From 47dade3f98b2e7d1d00c4ba79c7f4bdfc28bd805 Mon Sep 17 00:00:00 2001
From: Kevin Krakauer <krakauer@google.com>
Date: Tue, 8 Oct 2024 17:11:23 -0700
Subject: [PATCH] runsc: don't error with --reproduce-nftables when there are
 no nftables rules

It's not an error for there to be no rules worth scraping. It just means we
don't have to do anything.

PiperOrigin-RevId: 683815384
---
 runsc/sandbox/network.go | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/runsc/sandbox/network.go b/runsc/sandbox/network.go
index 211838eaa..7d4a3b5c6 100644
--- a/runsc/sandbox/network.go
+++ b/runsc/sandbox/network.go
@@ -586,8 +586,10 @@ func pcapAndNAT(args *boot.CreateLinksAndRoutesArgs, conf *config.Config) error
 		if err != nil {
 			return fmt.Errorf("failed to write NAT blob: %v", err)
 		}
-		args.NATBlob = true
-		args.FilePayload.Files = append(args.FilePayload.Files, f)
+		if f != nil {
+			args.NATBlob = true
+			args.FilePayload.Files = append(args.FilePayload.Files, f)
+		}
 	}
 
 	return nil
@@ -622,6 +624,8 @@ const emptyNatRules = `-P PREROUTING ACCEPT
 -P POSTROUTING ACCEPT
 `
 
+// checkNftables can return a nil file and error if it finds only
+// emptyNatRules.
 func checkNftables() (*os.File, error) {
 	// Use iptables (not iptables-save) to test table emptiness because it
 	// gives predictable results: no counters and no comments.
@@ -633,7 +637,7 @@ func checkNftables() (*os.File, error) {
 
 	// Is the nftables table empty?
 	if out, err := exec.Command("iptables-nft", "-t", "nat", "-S").Output(); err != nil || string(out) == emptyNatRules {
-		return nil, fmt.Errorf("no rules to scrape: %v", err)
+		return nil, nil
 	}
 
 	// Get the current (empty) legacy rules.