Skip to content

Commit 3bf460d

Browse files
kerumetogvisor-bot
kerumeto
authored and
gvisor-bot
committed
Re-arrange code in NETFILTER protocol for better readability
No functional changes. Re-organizes the code by moving the declaration of helper methods before where they are used, making the code more readable. In line with other NETLINK protocol implementation styles. PiperOrigin-RevId: 792353788
1 parent dc7d71f commit 3bf460d

File tree

1 file changed

+103
-103
lines changed

1 file changed

+103
-103
lines changed

‎pkg/sentry/socket/netlink/netfilter/protocol.go

Lines changed: 103 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -86,109 +86,6 @@ func (p *Protocol) Receive(ctx context.Context, s *netlink.Socket, buf []byte) *
8686
return s.ProcessMessages(ctx, buf)
8787
}
8888

89-
// ProcessMessage implements netlink.Protocol.ProcessMessage.
90-
// TODO: 434785410 - Support batch messages.
91-
func (p *Protocol) ProcessMessage(ctx context.Context, s *netlink.Socket, msg *nlmsg.Message, ms *nlmsg.MessageSet) *syserr.Error {
92-
hdr := msg.Header()
93-
94-
// Netlink message payloads must be of at least the size of the genmsg.
95-
// Return early if it is not, from linux/net/netfilter/nfnetlink.c.
96-
if netLinkMessagePayloadSize(&hdr) < linux.SizeOfNetfilterGenMsg {
97-
log.Debugf("Netlink message payload is too small: %d < %d", netLinkMessagePayloadSize(&hdr), linux.SizeOfNetfilterGenMsg)
98-
return nil
99-
}
100-
101-
msgType := hdr.NetFilterMsgType()
102-
st := inet.StackFromContext(ctx).(*netstack.Stack).Stack
103-
nft := (st.NFTables()).(*nftables.NFTables)
104-
var nfGenMsg linux.NetFilterGenMsg
105-
106-
// The payload of a netfilter generic message is its attributes.
107-
atr, ok := msg.GetData(&nfGenMsg)
108-
if !ok {
109-
log.Debugf("Failed to get message data")
110-
return syserr.ErrInvalidArgument
111-
}
112-
113-
attrs, ok := atr.Parse()
114-
if !ok {
115-
log.Debugf("Failed to parse message attributes")
116-
return syserr.ErrInvalidArgument
117-
}
118-
119-
// Nftables functions error check the address family value.
120-
family, err := nftables.AFtoNetlinkAF(nfGenMsg.Family)
121-
switch msgType {
122-
case linux.NFT_MSG_NEWTABLE:
123-
nft.Mu.Lock()
124-
defer nft.Mu.Unlock()
125-
// We only check the error value in the case of NFT_MSG_NEWTABLE as linux
126-
// returns an EOPNOTSUPP error only in that case. Otherwise the other
127-
// operations will return errors specific to their function.
128-
if err != nil {
129-
log.Debugf("Nftables: Unsupported address family: %d", int(nfGenMsg.Family))
130-
return err
131-
}
132-
133-
if err := p.newTable(nft, attrs, family, hdr.Flags, ms); err != nil {
134-
log.Debugf("Nftables new table error: %s", err)
135-
return err.GetError()
136-
}
137-
return nil
138-
case linux.NFT_MSG_GETTABLE:
139-
nft.Mu.RLock()
140-
defer nft.Mu.RUnlock()
141-
if err := p.getTable(nft, attrs, family, hdr.Flags, ms); err != nil {
142-
log.Debugf("Nftables get table error: %s", err)
143-
return err.GetError()
144-
}
145-
return nil
146-
case linux.NFT_MSG_DELTABLE, linux.NFT_MSG_DESTROYTABLE:
147-
nft.Mu.Lock()
148-
defer nft.Mu.Unlock()
149-
if err := p.deleteTable(nft, attrs, family, hdr, msgType, ms); err != nil {
150-
log.Debugf("Nftables delete table error: %s", err)
151-
return err.GetError()
152-
}
153-
return nil
154-
case linux.NFT_MSG_NEWCHAIN:
155-
nft.Mu.Lock()
156-
defer nft.Mu.Unlock()
157-
if err := p.newChain(nft, attrs, family, hdr.Flags, ms); err != nil {
158-
log.Debugf("Nftables new chain error: %s", err)
159-
return err.GetError()
160-
}
161-
return nil
162-
case linux.NFT_MSG_GETCHAIN:
163-
nft.Mu.RLock()
164-
defer nft.Mu.RUnlock()
165-
if err := p.getChain(nft, attrs, family, hdr.Flags, ms); err != nil {
166-
log.Debugf("Nftables get chain error: %s", err)
167-
return err.GetError()
168-
}
169-
return nil
170-
case linux.NFT_MSG_DELCHAIN, linux.NFT_MSG_DESTROYCHAIN:
171-
nft.Mu.Lock()
172-
defer nft.Mu.Unlock()
173-
if err := p.deleteChain(nft, attrs, family, hdr.Flags, msgType, ms); err != nil {
174-
log.Debugf("Nftables delete chain error: %s", err)
175-
return err.GetError()
176-
}
177-
return nil
178-
case linux.NFT_MSG_NEWRULE:
179-
nft.Mu.Lock()
180-
defer nft.Mu.Unlock()
181-
if err := p.newRule(nft, attrs, family, hdr.Flags, ms); err != nil {
182-
log.Debugf("Nftables new rule error: %s", err)
183-
return err.GetError()
184-
}
185-
return nil
186-
default:
187-
log.Debugf("Unsupported message type: %d", msgType)
188-
return syserr.ErrNotSupported
189-
}
190-
}
191-
19289
// newTable creates a new table for the given family.
19390
func (p *Protocol) newTable(nft *nftables.NFTables, attrs map[uint16]nlmsg.BytesView, family stack.AddressFamily, flags uint16, ms *nlmsg.MessageSet) *syserr.AnnotatedError {
19491
// TODO: b/434242152 - Handle the case where the table name is set to empty string.
@@ -990,6 +887,109 @@ func netLinkMessagePayloadSize(h *linux.NetlinkMessageHeader) int {
990887
return int(h.Length) - linux.NetlinkMessageHeaderSize
991888
}
992889

890+
// ProcessMessage implements netlink.Protocol.ProcessMessage.
891+
// TODO: 434785410 - Support batch messages.
892+
func (p *Protocol) ProcessMessage(ctx context.Context, s *netlink.Socket, msg *nlmsg.Message, ms *nlmsg.MessageSet) *syserr.Error {
893+
hdr := msg.Header()
894+
895+
// Netlink message payloads must be of at least the size of the genmsg.
896+
// Return early if it is not, from linux/net/netfilter/nfnetlink.c.
897+
if netLinkMessagePayloadSize(&hdr) < linux.SizeOfNetfilterGenMsg {
898+
log.Debugf("Netlink message payload is too small: %d < %d", netLinkMessagePayloadSize(&hdr), linux.SizeOfNetfilterGenMsg)
899+
return nil
900+
}
901+
902+
msgType := hdr.NetFilterMsgType()
903+
st := inet.StackFromContext(ctx).(*netstack.Stack).Stack
904+
nft := (st.NFTables()).(*nftables.NFTables)
905+
var nfGenMsg linux.NetFilterGenMsg
906+
907+
// The payload of a netfilter generic message is its attributes.
908+
atr, ok := msg.GetData(&nfGenMsg)
909+
if !ok {
910+
log.Debugf("Failed to get message data")
911+
return syserr.ErrInvalidArgument
912+
}
913+
914+
attrs, ok := atr.Parse()
915+
if !ok {
916+
log.Debugf("Failed to parse message attributes")
917+
return syserr.ErrInvalidArgument
918+
}
919+
920+
// Nftables functions error check the address family value.
921+
family, err := nftables.AFtoNetlinkAF(nfGenMsg.Family)
922+
switch msgType {
923+
case linux.NFT_MSG_NEWTABLE:
924+
nft.Mu.Lock()
925+
defer nft.Mu.Unlock()
926+
// We only check the error value in the case of NFT_MSG_NEWTABLE as linux
927+
// returns an EOPNOTSUPP error only in that case. Otherwise the other
928+
// operations will return errors specific to their function.
929+
if err != nil {
930+
log.Debugf("Nftables: Unsupported address family: %d", int(nfGenMsg.Family))
931+
return err
932+
}
933+
934+
if err := p.newTable(nft, attrs, family, hdr.Flags, ms); err != nil {
935+
log.Debugf("Nftables new table error: %s", err)
936+
return err.GetError()
937+
}
938+
return nil
939+
case linux.NFT_MSG_GETTABLE:
940+
nft.Mu.RLock()
941+
defer nft.Mu.RUnlock()
942+
if err := p.getTable(nft, attrs, family, hdr.Flags, ms); err != nil {
943+
log.Debugf("Nftables get table error: %s", err)
944+
return err.GetError()
945+
}
946+
return nil
947+
case linux.NFT_MSG_DELTABLE, linux.NFT_MSG_DESTROYTABLE:
948+
nft.Mu.Lock()
949+
defer nft.Mu.Unlock()
950+
if err := p.deleteTable(nft, attrs, family, hdr, msgType, ms); err != nil {
951+
log.Debugf("Nftables delete table error: %s", err)
952+
return err.GetError()
953+
}
954+
return nil
955+
case linux.NFT_MSG_NEWCHAIN:
956+
nft.Mu.Lock()
957+
defer nft.Mu.Unlock()
958+
if err := p.newChain(nft, attrs, family, hdr.Flags, ms); err != nil {
959+
log.Debugf("Nftables new chain error: %s", err)
960+
return err.GetError()
961+
}
962+
return nil
963+
case linux.NFT_MSG_GETCHAIN:
964+
nft.Mu.RLock()
965+
defer nft.Mu.RUnlock()
966+
if err := p.getChain(nft, attrs, family, hdr.Flags, ms); err != nil {
967+
log.Debugf("Nftables get chain error: %s", err)
968+
return err.GetError()
969+
}
970+
return nil
971+
case linux.NFT_MSG_DELCHAIN, linux.NFT_MSG_DESTROYCHAIN:
972+
nft.Mu.Lock()
973+
defer nft.Mu.Unlock()
974+
if err := p.deleteChain(nft, attrs, family, hdr.Flags, msgType, ms); err != nil {
975+
log.Debugf("Nftables delete chain error: %s", err)
976+
return err.GetError()
977+
}
978+
return nil
979+
case linux.NFT_MSG_NEWRULE:
980+
nft.Mu.Lock()
981+
defer nft.Mu.Unlock()
982+
if err := p.newRule(nft, attrs, family, hdr.Flags, ms); err != nil {
983+
log.Debugf("Nftables new rule error: %s", err)
984+
return err.GetError()
985+
}
986+
return nil
987+
default:
988+
log.Debugf("Unsupported message type: %d", msgType)
989+
return syserr.ErrNotSupported
990+
}
991+
}
992+
993993
// init registers the NETLINK_NETFILTER provider.
994994
func init() {
995995
netlink.RegisterProvider(linux.NETLINK_NETFILTER, NewProtocol)

0 commit comments

Comments
 (0)