From 55b1221db27da0269a67593f66a27d3efe8d9b8b Mon Sep 17 00:00:00 2001 From: David Anderson Date: Tue, 10 Nov 2020 01:00:35 -0800 Subject: [PATCH] net/packet: support full IPv6 decoding. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The packet filter still rejects all IPv6, but decodes enough from v6 packets to do something smarter in a followup. name time/op Decode/tcp4-8 28.8ns ± 2% Decode/tcp6-8 20.6ns ± 1% Decode/udp4-8 28.2ns ± 1% Decode/udp6-8 20.0ns ± 6% Decode/icmp4-8 21.7ns ± 2% Decode/icmp6-8 14.1ns ± 2% Decode/unknown-8 9.43ns ± 2% Signed-off-by: David Anderson --- net/packet/icmp4.go | 14 +- net/packet/icmp6.go | 37 +++++ net/packet/ip.go | 53 ++++++++ net/packet/ip4.go | 51 ++----- net/packet/ip6.go | 6 + net/packet/packet.go | 241 +++++++++++++++++++++++---------- net/packet/packet_test.go | 210 ++++++++++++++++++++-------- net/packet/udp4.go | 2 +- wgengine/filter/filter.go | 4 +- wgengine/filter/filter_test.go | 18 +-- wgengine/userspace.go | 2 +- 11 files changed, 454 insertions(+), 184 deletions(-) create mode 100644 net/packet/icmp6.go create mode 100644 net/packet/ip.go diff --git a/net/packet/icmp4.go b/net/packet/icmp4.go index c9e428793..344602c12 100644 --- a/net/packet/icmp4.go +++ b/net/packet/icmp4.go @@ -34,7 +34,7 @@ const ( ICMP4NoCode ICMP4Code = 0 ) -// ICMPHeader represents an ICMP packet header. +// ICMP4Header represents an ICMPv4 packet header. type ICMP4Header struct { IP4Header Type ICMP4Type @@ -42,24 +42,24 @@ type ICMP4Header struct { } const ( - icmpHeaderLength = 4 - // icmpTotalHeaderLength is the length of all headers in a ICMP packet. - icmpAllHeadersLength = ipHeaderLength + icmpHeaderLength + icmp4HeaderLength = 4 + // icmp4AllHeadersLength is the length of all headers in a ICMPv4 packet. + icmp4AllHeadersLength = ip4HeaderLength + icmp4HeaderLength ) func (ICMP4Header) Len() int { - return icmpAllHeadersLength + return icmp4AllHeadersLength } func (h ICMP4Header) Marshal(buf []byte) error { - if len(buf) < icmpAllHeadersLength { + if len(buf) < icmp4AllHeadersLength { return errSmallBuffer } if len(buf) > maxPacketLength { return errLargePacket } // The caller does not need to set this. - h.IPProto = ICMP + h.IPProto = ICMPv4 buf[20] = uint8(h.Type) buf[21] = uint8(h.Code) diff --git a/net/packet/icmp6.go b/net/packet/icmp6.go new file mode 100644 index 000000000..7759d78e9 --- /dev/null +++ b/net/packet/icmp6.go @@ -0,0 +1,37 @@ +// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +package packet + +type ICMP6Type uint8 + +const ( + ICMP6Unreachable ICMP6Type = 1 + ICMP6TimeExceeded ICMP6Type = 3 + ICMP6EchoRequest ICMP6Type = 128 + ICMP6EchoReply ICMP6Type = 129 +) + +func (t ICMP6Type) String() string { + switch t { + case ICMP6Unreachable: + return "Unreachable" + case ICMP6TimeExceeded: + return "TimeExceeded" + case ICMP6EchoRequest: + return "EchoRequest" + case ICMP6EchoReply: + return "EchoReply" + default: + return "Unknown" + } +} + +type ICMP6Code uint8 + +const ( + ICMP6NoCode ICMP6Code = 0 +) + +const icmp6HeaderLength = 4 diff --git a/net/packet/ip.go b/net/packet/ip.go new file mode 100644 index 000000000..a5703433e --- /dev/null +++ b/net/packet/ip.go @@ -0,0 +1,53 @@ +// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +package packet + +// IPProto is an IP subprotocol as defined by the IANA protocol +// numbers list +// (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml), +// or the special values Unknown or Fragment. +type IPProto uint8 + +const ( + // Unknown represents an unknown or unsupported protocol; it's + // deliberately the zero value. Strictly speaking the zero + // value is IPv6 hop-by-hop extensions, but we don't support + // those, so this is still technically correct. + Unknown IPProto = 0x00 + + // Values from the IANA registry. + ICMPv4 IPProto = 0x01 + IGMP IPProto = 0x02 + ICMPv6 IPProto = 0x3a + TCP IPProto = 0x06 + UDP IPProto = 0x11 + + // Fragment represents any non-first IP fragment, for which we + // don't have the sub-protocol header (and therefore can't + // figure out what the sub-protocol is). + // + // 0xFF is reserved in the IANA registry, so we steal it for + // internal use. + Fragment IPProto = 0xFF +) + +func (p IPProto) String() string { + switch p { + case Fragment: + return "Frag" + case ICMPv4: + return "ICMPv4" + case IGMP: + return "IGMP" + case ICMPv6: + return "ICMPv6" + case UDP: + return "UDP" + case TCP: + return "TCP" + default: + return "Unknown" + } +} diff --git a/net/packet/ip4.go b/net/packet/ip4.go index 09ebc3205..3c8fc87c1 100644 --- a/net/packet/ip4.go +++ b/net/packet/ip4.go @@ -47,64 +47,30 @@ func (ip IP4) IsLinkLocalUnicast() bool { return byte(ip>>24) == 169 && byte(ip>>16) == 254 } -// IP4Proto is either a real IP protocol (TCP, UDP, ...) or an special -// value like Unknown. If it is a real IP protocol, its value -// corresponds to its IP protocol number. -type IP4Proto uint8 - -const ( - // Unknown represents an unknown or unsupported protocol; it's deliberately the zero value. - Unknown IP4Proto = 0x00 - ICMP IP4Proto = 0x01 - IGMP IP4Proto = 0x02 - ICMPv6 IP4Proto = 0x3a - TCP IP4Proto = 0x06 - UDP IP4Proto = 0x11 - // Fragment is a special value. It's not really an IPProto value - // so we're using the unassigned 0xFF value. - // TODO(dmytro): special values should be taken out of here. - Fragment IP4Proto = 0xFF -) - -func (p IP4Proto) String() string { - switch p { - case Fragment: - return "Frag" - case ICMP: - return "ICMP" - case UDP: - return "UDP" - case TCP: - return "TCP" - default: - return "Unknown" - } -} - // IPHeader represents an IP packet header. type IP4Header struct { - IPProto IP4Proto + IPProto IPProto IPID uint16 SrcIP IP4 DstIP IP4 } -const ipHeaderLength = 20 +const ip4HeaderLength = 20 func (IP4Header) Len() int { - return ipHeaderLength + return ip4HeaderLength } func (h IP4Header) Marshal(buf []byte) error { - if len(buf) < ipHeaderLength { + if len(buf) < ip4HeaderLength { return errSmallBuffer } if len(buf) > maxPacketLength { return errLargePacket } - buf[0] = 0x40 | (ipHeaderLength >> 2) // IPv4 - buf[1] = 0x00 // DHCP, ECN + buf[0] = 0x40 | (ip4HeaderLength >> 2) // IPv4 + buf[1] = 0x00 // DHCP, ECN put16(buf[2:4], uint16(len(buf))) put16(buf[4:6], h.IPID) put16(buf[6:8], 0) // flags, offset @@ -123,20 +89,19 @@ func (h IP4Header) Marshal(buf []byte) error { // form required when calculating UDP checksums. Overwrites the first // h.Length() bytes of buf. func (h IP4Header) MarshalPseudo(buf []byte) error { - if len(buf) < ipHeaderLength { + if len(buf) < ip4HeaderLength { return errSmallBuffer } if len(buf) > maxPacketLength { return errLargePacket } - length := len(buf) - ipHeaderLength + length := len(buf) - ip4HeaderLength put32(buf[8:12], uint32(h.SrcIP)) put32(buf[12:16], uint32(h.DstIP)) buf[16] = 0x0 buf[17] = uint8(h.IPProto) put16(buf[18:20], uint16(length)) - return nil } diff --git a/net/packet/ip6.go b/net/packet/ip6.go index ad5c0a033..992da098b 100644 --- a/net/packet/ip6.go +++ b/net/packet/ip6.go @@ -1,3 +1,7 @@ +// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + package packet import ( @@ -22,3 +26,5 @@ func (ip IP6) Netaddr() netaddr.IP { func (ip IP6) String() string { return ip.Netaddr().String() } + +const ip6HeaderLength = 40 diff --git a/net/packet/packet.go b/net/packet/packet.go index 2b87339f2..f92647efd 100644 --- a/net/packet/packet.go +++ b/net/packet/packet.go @@ -43,39 +43,53 @@ type Parsed struct { // This is not the same as len(b) because b can have trailing zeros. length int - IPVersion uint8 // 4, 6, or 0 - IPProto IP4Proto // IP subprotocol (UDP, TCP, etc); the NextHeader field for IPv6 - SrcIP4 IP4 // IPv4 source address (not used for IPv6) - DstIP4 IP4 // IPv4 destination address (not used for IPv6) - SrcIP6 IP6 // IPv6 source address (not used for IPv4) - DstIP6 IP6 // IPv6 destination address (not used for IPv4) - SrcPort uint16 // TCP/UDP source port - DstPort uint16 // TCP/UDP destination port - TCPFlags uint8 // TCP flags (SYN, ACK, etc) + // IPVersion is the IP protocol version of the packet (4 or + // 6), or 0 if the packet doesn't look like IPv4 or IPv6. + IPVersion uint8 + // IPProto is the IP subprotocol (UDP, TCP, etc.). Valid iff IPVersion != 0. + IPProto IPProto + // SrcIP4 is the IPv4 source address. Valid iff IPVersion == 4. + SrcIP4 IP4 + // DstIP4 is the IPv4 destination address. Valid iff IPVersion == 4. + DstIP4 IP4 + // SrcIP6 is the IPv6 source address. Valid iff IPVersion == 6. + SrcIP6 IP6 + // DstIP6 is the IPv6 destination address. Valid iff IPVersion == 6. + DstIP6 IP6 + // SrcPort is the TCP/UDP source port. Valid iff IPProto == TCP || IPProto == UDP. + SrcPort uint16 + // DstPort is the TCP/UDP source port. Valid iff IPProto == TCP || IPProto == UDP. + DstPort uint16 + // TCPFlags is the packet's TCP flag bigs. Valid iff IPProto == TCP. + TCPFlags uint8 } -// NextHeader -type NextHeader uint8 - func (p *Parsed) String() string { - if p.IPVersion == 6 { - return fmt.Sprintf("IPv6{Proto=%d}", p.IPProto) - } - switch p.IPProto { - case Unknown: + switch p.IPVersion { + case 4: + sb := strbuilder.Get() + sb.WriteString(p.IPProto.String()) + sb.WriteByte('{') + writeIP4Port(sb, p.SrcIP4, p.SrcPort) + sb.WriteString(" > ") + writeIP4Port(sb, p.DstIP4, p.DstPort) + sb.WriteByte('}') + return sb.String() + case 6: + sb := strbuilder.Get() + sb.WriteString(p.IPProto.String()) + sb.WriteByte('{') + writeIP6Port(sb, p.SrcIP6, p.SrcPort) + sb.WriteString(" > ") + writeIP6Port(sb, p.DstIP6, p.DstPort) + sb.WriteByte('}') + return sb.String() + default: return "Unknown{???}" } - sb := strbuilder.Get() - sb.WriteString(p.IPProto.String()) - sb.WriteByte('{') - writeIPPort(sb, p.SrcIP4, p.SrcPort) - sb.WriteString(" > ") - writeIPPort(sb, p.DstIP4, p.DstPort) - sb.WriteByte('}') - return sb.String() } -func writeIPPort(sb *strbuilder.Builder, ip IP4, port uint16) { +func writeIP4Port(sb *strbuilder.Builder, ip IP4, port uint16) { sb.WriteUint(uint64(byte(ip >> 24))) sb.WriteByte('.') sb.WriteUint(uint64(byte(ip >> 16))) @@ -87,6 +101,13 @@ func writeIPPort(sb *strbuilder.Builder, ip IP4, port uint16) { sb.WriteUint(uint64(port)) } +func writeIP6Port(sb *strbuilder.Builder, ip IP6, port uint16) { + sb.WriteByte('[') + sb.WriteString(ip.Netaddr().String()) // TODO: faster? + sb.WriteString("]:") + sb.WriteUint(uint64(port)) +} + // based on https://tools.ietf.org/html/rfc1071 func ipChecksum(b []byte) uint16 { var ac uint32 @@ -113,27 +134,33 @@ func ipChecksum(b []byte) uint16 { func (q *Parsed) Decode(b []byte) { q.b = b - if len(b) < ipHeaderLength { + if len(b) < 1 { q.IPVersion = 0 q.IPProto = Unknown return } - // Check that it's IPv4. - // TODO(apenwarr): consider IPv6 support q.IPVersion = (b[0] & 0xF0) >> 4 switch q.IPVersion { case 4: - q.IPProto = IP4Proto(b[9]) + q.decode4(b) case 6: - q.IPProto = IP4Proto(b[6]) // "Next Header" field - return + q.decode6(b) default: q.IPVersion = 0 q.IPProto = Unknown + } +} + +func (q *Parsed) decode4(b []byte) { + if len(b) < ip4HeaderLength { + q.IPVersion = 0 + q.IPProto = Unknown return } + // Check that it's IPv4. + q.IPProto = IPProto(b[9]) q.length = int(get16(b[2:4])) if len(b) < q.length { // Packet was cut off before full IPv4 length. @@ -174,14 +201,14 @@ func (q *Parsed) Decode(b []byte) { // or a big enough initial fragment that we can read the // whole subprotocol header. switch q.IPProto { - case ICMP: - if len(sub) < icmpHeaderLength { + case ICMPv4: + if len(sub) < icmp4HeaderLength { q.IPProto = Unknown return } q.SrcPort = 0 q.DstPort = 0 - q.dataofs = q.subofs + icmpHeaderLength + q.dataofs = q.subofs + icmp4HeaderLength return case TCP: if len(sub) < tcpHeaderLength { @@ -226,7 +253,77 @@ func (q *Parsed) Decode(b []byte) { } } -func (q *Parsed) IPHeader() IP4Header { +func (q *Parsed) decode6(b []byte) { + if len(b) < ip6HeaderLength { + q.IPVersion = 0 + q.IPProto = Unknown + return + } + + q.IPProto = IPProto(b[6]) + q.length = int(get16(b[4:6])) + ip6HeaderLength + if len(b) < q.length { + // Packet was cut off before the full IPv6 length. + q.IPProto = Unknown + return + } + + copy(q.SrcIP6[:], b[8:24]) + copy(q.DstIP6[:], b[24:40]) + + // We don't support any IPv6 extension headers. Don't try to + // be clever. Therefore, the IP subprotocol always starts at + // byte 40. + // + // Note that this means we don't support fragmentation in + // IPv6. This is fine, because IPv6 strongly mandates that you + // should not fragment, which makes fragmentation on the open + // internet extremely uncommon. + // + // This also means we don't support IPSec headers (AH/ESP), or + // IPv6 jumbo frames. Those will get marked Unknown and + // dropped. + q.subofs = 40 + sub := b[q.subofs:] + + switch q.IPProto { + case ICMPv6: + if len(sub) < icmp6HeaderLength { + q.IPProto = Unknown + return + } + q.SrcPort = 0 + q.DstPort = 0 + q.dataofs = q.subofs + icmp6HeaderLength + case TCP: + if len(sub) < tcpHeaderLength { + q.IPProto = Unknown + return + } + q.SrcPort = get16(sub[0:2]) + q.DstPort = get16(sub[2:4]) + q.TCPFlags = sub[13] & 0x3F + headerLength := (sub[12] & 0xF0) >> 2 + q.dataofs = q.subofs + int(headerLength) + return + case UDP: + if len(sub) < udpHeaderLength { + q.IPProto = Unknown + return + } + q.SrcPort = get16(sub[0:2]) + q.DstPort = get16(sub[2:4]) + q.dataofs = q.subofs + udpHeaderLength + default: + q.IPProto = Unknown + return + } +} + +func (q *Parsed) IP4Header() IP4Header { + if q.IPVersion != 4 { + panic("IP4Header called on non-IPv4 Parsed") + } ipid := get16(q.b[4:6]) return IP4Header{ IPID: ipid, @@ -236,17 +333,23 @@ func (q *Parsed) IPHeader() IP4Header { } } -func (q *Parsed) ICMPHeader() ICMP4Header { +func (q *Parsed) ICMP4Header() ICMP4Header { + if q.IPVersion != 4 { + panic("IP4Header called on non-IPv4 Parsed") + } return ICMP4Header{ - IP4Header: q.IPHeader(), + IP4Header: q.IP4Header(), Type: ICMP4Type(q.b[q.subofs+0]), Code: ICMP4Code(q.b[q.subofs+1]), } } -func (q *Parsed) UDPHeader() UDP4Header { +func (q *Parsed) UDP4Header() UDP4Header { + if q.IPVersion != 4 { + panic("IP4Header called on non-IPv4 Parsed") + } return UDP4Header{ - IP4Header: q.IPHeader(), + IP4Header: q.IP4Header(), SrcPort: q.SrcPort, DstPort: q.DstPort, } @@ -258,58 +361,60 @@ func (q *Parsed) Buffer() []byte { return q.b } -// Sub returns the IP subprotocol section. -// This is a read-only view; that is, q retains the ownership of the buffer. -func (q *Parsed) Sub(begin, n int) []byte { - return q.b[q.subofs+begin : q.subofs+begin+n] -} - // Payload returns the payload of the IP subprotocol section. // This is a read-only view; that is, q retains the ownership of the buffer. func (q *Parsed) Payload() []byte { return q.b[q.dataofs:q.length] } -// Trim trims the buffer to its IPv4 length. -// Sometimes packets arrive from an interface with extra bytes on the end. -// This removes them. -func (q *Parsed) Trim() []byte { - return q.b[:q.length] -} - // IsTCPSyn reports whether q is a TCP SYN packet // (i.e. the first packet in a new connection). func (q *Parsed) IsTCPSyn() bool { return (q.TCPFlags & TCPSynAck) == TCPSyn } -// IsError reports whether q is an IPv4 ICMP "Error" packet. +// IsError reports whether q is an ICMP "Error" packet. func (q *Parsed) IsError() bool { - if q.IPProto == ICMP && len(q.b) >= q.subofs+8 { - switch ICMP4Type(q.b[q.subofs]) { - case ICMP4Unreachable, ICMP4TimeExceeded: - return true + switch q.IPProto { + case ICMPv4: + if len(q.b) < q.subofs+8 { + return false + } + t := ICMP4Type(q.b[q.subofs]) + return t == ICMP4Unreachable || t == ICMP4TimeExceeded + case ICMPv6: + if len(q.b) < q.subofs+8 { + return false } + t := ICMP6Type(q.b[q.subofs]) + return t == ICMP6Unreachable || t == ICMP6TimeExceeded + default: + return false } - return false } -// IsEchoRequest reports whether q is an IPv4 ICMP Echo Request. +// IsEchoRequest reports whether q is an ICMP Echo Request. func (q *Parsed) IsEchoRequest() bool { - if q.IPProto == ICMP && len(q.b) >= q.subofs+8 { - return ICMP4Type(q.b[q.subofs]) == ICMP4EchoRequest && - ICMP4Code(q.b[q.subofs+1]) == ICMP4NoCode + switch q.IPProto { + case ICMPv4: + return len(q.b) >= q.subofs+8 && ICMP4Type(q.b[q.subofs]) == ICMP4EchoRequest && ICMP4Code(q.b[q.subofs+1]) == ICMP4NoCode + case ICMPv6: + return len(q.b) >= q.subofs+8 && ICMP6Type(q.b[q.subofs]) == ICMP6EchoRequest && ICMP6Code(q.b[q.subofs+1]) == ICMP6NoCode + default: + return false } - return false } // IsEchoRequest reports whether q is an IPv4 ICMP Echo Response. func (q *Parsed) IsEchoResponse() bool { - if q.IPProto == ICMP && len(q.b) >= q.subofs+8 { - return ICMP4Type(q.b[q.subofs]) == ICMP4EchoReply && - ICMP4Code(q.b[q.subofs+1]) == ICMP4NoCode + switch q.IPProto { + case ICMPv4: + return len(q.b) >= q.subofs+8 && ICMP4Type(q.b[q.subofs]) == ICMP4EchoReply && ICMP4Code(q.b[q.subofs+1]) == ICMP4NoCode + case ICMPv6: + return len(q.b) >= q.subofs+8 && ICMP6Type(q.b[q.subofs]) == ICMP6EchoReply && ICMP6Code(q.b[q.subofs+1]) == ICMP6NoCode + default: + return false } - return false } func Hexdump(b []byte) string { diff --git a/net/packet/packet_test.go b/net/packet/packet_test.go index ecbe25a21..c59090645 100644 --- a/net/packet/packet_test.go +++ b/net/packet/packet_test.go @@ -9,8 +9,26 @@ import ( "net" "reflect" "testing" + + "inet.af/netaddr" ) +func mustIP4(s string) IP4 { + ip, err := netaddr.ParseIP(s) + if err != nil { + panic(err) + } + return IP4FromNetaddr(ip) +} + +func mustIP6(s string) IP6 { + ip, err := netaddr.ParseIP(s) + if err != nil { + panic(err) + } + return IP6FromNetaddr(ip) +} + func TestIP4String(t *testing.T) { const str = "1.2.3.4" ip := NewIP4(net.ParseIP(str)) @@ -28,7 +46,24 @@ func TestIP4String(t *testing.T) { } } -var icmpRequestBuffer = []byte{ +func TestIP6String(t *testing.T) { + const str = "2607:f8b0:400a:809::200e" + ip := mustIP6(str) + + var got string + allocs := testing.AllocsPerRun(1000, func() { + got = ip.String() + }) + + if got != str { + t.Errorf("got %q; want %q", got, str) + } + if allocs != 2 { + t.Errorf("allocs = %v; want 1", allocs) + } +} + +var icmp4RequestBuffer = []byte{ // IP header up to checksum 0x45, 0x00, 0x00, 0x27, 0xde, 0xad, 0x00, 0x00, 0x40, 0x01, 0x8c, 0x15, // source ip @@ -41,21 +76,21 @@ var icmpRequestBuffer = []byte{ 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, } -var icmpRequestDecode = Parsed{ - b: icmpRequestBuffer, +var icmp4RequestDecode = Parsed{ + b: icmp4RequestBuffer, subofs: 20, dataofs: 24, - length: len(icmpRequestBuffer), + length: len(icmp4RequestBuffer), IPVersion: 4, - IPProto: ICMP, - SrcIP4: NewIP4(net.ParseIP("1.2.3.4")), - DstIP4: NewIP4(net.ParseIP("5.6.7.8")), + IPProto: ICMPv4, + SrcIP4: mustIP4("1.2.3.4"), + DstIP4: mustIP4("5.6.7.8"), SrcPort: 0, DstPort: 0, } -var icmpReplyBuffer = []byte{ +var icmp4ReplyBuffer = []byte{ 0x45, 0x00, 0x00, 0x25, 0x21, 0x52, 0x00, 0x00, 0x40, 0x01, 0x49, 0x73, // source ip 0x05, 0x06, 0x07, 0x08, @@ -67,22 +102,22 @@ var icmpReplyBuffer = []byte{ 0x72, 0x65, 0x70, 0x6c, 0x79, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, } -var icmpReplyDecode = Parsed{ - b: icmpReplyBuffer, +var icmp4ReplyDecode = Parsed{ + b: icmp4ReplyBuffer, subofs: 20, dataofs: 24, - length: len(icmpReplyBuffer), + length: len(icmp4ReplyBuffer), IPVersion: 4, - IPProto: ICMP, - SrcIP4: NewIP4(net.ParseIP("1.2.3.4")), - DstIP4: NewIP4(net.ParseIP("5.6.7.8")), + IPProto: ICMPv4, + SrcIP4: mustIP4("1.2.3.4"), + DstIP4: mustIP4("5.6.7.8"), SrcPort: 0, DstPort: 0, } -// IPv6 Router Solicitation -var ipv6PacketBuffer = []byte{ +// ICMPv6 Router Solicitation +var icmp6PacketBuffer = []byte{ 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfb, 0x57, 0x1d, 0xea, 0x9c, 0x39, 0x8f, 0xb7, @@ -91,10 +126,15 @@ var ipv6PacketBuffer = []byte{ 0x85, 0x00, 0x38, 0x04, 0x00, 0x00, 0x00, 0x00, } -var ipv6PacketDecode = Parsed{ - b: ipv6PacketBuffer, +var icmp6PacketDecode = Parsed{ + b: icmp6PacketBuffer, + subofs: 40, + dataofs: 44, + length: len(icmp6PacketBuffer), IPVersion: 6, IPProto: ICMPv6, + SrcIP6: mustIP6("fe80::fb57:1dea:9c39:8fb7"), + DstIP6: mustIP6("ff02::2"), } // This is a malformed IPv4 packet. @@ -109,7 +149,7 @@ var unknownPacketDecode = Parsed{ IPProto: Unknown, } -var tcpPacketBuffer = []byte{ +var tcp4PacketBuffer = []byte{ // IP header up to checksum 0x45, 0x00, 0x00, 0x37, 0xde, 0xad, 0x00, 0x00, 0x40, 0x06, 0x49, 0x5f, // source ip @@ -123,22 +163,50 @@ var tcpPacketBuffer = []byte{ 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, } -var tcpPacketDecode = Parsed{ - b: tcpPacketBuffer, +var tcp4PacketDecode = Parsed{ + b: tcp4PacketBuffer, subofs: 20, dataofs: 40, - length: len(tcpPacketBuffer), + length: len(tcp4PacketBuffer), IPVersion: 4, IPProto: TCP, - SrcIP4: NewIP4(net.ParseIP("1.2.3.4")), - DstIP4: NewIP4(net.ParseIP("5.6.7.8")), + SrcIP4: mustIP4("1.2.3.4"), + DstIP4: mustIP4("5.6.7.8"), SrcPort: 123, DstPort: 567, TCPFlags: TCPSynAck, } -var udpRequestBuffer = []byte{ +var tcp6RequestBuffer = []byte{ + // IPv6 header up to hop limit + 0x60, 0x06, 0xef, 0xcc, 0x00, 0x28, 0x06, 0x40, + // Src addr + 0x20, 0x01, 0x05, 0x59, 0xbc, 0x13, 0x54, 0x00, 0x17, 0x49, 0x46, 0x28, 0x39, 0x34, 0x0e, 0x1b, + // Dst addr + 0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0a, 0x08, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x0e, + // TCP SYN segment, no payload + 0xa4, 0x60, 0x00, 0x50, 0xf3, 0x82, 0xa1, 0x25, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0xfd, 0x20, + 0xb1, 0xc6, 0x00, 0x00, 0x02, 0x04, 0x05, 0xa0, 0x04, 0x02, 0x08, 0x0a, 0xca, 0x76, 0xa6, 0x8e, + 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x07, +} + +var tcp6RequestDecode = Parsed{ + b: tcp6RequestBuffer, + subofs: 40, + dataofs: len(tcp6RequestBuffer), + length: len(tcp6RequestBuffer), + + IPVersion: 6, + IPProto: TCP, + SrcIP6: mustIP6("2001:559:bc13:5400:1749:4628:3934:e1b"), + DstIP6: mustIP6("2607:f8b0:400a:809::200e"), + SrcPort: 42080, + DstPort: 80, + TCPFlags: TCPSyn, +} + +var udp4RequestBuffer = []byte{ // IP header up to checksum 0x45, 0x00, 0x00, 0x2b, 0xde, 0xad, 0x00, 0x00, 0x40, 0x11, 0x8c, 0x01, // source ip @@ -151,21 +219,48 @@ var udpRequestBuffer = []byte{ 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, } -var udpRequestDecode = Parsed{ - b: udpRequestBuffer, +var udp4RequestDecode = Parsed{ + b: udp4RequestBuffer, subofs: 20, dataofs: 28, - length: len(udpRequestBuffer), + length: len(udp4RequestBuffer), IPVersion: 4, IPProto: UDP, - SrcIP4: NewIP4(net.ParseIP("1.2.3.4")), - DstIP4: NewIP4(net.ParseIP("5.6.7.8")), + SrcIP4: mustIP4("1.2.3.4"), + DstIP4: mustIP4("5.6.7.8"), SrcPort: 123, DstPort: 567, } -var udpReplyBuffer = []byte{ +var udp6RequestBuffer = []byte{ + // IPv6 header up to hop limit + 0x60, 0x0e, 0xc9, 0x67, 0x00, 0x29, 0x11, 0x40, + // Src addr + 0x20, 0x01, 0x05, 0x59, 0xbc, 0x13, 0x54, 0x00, 0x17, 0x49, 0x46, 0x28, 0x39, 0x34, 0x0e, 0x1b, + // Dst addr + 0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0a, 0x08, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x0e, + // UDP header + 0xd4, 0x04, 0x01, 0xbb, 0x00, 0x29, 0x96, 0x84, + // Payload + 0x5c, 0x06, 0xae, 0x85, 0x02, 0xf5, 0xdb, 0x90, 0xe0, 0xe0, 0x93, 0xed, 0x9a, 0xd9, 0x92, 0x69, 0xbe, 0x36, 0x8a, 0x7d, 0xd7, 0xce, 0xd0, 0x8a, 0xf2, 0x51, 0x95, 0xff, 0xb6, 0x92, 0x70, 0x10, 0xd7, +} + +var udp6RequestDecode = Parsed{ + b: udp6RequestBuffer, + subofs: 40, + dataofs: 48, + length: len(udp6RequestBuffer), + + IPVersion: 6, + IPProto: UDP, + SrcIP6: mustIP6("2001:559:bc13:5400:1749:4628:3934:e1b"), + DstIP6: mustIP6("2607:f8b0:400a:809::200e"), + SrcPort: 54276, + DstPort: 443, +} + +var udp4ReplyBuffer = []byte{ // IP header up to checksum 0x45, 0x00, 0x00, 0x29, 0x21, 0x52, 0x00, 0x00, 0x40, 0x11, 0x49, 0x5f, // source ip @@ -178,15 +273,15 @@ var udpReplyBuffer = []byte{ 0x72, 0x65, 0x70, 0x6c, 0x79, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, } -var udpReplyDecode = Parsed{ - b: udpReplyBuffer, +var udp4ReplyDecode = Parsed{ + b: udp4ReplyBuffer, subofs: 20, dataofs: 28, - length: len(udpReplyBuffer), + length: len(udp4ReplyBuffer), IPProto: UDP, - SrcIP4: NewIP4(net.ParseIP("1.2.3.4")), - DstIP4: NewIP4(net.ParseIP("5.6.7.8")), + SrcIP4: mustIP4("1.2.3.4"), + DstIP4: mustIP4("5.6.7.8"), SrcPort: 567, DstPort: 123, } @@ -197,10 +292,13 @@ func TestParsed(t *testing.T) { qdecode Parsed want string }{ - {"tcp", tcpPacketDecode, "TCP{1.2.3.4:123 > 5.6.7.8:567}"}, - {"icmp", icmpRequestDecode, "ICMP{1.2.3.4:0 > 5.6.7.8:0}"}, + {"tcp4", tcp4PacketDecode, "TCP{1.2.3.4:123 > 5.6.7.8:567}"}, + {"tcp6", tcp6RequestDecode, "TCP{[2001:559:bc13:5400:1749:4628:3934:e1b]:42080 > [2607:f8b0:400a:809::200e]:80}"}, + {"udp4", udp4RequestDecode, "UDP{1.2.3.4:123 > 5.6.7.8:567}"}, + {"udp6", udp6RequestDecode, "UDP{[2001:559:bc13:5400:1749:4628:3934:e1b]:54276 > [2607:f8b0:400a:809::200e]:443}"}, + {"icmp4", icmp4RequestDecode, "ICMPv4{1.2.3.4:0 > 5.6.7.8:0}"}, + {"icmp6", icmp6PacketDecode, "ICMPv6{[fe80::fb57:1dea:9c39:8fb7]:0 > [ff02::2]:0}"}, {"unknown", unknownPacketDecode, "Unknown{???}"}, - {"ipv6", ipv6PacketDecode, "IPv6{Proto=58}"}, } for _, tt := range tests { @@ -228,11 +326,13 @@ func TestDecode(t *testing.T) { buf []byte want Parsed }{ - {"icmp", icmpRequestBuffer, icmpRequestDecode}, - {"ipv6", ipv6PacketBuffer, ipv6PacketDecode}, + {"icmp4", icmp4RequestBuffer, icmp4RequestDecode}, + {"icmp6", icmp6PacketBuffer, icmp6PacketDecode}, {"unknown", unknownPacketBuffer, unknownPacketDecode}, - {"tcp", tcpPacketBuffer, tcpPacketDecode}, - {"udp", udpRequestBuffer, udpRequestDecode}, + {"tcp4", tcp4PacketBuffer, tcp4PacketDecode}, + {"tcp6", tcp6RequestBuffer, tcp6RequestDecode}, + {"udp4", udp4RequestBuffer, udp4RequestDecode}, + {"udp6", udp6RequestBuffer, udp6RequestDecode}, } for _, tt := range tests { @@ -259,9 +359,13 @@ func BenchmarkDecode(b *testing.B) { name string buf []byte }{ - {"icmp", icmpRequestBuffer}, + {"tcp4", tcp4PacketBuffer}, + {"tcp6", tcp6RequestBuffer}, + {"udp4", udp4RequestBuffer}, + {"udp6", udp6RequestBuffer}, + {"icmp4", icmp4RequestBuffer}, + {"icmp6", icmp6PacketBuffer}, {"unknown", unknownPacketBuffer}, - {"tcp", tcpPacketBuffer}, } for _, bench := range benches { @@ -280,15 +384,15 @@ func TestMarshalRequest(t *testing.T) { var small [20]byte var large [64]byte - icmpHeader := icmpRequestDecode.ICMPHeader() - udpHeader := udpRequestDecode.UDPHeader() + icmpHeader := icmp4RequestDecode.ICMP4Header() + udpHeader := udp4RequestDecode.UDP4Header() tests := []struct { name string header Header want []byte }{ - {"icmp", &icmpHeader, icmpRequestBuffer}, - {"udp", &udpHeader, udpRequestBuffer}, + {"icmp", &icmpHeader, icmp4RequestBuffer}, + {"udp", &udpHeader, udp4RequestBuffer}, } for _, tt := range tests { @@ -317,16 +421,16 @@ func TestMarshalRequest(t *testing.T) { func TestMarshalResponse(t *testing.T) { var buf [64]byte - icmpHeader := icmpRequestDecode.ICMPHeader() - udpHeader := udpRequestDecode.UDPHeader() + icmpHeader := icmp4RequestDecode.ICMP4Header() + udpHeader := udp4RequestDecode.UDP4Header() tests := []struct { name string header Header want []byte }{ - {"icmp", &icmpHeader, icmpReplyBuffer}, - {"udp", &udpHeader, udpReplyBuffer}, + {"icmp", &icmpHeader, icmp4ReplyBuffer}, + {"udp", &udpHeader, udp4ReplyBuffer}, } for _, tt := range tests { diff --git a/net/packet/udp4.go b/net/packet/udp4.go index ecc09b7bb..9a5c06614 100644 --- a/net/packet/udp4.go +++ b/net/packet/udp4.go @@ -14,7 +14,7 @@ type UDP4Header struct { const ( udpHeaderLength = 8 // udpTotalHeaderLength is the length of all headers in a UDP packet. - udpTotalHeaderLength = ipHeaderLength + udpHeaderLength + udpTotalHeaderLength = ip4HeaderLength + udpHeaderLength ) func (UDP4Header) Len() int { diff --git a/wgengine/filter/filter.go b/wgengine/filter/filter.go index 024427d78..466158fb2 100644 --- a/wgengine/filter/filter.go +++ b/wgengine/filter/filter.go @@ -243,7 +243,7 @@ func (f *Filter) runIn(q *packet.Parsed) (r Response, why string) { } switch q.IPProto { - case packet.ICMP: + case packet.ICMPv4: if q.IsEchoResponse() || q.IsError() { // ICMP responses are allowed. // TODO(apenwarr): consider using conntrack state. @@ -383,7 +383,7 @@ func omitDropLogging(p *packet.Parsed, dir direction) bool { // it doesn't know about, so parse it out ourselves if needed. ipProto := p.IPProto if ipProto == 0 && len(b) > 8 { - ipProto = packet.IP4Proto(b[9]) + ipProto = packet.IPProto(b[9]) } // Omit logging about outgoing IGMP. if ipProto == packet.IGMP { diff --git a/wgengine/filter/filter_test.go b/wgengine/filter/filter_test.go index ffec6fa3d..6c5682b79 100644 --- a/wgengine/filter/filter_test.go +++ b/wgengine/filter/filter_test.go @@ -20,7 +20,7 @@ import ( ) var Unknown = packet.Unknown -var ICMP = packet.ICMP +var ICMPv4 = packet.ICMPv4 var TCP = packet.TCP var UDP = packet.UDP var Fragment = packet.Fragment @@ -140,7 +140,7 @@ func TestFilter(t *testing.T) { // Basic {Accept, parsed(TCP, 0x08010101, 0x01020304, 999, 22)}, {Accept, parsed(UDP, 0x08010101, 0x01020304, 999, 22)}, - {Accept, parsed(ICMP, 0x08010101, 0x01020304, 0, 0)}, + {Accept, parsed(ICMPv4, 0x08010101, 0x01020304, 0, 0)}, {Drop, parsed(TCP, 0x08010101, 0x01020304, 0, 0)}, {Accept, parsed(TCP, 0x08010101, 0x01020304, 0, 22)}, {Drop, parsed(TCP, 0x08010101, 0x01020304, 0, 21)}, @@ -250,7 +250,7 @@ func BenchmarkFilter(b *testing.B) { tcpPacket := rawpacket(TCP, 0x08010101, 0x01020304, 999, 22, 0) udpPacket := rawpacket(UDP, 0x08010101, 0x01020304, 999, 22, 0) - icmpPacket := rawpacket(ICMP, 0x08010101, 0x01020304, 0, 0, 0) + icmpPacket := rawpacket(ICMPv4, 0x08010101, 0x01020304, 0, 0, 0) tcpSynPacket := rawpacket(TCP, 0x08010101, 0x01020304, 999, 22, 0) // TCP filtering is trivial (Accept) for non-SYN packets. @@ -299,7 +299,7 @@ func TestPreFilter(t *testing.T) { {"fragment", Accept, rawdefault(Fragment, 40)}, {"tcp", noVerdict, rawdefault(TCP, 200)}, {"udp", noVerdict, rawdefault(UDP, 200)}, - {"icmp", noVerdict, rawdefault(ICMP, 200)}, + {"icmp", noVerdict, rawdefault(ICMPv4, 200)}, } f := NewAllowNone(t.Logf) for _, testPacket := range packets { @@ -312,7 +312,7 @@ func TestPreFilter(t *testing.T) { } } -func parsed(proto packet.IP4Proto, src, dst packet.IP4, sport, dport uint16) packet.Parsed { +func parsed(proto packet.IPProto, src, dst packet.IP4, sport, dport uint16) packet.Parsed { return packet.Parsed{ IPProto: proto, SrcIP4: src, @@ -325,11 +325,11 @@ func parsed(proto packet.IP4Proto, src, dst packet.IP4, sport, dport uint16) pac // rawpacket generates a packet with given source and destination ports and IPs // and resizes the header to trimLength if it is nonzero. -func rawpacket(proto packet.IP4Proto, src, dst packet.IP4, sport, dport uint16, trimLength int) []byte { +func rawpacket(proto packet.IPProto, src, dst packet.IP4, sport, dport uint16, trimLength int) []byte { var headerLength int switch proto { - case ICMP: + case ICMPv4: headerLength = 24 case TCP: headerLength = 40 @@ -357,7 +357,7 @@ func rawpacket(proto packet.IP4Proto, src, dst packet.IP4, sport, dport uint16, bin.PutUint16(hdr[22:24], dport) switch proto { - case ICMP: + case ICMPv4: hdr[9] = 1 case TCP: hdr[9] = 6 @@ -379,7 +379,7 @@ func rawpacket(proto packet.IP4Proto, src, dst packet.IP4, sport, dport uint16, } // rawdefault calls rawpacket with default ports and IPs. -func rawdefault(proto packet.IP4Proto, trimLength int) []byte { +func rawdefault(proto packet.IPProto, trimLength int) []byte { ip := packet.IP4(0x08080808) // 8.8.8.8 port := uint16(53) return rawpacket(proto, ip, ip, port, port, trimLength) diff --git a/wgengine/userspace.go b/wgengine/userspace.go index 909a3d956..564c24b43 100644 --- a/wgengine/userspace.go +++ b/wgengine/userspace.go @@ -372,7 +372,7 @@ func newUserspaceEngineAdvanced(conf EngineConfig) (_ Engine, reterr error) { // echoRespondToAll is an inbound post-filter responding to all echo requests. func echoRespondToAll(p *packet.Parsed, t *tstun.TUN) filter.Response { if p.IsEchoRequest() { - header := p.ICMPHeader() + header := p.ICMP4Header() header.ToResponse() outp := packet.Generate(&header, p.Payload()) t.InjectOutbound(outp)