TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-04-16 03:31:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

wgengine/filter: also silently drop link-local unicast traffic

Browse Source 
Updates #629
This commit is contained in:
Brad Fitzpatrick 2020-09-25 11:47:38 -07:00
parent 5f807c389e
commit 73cc2d8f89
3 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
wgengine/filter/filter.go
View File

@ -371,6 +371,10 @@ func (f *Filter) pre(q *packet.ParsedPacket, rf RunFlags, dir direction) Respons
f.logRateLimit(rf, q, dir, Drop, "multicast") f.logRateLimit(rf, q, dir, Drop, "multicast")
return Drop return Drop
} }
if q.DstIP.IsLinkLocalUnicast() {
f.logRateLimit(rf, q, dir, Drop, "link-local-unicast")
return Drop
}
switch q.IPProto { switch q.IPProto {
case packet.Unknown: case packet.Unknown:
@ -414,7 +418,7 @@ func omitDropLogging(p *packet.ParsedPacket, dir direction) bool {
if ipProto == packet.IGMP { if ipProto == packet.IGMP {
return true return true
} }
if p.DstIP.IsMulticast() { if p.DstIP.IsMulticast() || p.DstIP.IsLinkLocalUnicast() {
return true return true
} }
case 6: case 6:

10
wgengine/filter/filter_test.go
View File

@ -380,17 +380,23 @@ func TestOmitDropLogging(t *testing.T) {
want: true, want: true,
}, },
{ {
name: "v6_multicast_out_low", name: "v4_multicast_out_low",
pkt: &packet.ParsedPacket{IPVersion: 4, DstIP: packet.NewIP(net.ParseIP("224.0.0.0"))}, pkt: &packet.ParsedPacket{IPVersion: 4, DstIP: packet.NewIP(net.ParseIP("224.0.0.0"))},
dir: out, dir: out,
want: true, want: true,
}, },
{ {
name: "v6_multicast_out_high", name: "v4_multicast_out_high",
pkt: &packet.ParsedPacket{IPVersion: 4, DstIP: packet.NewIP(net.ParseIP("239.255.255.255"))}, pkt: &packet.ParsedPacket{IPVersion: 4, DstIP: packet.NewIP(net.ParseIP("239.255.255.255"))},
dir: out, dir: out,
want: true, want: true,
}, },
{
name: "v4_link_local_unicast",
pkt: &packet.ParsedPacket{IPVersion: 4, DstIP: packet.NewIP(net.ParseIP("169.254.1.2"))},
dir: out,
want: true,
},
} }
for _, tt := range tests { for _, tt := range tests {

4
wgengine/packet/ip.go
View File

@ -43,6 +43,10 @@ func (ip IP) IsMulticast() bool {
return byte(ip>>24)&0xf0 == 0xe0 return byte(ip>>24)&0xf0 == 0xe0
} }
func (ip IP) IsLinkLocalUnicast() bool {
return byte(ip>>24) == 169 && byte(ip>>16) == 254
}
// IPProto is either a real IP protocol (ITCP, UDP, ...) or an special value like Unknown. // IPProto is either a real IP protocol (ITCP, UDP, ...) or an special value like Unknown.
// If it is a real IP protocol, its value corresponds to its IP protocol number. // If it is a real IP protocol, its value corresponds to its IP protocol number.
type IPProto uint8 type IPProto uint8