diff --git a/nftables_test.go b/nftables_test.go index e8e8177..bb61d6d 100644 --- a/nftables_test.go +++ b/nftables_test.go @@ -3498,6 +3498,66 @@ func TestCreateUseNamedSet(t *testing.T) { } } +func TestCreateAutoMergeSet(t *testing.T) { + // Create a new network namespace to test these operations, + // and tear down the namespace at test completion. + c, newNS := nftest.OpenSystemConn(t, *enableSysTests) + defer nftest.CleanupSystemConn(t, newNS) + // Clear all rules at the beginning + end of the test. + c.FlushRuleset() + defer c.FlushRuleset() + + filter := c.AddTable(&nftables.Table{ + Family: nftables.TableFamilyIPv4, + Name: "filter", + }) + + portSet := &nftables.Set{ + Table: filter, + Name: "test", + KeyType: nftables.TypeInetService, + Interval: true, + AutoMerge: true, + } + if err := c.AddSet(portSet, nil); err != nil { + t.Errorf("c.AddSet(portSet) failed: %v", err) + } + if err := c.SetAddElements(portSet, []nftables.SetElement{{Key: binaryutil.BigEndian.PutUint16(22)}}); err != nil { + t.Errorf("c.SetVal(portSet) failed: %v", err) + } + + ipSet := &nftables.Set{ + Table: filter, + Name: "IPs_4_dayz", + KeyType: nftables.TypeIPAddr, + Interval: true, + AutoMerge: true, + } + if err := c.AddSet(ipSet, []nftables.SetElement{{Key: []byte(net.ParseIP("192.168.1.64").To4())}}); err != nil { + t.Errorf("c.AddSet(ipSet) failed: %v", err) + } + if err := c.SetAddElements(ipSet, []nftables.SetElement{{Key: []byte(net.ParseIP("192.168.1.42").To4())}}); err != nil { + t.Errorf("c.SetVal(ipSet) failed: %v", err) + } + if err := c.Flush(); err != nil { + t.Errorf("c.Flush() failed: %v", err) + } + + sets, err := c.GetSets(filter) + if err != nil { + t.Errorf("c.GetSets() failed: %v", err) + } + if len(sets) != 2 { + t.Fatalf("len(sets) = %d, want 2", len(sets)) + } + if !sets[0].AutoMerge { + t.Errorf("set[0].AutoMerge = %v, want true", sets[0].AutoMerge) + } + if !sets[1].AutoMerge { + t.Errorf("set[1].AutoMerge = %v, want true", sets[1].AutoMerge) + } +} + func TestIP6SetAddElements(t *testing.T) { // Create a new network namespace to test these operations, // and tear down the namespace at test completion. diff --git a/set.go b/set.go index 401b9b4..d5afff3 100644 --- a/set.go +++ b/set.go @@ -21,10 +21,10 @@ import ( "strings" "time" + "github.com/google/nftables/binaryutil" "github.com/google/nftables/expr" "github.com/google/nftables/internal/parseexprfunc" - - "github.com/google/nftables/binaryutil" + "github.com/google/nftables/userdata" "github.com/mdlayher/netlink" "golang.org/x/sys/unix" ) @@ -249,6 +249,7 @@ type Set struct { Anonymous bool Constant bool Interval bool + AutoMerge bool IsMap bool HasTimeout bool Counter bool @@ -580,15 +581,27 @@ func (cc *Conn) AddSet(s *Set, vals []SetElement) error { // Marshal concat size description as set description tableInfo = append(tableInfo, netlink.Attribute{Type: unix.NLA_F_NESTED | unix.NFTA_SET_DESC, Data: concatBytes}) } + + // https://git.netfilter.org/libnftnl/tree/include/udata.h#n17 + var userData []byte + if s.Anonymous || s.Constant || s.Interval || s.KeyByteOrder == binaryutil.BigEndian { - tableInfo = append(tableInfo, - // Semantically useless - kept for binary compatability with nft - netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: []byte("\x00\x04\x02\x00\x00\x00")}) + // Semantically useless - kept for binary compatability with nft + userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_KEYBYTEORDER, 2) } else if s.KeyByteOrder == binaryutil.NativeEndian { // Per https://git.netfilter.org/nftables/tree/src/mnl.c?id=187c6d01d35722618c2711bbc49262c286472c8f#n1165 - tableInfo = append(tableInfo, - netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: []byte("\x00\x04\x01\x00\x00\x00")}) + userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_KEYBYTEORDER, 1) } + + if s.Interval && s.AutoMerge { + // https://git.netfilter.org/nftables/tree/src/mnl.c?id=187c6d01d35722618c2711bbc49262c286472c8f#n1174 + userData = userdata.AppendUint32(userData, userdata.NFTNL_UDATA_SET_MERGE_ELEMENTS, 1) + } + + if len(userData) > 0 { + tableInfo = append(tableInfo, netlink.Attribute{Type: unix.NFTA_SET_USERDATA, Data: userData}) + } + if s.Counter { data, err := netlink.MarshalAttributes([]netlink.Attribute{ {Type: unix.NFTA_LIST_ELEM, Data: []byte("counter\x00")}, @@ -740,6 +753,10 @@ func setsFromMsg(msg netlink.Message) (*Set, error) { set.DataType = dt case unix.NFTA_SET_DATA_LEN: set.DataType.Bytes = binary.BigEndian.Uint32(ad.Bytes()) + case unix.NFTA_SET_USERDATA: + data := ad.Bytes() + value, ok := userdata.GetUint32(data, userdata.NFTNL_UDATA_SET_MERGE_ELEMENTS) + set.AutoMerge = ok && value == 1 } } return &set, nil diff --git a/userdata/userdata.go b/userdata/userdata.go index 611919a..b8df006 100644 --- a/userdata/userdata.go +++ b/userdata/userdata.go @@ -31,6 +31,21 @@ const ( TypesCount ) +// TLV type values are defined in: +// https://git.netfilter.org/libnftnl/tree/include/libnftnl/udata.h#n39 +const ( + NFTNL_UDATA_SET_KEYBYTEORDER Type = iota + NFTNL_UDATA_SET_DATABYTEORDER + NFTNL_UDATA_SET_MERGE_ELEMENTS + NFTNL_UDATA_SET_KEY_TYPEOF + NFTNL_UDATA_SET_DATA_TYPEOF + NFTNL_UDATA_SET_EXPR + NFTNL_UDATA_SET_DATA_INTERVAL + NFTNL_UDATA_SET_COMMENT + + NFTNL_UDATA_SET_MAX +) + func Append(udata []byte, typ Type, data []byte) []byte { udata = append(udata, byte(typ), byte(len(data))) udata = append(udata, data...)