ITQC/containernetworking-plugins
24
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 34 Wiki Activity

bridge, spoofcheck: only read the prerouting chain on CNI delete

Browse Source 
Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>
This commit is contained in:
Miguel Duarte Barroso 2023-03-23 17:35:19 +01:00
parent 83fe87c5b0
commit 7dcd738d34
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/link/spoofcheck.go
View File

@ -29,7 +29,7 @@ const (
type NftConfigurer interface {
Apply(*nft.Config) error
Read() (*nft.Config, error)
Read(filterCommands ...string) (*nft.Config, error)
}
type SpoofChecker struct {
@ -45,8 +45,8 @@ func (dnc defaultNftConfigurer) Apply(cfg *nft.Config) error {
return nft.ApplyConfig(cfg)
}
func (dnc defaultNftConfigurer) Read() (*nft.Config, error) {
return nft.ReadConfig()
func (dnc defaultNftConfigurer) Read(filterCommands ...string) (*nft.Config, error) {
return nft.ReadConfig(filterCommands...)
}
func NewSpoofChecker(iface, macAddress, refID string) *SpoofChecker {
@ -109,7 +109,7 @@ func (sc *SpoofChecker) Setup() error {
// interface is removed.
func (sc *SpoofChecker) Teardown() error {
ifaceChain := sc.ifaceChain()
currentConfig, ifaceMatchRuleErr := sc.configurer.Read()
currentConfig, ifaceMatchRuleErr := sc.configurer.Read(listChainBridgeNatPrerouting()...)
if ifaceMatchRuleErr == nil {
expectedRuleToFind := sc.matchIfaceJumpToChainRule(preRoutingBaseChainName, ifaceChain.Name)
// It is safer to exclude the statement matching, avoiding cases where a current statement includes
@ -241,3 +241,7 @@ func ruleComment(id string) string {
const refIDPrefix = "macspoofchk-"
return refIDPrefix + id
}
func listChainBridgeNatPrerouting() []string {
return []string{"chain", "bridge", natTableName, preRoutingBaseChainName}
}

2
pkg/link/spoofcheck_test.go
View File

@ -288,7 +288,7 @@ func (a *configurerStub) Apply(c *nft.Config) error {
return nil
}
func (a *configurerStub) Read() (*nft.Config, error) {
func (a *configurerStub) Read(_ ...string) (*nft.Config, error) {
if a.failReadConfig {
return nil, fmt.Errorf(errorReadText)
}