Merge dae73eaa9c into 7a6c4ef3e7

Example: meta l4proto tcp dnat to 10.200.45.6:9080

  [ meta load l4proto => reg 1 ]
  [ cmp eq reg 1 0x00000006 ]
  [ immediate reg 1 0x062dc80a ]
  [ immediate reg 2 0x00007823 ]
  [ nat dnat ip addr_min reg 1 proto_min reg 2 flags 0x2 ]

.gitignore

@@ -0,0 +1 @@
+nftables.test

README.md

@@ -21,4 +21,12 @@ the data types/API will be identified as more functionality is added.
 
 Contributions are very welcome!
 
+### Testing Changes
 
+Run the following commands to test your changes:
+
+```bash
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests
+```

expr/expr.go

@@ -336,6 +336,8 @@ const (
 	NF_NAT_RANGE_PERSISTENT = unix.NF_NAT_RANGE_PERSISTENT
 	// NF_NAT_RANGE_PREFIX defines flag for a prefix masquerade
 	NF_NAT_RANGE_PREFIX = unix.NF_NAT_RANGE_NETMAP
+	// NF_NAT_RANGE_PROTO_SPECIFIED defines flag for a specified range
+	NF_NAT_RANGE_PROTO_SPECIFIED = unix.NF_NAT_RANGE_PROTO_SPECIFIED
 )
 
 func (e *Masq) marshal(fam byte) ([]byte, error) {

expr/nat.go

@@ -41,6 +41,7 @@ type NAT struct {
 	FullyRandom bool
 	Persistent  bool
 	Prefix      bool
+	Specified   bool
 }
 
 // |00048|N-|00001|	|len |flags| type|
@@ -97,6 +98,9 @@ func (e *NAT) marshalData(fam byte) ([]byte, error) {
 	if e.Prefix {
 		flags |= NF_NAT_RANGE_PREFIX
 	}
+	if e.Specified {
+		flags |= NF_NAT_RANGE_PROTO_SPECIFIED
+	}
 	if flags != 0 {
 		attrs = append(attrs, netlink.Attribute{Type: unix.NFTA_NAT_FLAGS, Data: binaryutil.BigEndian.PutUint32(flags)})
 	}
@@ -130,6 +134,7 @@ func (e *NAT) unmarshal(fam byte, data []byte) error {
 			e.Random = (flags & NF_NAT_RANGE_PROTO_RANDOM) != 0
 			e.FullyRandom = (flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY) != 0
 			e.Prefix = (flags & NF_NAT_RANGE_PREFIX) != 0
+			e.Specified = (flags & NF_NAT_RANGE_PROTO_SPECIFIED) != 0
 		}
 	}
 	return ad.Err()

expr/nat_test.go

@@ -0,0 +1,66 @@
+package expr
+
+import (
+	"encoding/binary"
+	"reflect"
+	"testing"
+
+	"github.com/mdlayher/netlink"
+	"golang.org/x/sys/unix"
+)
+
+func TestNat(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name string
+		nat  NAT
+	}{
+		{
+			name: "Unmarshal DNAT specified case",
+			nat: NAT{
+				Type:        NATTypeDestNAT,
+				Family:      unix.NFPROTO_IPV4,
+				RegAddrMin:  1,
+				RegProtoMin: 2,
+				Specified:   true,
+			},
+		},
+		{
+			name: "Unmarshal SNAT persistent case",
+			nat: NAT{
+				Type:        NATTypeSourceNAT,
+				Family:      unix.NFPROTO_IPV4,
+				RegAddrMin:  1,
+				RegProtoMin: 2,
+				Persistent:  true,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			nnat := NAT{}
+			data, err := tt.nat.marshal(0 /* don't care in this test */)
+			if err != nil {
+				t.Fatalf("marshal error: %+v", err)
+
+			}
+			ad, err := netlink.NewAttributeDecoder(data)
+			if err != nil {
+				t.Fatalf("NewAttributeDecoder() error: %+v", err)
+			}
+			ad.ByteOrder = binary.BigEndian
+			for ad.Next() {
+				if ad.Type() == unix.NFTA_EXPR_DATA {
+					if err := nnat.unmarshal(0, ad.Bytes()); err != nil {
+						t.Errorf("unmarshal error: %+v", err)
+						break
+					}
+				}
+			}
+			if !reflect.DeepEqual(tt.nat, nnat) {
+				t.Fatalf("original %+v and recovered %+v Ct structs are different", tt.nat, nnat)
+			}
+		})
+	}
+}

expr/verdict.go

@@ -24,6 +24,15 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+const (
+	NFT_DROP   = 0
+	NFT_ACCEPT = 1
+	NFT_STOLEN = 2
+	NFT_QUEUE  = 3
+	NFT_REPEAT = 4
+	NFT_STOP   = 5
+)
+
 // This code assembles the verdict structure, as expected by the
 // nftables netlink API.
 // For further information, consult:
@@ -129,3 +138,37 @@ func (e *Verdict) unmarshal(fam byte, data []byte) error {
 	}
 	return ad.Err()
 }
+
+func (e *Verdict) String() string {
+	var v string
+	switch e.Kind {
+	case unix.NFT_RETURN:
+		v = "return" // -0x5
+	case unix.NFT_GOTO:
+		v = "goto" // -0x4
+	case unix.NFT_JUMP:
+		v = "jump" // NFT_JUMP = -0x3
+	case unix.NFT_BREAK:
+		v = "break" // NFT_BREAK = -0x2
+	case unix.NFT_CONTINUE:
+		v = "continue" // NFT_CONTINUE = -0x1
+	case NFT_DROP:
+		v = "drop"
+	case NFT_ACCEPT:
+		v = "accept"
+	case NFT_STOLEN:
+		v = "stolen"
+	case NFT_QUEUE:
+		v = "queue"
+	case NFT_REPEAT:
+		v = "repeat"
+	case NFT_STOP:
+		v = "stop"
+	default:
+		v = fmt.Sprintf("verdict %v", e.Kind)
+	}
+	if e.Chain != "" {
+		return v + " " + e.Chain
+	}
+	return v
+}

nftables_test.go

@@ -221,12 +221,27 @@ func TestRuleOperations(t *testing.T) {
 		expr.VerdictDrop,
 	}
 
+	wantStrings := []string{
+		"queue",
+		"accept",
+		"queue",
+		"accept",
+		"drop",
+		"drop",
+	}
+
 	for i, r := range rules {
 		rr, _ := r.Exprs[0].(*expr.Verdict)
 
 		if rr.Kind != want[i] {
 			t.Fatalf("bad verdict kind at %d", i)
 		}
+
+		if rr.String() != wantStrings[i] {
+			t.Fatalf("bad verdict string at %d: %s (received) vs. %s (expected)", i, rr.String(), wantStrings[i])
+		}
+
+		t.Logf("%s", rr)
 	}
 }
 

nftables_test.sh

@@ -0,0 +1,3 @@
+go test ./...
+go test -c github.com/google/nftables
+sudo ./nftables.test -test.v -run_system_tests