Fix Fib parsing

google · Jan 15, 2025 · 6192a1e · 6192a1e
1 parent 85aee13
commit 6192a1e
Show file tree

Hide file tree

Showing 3 changed files with 71 additions and 9 deletions.
diff --git a/expr/expr.go b/expr/expr.go
@@ -207,6 +207,8 @@ func exprFromName(name string) Any {
 		e = &SecMark{}
 	case "cttimeout":
 		e = &CtTimeout{}
+	case "fib":
+		e = &Fib{}
 	}
 	return e
 }

diff --git a/expr/fib.go b/expr/fib.go
@@ -118,17 +118,22 @@ func (e *Fib) unmarshal(fam byte, data []byte) error {
 			e.Register = ad.Uint32()
 		case unix.NFTA_FIB_RESULT:
 			result := ad.Uint32()
-			e.ResultOIF = (result & unix.NFT_FIB_RESULT_OIF) == 1
-			e.ResultOIFNAME = (result & unix.NFT_FIB_RESULT_OIFNAME) == 1
-			e.ResultADDRTYPE = (result & unix.NFT_FIB_RESULT_ADDRTYPE) == 1
+			switch result {
+			case unix.NFT_FIB_RESULT_OIF:
+				e.ResultOIF = true
+			case unix.NFT_FIB_RESULT_OIFNAME:
+				e.ResultOIFNAME = true
+			case unix.NFT_FIB_RESULT_ADDRTYPE:
+				e.ResultADDRTYPE = true
+			}
 		case unix.NFTA_FIB_FLAGS:
 			flags := ad.Uint32()
-			e.FlagSADDR = (flags & unix.NFTA_FIB_F_SADDR) == 1
-			e.FlagDADDR = (flags & unix.NFTA_FIB_F_DADDR) == 1
-			e.FlagMARK = (flags & unix.NFTA_FIB_F_MARK) == 1
-			e.FlagIIF = (flags & unix.NFTA_FIB_F_IIF) == 1
-			e.FlagOIF = (flags & unix.NFTA_FIB_F_OIF) == 1
-			e.FlagPRESENT = (flags & unix.NFTA_FIB_F_PRESENT) == 1
+			e.FlagSADDR = (flags & unix.NFTA_FIB_F_SADDR) == unix.NFTA_FIB_F_SADDR
+			e.FlagDADDR = (flags & unix.NFTA_FIB_F_DADDR) == unix.NFTA_FIB_F_DADDR
+			e.FlagMARK = (flags & unix.NFTA_FIB_F_MARK) == unix.NFTA_FIB_F_MARK
+			e.FlagIIF = (flags & unix.NFTA_FIB_F_IIF) == unix.NFTA_FIB_F_IIF
+			e.FlagOIF = (flags & unix.NFTA_FIB_F_OIF) == unix.NFTA_FIB_F_OIF
+			e.FlagPRESENT = (flags & unix.NFTA_FIB_F_PRESENT) == unix.NFTA_FIB_F_PRESENT
 		}
 	}
 	return ad.Err()

diff --git a/nftables_test.go b/nftables_test.go
@@ -6387,6 +6387,61 @@ func TestFib(t *testing.T) {
 	}
 }
 
+func TestFibSystem(t *testing.T) {
+	c, newNS := nftest.OpenSystemConn(t, *enableSysTests)
+	defer nftest.CleanupSystemConn(t, newNS)
+	c.FlushRuleset()
+	defer c.FlushRuleset()
+
+	filter := c.AddTable(&nftables.Table{
+		Family: nftables.TableFamilyIPv4,
+		Name:   "filter",
+	})
+
+	chain := c.AddChain(&nftables.Chain{
+		Name:  "test-chain",
+		Table: filter,
+	})
+
+	expect := &expr.Fib{
+		Register:       1,
+		FlagDADDR:      true,
+		ResultADDRTYPE: true,
+	}
+
+	c.AddRule(&nftables.Rule{
+		Table: filter,
+		Chain: chain,
+		Exprs: []expr.Any{expect},
+	})
+
+	if err := c.Flush(); err != nil {
+		t.Fatalf("c.Flush() failed with error %+v", err)
+	}
+
+	rules, err := c.GetRules(filter, chain)
+	if err != nil {
+		t.Fatalf("GetRules failed: %v", err)
+	}
+
+	if got, want := len(rules), 1; got != want {
+		t.Fatalf("unexpected number of rules: got %d, want %d", got, want)
+	}
+
+	if got, want := len(rules[0].Exprs), 1; got != want {
+		t.Fatalf("unexpected number of exprs: got %d, want %d", got, want)
+	}
+
+	fib := rules[0].Exprs[0].(*expr.Fib)
+	if got, want := fib.FlagDADDR, expect.FlagDADDR; got != want {
+		t.Errorf("fib daddr not equal: got %+v, want %+v", got, want)
+	}
+
+	if got, want := fib.ResultADDRTYPE, expect.ResultADDRTYPE; got != want {
+		t.Errorf("fib addr type not equal: got %+v, want %+v", got, want)
+	}
+}
+
 func TestNumgen(t *testing.T) {
 	tests := []struct {
 		name        string