil {

21
expr/payload.go
View File

@ -58,18 +58,7 @@ type Payload struct {
}
func (e *Payload) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("payload\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Payload) marshalData(fam byte) ([]byte, error) {
var attrs []netlink.Attribute
if e.OperationType == PayloadWrite {
@ -100,7 +89,15 @@ func (e *Payload) marshalData(fam byte) ([]byte, error) {
}
}
return netlink.MarshalAttributes(attrs)
data, err := netlink.MarshalAttributes(attrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("payload\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Payload) unmarshal(fam byte, data []byte) error {

20
expr/queue.go
View File

@ -44,7 +44,14 @@ type Queue struct {
}
func (e *Queue) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if e.Total == 0 {
e.Total = 1 // The total default value is 1
}
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_QUEUE_NUM, Data: binaryutil.BigEndian.PutUint16(e.Num)},
{Type: unix.NFTA_QUEUE_TOTAL, Data: binaryutil.BigEndian.PutUint16(e.Total)},
{Type: unix.NFTA_QUEUE_FLAGS, Data: binaryutil.BigEndian.PutUint16(uint16(e.Flag))},
})
if err != nil {
return nil, err
}
@ -54,17 +61,6 @@ func (e *Queue) marshal(fam byte) ([]byte, error) {
})
}
func (e *Queue) marshalData(fam byte) ([]byte, error) {
if e.Total == 0 {
e.Total = 1 // The total default value is 1
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_QUEUE_NUM, Data: binaryutil.BigEndian.PutUint16(e.Num)},
{Type: unix.NFTA_QUEUE_TOTAL, Data: binaryutil.BigEndian.PutUint16(e.Total)},
{Type: unix.NFTA_QUEUE_FLAGS, Data: binaryutil.BigEndian.PutUint16(uint16(e.Flag))},
})
}
func (e *Queue) unmarshal(fam byte, data []byte) error {
ad, err := netlink.NewAttributeDecoder(data)
if err != nil {

22
expr/quota.go
View File

@ -30,18 +30,6 @@ type Quota struct {
}
func (q *Quota) marshal(fam byte) ([]byte, error) {
data, err := q.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("quota\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (q *Quota) marshalData(fam byte) ([]byte, error) {
attrs := []netlink.Attribute{
{Type: unix.NFTA_QUOTA_BYTES, Data: binaryutil.BigEndian.PutUint64(q.Bytes)},
{Type: unix.NFTA_QUOTA_CONSUMED, Data: binaryutil.BigEndian.PutUint64(q.Consumed)},
@ -56,7 +44,15 @@ func (q *Quota) marshalData(fam byte) ([]byte, error) {
Data: binaryutil.BigEndian.PutUint32(flags),
})
return netlink.MarshalAttributes(attrs)
data, err := netlink.MarshalAttributes(attrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("quota\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (q *Quota) unmarshal(fam byte, data []byte) error {

18
expr/range.go
View File

@ -31,18 +31,6 @@ type Range struct {
}
func (e *Range) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("range\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Range) marshalData(fam byte) ([]byte, error) {
var attrs []netlink.Attribute
var err error
var rangeFromData, rangeToData []byte
@ -69,7 +57,11 @@ func (e *Range) marshalData(fam byte) ([]byte, error) {
}
data = append(data, rangeFromData...)
data = append(data, rangeToData...)
return data, nil
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("range\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Range) unmarshal(fam byte, data []byte) error {

22
expr/redirect.go
View File

@ -29,18 +29,6 @@ type Redir struct {
}
func (e *Redir) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("redir\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Redir) marshalData(fam byte) ([]byte, error) {
var attrs []netlink.Attribute
if e.RegisterProtoMin > 0 {
attrs = append(attrs, netlink.Attribute{Type: unix.NFTA_REDIR_REG_PROTO_MIN, Data: binaryutil.BigEndian.PutUint32(e.RegisterProtoMin)})
@ -52,7 +40,15 @@ func (e *Redir) marshalData(fam byte) ([]byte, error) {
attrs = append(attrs, netlink.Attribute{Type: unix.NFTA_REDIR_FLAGS, Data: binaryutil.BigEndian.PutUint32(e.Flags)})
}
return netlink.MarshalAttributes(attrs)
data, err := netlink.MarshalAttributes(attrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("redir\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Redir) unmarshal(fam byte, data []byte) error {

12
expr/reject.go
View File

@ -28,7 +28,10 @@ type Reject struct {
}
func (e *Reject) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_REJECT_TYPE, Data: binaryutil.BigEndian.PutUint32(e.Type)},
{Type: unix.NFTA_REJECT_ICMP_CODE, Data: []byte{e.Code}},
})
if err != nil {
return nil, err
}
@ -38,13 +41,6 @@ func (e *Reject) marshal(fam byte) ([]byte, error) {
})
}
func (e *Reject) marshalData(fam byte) ([]byte, error) {
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_REJECT_TYPE, Data: binaryutil.BigEndian.PutUint32(e.Type)},
{Type: unix.NFTA_REJECT_ICMP_CODE, Data: []byte{e.Code}},
})
}
func (e *Reject) unmarshal(fam byte, data []byte) error {
ad, err := netlink.NewAttributeDecoder(data)
if err != nil {

12
expr/rt.go
View File

@ -37,7 +37,10 @@ type Rt struct {
}
func (e *Rt) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_RT_KEY, Data: binaryutil.BigEndian.PutUint32(uint32(e.Key))},
{Type: unix.NFTA_RT_DREG, Data: binaryutil.BigEndian.PutUint32(e.Register)},
})
if err != nil {
return nil, err
}
@ -47,13 +50,6 @@ func (e *Rt) marshal(fam byte) ([]byte, error) {
})
}
func (e *Rt) marshalData(fam byte) ([]byte, error) {
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_RT_KEY, Data: binaryutil.BigEndian.PutUint32(uint32(e.Key))},
{Type: unix.NFTA_RT_DREG, Data: binaryutil.BigEndian.PutUint32(e.Register)},
})
}
func (e *Rt) unmarshal(fam byte, data []byte) error {
return fmt.Errorf("not yet implemented")
}

21
expr/socket.go
View File

@ -49,26 +49,23 @@ const (
)
func (e *Socket) marshal(fam byte) ([]byte, error) {
exprData, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("socket\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
})
}
func (e *Socket) marshalData(fam byte) ([]byte, error) {
// NOTE: Socket.Level is only used when Socket.Key == SocketKeyCgroupv2. But `nft` always encoding it. Check link below:
// http://git.netfilter.org/nftables/tree/src/netlink_linearize.c?id=0583bac241ea18c9d7f61cb20ca04faa1e043b78#n319
return netlink.MarshalAttributes(
exprData, err := netlink.MarshalAttributes(
[]netlink.Attribute{
{Type: NFTA_SOCKET_DREG, Data: binaryutil.BigEndian.PutUint32(e.Register)},
{Type: NFTA_SOCKET_KEY, Data: binaryutil.BigEndian.PutUint32(uint32(e.Key))},
{Type: NFTA_SOCKET_LEVEL, Data: binaryutil.BigEndian.PutUint32(uint32(e.Level))},
},
)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("socket\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: exprData},
})
}
func (e *Socket) unmarshal(fam byte, data []byte) error {

21
expr/target.go
View File

@ -21,17 +21,6 @@ type Target struct {
}
func (e *Target) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("target\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Target) marshalData(fam byte) ([]byte, error) {
// Per https://git.netfilter.org/libnftnl/tree/src/expr/target.c?id=09456c720e9c00eecc08e41ac6b7c291b3821ee5#n38
name := e.Name
// limit the extension name as (some) user-space tools do and leave room for
@ -51,7 +40,15 @@ func (e *Target) marshalData(fam byte) ([]byte, error) {
{Type: unix.NFTA_TARGET_INFO, Data: info},
}
return netlink.MarshalAttributes(attrs)
data, err := netlink.MarshalAttributes(attrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("target\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Target) unmarshal(fam byte, data []byte) error {

20
expr/tproxy.go
View File

@ -40,17 +40,6 @@ type TProxy struct {
}
func (e *TProxy) marshal(fam byte) ([]byte, error) {
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("tproxy\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *TProxy) marshalData(fam byte) ([]byte, error) {
attrs := []netlink.Attribute{
{Type: NFTA_TPROXY_FAMILY, Data: binaryutil.BigEndian.PutUint32(uint32(e.Family))},
{Type: NFTA_TPROXY_REG_PORT, Data: binaryutil.BigEndian.PutUint32(e.RegPort)},
@ -63,7 +52,14 @@ func (e *TProxy) marshalData(fam byte) ([]byte, error) {
})
}
return netlink.MarshalAttributes(attrs)
data, err := netlink.MarshalAttributes(attrs)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("tproxy\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *TProxy) unmarshal(fam byte, data []byte) error {

19
expr/verdict.go
View File

@ -64,17 +64,7 @@ func (e *Verdict) marshal(fam byte) ([]byte, error) {
// }
// }
// }
data, err := e.marshalData(fam)
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("immediate\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Verdict) marshalData(fam byte) ([]byte, error) {
attrs := []netlink.Attribute{
{Type: unix.NFTA_VERDICT_CODE, Data: binaryutil.BigEndian.PutUint32(uint32(e.Kind))},
}
@ -93,10 +83,17 @@ func (e *Verdict) marshalData(fam byte) ([]byte, error) {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
data, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_IMMEDIATE_DREG, Data: binaryutil.BigEndian.PutUint32(unix.NFT_REG_VERDICT)},
{Type: unix.NLA_F_NESTED | unix.NFTA_IMMEDIATE_DATA, Data: immData},
})
if err != nil {
return nil, err
}
return netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_EXPR_NAME, Data: []byte("immediate\x00")},
{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
})
}
func (e *Verdict) unmarshal(fam byte, data []byte) error {

3
internal/parseexprfunc/parseexprfunc.go
View File

@ -5,7 +5,6 @@ import (
)
var (
ParseExprBytesFromNameFunc func(fam byte, ad *netlink.AttributeDecoder, exprName string) ([]interface{}, error)
ParseExprBytesFunc func(fam byte, ad *netlink.AttributeDecoder) ([]interface{}, error)
ParseExprBytesFunc func(fam byte, ad *netlink.AttributeDecoder, b []byte) ([]interface{}, error)
ParseExprMsgFunc func(fam byte, b []byte) ([]interface{}, error)
)

2
monitor.go
View File

@ -259,7 +259,7 @@ func (monitor *Monitor) monitor() {
}
monitor.eventCh <- event
case unix.NFT_MSG_NEWOBJ, unix.NFT_MSG_DELOBJ:
obj, err := objFromMsg(msg, true)
obj, err := objFromMsg(msg)
event := &MonitorEvent{
Type: MonitorEventType(msgType),
Data: obj,

510
nftables_test.go
View File

@ -1783,7 +1783,7 @@ func TestListChainByName(t *testing.T) {
}
func TestListChainByNameUsingLasting(t *testing.T) {
_, newNS := nftest.OpenSystemConn(t, *enableSysTests)
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
conn, err := nftables.New(nftables.WithNetNSFd(int(newNS)), nftables.AsLasting())
if err != nil {
t.Fatalf("nftables.New() failed: %v", err)
@ -1882,7 +1882,8 @@ func TestListTableByName(t *testing.T) {
}
// not specifying correct family should return err since no table in ipv4
if _, err = conn.ListTable(table2.Name); err == nil {
tr, err = conn.ListTable(table2.Name)
if err == nil {
t.Fatalf("conn.ListTable() should have failed")
}
@ -2105,18 +2106,17 @@ func TestGetObjReset(t *testing.T) {
}
filter := &nftables.Table{Name: "filter", Family: nftables.TableFamilyIPv4}
obj, err := c.ResetObject(&nftables.NamedObj{
obj, err := c.ResetObject(&nftables.CounterObj{
Table: filter,
Name: "fwded",
Type: nftables.ObjTypeCounter,
})
if err != nil {
t.Fatal(err)
}
co, ok := obj.(*nftables.NamedObj)
co, ok := obj.(*nftables.CounterObj)
if !ok {
t.Fatalf("unexpected type: got %T, want *nftables.ObjAttr", obj)
t.Fatalf("unexpected type: got %T, want *nftables.CounterObj", obj)
}
if got, want := co.Table.Name, filter.Name; got != want {
t.Errorf("unexpected table name: got %q, want %q", got, want)
@ -2124,14 +2124,10 @@ func TestGetObjReset(t *testing.T) {
if got, want := co.Table.Family, filter.Family; got != want {
t.Errorf("unexpected table family: got %d, want %d", got, want)
}
o, ok := co.Obj.(*expr.Counter)
if !ok {
t.Fatalf("unexpected type: got %T, want *expr.Counter", o)
}
if got, want := o.Packets, uint64(9); got != want {
if got, want := co.Packets, uint64(9); got != want {
t.Errorf("unexpected number of packets: got %d, want %d", got, want)
}
if got, want := o.Bytes, uint64(1121); got != want {
if got, want := co.Bytes, uint64(1121); got != want {
t.Errorf("unexpected number of bytes: got %d, want %d", got, want)
}
}
@ -2168,366 +2164,6 @@ func TestObjAPI(t *testing.T) {
Priority: nftables.ChainPriorityFilter,
})
counter1 := c.AddObj(&nftables.NamedObj{
Table: table,
Name: "fwded1",
Type: nftables.ObjTypeCounter,
Obj: &expr.Counter{
Bytes: 1,
Packets: 1,
},
})
counter2 := c.AddObj(&nftables.NamedObj{
Table: table,
Name: "fwded2",
Type: nftables.ObjTypeCounter,
Obj: &expr.Counter{
Bytes: 1,
Packets: 1,
},
})
c.AddObj(&nftables.NamedObj{
Table: tableOther,
Name: "fwdedOther",
Type: nftables.ObjTypeCounter,
Obj: &expr.Counter{
Bytes: 0,
Packets: 0,
},
})
c.AddRule(&nftables.Rule{
Table: table,
Chain: chain,
Exprs: []expr.Any{
&expr.Objref{
Type: 1,
Name: "fwded1",
},
},
})
if err := c.Flush(); err != nil {
t.Fatalf(err.Error())
}
objs, err := c.GetObjects(table)
if err != nil {
t.Errorf("c.GetObjects(table) failed: %v failed", err)
}
if got := len(objs); got != 2 {
t.Fatalf("unexpected number of objects: got %d, want %d", got, 2)
}
objsOther, err := c.GetObjects(tableOther)
if err != nil {
t.Errorf("c.GetObjects(tableOther) failed: %v failed", err)
}
if got := len(objsOther); got != 1 {
t.Fatalf("unexpected number of objects: got %d, want %d", got, 1)
}
obj1, err := c.GetObject(counter1)
if err != nil {
t.Errorf("c.GetObject(counter1) failed: %v failed", err)
}
rcounter1, ok := obj1.(*nftables.NamedObj)
if !ok {
t.Fatalf("unexpected type: got %T, want *nftables.ObjAttr", obj1)
}
if rcounter1.Name != "fwded1" {
t.Fatalf("unexpected counter name: got %s, want %s", rcounter1.Name, "fwded1")
}
obj2, err := c.GetObject(counter2)
if err != nil {
t.Errorf("c.GetObject(counter2) failed: %v failed", err)
}
rcounter2, ok := obj2.(*nftables.NamedObj)
if !ok {
t.Fatalf("unexpected type: got %T, want *nftables.CounterObj", obj2)
}
if rcounter2.Name != "fwded2" {
t.Fatalf("unexpected counter name: got %s, want %s", rcounter2.Name, "fwded2")
}
_, err = c.ResetObject(counter1)
if err != nil {
t.Errorf("c.ResetObjects(table) failed: %v failed", err)
}
obj1, err = c.GetObject(counter1)
if err != nil {
t.Errorf("c.GetObject(counter1) failed: %v failed", err)
}
if counter1 := obj1.(*nftables.NamedObj).Obj.(*expr.Counter); counter1.Packets > 0 {
t.Errorf("unexpected packets number: got %d, want %d", counter1.Packets, 0)
}
obj2, err = c.GetObject(counter2)
if err != nil {
t.Errorf("c.GetObject(counter2) failed: %v failed", err)
}
if counter2 := obj2.(*nftables.NamedObj).Obj.(*expr.Counter); counter2.Packets != 1 {
t.Errorf("unexpected packets number: got %d, want %d", counter2.Packets, 1)
}
legacy, err := c.GetObj(counter1)
if err != nil {
t.Errorf("c.GetObj(counter1) failed: %v failed", err)
}
if len(legacy) != 2 {
t.Errorf("unexpected number of objects: got %d, want %d", len(legacy), 2)
}
legacyReset, err := c.GetObjReset(counter1)
if err != nil {
t.Errorf("c.GetObjReset(counter1) failed: %v failed", err)
}
if len(legacyReset) != 2 {
t.Errorf("unexpected number of objects: got %d, want %d", len(legacyReset), 2)
}
}
func TestDeleteLegacyQuotaObj(t *testing.T) {
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)
conn.FlushRuleset()
defer conn.FlushRuleset()
table := &nftables.Table{
Name: "quota_demo",
Family: nftables.TableFamilyIPv4,
}
tr := conn.AddTable(table)
c := &nftables.Chain{
Name: "filter",
Table: table,
}
conn.AddChain(c)
o := &nftables.QuotaObj{
Table: tr,
Name: "q_test",
Bytes: 0x06400000,
Consumed: 0,
Over: true,
}
conn.AddObj(o)
if err := conn.Flush(); err != nil {
t.Fatalf("conn.Flush() failed: %v", err)
}
obj, err := conn.GetObj(&nftables.QuotaObj{
Table: table,
Name: "q_test",
})
if err != nil {
t.Fatalf("conn.GetObj() failed: %v", err)
}
if got, want := len(obj), 1; got != want {
t.Fatalf("unexpected number of objects: got %d, want %d", got, want)
}
if got, want := obj[0], o; !reflect.DeepEqual(got, want) {
t.Errorf("got = %+v, want = %+v", got, want)
}
conn.DeleteObject(&nftables.QuotaObj{
Table: tr,
Name: "q_test",
})
if err := conn.Flush(); err != nil {
t.Fatalf("conn.Flush() failed: %v", err)
}
obj, err = conn.GetObj(&nftables.QuotaObj{
Table: table,
Name: "q_test",
})
if err != nil {
t.Fatalf("conn.GetObj() failed: %v", err)
}
if got, want := len(obj), 0; got != want {
t.Fatalf("unexpected object list length: got %d, want %d", got, want)
}
}
func TestAddLegacyQuotaObj(t *testing.T) {
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)
conn.FlushRuleset()
defer conn.FlushRuleset()
table := &nftables.Table{
Name: "quota_demo",
Family: nftables.TableFamilyIPv4,
}
tr := conn.AddTable(table)
c := &nftables.Chain{
Name: "filter",
Table: table,
}
conn.AddChain(c)
o := &nftables.QuotaObj{
Table: tr,
Name: "q_test",
Bytes: 0x06400000,
Consumed: 0,
Over: true,
}
conn.AddObj(o)
if err := conn.Flush(); err != nil {
t.Errorf("conn.Flush() failed: %v", err)
}
obj, err := conn.GetObj(&nftables.QuotaObj{
Table: table,
Name: "q_test",
})
if err != nil {
t.Fatalf("conn.GetObj() failed: %v", err)
}
if got, want := len(obj), 1; got != want {
t.Fatalf("unexpected object list length: got %d, want %d", got, want)
}
o1, ok := obj[0].(*nftables.QuotaObj)
if !ok {
t.Fatalf("unexpected type: got %T, want *QuotaObj", obj[0])
}
if got, want := o1.Name, o.Name; got != want {
t.Fatalf("quota name mismatch: got %s, want %s", got, want)
}
if got, want := o1.Bytes, o.Bytes; got != want {
t.Fatalf("quota bytes mismatch: got %d, want %d", got, want)
}
if got, want := o1.Consumed, o.Consumed; got != want {
t.Fatalf("quota consumed mismatch: got %d, want %d", got, want)
}
if got, want := o1.Over, o.Over; got != want {
t.Fatalf("quota over mismatch: got %v, want %v", got, want)
}
}
func TestAddLegacyQuotaObjRef(t *testing.T) {
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)
conn.FlushRuleset()
defer conn.FlushRuleset()
table := &nftables.Table{
Name: "quota_demo",
Family: nftables.TableFamilyIPv4,
}
tr := conn.AddTable(table)
c := &nftables.Chain{
Name: "filter",
Table: table,
}
conn.AddChain(c)
o := &nftables.QuotaObj{
Table: tr,
Name: "q_test",
Bytes: 0x06400000,
Consumed: 0,
Over: true,
}
conn.AddObj(o)
r := &nftables.Rule{
Table: table,
Chain: c,
Exprs: []expr.Any{
&expr.Objref{
Type: 2,
Name: "q_test",
},
},
}
conn.AddRule(r)
if err := conn.Flush(); err != nil {
t.Fatalf("failed to flush: %v", err)
}
rules, err := conn.GetRules(table, c)
if err != nil {
t.Fatalf("failed to get rules: %v", err)
}
if got, want := len(rules), 1; got != want {
t.Fatalf("unexpected number of rules: got %d, want %d", got, want)
}
if got, want := len(rules[0].Exprs), 1; got != want {
t.Fatalf("unexpected number of exprs: got %d, want %d", got, want)
}
objref, ok := rules[0].Exprs[0].(*expr.Objref)
if !ok {
t.Fatalf("Exprs[0] is type %T, want *expr.Objref", rules[0].Exprs[0])
}
if want := r.Exprs[0]; !reflect.DeepEqual(objref, want) {
t.Errorf("objref expr = %+v, wanted %+v", objref, want)
}
}
func TestObjAPICounterLegacyType(t *testing.T) {
if os.Getenv("TRAVIS") == "true" {
t.SkipNow()
}
// Create a new network namespace to test these operations,
// and tear down the namespace at test completion.
c, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)
// Clear all rules at the beginning + end of the test.
c.FlushRuleset()
defer c.FlushRuleset()
table := c.AddTable(&nftables.Table{
Family: nftables.TableFamilyIPv4,
Name: "filter",
})
tableOther := c.AddTable(&nftables.Table{
Family: nftables.TableFamilyIPv4,
Name: "foo",
})
chain := c.AddChain(&nftables.Chain{
Name: "chain",
Table: table,
Type: nftables.ChainTypeFilter,
Hooknum: nftables.ChainHookPostrouting,
Priority: nftables.ChainPriorityFilter,
})
counter1 := c.AddObj(&nftables.CounterObj{
Table: table,
Name: "fwded1",
@ -3131,7 +2767,7 @@ func TestCreateUseAnonymousSet(t *testing.T) {
}
func TestCappedErrMsgOnSets(t *testing.T) {
_, newNS := nftest.OpenSystemConn(t, *enableSysTests)
c, newNS := nftest.OpenSystemConn(t, *enableSysTests)
c, err := nftables.New(nftables.WithNetNSFd(int(newNS)), nftables.AsLasting())
if err != nil {
t.Fatalf("nftables.New() failed: %v", err)
@ -6649,84 +6285,6 @@ func TestGetRulesObjref(t *testing.T) {
}
}
func TestAddLimitObj(t *testing.T) {
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)
conn.FlushRuleset()
defer conn.FlushRuleset()
table := &nftables.Table{
Name: "limit_demo",
Family: nftables.TableFamilyIPv4,
}
tr := conn.AddTable(table)
c := &nftables.Chain{
Name: "filter",
Table: table,
}
conn.AddChain(c)
l := &expr.Limit{
Type: expr.LimitTypePkts,
Rate: 400,
Unit: expr.LimitTimeMinute,
Burst: 5,
Over: false,
}
o := &nftables.NamedObj{
Table: tr,
Name: "limit_test",
Type: nftables.ObjTypeLimit,
Obj: l,
}
conn.AddObj(o)
if err := conn.Flush(); err != nil {
t.Errorf("conn.Flush() failed: %v", err)
}
obj, err := conn.GetObj(&nftables.NamedObj{
Table: table,
Name: "limit_test",
Type: nftables.ObjTypeLimit,
})
if err != nil {
t.Fatalf("conn.GetObj() failed: %v", err)
}
if got, want := len(obj), 1; got != want {
t.Fatalf("unexpected object list length: got %d, want %d", got, want)
}
o1, ok := obj[0].(*nftables.NamedObj)
if !ok {
t.Fatalf("unexpected type: got %T, want *ObjAttr", obj[0])
}
if got, want := o1.Name, o.Name; got != want {
t.Fatalf("limit name mismatch: got %s, want %s", got, want)
}
q, ok := o1.Obj.(*expr.Limit)
if !ok {
t.Fatalf("unexpected type: got %T, want *expr.Quota", o1.Obj)
}
if got, want := q.Burst, l.Burst; got != want {
t.Fatalf("limit burst mismatch: got %d, want %d", got, want)
}
if got, want := q.Unit, l.Unit; got != want {
t.Fatalf("limit unit mismatch: got %d, want %d", got, want)
}
if got, want := q.Rate, l.Rate; got != want {
t.Fatalf("limit rate mismatch: got %v, want %v", got, want)
}
if got, want := q.Over, l.Over; got != want {
t.Fatalf("limit over mismatch: got %v, want %v", got, want)
}
if got, want := q.Type, l.Type; got != want {
t.Fatalf("limit type mismatch: got %v, want %v", got, want)
}
}
func TestAddQuotaObj(t *testing.T) {
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)
@ -6745,26 +6303,22 @@ func TestAddQuotaObj(t *testing.T) {
}
conn.AddChain(c)
o := &nftables.NamedObj{
o := &nftables.QuotaObj{
Table: tr,
Name: "q_test",
Type: nftables.ObjTypeQuota,
Obj: &expr.Quota{
Bytes: 0x06400000,
Consumed: 0,
Over: true,
},
}
conn.AddObj(o)
if err := conn.Flush(); err != nil {
t.Fatalf("conn.Flush() failed: %v", err)
t.Errorf("conn.Flush() failed: %v", err)
}
obj, err := conn.GetObj(&nftables.NamedObj{
obj, err := conn.GetObj(&nftables.QuotaObj{
Table: table,
Name: "q_test",
Type: nftables.ObjTypeQuota,
})
if err != nil {
t.Fatalf("conn.GetObj() failed: %v", err)
@ -6774,25 +6328,20 @@ func TestAddQuotaObj(t *testing.T) {
t.Fatalf("unexpected object list length: got %d, want %d", got, want)
}
o1, ok := obj[0].(*nftables.NamedObj)
o1, ok := obj[0].(*nftables.QuotaObj)
if !ok {
t.Fatalf("unexpected type: got %T, want *ObjAttr", obj[0])
t.Fatalf("unexpected type: got %T, want *QuotaObj", obj[0])
}
if got, want := o1.Name, o.Name; got != want {
t.Fatalf("quota name mismatch: got %s, want %s", got, want)
}
q, ok := o1.Obj.(*expr.Quota)
if !ok {
t.Fatalf("unexpected type: got %T, want *expr.Quota", o1.Obj)
}
o2, _ := o.Obj.(*expr.Quota)
if got, want := q.Bytes, o2.Bytes; got != want {
if got, want := o1.Bytes, o.Bytes; got != want {
t.Fatalf("quota bytes mismatch: got %d, want %d", got, want)
}
if got, want := q.Consumed, o2.Consumed; got != want {
if got, want := o1.Consumed, o.Consumed; got != want {
t.Fatalf("quota consumed mismatch: got %d, want %d", got, want)
}
if got, want := q.Over, o2.Over; got != want {
if got, want := o1.Over, o.Over; got != want {
t.Fatalf("quota over mismatch: got %v, want %v", got, want)
}
}
@ -6860,7 +6409,7 @@ func TestAddQuotaObjRef(t *testing.T) {
}
}
func TestDeleteQuotaObjMixedTypes(t *testing.T) {
func TestDeleteQuotaObj(t *testing.T) {
conn, newNS := nftest.OpenSystemConn(t, *enableSysTests)
defer nftest.CleanupSystemConn(t, newNS)
conn.FlushRuleset()
@ -6878,15 +6427,12 @@ func TestDeleteQuotaObjMixedTypes(t *testing.T) {
}
conn.AddChain(c)
o := &nftables.NamedObj{
o := &nftables.QuotaObj{
Table: tr,
Name: "q_test",
Type: nftables.ObjTypeQuota,
Obj: &expr.Quota{
Bytes: 0x06400000,
Consumed: 0,
Over: true,
},
}
conn.AddObj(o)
@ -6894,10 +6440,9 @@ func TestDeleteQuotaObjMixedTypes(t *testing.T) {
t.Fatalf("conn.Flush() failed: %v", err)
}
obj, err := conn.GetObj(&nftables.NamedObj{
Table: tr,
obj, err := conn.GetObj(&nftables.QuotaObj{
Table: table,
Name: "q_test",
Type: nftables.ObjTypeQuota,
})
if err != nil {
t.Fatalf("conn.GetObj() failed: %v", err)
@ -6907,18 +6452,7 @@ func TestDeleteQuotaObjMixedTypes(t *testing.T) {
t.Fatalf("unexpected number of objects: got %d, want %d", got, want)
}
o2, _ := o.Obj.(*expr.Quota)
want := &nftables.NamedObj{
Table: tr,
Name: "q_test",
Type: nftables.ObjTypeQuota,
Obj: &expr.Quota{
Bytes: o2.Bytes,
Consumed: o2.Consumed,
Over: o2.Over,
},
}
if got, want := obj[0], want; !reflect.DeepEqual(got, want) {
if got, want := obj[0], o; !reflect.DeepEqual(got, want) {
t.Errorf("got = %+v, want = %+v", got, want)
}

173
obj.go
View File

@ -18,9 +18,6 @@ import (
"encoding/binary"
"fmt"
"github.com/google/nftables/binaryutil"
"github.com/google/nftables/expr"
"github.com/google/nftables/internal/parseexprfunc"
"github.com/mdlayher/netlink"
"golang.org/x/sys/unix"
)
@ -30,73 +27,13 @@ var (
delObjHeaderType = netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_DELOBJ)
)
type ObjType uint32
// https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=be0bae0ad31b0adb506f96de083f52a2bd0d4fbf#n1612
const (
ObjTypeCounter ObjType = unix.NFT_OBJECT_COUNTER
ObjTypeQuota ObjType = unix.NFT_OBJECT_QUOTA
ObjTypeCtHelper ObjType = unix.NFT_OBJECT_CT_HELPER
ObjTypeLimit ObjType = unix.NFT_OBJECT_LIMIT
ObjTypeConnLimit ObjType = unix.NFT_OBJECT_CONNLIMIT
ObjTypeTunnel ObjType = unix.NFT_OBJECT_TUNNEL
ObjTypeCtTimeout ObjType = unix.NFT_OBJECT_CT_TIMEOUT
ObjTypeSecMark ObjType = unix.NFT_OBJECT_SECMARK
ObjTypeCtExpect ObjType = unix.NFT_OBJECT_CT_EXPECT
ObjTypeSynProxy ObjType = unix.NFT_OBJECT_SYNPROXY
)
var objByObjTypeMagic = map[ObjType]string{
ObjTypeCounter: "counter",
ObjTypeQuota: "quota",
ObjTypeLimit: "limit",
ObjTypeConnLimit: "connlimit",
ObjTypeCtHelper: "cthelper", // not implemented in expr
ObjTypeTunnel: "tunnel", // not implemented in expr
ObjTypeCtTimeout: "cttimeout", // not implemented in expr
ObjTypeSecMark: "secmark", // not implemented in expr
ObjTypeCtExpect: "ctexpect", // not implemented in expr
ObjTypeSynProxy: "synproxy", // not implemented in expr
}
// Obj represents a netfilter stateful object. See also
// https://wiki.nftables.org/wiki-nftables/index.php/Stateful_objects
type Obj interface {
table() *Table
family() TableFamily
data() expr.Any
name() string
objType() ObjType
}
// NamedObj represents nftables stateful object attributes
// Corresponds to netfilter nft_object_attributes as per
// https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=116e95aa7b6358c917de8c69f6f173874030b46b#n1626
type NamedObj struct {
Table *Table
Name string
Type ObjType
Obj expr.Any
}
func (o *NamedObj) table() *Table {
return o.Table
}
func (o *NamedObj) family() TableFamily {
return o.Table.Family
}
func (o *NamedObj) data() expr.Any {
return o.Obj
}
func (o *NamedObj) name() string {
return o.Name
}
func (o *NamedObj) objType() ObjType {
return o.Type
unmarshal(*netlink.AttributeDecoder) error
marshal(data bool) ([]byte, error)
}
// AddObject adds the specified Obj. Alias of AddObj.
@ -109,27 +46,18 @@ func (cc *Conn) AddObject(o Obj) Obj {
func (cc *Conn) AddObj(o Obj) Obj {
cc.mu.Lock()
defer cc.mu.Unlock()
data, err := expr.MarshalExprData(byte(o.family()), o.data())
data, err := o.marshal(true)
if err != nil {
cc.setErr(err)
return nil
}
attrs := []netlink.Attribute{
{Type: unix.NFTA_OBJ_TABLE, Data: []byte(o.table().Name + "\x00")},
{Type: unix.NFTA_OBJ_NAME, Data: []byte(o.name() + "\x00")},
{Type: unix.NFTA_OBJ_TYPE, Data: binaryutil.BigEndian.PutUint32(uint32(o.objType()))},
}
if len(data) > 0 {
attrs = append(attrs, netlink.Attribute{Type: unix.NLA_F_NESTED | unix.NFTA_OBJ_DATA, Data: data})
}
cc.messages = append(cc.messages, netlink.Message{
Header: netlink.Header{
Type: netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_NEWOBJ),
Flags: netlink.Request | netlink.Acknowledge | netlink.Create,
},
Data: append(extraHeader(uint8(o.family()), 0), cc.marshalAttr(attrs)...),
Data: append(extraHeader(uint8(o.family()), 0), data...),
})
return o
}
@ -138,12 +66,12 @@ func (cc *Conn) AddObj(o Obj) Obj {
func (cc *Conn) DeleteObject(o Obj) {
cc.mu.Lock()
defer cc.mu.Unlock()
attrs := []netlink.Attribute{
{Type: unix.NFTA_OBJ_TABLE, Data: []byte(o.table().Name + "\x00")},
{Type: unix.NFTA_OBJ_NAME, Data: []byte(o.name() + "\x00")},
{Type: unix.NFTA_OBJ_TYPE, Data: binaryutil.BigEndian.PutUint32(uint32(o.objType()))},
data, err := o.marshal(false)
if err != nil {
cc.setErr(err)
return
}
data := cc.marshalAttr(attrs)
data = append(data, cc.marshalAttr([]netlink.Attribute{{Type: unix.NLA_F_NESTED | unix.NFTA_OBJ_DATA}})...)
cc.messages = append(cc.messages, netlink.Message{
@ -157,26 +85,17 @@ func (cc *Conn) DeleteObject(o Obj) {
// GetObj is a legacy method that return all Obj that belongs
// to the same table as the given one
// This function returns the same concrete type as passed,
// e.g. QuotaObj, CounterObj or NamedObj. Prefer using the more
// generic NamedObj over the legacy QuotaObj and CounterObj types.
func (cc *Conn) GetObj(o Obj) ([]Obj, error) {
return cc.getObjWithLegacyType(nil, o.table(), unix.NFT_MSG_GETOBJ, cc.useLegacyObjType(o))
return cc.getObj(nil, o.table(), unix.NFT_MSG_GETOBJ)
}
// GetObjReset is a legacy method that reset all Obj that belongs
// the same table as the given one
// This function returns the same concrete type as passed,
// e.g. QuotaObj, CounterObj or NamedObj. Prefer using the more
// generic NamedObj over the legacy QuotaObj and CounterObj types.
func (cc *Conn) GetObjReset(o Obj) ([]Obj, error) {
return cc.getObjWithLegacyType(nil, o.table(), unix.NFT_MSG_GETOBJ_RESET, cc.useLegacyObjType(o))
return cc.getObj(nil, o.table(), unix.NFT_MSG_GETOBJ_RESET)
}
// GetObject gets the specified Object
// This function returns the same concrete type as passed,
// e.g. QuotaObj, CounterObj or NamedObj. Prefer using the more
// generic NamedObj over the legacy QuotaObj and CounterObj types.
func (cc *Conn) GetObject(o Obj) (Obj, error) {
objs, err := cc.getObj(o, o.table(), unix.NFT_MSG_GETOBJ)
@ -188,16 +107,11 @@ func (cc *Conn) GetObject(o Obj) (Obj, error) {
}
// GetObjects get all the Obj that belongs to the given table
// This function will always return legacy QuotaObj/CounterObj
// types for backwards compatibility
func (cc *Conn) GetObjects(t *Table) ([]Obj, error) {
return cc.getObj(nil, t, unix.NFT_MSG_GETOBJ)
}
// ResetObject reset the given Obj
// This function returns the same concrete type as passed,
// e.g. QuotaObj, CounterObj or NamedObj. Prefer using the more
// generic NamedObj over the legacy QuotaObj and CounterObj types.
func (cc *Conn) ResetObject(o Obj) (Obj, error) {
objs, err := cc.getObj(o, o.table(), unix.NFT_MSG_GETOBJ_RESET)
@ -209,13 +123,11 @@ func (cc *Conn) ResetObject(o Obj) (Obj, error) {
}
// ResetObjects reset all the Obj that belongs to the given table
// This function will always return legacy QuotaObj/CounterObj
// types for backwards compatibility
func (cc *Conn) ResetObjects(t *Table) ([]Obj, error) {
return cc.getObj(nil, t, unix.NFT_MSG_GETOBJ_RESET)
}
func objFromMsg(msg netlink.Message, returnLegacyType bool) (Obj, error) {
func objFromMsg(msg netlink.Message) (Obj, error) {
if got, want1, want2 := msg.Header.Type, newObjHeaderType, delObjHeaderType; got != want1 && got != want2 {
return nil, fmt.Errorf("unexpected header type: got %v, want %v or %v", got, want1, want2)
}
@ -238,39 +150,6 @@ func objFromMsg(msg netlink.Message, returnLegacyType bool) (Obj, error) {
case unix.NFTA_OBJ_TYPE:
objectType = ad.Uint32()
case unix.NFTA_OBJ_DATA:
if returnLegacyType {
return objDataFromMsgLegacy(ad, table, name, objectType)
}
o := NamedObj{
Table: table,
Name: name,
Type: ObjType(objectType),
}
objs, err := parseexprfunc.ParseExprBytesFromNameFunc(byte(o.family()), ad, objByObjTypeMagic[o.Type])
if err != nil {
return nil, err
}
if len(objs) == 0 {
return nil, fmt.Errorf("objFromMsg: objs is empty for obj %v", o)
}
exprs := make([]expr.Any, len(objs))
for i := range exprs {
exprs[i] = objs[i].(expr.Any)
}
o.Obj = exprs[0]
return &o, ad.Err()
}
}
if err := ad.Err(); err != nil {
return nil, err
}
return nil, fmt.Errorf("malformed stateful object")
}
func objDataFromMsgLegacy(ad *netlink.AttributeDecoder, table *Table, name string, objectType uint32) (Obj, error) {
switch objectType {
case unix.NFT_OBJECT_COUNTER:
o := CounterObj{
@ -287,7 +166,7 @@ func objDataFromMsgLegacy(ad *netlink.AttributeDecoder, table *Table, name strin
return o.unmarshal(ad)
})
return &o, ad.Err()
case unix.NFT_OBJECT_QUOTA:
case NFT_OBJECT_QUOTA:
o := QuotaObj{
Table: table,
Name: name,
@ -303,6 +182,8 @@ func objDataFromMsgLegacy(ad *netlink.AttributeDecoder, table *Table, name strin
})
return &o, ad.Err()
}
}
}
if err := ad.Err(); err != nil {
return nil, err
}
@ -310,10 +191,6 @@ func objDataFromMsgLegacy(ad *netlink.AttributeDecoder, table *Table, name strin
}
func (cc *Conn) getObj(o Obj, t *Table, msgType uint16) ([]Obj, error) {
return cc.getObjWithLegacyType(o, t, msgType, cc.useLegacyObjType(o))
}
func (cc *Conn) getObjWithLegacyType(o Obj, t *Table, msgType uint16, returnLegacyObjType bool) ([]Obj, error) {
conn, closer, err := cc.netlinkConn()
if err != nil {
return nil, err
@ -324,12 +201,7 @@ func (cc *Conn) getObjWithLegacyType(o Obj, t *Table, msgType uint16, returnLega
var flags netlink.HeaderFlags
if o != nil {
attrs := []netlink.Attribute{
{Type: unix.NFTA_OBJ_TABLE, Data: []byte(o.table().Name + "\x00")},
{Type: unix.NFTA_OBJ_NAME, Data: []byte(o.name() + "\x00")},
{Type: unix.NFTA_OBJ_TYPE, Data: binaryutil.BigEndian.PutUint32(uint32(o.objType()))},
}
data = cc.marshalAttr(attrs)
data, err = o.marshal(false)
} else {
flags = netlink.Dump
data, err = netlink.MarshalAttributes([]netlink.Attribute{
@ -358,7 +230,7 @@ func (cc *Conn) getObjWithLegacyType(o Obj, t *Table, msgType uint16, returnLega
}
var objs []Obj
for _, msg := range reply {
o, err := objFromMsg(msg, returnLegacyObjType)
o, err := objFromMsg(msg)
if err != nil {
return nil, err
}
@ -367,14 +239,3 @@ func (cc *Conn) getObjWithLegacyType(o Obj, t *Table, msgType uint16, returnLega
return objs, nil
}
func (cc *Conn) useLegacyObjType(o Obj) bool {
useLegacyType := true
if o != nil {
switch o.(type) {
case *NamedObj:
useLegacyType = false
}
}
return useLegacyType
}

47
quota.go
View File

@ -15,11 +15,16 @@
package nftables
import (
"github.com/google/nftables/expr"
"github.com/google/nftables/binaryutil"
"github.com/mdlayher/netlink"
"golang.org/x/sys/unix"
)
const (
NFTA_OBJ_USERDATA = 8
NFT_OBJECT_QUOTA = 2
)
type QuotaObj struct {
Table *Table
Name string
@ -42,6 +47,30 @@ func (q *QuotaObj) unmarshal(ad *netlink.AttributeDecoder) error {
return nil
}
func (q *QuotaObj) marshal(data bool) ([]byte, error) {
flags := uint32(0)
if q.Over {
flags = unix.NFT_QUOTA_F_INV
}
obj, err := netlink.MarshalAttributes([]netlink.Attribute{
{Type: unix.NFTA_QUOTA_BYTES, Data: binaryutil.BigEndian.PutUint64(q.Bytes)},
{Type: unix.NFTA_QUOTA_CONSUMED, Data: binaryutil.BigEndian.PutUint64(q.Consumed)},
{Type: unix.NFTA_QUOTA_FLAGS, Data: binaryutil.BigEndian.PutUint32(flags)},
})
if err != nil {
return nil, err
}
attrs := []netlink.Attribute{
{Type: unix.NFTA_OBJ_TABLE, Data: []byte(q.Table.Name + "\x00")},
{Type: unix.NFTA_OBJ_NAME, Data: []byte(q.Name + "\x00")},
{Type: unix.NFTA_OBJ_TYPE, Data: binaryutil.BigEndian.PutUint32(NFT_OBJECT_QUOTA)},
}
if data {
attrs = append(attrs, netlink.Attribute{Type: unix.NLA_F_NESTED | unix.NFTA_OBJ_DATA, Data: obj})
}
return netlink.MarshalAttributes(attrs)
}
func (q *QuotaObj) table() *Table {
return q.Table
}
@ -49,19 +78,3 @@ func (q *QuotaObj) table() *Table {
func (q *QuotaObj) family() TableFamily {
return q.Table.Family
}
func (q *QuotaObj) data() expr.Any {
return &expr.Quota{
Bytes: q.Bytes,
Consumed: q.Consumed,
Over: q.Over,
}
}
func (q *QuotaObj) name() string {
return q.Name
}
func (q *QuotaObj) objType() ObjType {
return ObjTypeQuota
}

2
set.go
View File

@ -321,7 +321,7 @@ func (s *SetElement) decode(fam byte) func(b []byte) error {
case unix.NFTA_SET_ELEM_EXPIRATION:
s.Expires = time.Millisecond * time.Duration(ad.Uint64())
case unix.NFTA_SET_ELEM_EXPR:
elems, err := parseexprfunc.ParseExprBytesFunc(fam, ad)
elems, err := parseexprfunc.ParseExprBytesFunc(fam, ad, ad.Bytes())
if err != nil {
return err
}