diff options
| author | gVisor bot <gvisor-bot@google.com> | 2021-05-14 01:58:11 +0000 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2021-05-14 01:58:11 +0000 |
| commit | 5cf8df5d702feefcbab1ddb86477717697a581e8 (patch) | |
| tree | 37abb801f3ba21d696910929b0d588034defbdd3 /pkg/tcpip/stack | |
| parent | 16d71d30e2711bc204c97e7a56ff7d6c43a3e2a0 (diff) | |
| parent | 2b457d9ee9ba50da4a9208d957053fac2c77932d (diff) | |
Merge release-20210510.0-32-g2b457d9ee (automated)
Diffstat (limited to 'pkg/tcpip/stack')
| -rw-r--r-- | pkg/tcpip/stack/iptables.go | 1 | ||||
| -rw-r--r-- | pkg/tcpip/stack/iptables_types.go | 15 |
2 files changed, 13 insertions, 3 deletions
diff --git a/pkg/tcpip/stack/iptables.go b/pkg/tcpip/stack/iptables.go index e2894c548..3670d5995 100644 --- a/pkg/tcpip/stack/iptables.go +++ b/pkg/tcpip/stack/iptables.go @@ -177,6 +177,7 @@ func DefaultTables() *IPTables { priorities: [NumHooks][]TableID{ Prerouting: {MangleID, NATID}, Input: {NATID, FilterID}, + Forward: {FilterID}, Output: {MangleID, NATID, FilterID}, Postrouting: {MangleID, NATID}, }, diff --git a/pkg/tcpip/stack/iptables_types.go b/pkg/tcpip/stack/iptables_types.go index 4631ab93f..93592e7f5 100644 --- a/pkg/tcpip/stack/iptables_types.go +++ b/pkg/tcpip/stack/iptables_types.go @@ -280,9 +280,18 @@ func (fl IPHeaderFilter) match(pkt *PacketBuffer, hook Hook, inNicName, outNicNa return matchIfName(inNicName, fl.InputInterface, fl.InputInterfaceInvert) case Output: return matchIfName(outNicName, fl.OutputInterface, fl.OutputInterfaceInvert) - case Forward, Postrouting: - // TODO(gvisor.dev/issue/170): Add the check for FORWARD and POSTROUTING - // hooks after supported. + case Forward: + if !matchIfName(inNicName, fl.InputInterface, fl.InputInterfaceInvert) { + return false + } + + if !matchIfName(outNicName, fl.OutputInterface, fl.OutputInterfaceInvert) { + return false + } + + return true + case Postrouting: + // TODO(gvisor.dev/issue/170): Add the check for POSTROUTING. return true default: panic(fmt.Sprintf("unknown hook: %d", hook)) |