TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-04-02 14:32:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

wgengine/filter: add check for unknown proto

Browse Source 
Updates #14280

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
This commit is contained in:
Kristoffer Dalby 2025-01-08 10:53:07 +01:00 committed by Kristoffer Dalby
parent f39ee8e520
commit f0b63d0eec
3 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
util/usermetric/metrics.go
View File

@ -41,6 +41,9 @@ const (
// ReasonFragment means that the packet was dropped because it was an IP fragment. // ReasonFragment means that the packet was dropped because it was an IP fragment.
ReasonFragment DropReason = "fragment" ReasonFragment DropReason = "fragment"
// ReasonUnknownProtocol means that the packet was dropped because it was an unknown protocol.
ReasonUnknownProtocol DropReason = "unknown_protocol"
// ReasonError means that the packet was dropped because of an error. // ReasonError means that the packet was dropped because of an error.
ReasonError DropReason = "error" ReasonError DropReason = "error"
) )

5
wgengine/filter/filter.go
View File

@ -621,6 +621,11 @@ func (f *Filter) pre(q *packet.Parsed, rf RunFlags, dir direction) (Response, us
return Drop, usermetric.ReasonTooShort return Drop, usermetric.ReasonTooShort
} }
if q.IPProto == ipproto.Unknown {
f.logRateLimit(rf, q, dir, Drop, "unknown proto")
return Drop, usermetric.ReasonUnknownProtocol
}
if q.Dst.Addr().IsMulticast() { if q.Dst.Addr().IsMulticast() {
f.logRateLimit(rf, q, dir, Drop, "multicast") f.logRateLimit(rf, q, dir, Drop, "multicast")
return Drop, usermetric.ReasonMulticast return Drop, usermetric.ReasonMulticast

3
wgengine/filter/filter_test.go
View File

@ -390,7 +390,8 @@ func TestPreFilter(t *testing.T) {
}{ }{
{"empty", Accept, "", []byte{}}, {"empty", Accept, "", []byte{}},
{"short", Drop, usermetric.ReasonTooShort, []byte("short")}, {"short", Drop, usermetric.ReasonTooShort, []byte("short")},
{"junk", Drop, "", raw4default(ipproto.Unknown, 10)}, {"short-junk", Drop, usermetric.ReasonTooShort, raw4default(ipproto.Unknown, 10)},
{"long-junk", Drop, usermetric.ReasonUnknownProtocol, raw4default(ipproto.Unknown, 21)},
{"fragment", Accept, "", raw4default(ipproto.Fragment, 40)}, {"fragment", Accept, "", raw4default(ipproto.Fragment, 40)},
{"tcp", noVerdict, "", raw4default(ipproto.TCP, 0)}, {"tcp", noVerdict, "", raw4default(ipproto.TCP, 0)},
{"udp", noVerdict, "", raw4default(ipproto.UDP, 0)}, {"udp", noVerdict, "", raw4default(ipproto.UDP, 0)},