netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix check for IPPROTO_ICMP, since SocketType.proto it is not a bitmask.

Browse Source 
And add a comment above the socket type check, since that *is* a bitmask.

This uncovered a bug in the hostnet handling of IP_MULTICAST_IF socket option.
The kernel allows different-sized structures to be passed, but we were only
forwarding the first 4 bytes.

PiperOrigin-RevId: 628115391
This commit is contained in:
Nicolas Lacasse
2024-04-25 10:25:05 -07:00
committed by gVisor bot
parent 9da17a8fdd
commit dc5eed4f67
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/socket/hostinet/sockopt.go
+1 -1
View File
@@ -60,7 +60,7 @@ var SockOpts = []SockOpt{
{linux.SOL_IP, linux.IP_ADD_MEMBERSHIP, 0, false, true},
{linux.SOL_IP, linux.IP_DROP_MEMBERSHIP, 0, false, true},
{linux.SOL_IP, linux.IP_HDRINCL, sizeofInt32, true, true},
{linux.SOL_IP, linux.IP_MULTICAST_IF, uint64(linux.SizeOfInetAddr), true, true},
{linux.SOL_IP, linux.IP_MULTICAST_IF, 0 /* kernel allows multiple structures to be passed */, true, true},
{linux.SOL_IP, linux.IP_MULTICAST_LOOP, 0 /* can be 32-bit int or 8-bit uint */, true, true},
{linux.SOL_IP, linux.IP_MULTICAST_TTL, 0 /* can be 32-bit int or 8-bit uint */, true, true},
{linux.SOL_IP, linux.IP_PKTINFO, sizeofInt32, true, true},
test/syscalls/linux/socket_ipv4_datagram_based_socket_unbound.cc
+3 -1
View File
@@ -22,11 +22,13 @@ namespace gvisor {
namespace testing {
void IPv4DatagramBasedUnboundSocketTest::SetUp() {
// Require raw socket capability to create a raw socket. Note that
// SocketKind.type is a bitmask.
if (GetParam().type & SOCK_RAW) {
SKIP_IF(!ASSERT_NO_ERRNO_AND_VALUE(HaveRawIPSocketCapability()));
}
if (GetParam().protocol & IPPROTO_ICMP) {
if (GetParam().protocol == IPPROTO_ICMP) {
// By default, ICMP sockets cannot be created on Linux, even with root
// privs. So we only run the test with gVisor and not hostinet, and even
// then require CAP_NET_RAW.