Skip to content

Commit 8b1c8e2

Browse files
parth-opensrcgvisor-bot
parth-opensrc
authored and
gvisor-bot
committed
nftables: Parse chain type from the correct attribute.
PiperOrigin-RevId: 824667421
1 parent feddee9 commit 8b1c8e2

File tree

2 files changed

+14
-14
lines changed

2 files changed

+14
-14
lines changed

‎pkg/sentry/socket/netlink/netfilter/protocol.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -442,7 +442,7 @@ func (p *Protocol) addChain(attrs map[uint16]nlmsg.BytesView, tab *nftables.Tabl
442442
return syserr.NewAnnotatedError(syserr.ErrNotSupported, fmt.Sprintf("Nftables: Chain binding attribute is not supported for chains with a hook"))
443443
}
444444

445-
bcInfo, err = p.chainParseHook(nil, family, nlmsg.AttrsView(hookDataBytes))
445+
bcInfo, err = p.chainParseHook(nil, family, nlmsg.AttrsView(hookDataBytes), attrs)
446446
if err != nil {
447447
return err
448448
}
@@ -494,7 +494,7 @@ func (p *Protocol) addChain(attrs map[uint16]nlmsg.BytesView, tab *nftables.Tabl
494494

495495
// chainParseHook parses the hook attributes and returns a complete
496496
// BaseChainInfo.
497-
func (p *Protocol) chainParseHook(chain *nftables.Chain, family stack.AddressFamily, hdata nlmsg.AttrsView) (*nftables.BaseChainInfo, *syserr.AnnotatedError) {
497+
func (p *Protocol) chainParseHook(chain *nftables.Chain, family stack.AddressFamily, hdata nlmsg.AttrsView, attrs map[uint16]nlmsg.BytesView) (*nftables.BaseChainInfo, *syserr.AnnotatedError) {
498498
hookAttrs, ok := nftables.NfParse(hdata)
499499
if !ok {
500500
return nil, syserr.NewAnnotatedError(syserr.ErrInvalidArgument, fmt.Sprintf("Nftables: Failed to parse hook attributes"))
@@ -530,7 +530,7 @@ func (p *Protocol) chainParseHook(chain *nftables.Chain, family stack.AddressFam
530530
// All families default to filter type.
531531
hookInfo.ChainType = nftables.BaseChainTypeFilter
532532

533-
if chainTypeBytes, ok := hookAttrs[linux.NFTA_CHAIN_TYPE]; ok {
533+
if chainTypeBytes, ok := attrs[linux.NFTA_CHAIN_TYPE]; ok {
534534
// TODO - b/434243967: Support base chain types other than filter.
535535
switch chainType := chainTypeBytes.String(); chainType {
536536
case "filter":

‎test/syscalls/linux/socket_netlink_netfilter.cc‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -932,7 +932,6 @@ TEST(NetlinkNetfilterTest, ErrNewBaseChainWithInvalidPolicy) {
932932
NlNestedAttr()
933933
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
934934
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
935-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
936935
.Build();
937936

938937
std::vector<char> add_table_request_buffer =
@@ -955,6 +954,7 @@ TEST(NetlinkNetfilterTest, ErrNewBaseChainWithInvalidPolicy) {
955954
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
956955
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
957956
nested_hook_data.size())
957+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
958958
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
959959
.Build())
960960
.SeqEnd(kSeq + 5)
@@ -1122,7 +1122,6 @@ TEST(NetlinkNetfilterTest, ErrNewBaseChainWithInvalidChainType) {
11221122
NlNestedAttr()
11231123
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
11241124
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1125-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
11261125
.Build();
11271126

11281127
std::vector<char> add_request_buffer =
@@ -1139,6 +1138,7 @@ TEST(NetlinkNetfilterTest, ErrNewBaseChainWithInvalidChainType) {
11391138
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
11401139
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
11411140
nested_hook_data.size())
1141+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
11421142
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
11431143
.Build())
11441144
.SeqEnd(kSeq + 3)
@@ -1167,7 +1167,6 @@ TEST(NetlinkNetfilterTest, ErrNewNATBaseChainWithInvalidPriority) {
11671167
NlNestedAttr()
11681168
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
11691169
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1170-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
11711170
.Build();
11721171

11731172
std::vector<char> add_request_buffer =
@@ -1184,6 +1183,7 @@ TEST(NetlinkNetfilterTest, ErrNewNATBaseChainWithInvalidPriority) {
11841183
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
11851184
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
11861185
nested_hook_data.size())
1186+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
11871187
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
11881188
.Build())
11891189
.SeqEnd(kSeq + 3)
@@ -1212,7 +1212,6 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewNetDevBaseChain) {
12121212
NlNestedAttr()
12131213
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
12141214
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1215-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
12161215
.Build();
12171216

12181217
std::vector<char> add_request_buffer =
@@ -1229,6 +1228,7 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewNetDevBaseChain) {
12291228
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
12301229
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
12311230
nested_hook_data.size())
1231+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
12321232
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
12331233
.Build())
12341234
.SeqEnd(kSeq + 3)
@@ -1257,7 +1257,6 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewInetBaseChainAtIngress) {
12571257
NlNestedAttr()
12581258
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
12591259
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1260-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
12611260
.Build();
12621261

12631262
std::vector<char> add_request_buffer =
@@ -1274,6 +1273,7 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewInetBaseChainAtIngress) {
12741273
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
12751274
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
12761275
nested_hook_data.size())
1276+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
12771277
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
12781278
.Build())
12791279
.SeqEnd(kSeq + 3)
@@ -1302,7 +1302,6 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewBaseChainWithChainCounters) {
13021302
NlNestedAttr()
13031303
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
13041304
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1305-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
13061305
.Build();
13071306

13081307
std::vector<char> add_request_buffer =
@@ -1319,6 +1318,7 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewBaseChainWithChainCounters) {
13191318
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
13201319
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
13211320
nested_hook_data.size())
1321+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
13221322
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
13231323
.RawAttr(NFTA_CHAIN_COUNTERS, nullptr, 0)
13241324
.Build())
@@ -1540,7 +1540,6 @@ TEST(NetlinkNetfilterTest, AddBaseChainWithDropPolicy) {
15401540
NlNestedAttr()
15411541
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
15421542
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1543-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
15441543
.Build();
15451544

15461545
std::vector<char> add_request_buffer =
@@ -1557,6 +1556,7 @@ TEST(NetlinkNetfilterTest, AddBaseChainWithDropPolicy) {
15571556
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
15581557
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
15591558
nested_hook_data.size())
1559+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
15601560
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
15611561
.Build())
15621562
.SeqEnd(kSeq + 3)
@@ -1787,7 +1787,6 @@ TEST(NetlinkNetfilterTest, GetBaseChain) {
17871787
NlNestedAttr()
17881788
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
17891789
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1790-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
17911790
.Build();
17921791

17931792
std::vector<char> add_request_buffer =
@@ -1804,6 +1803,7 @@ TEST(NetlinkNetfilterTest, GetBaseChain) {
18041803
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
18051804
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
18061805
nested_hook_data.size())
1806+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
18071807
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
18081808
.RawAttr(NFTA_CHAIN_USERDATA, test_user_data,
18091809
expected_udata_size)
@@ -1857,7 +1857,6 @@ TEST(NetlinkNetfilterTest, ErrDeleteChainWithNoTableNameSpecified) {
18571857
NlNestedAttr()
18581858
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
18591859
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1860-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
18611860
.Build();
18621861

18631862
std::vector<char> add_request_buffer =
@@ -1874,6 +1873,7 @@ TEST(NetlinkNetfilterTest, ErrDeleteChainWithNoTableNameSpecified) {
18741873
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
18751874
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
18761875
nested_hook_data.size())
1876+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
18771877
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
18781878
.Build())
18791879
.SeqEnd(kSeq + 3)
@@ -1984,7 +1984,6 @@ TEST(NetlinkNetfilterTest, DeleteBaseChain) {
19841984
NlNestedAttr()
19851985
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
19861986
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1987-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
19881987
.Build();
19891988

19901989
std::vector<char> add_request_buffer =
@@ -2001,6 +2000,7 @@ TEST(NetlinkNetfilterTest, DeleteBaseChain) {
20012000
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
20022001
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
20032002
nested_hook_data.size())
2003+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
20042004
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
20052005
.Build())
20062006
.SeqEnd(kSeq + 3)
@@ -2041,7 +2041,6 @@ TEST(NetlinkNetfilterTest, DeleteBaseChainByHandle) {
20412041
NlNestedAttr()
20422042
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
20432043
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
2044-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
20452044
.Build();
20462045

20472046
std::vector<char> add_request_buffer =
@@ -2058,6 +2057,7 @@ TEST(NetlinkNetfilterTest, DeleteBaseChainByHandle) {
20582057
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
20592058
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
20602059
nested_hook_data.size())
2060+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
20612061
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
20622062
.Build())
20632063
.SeqEnd(kSeq + 3)

0 commit comments

Comments
 (0)