netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Support receiving broadcast IPv4 packets

Browse Source 
Test: integration_test.TestIncomingSubnetBroadcast
PiperOrigin-RevId: 325135617
This commit is contained in:
Ghanan Gowripalan
2020-08-05 17:32:54 -07:00
committed by gVisor bot
parent 1403a88c67
commit 90a2d4e823
4 changed files with 324 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/tcpip/stack/nic.go
+48
View File
@@ -609,6 +609,9 @@ func (n *NIC) findEndpoint(protocol tcpip.NetworkProtocolNumber, address tcpip.A
// If none exists a temporary one may be created if we are in promiscuous mode
// or spoofing. Promiscuous mode will only be checked if promiscuous is true.
// Similarly, spoofing will only be checked if spoofing is true.
//
// If the address is the IPv4 broadcast address for an endpoint's network, that
// endpoint will be returned.
func (n *NIC) getRefOrCreateTemp(protocol tcpip.NetworkProtocolNumber, address tcpip.Address, peb PrimaryEndpointBehavior, tempRef getRefBehaviour) *referencedNetworkEndpoint {
n.mu.RLock()
@@ -633,6 +636,16 @@ func (n *NIC) getRefOrCreateTemp(protocol tcpip.NetworkProtocolNumber, address t
}
}
// Check if address is a broadcast address for the endpoint's network.
//
// Only IPv4 has a notion of broadcast addresses.
if protocol == header.IPv4ProtocolNumber {
if ref := n.getRefForBroadcastRLocked(address); ref != nil {
n.mu.RUnlock()
return ref
}
}
// A usable reference was not found, create a temporary one if requested by
// the caller or if the address is found in the NIC's subnets.
createTempEP := spoofingOrPromiscuous
@@ -670,8 +683,34 @@ func (n *NIC) getRefOrCreateTemp(protocol tcpip.NetworkProtocolNumber, address t
return ref
}
// getRefForBroadcastLocked returns an endpoint where address is the IPv4
// broadcast address for the endpoint's network.
//
// n.mu MUST be read locked.
func (n *NIC) getRefForBroadcastRLocked(address tcpip.Address) *referencedNetworkEndpoint {
for _, ref := range n.mu.endpoints {
// Only IPv4 has a notion of broadcast addresses.
if ref.protocol != header.IPv4ProtocolNumber {
continue
}
addr := ref.addrWithPrefix()
subnet := addr.Subnet()
if subnet.IsBroadcast(address) && ref.tryIncRef() {
return ref
}
}
return nil
}
/// getRefOrCreateTempLocked returns an existing endpoint for address or creates
/// and returns a temporary endpoint.
//
// If the address is the IPv4 broadcast address for an endpoint's network, that
// endpoint will be returned.
//
// n.mu must be write locked.
func (n *NIC) getRefOrCreateTempLocked(protocol tcpip.NetworkProtocolNumber, address tcpip.Address, peb PrimaryEndpointBehavior) *referencedNetworkEndpoint {
if ref, ok := n.mu.endpoints[NetworkEndpointID{address}]; ok {
// No need to check the type as we are ok with expired endpoints at this
@@ -685,6 +724,15 @@ func (n *NIC) getRefOrCreateTempLocked(protocol tcpip.NetworkProtocolNumber, add
n.removeEndpointLocked(ref)
}
// Check if address is a broadcast address for an endpoint's network.
//
// Only IPv4 has a notion of broadcast addresses.
if protocol == header.IPv4ProtocolNumber {
if ref := n.getRefForBroadcastRLocked(address); ref != nil {
return ref
}
}
// Add a new temporary endpoint.
netProto, ok := n.stack.networkProtocols[protocol]
if !ok {
pkg/tcpip/stack/stack_test.go
+1 -1
View File
@@ -1704,7 +1704,7 @@ func testNicForAddressRange(t *testing.T, nicID tcpip.NICID, s *stack.Stack, sub
// Trying the next address should always fail since it is outside the range.
if gotNicID := s.CheckLocalAddress(0, fakeNetNumber, tcpip.Address(addrBytes)); gotNicID != 0 {
t.Errorf("got CheckLocalAddress(0, %d, %s) = %d, want = %d", fakeNetNumber, tcpip.Address(addrBytes), gotNicID, 0)
t.Errorf("got CheckLocalAddress(0, %d, %s) = %d, want = 0", fakeNetNumber, tcpip.Address(addrBytes), gotNicID)
}
}
pkg/tcpip/tests/integration/BUILD
+21
View File
@@ -0,0 +1,21 @@
load("//tools:defs.bzl", "go_test")
package(licenses = ["notice"])
go_test(
name = "integration_test",
size = "small",
srcs = ["multicast_broadcast_test.go"],
deps = [
"//pkg/tcpip",
"//pkg/tcpip/buffer",
"//pkg/tcpip/header",
"//pkg/tcpip/link/channel",
"//pkg/tcpip/network/ipv4",
"//pkg/tcpip/network/ipv6",
"//pkg/tcpip/stack",
"//pkg/tcpip/transport/udp",
"//pkg/waiter",
"@com_github_google_go_cmp//cmp:go_default_library",
],
)
pkg/tcpip/tests/integration/multicast_broadcast_test.go
+254
View File
@@ -0,0 +1,254 @@
// Copyright 2020 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package integration_test
import (
"testing"
"github.com/google/go-cmp/cmp"
"gvisor.dev/gvisor/pkg/tcpip"
"gvisor.dev/gvisor/pkg/tcpip/buffer"
"gvisor.dev/gvisor/pkg/tcpip/header"
"gvisor.dev/gvisor/pkg/tcpip/link/channel"
"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
"gvisor.dev/gvisor/pkg/tcpip/stack"
"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
"gvisor.dev/gvisor/pkg/waiter"
)
const defaultMTU = 1280
func TestIncomingSubnetBroadcast(t *testing.T) {
const (
nicID = 1
remotePort = 5555
localPort = 80
ttl = 255
)
data := []byte{1, 2, 3, 4}
// Local IPv4 subnet: 192.168.1.58/24
ipv4Addr := tcpip.AddressWithPrefix{
Address: "\xc0\xa8\x01\x3a",
PrefixLen: 24,
}
ipv4Subnet := ipv4Addr.Subnet()
ipv4SubnetBcast := ipv4Subnet.Broadcast()
// Local IPv6 subnet: 200a::1/64
ipv6Addr := tcpip.AddressWithPrefix{
Address: "\x20\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01",
PrefixLen: 64,
}
ipv6Subnet := ipv6Addr.Subnet()
ipv6SubnetBcast := ipv6Subnet.Broadcast()
// Remote addrs.
remoteIPv4Addr := tcpip.Address("\x64\x0a\x7b\x18")
remoteIPv6Addr := tcpip.Address("\x20\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02")
rxIPv4UDP := func(e *channel.Endpoint, dst tcpip.Address) {
payloadLen := header.UDPMinimumSize + len(data)
totalLen := header.IPv4MinimumSize + payloadLen
hdr := buffer.NewPrependable(totalLen)
u := header.UDP(hdr.Prepend(payloadLen))
u.Encode(&header.UDPFields{
SrcPort: remotePort,
DstPort: localPort,
Length: uint16(payloadLen),
})
copy(u.Payload(), data)
sum := header.PseudoHeaderChecksum(udp.ProtocolNumber, remoteIPv4Addr, dst, uint16(payloadLen))
sum = header.Checksum(data, sum)
u.SetChecksum(^u.CalculateChecksum(sum))
ip := header.IPv4(hdr.Prepend(header.IPv4MinimumSize))
ip.Encode(&header.IPv4Fields{
IHL: header.IPv4MinimumSize,
TotalLength: uint16(totalLen),
Protocol: uint8(udp.ProtocolNumber),
TTL: ttl,
SrcAddr: remoteIPv4Addr,
DstAddr: dst,
})
e.InjectInbound(header.IPv4ProtocolNumber, &stack.PacketBuffer{
Data: hdr.View().ToVectorisedView(),
})
}
rxIPv6UDP := func(e *channel.Endpoint, dst tcpip.Address) {
payloadLen := header.UDPMinimumSize + len(data)
hdr := buffer.NewPrependable(header.IPv6MinimumSize + payloadLen)
u := header.UDP(hdr.Prepend(payloadLen))
u.Encode(&header.UDPFields{
SrcPort: remotePort,
DstPort: localPort,
Length: uint16(payloadLen),
})
copy(u.Payload(), data)
sum := header.PseudoHeaderChecksum(udp.ProtocolNumber, remoteIPv6Addr, dst, uint16(payloadLen))
sum = header.Checksum(data, sum)
u.SetChecksum(^u.CalculateChecksum(sum))
ip := header.IPv6(hdr.Prepend(header.IPv6MinimumSize))
ip.Encode(&header.IPv6Fields{
PayloadLength: uint16(payloadLen),
NextHeader: uint8(udp.ProtocolNumber),
HopLimit: ttl,
SrcAddr: remoteIPv6Addr,
DstAddr: dst,
})
e.InjectInbound(header.IPv6ProtocolNumber, &stack.PacketBuffer{
Data: hdr.View().ToVectorisedView(),
})
}
tests := []struct {
name string
bindAddr tcpip.Address
dstAddr tcpip.Address
expectRx bool
}{
{
name: "IPv4 unicast binding to unicast",
bindAddr: ipv4Addr.Address,
dstAddr: ipv4Addr.Address,
expectRx: true,
},
{
name: "IPv4 unicast binding to broadcast",
bindAddr: header.IPv4Broadcast,
dstAddr: ipv4Addr.Address,
expectRx: false,
},
{
name: "IPv4 unicast binding to wildcard",
dstAddr: ipv4Addr.Address,
expectRx: true,
},
{
name: "IPv4 directed broadcast binding to subnet broadcast",
bindAddr: ipv4SubnetBcast,
dstAddr: ipv4SubnetBcast,
expectRx: true,
},
{
name: "IPv4 directed broadcast binding to broadcast",
bindAddr: header.IPv4Broadcast,
dstAddr: ipv4SubnetBcast,
expectRx: false,
},
{
name: "IPv4 directed broadcast binding to wildcard",
dstAddr: ipv4SubnetBcast,
expectRx: true,
},
{
name: "IPv4 broadcast binding to broadcast",
bindAddr: header.IPv4Broadcast,
dstAddr: header.IPv4Broadcast,
expectRx: true,
},
{
name: "IPv4 broadcast binding to subnet broadcast",
bindAddr: ipv4SubnetBcast,
dstAddr: header.IPv4Broadcast,
expectRx: false,
},
{
name: "IPv4 broadcast binding to wildcard",
dstAddr: ipv4SubnetBcast,
expectRx: true,
},
// IPv6 has no notion of a broadcast.
{
name: "IPv6 unicast binding to wildcard",
dstAddr: ipv6Addr.Address,
expectRx: true,
},
{
name: "IPv6 broadcast-like address binding to wildcard",
dstAddr: ipv6SubnetBcast,
expectRx: false,
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
s := stack.New(stack.Options{
NetworkProtocols: []stack.NetworkProtocol{ipv4.NewProtocol(), ipv6.NewProtocol()},
TransportProtocols: []stack.TransportProtocol{udp.NewProtocol()},
})
e := channel.New(0, defaultMTU, "")
if err := s.CreateNIC(nicID, e); err != nil {
t.Fatalf("CreateNIC(%d, _): %s", nicID, err)
}
ipv4ProtoAddr := tcpip.ProtocolAddress{Protocol: header.IPv4ProtocolNumber, AddressWithPrefix: ipv4Addr}
if err := s.AddProtocolAddress(nicID, ipv4ProtoAddr); err != nil {
t.Fatalf("AddProtocolAddress(%d, %+v): %s", nicID, ipv4ProtoAddr, err)
}
ipv6ProtoAddr := tcpip.ProtocolAddress{Protocol: header.IPv6ProtocolNumber, AddressWithPrefix: ipv6Addr}
if err := s.AddProtocolAddress(nicID, ipv6ProtoAddr); err != nil {
t.Fatalf("AddProtocolAddress(%d, %+v): %s", nicID, ipv6ProtoAddr, err)
}
var netproto tcpip.NetworkProtocolNumber
var rxUDP func(*channel.Endpoint, tcpip.Address)
switch l := len(test.dstAddr); l {
case header.IPv4AddressSize:
netproto = header.IPv4ProtocolNumber
rxUDP = rxIPv4UDP
case header.IPv6AddressSize:
netproto = header.IPv6ProtocolNumber
rxUDP = rxIPv6UDP
default:
t.Fatalf("got unexpected address length = %d bytes", l)
}
wq := waiter.Queue{}
ep, err := s.NewEndpoint(udp.ProtocolNumber, netproto, &wq)
if err != nil {
t.Fatalf("NewEndpoint(%d, %d, _): %s", udp.ProtocolNumber, netproto, err)
}
defer ep.Close()
bindAddr := tcpip.FullAddress{Addr: test.bindAddr, Port: localPort}
if err := ep.Bind(bindAddr); err != nil {
t.Fatalf("ep.Bind(%+v): %s", bindAddr, err)
}
rxUDP(e, test.dstAddr)
if gotPayload, _, err := ep.Read(nil); test.expectRx {
if err != nil {
t.Fatalf("Read(nil): %s", err)
}
if diff := cmp.Diff(buffer.View(data), gotPayload); diff != "" {
t.Errorf("got UDP payload mismatch (-want +got):\n%s", diff)
}
} else {
if err != tcpip.ErrWouldBlock {
t.Fatalf("got Read(nil) = (%x, _, %v), want = (_, _, %s)", gotPayload, err, tcpip.ErrWouldBlock)
}
}
})
}
}