From e64fa26613f79289ac31d04376f04b430d5108bd Mon Sep 17 00:00:00 2001
From: Nicolas Lacasse <nlacasse@google.com>
Date: Tue, 11 Apr 2023 16:44:05 -0700
Subject: [PATCH] Enable hostinet for netdevice tests.

This was just a matter of passing a few more IOCTL commands to the host.

PiperOrigin-RevId: 523540572
---
 pkg/sentry/socket/hostinet/socket_unsafe.go | 30 ++++++---------------
 runsc/boot/filter/extra_filters_hostinet.go | 29 ++++++++++++++++----
 test/syscalls/linux/socket_netdevice.cc     |  5 ----
 3 files changed, 32 insertions(+), 32 deletions(-)

diff --git a/pkg/sentry/socket/hostinet/socket_unsafe.go b/pkg/sentry/socket/hostinet/socket_unsafe.go
index 1370ca59b..3a9a7a188 100644
--- a/pkg/sentry/socket/hostinet/socket_unsafe.go
+++ b/pkg/sentry/socket/hostinet/socket_unsafe.go
@@ -68,7 +68,13 @@ func ioctl(ctx context.Context, fd int, io usermem.IO, sysno uintptr, args arch.
 			AddressSpaceActive: true,
 		})
 		return 0, err
-	case unix.SIOCGIFFLAGS:
+	case linux.SIOCGIFFLAGS,
+		linux.SIOCGIFHWADDR,
+		linux.SIOCGIFINDEX,
+		linux.SIOCGIFMTU,
+		linux.SIOCGIFNAME,
+		linux.SIOCGIFNETMASK,
+		linux.SIOCGIFTXQLEN:
 		cc := &usermem.IOCopyContext{
 			Ctx: ctx,
 			IO:  io,
@@ -85,7 +91,7 @@ func ioctl(ctx context.Context, fd int, io usermem.IO, sysno uintptr, args arch.
 		}
 		_, err := ifr.CopyOut(cc, args[2].Pointer())
 		return 0, err
-	case unix.SIOCGIFCONF:
+	case linux.SIOCGIFCONF:
 		cc := &usermem.IOCopyContext{
 			Ctx: ctx,
 			IO:  io,
@@ -187,26 +193,6 @@ func ioctl(ctx context.Context, fd int, io usermem.IO, sysno uintptr, args arch.
 		}
 
 		return 0, nil
-	case linux.SIOCGIFTXQLEN:
-		cc := &usermem.IOCopyContext{
-			Ctx: ctx,
-			IO:  io,
-			Opts: usermem.IOOpts{
-				AddressSpaceActive: true,
-			},
-		}
-
-		var ifr linux.IFReq
-		if _, err := ifr.CopyIn(cc, args[2].Pointer()); err != nil {
-			return 0, err
-		}
-
-		if _, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), cmd, uintptr(unsafe.Pointer(&ifr))); errno != 0 {
-			return 0, translateIOSyscallError(errno)
-		}
-
-		_, err := ifr.CopyOut(cc, args[2].Pointer())
-		return 0, err
 	default:
 		return 0, linuxerr.ENOTTY
 	}
diff --git a/runsc/boot/filter/extra_filters_hostinet.go b/runsc/boot/filter/extra_filters_hostinet.go
index 76c81c84a..19cb542e0 100644
--- a/runsc/boot/filter/extra_filters_hostinet.go
+++ b/runsc/boot/filter/extra_filters_hostinet.go
@@ -39,11 +39,11 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules {
 		unix.SYS_IOCTL: []seccomp.Rule{
 			{
 				seccomp.MatchAny{},
-				seccomp.EqualTo(unix.TIOCOUTQ),
+				seccomp.EqualTo(unix.SIOCGIFCONF),
 			},
 			{
 				seccomp.MatchAny{},
-				seccomp.EqualTo(unix.TIOCINQ),
+				seccomp.EqualTo(unix.SIOCETHTOOL),
 			},
 			{
 				seccomp.MatchAny{},
@@ -51,12 +51,31 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules {
 			},
 			{
 				seccomp.MatchAny{},
-				seccomp.EqualTo(unix.SIOCGIFCONF),
+				seccomp.EqualTo(unix.SIOCGIFHWADDR),
 			},
-			// Needed to query netlink sockets.
 			{
 				seccomp.MatchAny{},
-				seccomp.EqualTo(unix.SIOCETHTOOL),
+				seccomp.EqualTo(unix.SIOCGIFINDEX),
+			},
+			{
+				seccomp.MatchAny{},
+				seccomp.EqualTo(unix.SIOCGIFMTU),
+			},
+			{
+				seccomp.MatchAny{},
+				seccomp.EqualTo(unix.SIOCGIFNAME),
+			},
+			{
+				seccomp.MatchAny{},
+				seccomp.EqualTo(unix.SIOCGIFNETMASK),
+			},
+			{
+				seccomp.MatchAny{},
+				seccomp.EqualTo(unix.TIOCOUTQ),
+			},
+			{
+				seccomp.MatchAny{},
+				seccomp.EqualTo(unix.TIOCINQ),
 			},
 		},
 		unix.SYS_LISTEN:   {},
diff --git a/test/syscalls/linux/socket_netdevice.cc b/test/syscalls/linux/socket_netdevice.cc
index 0ff53ed55..0bebd68d2 100644
--- a/test/syscalls/linux/socket_netdevice.cc
+++ b/test/syscalls/linux/socket_netdevice.cc
@@ -37,7 +37,6 @@ using ::testing::AnyOf;
 using ::testing::Eq;
 
 TEST(NetdeviceTest, Loopback) {
-  SKIP_IF(IsRunningWithHostinet());
   FileDescriptor sock =
       ASSERT_NO_ERRNO_AND_VALUE(Socket(AF_INET, SOCK_DGRAM, 0));
 
@@ -61,7 +60,6 @@ TEST(NetdeviceTest, Loopback) {
 }
 
 TEST(NetdeviceTest, Netmask) {
-  SKIP_IF(IsRunningWithHostinet());
   // We need an interface index to identify the loopback device.
   FileDescriptor sock =
       ASSERT_NO_ERRNO_AND_VALUE(Socket(AF_INET, SOCK_DGRAM, 0));
@@ -137,7 +135,6 @@ TEST(NetdeviceTest, Netmask) {
 }
 
 TEST(NetdeviceTest, InterfaceName) {
-  SKIP_IF(IsRunningWithHostinet());
   FileDescriptor sock =
       ASSERT_NO_ERRNO_AND_VALUE(Socket(AF_INET, SOCK_DGRAM, 0));
 
@@ -171,7 +168,6 @@ TEST(NetdeviceTest, InterfaceFlags) {
 }
 
 TEST(NetdeviceTest, InterfaceMTU) {
-  SKIP_IF(IsRunningWithHostinet());
   FileDescriptor sock =
       ASSERT_NO_ERRNO_AND_VALUE(Socket(AF_INET, SOCK_DGRAM, 0));
 
@@ -203,7 +199,6 @@ TEST(NetdeviceTest, InterfaceQLEN) {
 }
 
 TEST(NetdeviceTest, EthtoolGetTSInfo) {
-  SKIP_IF(IsRunningWithHostinet());
   FileDescriptor sock =
       ASSERT_NO_ERRNO_AND_VALUE(Socket(AF_INET, SOCK_DGRAM, 0));