netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Only allow INPUT modifications.

Browse Source
This commit is contained in:
Kevin Krakauer
2020-01-13 14:14:49 -08:00
parent 31e49f4b19
commit 36641a2195
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/socket/netfilter/netfilter.go
+13
View File
@@ -365,9 +365,22 @@ func SetEntries(stack *stack.Stack, optVal []byte) *syserr.Error {
}
}
// TODO(gvisor.dev/issue/170): Support other chains.
// Since we only support modifying the INPUT chain right now, make sure
// all other chains point to ACCEPT rules.
for hook, ruleIdx := range table.BuiltinChains {
if hook != iptables.Input {
if _, ok := table.Rules[ruleIdx].Target.(iptables.UnconditionalAcceptTarget); !ok {
log.Warningf("Hook %d is unsupported.", hook)
return syserr.ErrInvalidArgument
}
}
}
// TODO(gvisor.dev/issue/170): Check the following conditions:
// - There are no loops.
// - There are no chains without an unconditional final rule.
// - There are no chains without an unconditional underflow rule.
ipt := stack.IPTables()
table.SetMetadata(metadata{