From b30b7f3422202232ad1c385a7ac0d775151fee2f Mon Sep 17 00:00:00 2001
From: Nayana Bidari <nybidari@google.com>
Date: Tue, 18 Feb 2020 11:30:42 -0800
Subject: Add nat table support for iptables.

Add nat table support for Prerouting hook with Redirect option.
Add tests to check redirect of ports.
---
 pkg/tcpip/iptables/iptables.go | 21 +++++++++++++++++++++
 pkg/tcpip/iptables/targets.go  | 24 ++++++++++++++++++++++++
 pkg/tcpip/stack/nic.go         | 23 +++++++++++++++++++++++
 3 files changed, 68 insertions(+)

(limited to 'pkg/tcpip')

diff --git a/pkg/tcpip/iptables/iptables.go b/pkg/tcpip/iptables/iptables.go
index 75a433a3b..c00d012c0 100644
--- a/pkg/tcpip/iptables/iptables.go
+++ b/pkg/tcpip/iptables/iptables.go
@@ -135,6 +135,27 @@ func EmptyFilterTable() Table {
 	}
 }
 
+// EmptyNatTable returns a Table with no rules and the filter table chains
+// mapped to HookUnset.
+func EmptyNatTable() Table {
+	return Table{
+		Rules: []Rule{},
+		BuiltinChains: map[Hook]int{
+			Prerouting:  HookUnset,
+			Input:       HookUnset,
+			Output:      HookUnset,
+			Postrouting: HookUnset,
+		},
+		Underflows: map[Hook]int{
+			Prerouting:  HookUnset,
+			Input:       HookUnset,
+			Output:      HookUnset,
+			Postrouting: HookUnset,
+		},
+		UserChains: map[string]int{},
+	}
+}
+
 // Check runs pkt through the rules for hook. It returns true when the packet
 // should continue traversing the network stack and false when it should be
 // dropped.
diff --git a/pkg/tcpip/iptables/targets.go b/pkg/tcpip/iptables/targets.go
index 9fc60cfad..06e65bece 100644
--- a/pkg/tcpip/iptables/targets.go
+++ b/pkg/tcpip/iptables/targets.go
@@ -19,6 +19,7 @@ package iptables
 import (
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
 )
 
 // AcceptTarget accepts packets.
@@ -65,3 +66,26 @@ type ReturnTarget struct{}
 func (ReturnTarget) Action(tcpip.PacketBuffer) (RuleVerdict, string) {
 	return RuleReturn, ""
 }
+
+// RedirectTarget redirects the packet by modifying the destination port/IP.
+type RedirectTarget struct {
+	RangeSize uint32
+	Flags     uint32
+	MinIP     tcpip.Address
+	MaxIP     tcpip.Address
+	MinPort   uint16
+	MaxPort   uint16
+}
+
+// Action implements Target.Action.
+func (rt RedirectTarget) Action(packet tcpip.PacketBuffer) (RuleVerdict, string) {
+	log.Infof("RedirectTarget triggered.")
+
+	// TODO(gvisor.dev/issue/170): Checking only for UDP protocol.
+	// We're yet to support for TCP protocol.
+	headerView := packet.Data.First()
+	h := header.UDP(headerView)
+	h.SetDestinationPort(rt.MinPort)
+
+	return RuleAccept, ""
+}
diff --git a/pkg/tcpip/stack/nic.go b/pkg/tcpip/stack/nic.go
index ca3a7a07e..2028f5201 100644
--- a/pkg/tcpip/stack/nic.go
+++ b/pkg/tcpip/stack/nic.go
@@ -25,6 +25,7 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/iptables"
 )
 
 // NIC represents a "network interface card" to which the networking stack is
@@ -1012,6 +1013,7 @@ func (n *NIC) leaveGroupLocked(addr tcpip.Address) *tcpip.Error {
 func handlePacket(protocol tcpip.NetworkProtocolNumber, dst, src tcpip.Address, localLinkAddr, remotelinkAddr tcpip.LinkAddress, ref *referencedNetworkEndpoint, pkt tcpip.PacketBuffer) {
 	r := makeRoute(protocol, dst, src, localLinkAddr, ref, false /* handleLocal */, false /* multicastLoop */)
 	r.RemoteLinkAddress = remotelinkAddr
+
 	ref.ep.HandlePacket(&r, pkt)
 	ref.decRef()
 }
@@ -1082,6 +1084,27 @@ func (n *NIC) DeliverNetworkPacket(linkEP LinkEndpoint, remote, local tcpip.Link
 		n.stack.stats.IP.InvalidSourceAddressesReceived.Increment()
 		return
 	}
+
+	// TODO(gvisor.dev/issue/170): Not supporting iptables for IPv6 yet.
+	if protocol == header.IPv4ProtocolNumber {
+		newPkt := pkt.Clone()
+
+		headerView := newPkt.Data.First()
+		h := header.IPv4(headerView)
+		newPkt.NetworkHeader = headerView[:h.HeaderLength()]
+
+		hlen := int(h.HeaderLength())
+		tlen := int(h.TotalLength())
+		newPkt.Data.TrimFront(hlen)
+		newPkt.Data.CapLength(tlen - hlen)
+
+		ipt := n.stack.IPTables()
+		if ok := ipt.Check(iptables.Prerouting, newPkt); !ok {
+			// iptables is telling us to drop the packet.
+			return
+		}
+	}
+
 	if ref := n.getRef(protocol, dst); ref != nil {
 		handlePacket(protocol, dst, src, linkEP.LinkAddress(), remote, ref, pkt)
 		return
-- 
cgit v1.2.3


From acc405ba60834f5dce9ce04cd762d5cda02224cb Mon Sep 17 00:00:00 2001
From: Nayana Bidari <nybidari@google.com>
Date: Tue, 25 Feb 2020 15:03:51 -0800
Subject: Add nat table support for iptables.

- commit the changes for the comments.
---
 pkg/abi/linux/netfilter.go               | 23 +++++++++--
 pkg/sentry/socket/netfilter/netfilter.go | 33 +++++++++++-----
 pkg/tcpip/iptables/iptables.go           | 10 ++++-
 pkg/tcpip/iptables/targets.go            | 66 ++++++++++++++++++++++----------
 pkg/tcpip/iptables/types.go              |  4 +-
 pkg/tcpip/stack/nic.go                   | 13 +------
 test/iptables/nat.go                     | 12 +-----
 7 files changed, 103 insertions(+), 58 deletions(-)

(limited to 'pkg/tcpip')

diff --git a/pkg/abi/linux/netfilter.go b/pkg/abi/linux/netfilter.go
index ba4d84962..2179ac995 100644
--- a/pkg/abi/linux/netfilter.go
+++ b/pkg/abi/linux/netfilter.go
@@ -250,8 +250,24 @@ type XTErrorTarget struct {
 // SizeOfXTErrorTarget is the size of an XTErrorTarget.
 const SizeOfXTErrorTarget = 64
 
+// Flag values for NfNATIPV4Range. The values indicate whether to map
+// protocol specific part(ports) or IPs. It corresponds to values in
+// include/uapi/linux/netfilter/nf_nat.h.
+const (
+	NF_NAT_RANGE_MAP_IPS            = 1 << 0
+	NF_NAT_RANGE_PROTO_SPECIFIED    = 1 << 1
+	NF_NAT_RANGE_PROTO_RANDOM       = 1 << 2
+	NF_NAT_RANGE_PERSISTENT         = 1 << 3
+	NF_NAT_RANGE_PROTO_RANDOM_FULLY = 1 << 4
+	NF_NAT_RANGE_PROTO_RANDOM_ALL   = (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
+	NF_NAT_RANGE_MASK               = (NF_NAT_RANGE_MAP_IPS |
+		NF_NAT_RANGE_PROTO_SPECIFIED | NF_NAT_RANGE_PROTO_RANDOM |
+		NF_NAT_RANGE_PERSISTENT | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
+)
+
 // NfNATIPV4Range. It corresponds to struct nf_nat_ipv4_range
-// in include/uapi/linux/netfilter/nf_nat.h.
+// in include/uapi/linux/netfilter/nf_nat.h. The fields are in
+// network byte order.
 type NfNATIPV4Range struct {
 	Flags   uint32
 	MinIP   [4]byte
@@ -263,11 +279,12 @@ type NfNATIPV4Range struct {
 // NfNATIPV4MultiRangeCompat. It corresponds to struct
 // nf_nat_ipv4_multi_range_compat in include/uapi/linux/netfilter/nf_nat.h.
 type NfNATIPV4MultiRangeCompat struct {
-	Rangesize uint32
-	RangeIPV4 [1]NfNATIPV4Range
+	RangeSize uint32
+	RangeIPV4 NfNATIPV4Range
 }
 
 // XTRedirectTarget triggers a redirect when reached.
+// Adding 4 bytes of padding to make the struct 8 byte aligned.
 type XTRedirectTarget struct {
 	Target  XTEntryTarget
 	NfRange NfNATIPV4MultiRangeCompat
diff --git a/pkg/sentry/socket/netfilter/netfilter.go b/pkg/sentry/socket/netfilter/netfilter.go
index 512ad624a..257cb485b 100644
--- a/pkg/sentry/socket/netfilter/netfilter.go
+++ b/pkg/sentry/socket/netfilter/netfilter.go
@@ -26,6 +26,7 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/syserr"
 	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
 	"gvisor.dev/gvisor/pkg/tcpip/iptables"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 	"gvisor.dev/gvisor/pkg/usermem"
@@ -288,6 +289,7 @@ func marshalRedirectTarget() []byte {
 			TargetSize: linux.SizeOfXTRedirectTarget,
 		},
 	}
+	copy(target.Target.Name[:], redirectTargetName)
 
 	ret := make([]byte, 0, linux.SizeOfXTRedirectTarget)
 	return binary.Marshal(ret, usermem.ByteOrder, target)
@@ -405,7 +407,7 @@ func SetEntries(stack *stack.Stack, optVal []byte) *syserr.Error {
 			nflog("entry doesn't have enough room for its target (only %d bytes remain)", len(optVal))
 			return syserr.ErrInvalidArgument
 		}
-		target, err := parseTarget(optVal[:targetSize])
+		target, err := parseTarget(filter, optVal[:targetSize])
 		if err != nil {
 			nflog("failed to parse target: %v", err)
 			return syserr.ErrInvalidArgument
@@ -552,7 +554,7 @@ func parseMatchers(filter iptables.IPHeaderFilter, optVal []byte) ([]iptables.Ma
 
 // parseTarget parses a target from optVal. optVal should contain only the
 // target.
-func parseTarget(optVal []byte) (iptables.Target, error) {
+func parseTarget(filter iptables.IPHeaderFilter, optVal []byte) (iptables.Target, error) {
 	nflog("set entries: parsing target of size %d", len(optVal))
 	if len(optVal) < linux.SizeOfXTEntryTarget {
 		return nil, fmt.Errorf("optVal has insufficient size for entry target %d", len(optVal))
@@ -604,6 +606,10 @@ func parseTarget(optVal []byte) (iptables.Target, error) {
 			return nil, fmt.Errorf("netfilter.SetEntries: optVal has insufficient size for redirect target %d", len(optVal))
 		}
 
+		if filter.Protocol != header.TCPProtocolNumber && filter.Protocol != header.UDPProtocolNumber {
+			return nil, fmt.Errorf("netfilter.SetEntries: invalid argument")
+		}
+
 		var redirectTarget linux.XTRedirectTarget
 		buf = optVal[:linux.SizeOfXTRedirectTarget]
 		binary.Unmarshal(buf, usermem.ByteOrder, &redirectTarget)
@@ -612,21 +618,30 @@ func parseTarget(optVal []byte) (iptables.Target, error) {
 		var target iptables.RedirectTarget
 		nfRange := redirectTarget.NfRange
 
-		target.RangeSize = nfRange.Rangesize
-		target.Flags = nfRange.RangeIPV4[0].Flags
+		// RangeSize should be 1.
+		if nfRange.RangeSize != 1 {
+			return nil, fmt.Errorf("netfilter.SetEntries: invalid argument")
+		}
+
+		// TODO(gvisor.dev/issue/170): Check if the flags are valid.
+		// Also check if we need to map ports or IP.
+		// For now, redirect target only supports dest port change.
+		if nfRange.RangeIPV4.Flags&linux.NF_NAT_RANGE_PROTO_SPECIFIED == 0 {
+			return nil, fmt.Errorf("netfilter.SetEntries: invalid argument.")
+		}
+		target.Flags = nfRange.RangeIPV4.Flags
 
-		target.MinIP = tcpip.Address(nfRange.RangeIPV4[0].MinIP[:])
-		target.MaxIP = tcpip.Address(nfRange.RangeIPV4[0].MaxIP[:])
+		target.MinIP = tcpip.Address(nfRange.RangeIPV4.MinIP[:])
+		target.MaxIP = tcpip.Address(nfRange.RangeIPV4.MaxIP[:])
 
 		// Convert port from big endian to little endian.
 		port := make([]byte, 2)
-		binary.BigEndian.PutUint16(port, nfRange.RangeIPV4[0].MinPort)
+		binary.BigEndian.PutUint16(port, nfRange.RangeIPV4.MinPort)
 		target.MinPort = binary.LittleEndian.Uint16(port)
 
-		binary.BigEndian.PutUint16(port, nfRange.RangeIPV4[0].MaxPort)
+		binary.BigEndian.PutUint16(port, nfRange.RangeIPV4.MaxPort)
 		target.MaxPort = binary.LittleEndian.Uint16(port)
 		return target, nil
-
 	}
 
 	// Unknown target.
diff --git a/pkg/tcpip/iptables/iptables.go b/pkg/tcpip/iptables/iptables.go
index c00d012c0..f7dc4f720 100644
--- a/pkg/tcpip/iptables/iptables.go
+++ b/pkg/tcpip/iptables/iptables.go
@@ -207,7 +207,7 @@ func (it *IPTables) checkTable(hook Hook, pkt tcpip.PacketBuffer, tablename stri
 			underflow := table.Rules[table.Underflows[hook]]
 			// Underflow is guaranteed to be an unconditional
 			// ACCEPT or DROP.
-			switch v, _ := underflow.Target.Action(pkt); v {
+			switch v, _ := underflow.Target.Action(pkt, underflow.Filter); v {
 			case RuleAccept:
 				return TableAccept
 			case RuleDrop:
@@ -233,6 +233,12 @@ func (it *IPTables) checkTable(hook Hook, pkt tcpip.PacketBuffer, tablename stri
 func (it *IPTables) checkRule(hook Hook, pkt tcpip.PacketBuffer, table Table, ruleIdx int) RuleVerdict {
 	rule := table.Rules[ruleIdx]
 
+	// If pkt.NetworkHeader hasn't been set yet, it will be contained in
+	// pkt.Data.First().
+	if pkt.NetworkHeader == nil {
+		pkt.NetworkHeader = pkt.Data.First()
+	}
+
 	// First check whether the packet matches the IP header filter.
 	// TODO(gvisor.dev/issue/170): Support other fields of the filter.
 	if rule.Filter.Protocol != 0 && rule.Filter.Protocol != header.IPv4(pkt.NetworkHeader).TransportProtocol() {
@@ -252,6 +258,6 @@ func (it *IPTables) checkRule(hook Hook, pkt tcpip.PacketBuffer, table Table, ru
 	}
 
 	// All the matchers matched, so run the target.
-	verdict, _ := rule.Target.Action(pkt)
+	verdict, _ := rule.Target.Action(pkt, rule.Filter)
 	return verdict
 }
diff --git a/pkg/tcpip/iptables/targets.go b/pkg/tcpip/iptables/targets.go
index 06e65bece..a75938da3 100644
--- a/pkg/tcpip/iptables/targets.go
+++ b/pkg/tcpip/iptables/targets.go
@@ -26,7 +26,7 @@ import (
 type AcceptTarget struct{}
 
 // Action implements Target.Action.
-func (AcceptTarget) Action(packet tcpip.PacketBuffer) (RuleVerdict, string) {
+func (AcceptTarget) Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, string) {
 	return RuleAccept, ""
 }
 
@@ -34,7 +34,7 @@ func (AcceptTarget) Action(packet tcpip.PacketBuffer) (RuleVerdict, string) {
 type DropTarget struct{}
 
 // Action implements Target.Action.
-func (DropTarget) Action(packet tcpip.PacketBuffer) (RuleVerdict, string) {
+func (DropTarget) Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, string) {
 	return RuleDrop, ""
 }
 
@@ -43,7 +43,7 @@ func (DropTarget) Action(packet tcpip.PacketBuffer) (RuleVerdict, string) {
 type ErrorTarget struct{}
 
 // Action implements Target.Action.
-func (ErrorTarget) Action(packet tcpip.PacketBuffer) (RuleVerdict, string) {
+func (ErrorTarget) Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, string) {
 	log.Debugf("ErrorTarget triggered.")
 	return RuleDrop, ""
 }
@@ -54,7 +54,7 @@ type UserChainTarget struct {
 }
 
 // Action implements Target.Action.
-func (UserChainTarget) Action(tcpip.PacketBuffer) (RuleVerdict, string) {
+func (UserChainTarget) Action(tcpip.PacketBuffer, IPHeaderFilter) (RuleVerdict, string) {
 	panic("UserChainTarget should never be called.")
 }
 
@@ -63,29 +63,55 @@ func (UserChainTarget) Action(tcpip.PacketBuffer) (RuleVerdict, string) {
 type ReturnTarget struct{}
 
 // Action implements Target.Action.
-func (ReturnTarget) Action(tcpip.PacketBuffer) (RuleVerdict, string) {
+func (ReturnTarget) Action(tcpip.PacketBuffer, IPHeaderFilter) (RuleVerdict, string) {
 	return RuleReturn, ""
 }
 
 // RedirectTarget redirects the packet by modifying the destination port/IP.
+// Min and Max values for IP and Ports in the struct indicate the range of
+// values which can be used to redirect.
 type RedirectTarget struct {
-	RangeSize uint32
-	Flags     uint32
-	MinIP     tcpip.Address
-	MaxIP     tcpip.Address
-	MinPort   uint16
-	MaxPort   uint16
-}
+	// Flags to check if the redirect is for address or ports.
+	Flags uint32
 
-// Action implements Target.Action.
-func (rt RedirectTarget) Action(packet tcpip.PacketBuffer) (RuleVerdict, string) {
-	log.Infof("RedirectTarget triggered.")
+	// Min address used to redirect.
+	MinIP tcpip.Address
+
+	// Max address used to redirect.
+	MaxIP tcpip.Address
 
-	// TODO(gvisor.dev/issue/170): Checking only for UDP protocol.
-	// We're yet to support for TCP protocol.
-	headerView := packet.Data.First()
-	h := header.UDP(headerView)
-	h.SetDestinationPort(rt.MinPort)
+	// Min port used to redirect.
+	MinPort uint16
 
+	// Max port used to redirect.
+	MaxPort uint16
+}
+
+// Action implements Target.Action.
+func (rt RedirectTarget) Action(pkt tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, string) {
+	headerView := pkt.Data.First()
+
+	// Network header should be set.
+	netHeader := header.IPv4(headerView)
+	if netHeader == nil {
+		return RuleDrop, ""
+	}
+
+	// TODO(gvisor.dev/issue/170): Check Flags in RedirectTarget if
+	// we need to change dest address (for OUTPUT chain) or ports.
+	hlen := int(netHeader.HeaderLength())
+
+	switch protocol := filter.Protocol; protocol {
+	case header.UDPProtocolNumber:
+		udp := header.UDP(headerView[hlen:])
+		udp.SetDestinationPort(rt.MinPort)
+	case header.TCPProtocolNumber:
+		// TODO(gvisor.dev/issue/170): Need to recompute checksum
+		// and implement nat connection tracking to support TCP.
+		tcp := header.TCP(headerView[hlen:])
+		tcp.SetDestinationPort(rt.MinPort)
+	default:
+		return RuleDrop, ""
+	}
 	return RuleAccept, ""
 }
diff --git a/pkg/tcpip/iptables/types.go b/pkg/tcpip/iptables/types.go
index 5735d001b..0102831d0 100644
--- a/pkg/tcpip/iptables/types.go
+++ b/pkg/tcpip/iptables/types.go
@@ -63,7 +63,7 @@ const (
 	// TableAccept indicates the packet should continue through netstack.
 	TableAccept TableVerdict = iota
 
-	// TableAccept indicates the packet should be dropped.
+	// TableDrop indicates the packet should be dropped.
 	TableDrop
 )
 
@@ -175,5 +175,5 @@ type Target interface {
 	// Action takes an action on the packet and returns a verdict on how
 	// traversal should (or should not) continue. If the return value is
 	// Jump, it also returns the name of the chain to jump to.
-	Action(packet tcpip.PacketBuffer) (RuleVerdict, string)
+	Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, string)
 }
diff --git a/pkg/tcpip/stack/nic.go b/pkg/tcpip/stack/nic.go
index 2028f5201..a75dc0322 100644
--- a/pkg/tcpip/stack/nic.go
+++ b/pkg/tcpip/stack/nic.go
@@ -1087,19 +1087,8 @@ func (n *NIC) DeliverNetworkPacket(linkEP LinkEndpoint, remote, local tcpip.Link
 
 	// TODO(gvisor.dev/issue/170): Not supporting iptables for IPv6 yet.
 	if protocol == header.IPv4ProtocolNumber {
-		newPkt := pkt.Clone()
-
-		headerView := newPkt.Data.First()
-		h := header.IPv4(headerView)
-		newPkt.NetworkHeader = headerView[:h.HeaderLength()]
-
-		hlen := int(h.HeaderLength())
-		tlen := int(h.TotalLength())
-		newPkt.Data.TrimFront(hlen)
-		newPkt.Data.CapLength(tlen - hlen)
-
 		ipt := n.stack.IPTables()
-		if ok := ipt.Check(iptables.Prerouting, newPkt); !ok {
+		if ok := ipt.Check(iptables.Prerouting, pkt); !ok {
 			// iptables is telling us to drop the packet.
 			return
 		}
diff --git a/test/iptables/nat.go b/test/iptables/nat.go
index 306cbd1b3..899d1c9d3 100644
--- a/test/iptables/nat.go
+++ b/test/iptables/nat.go
@@ -71,20 +71,12 @@ func (NATRedirectTCPPort) ContainerAction(ip net.IP) error {
 	}
 
 	// Listen for TCP packets on redirect port.
-	if err := listenTCP(redirectPort, sendloopDuration); err != nil {
-		return fmt.Errorf("connection on port %d should be accepted, but got error %v", redirectPort, err)
-	}
-
-	return nil
+	return listenTCP(redirectPort, sendloopDuration)
 }
 
 // LocalAction implements TestCase.LocalAction.
 func (NATRedirectTCPPort) LocalAction(ip net.IP) error {
-	if err := connectTCP(ip, dropPort, acceptPort, sendloopDuration); err != nil {
-		return fmt.Errorf("connection destined to port %d should be accepted, but got error %v", dropPort, err)
-	}
-
-	return nil
+	return connectTCP(ip, dropPort, acceptPort, sendloopDuration)
 }
 
 // NATDropUDP tests that packets are not received in ports other than redirect port.
-- 
cgit v1.2.3


From 9fccf98c0d990cb32666091855f3a396f762ce55 Mon Sep 17 00:00:00 2001
From: Nayana Bidari <nybidari@google.com>
Date: Wed, 26 Feb 2020 13:18:35 -0800
Subject: Fix merge conflicts.

---
 pkg/tcpip/iptables/iptables.go |  5 ++---
 pkg/tcpip/iptables/targets.go  | 14 +++++++-------
 pkg/tcpip/iptables/types.go    |  2 +-
 3 files changed, 10 insertions(+), 11 deletions(-)

(limited to 'pkg/tcpip')

diff --git a/pkg/tcpip/iptables/iptables.go b/pkg/tcpip/iptables/iptables.go
index 80ddbd442..2ab9e0675 100644
--- a/pkg/tcpip/iptables/iptables.go
+++ b/pkg/tcpip/iptables/iptables.go
@@ -171,7 +171,6 @@ const (
 	chainReturn
 )
 
-
 // Check runs pkt through the rules for hook. It returns true when the packet
 // should continue traversing the network stack and false when it should be
 // dropped.
@@ -242,7 +241,7 @@ func (it *IPTables) checkChain(hook Hook, pkt tcpip.PacketBuffer, table Table, r
 				return chainDrop
 			case chainReturn:
 				ruleIdx++
-				continue   
+				continue
 			default:
 				panic(fmt.Sprintf("Unknown verdict: %d", verdict))
 			}
@@ -289,5 +288,5 @@ func (it *IPTables) checkRule(hook Hook, pkt tcpip.PacketBuffer, table Table, ru
 	}
 
 	// All the matchers matched, so run the target.
-  return rule.Target.Action(pkt, rule.Filter)
+	return rule.Target.Action(pkt)
 }
diff --git a/pkg/tcpip/iptables/targets.go b/pkg/tcpip/iptables/targets.go
index 5dbb28145..96318118c 100644
--- a/pkg/tcpip/iptables/targets.go
+++ b/pkg/tcpip/iptables/targets.go
@@ -24,7 +24,7 @@ import (
 type AcceptTarget struct{}
 
 // Action implements Target.Action.
-func (AcceptTarget) Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, int) {
+func (AcceptTarget) Action(packet tcpip.PacketBuffer) (RuleVerdict, int) {
 	return RuleAccept, 0
 }
 
@@ -32,7 +32,7 @@ func (AcceptTarget) Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (Ru
 type DropTarget struct{}
 
 // Action implements Target.Action.
-func (DropTarget) Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, int) {
+func (DropTarget) Action(packet tcpip.PacketBuffer) (RuleVerdict, int) {
 	return RuleDrop, 0
 }
 
@@ -41,7 +41,7 @@ func (DropTarget) Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (Rule
 type ErrorTarget struct{}
 
 // Action implements Target.Action.
-func (ErrorTarget) Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, int) {
+func (ErrorTarget) Action(packet tcpip.PacketBuffer) (RuleVerdict, int) {
 	log.Debugf("ErrorTarget triggered.")
 	return RuleDrop, 0
 }
@@ -52,7 +52,7 @@ type UserChainTarget struct {
 }
 
 // Action implements Target.Action.
-func (UserChainTarget) Action(tcpip.PacketBuffer, IPHeaderFilter) (RuleVerdict, int) {
+func (UserChainTarget) Action(tcpip.PacketBuffer) (RuleVerdict, int) {
 	panic("UserChainTarget should never be called.")
 }
 
@@ -61,7 +61,7 @@ func (UserChainTarget) Action(tcpip.PacketBuffer, IPHeaderFilter) (RuleVerdict,
 type ReturnTarget struct{}
 
 // Action implements Target.Action.
-func (ReturnTarget) Action(tcpip.PacketBuffer, IPHeaderFilter) (RuleVerdict, int) {
+func (ReturnTarget) Action(tcpip.PacketBuffer) (RuleVerdict, int) {
 	return RuleReturn, 0
 }
 
@@ -86,7 +86,7 @@ type RedirectTarget struct {
 }
 
 // Action implements Target.Action.
-func (rt RedirectTarget) Action(pkt tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, int) {
+func (rt RedirectTarget) Action(pkt tcpip.PacketBuffer) (RuleVerdict, int) {
 	headerView := pkt.Data.First()
 
 	// Network header should be set.
@@ -99,7 +99,7 @@ func (rt RedirectTarget) Action(pkt tcpip.PacketBuffer, filter IPHeaderFilter) (
 	// we need to change dest address (for OUTPUT chain) or ports.
 	hlen := int(netHeader.HeaderLength())
 
-	switch protocol := filter.Protocol; protocol {
+	switch protocol := netHeader.TransportProtocol(); protocol {
 	case header.UDPProtocolNumber:
 		udp := header.UDP(headerView[hlen:])
 		udp.SetDestinationPort(rt.MinPort)
diff --git a/pkg/tcpip/iptables/types.go b/pkg/tcpip/iptables/types.go
index 8bd3a2c94..9c2ad2d46 100644
--- a/pkg/tcpip/iptables/types.go
+++ b/pkg/tcpip/iptables/types.go
@@ -164,5 +164,5 @@ type Target interface {
 	// Action takes an action on the packet and returns a verdict on how
 	// traversal should (or should not) continue. If the return value is
 	// Jump, it also returns the name of the chain to jump to.
-	Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, int)
+	Action(packet tcpip.PacketBuffer) (RuleVerdict, int)
 }
-- 
cgit v1.2.3


From af6fab651406c411ef848c360b017713de385880 Mon Sep 17 00:00:00 2001
From: Nayana Bidari <nybidari@google.com>
Date: Fri, 28 Feb 2020 10:00:38 -0800
Subject: Add nat table support for iptables.

- Fix review comments.
---
 pkg/sentry/socket/netfilter/netfilter.go | 14 +++++---
 pkg/tcpip/iptables/targets.go            | 55 ++++++++++++++++++++++++--------
 pkg/tcpip/iptables/types.go              |  2 +-
 3 files changed, 53 insertions(+), 18 deletions(-)

(limited to 'pkg/tcpip')

diff --git a/pkg/sentry/socket/netfilter/netfilter.go b/pkg/sentry/socket/netfilter/netfilter.go
index f68a2260d..c8a9e67b8 100644
--- a/pkg/sentry/socket/netfilter/netfilter.go
+++ b/pkg/sentry/socket/netfilter/netfilter.go
@@ -292,9 +292,9 @@ func marshalRedirectTarget() []byte {
 		},
 	}
 	copy(target.Target.Name[:], redirectTargetName)
-  
+
 	ret := make([]byte, 0, linux.SizeOfXTRedirectTarget)
-  return binary.Marshal(ret, usermem.ByteOrder, target)
+	return binary.Marshal(ret, usermem.ByteOrder, target)
 }
 
 func marshalJumpTarget(jt JumpTarget) []byte {
@@ -670,15 +670,21 @@ func parseTarget(filter iptables.IPHeaderFilter, optVal []byte) (iptables.Target
 
 		// TODO(gvisor.dev/issue/170): Check if the flags are valid.
 		// Also check if we need to map ports or IP.
-		// For now, redirect target only supports dest port change.
+		// For now, redirect target only supports destination port change.
+		// Port range and IP range are not supported yet.
 		if nfRange.RangeIPV4.Flags&linux.NF_NAT_RANGE_PROTO_SPECIFIED == 0 {
 			return nil, fmt.Errorf("netfilter.SetEntries: invalid argument.")
 		}
-		target.Flags = nfRange.RangeIPV4.Flags
+		target.RangeProtoSpecified = true
 
 		target.MinIP = tcpip.Address(nfRange.RangeIPV4.MinIP[:])
 		target.MaxIP = tcpip.Address(nfRange.RangeIPV4.MaxIP[:])
 
+		// TODO(gvisor.dev/issue/170): Port range is not supported yet.
+		if nfRange.RangeIPV4.MinPort != nfRange.RangeIPV4.MaxPort {
+			return nil, fmt.Errorf("netfilter.SetEntries: invalid argument.")
+		}
+
 		// Convert port from big endian to little endian.
 		port := make([]byte, 2)
 		binary.BigEndian.PutUint16(port, nfRange.RangeIPV4.MinPort)
diff --git a/pkg/tcpip/iptables/targets.go b/pkg/tcpip/iptables/targets.go
index 96318118c..ae5af7c53 100644
--- a/pkg/tcpip/iptables/targets.go
+++ b/pkg/tcpip/iptables/targets.go
@@ -69,8 +69,11 @@ func (ReturnTarget) Action(tcpip.PacketBuffer) (RuleVerdict, int) {
 // Min and Max values for IP and Ports in the struct indicate the range of
 // values which can be used to redirect.
 type RedirectTarget struct {
-	// Flags to check if the redirect is for address or ports.
-	Flags uint32
+	// TODO(gvisor.dev/issue/170): Other flags need to be aded after
+	// we support them.
+	// RangeProtoSpecified flag indicates single port is specified to
+	// redirect.
+	RangeProtoSpecified bool
 
 	// Min address used to redirect.
 	MinIP tcpip.Address
@@ -86,30 +89,56 @@ type RedirectTarget struct {
 }
 
 // Action implements Target.Action.
+// TODO(gvisor.dev/issue/170): Parse headers without copying. The current
+// implementation only works for PREROUTING and calls pkt.Clone(), neither
+// of which should be the case.
 func (rt RedirectTarget) Action(pkt tcpip.PacketBuffer) (RuleVerdict, int) {
-	headerView := pkt.Data.First()
+	newPkt := pkt.Clone()
 
-	// Network header should be set.
+	// Set network header.
+	headerView := newPkt.Data.First()
 	netHeader := header.IPv4(headerView)
-	if netHeader == nil {
-		return RuleDrop, 0
-	}
+	newPkt.NetworkHeader = headerView[:netHeader.HeaderLength()]
 
-	// TODO(gvisor.dev/issue/170): Check Flags in RedirectTarget if
-	// we need to change dest address (for OUTPUT chain) or ports.
 	hlen := int(netHeader.HeaderLength())
+	tlen := int(netHeader.TotalLength())
+	newPkt.Data.TrimFront(hlen)
+	newPkt.Data.CapLength(tlen - hlen)
 
+	// TODO(gvisor.dev/issue/170): Change destination address to
+	// loopback or interface address on which the packet was
+	// received.
+
+	// TODO(gvisor.dev/issue/170): Check Flags in RedirectTarget if
+	// we need to change dest address (for OUTPUT chain) or ports.
 	switch protocol := netHeader.TransportProtocol(); protocol {
 	case header.UDPProtocolNumber:
-		udp := header.UDP(headerView[hlen:])
-		udp.SetDestinationPort(rt.MinPort)
+		var udpHeader header.UDP
+		if newPkt.TransportHeader != nil {
+			udpHeader = header.UDP(newPkt.TransportHeader)
+		} else {
+			if len(pkt.Data.First()) < header.UDPMinimumSize {
+				return RuleDrop, 0
+			}
+			udpHeader = header.UDP(newPkt.Data.First())
+		}
+		udpHeader.SetDestinationPort(rt.MinPort)
 	case header.TCPProtocolNumber:
+		var tcpHeader header.TCP
+		if newPkt.TransportHeader != nil {
+			tcpHeader = header.TCP(newPkt.TransportHeader)
+		} else {
+			if len(pkt.Data.First()) < header.TCPMinimumSize {
+				return RuleDrop, 0
+			}
+			tcpHeader = header.TCP(newPkt.TransportHeader)
+		}
 		// TODO(gvisor.dev/issue/170): Need to recompute checksum
 		// and implement nat connection tracking to support TCP.
-		tcp := header.TCP(headerView[hlen:])
-		tcp.SetDestinationPort(rt.MinPort)
+		tcpHeader.SetDestinationPort(rt.MinPort)
 	default:
 		return RuleDrop, 0
 	}
+
 	return RuleAccept, 0
 }
diff --git a/pkg/tcpip/iptables/types.go b/pkg/tcpip/iptables/types.go
index 9c2ad2d46..7d032fd23 100644
--- a/pkg/tcpip/iptables/types.go
+++ b/pkg/tcpip/iptables/types.go
@@ -163,6 +163,6 @@ type Matcher interface {
 type Target interface {
 	// Action takes an action on the packet and returns a verdict on how
 	// traversal should (or should not) continue. If the return value is
-	// Jump, it also returns the name of the chain to jump to.
+	// Jump, it also returns the index of the rule to jump to.
 	Action(packet tcpip.PacketBuffer) (RuleVerdict, int)
 }
-- 
cgit v1.2.3


From 1e8c0bcedb265d3149e5d2ab1181628d013539c4 Mon Sep 17 00:00:00 2001
From: Nayana Bidari <nybidari@google.com>
Date: Fri, 6 Mar 2020 09:25:32 -0800
Subject: Add nat table support for iptables.

---
 pkg/tcpip/iptables/targets.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'pkg/tcpip')

diff --git a/pkg/tcpip/iptables/targets.go b/pkg/tcpip/iptables/targets.go
index ae5af7c53..e457f2349 100644
--- a/pkg/tcpip/iptables/targets.go
+++ b/pkg/tcpip/iptables/targets.go
@@ -69,7 +69,7 @@ func (ReturnTarget) Action(tcpip.PacketBuffer) (RuleVerdict, int) {
 // Min and Max values for IP and Ports in the struct indicate the range of
 // values which can be used to redirect.
 type RedirectTarget struct {
-	// TODO(gvisor.dev/issue/170): Other flags need to be aded after
+	// TODO(gvisor.dev/issue/170): Other flags need to be added after
 	// we support them.
 	// RangeProtoSpecified flag indicates single port is specified to
 	// redirect.
@@ -98,7 +98,7 @@ func (rt RedirectTarget) Action(pkt tcpip.PacketBuffer) (RuleVerdict, int) {
 	// Set network header.
 	headerView := newPkt.Data.First()
 	netHeader := header.IPv4(headerView)
-	newPkt.NetworkHeader = headerView[:netHeader.HeaderLength()]
+	newPkt.NetworkHeader = headerView[:header.IPv4MinimumSize]
 
 	hlen := int(netHeader.HeaderLength())
 	tlen := int(netHeader.TotalLength())
-- 
cgit v1.2.3