TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-02-27 10:47:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

wgengine/filter: add protocol-agnostic packet checker (#10446)

Browse Source 
For use in ACL tests, we need a way to check whether a packet is allowed
not just with TCP, but any protocol.

Updates #3561

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
This commit is contained in:
Andrew Lytvynov 2023-12-02 16:30:33 -06:00 committed by GitHub
parent c85532270f
commit 263e01c47b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
wgengine/filter/filter.go
View File

@ -300,9 +300,9 @@ var dummyPacket = []byte{
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
} }
// CheckTCP determines whether TCP traffic from srcIP to dstIP:dstPort // Check determines whether traffic from srcIP to dstIP:dstPort is allowed
// is allowed. // using protocol proto.
func (f *Filter) CheckTCP(srcIP, dstIP netip.Addr, dstPort uint16) Response { func (f *Filter) Check(srcIP, dstIP netip.Addr, dstPort uint16, proto ipproto.Proto) Response {
pkt := &packet.Parsed{} pkt := &packet.Parsed{}
pkt.Decode(dummyPacket) // initialize private fields pkt.Decode(dummyPacket) // initialize private fields
switch { switch {
@ -319,12 +319,20 @@ func (f *Filter) CheckTCP(srcIP, dstIP netip.Addr, dstPort uint16) Response {
} }
pkt.Src = netip.AddrPortFrom(srcIP, 0) pkt.Src = netip.AddrPortFrom(srcIP, 0)
pkt.Dst = netip.AddrPortFrom(dstIP, dstPort) pkt.Dst = netip.AddrPortFrom(dstIP, dstPort)
pkt.IPProto = ipproto.TCP pkt.IPProto = proto
pkt.TCPFlags = packet.TCPSyn if proto == ipproto.TCP {
pkt.TCPFlags = packet.TCPSyn
}
return f.RunIn(pkt, 0) return f.RunIn(pkt, 0)
} }
// CheckTCP determines whether TCP traffic from srcIP to dstIP:dstPort
// is allowed.
func (f *Filter) CheckTCP(srcIP, dstIP netip.Addr, dstPort uint16) Response {
return f.Check(srcIP, dstIP, dstPort, ipproto.TCP)
}
// CapsWithValues appends to base the capabilities that srcIP has talking // CapsWithValues appends to base the capabilities that srcIP has talking
// to dstIP. // to dstIP.
func (f *Filter) CapsWithValues(srcIP, dstIP netip.Addr) tailcfg.PeerCapMap { func (f *Filter) CapsWithValues(srcIP, dstIP netip.Addr) tailcfg.PeerCapMap {