build: consume specific tables/chains via go-nft

This go-nft version allows its users to only read particular
tables/chains when invoking `ReadConfig`, instead of the entire ruleset.

This will make deleting rules from a large ruleset faster, thus speeding
up CNI DELs.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2175041

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5
 	github.com/godbus/dbus/v5 v5.1.0
 	github.com/mattn/go-shellwords v1.0.12
-	github.com/networkplumbing/go-nft v0.2.0
+	github.com/networkplumbing/go-nft v0.3.0
 	github.com/onsi/ginkgo/v2 v2.9.2
 	github.com/onsi/gomega v1.27.6
 	github.com/opencontainers/selinux v1.11.0

go.sum

@@ -486,8 +486,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8m
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/ncw/swift v1.0.47/go.mod h1:23YIA4yWVnGwv2dQlN4bB7egfYX6YLn0Yo/S6zZO/ZM=
-github.com/networkplumbing/go-nft v0.2.0 h1:eKapmyVUt/3VGfhYaDos5yeprm+LPt881UeksmKKZHY=
-github.com/networkplumbing/go-nft v0.2.0/go.mod h1:HnnM+tYvlGAsMU7yoYwXEVLLiDW9gdMmb5HoGcwpuQs=
+github.com/networkplumbing/go-nft v0.3.0 h1:IIc6yHjN85KyJx21p3ZEsO0iBMYHNXux22rc9Q8TfFw=
+github.com/networkplumbing/go-nft v0.3.0/go.mod h1:HnnM+tYvlGAsMU7yoYwXEVLLiDW9gdMmb5HoGcwpuQs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=

vendor/github.com/networkplumbing/go-nft/nft/config.go

@@ -20,12 +20,19 @@
 package nft
 
 import (
+	"context"
+	"time"
+
 	nftconfig "github.com/networkplumbing/go-nft/nft/config"
 	nftexec "github.com/networkplumbing/go-nft/nft/exec"
 )
 
 type Config = nftconfig.Config
 
+const (
+	defaultTimeout = 30 * time.Second
+)
+
 // NewConfig returns a new nftables config structure.
 func NewConfig() *nftconfig.Config {
 	return nftconfig.New()
@@ -34,12 +41,29 @@ func NewConfig() *nftconfig.Config {
 // ReadConfig loads the nftables configuration from the system and
 // returns it as a nftables config structure.
 // The system is expected to have the `nft` executable deployed and nftables enabled in the kernel.
-func ReadConfig() (*Config, error) {
-	return nftexec.ReadConfig()
+func ReadConfig(filterCommands ...string) (*Config, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), defaultTimeout)
+	defer cancel()
+	return ReadConfigContext(ctx, filterCommands...)
+}
+
+// ReadConfigContext loads the nftables configuration from the system and
+// returns it as a nftables config structure.
+// The system is expected to have the `nft` executable deployed and nftables enabled in the kernel.
+func ReadConfigContext(ctx context.Context, filterCommands ...string) (*Config, error) {
+	return nftexec.ReadConfig(ctx, filterCommands...)
 }
 
 // ApplyConfig applies the given nftables config on the system.
 // The system is expected to have the `nft` executable deployed and nftables enabled in the kernel.
 func ApplyConfig(c *Config) error {
-	return nftexec.ApplyConfig(c)
+	ctx, cancel := context.WithTimeout(context.Background(), defaultTimeout)
+	defer cancel()
+	return ApplyConfigContext(ctx, c)
+}
+
+// ApplyConfigContext applies the given nftables config on the system.
+// The system is expected to have the `nft` executable deployed and nftables enabled in the kernel.
+func ApplyConfigContext(ctx context.Context, c *Config) error {
+	return nftexec.ApplyConfig(ctx, c)
 }

vendor/github.com/networkplumbing/go-nft/nft/exec/exec.go

@@ -21,6 +21,7 @@ package exec
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -41,8 +42,13 @@ const (
 // ReadConfig loads the nftables configuration from the system and
 // returns it as a nftables config structure.
 // The system is expected to have the `nft` executable deployed and nftables enabled in the kernel.
-func ReadConfig() (*nftconfig.Config, error) {
-	stdout, err := execCommand(cmdJSON, cmdList, cmdRuleset)
+func ReadConfig(ctx context.Context, filterCommands ...string) (*nftconfig.Config, error) {
+
+	whatToList := cmdRuleset
+	if len(filterCommands) > 0 {
+		whatToList = strings.Join(filterCommands, " ")
+	}
+	stdout, err := execCommand(ctx, cmdJSON, cmdList, whatToList)
 	if err != nil {
 		return nil, err
 	}
@@ -57,7 +63,7 @@ func ReadConfig() (*nftconfig.Config, error) {
 
 // ApplyConfig applies the given nftables config on the system.
 // The system is expected to have the `nft` executable deployed and nftables enabled in the kernel.
-func ApplyConfig(c *nftconfig.Config) error {
+func ApplyConfig(ctx context.Context, c *nftconfig.Config) error {
 	data, err := c.ToJSON()
 	if err != nil {
 		return err
@@ -77,15 +83,15 @@ func ApplyConfig(c *nftconfig.Config) error {
 		return fmt.Errorf("failed to close temporary file: %v", err)
 	}
 
-	if _, err := execCommand(cmdJSON, cmdFile, tmpFile.Name()); err != nil {
+	if _, err := execCommand(ctx, cmdJSON, cmdFile, tmpFile.Name()); err != nil {
 		return err
 	}
 
 	return nil
 }
 
-func execCommand(args ...string) (*bytes.Buffer, error) {
-	cmd := exec.Command(cmdBin, args...)
+func execCommand(ctx context.Context, args ...string) (*bytes.Buffer, error) {
+	cmd := exec.CommandContext(ctx, cmdBin, args...)
 
 	var stdout, stderr bytes.Buffer
 	cmd.Stderr = &stderr

vendor/modules.txt

@@ -103,7 +103,7 @@ github.com/google/pprof/profile
 # github.com/mattn/go-shellwords v1.0.12
 ## explicit; go 1.13
 github.com/mattn/go-shellwords
-# github.com/networkplumbing/go-nft v0.2.0
+# github.com/networkplumbing/go-nft v0.3.0
 ## explicit; go 1.16
 github.com/networkplumbing/go-nft/nft
 github.com/networkplumbing/go-nft/nft/config