2019-05-31 23:14:04 +00:00
|
|
|
// Copyright 2019 The gVisor Authors.
|
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
2019-07-02 20:48:02 +00:00
|
|
|
package iptables
|
2019-05-31 23:14:04 +00:00
|
|
|
|
2020-01-09 01:30:08 +00:00
|
|
|
import (
|
|
|
|
"gvisor.dev/gvisor/pkg/log"
|
2020-01-09 04:05:02 +00:00
|
|
|
"gvisor.dev/gvisor/pkg/tcpip"
|
2020-02-18 19:30:42 +00:00
|
|
|
"gvisor.dev/gvisor/pkg/tcpip/header"
|
2020-01-09 01:30:08 +00:00
|
|
|
)
|
2019-05-31 23:14:04 +00:00
|
|
|
|
2020-02-07 19:21:07 +00:00
|
|
|
// AcceptTarget accepts packets.
|
|
|
|
type AcceptTarget struct{}
|
2019-05-31 23:14:04 +00:00
|
|
|
|
|
|
|
// Action implements Target.Action.
|
2020-02-25 23:33:59 +00:00
|
|
|
func (AcceptTarget) Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, int) {
|
2020-02-13 00:19:06 +00:00
|
|
|
return RuleAccept, 0
|
2019-05-31 23:14:04 +00:00
|
|
|
}
|
|
|
|
|
2020-02-07 19:21:07 +00:00
|
|
|
// DropTarget drops packets.
|
|
|
|
type DropTarget struct{}
|
2019-05-31 23:14:04 +00:00
|
|
|
|
|
|
|
// Action implements Target.Action.
|
2020-02-25 23:33:59 +00:00
|
|
|
func (DropTarget) Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, int) {
|
2020-02-13 00:19:06 +00:00
|
|
|
return RuleDrop, 0
|
2019-05-31 23:14:04 +00:00
|
|
|
}
|
2019-12-12 23:48:24 +00:00
|
|
|
|
2020-01-09 01:30:08 +00:00
|
|
|
// ErrorTarget logs an error and drops the packet. It represents a target that
|
|
|
|
// should be unreachable.
|
|
|
|
type ErrorTarget struct{}
|
2019-12-12 23:48:24 +00:00
|
|
|
|
2020-01-13 19:26:26 +00:00
|
|
|
// Action implements Target.Action.
|
2020-02-25 23:33:59 +00:00
|
|
|
func (ErrorTarget) Action(packet tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, int) {
|
2020-02-07 19:21:07 +00:00
|
|
|
log.Debugf("ErrorTarget triggered.")
|
2020-02-13 00:19:06 +00:00
|
|
|
return RuleDrop, 0
|
2020-02-07 19:21:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// UserChainTarget marks a rule as the beginning of a user chain.
|
|
|
|
type UserChainTarget struct {
|
|
|
|
Name string
|
|
|
|
}
|
|
|
|
|
|
|
|
// Action implements Target.Action.
|
2020-02-25 23:33:59 +00:00
|
|
|
func (UserChainTarget) Action(tcpip.PacketBuffer, IPHeaderFilter) (RuleVerdict, int) {
|
2020-02-07 19:21:07 +00:00
|
|
|
panic("UserChainTarget should never be called.")
|
|
|
|
}
|
|
|
|
|
|
|
|
// ReturnTarget returns from the current chain. If the chain is a built-in, the
|
|
|
|
// hook's underflow should be called.
|
|
|
|
type ReturnTarget struct{}
|
|
|
|
|
|
|
|
// Action implements Target.Action.
|
2020-02-25 23:33:59 +00:00
|
|
|
func (ReturnTarget) Action(tcpip.PacketBuffer, IPHeaderFilter) (RuleVerdict, int) {
|
2020-02-13 00:19:06 +00:00
|
|
|
return RuleReturn, 0
|
2019-12-12 23:48:24 +00:00
|
|
|
}
|
2020-02-18 19:30:42 +00:00
|
|
|
|
|
|
|
// RedirectTarget redirects the packet by modifying the destination port/IP.
|
2020-02-25 23:03:51 +00:00
|
|
|
// Min and Max values for IP and Ports in the struct indicate the range of
|
|
|
|
// values which can be used to redirect.
|
2020-02-18 19:30:42 +00:00
|
|
|
type RedirectTarget struct {
|
2020-02-25 23:03:51 +00:00
|
|
|
// Flags to check if the redirect is for address or ports.
|
|
|
|
Flags uint32
|
2020-02-18 19:30:42 +00:00
|
|
|
|
2020-02-25 23:03:51 +00:00
|
|
|
// Min address used to redirect.
|
|
|
|
MinIP tcpip.Address
|
|
|
|
|
|
|
|
// Max address used to redirect.
|
|
|
|
MaxIP tcpip.Address
|
2020-02-18 19:30:42 +00:00
|
|
|
|
2020-02-25 23:03:51 +00:00
|
|
|
// Min port used to redirect.
|
|
|
|
MinPort uint16
|
2020-02-18 19:30:42 +00:00
|
|
|
|
2020-02-25 23:03:51 +00:00
|
|
|
// Max port used to redirect.
|
|
|
|
MaxPort uint16
|
|
|
|
}
|
|
|
|
|
|
|
|
// Action implements Target.Action.
|
2020-02-25 23:33:59 +00:00
|
|
|
func (rt RedirectTarget) Action(pkt tcpip.PacketBuffer, filter IPHeaderFilter) (RuleVerdict, int) {
|
2020-02-25 23:03:51 +00:00
|
|
|
headerView := pkt.Data.First()
|
|
|
|
|
|
|
|
// Network header should be set.
|
|
|
|
netHeader := header.IPv4(headerView)
|
|
|
|
if netHeader == nil {
|
2020-02-25 23:33:59 +00:00
|
|
|
return RuleDrop, 0
|
2020-02-25 23:03:51 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// TODO(gvisor.dev/issue/170): Check Flags in RedirectTarget if
|
|
|
|
// we need to change dest address (for OUTPUT chain) or ports.
|
|
|
|
hlen := int(netHeader.HeaderLength())
|
|
|
|
|
|
|
|
switch protocol := filter.Protocol; protocol {
|
|
|
|
case header.UDPProtocolNumber:
|
|
|
|
udp := header.UDP(headerView[hlen:])
|
|
|
|
udp.SetDestinationPort(rt.MinPort)
|
|
|
|
case header.TCPProtocolNumber:
|
|
|
|
// TODO(gvisor.dev/issue/170): Need to recompute checksum
|
|
|
|
// and implement nat connection tracking to support TCP.
|
|
|
|
tcp := header.TCP(headerView[hlen:])
|
|
|
|
tcp.SetDestinationPort(rt.MinPort)
|
|
|
|
default:
|
2020-02-25 23:33:59 +00:00
|
|
|
return RuleDrop, 0
|
2020-02-25 23:03:51 +00:00
|
|
|
}
|
2020-02-25 23:33:59 +00:00
|
|
|
return RuleAccept, 0
|
2020-02-18 19:30:42 +00:00
|
|
|
}
|