Skip to content

Commit 806d1cc

Browse files
parth-opensrcgvisor-bot
parth-opensrc
authored and
gvisor-bot
committed
nftables: Added uint8/16 and int8/16/64 BytesView converters.
PiperOrigin-RevId: 826652100
1 parent feddee9 commit 806d1cc

File tree

3 files changed

+69
-14
lines changed

3 files changed

+69
-14
lines changed

‎pkg/sentry/socket/netlink/netfilter/protocol.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -442,7 +442,7 @@ func (p *Protocol) addChain(attrs map[uint16]nlmsg.BytesView, tab *nftables.Tabl
442442
return syserr.NewAnnotatedError(syserr.ErrNotSupported, fmt.Sprintf("Nftables: Chain binding attribute is not supported for chains with a hook"))
443443
}
444444

445-
bcInfo, err = p.chainParseHook(nil, family, nlmsg.AttrsView(hookDataBytes))
445+
bcInfo, err = p.chainParseHook(nil, family, nlmsg.AttrsView(hookDataBytes), attrs)
446446
if err != nil {
447447
return err
448448
}
@@ -494,7 +494,7 @@ func (p *Protocol) addChain(attrs map[uint16]nlmsg.BytesView, tab *nftables.Tabl
494494

495495
// chainParseHook parses the hook attributes and returns a complete
496496
// BaseChainInfo.
497-
func (p *Protocol) chainParseHook(chain *nftables.Chain, family stack.AddressFamily, hdata nlmsg.AttrsView) (*nftables.BaseChainInfo, *syserr.AnnotatedError) {
497+
func (p *Protocol) chainParseHook(chain *nftables.Chain, family stack.AddressFamily, hdata nlmsg.AttrsView, attrs map[uint16]nlmsg.BytesView) (*nftables.BaseChainInfo, *syserr.AnnotatedError) {
498498
hookAttrs, ok := nftables.NfParse(hdata)
499499
if !ok {
500500
return nil, syserr.NewAnnotatedError(syserr.ErrInvalidArgument, fmt.Sprintf("Nftables: Failed to parse hook attributes"))
@@ -530,7 +530,7 @@ func (p *Protocol) chainParseHook(chain *nftables.Chain, family stack.AddressFam
530530
// All families default to filter type.
531531
hookInfo.ChainType = nftables.BaseChainTypeFilter
532532

533-
if chainTypeBytes, ok := hookAttrs[linux.NFTA_CHAIN_TYPE]; ok {
533+
if chainTypeBytes, ok := attrs[linux.NFTA_CHAIN_TYPE]; ok {
534534
// TODO - b/434243967: Support base chain types other than filter.
535535
switch chainType := chainTypeBytes.String(); chainType {
536536
case "filter":

‎pkg/sentry/socket/netlink/nlmsg/message.go‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -374,6 +374,28 @@ func (v *BytesView) String() string {
374374
return string(b)
375375
}
376376

377+
// Uint8 converts the raw attribute value to uint8.
378+
func (v *BytesView) Uint8() (uint8, bool) {
379+
attr := []byte(*v)
380+
val := primitive.Uint8(0)
381+
if len(attr) != val.SizeBytes() {
382+
return 0, false
383+
}
384+
val.UnmarshalBytes(attr)
385+
return uint8(val), true
386+
}
387+
388+
// Uint16 converts the raw attribute value to uint16.
389+
func (v *BytesView) Uint16() (uint16, bool) {
390+
attr := []byte(*v)
391+
val := primitive.Uint16(0)
392+
if len(attr) != val.SizeBytes() {
393+
return 0, false
394+
}
395+
val.UnmarshalBytes(attr)
396+
return uint16(val), true
397+
}
398+
377399
// Uint32 converts the raw attribute value to uint32.
378400
func (v *BytesView) Uint32() (uint32, bool) {
379401
attr := []byte(*v)
@@ -396,6 +418,28 @@ func (v *BytesView) Uint64() (uint64, bool) {
396418
return uint64(val), true
397419
}
398420

421+
// Int8 converts the raw attribute value to int8.
422+
func (v *BytesView) Int8() (int8, bool) {
423+
attr := []byte(*v)
424+
val := primitive.Int8(0)
425+
if len(attr) != val.SizeBytes() {
426+
return 0, false
427+
}
428+
val.UnmarshalBytes(attr)
429+
return int8(val), true
430+
}
431+
432+
// Int16 converts the raw attribute value to int32.
433+
func (v *BytesView) Int16() (int16, bool) {
434+
attr := []byte(*v)
435+
val := primitive.Int16(0)
436+
if len(attr) != val.SizeBytes() {
437+
return 0, false
438+
}
439+
val.UnmarshalBytes(attr)
440+
return int16(val), true
441+
}
442+
399443
// Int32 converts the raw attribute value to int32.
400444
func (v *BytesView) Int32() (int32, bool) {
401445
attr := []byte(*v)
@@ -407,6 +451,17 @@ func (v *BytesView) Int32() (int32, bool) {
407451
return int32(val), true
408452
}
409453

454+
// Int64 converts the raw attribute value to int32.
455+
func (v *BytesView) Int64() (int64, bool) {
456+
attr := []byte(*v)
457+
val := primitive.Int64(0)
458+
if len(attr) != val.SizeBytes() {
459+
return 0, false
460+
}
461+
val.UnmarshalBytes(attr)
462+
return int64(val), true
463+
}
464+
410465
// NetToHostU16 converts a uint16 in network byte order to
411466
// host byte order value.
412467
func NetToHostU16(v uint16) uint16 {

‎test/syscalls/linux/socket_netlink_netfilter.cc‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -932,7 +932,6 @@ TEST(NetlinkNetfilterTest, ErrNewBaseChainWithInvalidPolicy) {
932932
NlNestedAttr()
933933
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
934934
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
935-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
936935
.Build();
937936

938937
std::vector<char> add_table_request_buffer =
@@ -955,6 +954,7 @@ TEST(NetlinkNetfilterTest, ErrNewBaseChainWithInvalidPolicy) {
955954
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
956955
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
957956
nested_hook_data.size())
957+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
958958
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
959959
.Build())
960960
.SeqEnd(kSeq + 5)
@@ -1122,7 +1122,6 @@ TEST(NetlinkNetfilterTest, ErrNewBaseChainWithInvalidChainType) {
11221122
NlNestedAttr()
11231123
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
11241124
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1125-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
11261125
.Build();
11271126

11281127
std::vector<char> add_request_buffer =
@@ -1139,6 +1138,7 @@ TEST(NetlinkNetfilterTest, ErrNewBaseChainWithInvalidChainType) {
11391138
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
11401139
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
11411140
nested_hook_data.size())
1141+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
11421142
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
11431143
.Build())
11441144
.SeqEnd(kSeq + 3)
@@ -1167,7 +1167,6 @@ TEST(NetlinkNetfilterTest, ErrNewNATBaseChainWithInvalidPriority) {
11671167
NlNestedAttr()
11681168
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
11691169
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1170-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
11711170
.Build();
11721171

11731172
std::vector<char> add_request_buffer =
@@ -1184,6 +1183,7 @@ TEST(NetlinkNetfilterTest, ErrNewNATBaseChainWithInvalidPriority) {
11841183
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
11851184
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
11861185
nested_hook_data.size())
1186+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
11871187
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
11881188
.Build())
11891189
.SeqEnd(kSeq + 3)
@@ -1212,7 +1212,6 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewNetDevBaseChain) {
12121212
NlNestedAttr()
12131213
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
12141214
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1215-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
12161215
.Build();
12171216

12181217
std::vector<char> add_request_buffer =
@@ -1229,6 +1228,7 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewNetDevBaseChain) {
12291228
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
12301229
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
12311230
nested_hook_data.size())
1231+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
12321232
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
12331233
.Build())
12341234
.SeqEnd(kSeq + 3)
@@ -1257,7 +1257,6 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewInetBaseChainAtIngress) {
12571257
NlNestedAttr()
12581258
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
12591259
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1260-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
12611260
.Build();
12621261

12631262
std::vector<char> add_request_buffer =
@@ -1274,6 +1273,7 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewInetBaseChainAtIngress) {
12741273
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
12751274
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
12761275
nested_hook_data.size())
1276+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
12771277
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
12781278
.Build())
12791279
.SeqEnd(kSeq + 3)
@@ -1302,7 +1302,6 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewBaseChainWithChainCounters) {
13021302
NlNestedAttr()
13031303
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
13041304
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1305-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
13061305
.Build();
13071306

13081307
std::vector<char> add_request_buffer =
@@ -1319,6 +1318,7 @@ TEST(NetlinkNetfilterTest, ErrUnsupportedNewBaseChainWithChainCounters) {
13191318
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
13201319
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
13211320
nested_hook_data.size())
1321+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
13221322
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
13231323
.RawAttr(NFTA_CHAIN_COUNTERS, nullptr, 0)
13241324
.Build())
@@ -1540,7 +1540,6 @@ TEST(NetlinkNetfilterTest, AddBaseChainWithDropPolicy) {
15401540
NlNestedAttr()
15411541
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
15421542
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1543-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
15441543
.Build();
15451544

15461545
std::vector<char> add_request_buffer =
@@ -1557,6 +1556,7 @@ TEST(NetlinkNetfilterTest, AddBaseChainWithDropPolicy) {
15571556
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
15581557
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
15591558
nested_hook_data.size())
1559+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
15601560
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
15611561
.Build())
15621562
.SeqEnd(kSeq + 3)
@@ -1787,7 +1787,6 @@ TEST(NetlinkNetfilterTest, GetBaseChain) {
17871787
NlNestedAttr()
17881788
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
17891789
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1790-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
17911790
.Build();
17921791

17931792
std::vector<char> add_request_buffer =
@@ -1804,6 +1803,7 @@ TEST(NetlinkNetfilterTest, GetBaseChain) {
18041803
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
18051804
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
18061805
nested_hook_data.size())
1806+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
18071807
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
18081808
.RawAttr(NFTA_CHAIN_USERDATA, test_user_data,
18091809
expected_udata_size)
@@ -1857,7 +1857,6 @@ TEST(NetlinkNetfilterTest, ErrDeleteChainWithNoTableNameSpecified) {
18571857
NlNestedAttr()
18581858
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
18591859
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1860-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
18611860
.Build();
18621861

18631862
std::vector<char> add_request_buffer =
@@ -1874,6 +1873,7 @@ TEST(NetlinkNetfilterTest, ErrDeleteChainWithNoTableNameSpecified) {
18741873
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
18751874
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
18761875
nested_hook_data.size())
1876+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
18771877
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
18781878
.Build())
18791879
.SeqEnd(kSeq + 3)
@@ -1984,7 +1984,6 @@ TEST(NetlinkNetfilterTest, DeleteBaseChain) {
19841984
NlNestedAttr()
19851985
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
19861986
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
1987-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
19881987
.Build();
19891988

19901989
std::vector<char> add_request_buffer =
@@ -2001,6 +2000,7 @@ TEST(NetlinkNetfilterTest, DeleteBaseChain) {
20012000
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
20022001
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
20032002
nested_hook_data.size())
2003+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
20042004
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
20052005
.Build())
20062006
.SeqEnd(kSeq + 3)
@@ -2041,7 +2041,6 @@ TEST(NetlinkNetfilterTest, DeleteBaseChainByHandle) {
20412041
NlNestedAttr()
20422042
.U32Attr(NFTA_HOOK_HOOKNUM, test_hook_num)
20432043
.U32Attr(NFTA_HOOK_PRIORITY, test_hook_priority)
2044-
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
20452044
.Build();
20462045

20472046
std::vector<char> add_request_buffer =
@@ -2058,6 +2057,7 @@ TEST(NetlinkNetfilterTest, DeleteBaseChainByHandle) {
20582057
.U32Attr(NFTA_CHAIN_POLICY, test_policy)
20592058
.RawAttr(NFTA_CHAIN_HOOK, nested_hook_data.data(),
20602059
nested_hook_data.size())
2060+
.StrAttr(NFTA_CHAIN_TYPE, test_chain_type_name)
20612061
.U32Attr(NFTA_CHAIN_FLAGS, test_chain_flags)
20622062
.Build())
20632063
.SeqEnd(kSeq + 3)

0 commit comments

Comments
 (0)