From d947422655f16bae014d411a40f9519fafd48b29 Mon Sep 17 00:00:00 2001
From: Ghanan Gowripalan <ghanan@google.com>
Date: Thu, 8 Dec 2022 14:14:05 -0800
Subject: [PATCH] Don't prevent removing loopback in core netstack

Implement this check in netstack integration (in sentry) so that the
core netstack does not prevent an integrator from removing loopback.

PiperOrigin-RevId: 493992707
---
 pkg/sentry/socket/netstack/stack.go | 11 ++++++++++
 pkg/tcpip/stack/stack.go            |  3 ---
 pkg/tcpip/stack/stack_test.go       | 31 ++++++++++++-----------------
 3 files changed, 24 insertions(+), 21 deletions(-)

diff --git a/pkg/sentry/socket/netstack/stack.go b/pkg/sentry/socket/netstack/stack.go
index 70e1c519d..958a96f81 100644
--- a/pkg/sentry/socket/netstack/stack.go
+++ b/pkg/sentry/socket/netstack/stack.go
@@ -80,6 +80,17 @@ func (s *Stack) Interfaces() map[int32]inet.Interface {
 // RemoveInterface implements inet.Stack.RemoveInterface.
 func (s *Stack) RemoveInterface(idx int32) error {
 	nic := tcpip.NICID(idx)
+
+	nicInfo, ok := s.Stack.NICInfo()[nic]
+	if !ok {
+		return syserr.ErrUnknownNICID.ToError()
+	}
+
+	// Don't allow removing the loopback interface.
+	if nicInfo.Flags.Loopback {
+		return syserr.ErrNotSupported.ToError()
+	}
+
 	return syserr.TranslateNetstackError(s.Stack.RemoveNIC(nic)).ToError()
 }
 
diff --git a/pkg/tcpip/stack/stack.go b/pkg/tcpip/stack/stack.go
index a7f5986b9..8e212b4ab 100644
--- a/pkg/tcpip/stack/stack.go
+++ b/pkg/tcpip/stack/stack.go
@@ -957,9 +957,6 @@ func (s *Stack) removeNICLocked(id tcpip.NICID) tcpip.Error {
 	if !ok {
 		return &tcpip.ErrUnknownNICID{}
 	}
-	if nic.IsLoopback() {
-		return &tcpip.ErrNotSupported{}
-	}
 	delete(s.nics, id)
 
 	// Remove routes in-place. n tracks the number of routes written.
diff --git a/pkg/tcpip/stack/stack_test.go b/pkg/tcpip/stack/stack_test.go
index 2733fb68c..c70f448c8 100644
--- a/pkg/tcpip/stack/stack_test.go
+++ b/pkg/tcpip/stack/stack_test.go
@@ -966,19 +966,16 @@ func TestRemoveUnknownNIC(t *testing.T) {
 
 func TestRemoveNIC(t *testing.T) {
 	for _, tt := range []struct {
-		name      string
-		linkep    stack.LinkEndpoint
-		expectErr tcpip.Error
+		name   string
+		linkep stack.LinkEndpoint
 	}{
 		{
-			name:      "loopback",
-			linkep:    loopback.New(),
-			expectErr: &tcpip.ErrNotSupported{},
+			name:   "loopback",
+			linkep: loopback.New(),
 		},
 		{
-			name:      "channel",
-			linkep:    channel.New(0, defaultMTU, ""),
-			expectErr: nil,
+			name:   "channel",
+			linkep: channel.New(0, defaultMTU, ""),
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
@@ -1006,16 +1003,14 @@ func TestRemoveNIC(t *testing.T) {
 
 			// Removing a NIC should remove it from NICInfo and e should be detached from
 			// the NetworkDispatcher.
-			if got, want := s.RemoveNIC(nicID), tt.expectErr; got != want {
-				t.Fatalf("got s.RemoveNIC(%d) = %s, want %s", nicID, got, want)
+			if err := s.RemoveNIC(nicID); err != nil {
+				t.Fatalf("s.RemoveNIC(%d): %s", nicID, err)
 			}
-			if tt.expectErr == nil {
-				if nicInfo, ok := s.NICInfo()[nicID]; ok {
-					t.Errorf("got unexpected NICInfo entry for deleted NIC %d = %+v", nicID, nicInfo)
-				}
-				if e.isAttached() {
-					t.Error("link endpoint for removed NIC still attached to a network dispatcher")
-				}
+			if nicInfo, ok := s.NICInfo()[nicID]; ok {
+				t.Errorf("got unexpected NICInfo entry for deleted NIC %d = %+v", nicID, nicInfo)
+			}
+			if e.isAttached() {
+				t.Error("link endpoint for removed NIC still attached to a network dispatcher")
 			}
 		})
 	}