netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

runsc: don't error with --reproduce-nftables when there are no nftables rules

Browse Source 
It's not an error for there to be no rules worth scraping. It just means we
don't have to do anything.

PiperOrigin-RevId: 683815384
This commit is contained in:
Kevin Krakauer
2024-10-08 17:15:01 -07:00
committed by gVisor bot
parent 56b1ea0b5b
commit 47dade3f98
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/sandbox/network.go
+7 -3
View File
@@ -586,8 +586,10 @@ func pcapAndNAT(args *boot.CreateLinksAndRoutesArgs, conf *config.Config) error
if err != nil {
return fmt.Errorf("failed to write NAT blob: %v", err)
}
args.NATBlob = true
args.FilePayload.Files = append(args.FilePayload.Files, f)
if f != nil {
args.NATBlob = true
args.FilePayload.Files = append(args.FilePayload.Files, f)
}
}
return nil
@@ -622,6 +624,8 @@ const emptyNatRules = `-P PREROUTING ACCEPT
-P POSTROUTING ACCEPT
`
// checkNftables can return a nil file and error if it finds only
// emptyNatRules.
func checkNftables() (*os.File, error) {
// Use iptables (not iptables-save) to test table emptiness because it
// gives predictable results: no counters and no comments.
@@ -633,7 +637,7 @@ func checkNftables() (*os.File, error) {
// Is the nftables table empty?
if out, err := exec.Command("iptables-nft", "-t", "nat", "-S").Output(); err != nil || string(out) == emptyNatRules {
return nil, fmt.Errorf("no rules to scrape: %v", err)
return nil, nil
}
// Get the current (empty) legacy rules.