Commit Graph

222 Commits

Author SHA1 Message Date
gVisor bot bcca56ffe6 Merge release-20210208.0-71-g2a2cb29e1 (automated) 2021-02-18 20:34:57 +00:00
Arthur Sfez 2a2cb29e1c Validate IGMP packets
This change also adds support for Router Alert option processing on
incoming packets, a new stat for Router Alert option, and exports
all the IP-option related stats.

Fixes #5491

PiperOrigin-RevId: 358238123
2021-02-18 12:29:54 -08:00
gVisor bot e82d147017 Merge release-20210125.0-47-gebd3912c0 (automated) 2021-02-01 20:21:37 +00:00
Ghanan Gowripalan ebd3912c0f Refactor HandleControlPacket/SockError
...to remove the need for the transport layer to deduce the type of
error it received.

Rename HandleControlPacket to HandleError as HandleControlPacket only
handles errors.

tcpip.SockError now holds a tcpip.SockErrorCause interface that
different errors can implement.

PiperOrigin-RevId: 354994306
2021-02-01 12:04:03 -08:00
gVisor bot ed0a3c9243 Merge release-20210125.0-21-g8d1afb418 (automated) 2021-01-29 02:16:39 +00:00
Tamir Duberstein 8d1afb4185 Change tcpip.Error to an interface
This makes it possible to add data to types that implement tcpip.Error.
ErrBadLinkEndpoint is removed as it is unused.

PiperOrigin-RevId: 354437314
2021-01-28 17:59:58 -08:00
gVisor bot e4466f04ff Merge release-20210112.0-48-g286516640 (automated) 2021-01-20 23:50:30 +00:00
Julian Elischer 2865166403 Change the way the IP options report problems
The error messages are not needed or used as these are not processing errors
so much as errors to be reported back to the packet sender. Implicitly
describe whether each error should generate ICMP packets or not. Most do
but there are a couple that do not.

Slightly alter some test expectations for Linux compatibility and add a
couple more. Improve Linux compatibility on error packet returns. Some
cosmetic changes to tests to match the upcoming packet impact version
of the same tests.

PiperOrigin-RevId: 352889785
2021-01-20 15:36:03 -08:00
gVisor bot 5c21c7c3bd Merge release-20201208.0-89-g3ff7324df (automated) 2020-12-28 22:05:49 +00:00
Ghanan Gowripalan 620de250a4 Prefer matching labels and longest matching prefix
...when performing source address selection for IPv6.

These are defined in RFC 6724 section 5 rule 6 (prefer matching label)
and rule 8 (use longest matching prefix).

This change also considers ULA of global scope instead of its own scope,
as per RFC 6724 section 3.1:

   Also, note that ULAs are considered as global, not
   site-local, scope but are handled via the prefix policy table as
   discussed in Section 10.6.

Test: stack_test.TestIPv6SourceAddressSelectionScope

Startblock:
  has LGTM from peterjohnston
  and then
  add reviewer brunodalbo
PiperOrigin-RevId: 348580996
2020-12-21 22:26:10 -08:00
Andrei Vagin 946cb909e6 Don't modify a packet header when it can be used by other endpoints
Reported-by: syzbot+48c43f82fe7738fceae9@syzkaller.appspotmail.com
PiperOrigin-RevId: 348540796
2020-12-21 15:50:33 -08:00
Ayush Ranjan 028271b530 [netstack] Implement IP(V6)_RECVERR socket option.
PiperOrigin-RevId: 348055514
2020-12-17 11:10:41 -08:00
gVisor bot 0ac6636aaf Automated rollback of changelist 346565589
PiperOrigin-RevId: 347911316
2020-12-16 15:41:03 -08:00
Ghanan Gowripalan c55e5bda4d Validate router alert's data length
RFC 2711 specifies that the router alert's length field is always 2
so we should make sure only 2 bytes are read from a router alert
option's data field.

Test: header.TestIPv6OptionsExtHdrIterErr
PiperOrigin-RevId: 347727876
2020-12-15 17:45:22 -08:00
gVisor bot 5399efbe29 Merge release-20201208.0-39-g4aef908c9 (automated) 2020-12-12 17:18:09 +00:00
Bruno Dal Bo 4aef908c92 Introduce IPv6 extension header serialization facilities
Adds IPv6 extension header serializer and Hop by Hop options serializer.
Add RouterAlert option serializer and use it in MLD.

Fixed #4996

Startblock:
  has LGTM from marinaciocea
  and then
  add reviewer ghanan
PiperOrigin-RevId: 347174537
2020-12-12 09:07:44 -08:00
gVisor bot 1b5d08596a Merge release-20201130.0-67-gf6cb96bd5 (automated) 2020-12-09 23:55:41 +00:00
Bruno Dal Bo f6cb96bd57 Cap UDP payload size to length informed in UDP header
startblock:
  has LGTM from peterjohnston
  and then
  add reviewer ghanan,tamird
PiperOrigin-RevId: 346565589
2020-12-09 15:52:28 -08:00
gVisor bot 588cab496f Merge release-20201130.0-39-gfd28ccfaa (automated) 2020-12-04 18:14:07 +00:00
Bruno Dal Bo fd28ccfaa4 Introduce IPv4 options serializer and add RouterAlert to IGMP
PiperOrigin-RevId: 345701623
2020-12-04 10:10:56 -08:00
gVisor bot 3927c666bb Merge release-20201109.0-118-gbc81fcced (automated) 2020-11-26 02:03:52 +00:00
Ghanan Gowripalan bc81fcceda Support listener-side MLDv1
...as defined by RFC 2710. Querier (router)-side MLDv1 is not yet
supported.

The core state machine is shared with IGMPv2.

This is guarded behind a flag (ipv6.Options.MLDEnabled).

Tests: ip_test.TestMGP*

Bug #4861

PiperOrigin-RevId: 344344095
2020-11-25 18:00:41 -08:00
gVisor bot 5a994e663e Merge release-20201109.0-113-g4da63dc82 (automated) 2020-11-24 23:28:53 +00:00
Julian Elischer 4da63dc82e Report correct pointer value for "bad next header" ICMP error
Because the code handles a bad header as "payload" right up to the last moment
we need to make sure payload handling does not remove the error information.

Fixes #4909

PiperOrigin-RevId: 344141690
2020-11-24 15:25:40 -08:00
gVisor bot 502c7c4ed4 Merge release-20201109.0-107-gba2d5cb7e (automated) 2020-11-24 06:51:09 +00:00
Ghanan Gowripalan ba2d5cb7e1 Use time.Duration for IGMP Max Response Time field
Bug #4682

PiperOrigin-RevId: 343993297
2020-11-23 22:47:55 -08:00
gVisor bot f6c627bdbc Merge release-20201109.0-95-gfbc4a8dbd (automated) 2020-11-20 02:18:35 +00:00
Ryan Heacock fbc4a8dbd1 Perform IGMPv2 when joining IPv4 multicast groups
Added headers, stats, checksum parsing capabilities from RFC 2236 describing
IGMPv2.

IGMPv2 state machine is implemented for each condition, sending and receiving
IGMP Membership Reports and Leave Group messages with backwards compatibility
with IGMPv1 routers.

Test:
* Implemented igmp header parser and checksum calculator in header/igmp_test.go
* ipv4/igmp_test.go tests incoming and outgoing IGMP messages and pathways.
* Added unit test coverage for IGMPv2 RFC behavior + IGMPv1 backwards
   compatibility in ipv4/igmp_test.go.

Fixes #4682

PiperOrigin-RevId: 343408809
2020-11-19 18:15:25 -08:00
gVisor bot 85438cb6ca Merge release-20201109.0-92-g4cf7956dd (automated) 2020-11-20 00:22:36 +00:00
Ghanan Gowripalan 4cf7956dde Add types to parse MLD messages
Preparing for upcoming CLs that add MLD functionality.

Bug #4861

Test: header.TestMLD
PiperOrigin-RevId: 343391556
2020-11-19 16:19:24 -08:00
gVisor bot 3765559c4b Merge release-20201109.0-49-g758e45618 (automated) 2020-11-16 21:09:53 +00:00
Toshi Kikuchi 758e45618f Clean up fragmentation.Process
- Pass a PacketBuffer directly instead of releaseCB
- No longer pass a VectorisedView, which is included in the PacketBuffer
- Make it an error if data size is not equal to (last - first + 1)
- Set the callback for the reassembly timeout on NewFragmentation

PiperOrigin-RevId: 342702432
2020-11-16 13:06:38 -08:00
gVisor bot d993a11037 Merge release-20201030.0-95-g0fee59c8c (automated) 2020-11-14 01:16:29 +00:00
Julian Elischer 0fee59c8c8 Requested Comment/Message wording changes
PiperOrigin-RevId: 342366891
2020-11-13 17:13:11 -08:00
gVisor bot 4e9636928b Merge release-20201030.0-91-g6c0f53002 (automated) 2020-11-13 21:17:13 +00:00
Ghanan Gowripalan 6c0f53002a Decrement TTL/Hop Limit when forwarding IP packets
If the packet must no longer be forwarded because its TTL/Hop Limit
reaches 0, send an ICMP Time Exceeded error to the source.

Required as per relevant RFCs. See comments in code for RFC references.

Fixes #1085

Tests:
  - ipv4_test.TestForwarding
  - ipv6.TestForwarding
PiperOrigin-RevId: 342323610
2020-11-13 13:13:21 -08:00
gVisor bot 77f5e9c854 Merge release-20201030.0-80-g638d64c63 (automated) 2020-11-13 02:42:15 +00:00
Julian Elischer 638d64c633 Change AllocationSize to SizeWithPadding as requested
RELNOTES: n/a
PiperOrigin-RevId: 342176296
2020-11-12 18:38:43 -08:00
gVisor bot efaa2c8edb Merge release-20201030.0-77-gd700ba22a (automated) 2020-11-13 01:53:47 +00:00
Julian Elischer d700ba22ab Pad with a loop rather than a copy from an allocation.
Add a unit test for ipv4.Encode and a round trip test.

PiperOrigin-RevId: 342169517
2020-11-12 17:50:24 -08:00
gVisor bot 60cccae0c7 Merge release-20201030.0-68-g9c4102896 (automated) 2020-11-11 19:02:45 +00:00
Julian Elischer 9c4102896d Teach netstack how to add options to IPv4 packets
Most packets don't have options but they are an integral part of the
standard. Teaching the ipv4 code how to handle them will simplify future
testing and use.  Because Options are so rare it is worth making sure
that the extra work is kept out of the fast path as much as possible.

Prior to this change, all usages of the IHL field of the IPv4Fields/Encode
system set it to the same constant value except in a couple of tests
for bad values. From this change IHL will not be a constant as it will
depend on the size of any Options. Since ipv4.Encode() now handles the
options it becomes a possible source of errors to let the callers set
this value, so remove it entirely and calculate the value from the size
of the Options if present (or not) therefore guaranteeing a correct value.

Fixes #4709
RELNOTES: n/a
PiperOrigin-RevId: 341864765
2020-11-11 10:59:35 -08:00
gVisor bot 2929b6f1f8 Merge release-20201019.0-115-gdf88f223b (automated) 2020-10-31 08:22:56 +00:00
Andrei Vagin df88f223bb net/tcpip: connect to unset loopback address has to return EADDRNOTAVAIL
In the docker container, the ipv6 loopback address is not set,
and connect("::1") has to return ENEADDRNOTAVAIL in this case.

Without this fix, it returns EHOSTUNREACH.

PiperOrigin-RevId: 340002915
2020-10-31 01:19:40 -07:00
gVisor bot 6b463fe2b7 Merge release-20201019.0-76-g035b1c827 (automated) 2020-10-28 02:35:11 +00:00
Julian Elischer 035b1c8272 Add support for Timestamp and RecordRoute IP options
IPv4 options extend the size of the IP header and have a basic known
format. The framework can process that format without needing to know
about every possible option. We can add more code to handle additional
option types as we need them. Bad options or mangled option entries
can result in ICMP Parameter Problem packets. The first types we
support are the Timestamp option and the Record Route option, included
in this change.

The options are processed at several points in the packet flow within
the Network stack, with slightly different requirements. The framework
includes a mechanism to control this at each point. Support has been
added for such points which are only present in upcoming CLs such as
during packet forwarding and fragmentation.

With this change, 'ping -R' and 'ping -T' work against gVisor and Fuchsia.

$ ping -R 192.168.1.2
PING 192.168.1.2 (192.168.1.2) 56(124) bytes of data.
64 bytes from 192.168.1.2: icmp_seq=1 ttl=64 time=0.990 ms
NOP
RR:     192.168.1.1
        192.168.1.2
        192.168.1.1

$ ping -T tsprespec 192.168.1.2 192.168.1.1 192.168.1.2
PING 192.168.1.2 (192.168.1.2) 56(124) bytes of data.
64 bytes from 192.168.1.2: icmp_seq=1 ttl=64 time=1.20 ms
TS:     192.168.1.2    71486821 absolute
        192.168.1.1    746

Unit tests included for generic options, Timestamp options
and Record Route options.

PiperOrigin-RevId: 339379076
2020-10-27 19:32:09 -07:00
gVisor bot 8ba0071e50 Merge release-20201019.0-56-g0a035a101 (automated) 2020-10-24 07:27:50 +00:00
Toshi Kikuchi 0a035a1011 Send ICMP error message if IP fragment reassembly fails
Fixes #4427, #4428

PiperOrigin-RevId: 338805047
2020-10-24 00:19:15 -07:00
gVisor bot 4aeb88453f Merge release-20201019.0-29-g58a3c2d44 (automated) 2020-10-22 05:15:02 +00:00
Arthur Sfez 58a3c2d44f Add underflow check when calculating the MTU
Also enforce the minimum MTU for IPv4 and IPv6, and discard packets if the
minimum is not met.

PiperOrigin-RevId: 338404225
2020-10-21 22:12:13 -07:00