You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/net
Brad Fitzpatrick c1a2e2c380 net/{packet,tstun},wgengine/filter: fix unknown IP protocol handling
01b90df2fa added SCTP support before
(with explicit parsing for ports) and
69de3bf7bf tried to add support for
arbitrary IP protocols (as long as the ACL permited a port of "*",
since we might not know how to find ports from an arbitrary IP
protocol, if it even has such a concept). But apparently that latter
commit wasn't tested end-to-end enough. It had a lot of tests, but the
tests made assumptions about layering that either weren't true, or
regressed since 1.20. Notably, it didn't remove the (*Filter).pre
bidirectional filter that dropped all "unknown" protocol packets both
leaving and entering, even if there were explicit protocol matches
allowing them in.

Also, don't map all unknown protocols to 0. Keep their IP protocol
number parsed so it's matchable by later layers. Only reject illegal
things.

Fixes #6423
Updates #2162
Updates #2163

Change-Id: I9659b3ece86f4db51d644f9b34df78821758842c
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
3 years ago
..
connstats net/connstats: enforce maximum number of connections (#6760) 3 years ago
dns net/dns,userspace: remove unused DNS paths, normalize query limit on iOS 3 years ago
dnscache all: update golang.zx2c4.com/wireguard to github.com/tailscale/wireguard-go (#6692) 3 years ago
dnsfallback all: remove old +build tags 3 years ago
flowtrack net/flowtrack,wgengine/filter: refactor Cache to use generics 3 years ago
interfaces all: update golang.zx2c4.com/wireguard to github.com/tailscale/wireguard-go (#6692) 3 years ago
netaddr all: migrate code from netaddr.FromStdAddr to Go 1.18 3 years ago
netcheck net/netcheck: don't use a space in the captive portal challenge 3 years ago
neterror net/{neterror,dns/resolver}: move PacketWasTruncated to neterror from DNS code 4 years ago
netknob all: disable TCP keep-alives on iOS/Android 4 years ago
netns util/endian: delete package; use updated josharian/native instead 3 years ago
netstat netstat, portlist: update Windows implementation to disambiguate svchost processes 3 years ago
nettest ssh/tailssh: add TestSSHAuthFlow 3 years ago
netutil all: fix spelling mistakes 3 years ago
packet net/{packet,tstun},wgengine/filter: fix unknown IP protocol handling 3 years ago
ping all: fix spelling mistakes 3 years ago
portmapper net/portmapper: relax handling of UPnP resp (#6946) 3 years ago
proxymux net/proxymux: add a listener mux that can run SOCKS and HTTP on a single socket. 4 years ago
routetable all: remove old +build tags 3 years ago
socks5 net/socks5: use new Go 1.19 binary.AppendByteOrder.AppendUintX 3 years ago
speedtest net/speedtest: retune to meet iperf on localhost in a VM 3 years ago
stun net/netcheck: deflake (maybe) magicsock's TestNewConn 3 years ago
tlsdial net/tlsdial,tstest,version: use go command from $PATH 3 years ago
tsaddr net/tsaddr: remove ContainsFunc helpers (they're now in x/exp/slices) 3 years ago
tsdial all: standardize on PeerAPI 3 years ago
tshttpproxy net/tshttpproxy: don't ignore env-based HTTP proxies after system lookups fail 3 years ago
tstun net/{packet,tstun},wgengine/filter: fix unknown IP protocol handling 3 years ago
wsconn net/wsconn: add back custom wrapper for turning a websocket.Conn into a net.Conn 3 years ago