mirror of https://github.com/tailscale/tailscale/
tstest/natlab: add a configurable SNAT44 translator.
This lets us implement the most common kinds of NAT in the wild. Signed-off-by: David Anderson <danderson@tailscale.com>reviewable/pr556/r1
David Anderson
4 years ago
committed by
Dave Anderson
parent
2f15894a10
commit
23123907c0
@ -0,0 +1,244 @@
|
||||
// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package natlab
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"inet.af/netaddr"
|
||||
)
|
||||
|
||||
// mapping is the state of an allocated NAT session.
|
||||
type mapping struct {
|
||||
lanSrc netaddr.IPPort
|
||||
lanDst netaddr.IPPort
|
||||
wanSrc netaddr.IPPort
|
||||
deadline time.Time
|
||||
|
||||
// pc is a PacketConn that reserves an outbound port on the NAT's
|
||||
// WAN interface. We do this because ListenPacket already has
|
||||
// random port selection logic built in. Additionally this means
|
||||
// that concurrent use of ListenPacket for connections originating
|
||||
// from the NAT box won't conflict with NAT mappings, since both
|
||||
// use PacketConn to reserve ports on the machine.
|
||||
pc net.PacketConn
|
||||
}
|
||||
|
||||
// NATType is the mapping behavior of a NAT device. Values express
|
||||
// different modes defined by RFC 4787.
|
||||
type NATType int
|
||||
|
||||
const (
|
||||
// EndpointIndependentNAT specifies a destination endpoint
|
||||
// independent NAT. All traffic from a source ip:port gets mapped
|
||||
// to a single WAN ip:port.
|
||||
EndpointIndependentNAT NATType = iota
|
||||
// AddressDependentNAT specifies a destination address dependent
|
||||
// NAT. Every distinct destination IP gets its own WAN ip:port
|
||||
// allocation.
|
||||
AddressDependentNAT
|
||||
// AddressAndPortDependentNAT specifies a destination
|
||||
// address-and-port dependent NAT. Every distinct destination
|
||||
// ip:port gets its own WAN ip:port allocation.
|
||||
AddressAndPortDependentNAT
|
||||
)
|
||||
|
||||
// natKey is the lookup key for a NAT session. While it contains a
|
||||
// 4-tuple ({src,dst} {ip,port}), some NATTypes will zero out some
|
||||
// fields, so in practice the key is either a 2-tuple (src only),
|
||||
// 3-tuple (src ip+port and dst ip) or 4-tuple (src+dst ip+port).
|
||||
type natKey struct {
|
||||
src, dst netaddr.IPPort
|
||||
}
|
||||
|
||||
func (t NATType) key(src, dst netaddr.IPPort) natKey {
|
||||
k := natKey{src: src}
|
||||
switch t {
|
||||
case EndpointIndependentNAT:
|
||||
case AddressDependentNAT:
|
||||
k.dst.IP = dst.IP
|
||||
case AddressAndPortDependentNAT:
|
||||
k.dst = dst
|
||||
default:
|
||||
panic(fmt.Sprintf("unknown NAT type %v", t))
|
||||
}
|
||||
return k
|
||||
}
|
||||
|
||||
// DefaultMappingTimeout is the default timeout for a NAT mapping.
|
||||
const DefaultMappingTimeout = 30 * time.Second
|
||||
|
||||
// SNAT44 implements an IPv4-to-IPv4 source NAT (SNAT) translator, with
|
||||
// optional builtin firewall.
|
||||
type SNAT44 struct {
|
||||
// Machine is the machine to which this NAT is attached. Altered
|
||||
// packets are injected back into this Machine for processing.
|
||||
Machine *Machine
|
||||
// ExternalInterface is the "WAN" interface of Machine. Packets
|
||||
// from other sources get NATed onto this interface.
|
||||
ExternalInterface *Interface
|
||||
// Type specifies the mapping allocation behavior for this NAT.
|
||||
Type NATType
|
||||
// MappingTimeout is the lifetime of individual NAT sessions. Once
|
||||
// a session expires, the mapped port effectively "closes" to new
|
||||
// traffic. If MappingTimeout is 0, DefaultMappingTimeout is used.
|
||||
MappingTimeout time.Duration
|
||||
// Firewall is an optional packet handler that will be invoked as
|
||||
// a firewall during NAT translation. The firewall always sees
|
||||
// packets in their "LAN form", i.e. before translation in the
|
||||
// outbound direction and after translation in the inbound
|
||||
// direction.
|
||||
Firewall PacketHandler
|
||||
// TimeNow is a function that returns the current time. If
|
||||
// nil, time.Now is used.
|
||||
TimeNow func() time.Time
|
||||
|
||||
// inject, if not nil, will be invoked instead of Machine.Inject
|
||||
// to inject NATed packets into the network. It is used for tests
|
||||
// only.
|
||||
inject func(*Packet) error
|
||||
|
||||
mu sync.Mutex
|
||||
byLAN map[natKey]*mapping // lookup by outbound packet tuple
|
||||
byWAN map[netaddr.IPPort]*mapping // lookup by wan ip:port only
|
||||
}
|
||||
|
||||
func (n *SNAT44) timeNow() time.Time {
|
||||
if n.TimeNow != nil {
|
||||
return n.TimeNow()
|
||||
}
|
||||
return time.Now()
|
||||
}
|
||||
|
||||
func (n *SNAT44) mappingTimeout() time.Duration {
|
||||
if n.MappingTimeout == 0 {
|
||||
return DefaultMappingTimeout
|
||||
}
|
||||
return n.MappingTimeout
|
||||
}
|
||||
|
||||
func (n *SNAT44) initLocked() {
|
||||
if n.byLAN == nil {
|
||||
n.byLAN = map[natKey]*mapping{}
|
||||
n.byWAN = map[netaddr.IPPort]*mapping{}
|
||||
}
|
||||
if n.ExternalInterface.Machine() != n.Machine {
|
||||
panic(fmt.Sprintf("NAT given interface %s that is not part of given machine %s", n.ExternalInterface, n.Machine.Name))
|
||||
}
|
||||
if n.inject == nil {
|
||||
n.inject = n.Machine.Inject
|
||||
}
|
||||
}
|
||||
|
||||
func (n *SNAT44) HandlePacket(p *Packet, inIf *Interface) PacketVerdict {
|
||||
n.mu.Lock()
|
||||
defer n.mu.Unlock()
|
||||
n.initLocked()
|
||||
|
||||
if inIf == n.ExternalInterface {
|
||||
return n.processInboundLocked(p, inIf)
|
||||
} else {
|
||||
return n.processOutboundLocked(p, inIf)
|
||||
}
|
||||
}
|
||||
|
||||
func (n *SNAT44) processInboundLocked(p *Packet, inIf *Interface) PacketVerdict {
|
||||
// TODO: packets to local addrs should fall through to local
|
||||
// socket processing.
|
||||
now := n.timeNow()
|
||||
mapping := n.byWAN[p.Dst]
|
||||
if mapping == nil || now.After(mapping.deadline) {
|
||||
p.Trace("nat drop, no mapping/expired mapping")
|
||||
return Drop
|
||||
}
|
||||
p.Dst = mapping.lanSrc
|
||||
|
||||
if n.Firewall != nil {
|
||||
if verdict := n.Firewall(p.Clone(), inIf); verdict == Drop {
|
||||
return Drop
|
||||
}
|
||||
}
|
||||
|
||||
if err := n.inject(p); err != nil {
|
||||
p.Trace("inject failed: %v", err)
|
||||
}
|
||||
return Drop
|
||||
}
|
||||
|
||||
func (n *SNAT44) processOutboundLocked(p *Packet, inIf *Interface) PacketVerdict {
|
||||
if n.Firewall != nil {
|
||||
if verdict := n.Firewall(p, inIf); verdict == Drop {
|
||||
return Drop
|
||||
}
|
||||
}
|
||||
if inIf == nil {
|
||||
// Technically, we don't need to process the outbound firewall
|
||||
// for NATed packets, but our current packet processing API
|
||||
// doesn't give us that granularity: we'll see both locally
|
||||
// originated PacketConn traffic and NATed traffic as inIf ==
|
||||
// nil, and we need to apply the firewall to locally
|
||||
// originated traffic. This may create some useless state
|
||||
// entries in the firewall, but until we implement a much more
|
||||
// elaborate packet processing pipeline that can distinguish
|
||||
// local vs. forwarded traffic, this is the best we have.
|
||||
return Continue
|
||||
}
|
||||
|
||||
k := n.Type.key(p.Src, p.Dst)
|
||||
now := n.timeNow()
|
||||
m := n.byLAN[k]
|
||||
if m == nil || now.After(m.deadline) {
|
||||
pc, wanAddr := n.allocateMappedPort()
|
||||
m = &mapping{
|
||||
lanSrc: p.Src,
|
||||
lanDst: p.Dst,
|
||||
wanSrc: wanAddr,
|
||||
pc: pc,
|
||||
}
|
||||
n.byLAN[k] = m
|
||||
n.byWAN[wanAddr] = m
|
||||
}
|
||||
m.deadline = now.Add(n.mappingTimeout())
|
||||
p.Src = m.wanSrc
|
||||
|
||||
p.Trace("snat from %v", p.Src)
|
||||
if err := n.inject(p); err != nil {
|
||||
p.Trace("inject failed: %v", err)
|
||||
}
|
||||
return Drop
|
||||
}
|
||||
|
||||
func (n *SNAT44) allocateMappedPort() (net.PacketConn, netaddr.IPPort) {
|
||||
// Clean up old entries before trying to allocate, to free up any
|
||||
// expired ports.
|
||||
n.gc()
|
||||
|
||||
ip := n.ExternalInterface.V4()
|
||||
pc, err := n.Machine.ListenPacket(context.Background(), "udp", net.JoinHostPort(ip.String(), "0"))
|
||||
if err != nil {
|
||||
panic(fmt.Sprintf("ran out of NAT ports: %v", err))
|
||||
}
|
||||
addr := netaddr.IPPort{
|
||||
IP: ip,
|
||||
Port: uint16(pc.LocalAddr().(*net.UDPAddr).Port),
|
||||
}
|
||||
return pc, addr
|
||||
}
|
||||
|
||||
func (n *SNAT44) gc() {
|
||||
now := n.timeNow()
|
||||
for _, m := range n.byLAN {
|
||||
if !now.After(m.deadline) {
|
||||
continue
|
||||
}
|
||||
m.pc.Close()
|
||||
delete(n.byLAN, n.Type.key(m.lanSrc, m.lanDst))
|
||||
delete(n.byWAN, m.wanSrc)
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue