From 8a83d9fccc9d25cb859ca136bea726b004aff6e7 Mon Sep 17 00:00:00 2001 From: Kevin Krakauer Date: Thu, 13 Jun 2024 14:25:41 -0700 Subject: [PATCH] netstack: don't reject FORWARD rules These have been supported in netstack since cl/373702359 (git: 2b457d9ee9). That change was for a non-gVisor netstack user, so we never updated the netfilter/ package to allow gVisor to ingest FORWARD rules. PiperOrigin-RevId: 643121358 --- pkg/sentry/socket/netfilter/netfilter.go | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) diff --git a/pkg/sentry/socket/netfilter/netfilter.go b/pkg/sentry/socket/netfilter/netfilter.go index 05c8b3ebf..c7827fb66 100644 --- a/pkg/sentry/socket/netfilter/netfilter.go +++ b/pkg/sentry/socket/netfilter/netfilter.go @@ -35,7 +35,7 @@ import ( // enableLogging controls whether to log the (de)serialization of netfilter // structs between userspace and netstack. These logs are useful when // developing iptables, but can pollute sentry logs otherwise. -const enableLogging = false +const enableLogging = true // nflog logs messages related to the writing and reading of iptables. func nflog(format string, args ...any) { @@ -277,20 +277,6 @@ func SetEntries(mapper IDMapper, stk *stack.Stack, optVal []byte, ipv6 bool) *sy table.Rules[ruleIdx] = rule } - // Since we don't support FORWARD, yet, make sure all other chains point to - // ACCEPT rules. - for hook, ruleIdx := range table.BuiltinChains { - if hook := stack.Hook(hook); hook == stack.Forward { - if ruleIdx == stack.HookUnset { - continue - } - if !isUnconditionalAccept(table.Rules[ruleIdx], ipv6) { - nflog("hook %d is unsupported.", hook) - return syserr.ErrInvalidArgument - } - } - } - // TODO(gvisor.dev/issue/6167): Check the following conditions: // - There are no loops. // - There are no chains without an unconditional final rule.