From 36dbd3b97dbc455c6d710f4530ec8a07474dee64 Mon Sep 17 00:00:00 2001
From: Kevin Krakauer <krakauer@google.com>
Date: Wed, 14 Apr 2021 10:23:58 -0700
Subject: Automatically enforce limited netstack dependencies

Netstack is supposed to be somewhat independent of the rest of gVisor, and
others should be able to use it without pulling in excessive dependencies.
Currently, there is no way to fight dependency creep besides careful code
review.

This change introduces a test rule `netstack_deps_check` that ensures the target
only relies on gVisor targets and a short allowlist of external dependencies.
Users who add a dependency will see an error and have to manually update the
allowlist.

The set of packages to test comes from //runsc, as it uses packages we would
expect users to commonly rely on. It was generated via:
$ find ./runsc -name BUILD | xargs grep tcpip | awk '{print $2}' | sort | uniq

(Note: We considered giving //pkg/tcpip it's own go.mod, but this breaks go
tooling.)

PiperOrigin-RevId: 368456711
---
 pkg/tcpip/BUILD | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

(limited to 'pkg/tcpip')

diff --git a/pkg/tcpip/BUILD b/pkg/tcpip/BUILD
index f979d22f0..aa30cfc85 100644
--- a/pkg/tcpip/BUILD
+++ b/pkg/tcpip/BUILD
@@ -1,4 +1,5 @@
 load("//tools:defs.bzl", "go_library", "go_test")
+load("//tools:deps.bzl", "deps_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
 package(licenses = ["notice"])
@@ -33,6 +34,36 @@ go_library(
     ],
 )
 
+deps_test(
+    name = "netstack_deps_test",
+    allowed = [
+        "@com_github_google_btree//:go_default_library",
+        "@org_golang_x_sys//unix:go_default_library",
+        "@org_golang_x_time//rate:go_default_library",
+    ],
+    allowed_prefixes = [
+        "//",
+        "@org_golang_x_sys//internal/unsafeheader",
+    ],
+    targets = [
+        "//pkg/tcpip",
+        "//pkg/tcpip/header",
+        "//pkg/tcpip/link/fdbased",
+        "//pkg/tcpip/link/loopback",
+        "//pkg/tcpip/link/packetsocket",
+        "//pkg/tcpip/link/qdisc/fifo",
+        "//pkg/tcpip/link/sniffer",
+        "//pkg/tcpip/network/arp",
+        "//pkg/tcpip/network/ipv4",
+        "//pkg/tcpip/network/ipv6",
+        "//pkg/tcpip/stack",
+        "//pkg/tcpip/transport/icmp",
+        "//pkg/tcpip/transport/raw",
+        "//pkg/tcpip/transport/tcp",
+        "//pkg/tcpip/transport/udp",
+    ],
+)
+
 go_test(
     name = "tcpip_test",
     size = "small",
-- 
cgit v1.2.3