bridge: Add macspoofchk support

The new macspoofchk field is added to the bridge plugin to support
anti-mac-spoofing.
When the parameter is enabled, traffic is limited to the mac addresses
of the container interface (the veth peer that is placed in the
container ns).
Any traffic that exits the pod is checked against the source mac address
that is expected. If the mac address is different, the frames are
dropped.

The implementation is using nftables and should only be used on nodes
that support it.

Signed-off-by: Edward Haas <edwardh@redhat.com>

vendor/github.com/networkplumbing/go-nft/nft/chain.go

@@ -0,0 +1,82 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package nft
+
+import (
+	"github.com/networkplumbing/go-nft/nft/schema"
+)
+
+type ChainType string
+type ChainHook string
+type ChainPolicy string
+
+// Chain Types
+const (
+	TypeFilter ChainType = schema.TypeFilter
+	TypeNAT    ChainType = schema.TypeNAT
+	TypeRoute  ChainType = schema.TypeRoute
+)
+
+// Chain Hooks
+const (
+	HookPreRouting  ChainHook = schema.HookPreRouting
+	HookInput       ChainHook = schema.HookInput
+	HookOutput      ChainHook = schema.HookOutput
+	HookForward     ChainHook = schema.HookForward
+	HookPostRouting ChainHook = schema.HookPostRouting
+	HookIngress     ChainHook = schema.HookIngress
+)
+
+// Chain Policies
+const (
+	PolicyAccept ChainPolicy = schema.PolicyAccept
+	PolicyDrop   ChainPolicy = schema.PolicyDrop
+)
+
+// NewRegularChain returns a new schema chain structure for a regular chain.
+func NewRegularChain(table *schema.Table, name string) *schema.Chain {
+	return NewChain(table, name, nil, nil, nil, nil)
+}
+
+// NewChain returns a new schema chain structure for a base chain.
+// For base chains, all arguments are required except the policy.
+// Missing arguments will cause an error once the config is applied.
+func NewChain(table *schema.Table, name string, ctype *ChainType, hook *ChainHook, prio *int, policy *ChainPolicy) *schema.Chain {
+	c := &schema.Chain{
+		Family: table.Family,
+		Table:  table.Name,
+		Name:   name,
+	}
+
+	if ctype != nil {
+		c.Type = string(*ctype)
+	}
+	if hook != nil {
+		c.Hook = string(*hook)
+	}
+	if prio != nil {
+		c.Prio = prio
+	}
+	if policy != nil {
+		c.Policy = string(*policy)
+	}
+
+	return c
+}

vendor/github.com/networkplumbing/go-nft/nft/config.go

@@ -0,0 +1,45 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package nft
+
+import (
+	nftconfig "github.com/networkplumbing/go-nft/nft/config"
+	nftexec "github.com/networkplumbing/go-nft/nft/exec"
+)
+
+type Config = nftconfig.Config
+
+// NewConfig returns a new nftables config structure.
+func NewConfig() *nftconfig.Config {
+	return nftconfig.New()
+}
+
+// ReadConfig loads the nftables configuration from the system and
+// returns it as a nftables config structure.
+// The system is expected to have the `nft` executable deployed and nftables enabled in the kernel.
+func ReadConfig() (*Config, error) {
+	return nftexec.ReadConfig()
+}
+
+// ApplyConfig applies the given nftables config on the system.
+// The system is expected to have the `nft` executable deployed and nftables enabled in the kernel.
+func ApplyConfig(c *Config) error {
+	return nftexec.ApplyConfig(c)
+}

vendor/github.com/networkplumbing/go-nft/nft/config/chain.go

@@ -0,0 +1,80 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package config
+
+import (
+	"github.com/networkplumbing/go-nft/nft/schema"
+)
+
+// AddChain appends the given chain to the nftable config.
+// The chain is added without an explicit action (`add`).
+// Adding multiple times the same chain has no affect when the config is applied.
+func (c *Config) AddChain(chain *schema.Chain) {
+	nftable := schema.Nftable{Chain: chain}
+	c.Nftables = append(c.Nftables, nftable)
+}
+
+// DeleteChain appends a given chain to the nftable config
+// with the `delete` action.
+// Attempting to delete a non-existing chain, results with a failure when the config is applied.
+// The chain must not contain any rules or be used as a jump target.
+func (c *Config) DeleteChain(chain *schema.Chain) {
+	nftable := schema.Nftable{Delete: &schema.Objects{Chain: chain}}
+	c.Nftables = append(c.Nftables, nftable)
+}
+
+// FlushChain appends a given chain to the nftable config
+// with the `flush` action.
+// All rules under the chain are removed (when applied).
+// Attempting to flush a non-existing chain, results with a failure when the config is applied.
+func (c *Config) FlushChain(chain *schema.Chain) {
+	nftable := schema.Nftable{Flush: &schema.Objects{Chain: chain}}
+	c.Nftables = append(c.Nftables, nftable)
+}
+
+// LookupChain searches the configuration for a matching chain and returns it.
+// The chain is matched first by the table and chain name.
+// Other matching fields are optional (for matching base chains).
+// Mutating the returned chain will result in mutating the configuration.
+func (c *Config) LookupChain(toFind *schema.Chain) *schema.Chain {
+	for _, nftable := range c.Nftables {
+		if chain := nftable.Chain; chain != nil {
+			match := chain.Table == toFind.Table && chain.Family == toFind.Family && chain.Name == toFind.Name
+			if match {
+				if t := toFind.Type; t != "" {
+					match = match && chain.Type == t
+				}
+				if h := toFind.Hook; h != "" {
+					match = match && chain.Hook == h
+				}
+				if p := toFind.Prio; p != nil {
+					match = match && chain.Prio != nil && *chain.Prio == *p
+				}
+				if p := toFind.Policy; p != "" {
+					match = match && chain.Policy == p
+				}
+				if match {
+					return chain
+				}
+			}
+		}
+	}
+	return nil
+}

vendor/github.com/networkplumbing/go-nft/nft/config/config.go

@@ -0,0 +1,59 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package config
+
+import (
+	"encoding/json"
+
+	"github.com/networkplumbing/go-nft/nft/schema"
+)
+
+type Config struct {
+	schema.Root
+}
+
+// New returns a new nftables config structure.
+func New() *Config {
+	c := &Config{}
+	c.Nftables = []schema.Nftable{}
+	return c
+}
+
+// ToJSON returns the JSON encoding of the nftables config.
+func (c *Config) ToJSON() ([]byte, error) {
+	return json.Marshal(*c)
+}
+
+// FromJSON decodes the provided JSON-encoded data and populates the nftables config.
+func (c *Config) FromJSON(data []byte) error {
+	if err := json.Unmarshal(data, c); err != nil {
+		return err
+	}
+	return nil
+}
+
+// FlushRuleset adds a command to the nftables config that erases all the configuration when applied.
+// It is commonly used as the first config instruction, followed by a declarative configuration.
+// When used, any previous configuration is flushed away before adding the new one.
+// Calling FlushRuleset updates the configuration and will take effect only
+// when applied on the system.
+func (c *Config) FlushRuleset() {
+	c.Nftables = append(c.Nftables, schema.Nftable{Flush: &schema.Objects{Ruleset: true}})
+}

vendor/github.com/networkplumbing/go-nft/nft/config/rule.go

@@ -0,0 +1,94 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package config
+
+import (
+	"bytes"
+	"encoding/json"
+
+	"github.com/networkplumbing/go-nft/nft/schema"
+)
+
+// AddRule appends the given rule to the nftable config.
+// The rule is added without an explicit action (`add`).
+// Adding multiple times the same rule will result in multiple identical rules when applied.
+func (c *Config) AddRule(rule *schema.Rule) {
+	nftable := schema.Nftable{Rule: rule}
+	c.Nftables = append(c.Nftables, nftable)
+}
+
+// DeleteRule appends a given rule to the nftable config
+// with the `delete` action.
+// A rule is identified by its handle ID and it must be present in the given rule.
+// Attempting to delete a non-existing rule, results with a failure when the config is applied.
+// A common usage is to use LookupRule() and then to pass the result to DeleteRule.
+func (c *Config) DeleteRule(rule *schema.Rule) {
+	nftable := schema.Nftable{Delete: &schema.Objects{Rule: rule}}
+	c.Nftables = append(c.Nftables, nftable)
+}
+
+// LookupRule searches the configuration for a matching rule and returns it.
+// The rule is matched first by the table and chain.
+// Other matching fields are optional (nil or an empty string arguments imply no-matching).
+// Mutating the returned chain will result in mutating the configuration.
+func (c *Config) LookupRule(toFind *schema.Rule) []*schema.Rule {
+	var rules []*schema.Rule
+
+	for _, nftable := range c.Nftables {
+		if r := nftable.Rule; r != nil {
+			match := r.Table == toFind.Table && r.Family == toFind.Family && r.Chain == toFind.Chain
+			if match {
+				if h := toFind.Handle; h != nil {
+					match = match && r.Handle != nil && *r.Handle == *h
+				}
+				if i := toFind.Index; i != nil {
+					match = match && r.Index != nil && *r.Index == *i
+				}
+				if co := toFind.Comment; co != "" {
+					match = match && r.Comment == co
+				}
+				if toFindStatements := toFind.Expr; toFindStatements != nil {
+					if match = match && len(toFindStatements) == len(r.Expr); match {
+						for i, toFindStatement := range toFindStatements {
+							equal, err := areStatementsEqual(toFindStatement, r.Expr[i])
+							match = match && err == nil && equal
+						}
+					}
+				}
+				if match {
+					rules = append(rules, r)
+				}
+			}
+		}
+	}
+	return rules
+}
+
+func areStatementsEqual(statementA, statementB schema.Statement) (bool, error) {
+	statementARow, err := json.Marshal(statementA)
+	if err != nil {
+		return false, err
+	}
+	statementBRow, err := json.Marshal(statementB)
+	if err != nil {
+		return false, err
+	}
+	return bytes.Equal(statementARow, statementBRow), nil
+}

vendor/github.com/networkplumbing/go-nft/nft/config/table.go

@@ -0,0 +1,63 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package config
+
+import (
+	"github.com/networkplumbing/go-nft/nft/schema"
+)
+
+// AddTable appends the given table to the nftable config.
+// The table is added without an explicit action (`add`).
+// Adding multiple times the same table has no effect when the config is applied.
+func (c *Config) AddTable(table *schema.Table) {
+	nftable := schema.Nftable{Table: table}
+	c.Nftables = append(c.Nftables, nftable)
+}
+
+// DeleteTable appends a given table to the nftable config
+// with the `delete` action.
+// Attempting to delete a non-existing table, results with a failure when the config is applied.
+// All chains and rules under the table are removed as well (when applied).
+func (c *Config) DeleteTable(table *schema.Table) {
+	nftable := schema.Nftable{Delete: &schema.Objects{Table: table}}
+	c.Nftables = append(c.Nftables, nftable)
+}
+
+// FlushTable appends a given table to the nftable config
+// with the `flush` action.
+// All chains and rules under the table are removed (when applied).
+// Attempting to flush a non-existing table, results with a failure when the config is applied.
+func (c *Config) FlushTable(table *schema.Table) {
+	nftable := schema.Nftable{Flush: &schema.Objects{Table: table}}
+	c.Nftables = append(c.Nftables, nftable)
+}
+
+// LookupTable searches the configuration for a matching table and returns it.
+// Mutating the returned table will result in mutating the configuration.
+func (c *Config) LookupTable(toFind *schema.Table) *schema.Table {
+	for _, nftable := range c.Nftables {
+		if t := nftable.Table; t != nil {
+			if t.Name == toFind.Name && t.Family == toFind.Family {
+				return t
+			}
+		}
+	}
+	return nil
+}

vendor/github.com/networkplumbing/go-nft/nft/doc.go

@@ -0,0 +1,48 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+// Package nft provides a GO API to nftables.
+// Together with the schema package, it allows to build, read and apply
+// nftables configuration on a supporting system.
+//
+// The schema structures are based on libnftables-json (https://www.mankier.com/5/libnftables-json)
+// and implement a subset of them.
+//
+// To create a new configuration, use `NewConfig` followed by methods
+// which populates the configuration with tables, chains and rules, accompanied
+// to specific actions (add, delete, flush).
+//
+//   config := nft.NewConfig()
+//   table := nft.NewTable("mytable", nft.FamilyIP)
+//   config.AddTable(table)
+//   chain := nft.NewRegularChain(table, "mychain")
+//   config.AddChain(chain)
+//   rule := nft.NewRule(table, chain, statements, nil, nil, "mycomment")
+//
+// To apply a configuration on the system, use the `ApplyConfig` function.
+//   err := nft.ApplyConfig(config)
+//
+// To read the configuration from the system, use the `ReadConfig` function.
+//   config, err := nft.ReadConfig()
+//
+// For full setup example, see the integration test: tests/config_test.go
+//
+// The nft package is dependent on the `nft` binary and the kernel nftables
+// support.
+package nft

vendor/github.com/networkplumbing/go-nft/nft/exec/exec.go

@@ -0,0 +1,102 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package exec
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"strings"
+
+	nftconfig "github.com/networkplumbing/go-nft/nft/config"
+)
+
+const (
+	cmdBin     = "nft"
+	cmdFile    = "-f"
+	cmdJSON    = "-j"
+	cmdList    = "list"
+	cmdRuleset = "ruleset"
+)
+
+// ReadConfig loads the nftables configuration from the system and
+// returns it as a nftables config structure.
+// The system is expected to have the `nft` executable deployed and nftables enabled in the kernel.
+func ReadConfig() (*nftconfig.Config, error) {
+	stdout, err := execCommand(cmdJSON, cmdList, cmdRuleset)
+	if err != nil {
+		return nil, err
+	}
+
+	config := nftconfig.New()
+	if err := config.FromJSON(stdout.Bytes()); err != nil {
+		return nil, fmt.Errorf("failed to list ruleset: %v", err)
+	}
+
+	return config, nil
+}
+
+// ApplyConfig applies the given nftables config on the system.
+// The system is expected to have the `nft` executable deployed and nftables enabled in the kernel.
+func ApplyConfig(c *nftconfig.Config) error {
+	data, err := c.ToJSON()
+	if err != nil {
+		return err
+	}
+
+	tmpFile, err := ioutil.TempFile(os.TempDir(), "spoofcheck-")
+	if err != nil {
+		return fmt.Errorf("failed to create temporary file: %v", err)
+	}
+	defer os.Remove(tmpFile.Name())
+
+	if _, err = tmpFile.Write(data); err != nil {
+		return fmt.Errorf("failed to write to temporary file: %v", err)
+	}
+
+	if err := tmpFile.Close(); err != nil {
+		return fmt.Errorf("failed to close temporary file: %v", err)
+	}
+
+	if _, err := execCommand(cmdJSON, cmdFile, tmpFile.Name()); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func execCommand(args ...string) (*bytes.Buffer, error) {
+	cmd := exec.Command(cmdBin, args...)
+
+	var stdout, stderr bytes.Buffer
+	cmd.Stderr = &stderr
+	cmd.Stdout = &stdout
+
+	if err := cmd.Run(); err != nil {
+		return nil, fmt.Errorf(
+			"failed to execute %s %s: %v stdout:'%s' stderr:'%s'",
+			cmd.Path, strings.Join(cmd.Args, " "), err, stdout.String(), stderr.String(),
+		)
+	}
+
+	return &stdout, nil
+}

vendor/github.com/networkplumbing/go-nft/nft/rule.go

@@ -0,0 +1,58 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package nft
+
+import (
+	"github.com/networkplumbing/go-nft/nft/schema"
+)
+
+// NewRule returns a new schema rule structure.
+func NewRule(table *schema.Table, chain *schema.Chain, expr []schema.Statement, handle *int, index *int, comment string) *schema.Rule {
+	c := &schema.Rule{
+		Family:  table.Family,
+		Table:   table.Name,
+		Chain:   chain.Name,
+		Expr:    expr,
+		Handle:  handle,
+		Index:   index,
+		Comment: comment,
+	}
+
+	return c
+}
+
+type RuleIndex int
+
+// NewRuleIndex returns a rule index object which acts as an iterator.
+// When multiple rules are added to a chain, index allows to define an order between them.
+// The first rule which is added to a chain should have no index (it is assigned index 0),
+// following rules should have the index set, referencing after/before which rule the new one is to be added/inserted.
+func NewRuleIndex() *RuleIndex {
+	var index RuleIndex = -1
+	return &index
+}
+
+// Next returns the next iteration value as an integer pointer.
+// When first time called, it returns the value 0.
+func (i *RuleIndex) Next() *int {
+	*i++
+	var index = int(*i)
+	return &index
+}

vendor/github.com/networkplumbing/go-nft/nft/schema/chain.go

@@ -0,0 +1,53 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package schema
+
+// Chain Types
+const (
+	TypeFilter = "filter"
+	TypeNAT    = "nat"
+	TypeRoute  = "route"
+)
+
+// Chain Hooks
+const (
+	HookPreRouting  = "prerouting"
+	HookInput       = "input"
+	HookOutput      = "output"
+	HookForward     = "forward"
+	HookPostRouting = "postrouting"
+	HookIngress     = "ingress"
+)
+
+// Chain Policies
+const (
+	PolicyAccept = "accept"
+	PolicyDrop   = "drop"
+)
+
+type Chain struct {
+	Family string `json:"family"`
+	Table  string `json:"table"`
+	Name   string `json:"name"`
+	Type   string `json:"type,omitempty"`
+	Hook   string `json:"hook,omitempty"`
+	Prio   *int   `json:"prio,omitempty"`
+	Policy string `json:"policy,omitempty"`
+}

vendor/github.com/networkplumbing/go-nft/nft/schema/rule.go

@@ -0,0 +1,366 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package schema
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+type Rule struct {
+	Family  string      `json:"family"`
+	Table   string      `json:"table"`
+	Chain   string      `json:"chain"`
+	Expr    []Statement `json:"expr,omitempty"`
+	Handle  *int        `json:"handle,omitempty"`
+	Index   *int        `json:"index,omitempty"`
+	Comment string      `json:"comment,omitempty"`
+}
+
+type Statement struct {
+	Counter *Counter `json:"counter,omitempty"`
+	Match   *Match   `json:"match,omitempty"`
+	Verdict
+	Nat
+}
+
+type Counter struct {
+	Packets int `json:"packets"`
+	Bytes   int `json:"bytes"`
+}
+
+type Nat struct {
+	Snat       *Snat       `json:"snat,omitempty"`
+	Dnat       *Dnat       `json:"dnat,omitempty"`
+	Masquerade *Masquerade `json:"masquerade,omitempty"`
+	Redirect   *Redirect   `json:"redirect,omitempty"`
+}
+
+type Snat struct {
+	Addr   *Expression `json:"addr,omitempty"`
+	Family *string     `json:"family,omitempty"`
+	Port   *Expression `json:"port,omitempty"`
+	Flags  *Flags      `json:"flags,omitempty"`
+}
+
+type Dnat struct {
+	Addr   *Expression `json:"addr,omitempty"`
+	Family *string     `json:"family,omitempty"`
+	Port   *Expression `json:"port,omitempty"`
+	Flags  *Flags      `json:"flags,omitempty"`
+}
+
+const masquerade = "masquerade"
+
+type Masquerade struct {
+	Enabled bool        `json:"-"`
+	Port    *Expression `json:"port,omitempty"`
+	Flags   *Flags      `json:"flags,omitempty"`
+}
+
+const redirect = "redirect"
+
+type Redirect struct {
+	Enabled bool        `json:"-"`
+	Port    *Expression `json:"port,omitempty"`
+	Flags   *Flags      `json:"flags,omitempty"`
+}
+
+type Flags struct {
+	Flags []string `json:"-"`
+}
+
+// NAT Flags
+const (
+	NATFlagRandom      = "random"
+	NATFlagFullyRandom = "fully-random"
+	NATFlagPersistent  = "persistent"
+)
+
+type Verdict struct {
+	SimpleVerdict
+	Jump *ToTarget `json:"jump,omitempty"`
+	Goto *ToTarget `json:"goto,omitempty"`
+}
+
+type SimpleVerdict struct {
+	Accept   bool `json:"-"`
+	Continue bool `json:"-"`
+	Drop     bool `json:"-"`
+	Return   bool `json:"-"`
+}
+
+type ToTarget struct {
+	Target string `json:"target"`
+}
+
+type Match struct {
+	Op    string     `json:"op"`
+	Left  Expression `json:"left"`
+	Right Expression `json:"right"`
+}
+
+type Expression struct {
+	String  *string  `json:"-"`
+	Bool    *bool    `json:"-"`
+	Float64 *float64 `json:"-"`
+	Payload *Payload `json:"payload,omitempty"`
+	// RowData accepts arbitrary data which cannot be composed from the existing schema.
+	// Use `json.RawMessage()` or `[]byte()` for the value.
+	// Example:
+	// `schema.Expression{RowData: json.RawMessage(`{"meta":{"key":"iifname"}}`)}`
+	RowData json.RawMessage `json:"-"`
+}
+
+type Payload struct {
+	Protocol string `json:"protocol"`
+	Field    string `json:"field"`
+}
+
+// Verdict Operations
+const (
+	VerdictAccept   = "accept"
+	VerdictContinue = "continue"
+	VerdictDrop     = "drop"
+	VerdictReturn   = "return"
+)
+
+// Match Operators
+const (
+	OperAND = "&"  // Binary AND
+	OperOR  = "|"  // Binary OR
+	OperXOR = "^"  // Binary XOR
+	OperLSH = "<<" // Left shift
+	OperRSH = ">>" // Right shift
+	OperEQ  = "==" // Equal
+	OperNEQ = "!=" // Not equal
+	OperLS  = "<"  // Less than
+	OperGR  = ">"  // Greater than
+	OperLSE = "<=" // Less than or equal to
+	OperGRE = ">=" // Greater than or equal to
+	OperIN  = "in" // Perform a lookup, i.e. test if bits on RHS are contained in LHS value
+)
+
+// Payload Expressions
+const (
+	PayloadKey = "payload"
+	// Ethernet
+	PayloadProtocolEther   = "ether"
+	PayloadFieldEtherDAddr = "daddr"
+	PayloadFieldEtherSAddr = "saddr"
+	PayloadFieldEtherType  = "type"
+
+	// IP (common)
+	PayloadFieldIPVer   = "version"
+	PayloadFieldIPDscp  = "dscp"
+	PayloadFieldIPEcn   = "ecn"
+	PayloadFieldIPLen   = "length"
+	PayloadFieldIPSAddr = "saddr"
+	PayloadFieldIPDAddr = "daddr"
+
+	// IPv4
+	PayloadProtocolIP4      = "ip"
+	PayloadFieldIP4HdrLen   = "hdrlength"
+	PayloadFieldIP4Id       = "id"
+	PayloadFieldIP4FragOff  = "frag-off"
+	PayloadFieldIP4Ttl      = "ttl"
+	PayloadFieldIP4Protocol = "protocol"
+	PayloadFieldIP4Chksum   = "checksum"
+
+	// IPv6
+	PayloadProtocolIP6       = "ip6"
+	PayloadFieldIP6FlowLabel = "flowlabel"
+	PayloadFieldIP6NextHdr   = "nexthdr"
+	PayloadFieldIP6HopLimit  = "hoplimit"
+)
+
+func (s Statement) MarshalJSON() ([]byte, error) {
+	type _Statement Statement
+	statement := _Statement(s)
+
+	// Convert to a dynamic structure
+	data, err := json.Marshal(statement)
+	if err != nil {
+		return nil, err
+	}
+	dynamicStructure := make(map[string]json.RawMessage)
+	if err := json.Unmarshal(data, &dynamicStructure); err != nil {
+		return nil, err
+	}
+
+	switch {
+	case s.Accept:
+		dynamicStructure[VerdictAccept] = nil
+	case s.Continue:
+		dynamicStructure[VerdictContinue] = nil
+	case s.Drop:
+		dynamicStructure[VerdictDrop] = nil
+	case s.Return:
+		dynamicStructure[VerdictReturn] = nil
+	case s.Masquerade != nil && s.Masquerade.Enabled && s.Masquerade.Port == nil && s.Masquerade.Flags == nil:
+		dynamicStructure[masquerade] = nil
+	case s.Redirect != nil && s.Redirect.Enabled && s.Redirect.Port == nil && s.Redirect.Flags == nil:
+		dynamicStructure[redirect] = nil
+	}
+
+	data, err = json.Marshal(dynamicStructure)
+	if err != nil {
+		return nil, err
+	}
+	return data, nil
+}
+
+func (s *Statement) UnmarshalJSON(data []byte) error {
+	type _Statement Statement
+	statement := _Statement{}
+
+	if err := json.Unmarshal(data, &statement); err != nil {
+		return err
+	}
+	*s = Statement(statement)
+
+	dynamicStructure := make(map[string]json.RawMessage)
+	if err := json.Unmarshal(data, &dynamicStructure); err != nil {
+		return err
+	}
+	_, s.Accept = dynamicStructure[VerdictAccept]
+	_, s.Continue = dynamicStructure[VerdictContinue]
+	_, s.Drop = dynamicStructure[VerdictDrop]
+	_, s.Return = dynamicStructure[VerdictReturn]
+
+	if _, masqueradeDefined := dynamicStructure[masquerade]; s.Masquerade == nil && masqueradeDefined {
+		s.Masquerade = &Masquerade{Enabled: true}
+	}
+
+	if _, redirectDefined := dynamicStructure[redirect]; s.Redirect == nil && redirectDefined {
+		s.Redirect = &Redirect{Enabled: true}
+	}
+
+	return nil
+}
+
+func (e Expression) MarshalJSON() ([]byte, error) {
+	var dynamicStruct interface{}
+
+	switch {
+	case e.RowData != nil:
+		return e.RowData, nil
+	case e.String != nil:
+		dynamicStruct = *e.String
+	case e.Float64 != nil:
+		dynamicStruct = *e.Float64
+	case e.Bool != nil:
+		dynamicStruct = *e.Bool
+	default:
+		type _Expression Expression
+		dynamicStruct = _Expression(e)
+	}
+
+	return json.Marshal(dynamicStruct)
+}
+
+func (e *Expression) UnmarshalJSON(data []byte) error {
+	var dynamicStruct interface{}
+	if err := json.Unmarshal(data, &dynamicStruct); err != nil {
+		return err
+	}
+
+	switch dynamicStruct.(type) {
+	case string:
+		d := dynamicStruct.(string)
+		e.String = &d
+	case float64:
+		d := dynamicStruct.(float64)
+		e.Float64 = &d
+	case bool:
+		d := dynamicStruct.(bool)
+		e.Bool = &d
+	case []interface{}:
+		e.RowData = data
+	case map[string]interface{}:
+		type _Expression Expression
+		expression := _Expression(*e)
+		if err := json.Unmarshal(data, &expression); err != nil {
+			return err
+		}
+		*e = Expression(expression)
+	default:
+		return fmt.Errorf("unsupported field type in expression: %T(%v)", dynamicStruct, dynamicStruct)
+	}
+
+	if e.String == nil && e.Float64 == nil && e.Bool == nil && e.Payload == nil {
+		e.RowData = data
+	}
+
+	return nil
+}
+
+func (f Flags) MarshalJSON() ([]byte, error) {
+	var dynamicStruct interface{}
+
+	switch flagCount := len(f.Flags); {
+	case flagCount == 1:
+		dynamicStruct = f.Flags[0]
+	case flagCount > 1:
+		dynamicStruct = f.Flags
+	}
+
+	return json.Marshal(dynamicStruct)
+}
+
+func (f *Flags) UnmarshalJSON(data []byte) error {
+	var dynamicStruct interface{}
+	if err := json.Unmarshal(data, &dynamicStruct); err != nil {
+		return err
+	}
+
+	switch v := dynamicStruct.(type) {
+	case string:
+		f.Flags = []string{v}
+	case []interface{}:
+		for _, val := range v {
+			stringVal, ok := val.(string)
+			if !ok {
+				return fmt.Errorf("flags values require string type: %T(%v)", dynamicStruct, dynamicStruct)
+			}
+			f.Flags = append(f.Flags, stringVal)
+		}
+	default:
+		return fmt.Errorf("flags values require string type: %T(%v)", dynamicStruct, dynamicStruct)
+	}
+
+	return nil
+}
+
+func Accept() Verdict {
+	return Verdict{SimpleVerdict: SimpleVerdict{Accept: true}}
+}
+
+func Continue() Verdict {
+	return Verdict{SimpleVerdict: SimpleVerdict{Continue: true}}
+}
+
+func Drop() Verdict {
+	return Verdict{SimpleVerdict: SimpleVerdict{Drop: true}}
+}
+
+func Return() Verdict {
+	return Verdict{SimpleVerdict: SimpleVerdict{Return: true}}
+}

vendor/github.com/networkplumbing/go-nft/nft/schema/schema.go

@@ -0,0 +1,80 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package schema
+
+import (
+	"encoding/json"
+)
+
+type Root struct {
+	Nftables []Nftable `json:"nftables"`
+}
+
+const ruleSetKey = "ruleset"
+
+type Objects struct {
+	Table   *Table `json:"table,omitempty"`
+	Chain   *Chain `json:"chain,omitempty"`
+	Rule    *Rule  `json:"rule,omitempty"`
+	Ruleset bool   `json:"-"`
+}
+
+func (o Objects) MarshalJSON() ([]byte, error) {
+	type _Objects Objects
+	objects := _Objects(o)
+
+	data, err := json.Marshal(objects)
+	if err != nil {
+		return nil, err
+	}
+
+	if o.Ruleset {
+		// Convert to a dynamic structure
+		var dynamicStructure map[string]json.RawMessage
+		if err := json.Unmarshal(data, &dynamicStructure); err != nil {
+			return nil, err
+		}
+		dynamicStructure[ruleSetKey] = nil
+		data, err = json.Marshal(dynamicStructure)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return data, nil
+}
+
+type Nftable struct {
+	Table *Table `json:"table,omitempty"`
+	Chain *Chain `json:"chain,omitempty"`
+	Rule  *Rule  `json:"rule,omitempty"`
+
+	Add    *Objects `json:"add,omitempty"`
+	Delete *Objects `json:"delete,omitempty"`
+	Flush  *Objects `json:"flush,omitempty"`
+
+	Metainfo *Metainfo `json:"metainfo,omitempty"`
+}
+
+type Metainfo struct {
+	Version           string `json:"version"`
+	ReleaseName       string `json:"release_name"`
+	JsonSchemaVersion int    `json:"json_schema_version"`
+}

vendor/github.com/networkplumbing/go-nft/nft/schema/table.go

@@ -0,0 +1,35 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package schema
+
+// Table Address Families
+const (
+	FamilyIP     = "ip"     // IPv4 address AddressFamily.
+	FamilyIP6    = "ip6"    // IPv6 address AddressFamily.
+	FamilyINET   = "inet"   // Internet (IPv4/IPv6) address AddressFamily.
+	FamilyARP    = "arp"    // ARP address AddressFamily, handling IPv4 ARP packets.
+	FamilyBridge = "bridge" // Bridge address AddressFamily, handling packets which traverse a bridge device.
+	FamilyNETDEV = "netdev" // Netdev address AddressFamily, handling packets from ingress.
+)
+
+type Table struct {
+	Family string `json:"family"`
+	Name   string `json:"name"`
+}

vendor/github.com/networkplumbing/go-nft/nft/table.go

@@ -0,0 +1,51 @@
+/*
+ * This file is part of the go-nft project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2021 Red Hat, Inc.
+ *
+ */
+
+package nft
+
+import "github.com/networkplumbing/go-nft/nft/schema"
+
+type AddressFamily string
+
+// Address Families
+const (
+	FamilyIP     AddressFamily = schema.FamilyIP
+	FamilyIP6    AddressFamily = schema.FamilyIP6
+	FamilyINET   AddressFamily = schema.FamilyINET
+	FamilyARP    AddressFamily = schema.FamilyARP
+	FamilyBridge AddressFamily = schema.FamilyBridge
+	FamilyNETDEV AddressFamily = schema.FamilyNETDEV
+)
+
+type TableAction string
+
+// Table Actions
+const (
+	TableADD    TableAction = "add"
+	TableDELETE TableAction = "delete"
+	TableFLUSH  TableAction = "flush"
+)
+
+// NewTable returns a new schema table structure.
+func NewTable(name string, family AddressFamily) *schema.Table {
+	return &schema.Table{
+		Name:   name,
+		Family: string(family),
+	}
+}