TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-12-01 17:49:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

wgengine/filter, tailcfg: support CIDRs+ranges in PacketFilter (mapver 7)

Browse Source 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick
2020-12-14 08:21:41 -08:00
committed by Brad Fitzpatrick
parent 0681c6da49
commit afcf134812
6 changed files with 117 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
wgengine/filter/filter_test.go
View File

@@ -194,7 +194,7 @@ func TestNoAllocs(t *testing.T) {
}
}
func TestParseIP(t *testing.T) {
func TestParseIPSet(t *testing.T) {
tests := []struct {
host string
bits int
@@ -203,23 +203,33 @@ func TestParseIP(t *testing.T) {
}{
{"8.8.8.8", 24, pfx("8.8.8.8/24"), ""},
{"2601:1234::", 64, pfx("2601:1234::/64"), ""},
{"8.8.8.8", 33, nil, `invalid CIDR size 33 for host "8.8.8.8"`},
{"8.8.8.8", -1, nil, `invalid CIDR size -1 for host "8.8.8.8"`},
{"2601:1234::", 129, nil, `invalid CIDR size 129 for host "2601:1234::"`},
{"0.0.0.0", 24, nil, `ports="0.0.0.0": to allow all IP addresses, use *:port, not 0.0.0.0:port`},
{"::", 64, nil, `ports="::": to allow all IP addresses, use *:port, not [::]:port`},
{"8.8.8.8", 33, nil, `invalid CIDR size 33 for IP "8.8.8.8"`},
{"8.8.8.8", -1, pfx("8.8.8.8/32"), ""},
{"8.8.8.8", 32, pfx("8.8.8.8/32"), ""},
{"8.8.8.8/24", -1, nil, "8.8.8.8/24 contains non-network bits set"},
{"8.8.8.0/24", 18, pfx("8.8.8.0/24"), ""}, // the 18 is ignored
{"1.0.0.0-1.255.255.255", 5, pfx("1.0.0.0/8"), ""},
{"1.0.0.0-2.1.2.3", 5, pfx("1.0.0.0/8", "2.0.0.0/16", "2.1.0.0/23", "2.1.2.0/30"), ""},
{"1.0.0.2-1.0.0.1", -1, nil, "invalid IP range \"1.0.0.2-1.0.0.1\""},
{"2601:1234::", 129, nil, `invalid CIDR size 129 for IP "2601:1234::"`},
{"0.0.0.0", 24, pfx("0.0.0.0/24"), ""},
{"::", 64, pfx("::/64"), ""},
{"*", 24, pfx("0.0.0.0/0", "::/0"), ""},
}
for _, tt := range tests {
got, err := parseIP(tt.host, tt.bits)
var bits *int
if tt.bits != -1 {
bits = &tt.bits
}
got, err := parseIPSet(tt.host, bits)
if err != nil {
if err.Error() == tt.wantErr {
continue
}
t.Errorf("parseIP(%q, %v) error: %v; want error %q", tt.host, tt.bits, err, tt.wantErr)
t.Errorf("parseIPSet(%q, %v) error: %v; want error %q", tt.host, tt.bits, err, tt.wantErr)
}
if diff := cmp.Diff(got, tt.want, cmp.Comparer(func(a, b netaddr.IP) bool { return a == b })); diff != "" {
t.Errorf("parseIP(%q, %v) = %s; want %s", tt.host, tt.bits, got, tt.want)
t.Errorf("parseIPSet(%q, %v) = %s; want %s", tt.host, tt.bits, got, tt.want)
continue
}
}

102
wgengine/filter/tailcfg.go
View File

@@ -6,6 +6,7 @@ package filter
import (
"fmt"
"strings"
"inet.af/netaddr"
"tailscale.com/tailcfg"
@@ -22,11 +23,11 @@ func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) {
m := Match{}
for i, s := range r.SrcIPs {
bits := 32
var bits *int
if len(r.SrcBits) > i {
bits = r.SrcBits[i]
bits = &r.SrcBits[i]
}
nets, err := parseIP(s, bits)
nets, err := parseIPSet(s, bits)
if err != nil && erracc == nil {
erracc = err
continue
@@ -35,11 +36,7 @@ func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) {
}
for _, d := range r.DstPorts {
bits := 32
if d.Bits != nil {
bits = *d.Bits
}
nets, err := parseIP(d.IP, bits)
nets, err := parseIPSet(d.IP, d.Bits)
if err != nil && erracc == nil {
erracc = err
continue
@@ -65,35 +62,80 @@ var (
zeroIP6 = netaddr.IPFrom16([16]byte{})
)
func parseIP(host string, defaultBits int) ([]netaddr.IPPrefix, error) {
if host == "*" {
// User explicitly requested wildcard dst ip.
// parseIPSet parses arg as one:
//
// * an IP address (IPv4 or IPv6)
// * the string "*" to match everything (both IPv4 & IPv6)
// * a CIDR (e.g. "192.168.0.0/16")
// * a range of two IPs, inclusive, separated by hyphen ("2eff::1-2eff::0800")
//
// bits, if non-nil, is the legacy SrcBits CIDR length to make a IP
// address (without a slash) treated as a CIDR of *bits length.
//
// TODO(bradfitz): make this return an IPSet and plumb that all
// around, and ultimately use a new version of IPSet.ContainsFunc like
// Contains16Func that works in [16]byte address, so we we can match
// at runtime without allocating?
func parseIPSet(arg string, bits *int) ([]netaddr.IPPrefix, error) {
if arg == "*" {
// User explicitly requested wildcard.
return []netaddr.IPPrefix{
{IP: zeroIP4, Bits: 0},
{IP: zeroIP6, Bits: 0},
}, nil
}
ip, err := netaddr.ParseIP(host)
if strings.Contains(arg, "/") {
pfx, err := netaddr.ParseIPPrefix(arg)
if err != nil {
return nil, err
}
if pfx != pfx.Masked() {
return nil, fmt.Errorf("%v contains non-network bits set", pfx)
}
return []netaddr.IPPrefix{pfx}, nil
}
if strings.Count(arg, "-") == 1 {
i := strings.Index(arg, "-")
ip1s, ip2s := arg[:i], arg[i+1:]
ip1, err := netaddr.ParseIP(ip1s)
if err != nil {
return nil, err
}
ip2, err := netaddr.ParseIP(ip2s)
if err != nil {
return nil, err
}
r := netaddr.IPRange{From: ip1, To: ip2}
if !r.Valid() {
return nil, fmt.Errorf("invalid IP range %q", arg)
}
return r.Prefixes(), nil
}
ip, err := netaddr.ParseIP(arg)
if err != nil {
return nil, fmt.Errorf("ports=%#v: invalid IP address", host)
}
if ip == zeroIP4 {
// For clarity, reject 0.0.0.0 as an input
return nil, fmt.Errorf("ports=%#v: to allow all IP addresses, use *:port, not 0.0.0.0:port", host)
}
if ip == zeroIP6 {
// For clarity, reject :: as an input
return nil, fmt.Errorf("ports=%#v: to allow all IP addresses, use *:port, not [::]:port", host)
return nil, fmt.Errorf("invalid IP address %q", arg)
}
if defaultBits < 0 || (ip.Is4() && defaultBits > 32) || (ip.Is6() && defaultBits > 128) {
return nil, fmt.Errorf("invalid CIDR size %d for host %q", defaultBits, host)
var bits8 uint8
if ip.Is4() {
bits8 = 32
if bits != nil {
if *bits < 0 || *bits > 32 {
return nil, fmt.Errorf("invalid CIDR size %d for IP %q", *bits, arg)
}
bits8 = uint8(*bits)
}
} else if ip.Is6() {
bits8 = 128
if bits != nil {
if *bits < 0 || *bits > 128 {
return nil, fmt.Errorf("invalid CIDR size %d for IP %q", *bits, arg)
}
bits8 = uint8(*bits)
}
}
return []netaddr.IPPrefix{
{
IP: ip,
Bits: uint8(defaultBits),
},
}, nil
if bits8 == 0 {
return nil, fmt.Errorf("unknown IP type %q", ip)
}
return []netaddr.IPPrefix{{IP: ip, Bits: bits8}}, nil
}