netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Filter out received packets with a local source IP address.

Browse Source 
CERT Advisory CA-96.21 III. Solution advises that devices drop packets which
could not have correctly arrived on the wire, such as receiving a packet where
the source IP address is owned by the device that sent it.

Fixes #1507

PiperOrigin-RevId: 290378240
This commit is contained in:
Eyal Soha
2020-01-17 18:26:20 -08:00
committed by gVisor bot
parent f1a5178c58
commit 47d85257d3
5 changed files with 95 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/socket/netstack/netstack.go
+8 -7
View File
@@ -138,13 +138,14 @@ var Metrics = tcpip.Stats{
},
},
IP: tcpip.IPStats{
PacketsReceived: mustCreateMetric("/netstack/ip/packets_received", "Total number of IP packets received from the link layer in nic.DeliverNetworkPacket."),
InvalidAddressesReceived: mustCreateMetric("/netstack/ip/invalid_addresses_received", "Total number of IP packets received with an unknown or invalid destination address."),
PacketsDelivered: mustCreateMetric("/netstack/ip/packets_delivered", "Total number of incoming IP packets that are successfully delivered to the transport layer via HandlePacket."),
PacketsSent: mustCreateMetric("/netstack/ip/packets_sent", "Total number of IP packets sent via WritePacket."),
OutgoingPacketErrors: mustCreateMetric("/netstack/ip/outgoing_packet_errors", "Total number of IP packets which failed to write to a link-layer endpoint."),
MalformedPacketsReceived: mustCreateMetric("/netstack/ip/malformed_packets_received", "Total number of IP packets which failed IP header validation checks."),
MalformedFragmentsReceived: mustCreateMetric("/netstack/ip/malformed_fragments_received", "Total number of IP fragments which failed IP fragment validation checks."),
PacketsReceived: mustCreateMetric("/netstack/ip/packets_received", "Total number of IP packets received from the link layer in nic.DeliverNetworkPacket."),
InvalidDestinationAddressesReceived: mustCreateMetric("/netstack/ip/invalid_addresses_received", "Total number of IP packets received with an unknown or invalid destination address."),
InvalidSourceAddressesReceived: mustCreateMetric("/netstack/ip/invalid_source_addresses_received", "Total number of IP packets received with an unknown or invalid source address."),
PacketsDelivered: mustCreateMetric("/netstack/ip/packets_delivered", "Total number of incoming IP packets that are successfully delivered to the transport layer via HandlePacket."),
PacketsSent: mustCreateMetric("/netstack/ip/packets_sent", "Total number of IP packets sent via WritePacket."),
OutgoingPacketErrors: mustCreateMetric("/netstack/ip/outgoing_packet_errors", "Total number of IP packets which failed to write to a link-layer endpoint."),
MalformedPacketsReceived: mustCreateMetric("/netstack/ip/malformed_packets_received", "Total number of IP packets which failed IP header validation checks."),
MalformedFragmentsReceived: mustCreateMetric("/netstack/ip/malformed_fragments_received", "Total number of IP fragments which failed IP fragment validation checks."),
},
TCP: tcpip.TCPStats{
ActiveConnectionOpenings: mustCreateMetric("/netstack/tcp/active_connection_openings", "Number of connections opened successfully via Connect."),
pkg/sentry/socket/netstack/stack.go
+19 -19
View File
@@ -148,25 +148,25 @@ func (s *Stack) Statistics(stat interface{}, arg string) error {
case *inet.StatSNMPIP:
ip := Metrics.IP
*stats = inet.StatSNMPIP{
0, // TODO(gvisor.dev/issue/969): Support Ip/Forwarding.
0, // TODO(gvisor.dev/issue/969): Support Ip/DefaultTTL.
ip.PacketsReceived.Value(), // InReceives.
0, // TODO(gvisor.dev/issue/969): Support Ip/InHdrErrors.
ip.InvalidAddressesReceived.Value(), // InAddrErrors.
0, // TODO(gvisor.dev/issue/969): Support Ip/ForwDatagrams.
0, // TODO(gvisor.dev/issue/969): Support Ip/InUnknownProtos.
0, // TODO(gvisor.dev/issue/969): Support Ip/InDiscards.
ip.PacketsDelivered.Value(), // InDelivers.
ip.PacketsSent.Value(), // OutRequests.
ip.OutgoingPacketErrors.Value(), // OutDiscards.
0, // TODO(gvisor.dev/issue/969): Support Ip/OutNoRoutes.
0, // TODO(gvisor.dev/issue/969): Support Ip/ReasmTimeout.
0, // TODO(gvisor.dev/issue/969): Support Ip/ReasmReqds.
0, // TODO(gvisor.dev/issue/969): Support Ip/ReasmOKs.
0, // TODO(gvisor.dev/issue/969): Support Ip/ReasmFails.
0, // TODO(gvisor.dev/issue/969): Support Ip/FragOKs.
0, // TODO(gvisor.dev/issue/969): Support Ip/FragFails.
0, // TODO(gvisor.dev/issue/969): Support Ip/FragCreates.
0, // TODO(gvisor.dev/issue/969): Support Ip/Forwarding.
0, // TODO(gvisor.dev/issue/969): Support Ip/DefaultTTL.
ip.PacketsReceived.Value(), // InReceives.
0, // TODO(gvisor.dev/issue/969): Support Ip/InHdrErrors.
ip.InvalidDestinationAddressesReceived.Value(), // InAddrErrors.
0, // TODO(gvisor.dev/issue/969): Support Ip/ForwDatagrams.
0, // TODO(gvisor.dev/issue/969): Support Ip/InUnknownProtos.
0, // TODO(gvisor.dev/issue/969): Support Ip/InDiscards.
ip.PacketsDelivered.Value(), // InDelivers.
ip.PacketsSent.Value(), // OutRequests.
ip.OutgoingPacketErrors.Value(), // OutDiscards.
0, // TODO(gvisor.dev/issue/969): Support Ip/OutNoRoutes.
0, // TODO(gvisor.dev/issue/969): Support Ip/ReasmTimeout.
0, // TODO(gvisor.dev/issue/969): Support Ip/ReasmReqds.
0, // TODO(gvisor.dev/issue/969): Support Ip/ReasmOKs.
0, // TODO(gvisor.dev/issue/969): Support Ip/ReasmFails.
0, // TODO(gvisor.dev/issue/969): Support Ip/FragOKs.
0, // TODO(gvisor.dev/issue/969): Support Ip/FragFails.
0, // TODO(gvisor.dev/issue/969): Support Ip/FragCreates.
}
case *inet.StatSNMPICMP:
in := Metrics.ICMP.V4PacketsReceived.ICMPv4PacketStats