2019-04-29 21:25:05 +00:00
|
|
|
// Copyright 2018 The gVisor Authors.
|
2018-04-27 17:37:02 +00:00
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
package epsocket
|
|
|
|
|
|
|
|
import (
|
|
|
|
"syscall"
|
|
|
|
|
2019-06-13 23:49:09 +00:00
|
|
|
"gvisor.dev/gvisor/pkg/abi/linux"
|
|
|
|
"gvisor.dev/gvisor/pkg/sentry/context"
|
|
|
|
"gvisor.dev/gvisor/pkg/sentry/fs"
|
|
|
|
"gvisor.dev/gvisor/pkg/sentry/kernel"
|
|
|
|
"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
|
|
|
|
"gvisor.dev/gvisor/pkg/sentry/socket"
|
|
|
|
"gvisor.dev/gvisor/pkg/syserr"
|
|
|
|
"gvisor.dev/gvisor/pkg/tcpip"
|
|
|
|
"gvisor.dev/gvisor/pkg/tcpip/header"
|
|
|
|
"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
|
|
|
|
"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
|
|
|
|
"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
|
|
|
|
"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
|
|
|
|
"gvisor.dev/gvisor/pkg/waiter"
|
2018-04-27 17:37:02 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// provider is an inet socket provider.
|
|
|
|
type provider struct {
|
|
|
|
family int
|
|
|
|
netProto tcpip.NetworkProtocolNumber
|
|
|
|
}
|
|
|
|
|
2019-02-27 22:30:20 +00:00
|
|
|
// getTransportProtocol figures out transport protocol. Currently only TCP,
|
2019-07-13 01:08:03 +00:00
|
|
|
// UDP, and ICMP are supported. The bool return value is true when this socket
|
|
|
|
// is associated with a transport protocol. This is only false for SOCK_RAW,
|
|
|
|
// IPPROTO_IP sockets.
|
|
|
|
func getTransportProtocol(ctx context.Context, stype linux.SockType, protocol int) (tcpip.TransportProtocolNumber, bool, *syserr.Error) {
|
2018-04-27 17:37:02 +00:00
|
|
|
switch stype {
|
|
|
|
case linux.SOCK_STREAM:
|
|
|
|
if protocol != 0 && protocol != syscall.IPPROTO_TCP {
|
2019-07-13 01:08:03 +00:00
|
|
|
return 0, true, syserr.ErrInvalidArgument
|
2018-04-27 17:37:02 +00:00
|
|
|
}
|
2019-07-13 01:08:03 +00:00
|
|
|
return tcp.ProtocolNumber, true, nil
|
2018-04-27 17:37:02 +00:00
|
|
|
|
|
|
|
case linux.SOCK_DGRAM:
|
2018-05-02 05:50:55 +00:00
|
|
|
switch protocol {
|
|
|
|
case 0, syscall.IPPROTO_UDP:
|
2019-07-13 01:08:03 +00:00
|
|
|
return udp.ProtocolNumber, true, nil
|
2018-05-02 05:50:55 +00:00
|
|
|
case syscall.IPPROTO_ICMP:
|
2019-07-13 01:08:03 +00:00
|
|
|
return header.ICMPv4ProtocolNumber, true, nil
|
2018-05-02 05:50:55 +00:00
|
|
|
case syscall.IPPROTO_ICMPV6:
|
2019-07-13 01:08:03 +00:00
|
|
|
return header.ICMPv6ProtocolNumber, true, nil
|
2018-04-27 17:37:02 +00:00
|
|
|
}
|
2019-02-27 22:30:20 +00:00
|
|
|
|
|
|
|
case linux.SOCK_RAW:
|
|
|
|
// Raw sockets require CAP_NET_RAW.
|
|
|
|
creds := auth.CredentialsFromContext(ctx)
|
|
|
|
if !creds.HasCapability(linux.CAP_NET_RAW) {
|
2019-09-26 22:07:59 +00:00
|
|
|
return 0, true, syserr.ErrNotPermitted
|
2019-02-27 22:30:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
switch protocol {
|
|
|
|
case syscall.IPPROTO_ICMP:
|
2019-07-13 01:08:03 +00:00
|
|
|
return header.ICMPv4ProtocolNumber, true, nil
|
2019-05-22 20:44:07 +00:00
|
|
|
case syscall.IPPROTO_UDP:
|
2019-07-13 01:08:03 +00:00
|
|
|
return header.UDPProtocolNumber, true, nil
|
2019-05-22 20:44:07 +00:00
|
|
|
case syscall.IPPROTO_TCP:
|
2019-07-13 01:08:03 +00:00
|
|
|
return header.TCPProtocolNumber, true, nil
|
|
|
|
// IPPROTO_RAW signifies that the raw socket isn't assigned to
|
|
|
|
// a transport protocol. Users will be able to write packets'
|
|
|
|
// IP headers and won't receive anything.
|
|
|
|
case syscall.IPPROTO_RAW:
|
|
|
|
return tcpip.TransportProtocolNumber(0), false, nil
|
2019-02-27 22:30:20 +00:00
|
|
|
}
|
2018-04-27 17:37:02 +00:00
|
|
|
}
|
2019-07-13 01:08:03 +00:00
|
|
|
return 0, true, syserr.ErrProtocolNotSupported
|
2018-04-27 17:37:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Socket creates a new socket object for the AF_INET or AF_INET6 family.
|
2019-06-06 23:59:21 +00:00
|
|
|
func (p *provider) Socket(t *kernel.Task, stype linux.SockType, protocol int) (*fs.File, *syserr.Error) {
|
2018-04-27 17:37:02 +00:00
|
|
|
// Fail right away if we don't have a stack.
|
|
|
|
stack := t.NetworkContext()
|
|
|
|
if stack == nil {
|
|
|
|
// Don't propagate an error here. Instead, allow the socket
|
|
|
|
// code to continue searching for another provider.
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
eps, ok := stack.(*Stack)
|
|
|
|
if !ok {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Figure out the transport protocol.
|
2019-07-13 01:08:03 +00:00
|
|
|
transProto, associated, err := getTransportProtocol(t, stype, protocol)
|
2018-04-27 17:37:02 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Create the endpoint.
|
2019-02-27 22:30:20 +00:00
|
|
|
var ep tcpip.Endpoint
|
|
|
|
var e *tcpip.Error
|
2018-04-27 17:37:02 +00:00
|
|
|
wq := &waiter.Queue{}
|
2019-02-27 22:30:20 +00:00
|
|
|
if stype == linux.SOCK_RAW {
|
2019-07-13 01:08:03 +00:00
|
|
|
ep, e = eps.Stack.NewRawEndpoint(transProto, p.netProto, wq, associated)
|
2019-02-27 22:30:20 +00:00
|
|
|
} else {
|
|
|
|
ep, e = eps.Stack.NewEndpoint(transProto, p.netProto, wq)
|
|
|
|
}
|
2018-04-27 17:37:02 +00:00
|
|
|
if e != nil {
|
|
|
|
return nil, syserr.TranslateNetstackError(e)
|
|
|
|
}
|
|
|
|
|
2019-06-14 00:23:35 +00:00
|
|
|
return New(t, p.family, stype, int(transProto), wq, ep)
|
2018-04-27 17:37:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Pair just returns nil sockets (not supported).
|
2019-06-06 23:59:21 +00:00
|
|
|
func (*provider) Pair(*kernel.Task, linux.SockType, int) (*fs.File, *fs.File, *syserr.Error) {
|
2018-04-27 17:37:02 +00:00
|
|
|
return nil, nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// init registers socket providers for AF_INET and AF_INET6.
|
|
|
|
func init() {
|
|
|
|
// Providers backed by netstack.
|
|
|
|
p := []provider{
|
|
|
|
{
|
|
|
|
family: linux.AF_INET,
|
|
|
|
netProto: ipv4.ProtocolNumber,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
family: linux.AF_INET6,
|
|
|
|
netProto: ipv6.ProtocolNumber,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for i := range p {
|
|
|
|
socket.RegisterProvider(p[i].family, &p[i])
|
|
|
|
}
|
|
|
|
}
|