Merge pull request #49 from balena-io-experimental/kyle/nf-nat

Enable all nf tables features in the kernel
balena-io-experimental · Mar 12, 2024 · 45e25ea · 45e25ea
2 parents 45c361a + de02064
commit 45e25ea
Show file tree

Hide file tree

Showing 13 changed files with 6,765 additions and 87 deletions.
diff --git a/.gitignore b/.gitignore
@@ -1,2 +1,3 @@
 .env
 .balena
+vmlinux/out
diff --git a/Dockerfile b/Dockerfile
@@ -31,22 +31,32 @@ ARG KERNEL_BRANCH=5.10
 RUN git clone --depth 1 -c advice.detachedHead=false \
     --branch "v${KERNEL_BRANCH}" https://github.com/torvalds/linux.git .
 
-COPY vmlinux/*.patch ./
+COPY vmlinux/${KERNEL_BRANCH}/*.patch ./
 
 RUN git apply -v ./*.patch
 
 ###############################################
 
-FROM linux.git AS vmlinux
+FROM linux.git AS vmconfig-arm64
+ARG KERNEL_BRANCH=5.10
+COPY vmlinux/${KERNEL_BRANCH}/microvm-kernel-arm64-${KERNEL_BRANCH}.config ./.config
+FROM vmconfig-arm64 AS vmlinux-arm64
+RUN make Image && lz4 -9 ./arch/arm64/boot/Image ./vmlinux.bin.lz4
+
+###############################################
+FROM linux.git AS vmconfig-amd64
+ARG KERNEL_BRANCH=5.10
+COPY vmlinux/${KERNEL_BRANCH}/microvm-kernel-x86_64-${KERNEL_BRANCH}.config ./.config
+FROM vmconfig-amd64 AS vmlinux-amd64
+RUN make vmlinux && lz4 -9 ./vmlinux ./vmlinux.bin.lz4
 
-COPY vmlinux/*.config ./
+###############################################
+
+# hadolint ignore=DL3006
+FROM vmconfig-${TARGETARCH} AS vmconfig
 
-RUN if [ "$(uname -m)" = "aarch64" ] ; \
-    then ln -sf "microvm-kernel-arm64-5.10.config" .config && make Image && \
-    lz4 -9 ./arch/arm64/boot/Image ./vmlinux.bin.lz4 ; \
-    else ln -sf "microvm-kernel-x86_64-5.10.config" .config && make vmlinux &&\
-    lz4 -9 ./vmlinux ./vmlinux.bin.lz4 ; \
-    fi
+# hadolint ignore=DL3006
+FROM vmlinux-${TARGETARCH} AS vmlinux
 
 ###############################################
 

diff --git a/docker-compose.test.yml b/docker-compose.test.yml
@@ -54,7 +54,6 @@ services:
       file: docker-compose.yml
       service: jailer
     build:
-      context: .
       args:
         TEST_IMAGE: alpine:3.18
       cache_from:
@@ -66,7 +65,6 @@ services:
       file: docker-compose.yml
       service: jailer
     build:
-      context: .
       args:
         TEST_IMAGE: debian:bookworm-slim
       cache_from:
@@ -78,7 +76,6 @@ services:
       file: docker-compose.yml
       service: jailer
     build:
-      context: .
       args:
         TEST_IMAGE: ubuntu:jammy
       cache_from:

diff --git a/test/healthcheck.sh b/test/healthcheck.sh
@@ -80,6 +80,9 @@ case $(id -u) in
     if command -v iptables-nft >/dev/null 2>&1; then
         iptables-nft -V
         iptables-nft -L
+        iptables-nft -N DOCKER-ISOLATION-STAGE-1
+        iptables-nft -L
+        iptables-nft -I DOCKER-ISOLATION-STAGE-1 -j RETURN
     fi
     ;;
 *) ;;

diff --git a/...p-add-compat_uts_machine-kernel-com.patch → ...p-add-compat_uts_machine-kernel-com.patch b/...p-add-compat_uts_machine-kernel-com.patch → ...p-add-compat_uts_machine-kernel-com.patch
diff --git a/...E26-personality-to-return-armv6l-in.patch → ...E26-personality-to-return-armv6l-in.patch b/...E26-personality-to-return-armv6l-in.patch → ...E26-personality-to-return-armv6l-in.patch
diff --git a/vmlinux/microvm-kernel-arm64-5.10.config → ...nux/5.10/microvm-kernel-arm64-5.10.config b/vmlinux/microvm-kernel-arm64-5.10.config → ...nux/5.10/microvm-kernel-arm64-5.10.config
@@ -960,13 +960,15 @@ CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_INGRESS=y
 CONFIG_NETFILTER_NETLINK=y
 CONFIG_NETFILTER_FAMILY_BRIDGE=y
+CONFIG_NETFILTER_FAMILY_ARP=y
 # CONFIG_NETFILTER_NETLINK_ACCT is not set
 # CONFIG_NETFILTER_NETLINK_QUEUE is not set
 # CONFIG_NETFILTER_NETLINK_LOG is not set
-# CONFIG_NETFILTER_NETLINK_OSF is not set
+CONFIG_NETFILTER_NETLINK_OSF=y
 CONFIG_NF_CONNTRACK=y
 CONFIG_NF_LOG_COMMON=y
 # CONFIG_NF_LOG_NETDEV is not set
+CONFIG_NETFILTER_CONNCOUNT=y
 CONFIG_NF_CONNTRACK_MARK=y
 CONFIG_NF_CONNTRACK_SECMARK=y
 # CONFIG_NF_CONNTRACK_ZONES is not set
@@ -995,28 +997,35 @@ CONFIG_NF_NAT_REDIRECT=y
 CONFIG_NF_NAT_MASQUERADE=y
 CONFIG_NETFILTER_SYNPROXY=y
 CONFIG_NF_TABLES=y
-# CONFIG_NF_TABLES_INET is not set
-# CONFIG_NF_TABLES_NETDEV is not set
-# CONFIG_NFT_NUMGEN is not set
-# CONFIG_NFT_CT is not set
-# CONFIG_NFT_COUNTER is not set
-# CONFIG_NFT_CONNLIMIT is not set
-# CONFIG_NFT_LOG is not set
-# CONFIG_NFT_LIMIT is not set
-# CONFIG_NFT_MASQ is not set
-# CONFIG_NFT_REDIR is not set
-# CONFIG_NFT_TUNNEL is not set
-# CONFIG_NFT_OBJREF is not set
-# CONFIG_NFT_QUOTA is not set
-# CONFIG_NFT_REJECT is not set
-# CONFIG_NFT_COMPAT is not set
-# CONFIG_NFT_HASH is not set
-# CONFIG_NFT_XFRM is not set
-# CONFIG_NFT_SOCKET is not set
-# CONFIG_NFT_OSF is not set
-# CONFIG_NFT_TPROXY is not set
-# CONFIG_NFT_SYNPROXY is not set
-# CONFIG_NF_FLOW_TABLE is not set
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
+CONFIG_NFT_CT=y
+CONFIG_NFT_FLOW_OFFLOAD=y
+CONFIG_NFT_COUNTER=y
+CONFIG_NFT_CONNLIMIT=y
+CONFIG_NFT_LOG=y
+CONFIG_NFT_LIMIT=y
+CONFIG_NFT_MASQ=y
+CONFIG_NFT_REDIR=y
+CONFIG_NFT_NAT=y
+CONFIG_NFT_TUNNEL=y
+CONFIG_NFT_OBJREF=y
+CONFIG_NFT_QUOTA=y
+CONFIG_NFT_REJECT=y
+CONFIG_NFT_REJECT_INET=y
+CONFIG_NFT_COMPAT=y
+CONFIG_NFT_HASH=y
+CONFIG_NFT_XFRM=y
+CONFIG_NFT_SOCKET=y
+CONFIG_NFT_OSF=y
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
+CONFIG_NF_DUP_NETDEV=y
+CONFIG_NFT_DUP_NETDEV=y
+CONFIG_NFT_FWD_NETDEV=y
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
 CONFIG_NETFILTER_XTABLES=y
 
 #
@@ -1109,10 +1118,14 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
 # IP: Netfilter Configuration
 #
 CONFIG_NF_DEFRAG_IPV4=y
-# CONFIG_NF_SOCKET_IPV4 is not set
-# CONFIG_NF_TPROXY_IPV4 is not set
-# CONFIG_NF_TABLES_IPV4 is not set
-# CONFIG_NF_TABLES_ARP is not set
+CONFIG_NF_SOCKET_IPV4=y
+CONFIG_NF_TPROXY_IPV4=y
+CONFIG_NF_TABLES_IPV4=y
+CONFIG_NFT_REJECT_IPV4=y
+# CONFIG_NFT_DUP_IPV4 is not set
+# CONFIG_NFT_FIB_IPV4 is not set
+CONFIG_NF_TABLES_ARP=y
+# CONFIG_NF_FLOW_TABLE_IPV4 is not set
 # CONFIG_NF_DUP_IPV4 is not set
 CONFIG_NF_LOG_ARP=y
 CONFIG_NF_LOG_IPV4=y
@@ -1141,17 +1154,24 @@ CONFIG_IP_NF_MANGLE=y
 #
 # IPv6: Netfilter Configuration
 #
-# CONFIG_NF_SOCKET_IPV6 is not set
-# CONFIG_NF_TPROXY_IPV6 is not set
-# CONFIG_NF_TABLES_IPV6 is not set
+CONFIG_NF_SOCKET_IPV6=y
+CONFIG_NF_TPROXY_IPV6=y
+CONFIG_NF_TABLES_IPV6=y
+CONFIG_NFT_REJECT_IPV6=y
+# CONFIG_NFT_DUP_IPV6 is not set
+# CONFIG_NFT_FIB_IPV6 is not set
+# CONFIG_NF_FLOW_TABLE_IPV6 is not set
 # CONFIG_NF_DUP_IPV6 is not set
-# CONFIG_NF_REJECT_IPV6 is not set
+CONFIG_NF_REJECT_IPV6=y
 # CONFIG_NF_LOG_IPV6 is not set
 # CONFIG_IP6_NF_IPTABLES is not set
 # end of IPv6: Netfilter Configuration
 
 CONFIG_NF_DEFRAG_IPV6=y
-# CONFIG_NF_TABLES_BRIDGE is not set
+CONFIG_NF_TABLES_BRIDGE=y
+# CONFIG_NFT_BRIDGE_META is not set
+# CONFIG_NFT_BRIDGE_REJECT is not set
+# CONFIG_NF_LOG_BRIDGE is not set
 # CONFIG_NF_CONNTRACK_BRIDGE is not set
 # CONFIG_BRIDGE_NF_EBTABLES is not set
 # CONFIG_BPFILTER is not set
@@ -1257,6 +1277,7 @@ CONFIG_NET_CLS_ACT=y
 # CONFIG_NET_ACT_SKBMOD is not set
 # CONFIG_NET_ACT_IFE is not set
 # CONFIG_NET_ACT_TUNNEL_KEY is not set
+# CONFIG_NET_ACT_CT is not set
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_TC_SKB_EXT is not set
 CONFIG_NET_SCH_FIFO=y

diff --git a/vmlinux/microvm-kernel-x86_64-5.10.config → ...ux/5.10/microvm-kernel-x86_64-5.10.config b/vmlinux/microvm-kernel-x86_64-5.10.config → ...ux/5.10/microvm-kernel-x86_64-5.10.config
@@ -990,10 +990,11 @@ CONFIG_NETFILTER_FAMILY_BRIDGE=y
 # CONFIG_NETFILTER_NETLINK_ACCT is not set
 # CONFIG_NETFILTER_NETLINK_QUEUE is not set
 # CONFIG_NETFILTER_NETLINK_LOG is not set
-# CONFIG_NETFILTER_NETLINK_OSF is not set
+CONFIG_NETFILTER_NETLINK_OSF=y
 CONFIG_NF_CONNTRACK=y
 CONFIG_NF_LOG_COMMON=y
 # CONFIG_NF_LOG_NETDEV is not set
+CONFIG_NETFILTER_CONNCOUNT=y
 CONFIG_NF_CONNTRACK_MARK=y
 CONFIG_NF_CONNTRACK_SECMARK=y
 # CONFIG_NF_CONNTRACK_ZONES is not set
@@ -1022,28 +1023,35 @@ CONFIG_NF_NAT_REDIRECT=y
 CONFIG_NF_NAT_MASQUERADE=y
 CONFIG_NETFILTER_SYNPROXY=y
 CONFIG_NF_TABLES=y
-# CONFIG_NF_TABLES_INET is not set
-# CONFIG_NF_TABLES_NETDEV is not set
-# CONFIG_NFT_NUMGEN is not set
-# CONFIG_NFT_CT is not set
-# CONFIG_NFT_COUNTER is not set
-# CONFIG_NFT_CONNLIMIT is not set
-# CONFIG_NFT_LOG is not set
-# CONFIG_NFT_LIMIT is not set
-# CONFIG_NFT_MASQ is not set
-# CONFIG_NFT_REDIR is not set
-# CONFIG_NFT_TUNNEL is not set
-# CONFIG_NFT_OBJREF is not set
-# CONFIG_NFT_QUOTA is not set
-# CONFIG_NFT_REJECT is not set
-# CONFIG_NFT_COMPAT is not set
-# CONFIG_NFT_HASH is not set
-# CONFIG_NFT_XFRM is not set
-# CONFIG_NFT_SOCKET is not set
-# CONFIG_NFT_OSF is not set
-# CONFIG_NFT_TPROXY is not set
-# CONFIG_NFT_SYNPROXY is not set
-# CONFIG_NF_FLOW_TABLE is not set
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=y
+CONFIG_NFT_CT=y
+# CONFIG_NFT_FLOW_OFFLOAD is not set
+CONFIG_NFT_COUNTER=y
+CONFIG_NFT_CONNLIMIT=y
+CONFIG_NFT_LOG=y
+CONFIG_NFT_LIMIT=y
+CONFIG_NFT_MASQ=y
+CONFIG_NFT_REDIR=y
+CONFIG_NFT_NAT=y
+CONFIG_NFT_TUNNEL=y
+CONFIG_NFT_OBJREF=y
+CONFIG_NFT_QUOTA=y
+CONFIG_NFT_REJECT=y
+CONFIG_NFT_REJECT_INET=y
+CONFIG_NFT_COMPAT=y
+CONFIG_NFT_HASH=y
+CONFIG_NFT_XFRM=y
+CONFIG_NFT_SOCKET=y
+CONFIG_NFT_OSF=y
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_SYNPROXY=y
+CONFIG_NF_DUP_NETDEV=y
+CONFIG_NFT_DUP_NETDEV=y
+CONFIG_NFT_FWD_NETDEV=y
+# CONFIG_NF_FLOW_TABLE_INET is not set
+CONFIG_NF_FLOW_TABLE=y
 CONFIG_NETFILTER_XTABLES=y
 
 #
@@ -1136,10 +1144,14 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
 # IP: Netfilter Configuration
 #
 CONFIG_NF_DEFRAG_IPV4=y
-# CONFIG_NF_SOCKET_IPV4 is not set
-# CONFIG_NF_TPROXY_IPV4 is not set
-# CONFIG_NF_TABLES_IPV4 is not set
+CONFIG_NF_SOCKET_IPV4=y
+CONFIG_NF_TPROXY_IPV4=y
+CONFIG_NF_TABLES_IPV4=y
+CONFIG_NFT_REJECT_IPV4=y
+# CONFIG_NFT_DUP_IPV4 is not set
+# CONFIG_NFT_FIB_IPV4 is not set
 # CONFIG_NF_TABLES_ARP is not set
+# CONFIG_NF_FLOW_TABLE_IPV4 is not set
 # CONFIG_NF_DUP_IPV4 is not set
 CONFIG_NF_LOG_ARP=y
 CONFIG_NF_LOG_IPV4=y
@@ -1168,11 +1180,15 @@ CONFIG_IP_NF_MANGLE=y
 #
 # IPv6: Netfilter Configuration
 #
-# CONFIG_NF_SOCKET_IPV6 is not set
-# CONFIG_NF_TPROXY_IPV6 is not set
-# CONFIG_NF_TABLES_IPV6 is not set
+CONFIG_NF_SOCKET_IPV6=y
+CONFIG_NF_TPROXY_IPV6=y
+CONFIG_NF_TABLES_IPV6=y
+CONFIG_NFT_REJECT_IPV6=y
+# CONFIG_NFT_DUP_IPV6 is not set
+# CONFIG_NFT_FIB_IPV6 is not set
+# CONFIG_NF_FLOW_TABLE_IPV6 is not set
 # CONFIG_NF_DUP_IPV6 is not set
-# CONFIG_NF_REJECT_IPV6 is not set
+CONFIG_NF_REJECT_IPV6=y
 # CONFIG_NF_LOG_IPV6 is not set
 # CONFIG_IP6_NF_IPTABLES is not set
 # end of IPv6: Netfilter Configuration
@@ -1284,6 +1300,7 @@ CONFIG_NET_CLS_ACT=y
 # CONFIG_NET_ACT_SKBMOD is not set
 # CONFIG_NET_ACT_IFE is not set
 # CONFIG_NET_ACT_TUNNEL_KEY is not set
+# CONFIG_NET_ACT_CT is not set
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_TC_SKB_EXT is not set
 CONFIG_NET_SCH_FIFO=y

diff --git a/vmlinux/6.1/0001-UBUNTU-SAUCE-no-up-add-compat_uts_machine-kernel-com.patch b/vmlinux/6.1/0001-UBUNTU-SAUCE-no-up-add-compat_uts_machine-kernel-com.patch
@@ -0,0 +1,42 @@
+From: Andy Whitcroft <[email protected]>
+Date: Fri, 27 Nov 2015 17:38:30 +0000
+Subject: [PATCH] UBUNTU: SAUCE: (no-up) add compat_uts_machine= kernel command
+ line override
+
+We wish to use the arm64 buildds to build armhf binaries in 32bit chroots.
+To make this work we need uname to return armv7l machine type.  To achieve
+this add a kernel command line override for the 32bit machine type.
+Add compat_uts_machine=<type> to allow the LINUX32 personality to return
+that type for uname.
+
+Signed-off-by: Andy Whitcroft <[email protected]>
+---
+ kernel/sys.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/kernel/sys.c b/kernel/sys.c
+index 83ffd7dccf23..5b030fbaf199 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1138,6 +1138,21 @@ SYSCALL_DEFINE0(setsid)
+
+ DECLARE_RWSEM(uts_sem);
+
++#ifdef COMPAT_UTS_MACHINE
++static char compat_uts_machine[__OLD_UTS_LEN+1] = COMPAT_UTS_MACHINE;
++
++static int __init parse_compat_uts_machine(char *arg)
++{
++	strncpy(compat_uts_machine, arg, __OLD_UTS_LEN);
++	compat_uts_machine[__OLD_UTS_LEN] = 0;
++	return 0;
++}
++early_param("compat_uts_machine", parse_compat_uts_machine);
++
++#undef COMPAT_UTS_MACHINE
++#define COMPAT_UTS_MACHINE compat_uts_machine
++#endif
++
+ #ifdef COMPAT_UTS_MACHINE
+ #define override_architecture(name) \
+ 	(personality(current->personality) == PER_LINUX32 && \