Add ct_stat constants to add rule with ct_state easier

[lyonsdpy]

Normally, I add a rule with ct_state like this , the mask field indicate the specific state like(established,related,new...). but as a user I probably dont know how to set the mask value . (I find answer on nftables.org)

func TestRule(t *testing.T) {
	conn, err := getConn()
	if err != nil {
		t.Fatal(err)
	}
	defer closeNs(netns.NsHandle(conn.NetNS))

	rule := &Rule{
		Table: mytable,
		Chain: cout,
		Exprs: []expr.Any{
			&expr.Ct{Register: 1, SourceRegister: false, Key: expr.CtKeyPROTOCOL},
			&expr.Cmp{Op: expr.CmpOpEq, Data: []byte{unix.IPPROTO_TCP}, Register: 1},
			&expr.Ct{Register: 1, SourceRegister: false, Key: expr.CtKeySTATE},
			&expr.Bitwise{
				SourceRegister: 1,
				DestRegister:   1,
				Len:            4,
				Mask:          []byte{6, 0, 0, 0},
				Xor:            []byte{0, 0, 0, 0},
			},
			&expr.Cmp{Op: expr.CmpOpNeq, Register: 1, Data: []byte{0, 0, 0, 0}},
			&expr.Verdict{Kind: expr.VerdictAccept},
		},
	}

	conn.AddRule(rule)

	err = conn.Flush()
	if err != nil {
		t.Fatal(err)
	}
}

So I think it's good to add some constants in expr/ct.go like

const (
        CtStatINVALID     uint32 = 1
	CtStatESTABLISHED uint32 = 2
	CtStatRELATED     uint32 = 4
	CtStatNEW         uint32 = 8
	CtStatUNTRACKED   uint32 = 64
)

And use them

func TestRule(t *testing.T) {
	conn, err := getConn()
	if err != nil {
		t.Fatal(err)
	}
	defer closeNs(netns.NsHandle(conn.NetNS))

	rule := &Rule{
		Table: mytable,
		Chain: cout,
		Exprs: []expr.Any{
			&expr.Ct{Register: 1, SourceRegister: false, Key: expr.CtKeyPROTOCOL},
			&expr.Cmp{Op: expr.CmpOpEq, Data: []byte{unix.IPPROTO_TCP}, Register: 1},
			&expr.Ct{Register: 1, SourceRegister: false, Key: expr.CtKeySTATE},
			&expr.Bitwise{
				SourceRegister: 1,
				DestRegister:   1,
				Len:            4,
				Mask:  binaryutil.NativeEndian.PutUint32(expr.CtStatESTABLISHED | expr.CtStatRELATED),
				Xor:   binaryutil.NativeEndian.PutUint32(0),
			},
			&expr.Cmp{Op: expr.CmpOpNeq, Register: 1, Data: []byte{0, 0, 0, 0}},
			&expr.Verdict{Kind: expr.VerdictAccept},
		},
	}

	conn.AddRule(rule)

	err = conn.Flush()
	if err != nil {
		t.Fatal(err)
	}
}

[stapelberg]

Sounds good. Can you send a PR with these constants and a test please?

[lyonsdpy]

By the way , I can't get the hex value of sendmsg using new version of strace.

[stapelberg]

By the way , I can't get the hex value of sendmsg using new version of strace.

Yes, see

nftables/nftables_test.go

Line 3221 in 5231121

// Until https://github.com/strace/strace/issues/100 is resolved,