Skip to content

Commit 3a1310d

Browse files
kerumetogvisor-bot
authored andcommitted
Nftables New Chain implementation
Implements functionality for adding a new base chain and/or regular chain to a netfilter table. This includes chain flags, user-metadata, handles, policies, and hook attribute data. Certain flags like NFTA_CHAIN_COUNTERS were left as explicitly unsupported for now. Finally, adding base chains specifically for the netdev family and at the Ingress and Egress hooks have been explicitly left unsupported for now. Updating already existing chains have also been explicitly left unsupported for now, both of which will be implemented in a future change. PiperOrigin-RevId: 778218038
1 parent 1282119 commit 3a1310d

File tree

13 files changed

+1534
-7
lines changed

13 files changed

+1534
-7
lines changed

pkg/abi/linux/BUILD

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ go_library(
5252
"msgqueue.go",
5353
"netdevice.go",
5454
"netfilter.go",
55+
"netfilter_arp.go",
5556
"netfilter_bridge.go",
5657
"netfilter_ipv4.go",
5758
"netfilter_ipv6.go",

pkg/abi/linux/netfilter.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,13 @@ const (
3131
NF_INET_LOCAL_OUT = 3
3232
NF_INET_POST_ROUTING = 4
3333
NF_INET_NUMHOOKS = 5
34+
NF_INET_INGRESS = NF_INET_NUMHOOKS
35+
)
36+
37+
const (
38+
NF_NETDEV_INGRESS = iota
39+
NF_NETDEV_EGRESS
40+
NF_NETDEV_NUMHOOKS
3441
)
3542

3643
// Protocol families (address families). These correspond to values in

pkg/abi/linux/netfilter_arp.go

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// Copyright 2025 The gVisor Authors.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package linux
16+
17+
// These constants show the hooks ARP packets can be evaluated at.
18+
// From include/uapi/linux/netfilter_arp.h.
19+
const (
20+
NF_ARP_IN = iota
21+
NF_ARP_OUT
22+
NF_ARP_FORWARD
23+
NF_ARP_NUMHOOKS
24+
)

pkg/abi/linux/netfilter_bridge.go

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,17 @@ package linux
1616

1717
import "math"
1818

19+
// Netfilter Bridge Standard Hook Points, from uapi/linux/netfilter_bridge.h.
20+
const (
21+
NF_BR_PRE_ROUTING = iota
22+
NF_BR_LOCAL_IN
23+
NF_BR_FORWARD
24+
NF_BR_LOCAL_OUT
25+
NF_BR_POST_ROUTING
26+
NF_BR_BROUTING
27+
NF_BR_NUMHOOKS
28+
)
29+
1930
// Netfilter Bridge Standard Hook Priorities, from
2031
// uapi/linux/netfilter_bridge.h.
2132
const (

pkg/abi/linux/nf_tables.go

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ package linux
1616

1717
// This file contains constants required to support nf_tables.
1818

19+
const NFT_MAX_HOOKS = NF_INET_NUMHOOKS + 1
20+
1921
// Name length constants for nf_table structures. These correspond to values in
2022
// include/uapi/linux/netfilter/nf_tables.h.
2123
const (
@@ -136,6 +138,18 @@ const (
136138
NFT_MSG_MAX
137139
)
138140

141+
// NfTableHookAttributes represents the netfilter hook attributes.
142+
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
143+
const (
144+
NFTA_HOOK_UNSPEC uint16 = iota
145+
NFTA_HOOK_HOOKNUM
146+
NFTA_HOOK_PRIORITY
147+
NFTA_HOOK_DEV
148+
NFTA_HOOK_DEVS
149+
__NFTA_HOOK_MAX
150+
NFTA_HOOK_MAX = __NFTA_HOOK_MAX - 1
151+
)
152+
139153
// NfTableFlags represents table flags that can be set for a table, namely dormant.
140154
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
141155
const (
@@ -162,6 +176,35 @@ const (
162176
// NFTA_TABLE_MAX is the maximum netfilter table attribute.
163177
const NFTA_TABLE_MAX = __NFTA_TABLE_MAX - 1
164178

179+
// NfTableChainFlags represents chain flags that can be set for a chain.
180+
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
181+
const (
182+
NFT_CHAIN_BASE uint32 = (1 << 0)
183+
NFT_CHAIN_HW_OFFLOAD = (1 << 1)
184+
NFT_CHAIN_BINDING = (1 << 2)
185+
NFT_CHAIN_FLAGS = (NFT_CHAIN_BASE | NFT_CHAIN_HW_OFFLOAD | NFT_CHAIN_BINDING)
186+
)
187+
188+
// NfTableChainAttributes represents the netfilter chain attributes.
189+
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
190+
const (
191+
NFTA_CHAIN_UNSPEC uint16 = iota
192+
NFTA_CHAIN_TABLE
193+
NFTA_CHAIN_HANDLE
194+
NFTA_CHAIN_NAME
195+
NFTA_CHAIN_HOOK
196+
NFTA_CHAIN_POLICY
197+
NFTA_CHAIN_USE
198+
NFTA_CHAIN_TYPE
199+
NFTA_CHAIN_COUNTERS
200+
NFTA_CHAIN_PAD
201+
NFTA_CHAIN_FLAGS
202+
NFTA_CHAIN_ID
203+
NFTA_CHAIN_USERDATA
204+
__NFTA_CHAIN_MAX
205+
NFTA_CHAIN_MAX = __NFTA_CHAIN_MAX - 1
206+
)
207+
165208
// Nf table relational operators.
166209
// Used by the nft comparison operation to compare values in registers.
167210
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.

pkg/sentry/socket/netlink/netfilter/BUILD

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ go_library(
1111
visibility = ["//pkg/sentry:internal"],
1212
deps = [
1313
"//pkg/abi/linux",
14+
"//pkg/atomicbitops",
1415
"//pkg/context",
1516
"//pkg/log",
1617
"//pkg/marshal/primitive",

0 commit comments

Comments
 (0)