The set of meta fields for meta set is much more limited than meta load.
Currently supports setting a limited set of meta fields: pkttype.
It should also be able to support: mark, priority, nftrace, and secmark,
but these have yet to be implemented.
PiperOrigin-RevId: 674426635
Replaced overly wordy switch statements with concise maps.
Also makes the style consistent with how meta enum constants are processed.
PiperOrigin-RevId: 674402548
Currently supports a limited set of meta fields. The supported fields are
len, protocol, nfproto, l4proto, skiud, skgid, rtclassid (only for ipv6),
pkttype, prandom, time, day, and hour.
PiperOrigin-RevId: 674392201
Uses binary.NativeEndian & binary.BigEndian for all byteorder operations.
Also removes all magic number instances of 4 and 16 as register sizes.
PiperOrigin-RevId: 674065001
Out of the 5 route keys, we currently support all but IPsec/XRFM key.
However, classid key is only supported for IPv6 (needs support for IPv4 too).
Also removes repetition in validatePayloadBase & String for payloadBase.
PiperOrigin-RevId: 674044789
Last operation is thread-safe.
Includes minor state/structure changes that enable time tracking:
- Adds clock & start time to NFTables state (tcpip Standard Clock as default).
- Passes rule as argument to operation evaluation for access to NFTables state.
PiperOrigin-RevId: 674021450
The linux kernel defines the range operation, but its use has not been observed
in the nft binary debug output; commands use two comparison operations instead.
Thus, no interpretation of range operation via the nft binary debug output, but
it's fully supported. Similar comment has been left under operation definition.
Operation named "ranged" because "range" is a keyword in golang.
Also includes small change to the comparison operation evaluation; no
change in behavior.
PiperOrigin-RevId: 673932318
Change resulted from realization that it is currently unnecessary and extra to
store all bytesData within operations generically. If this is needed in the
future, we can change it then, but for now, a more direct and as-necessary
implementation is preferred.
PiperOrigin-RevId: 673908276
Recently printf.Analyzer has become stricter
(https://github.com/golang/go/issues/60529)
which led to new findings.
gvisor nogo tests run this analyzer and fail if it produces findings.
PiperOrigin-RevId: 671657227
Justification: Since the comparison operator is only valid for bytesData, the
constructor should recieve a byte slice as input and then convert it to
registerData. It makes less sense to have the caller create the registerData
from the byte slice if bytes data is the only type of registerData, we accept.
This change removes unnecessary checks and makes the code a lot less wordy by
removing the profuse amount of newBytesData calls for comparison construction.
PiperOrigin-RevId: 670652077
Tests payload set evaluation for all basic fields of IP, IPv6, & TCP headers.
Similar to PayloadLoad, these headers were prioritized. Setting other headers
should still work but wasn't explicitly tested. Tests for other packets should
be added later.
PiperOrigin-RevId: 670636213
Tests payload load evaluation for all basic fields of IP, IPv6, & TCP headers.
These are the main headers that are encountered for gVisor, so their
implementation was prioritized. Loading for other packet headers should work
as expected since raw/general payload loading works, but it has not been
explicitly tested. These tests should be added later and a TODO has been left
noting this.
PiperOrigin-RevId: 668202252
Previously, it was thought that the interpreter stored data and did evaluations
in Little Endian. The confusion originated from the nft binary's debug output,
which is the primary artifact guiding the interpreter's implementation. The
debug output of the nft binary prints data in Little Endian although the data
is actually being stored in Big Endian. Since this is the only reference we
have to implement the interpreter, other than the Linux kernel, we thought the
data matched the debug output directly such that the interpreter's host
representation was Little Endian. The mistake became clear when looking at the
Linux kernel code for the byteorder operation and realizing the apparent
inconsistencies.
This also came with a few other changes as a result of switching endianness.
Allows data of any number of bytes (0,16]
Converts data in nftinterp from Little to Big Endian to account for the debug
output's transformation.
PiperOrigin-RevId: 668151185
Removes Data- types and switches to Go's built-in type system.
Modifies tests to allow for creation and interpretation of 8- and 12-byte data.
Change became necessary when it was noticed that some nft binary operations
allowed for 8-byte data. Previously believed data was restricted to 4 or 16
bytes, but turned out the restriction is for data to be given in multiples of 4
bytes. This change corrects that.
PiperOrigin-RevId: 666542163
Loop checking is done whenever a rule is registered to a chain.
Includes restructuring how rules are added/registered to chains to make loop
checking consistent and restrict adding operations to already registered rules.
Change also performs minor code re-org, moving evaluation methods to the top.
PiperOrigin-RevId: 663039449
Implement the necessary structure for rules to be parsed and interpreted.
The interpreter parses one line at a time with each line corresponding
to a single operation in a rule.
PiperOrigin-RevId: 660575983
Change flushes out the Rule type and defines Operation interface.
Logic incorporates the RegisterSet and a pseudo jumpstack and supports jumping
between chains via jump and goto Verdicts starting from a base chain.
Individual operations have left to be implemented.
PiperOrigin-RevId: 660470222
RegisterSet will be modified by each operation and will hold resulting verdicts
in the verdict register.
RegisterData will be stored in operations and used to set the data of specific
registers within the RegisterSet.
Both will be used mainly during packet evaluation.
PiperOrigin-RevId: 659637471
