netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: Support multiport matching (-m multiport)

Browse Source 
This set of changes adds:

  - support for `xt_multiport_{,v1}` matchers for matching for
    a range of ports and their inverse, i.e.,:

      ```
      -m multiport [!] --[s|d]ports (PORT,...|PORT:PORT,...)
      ```

  - support for `IP{,6}T_SO_GET_REVISION_MATCH` socket options,
    which allows `iptables` to query for the highest supported
    revision for a given matcher
This commit is contained in:
clickyotomy
2025-01-18 09:46:30 -05:00
committed by Srinidhi Kaushik
parent d22dedf3d5
commit 4a8209f26f
11 changed files with 1141 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/socket/netstack/netstack.go
+47
View File
@@ -1549,6 +1549,29 @@ func getSockOptIPv6(t *kernel.Task, s socket.Socket, ep commonEndpoint, name int
}
return &entries, nil
case linux.IP6T_SO_GET_REVISION_MATCH:
if outLen < linux.SizeOfXTGetRevision {
return nil, syserr.ErrInvalidArgument
}
// Only valid for raw IPv6 sockets.
if skType != linux.SOCK_RAW {
return nil, syserr.ErrProtocolNotAvailable
}
stk := inet.StackFromContext(t)
if stk == nil {
return nil, syserr.ErrNoDevice
}
// Get the highest support matcher revision.
ret, err := netfilter.MatchRevision(t, outPtr)
if err != nil {
return nil, err
}
return &ret, nil
case linux.IP6T_SO_GET_REVISION_TARGET:
if outLen < linux.SizeOfXTGetRevision {
return nil, syserr.ErrInvalidArgument
@@ -1754,6 +1777,30 @@ func getSockOptIP(t *kernel.Task, s socket.Socket, ep commonEndpoint, name int,
}
return &entries, nil
case linux.IPT_SO_GET_REVISION_MATCH:
if outLen < linux.SizeOfXTGetRevision {
return nil, syserr.ErrInvalidArgument
}
// Only valid for raw IPv4 sockets.
family, skType, _ := s.Type()
if family != linux.AF_INET || skType != linux.SOCK_RAW {
return nil, syserr.ErrProtocolNotAvailable
}
stk := inet.StackFromContext(t)
if stk == nil {
return nil, syserr.ErrNoDevice
}
// Get the highest support matcher revision.
ret, err := netfilter.MatchRevision(t, outPtr)
if err != nil {
return nil, err
}
return &ret, nil
case linux.IPT_SO_GET_REVISION_TARGET:
if outLen < linux.SizeOfXTGetRevision {
return nil, syserr.ErrInvalidArgument