From ce727c3fc57baf56a28156eec7a75d3b02184541 Mon Sep 17 00:00:00 2001 From: Kevin Krakauer Date: Tue, 5 Nov 2024 14:58:15 -0800 Subject: [PATCH] netstack: add log for martian packet dropping Martian packets are dropped by default, but some setups require accepting them. A rate limited log will help users quickly hone in on the issue, which is otherwise unclear and time-consuming to debug. PiperOrigin-RevId: 693487838 --- pkg/tcpip/network/ipv4/BUILD | 1 + pkg/tcpip/network/ipv4/ipv4.go | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/pkg/tcpip/network/ipv4/BUILD b/pkg/tcpip/network/ipv4/BUILD index 8df4a99fa..573bdd37e 100644 --- a/pkg/tcpip/network/ipv4/BUILD +++ b/pkg/tcpip/network/ipv4/BUILD @@ -17,6 +17,7 @@ go_library( deps = [ "//pkg/atomicbitops", "//pkg/buffer", + "//pkg/log", "//pkg/sync", "//pkg/tcpip", "//pkg/tcpip/checksum", diff --git a/pkg/tcpip/network/ipv4/ipv4.go b/pkg/tcpip/network/ipv4/ipv4.go index 9e9067f38..875895644 100644 --- a/pkg/tcpip/network/ipv4/ipv4.go +++ b/pkg/tcpip/network/ipv4/ipv4.go @@ -23,6 +23,7 @@ import ( "gvisor.dev/gvisor/pkg/atomicbitops" "gvisor.dev/gvisor/pkg/buffer" + "gvisor.dev/gvisor/pkg/log" "gvisor.dev/gvisor/pkg/sync" "gvisor.dev/gvisor/pkg/tcpip" "gvisor.dev/gvisor/pkg/tcpip/header" @@ -69,6 +70,8 @@ const ( forwardingEnabled = 1 ) +var martianPacketLogger = log.BasicRateLimitedLogger(time.Minute) + var ipv4BroadcastAddr = header.IPv4Broadcast.WithPrefix() var _ stack.LinkResolvableNetworkEndpoint = (*endpoint)(nil) @@ -839,11 +842,13 @@ func (e *endpoint) HandlePacket(pkt *stack.PacketBuffer) { if !e.nic.IsLoopback() { if !e.protocol.options.AllowExternalLoopbackTraffic { if header.IsV4LoopbackAddress(h.SourceAddress()) { + martianPacketLogger.Infof("Martian packet dropped with loopback source address. If your traffic is unexpectedly dropped, you may want to allow martian packets.") stats.InvalidSourceAddressesReceived.Increment() return } if header.IsV4LoopbackAddress(h.DestinationAddress()) { + martianPacketLogger.Infof("Martian packet dropped with loopback destination address. If your traffic is unexpectedly dropped, you may want to allow martian packets.") stats.InvalidDestinationAddressesReceived.Increment() return }