2194 lines
67 KiB
Go
2194 lines
67 KiB
Go
// Copyright 2018 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// Package stack provides the glue between networking protocols and the
|
|
// consumers of the networking stack.
|
|
//
|
|
// For consumers, the only function of interest is New(), everything else is
|
|
// provided by the tcpip/public package.
|
|
package stack
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/binary"
|
|
"fmt"
|
|
"io"
|
|
mathrand "math/rand"
|
|
"sync/atomic"
|
|
"time"
|
|
|
|
"golang.org/x/time/rate"
|
|
"gvisor.dev/gvisor/pkg/rand"
|
|
"gvisor.dev/gvisor/pkg/sync"
|
|
"gvisor.dev/gvisor/pkg/tcpip"
|
|
"gvisor.dev/gvisor/pkg/tcpip/buffer"
|
|
"gvisor.dev/gvisor/pkg/tcpip/header"
|
|
"gvisor.dev/gvisor/pkg/tcpip/ports"
|
|
"gvisor.dev/gvisor/pkg/tcpip/seqnum"
|
|
"gvisor.dev/gvisor/pkg/waiter"
|
|
)
|
|
|
|
const (
|
|
// ageLimit is set to the same cache stale time used in Linux.
|
|
ageLimit = 1 * time.Minute
|
|
// resolutionTimeout is set to the same ARP timeout used in Linux.
|
|
resolutionTimeout = 1 * time.Second
|
|
// resolutionAttempts is set to the same ARP retries used in Linux.
|
|
resolutionAttempts = 3
|
|
|
|
// DefaultTOS is the default type of service value for network endpoints.
|
|
DefaultTOS = 0
|
|
)
|
|
|
|
type transportProtocolState struct {
|
|
proto TransportProtocol
|
|
defaultHandler func(id TransportEndpointID, pkt *PacketBuffer) bool
|
|
}
|
|
|
|
// TCPProbeFunc is the expected function type for a TCP probe function to be
|
|
// passed to stack.AddTCPProbe.
|
|
type TCPProbeFunc func(s TCPEndpointState)
|
|
|
|
// TCPCubicState is used to hold a copy of the internal cubic state when the
|
|
// TCPProbeFunc is invoked.
|
|
type TCPCubicState struct {
|
|
WLastMax float64
|
|
WMax float64
|
|
T time.Time
|
|
TimeSinceLastCongestion time.Duration
|
|
C float64
|
|
K float64
|
|
Beta float64
|
|
WC float64
|
|
WEst float64
|
|
}
|
|
|
|
// TCPRACKState is used to hold a copy of the internal RACK state when the
|
|
// TCPProbeFunc is invoked.
|
|
type TCPRACKState struct {
|
|
XmitTime time.Time
|
|
EndSequence seqnum.Value
|
|
FACK seqnum.Value
|
|
RTT time.Duration
|
|
Reord bool
|
|
DSACKSeen bool
|
|
ReoWnd time.Duration
|
|
ReoWndIncr uint8
|
|
ReoWndPersist int8
|
|
RTTSeq seqnum.Value
|
|
}
|
|
|
|
// TCPEndpointID is the unique 4 tuple that identifies a given endpoint.
|
|
type TCPEndpointID struct {
|
|
// LocalPort is the local port associated with the endpoint.
|
|
LocalPort uint16
|
|
|
|
// LocalAddress is the local [network layer] address associated with
|
|
// the endpoint.
|
|
LocalAddress tcpip.Address
|
|
|
|
// RemotePort is the remote port associated with the endpoint.
|
|
RemotePort uint16
|
|
|
|
// RemoteAddress it the remote [network layer] address associated with
|
|
// the endpoint.
|
|
RemoteAddress tcpip.Address
|
|
}
|
|
|
|
// TCPFastRecoveryState holds a copy of the internal fast recovery state of a
|
|
// TCP endpoint.
|
|
type TCPFastRecoveryState struct {
|
|
// Active if true indicates the endpoint is in fast recovery.
|
|
Active bool
|
|
|
|
// First is the first unacknowledged sequence number being recovered.
|
|
First seqnum.Value
|
|
|
|
// Last is the 'recover' sequence number that indicates the point at
|
|
// which we should exit recovery barring any timeouts etc.
|
|
Last seqnum.Value
|
|
|
|
// MaxCwnd is the maximum value we are permitted to grow the congestion
|
|
// window during recovery. This is set at the time we enter recovery.
|
|
MaxCwnd int
|
|
|
|
// HighRxt is the highest sequence number which has been retransmitted
|
|
// during the current loss recovery phase.
|
|
// See: RFC 6675 Section 2 for details.
|
|
HighRxt seqnum.Value
|
|
|
|
// RescueRxt is the highest sequence number which has been
|
|
// optimistically retransmitted to prevent stalling of the ACK clock
|
|
// when there is loss at the end of the window and no new data is
|
|
// available for transmission.
|
|
// See: RFC 6675 Section 2 for details.
|
|
RescueRxt seqnum.Value
|
|
}
|
|
|
|
// TCPReceiverState holds a copy of the internal state of the receiver for
|
|
// a given TCP endpoint.
|
|
type TCPReceiverState struct {
|
|
// RcvNxt is the TCP variable RCV.NXT.
|
|
RcvNxt seqnum.Value
|
|
|
|
// RcvAcc is the TCP variable RCV.ACC.
|
|
RcvAcc seqnum.Value
|
|
|
|
// RcvWndScale is the window scaling to use for inbound segments.
|
|
RcvWndScale uint8
|
|
|
|
// PendingBufUsed is the number of bytes pending in the receive
|
|
// queue.
|
|
PendingBufUsed int
|
|
}
|
|
|
|
// TCPSenderState holds a copy of the internal state of the sender for
|
|
// a given TCP Endpoint.
|
|
type TCPSenderState struct {
|
|
// LastSendTime is the time at which we sent the last segment.
|
|
LastSendTime time.Time
|
|
|
|
// DupAckCount is the number of Duplicate ACK's received.
|
|
DupAckCount int
|
|
|
|
// SndCwnd is the size of the sending congestion window in packets.
|
|
SndCwnd int
|
|
|
|
// Ssthresh is the slow start threshold in packets.
|
|
Ssthresh int
|
|
|
|
// SndCAAckCount is the number of packets consumed in congestion
|
|
// avoidance mode.
|
|
SndCAAckCount int
|
|
|
|
// Outstanding is the number of packets in flight.
|
|
Outstanding int
|
|
|
|
// SackedOut is the number of packets which have been selectively acked.
|
|
SackedOut int
|
|
|
|
// SndWnd is the send window size in bytes.
|
|
SndWnd seqnum.Size
|
|
|
|
// SndUna is the next unacknowledged sequence number.
|
|
SndUna seqnum.Value
|
|
|
|
// SndNxt is the sequence number of the next segment to be sent.
|
|
SndNxt seqnum.Value
|
|
|
|
// RTTMeasureSeqNum is the sequence number being used for the latest RTT
|
|
// measurement.
|
|
RTTMeasureSeqNum seqnum.Value
|
|
|
|
// RTTMeasureTime is the time when the RTTMeasureSeqNum was sent.
|
|
RTTMeasureTime time.Time
|
|
|
|
// Closed indicates that the caller has closed the endpoint for sending.
|
|
Closed bool
|
|
|
|
// SRTT is the smoothed round-trip time as defined in section 2 of
|
|
// RFC 6298.
|
|
SRTT time.Duration
|
|
|
|
// RTO is the retransmit timeout as defined in section of 2 of RFC 6298.
|
|
RTO time.Duration
|
|
|
|
// RTTVar is the round-trip time variation as defined in section 2 of
|
|
// RFC 6298.
|
|
RTTVar time.Duration
|
|
|
|
// SRTTInited if true indicates take a valid RTT measurement has been
|
|
// completed.
|
|
SRTTInited bool
|
|
|
|
// MaxPayloadSize is the maximum size of the payload of a given segment.
|
|
// It is initialized on demand.
|
|
MaxPayloadSize int
|
|
|
|
// SndWndScale is the number of bits to shift left when reading the send
|
|
// window size from a segment.
|
|
SndWndScale uint8
|
|
|
|
// MaxSentAck is the highest acknowledgement number sent till now.
|
|
MaxSentAck seqnum.Value
|
|
|
|
// FastRecovery holds the fast recovery state for the endpoint.
|
|
FastRecovery TCPFastRecoveryState
|
|
|
|
// Cubic holds the state related to CUBIC congestion control.
|
|
Cubic TCPCubicState
|
|
|
|
// RACKState holds the state related to RACK loss detection algorithm.
|
|
RACKState TCPRACKState
|
|
}
|
|
|
|
// TCPSACKInfo holds TCP SACK related information for a given TCP endpoint.
|
|
type TCPSACKInfo struct {
|
|
// Blocks is the list of SACK Blocks that identify the out of order segments
|
|
// held by a given TCP endpoint.
|
|
Blocks []header.SACKBlock
|
|
|
|
// ReceivedBlocks are the SACK blocks received by this endpoint
|
|
// from the peer endpoint.
|
|
ReceivedBlocks []header.SACKBlock
|
|
|
|
// MaxSACKED is the highest sequence number that has been SACKED
|
|
// by the peer.
|
|
MaxSACKED seqnum.Value
|
|
}
|
|
|
|
// RcvBufAutoTuneParams holds state related to TCP receive buffer auto-tuning.
|
|
type RcvBufAutoTuneParams struct {
|
|
// MeasureTime is the time at which the current measurement
|
|
// was started.
|
|
MeasureTime time.Time
|
|
|
|
// CopiedBytes is the number of bytes copied to user space since
|
|
// this measure began.
|
|
CopiedBytes int
|
|
|
|
// PrevCopiedBytes is the number of bytes copied to userspace in
|
|
// the previous RTT period.
|
|
PrevCopiedBytes int
|
|
|
|
// RcvBufSize is the auto tuned receive buffer size.
|
|
RcvBufSize int
|
|
|
|
// RTT is the smoothed RTT as measured by observing the time between
|
|
// when a byte is first acknowledged and the receipt of data that is at
|
|
// least one window beyond the sequence number that was acknowledged.
|
|
RTT time.Duration
|
|
|
|
// RTTVar is the "round-trip time variation" as defined in section 2
|
|
// of RFC6298.
|
|
RTTVar time.Duration
|
|
|
|
// RTTMeasureSeqNumber is the highest acceptable sequence number at the
|
|
// time this RTT measurement period began.
|
|
RTTMeasureSeqNumber seqnum.Value
|
|
|
|
// RTTMeasureTime is the absolute time at which the current RTT
|
|
// measurement period began.
|
|
RTTMeasureTime time.Time
|
|
|
|
// Disabled is true if an explicit receive buffer is set for the
|
|
// endpoint.
|
|
Disabled bool
|
|
}
|
|
|
|
// TCPEndpointState is a copy of the internal state of a TCP endpoint.
|
|
type TCPEndpointState struct {
|
|
// ID is a copy of the TransportEndpointID for the endpoint.
|
|
ID TCPEndpointID
|
|
|
|
// SegTime denotes the absolute time when this segment was received.
|
|
SegTime time.Time
|
|
|
|
// RcvBufSize is the size of the receive socket buffer for the endpoint.
|
|
RcvBufSize int
|
|
|
|
// RcvBufUsed is the amount of bytes actually held in the receive socket
|
|
// buffer for the endpoint.
|
|
RcvBufUsed int
|
|
|
|
// RcvBufAutoTuneParams is used to hold state variables to compute
|
|
// the auto tuned receive buffer size.
|
|
RcvAutoParams RcvBufAutoTuneParams
|
|
|
|
// RcvClosed if true, indicates the endpoint has been closed for reading.
|
|
RcvClosed bool
|
|
|
|
// SendTSOk is used to indicate when the TS Option has been negotiated.
|
|
// When sendTSOk is true every non-RST segment should carry a TS as per
|
|
// RFC7323#section-1.1.
|
|
SendTSOk bool
|
|
|
|
// RecentTS is the timestamp that should be sent in the TSEcr field of
|
|
// the timestamp for future segments sent by the endpoint. This field is
|
|
// updated if required when a new segment is received by this endpoint.
|
|
RecentTS uint32
|
|
|
|
// TSOffset is a randomized offset added to the value of the TSVal field
|
|
// in the timestamp option.
|
|
TSOffset uint32
|
|
|
|
// SACKPermitted is set to true if the peer sends the TCPSACKPermitted
|
|
// option in the SYN/SYN-ACK.
|
|
SACKPermitted bool
|
|
|
|
// SACK holds TCP SACK related information for this endpoint.
|
|
SACK TCPSACKInfo
|
|
|
|
// SndBufSize is the size of the socket send buffer.
|
|
SndBufSize int
|
|
|
|
// SndBufUsed is the number of bytes held in the socket send buffer.
|
|
SndBufUsed int
|
|
|
|
// SndClosed indicates that the endpoint has been closed for sends.
|
|
SndClosed bool
|
|
|
|
// SndBufInQueue is the number of bytes in the send queue.
|
|
SndBufInQueue seqnum.Size
|
|
|
|
// PacketTooBigCount is used to notify the main protocol routine how
|
|
// many times a "packet too big" control packet is received.
|
|
PacketTooBigCount int
|
|
|
|
// SndMTU is the smallest MTU seen in the control packets received.
|
|
SndMTU int
|
|
|
|
// Receiver holds variables related to the TCP receiver for the endpoint.
|
|
Receiver TCPReceiverState
|
|
|
|
// Sender holds state related to the TCP Sender for the endpoint.
|
|
Sender TCPSenderState
|
|
}
|
|
|
|
// ResumableEndpoint is an endpoint that needs to be resumed after restore.
|
|
type ResumableEndpoint interface {
|
|
// Resume resumes an endpoint after restore. This can be used to restart
|
|
// background workers such as protocol goroutines. This must be called after
|
|
// all indirect dependencies of the endpoint has been restored, which
|
|
// generally implies at the end of the restore process.
|
|
Resume(*Stack)
|
|
}
|
|
|
|
// uniqueIDGenerator is a default unique ID generator.
|
|
type uniqueIDGenerator uint64
|
|
|
|
func (u *uniqueIDGenerator) UniqueID() uint64 {
|
|
return atomic.AddUint64((*uint64)(u), 1)
|
|
}
|
|
|
|
// Stack is a networking stack, with all supported protocols, NICs, and route
|
|
// table.
|
|
type Stack struct {
|
|
transportProtocols map[tcpip.TransportProtocolNumber]*transportProtocolState
|
|
networkProtocols map[tcpip.NetworkProtocolNumber]NetworkProtocol
|
|
|
|
// rawFactory creates raw endpoints. If nil, raw endpoints are
|
|
// disabled. It is set during Stack creation and is immutable.
|
|
rawFactory RawFactory
|
|
|
|
demux *transportDemuxer
|
|
|
|
stats tcpip.Stats
|
|
|
|
// LOCK ORDERING: mu > route.mu.
|
|
route struct {
|
|
mu struct {
|
|
sync.RWMutex
|
|
|
|
table []tcpip.Route
|
|
}
|
|
}
|
|
|
|
mu sync.RWMutex
|
|
nics map[tcpip.NICID]*nic
|
|
|
|
// cleanupEndpointsMu protects cleanupEndpoints.
|
|
cleanupEndpointsMu sync.Mutex
|
|
cleanupEndpoints map[TransportEndpoint]struct{}
|
|
|
|
*ports.PortManager
|
|
|
|
// If not nil, then any new endpoints will have this probe function
|
|
// invoked everytime they receive a TCP segment.
|
|
tcpProbeFunc atomic.Value // TCPProbeFunc
|
|
|
|
// clock is used to generate user-visible times.
|
|
clock tcpip.Clock
|
|
|
|
// handleLocal allows non-loopback interfaces to loop packets.
|
|
handleLocal bool
|
|
|
|
// tables are the iptables packet filtering and manipulation rules.
|
|
// TODO(gvisor.dev/issue/170): S/R this field.
|
|
tables *IPTables
|
|
|
|
// resumableEndpoints is a list of endpoints that need to be resumed if the
|
|
// stack is being restored.
|
|
resumableEndpoints []ResumableEndpoint
|
|
|
|
// icmpRateLimiter is a global rate limiter for all ICMP messages generated
|
|
// by the stack.
|
|
icmpRateLimiter *ICMPRateLimiter
|
|
|
|
// seed is a one-time random value initialized at stack startup
|
|
// and is used to seed the TCP port picking on active connections
|
|
//
|
|
// TODO(gvisor.dev/issue/940): S/R this field.
|
|
seed uint32
|
|
|
|
// nudConfigs is the default NUD configurations used by interfaces.
|
|
nudConfigs NUDConfigurations
|
|
|
|
// nudDisp is the NUD event dispatcher that is used to send the netstack
|
|
// integrator NUD related events.
|
|
nudDisp NUDDispatcher
|
|
|
|
// uniqueIDGenerator is a generator of unique identifiers.
|
|
uniqueIDGenerator UniqueID
|
|
|
|
// randomGenerator is an injectable pseudo random generator that can be
|
|
// used when a random number is required.
|
|
randomGenerator *mathrand.Rand
|
|
|
|
// secureRNG is a cryptographically secure random number generator.
|
|
secureRNG io.Reader
|
|
|
|
// sendBufferSize holds the min/default/max send buffer sizes for
|
|
// endpoints other than TCP.
|
|
sendBufferSize tcpip.SendBufferSizeOption
|
|
|
|
// receiveBufferSize holds the min/default/max receive buffer sizes for
|
|
// endpoints other than TCP.
|
|
receiveBufferSize ReceiveBufferSizeOption
|
|
|
|
// tcpInvalidRateLimit is the maximal rate for sending duplicate
|
|
// acknowledgements in response to incoming TCP packets that are for an existing
|
|
// connection but that are invalid due to any of the following reasons:
|
|
//
|
|
// a) out-of-window sequence number.
|
|
// b) out-of-window acknowledgement number.
|
|
// c) PAWS check failure (when implemented).
|
|
//
|
|
// This is required to prevent potential ACK loops.
|
|
// Setting this to 0 will disable all rate limiting.
|
|
tcpInvalidRateLimit time.Duration
|
|
}
|
|
|
|
// UniqueID is an abstract generator of unique identifiers.
|
|
type UniqueID interface {
|
|
UniqueID() uint64
|
|
}
|
|
|
|
// NetworkProtocolFactory instantiates a network protocol.
|
|
//
|
|
// NetworkProtocolFactory must not attempt to modify the stack, it may only
|
|
// query the stack.
|
|
type NetworkProtocolFactory func(*Stack) NetworkProtocol
|
|
|
|
// TransportProtocolFactory instantiates a transport protocol.
|
|
//
|
|
// TransportProtocolFactory must not attempt to modify the stack, it may only
|
|
// query the stack.
|
|
type TransportProtocolFactory func(*Stack) TransportProtocol
|
|
|
|
// Options contains optional Stack configuration.
|
|
type Options struct {
|
|
// NetworkProtocols lists the network protocols to enable.
|
|
NetworkProtocols []NetworkProtocolFactory
|
|
|
|
// TransportProtocols lists the transport protocols to enable.
|
|
TransportProtocols []TransportProtocolFactory
|
|
|
|
// Clock is an optional clock source used for timestampping packets.
|
|
//
|
|
// If no Clock is specified, the clock source will be time.Now.
|
|
Clock tcpip.Clock
|
|
|
|
// Stats are optional statistic counters.
|
|
Stats tcpip.Stats
|
|
|
|
// HandleLocal indicates whether packets destined to their source
|
|
// should be handled by the stack internally (true) or outside the
|
|
// stack (false).
|
|
HandleLocal bool
|
|
|
|
// UniqueID is an optional generator of unique identifiers.
|
|
UniqueID UniqueID
|
|
|
|
// NUDConfigs is the default NUD configurations used by interfaces.
|
|
NUDConfigs NUDConfigurations
|
|
|
|
// NUDDisp is the NUD event dispatcher that an integrator can provide to
|
|
// receive NUD related events.
|
|
NUDDisp NUDDispatcher
|
|
|
|
// RawFactory produces raw endpoints. Raw endpoints are enabled only if
|
|
// this is non-nil.
|
|
RawFactory RawFactory
|
|
|
|
// RandSource is an optional source to use to generate random
|
|
// numbers. If omitted it defaults to a Source seeded by the data
|
|
// returned by rand.Read().
|
|
//
|
|
// RandSource must be thread-safe.
|
|
RandSource mathrand.Source
|
|
|
|
// IPTables are the initial iptables rules. If nil, iptables will allow
|
|
// all traffic.
|
|
IPTables *IPTables
|
|
|
|
// SecureRNG is a cryptographically secure random number generator.
|
|
SecureRNG io.Reader
|
|
}
|
|
|
|
// TransportEndpointInfo holds useful information about a transport endpoint
|
|
// which can be queried by monitoring tools.
|
|
//
|
|
// +stateify savable
|
|
type TransportEndpointInfo struct {
|
|
// The following fields are initialized at creation time and are
|
|
// immutable.
|
|
|
|
NetProto tcpip.NetworkProtocolNumber
|
|
TransProto tcpip.TransportProtocolNumber
|
|
|
|
// The following fields are protected by endpoint mu.
|
|
|
|
ID TransportEndpointID
|
|
// BindNICID and bindAddr are set via calls to Bind(). They are used to
|
|
// reject attempts to send data or connect via a different NIC or
|
|
// address
|
|
BindNICID tcpip.NICID
|
|
BindAddr tcpip.Address
|
|
// RegisterNICID is the default NICID registered as a side-effect of
|
|
// connect or datagram write.
|
|
RegisterNICID tcpip.NICID
|
|
}
|
|
|
|
// AddrNetProtoLocked unwraps the specified address if it is a V4-mapped V6
|
|
// address and returns the network protocol number to be used to communicate
|
|
// with the specified address. It returns an error if the passed address is
|
|
// incompatible with the receiver.
|
|
//
|
|
// Preconditon: the parent endpoint mu must be held while calling this method.
|
|
func (t *TransportEndpointInfo) AddrNetProtoLocked(addr tcpip.FullAddress, v6only bool) (tcpip.FullAddress, tcpip.NetworkProtocolNumber, tcpip.Error) {
|
|
netProto := t.NetProto
|
|
switch len(addr.Addr) {
|
|
case header.IPv4AddressSize:
|
|
netProto = header.IPv4ProtocolNumber
|
|
case header.IPv6AddressSize:
|
|
if header.IsV4MappedAddress(addr.Addr) {
|
|
netProto = header.IPv4ProtocolNumber
|
|
addr.Addr = addr.Addr[header.IPv6AddressSize-header.IPv4AddressSize:]
|
|
if addr.Addr == header.IPv4Any {
|
|
addr.Addr = ""
|
|
}
|
|
}
|
|
}
|
|
|
|
switch len(t.ID.LocalAddress) {
|
|
case header.IPv4AddressSize:
|
|
if len(addr.Addr) == header.IPv6AddressSize {
|
|
return tcpip.FullAddress{}, 0, &tcpip.ErrInvalidEndpointState{}
|
|
}
|
|
case header.IPv6AddressSize:
|
|
if len(addr.Addr) == header.IPv4AddressSize {
|
|
return tcpip.FullAddress{}, 0, &tcpip.ErrNetworkUnreachable{}
|
|
}
|
|
}
|
|
|
|
switch {
|
|
case netProto == t.NetProto:
|
|
case netProto == header.IPv4ProtocolNumber && t.NetProto == header.IPv6ProtocolNumber:
|
|
if v6only {
|
|
return tcpip.FullAddress{}, 0, &tcpip.ErrNoRoute{}
|
|
}
|
|
default:
|
|
return tcpip.FullAddress{}, 0, &tcpip.ErrInvalidEndpointState{}
|
|
}
|
|
|
|
return addr, netProto, nil
|
|
}
|
|
|
|
// IsEndpointInfo is an empty method to implement the tcpip.EndpointInfo
|
|
// marker interface.
|
|
func (*TransportEndpointInfo) IsEndpointInfo() {}
|
|
|
|
// New allocates a new networking stack with only the requested networking and
|
|
// transport protocols configured with default options.
|
|
//
|
|
// Note, NDPConfigurations will be fixed before being used by the Stack. That
|
|
// is, if an invalid value was provided, it will be reset to the default value.
|
|
//
|
|
// Protocol options can be changed by calling the
|
|
// SetNetworkProtocolOption/SetTransportProtocolOption methods provided by the
|
|
// stack. Please refer to individual protocol implementations as to what options
|
|
// are supported.
|
|
func New(opts Options) *Stack {
|
|
clock := opts.Clock
|
|
if clock == nil {
|
|
clock = &tcpip.StdClock{}
|
|
}
|
|
|
|
if opts.UniqueID == nil {
|
|
opts.UniqueID = new(uniqueIDGenerator)
|
|
}
|
|
|
|
randSrc := opts.RandSource
|
|
if randSrc == nil {
|
|
// Source provided by mathrand.NewSource is not thread-safe so
|
|
// we wrap it in a simple thread-safe version.
|
|
randSrc = &lockedRandomSource{src: mathrand.NewSource(generateRandInt64())}
|
|
}
|
|
|
|
if opts.IPTables == nil {
|
|
opts.IPTables = DefaultTables()
|
|
}
|
|
|
|
opts.NUDConfigs.resetInvalidFields()
|
|
|
|
if opts.SecureRNG == nil {
|
|
opts.SecureRNG = rand.Reader
|
|
}
|
|
|
|
s := &Stack{
|
|
transportProtocols: make(map[tcpip.TransportProtocolNumber]*transportProtocolState),
|
|
networkProtocols: make(map[tcpip.NetworkProtocolNumber]NetworkProtocol),
|
|
nics: make(map[tcpip.NICID]*nic),
|
|
cleanupEndpoints: make(map[TransportEndpoint]struct{}),
|
|
PortManager: ports.NewPortManager(),
|
|
clock: clock,
|
|
stats: opts.Stats.FillIn(),
|
|
handleLocal: opts.HandleLocal,
|
|
tables: opts.IPTables,
|
|
icmpRateLimiter: NewICMPRateLimiter(),
|
|
seed: generateRandUint32(),
|
|
nudConfigs: opts.NUDConfigs,
|
|
uniqueIDGenerator: opts.UniqueID,
|
|
nudDisp: opts.NUDDisp,
|
|
randomGenerator: mathrand.New(randSrc),
|
|
secureRNG: opts.SecureRNG,
|
|
sendBufferSize: tcpip.SendBufferSizeOption{
|
|
Min: MinBufferSize,
|
|
Default: DefaultBufferSize,
|
|
Max: DefaultMaxBufferSize,
|
|
},
|
|
receiveBufferSize: ReceiveBufferSizeOption{
|
|
Min: MinBufferSize,
|
|
Default: DefaultBufferSize,
|
|
Max: DefaultMaxBufferSize,
|
|
},
|
|
tcpInvalidRateLimit: defaultTCPInvalidRateLimit,
|
|
}
|
|
|
|
// Add specified network protocols.
|
|
for _, netProtoFactory := range opts.NetworkProtocols {
|
|
netProto := netProtoFactory(s)
|
|
s.networkProtocols[netProto.Number()] = netProto
|
|
}
|
|
|
|
// Add specified transport protocols.
|
|
for _, transProtoFactory := range opts.TransportProtocols {
|
|
transProto := transProtoFactory(s)
|
|
s.transportProtocols[transProto.Number()] = &transportProtocolState{
|
|
proto: transProto,
|
|
}
|
|
}
|
|
|
|
// Add the factory for raw endpoints, if present.
|
|
s.rawFactory = opts.RawFactory
|
|
|
|
// Create the global transport demuxer.
|
|
s.demux = newTransportDemuxer(s)
|
|
|
|
return s
|
|
}
|
|
|
|
// newJob returns a tcpip.Job using the Stack clock.
|
|
func (s *Stack) newJob(l sync.Locker, f func()) *tcpip.Job {
|
|
return tcpip.NewJob(s.clock, l, f)
|
|
}
|
|
|
|
// UniqueID returns a unique identifier.
|
|
func (s *Stack) UniqueID() uint64 {
|
|
return s.uniqueIDGenerator.UniqueID()
|
|
}
|
|
|
|
// SetNetworkProtocolOption allows configuring individual protocol level
|
|
// options. This method returns an error if the protocol is not supported or
|
|
// option is not supported by the protocol implementation or the provided value
|
|
// is incorrect.
|
|
func (s *Stack) SetNetworkProtocolOption(network tcpip.NetworkProtocolNumber, option tcpip.SettableNetworkProtocolOption) tcpip.Error {
|
|
netProto, ok := s.networkProtocols[network]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownProtocol{}
|
|
}
|
|
return netProto.SetOption(option)
|
|
}
|
|
|
|
// NetworkProtocolOption allows retrieving individual protocol level option
|
|
// values. This method returns an error if the protocol is not supported or
|
|
// option is not supported by the protocol implementation.
|
|
// e.g.
|
|
// var v ipv4.MyOption
|
|
// err := s.NetworkProtocolOption(tcpip.IPv4ProtocolNumber, &v)
|
|
// if err != nil {
|
|
// ...
|
|
// }
|
|
func (s *Stack) NetworkProtocolOption(network tcpip.NetworkProtocolNumber, option tcpip.GettableNetworkProtocolOption) tcpip.Error {
|
|
netProto, ok := s.networkProtocols[network]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownProtocol{}
|
|
}
|
|
return netProto.Option(option)
|
|
}
|
|
|
|
// SetTransportProtocolOption allows configuring individual protocol level
|
|
// options. This method returns an error if the protocol is not supported or
|
|
// option is not supported by the protocol implementation or the provided value
|
|
// is incorrect.
|
|
func (s *Stack) SetTransportProtocolOption(transport tcpip.TransportProtocolNumber, option tcpip.SettableTransportProtocolOption) tcpip.Error {
|
|
transProtoState, ok := s.transportProtocols[transport]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownProtocol{}
|
|
}
|
|
return transProtoState.proto.SetOption(option)
|
|
}
|
|
|
|
// TransportProtocolOption allows retrieving individual protocol level option
|
|
// values. This method returns an error if the protocol is not supported or
|
|
// option is not supported by the protocol implementation.
|
|
// var v tcp.SACKEnabled
|
|
// if err := s.TransportProtocolOption(tcpip.TCPProtocolNumber, &v); err != nil {
|
|
// ...
|
|
// }
|
|
func (s *Stack) TransportProtocolOption(transport tcpip.TransportProtocolNumber, option tcpip.GettableTransportProtocolOption) tcpip.Error {
|
|
transProtoState, ok := s.transportProtocols[transport]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownProtocol{}
|
|
}
|
|
return transProtoState.proto.Option(option)
|
|
}
|
|
|
|
// SetTransportProtocolHandler sets the per-stack default handler for the given
|
|
// protocol.
|
|
//
|
|
// It must be called only during initialization of the stack. Changing it as the
|
|
// stack is operating is not supported.
|
|
func (s *Stack) SetTransportProtocolHandler(p tcpip.TransportProtocolNumber, h func(TransportEndpointID, *PacketBuffer) bool) {
|
|
state := s.transportProtocols[p]
|
|
if state != nil {
|
|
state.defaultHandler = h
|
|
}
|
|
}
|
|
|
|
// Clock returns the Stack's clock for retrieving the current time and
|
|
// scheduling work.
|
|
func (s *Stack) Clock() tcpip.Clock {
|
|
return s.clock
|
|
}
|
|
|
|
// Stats returns a mutable copy of the current stats.
|
|
//
|
|
// This is not generally exported via the public interface, but is available
|
|
// internally.
|
|
func (s *Stack) Stats() tcpip.Stats {
|
|
return s.stats
|
|
}
|
|
|
|
// SetForwarding enables or disables packet forwarding between NICs for the
|
|
// passed protocol.
|
|
func (s *Stack) SetForwarding(protocolNum tcpip.NetworkProtocolNumber, enable bool) tcpip.Error {
|
|
protocol, ok := s.networkProtocols[protocolNum]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownProtocol{}
|
|
}
|
|
|
|
forwardingProtocol, ok := protocol.(ForwardingNetworkProtocol)
|
|
if !ok {
|
|
return &tcpip.ErrNotSupported{}
|
|
}
|
|
|
|
forwardingProtocol.SetForwarding(enable)
|
|
return nil
|
|
}
|
|
|
|
// Forwarding returns true if packet forwarding between NICs is enabled for the
|
|
// passed protocol.
|
|
func (s *Stack) Forwarding(protocolNum tcpip.NetworkProtocolNumber) bool {
|
|
protocol, ok := s.networkProtocols[protocolNum]
|
|
if !ok {
|
|
return false
|
|
}
|
|
|
|
forwardingProtocol, ok := protocol.(ForwardingNetworkProtocol)
|
|
if !ok {
|
|
return false
|
|
}
|
|
|
|
return forwardingProtocol.Forwarding()
|
|
}
|
|
|
|
// PortRange returns the UDP and TCP inclusive range of ephemeral ports used in
|
|
// both IPv4 and IPv6.
|
|
func (s *Stack) PortRange() (uint16, uint16) {
|
|
return s.PortManager.PortRange()
|
|
}
|
|
|
|
// SetPortRange sets the UDP and TCP IPv4 and IPv6 ephemeral port range
|
|
// (inclusive).
|
|
func (s *Stack) SetPortRange(start uint16, end uint16) tcpip.Error {
|
|
return s.PortManager.SetPortRange(start, end)
|
|
}
|
|
|
|
// SetRouteTable assigns the route table to be used by this stack. It
|
|
// specifies which NIC to use for given destination address ranges.
|
|
//
|
|
// This method takes ownership of the table.
|
|
func (s *Stack) SetRouteTable(table []tcpip.Route) {
|
|
s.route.mu.Lock()
|
|
defer s.route.mu.Unlock()
|
|
s.route.mu.table = table
|
|
}
|
|
|
|
// GetRouteTable returns the route table which is currently in use.
|
|
func (s *Stack) GetRouteTable() []tcpip.Route {
|
|
s.route.mu.RLock()
|
|
defer s.route.mu.RUnlock()
|
|
return append([]tcpip.Route(nil), s.route.mu.table...)
|
|
}
|
|
|
|
// AddRoute appends a route to the route table.
|
|
func (s *Stack) AddRoute(route tcpip.Route) {
|
|
s.route.mu.Lock()
|
|
defer s.route.mu.Unlock()
|
|
s.route.mu.table = append(s.route.mu.table, route)
|
|
}
|
|
|
|
// RemoveRoutes removes matching routes from the route table.
|
|
func (s *Stack) RemoveRoutes(match func(tcpip.Route) bool) {
|
|
s.route.mu.Lock()
|
|
defer s.route.mu.Unlock()
|
|
|
|
var filteredRoutes []tcpip.Route
|
|
for _, route := range s.route.mu.table {
|
|
if !match(route) {
|
|
filteredRoutes = append(filteredRoutes, route)
|
|
}
|
|
}
|
|
s.route.mu.table = filteredRoutes
|
|
}
|
|
|
|
// NewEndpoint creates a new transport layer endpoint of the given protocol.
|
|
func (s *Stack) NewEndpoint(transport tcpip.TransportProtocolNumber, network tcpip.NetworkProtocolNumber, waiterQueue *waiter.Queue) (tcpip.Endpoint, tcpip.Error) {
|
|
t, ok := s.transportProtocols[transport]
|
|
if !ok {
|
|
return nil, &tcpip.ErrUnknownProtocol{}
|
|
}
|
|
|
|
return t.proto.NewEndpoint(network, waiterQueue)
|
|
}
|
|
|
|
// NewRawEndpoint creates a new raw transport layer endpoint of the given
|
|
// protocol. Raw endpoints receive all traffic for a given protocol regardless
|
|
// of address.
|
|
func (s *Stack) NewRawEndpoint(transport tcpip.TransportProtocolNumber, network tcpip.NetworkProtocolNumber, waiterQueue *waiter.Queue, associated bool) (tcpip.Endpoint, tcpip.Error) {
|
|
if s.rawFactory == nil {
|
|
return nil, &tcpip.ErrNotPermitted{}
|
|
}
|
|
|
|
if !associated {
|
|
return s.rawFactory.NewUnassociatedEndpoint(s, network, transport, waiterQueue)
|
|
}
|
|
|
|
t, ok := s.transportProtocols[transport]
|
|
if !ok {
|
|
return nil, &tcpip.ErrUnknownProtocol{}
|
|
}
|
|
|
|
return t.proto.NewRawEndpoint(network, waiterQueue)
|
|
}
|
|
|
|
// NewPacketEndpoint creates a new packet endpoint listening for the given
|
|
// netProto.
|
|
func (s *Stack) NewPacketEndpoint(cooked bool, netProto tcpip.NetworkProtocolNumber, waiterQueue *waiter.Queue) (tcpip.Endpoint, tcpip.Error) {
|
|
if s.rawFactory == nil {
|
|
return nil, &tcpip.ErrNotPermitted{}
|
|
}
|
|
|
|
return s.rawFactory.NewPacketEndpoint(s, cooked, netProto, waiterQueue)
|
|
}
|
|
|
|
// NICContext is an opaque pointer used to store client-supplied NIC metadata.
|
|
type NICContext interface{}
|
|
|
|
// NICOptions specifies the configuration of a NIC as it is being created.
|
|
// The zero value creates an enabled, unnamed NIC.
|
|
type NICOptions struct {
|
|
// Name specifies the name of the NIC.
|
|
Name string
|
|
|
|
// Disabled specifies whether to avoid calling Attach on the passed
|
|
// LinkEndpoint.
|
|
Disabled bool
|
|
|
|
// Context specifies user-defined data that will be returned in stack.NICInfo
|
|
// for the NIC. Clients of this library can use it to add metadata that
|
|
// should be tracked alongside a NIC, to avoid having to keep a
|
|
// map[tcpip.NICID]metadata mirroring stack.Stack's nic map.
|
|
Context NICContext
|
|
}
|
|
|
|
// CreateNICWithOptions creates a NIC with the provided id, LinkEndpoint, and
|
|
// NICOptions. See the documentation on type NICOptions for details on how
|
|
// NICs can be configured.
|
|
//
|
|
// LinkEndpoint.Attach will be called to bind ep with a NetworkDispatcher.
|
|
func (s *Stack) CreateNICWithOptions(id tcpip.NICID, ep LinkEndpoint, opts NICOptions) tcpip.Error {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
|
|
// Make sure id is unique.
|
|
if _, ok := s.nics[id]; ok {
|
|
return &tcpip.ErrDuplicateNICID{}
|
|
}
|
|
|
|
// Make sure name is unique, unless unnamed.
|
|
if opts.Name != "" {
|
|
for _, n := range s.nics {
|
|
if n.Name() == opts.Name {
|
|
return &tcpip.ErrDuplicateNICID{}
|
|
}
|
|
}
|
|
}
|
|
|
|
n := newNIC(s, id, opts.Name, ep, opts.Context)
|
|
s.nics[id] = n
|
|
if !opts.Disabled {
|
|
return n.enable()
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// CreateNIC creates a NIC with the provided id and LinkEndpoint and calls
|
|
// LinkEndpoint.Attach to bind ep with a NetworkDispatcher.
|
|
func (s *Stack) CreateNIC(id tcpip.NICID, ep LinkEndpoint) tcpip.Error {
|
|
return s.CreateNICWithOptions(id, ep, NICOptions{})
|
|
}
|
|
|
|
// GetLinkEndpointByName gets the link endpoint specified by name.
|
|
func (s *Stack) GetLinkEndpointByName(name string) LinkEndpoint {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
for _, nic := range s.nics {
|
|
if nic.Name() == name {
|
|
return nic.LinkEndpoint
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// EnableNIC enables the given NIC so that the link-layer endpoint can start
|
|
// delivering packets to it.
|
|
func (s *Stack) EnableNIC(id tcpip.NICID) tcpip.Error {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
nic, ok := s.nics[id]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.enable()
|
|
}
|
|
|
|
// DisableNIC disables the given NIC.
|
|
func (s *Stack) DisableNIC(id tcpip.NICID) tcpip.Error {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
nic, ok := s.nics[id]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
nic.disable()
|
|
return nil
|
|
}
|
|
|
|
// CheckNIC checks if a NIC is usable.
|
|
func (s *Stack) CheckNIC(id tcpip.NICID) bool {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
nic, ok := s.nics[id]
|
|
if !ok {
|
|
return false
|
|
}
|
|
|
|
return nic.Enabled()
|
|
}
|
|
|
|
// RemoveNIC removes NIC and all related routes from the network stack.
|
|
func (s *Stack) RemoveNIC(id tcpip.NICID) tcpip.Error {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
|
|
return s.removeNICLocked(id)
|
|
}
|
|
|
|
// removeNICLocked removes NIC and all related routes from the network stack.
|
|
//
|
|
// s.mu must be locked.
|
|
func (s *Stack) removeNICLocked(id tcpip.NICID) tcpip.Error {
|
|
nic, ok := s.nics[id]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
delete(s.nics, id)
|
|
|
|
// Remove routes in-place. n tracks the number of routes written.
|
|
s.route.mu.Lock()
|
|
n := 0
|
|
for i, r := range s.route.mu.table {
|
|
s.route.mu.table[i] = tcpip.Route{}
|
|
if r.NIC != id {
|
|
// Keep this route.
|
|
s.route.mu.table[n] = r
|
|
n++
|
|
}
|
|
}
|
|
s.route.mu.table = s.route.mu.table[:n]
|
|
s.route.mu.Unlock()
|
|
|
|
return nic.remove()
|
|
}
|
|
|
|
// NICInfo captures the name and addresses assigned to a NIC.
|
|
type NICInfo struct {
|
|
Name string
|
|
LinkAddress tcpip.LinkAddress
|
|
ProtocolAddresses []tcpip.ProtocolAddress
|
|
|
|
// Flags indicate the state of the NIC.
|
|
Flags NICStateFlags
|
|
|
|
// MTU is the maximum transmission unit.
|
|
MTU uint32
|
|
|
|
Stats NICStats
|
|
|
|
// NetworkStats holds the stats of each NetworkEndpoint bound to the NIC.
|
|
NetworkStats map[tcpip.NetworkProtocolNumber]NetworkEndpointStats
|
|
|
|
// Context is user-supplied data optionally supplied in CreateNICWithOptions.
|
|
// See type NICOptions for more details.
|
|
Context NICContext
|
|
|
|
// ARPHardwareType holds the ARP Hardware type of the NIC. This is the
|
|
// value sent in haType field of an ARP Request sent by this NIC and the
|
|
// value expected in the haType field of an ARP response.
|
|
ARPHardwareType header.ARPHardwareType
|
|
}
|
|
|
|
// HasNIC returns true if the NICID is defined in the stack.
|
|
func (s *Stack) HasNIC(id tcpip.NICID) bool {
|
|
s.mu.RLock()
|
|
_, ok := s.nics[id]
|
|
s.mu.RUnlock()
|
|
return ok
|
|
}
|
|
|
|
// NICInfo returns a map of NICIDs to their associated information.
|
|
func (s *Stack) NICInfo() map[tcpip.NICID]NICInfo {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
nics := make(map[tcpip.NICID]NICInfo)
|
|
for id, nic := range s.nics {
|
|
flags := NICStateFlags{
|
|
Up: true, // Netstack interfaces are always up.
|
|
Running: nic.Enabled(),
|
|
Promiscuous: nic.Promiscuous(),
|
|
Loopback: nic.IsLoopback(),
|
|
}
|
|
|
|
netStats := make(map[tcpip.NetworkProtocolNumber]NetworkEndpointStats)
|
|
for proto, netEP := range nic.networkEndpoints {
|
|
netStats[proto] = netEP.Stats()
|
|
}
|
|
|
|
nics[id] = NICInfo{
|
|
Name: nic.name,
|
|
LinkAddress: nic.LinkEndpoint.LinkAddress(),
|
|
ProtocolAddresses: nic.primaryAddresses(),
|
|
Flags: flags,
|
|
MTU: nic.LinkEndpoint.MTU(),
|
|
Stats: nic.stats,
|
|
NetworkStats: netStats,
|
|
Context: nic.context,
|
|
ARPHardwareType: nic.LinkEndpoint.ARPHardwareType(),
|
|
}
|
|
}
|
|
return nics
|
|
}
|
|
|
|
// NICStateFlags holds information about the state of an NIC.
|
|
type NICStateFlags struct {
|
|
// Up indicates whether the interface is running.
|
|
Up bool
|
|
|
|
// Running indicates whether resources are allocated.
|
|
Running bool
|
|
|
|
// Promiscuous indicates whether the interface is in promiscuous mode.
|
|
Promiscuous bool
|
|
|
|
// Loopback indicates whether the interface is a loopback.
|
|
Loopback bool
|
|
}
|
|
|
|
// AddAddress adds a new network-layer address to the specified NIC.
|
|
func (s *Stack) AddAddress(id tcpip.NICID, protocol tcpip.NetworkProtocolNumber, addr tcpip.Address) tcpip.Error {
|
|
return s.AddAddressWithOptions(id, protocol, addr, CanBePrimaryEndpoint)
|
|
}
|
|
|
|
// AddAddressWithPrefix is the same as AddAddress, but allows you to specify
|
|
// the address prefix.
|
|
func (s *Stack) AddAddressWithPrefix(id tcpip.NICID, protocol tcpip.NetworkProtocolNumber, addr tcpip.AddressWithPrefix) tcpip.Error {
|
|
ap := tcpip.ProtocolAddress{
|
|
Protocol: protocol,
|
|
AddressWithPrefix: addr,
|
|
}
|
|
return s.AddProtocolAddressWithOptions(id, ap, CanBePrimaryEndpoint)
|
|
}
|
|
|
|
// AddProtocolAddress adds a new network-layer protocol address to the
|
|
// specified NIC.
|
|
func (s *Stack) AddProtocolAddress(id tcpip.NICID, protocolAddress tcpip.ProtocolAddress) tcpip.Error {
|
|
return s.AddProtocolAddressWithOptions(id, protocolAddress, CanBePrimaryEndpoint)
|
|
}
|
|
|
|
// AddAddressWithOptions is the same as AddAddress, but allows you to specify
|
|
// whether the new endpoint can be primary or not.
|
|
func (s *Stack) AddAddressWithOptions(id tcpip.NICID, protocol tcpip.NetworkProtocolNumber, addr tcpip.Address, peb PrimaryEndpointBehavior) tcpip.Error {
|
|
netProto, ok := s.networkProtocols[protocol]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownProtocol{}
|
|
}
|
|
return s.AddProtocolAddressWithOptions(id, tcpip.ProtocolAddress{
|
|
Protocol: protocol,
|
|
AddressWithPrefix: tcpip.AddressWithPrefix{
|
|
Address: addr,
|
|
PrefixLen: netProto.DefaultPrefixLen(),
|
|
},
|
|
}, peb)
|
|
}
|
|
|
|
// AddProtocolAddressWithOptions is the same as AddProtocolAddress, but allows
|
|
// you to specify whether the new endpoint can be primary or not.
|
|
func (s *Stack) AddProtocolAddressWithOptions(id tcpip.NICID, protocolAddress tcpip.ProtocolAddress, peb PrimaryEndpointBehavior) tcpip.Error {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
nic, ok := s.nics[id]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.addAddress(protocolAddress, peb)
|
|
}
|
|
|
|
// RemoveAddress removes an existing network-layer address from the specified
|
|
// NIC.
|
|
func (s *Stack) RemoveAddress(id tcpip.NICID, addr tcpip.Address) tcpip.Error {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
if nic, ok := s.nics[id]; ok {
|
|
return nic.removeAddress(addr)
|
|
}
|
|
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
// AllAddresses returns a map of NICIDs to their protocol addresses (primary
|
|
// and non-primary).
|
|
func (s *Stack) AllAddresses() map[tcpip.NICID][]tcpip.ProtocolAddress {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
nics := make(map[tcpip.NICID][]tcpip.ProtocolAddress)
|
|
for id, nic := range s.nics {
|
|
nics[id] = nic.allPermanentAddresses()
|
|
}
|
|
return nics
|
|
}
|
|
|
|
// GetMainNICAddress returns the first non-deprecated primary address and prefix
|
|
// for the given NIC and protocol. If no non-deprecated primary addresses exist,
|
|
// a deprecated address will be returned. If no deprecated addresses exist, the
|
|
// zero value will be returned.
|
|
func (s *Stack) GetMainNICAddress(id tcpip.NICID, protocol tcpip.NetworkProtocolNumber) (tcpip.AddressWithPrefix, tcpip.Error) {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
nic, ok := s.nics[id]
|
|
if !ok {
|
|
return tcpip.AddressWithPrefix{}, &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.PrimaryAddress(protocol)
|
|
}
|
|
|
|
func (s *Stack) getAddressEP(nic *nic, localAddr, remoteAddr tcpip.Address, netProto tcpip.NetworkProtocolNumber) AssignableAddressEndpoint {
|
|
if len(localAddr) == 0 {
|
|
return nic.primaryEndpoint(netProto, remoteAddr)
|
|
}
|
|
return nic.findEndpoint(netProto, localAddr, CanBePrimaryEndpoint)
|
|
}
|
|
|
|
// findLocalRouteFromNICRLocked is like findLocalRouteRLocked but finds a route
|
|
// from the specified NIC.
|
|
//
|
|
// Precondition: s.mu must be read locked.
|
|
func (s *Stack) findLocalRouteFromNICRLocked(localAddressNIC *nic, localAddr, remoteAddr tcpip.Address, netProto tcpip.NetworkProtocolNumber) *Route {
|
|
localAddressEndpoint := localAddressNIC.getAddressOrCreateTempInner(netProto, localAddr, false /* createTemp */, NeverPrimaryEndpoint)
|
|
if localAddressEndpoint == nil {
|
|
return nil
|
|
}
|
|
|
|
var outgoingNIC *nic
|
|
// Prefer a local route to the same interface as the local address.
|
|
if localAddressNIC.hasAddress(netProto, remoteAddr) {
|
|
outgoingNIC = localAddressNIC
|
|
}
|
|
|
|
// If the remote address isn't owned by the local address's NIC, check all
|
|
// NICs.
|
|
if outgoingNIC == nil {
|
|
for _, nic := range s.nics {
|
|
if nic.hasAddress(netProto, remoteAddr) {
|
|
outgoingNIC = nic
|
|
break
|
|
}
|
|
}
|
|
}
|
|
|
|
// If the remote address is not owned by the stack, we can't return a local
|
|
// route.
|
|
if outgoingNIC == nil {
|
|
localAddressEndpoint.DecRef()
|
|
return nil
|
|
}
|
|
|
|
r := makeLocalRoute(
|
|
netProto,
|
|
localAddr,
|
|
remoteAddr,
|
|
outgoingNIC,
|
|
localAddressNIC,
|
|
localAddressEndpoint,
|
|
)
|
|
|
|
if r.IsOutboundBroadcast() {
|
|
r.Release()
|
|
return nil
|
|
}
|
|
|
|
return r
|
|
}
|
|
|
|
// findLocalRouteRLocked returns a local route.
|
|
//
|
|
// A local route is a route to some remote address which the stack owns. That
|
|
// is, a local route is a route where packets never have to leave the stack.
|
|
//
|
|
// Precondition: s.mu must be read locked.
|
|
func (s *Stack) findLocalRouteRLocked(localAddressNICID tcpip.NICID, localAddr, remoteAddr tcpip.Address, netProto tcpip.NetworkProtocolNumber) *Route {
|
|
if len(localAddr) == 0 {
|
|
localAddr = remoteAddr
|
|
}
|
|
|
|
if localAddressNICID == 0 {
|
|
for _, localAddressNIC := range s.nics {
|
|
if r := s.findLocalRouteFromNICRLocked(localAddressNIC, localAddr, remoteAddr, netProto); r != nil {
|
|
return r
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
if localAddressNIC, ok := s.nics[localAddressNICID]; ok {
|
|
return s.findLocalRouteFromNICRLocked(localAddressNIC, localAddr, remoteAddr, netProto)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// HandleLocal returns true if non-loopback interfaces are allowed to loop packets.
|
|
func (s *Stack) HandleLocal() bool {
|
|
return s.handleLocal
|
|
}
|
|
|
|
// FindRoute creates a route to the given destination address, leaving through
|
|
// the given NIC and local address (if provided).
|
|
//
|
|
// If a NIC is not specified, the returned route will leave through the same
|
|
// NIC as the NIC that has the local address assigned when forwarding is
|
|
// disabled. If forwarding is enabled and the NIC is unspecified, the route may
|
|
// leave through any interface unless the route is link-local.
|
|
//
|
|
// If no local address is provided, the stack will select a local address. If no
|
|
// remote address is provided, the stack wil use a remote address equal to the
|
|
// local address.
|
|
func (s *Stack) FindRoute(id tcpip.NICID, localAddr, remoteAddr tcpip.Address, netProto tcpip.NetworkProtocolNumber, multicastLoop bool) (*Route, tcpip.Error) {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
isLinkLocal := header.IsV6LinkLocalAddress(remoteAddr) || header.IsV6LinkLocalMulticastAddress(remoteAddr)
|
|
isLocalBroadcast := remoteAddr == header.IPv4Broadcast
|
|
isMulticast := header.IsV4MulticastAddress(remoteAddr) || header.IsV6MulticastAddress(remoteAddr)
|
|
isLoopback := header.IsV4LoopbackAddress(remoteAddr) || header.IsV6LoopbackAddress(remoteAddr)
|
|
needRoute := !(isLocalBroadcast || isMulticast || isLinkLocal || isLoopback)
|
|
|
|
if s.handleLocal && !isMulticast && !isLocalBroadcast {
|
|
if r := s.findLocalRouteRLocked(id, localAddr, remoteAddr, netProto); r != nil {
|
|
return r, nil
|
|
}
|
|
}
|
|
|
|
// If the interface is specified and we do not need a route, return a route
|
|
// through the interface if the interface is valid and enabled.
|
|
if id != 0 && !needRoute {
|
|
if nic, ok := s.nics[id]; ok && nic.Enabled() {
|
|
if addressEndpoint := s.getAddressEP(nic, localAddr, remoteAddr, netProto); addressEndpoint != nil {
|
|
return makeRoute(
|
|
netProto,
|
|
"", /* gateway */
|
|
localAddr,
|
|
remoteAddr,
|
|
nic, /* outboundNIC */
|
|
nic, /* localAddressNIC*/
|
|
addressEndpoint,
|
|
s.handleLocal,
|
|
multicastLoop,
|
|
), nil
|
|
}
|
|
}
|
|
|
|
if isLoopback {
|
|
return nil, &tcpip.ErrBadLocalAddress{}
|
|
}
|
|
return nil, &tcpip.ErrNetworkUnreachable{}
|
|
}
|
|
|
|
canForward := s.Forwarding(netProto) && !header.IsV6LinkLocalAddress(localAddr) && !isLinkLocal
|
|
|
|
// Find a route to the remote with the route table.
|
|
var chosenRoute tcpip.Route
|
|
if r := func() *Route {
|
|
s.route.mu.RLock()
|
|
defer s.route.mu.RUnlock()
|
|
|
|
for _, route := range s.route.mu.table {
|
|
if len(remoteAddr) != 0 && !route.Destination.Contains(remoteAddr) {
|
|
continue
|
|
}
|
|
|
|
nic, ok := s.nics[route.NIC]
|
|
if !ok || !nic.Enabled() {
|
|
continue
|
|
}
|
|
|
|
if id == 0 || id == route.NIC {
|
|
if addressEndpoint := s.getAddressEP(nic, localAddr, remoteAddr, netProto); addressEndpoint != nil {
|
|
var gateway tcpip.Address
|
|
if needRoute {
|
|
gateway = route.Gateway
|
|
}
|
|
r := constructAndValidateRoute(netProto, addressEndpoint, nic /* outgoingNIC */, nic /* outgoingNIC */, gateway, localAddr, remoteAddr, s.handleLocal, multicastLoop)
|
|
if r == nil {
|
|
panic(fmt.Sprintf("non-forwarding route validation failed with route table entry = %#v, id = %d, localAddr = %s, remoteAddr = %s", route, id, localAddr, remoteAddr))
|
|
}
|
|
return r
|
|
}
|
|
}
|
|
|
|
// If the stack has forwarding enabled and we haven't found a valid route
|
|
// to the remote address yet, keep track of the first valid route. We
|
|
// keep iterating because we prefer routes that let us use a local
|
|
// address that is assigned to the outgoing interface. There is no
|
|
// requirement to do this from any RFC but simply a choice made to better
|
|
// follow a strong host model which the netstack follows at the time of
|
|
// writing.
|
|
if canForward && chosenRoute == (tcpip.Route{}) {
|
|
chosenRoute = route
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}(); r != nil {
|
|
return r, nil
|
|
}
|
|
|
|
if chosenRoute != (tcpip.Route{}) {
|
|
// At this point we know the stack has forwarding enabled since chosenRoute is
|
|
// only set when forwarding is enabled.
|
|
nic, ok := s.nics[chosenRoute.NIC]
|
|
if !ok {
|
|
// If the route's NIC was invalid, we should not have chosen the route.
|
|
panic(fmt.Sprintf("chosen route must have a valid NIC with ID = %d", chosenRoute.NIC))
|
|
}
|
|
|
|
var gateway tcpip.Address
|
|
if needRoute {
|
|
gateway = chosenRoute.Gateway
|
|
}
|
|
|
|
// Use the specified NIC to get the local address endpoint.
|
|
if id != 0 {
|
|
if aNIC, ok := s.nics[id]; ok {
|
|
if addressEndpoint := s.getAddressEP(aNIC, localAddr, remoteAddr, netProto); addressEndpoint != nil {
|
|
if r := constructAndValidateRoute(netProto, addressEndpoint, aNIC /* localAddressNIC */, nic /* outgoingNIC */, gateway, localAddr, remoteAddr, s.handleLocal, multicastLoop); r != nil {
|
|
return r, nil
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil, &tcpip.ErrNoRoute{}
|
|
}
|
|
|
|
if id == 0 {
|
|
// If an interface is not specified, try to find a NIC that holds the local
|
|
// address endpoint to construct a route.
|
|
for _, aNIC := range s.nics {
|
|
addressEndpoint := s.getAddressEP(aNIC, localAddr, remoteAddr, netProto)
|
|
if addressEndpoint == nil {
|
|
continue
|
|
}
|
|
|
|
if r := constructAndValidateRoute(netProto, addressEndpoint, aNIC /* localAddressNIC */, nic /* outgoingNIC */, gateway, localAddr, remoteAddr, s.handleLocal, multicastLoop); r != nil {
|
|
return r, nil
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if needRoute {
|
|
return nil, &tcpip.ErrNoRoute{}
|
|
}
|
|
if header.IsV6LoopbackAddress(remoteAddr) {
|
|
return nil, &tcpip.ErrBadLocalAddress{}
|
|
}
|
|
return nil, &tcpip.ErrNetworkUnreachable{}
|
|
}
|
|
|
|
// CheckNetworkProtocol checks if a given network protocol is enabled in the
|
|
// stack.
|
|
func (s *Stack) CheckNetworkProtocol(protocol tcpip.NetworkProtocolNumber) bool {
|
|
_, ok := s.networkProtocols[protocol]
|
|
return ok
|
|
}
|
|
|
|
// CheckDuplicateAddress performs duplicate address detection for the address on
|
|
// the specified interface.
|
|
func (s *Stack) CheckDuplicateAddress(nicID tcpip.NICID, protocol tcpip.NetworkProtocolNumber, addr tcpip.Address, h DADCompletionHandler) (DADCheckAddressDisposition, tcpip.Error) {
|
|
nic, ok := s.nics[nicID]
|
|
if !ok {
|
|
return 0, &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.checkDuplicateAddress(protocol, addr, h)
|
|
}
|
|
|
|
// CheckLocalAddress determines if the given local address exists, and if it
|
|
// does, returns the id of the NIC it's bound to. Returns 0 if the address
|
|
// does not exist.
|
|
func (s *Stack) CheckLocalAddress(nicID tcpip.NICID, protocol tcpip.NetworkProtocolNumber, addr tcpip.Address) tcpip.NICID {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
// If a NIC is specified, we try to find the address there only.
|
|
if nicID != 0 {
|
|
nic, ok := s.nics[nicID]
|
|
if !ok {
|
|
return 0
|
|
}
|
|
|
|
if nic.CheckLocalAddress(protocol, addr) {
|
|
return nic.id
|
|
}
|
|
|
|
return 0
|
|
}
|
|
|
|
// Go through all the NICs.
|
|
for _, nic := range s.nics {
|
|
if nic.CheckLocalAddress(protocol, addr) {
|
|
return nic.id
|
|
}
|
|
}
|
|
|
|
return 0
|
|
}
|
|
|
|
// SetPromiscuousMode enables or disables promiscuous mode in the given NIC.
|
|
func (s *Stack) SetPromiscuousMode(nicID tcpip.NICID, enable bool) tcpip.Error {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
nic, ok := s.nics[nicID]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
nic.setPromiscuousMode(enable)
|
|
|
|
return nil
|
|
}
|
|
|
|
// SetSpoofing enables or disables address spoofing in the given NIC, allowing
|
|
// endpoints to bind to any address in the NIC.
|
|
func (s *Stack) SetSpoofing(nicID tcpip.NICID, enable bool) tcpip.Error {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
nic, ok := s.nics[nicID]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
nic.setSpoofing(enable)
|
|
|
|
return nil
|
|
}
|
|
|
|
// LinkResolutionResult is the result of a link address resolution attempt.
|
|
type LinkResolutionResult struct {
|
|
LinkAddress tcpip.LinkAddress
|
|
Err tcpip.Error
|
|
}
|
|
|
|
// GetLinkAddress finds the link address corresponding to a network address.
|
|
//
|
|
// Returns ErrNotSupported if the stack is not configured with a link address
|
|
// resolver for the specified network protocol.
|
|
//
|
|
// Returns ErrWouldBlock if the link address is not readily available, along
|
|
// with a notification channel for the caller to block on. Triggers address
|
|
// resolution asynchronously.
|
|
//
|
|
// onResolve will be called either immediately, if resolution is not required,
|
|
// or when address resolution is complete, with the resolved link address and
|
|
// whether resolution succeeded.
|
|
//
|
|
// If specified, the local address must be an address local to the interface
|
|
// the neighbor cache belongs to. The local address is the source address of
|
|
// a packet prompting NUD/link address resolution.
|
|
func (s *Stack) GetLinkAddress(nicID tcpip.NICID, addr, localAddr tcpip.Address, protocol tcpip.NetworkProtocolNumber, onResolve func(LinkResolutionResult)) tcpip.Error {
|
|
s.mu.RLock()
|
|
nic, ok := s.nics[nicID]
|
|
s.mu.RUnlock()
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.getLinkAddress(addr, localAddr, protocol, onResolve)
|
|
}
|
|
|
|
// Neighbors returns all IP to MAC address associations.
|
|
func (s *Stack) Neighbors(nicID tcpip.NICID, protocol tcpip.NetworkProtocolNumber) ([]NeighborEntry, tcpip.Error) {
|
|
s.mu.RLock()
|
|
nic, ok := s.nics[nicID]
|
|
s.mu.RUnlock()
|
|
|
|
if !ok {
|
|
return nil, &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.neighbors(protocol)
|
|
}
|
|
|
|
// AddStaticNeighbor statically associates an IP address to a MAC address.
|
|
func (s *Stack) AddStaticNeighbor(nicID tcpip.NICID, protocol tcpip.NetworkProtocolNumber, addr tcpip.Address, linkAddr tcpip.LinkAddress) tcpip.Error {
|
|
s.mu.RLock()
|
|
nic, ok := s.nics[nicID]
|
|
s.mu.RUnlock()
|
|
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.addStaticNeighbor(addr, protocol, linkAddr)
|
|
}
|
|
|
|
// RemoveNeighbor removes an IP to MAC address association previously created
|
|
// either automically or by AddStaticNeighbor. Returns ErrBadAddress if there
|
|
// is no association with the provided address.
|
|
func (s *Stack) RemoveNeighbor(nicID tcpip.NICID, protocol tcpip.NetworkProtocolNumber, addr tcpip.Address) tcpip.Error {
|
|
s.mu.RLock()
|
|
nic, ok := s.nics[nicID]
|
|
s.mu.RUnlock()
|
|
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.removeNeighbor(protocol, addr)
|
|
}
|
|
|
|
// ClearNeighbors removes all IP to MAC address associations.
|
|
func (s *Stack) ClearNeighbors(nicID tcpip.NICID, protocol tcpip.NetworkProtocolNumber) tcpip.Error {
|
|
s.mu.RLock()
|
|
nic, ok := s.nics[nicID]
|
|
s.mu.RUnlock()
|
|
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.clearNeighbors(protocol)
|
|
}
|
|
|
|
// RegisterTransportEndpoint registers the given endpoint with the stack
|
|
// transport dispatcher. Received packets that match the provided id will be
|
|
// delivered to the given endpoint; specifying a nic is optional, but
|
|
// nic-specific IDs have precedence over global ones.
|
|
func (s *Stack) RegisterTransportEndpoint(netProtos []tcpip.NetworkProtocolNumber, protocol tcpip.TransportProtocolNumber, id TransportEndpointID, ep TransportEndpoint, flags ports.Flags, bindToDevice tcpip.NICID) tcpip.Error {
|
|
return s.demux.registerEndpoint(netProtos, protocol, id, ep, flags, bindToDevice)
|
|
}
|
|
|
|
// CheckRegisterTransportEndpoint checks if an endpoint can be registered with
|
|
// the stack transport dispatcher.
|
|
func (s *Stack) CheckRegisterTransportEndpoint(netProtos []tcpip.NetworkProtocolNumber, protocol tcpip.TransportProtocolNumber, id TransportEndpointID, flags ports.Flags, bindToDevice tcpip.NICID) tcpip.Error {
|
|
return s.demux.checkEndpoint(netProtos, protocol, id, flags, bindToDevice)
|
|
}
|
|
|
|
// UnregisterTransportEndpoint removes the endpoint with the given id from the
|
|
// stack transport dispatcher.
|
|
func (s *Stack) UnregisterTransportEndpoint(netProtos []tcpip.NetworkProtocolNumber, protocol tcpip.TransportProtocolNumber, id TransportEndpointID, ep TransportEndpoint, flags ports.Flags, bindToDevice tcpip.NICID) {
|
|
s.demux.unregisterEndpoint(netProtos, protocol, id, ep, flags, bindToDevice)
|
|
}
|
|
|
|
// StartTransportEndpointCleanup removes the endpoint with the given id from
|
|
// the stack transport dispatcher. It also transitions it to the cleanup stage.
|
|
func (s *Stack) StartTransportEndpointCleanup(netProtos []tcpip.NetworkProtocolNumber, protocol tcpip.TransportProtocolNumber, id TransportEndpointID, ep TransportEndpoint, flags ports.Flags, bindToDevice tcpip.NICID) {
|
|
s.cleanupEndpointsMu.Lock()
|
|
s.cleanupEndpoints[ep] = struct{}{}
|
|
s.cleanupEndpointsMu.Unlock()
|
|
|
|
s.demux.unregisterEndpoint(netProtos, protocol, id, ep, flags, bindToDevice)
|
|
}
|
|
|
|
// CompleteTransportEndpointCleanup removes the endpoint from the cleanup
|
|
// stage.
|
|
func (s *Stack) CompleteTransportEndpointCleanup(ep TransportEndpoint) {
|
|
s.cleanupEndpointsMu.Lock()
|
|
delete(s.cleanupEndpoints, ep)
|
|
s.cleanupEndpointsMu.Unlock()
|
|
}
|
|
|
|
// FindTransportEndpoint finds an endpoint that most closely matches the provided
|
|
// id. If no endpoint is found it returns nil.
|
|
func (s *Stack) FindTransportEndpoint(netProto tcpip.NetworkProtocolNumber, transProto tcpip.TransportProtocolNumber, id TransportEndpointID, nicID tcpip.NICID) TransportEndpoint {
|
|
return s.demux.findTransportEndpoint(netProto, transProto, id, nicID)
|
|
}
|
|
|
|
// RegisterRawTransportEndpoint registers the given endpoint with the stack
|
|
// transport dispatcher. Received packets that match the provided transport
|
|
// protocol will be delivered to the given endpoint.
|
|
func (s *Stack) RegisterRawTransportEndpoint(netProto tcpip.NetworkProtocolNumber, transProto tcpip.TransportProtocolNumber, ep RawTransportEndpoint) tcpip.Error {
|
|
return s.demux.registerRawEndpoint(netProto, transProto, ep)
|
|
}
|
|
|
|
// UnregisterRawTransportEndpoint removes the endpoint for the transport
|
|
// protocol from the stack transport dispatcher.
|
|
func (s *Stack) UnregisterRawTransportEndpoint(netProto tcpip.NetworkProtocolNumber, transProto tcpip.TransportProtocolNumber, ep RawTransportEndpoint) {
|
|
s.demux.unregisterRawEndpoint(netProto, transProto, ep)
|
|
}
|
|
|
|
// RegisterRestoredEndpoint records e as an endpoint that has been restored on
|
|
// this stack.
|
|
func (s *Stack) RegisterRestoredEndpoint(e ResumableEndpoint) {
|
|
s.mu.Lock()
|
|
s.resumableEndpoints = append(s.resumableEndpoints, e)
|
|
s.mu.Unlock()
|
|
}
|
|
|
|
// RegisteredEndpoints returns all endpoints which are currently registered.
|
|
func (s *Stack) RegisteredEndpoints() []TransportEndpoint {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
var es []TransportEndpoint
|
|
for _, e := range s.demux.protocol {
|
|
es = append(es, e.transportEndpoints()...)
|
|
}
|
|
return es
|
|
}
|
|
|
|
// CleanupEndpoints returns endpoints currently in the cleanup state.
|
|
func (s *Stack) CleanupEndpoints() []TransportEndpoint {
|
|
s.cleanupEndpointsMu.Lock()
|
|
es := make([]TransportEndpoint, 0, len(s.cleanupEndpoints))
|
|
for e := range s.cleanupEndpoints {
|
|
es = append(es, e)
|
|
}
|
|
s.cleanupEndpointsMu.Unlock()
|
|
return es
|
|
}
|
|
|
|
// RestoreCleanupEndpoints adds endpoints to cleanup tracking. This is useful
|
|
// for restoring a stack after a save.
|
|
func (s *Stack) RestoreCleanupEndpoints(es []TransportEndpoint) {
|
|
s.cleanupEndpointsMu.Lock()
|
|
for _, e := range es {
|
|
s.cleanupEndpoints[e] = struct{}{}
|
|
}
|
|
s.cleanupEndpointsMu.Unlock()
|
|
}
|
|
|
|
// Close closes all currently registered transport endpoints.
|
|
//
|
|
// Endpoints created or modified during this call may not get closed.
|
|
func (s *Stack) Close() {
|
|
for _, e := range s.RegisteredEndpoints() {
|
|
e.Abort()
|
|
}
|
|
for _, p := range s.transportProtocols {
|
|
p.proto.Close()
|
|
}
|
|
for _, p := range s.networkProtocols {
|
|
p.Close()
|
|
}
|
|
}
|
|
|
|
// Wait waits for all transport and link endpoints to halt their worker
|
|
// goroutines.
|
|
//
|
|
// Endpoints created or modified during this call may not get waited on.
|
|
//
|
|
// Note that link endpoints must be stopped via an implementation specific
|
|
// mechanism.
|
|
func (s *Stack) Wait() {
|
|
for _, e := range s.RegisteredEndpoints() {
|
|
e.Wait()
|
|
}
|
|
for _, e := range s.CleanupEndpoints() {
|
|
e.Wait()
|
|
}
|
|
for _, p := range s.transportProtocols {
|
|
p.proto.Wait()
|
|
}
|
|
for _, p := range s.networkProtocols {
|
|
p.Wait()
|
|
}
|
|
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
for _, n := range s.nics {
|
|
n.LinkEndpoint.Wait()
|
|
}
|
|
}
|
|
|
|
// Resume restarts the stack after a restore. This must be called after the
|
|
// entire system has been restored.
|
|
func (s *Stack) Resume() {
|
|
// ResumableEndpoint.Resume() may call other methods on s, so we can't hold
|
|
// s.mu while resuming the endpoints.
|
|
s.mu.Lock()
|
|
eps := s.resumableEndpoints
|
|
s.resumableEndpoints = nil
|
|
s.mu.Unlock()
|
|
for _, e := range eps {
|
|
e.Resume(s)
|
|
}
|
|
}
|
|
|
|
// RegisterPacketEndpoint registers ep with the stack, causing it to receive
|
|
// all traffic of the specified netProto on the given NIC. If nicID is 0, it
|
|
// receives traffic from every NIC.
|
|
func (s *Stack) RegisterPacketEndpoint(nicID tcpip.NICID, netProto tcpip.NetworkProtocolNumber, ep PacketEndpoint) tcpip.Error {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
|
|
// If no NIC is specified, capture on all devices.
|
|
if nicID == 0 {
|
|
// Register with each NIC.
|
|
for _, nic := range s.nics {
|
|
if err := nic.registerPacketEndpoint(netProto, ep); err != nil {
|
|
s.unregisterPacketEndpointLocked(0, netProto, ep)
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Capture on a specific device.
|
|
nic, ok := s.nics[nicID]
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
if err := nic.registerPacketEndpoint(netProto, ep); err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// UnregisterPacketEndpoint unregisters ep for packets of the specified
|
|
// netProto from the specified NIC. If nicID is 0, ep is unregistered from all
|
|
// NICs.
|
|
func (s *Stack) UnregisterPacketEndpoint(nicID tcpip.NICID, netProto tcpip.NetworkProtocolNumber, ep PacketEndpoint) {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
s.unregisterPacketEndpointLocked(nicID, netProto, ep)
|
|
}
|
|
|
|
func (s *Stack) unregisterPacketEndpointLocked(nicID tcpip.NICID, netProto tcpip.NetworkProtocolNumber, ep PacketEndpoint) {
|
|
// If no NIC is specified, unregister on all devices.
|
|
if nicID == 0 {
|
|
// Unregister with each NIC.
|
|
for _, nic := range s.nics {
|
|
nic.unregisterPacketEndpoint(netProto, ep)
|
|
}
|
|
return
|
|
}
|
|
|
|
// Unregister in a single device.
|
|
nic, ok := s.nics[nicID]
|
|
if !ok {
|
|
return
|
|
}
|
|
nic.unregisterPacketEndpoint(netProto, ep)
|
|
}
|
|
|
|
// WritePacketToRemote writes a payload on the specified NIC using the provided
|
|
// network protocol and remote link address.
|
|
func (s *Stack) WritePacketToRemote(nicID tcpip.NICID, remote tcpip.LinkAddress, netProto tcpip.NetworkProtocolNumber, payload buffer.VectorisedView) tcpip.Error {
|
|
s.mu.Lock()
|
|
nic, ok := s.nics[nicID]
|
|
s.mu.Unlock()
|
|
if !ok {
|
|
return &tcpip.ErrUnknownDevice{}
|
|
}
|
|
pkt := NewPacketBuffer(PacketBufferOptions{
|
|
ReserveHeaderBytes: int(nic.MaxHeaderLength()),
|
|
Data: payload,
|
|
})
|
|
return nic.WritePacketToRemote(remote, nil, netProto, pkt)
|
|
}
|
|
|
|
// NetworkProtocolInstance returns the protocol instance in the stack for the
|
|
// specified network protocol. This method is public for protocol implementers
|
|
// and tests to use.
|
|
func (s *Stack) NetworkProtocolInstance(num tcpip.NetworkProtocolNumber) NetworkProtocol {
|
|
if p, ok := s.networkProtocols[num]; ok {
|
|
return p
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// TransportProtocolInstance returns the protocol instance in the stack for the
|
|
// specified transport protocol. This method is public for protocol implementers
|
|
// and tests to use.
|
|
func (s *Stack) TransportProtocolInstance(num tcpip.TransportProtocolNumber) TransportProtocol {
|
|
if pState, ok := s.transportProtocols[num]; ok {
|
|
return pState.proto
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// AddTCPProbe installs a probe function that will be invoked on every segment
|
|
// received by a given TCP endpoint. The probe function is passed a copy of the
|
|
// TCP endpoint state before and after processing of the segment.
|
|
//
|
|
// NOTE: TCPProbe is added only to endpoints created after this call. Endpoints
|
|
// created prior to this call will not call the probe function.
|
|
//
|
|
// Further, installing two different probes back to back can result in some
|
|
// endpoints calling the first one and some the second one. There is no
|
|
// guarantee provided on which probe will be invoked. Ideally this should only
|
|
// be called once per stack.
|
|
func (s *Stack) AddTCPProbe(probe TCPProbeFunc) {
|
|
s.tcpProbeFunc.Store(probe)
|
|
}
|
|
|
|
// GetTCPProbe returns the TCPProbeFunc if installed with AddTCPProbe, nil
|
|
// otherwise.
|
|
func (s *Stack) GetTCPProbe() TCPProbeFunc {
|
|
p := s.tcpProbeFunc.Load()
|
|
if p == nil {
|
|
return nil
|
|
}
|
|
return p.(TCPProbeFunc)
|
|
}
|
|
|
|
// RemoveTCPProbe removes an installed TCP probe.
|
|
//
|
|
// NOTE: This only ensures that endpoints created after this call do not
|
|
// have a probe attached. Endpoints already created will continue to invoke
|
|
// TCP probe.
|
|
func (s *Stack) RemoveTCPProbe() {
|
|
// This must be TCPProbeFunc(nil) because atomic.Value.Store(nil) panics.
|
|
s.tcpProbeFunc.Store(TCPProbeFunc(nil))
|
|
}
|
|
|
|
// JoinGroup joins the given multicast group on the given NIC.
|
|
func (s *Stack) JoinGroup(protocol tcpip.NetworkProtocolNumber, nicID tcpip.NICID, multicastAddr tcpip.Address) tcpip.Error {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
if nic, ok := s.nics[nicID]; ok {
|
|
return nic.joinGroup(protocol, multicastAddr)
|
|
}
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
// LeaveGroup leaves the given multicast group on the given NIC.
|
|
func (s *Stack) LeaveGroup(protocol tcpip.NetworkProtocolNumber, nicID tcpip.NICID, multicastAddr tcpip.Address) tcpip.Error {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
if nic, ok := s.nics[nicID]; ok {
|
|
return nic.leaveGroup(protocol, multicastAddr)
|
|
}
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
// IsInGroup returns true if the NIC with ID nicID has joined the multicast
|
|
// group multicastAddr.
|
|
func (s *Stack) IsInGroup(nicID tcpip.NICID, multicastAddr tcpip.Address) (bool, tcpip.Error) {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
if nic, ok := s.nics[nicID]; ok {
|
|
return nic.isInGroup(multicastAddr), nil
|
|
}
|
|
return false, &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
// IPTables returns the stack's iptables.
|
|
func (s *Stack) IPTables() *IPTables {
|
|
return s.tables
|
|
}
|
|
|
|
// ICMPLimit returns the maximum number of ICMP messages that can be sent
|
|
// in one second.
|
|
func (s *Stack) ICMPLimit() rate.Limit {
|
|
return s.icmpRateLimiter.Limit()
|
|
}
|
|
|
|
// SetICMPLimit sets the maximum number of ICMP messages that be sent
|
|
// in one second.
|
|
func (s *Stack) SetICMPLimit(newLimit rate.Limit) {
|
|
s.icmpRateLimiter.SetLimit(newLimit)
|
|
}
|
|
|
|
// ICMPBurst returns the maximum number of ICMP messages that can be sent
|
|
// in a single burst.
|
|
func (s *Stack) ICMPBurst() int {
|
|
return s.icmpRateLimiter.Burst()
|
|
}
|
|
|
|
// SetICMPBurst sets the maximum number of ICMP messages that can be sent
|
|
// in a single burst.
|
|
func (s *Stack) SetICMPBurst(burst int) {
|
|
s.icmpRateLimiter.SetBurst(burst)
|
|
}
|
|
|
|
// AllowICMPMessage returns true if we the rate limiter allows at least one
|
|
// ICMP message to be sent at this instant.
|
|
func (s *Stack) AllowICMPMessage() bool {
|
|
return s.icmpRateLimiter.Allow()
|
|
}
|
|
|
|
// GetNetworkEndpoint returns the NetworkEndpoint with the specified protocol
|
|
// number installed on the specified NIC.
|
|
func (s *Stack) GetNetworkEndpoint(nicID tcpip.NICID, proto tcpip.NetworkProtocolNumber) (NetworkEndpoint, tcpip.Error) {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
|
|
nic, ok := s.nics[nicID]
|
|
if !ok {
|
|
return nil, &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.getNetworkEndpoint(proto), nil
|
|
}
|
|
|
|
// NUDConfigurations gets the per-interface NUD configurations.
|
|
func (s *Stack) NUDConfigurations(id tcpip.NICID, proto tcpip.NetworkProtocolNumber) (NUDConfigurations, tcpip.Error) {
|
|
s.mu.RLock()
|
|
nic, ok := s.nics[id]
|
|
s.mu.RUnlock()
|
|
|
|
if !ok {
|
|
return NUDConfigurations{}, &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.nudConfigs(proto)
|
|
}
|
|
|
|
// SetNUDConfigurations sets the per-interface NUD configurations.
|
|
//
|
|
// Note, if c contains invalid NUD configuration values, it will be fixed to
|
|
// use default values for the erroneous values.
|
|
func (s *Stack) SetNUDConfigurations(id tcpip.NICID, proto tcpip.NetworkProtocolNumber, c NUDConfigurations) tcpip.Error {
|
|
s.mu.RLock()
|
|
nic, ok := s.nics[id]
|
|
s.mu.RUnlock()
|
|
|
|
if !ok {
|
|
return &tcpip.ErrUnknownNICID{}
|
|
}
|
|
|
|
return nic.setNUDConfigs(proto, c)
|
|
}
|
|
|
|
// Seed returns a 32 bit value that can be used as a seed value for port
|
|
// picking, ISN generation etc.
|
|
//
|
|
// NOTE: The seed is generated once during stack initialization only.
|
|
func (s *Stack) Seed() uint32 {
|
|
return s.seed
|
|
}
|
|
|
|
// Rand returns a reference to a pseudo random generator that can be used
|
|
// to generate random numbers as required.
|
|
func (s *Stack) Rand() *mathrand.Rand {
|
|
return s.randomGenerator
|
|
}
|
|
|
|
// SecureRNG returns the stack's cryptographically secure random number
|
|
// generator.
|
|
func (s *Stack) SecureRNG() io.Reader {
|
|
return s.secureRNG
|
|
}
|
|
|
|
func generateRandUint32() uint32 {
|
|
b := make([]byte, 4)
|
|
if _, err := rand.Read(b); err != nil {
|
|
panic(err)
|
|
}
|
|
return binary.LittleEndian.Uint32(b)
|
|
}
|
|
|
|
func generateRandInt64() int64 {
|
|
b := make([]byte, 8)
|
|
if _, err := rand.Read(b); err != nil {
|
|
panic(err)
|
|
}
|
|
buf := bytes.NewReader(b)
|
|
var v int64
|
|
if err := binary.Read(buf, binary.LittleEndian, &v); err != nil {
|
|
panic(err)
|
|
}
|
|
return v
|
|
}
|
|
|
|
// FindNICNameFromID returns the name of the NIC for the given NICID.
|
|
func (s *Stack) FindNICNameFromID(id tcpip.NICID) string {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
nic, ok := s.nics[id]
|
|
if !ok {
|
|
return ""
|
|
}
|
|
|
|
return nic.Name()
|
|
}
|
|
|
|
// NewJob returns a new tcpip.Job using the stack's clock.
|
|
func (s *Stack) NewJob(l sync.Locker, f func()) *tcpip.Job {
|
|
return tcpip.NewJob(s.clock, l, f)
|
|
}
|
|
|
|
// ParseResult indicates the result of a parsing attempt.
|
|
type ParseResult int
|
|
|
|
const (
|
|
// ParsedOK indicates that a packet was successfully parsed.
|
|
ParsedOK ParseResult = iota
|
|
|
|
// UnknownTransportProtocol indicates that the transport protocol is unknown.
|
|
UnknownTransportProtocol
|
|
|
|
// TransportLayerParseError indicates that the transport packet was not
|
|
// successfully parsed.
|
|
TransportLayerParseError
|
|
)
|
|
|
|
// ParsePacketBufferTransport parses the provided packet buffer's transport
|
|
// header.
|
|
func (s *Stack) ParsePacketBufferTransport(protocol tcpip.TransportProtocolNumber, pkt *PacketBuffer) ParseResult {
|
|
// TODO(gvisor.dev/issue/170): ICMP packets don't have their TransportHeader
|
|
// fields set yet, parse it here. See icmp/protocol.go:protocol.Parse for a
|
|
// full explanation.
|
|
if protocol == header.ICMPv4ProtocolNumber || protocol == header.ICMPv6ProtocolNumber {
|
|
return ParsedOK
|
|
}
|
|
|
|
pkt.TransportProtocolNumber = protocol
|
|
// Parse the transport header if present.
|
|
state, ok := s.transportProtocols[protocol]
|
|
if !ok {
|
|
return UnknownTransportProtocol
|
|
}
|
|
|
|
if !state.proto.Parse(pkt) {
|
|
return TransportLayerParseError
|
|
}
|
|
|
|
return ParsedOK
|
|
}
|
|
|
|
// networkProtocolNumbers returns the network protocol numbers the stack is
|
|
// configured with.
|
|
func (s *Stack) networkProtocolNumbers() []tcpip.NetworkProtocolNumber {
|
|
protos := make([]tcpip.NetworkProtocolNumber, 0, len(s.networkProtocols))
|
|
for p := range s.networkProtocols {
|
|
protos = append(protos, p)
|
|
}
|
|
return protos
|
|
}
|
|
|
|
func isSubnetBroadcastOnNIC(nic *nic, protocol tcpip.NetworkProtocolNumber, addr tcpip.Address) bool {
|
|
addressEndpoint := nic.getAddressOrCreateTempInner(protocol, addr, false /* createTemp */, NeverPrimaryEndpoint)
|
|
if addressEndpoint == nil {
|
|
return false
|
|
}
|
|
|
|
subnet := addressEndpoint.Subnet()
|
|
addressEndpoint.DecRef()
|
|
return subnet.IsBroadcast(addr)
|
|
}
|
|
|
|
// IsSubnetBroadcast returns true if the provided address is a subnet-local
|
|
// broadcast address on the specified NIC and protocol.
|
|
//
|
|
// Returns false if the NIC is unknown or if the protocol is unknown or does
|
|
// not support addressing.
|
|
//
|
|
// If the NIC is not specified, the stack will check all NICs.
|
|
func (s *Stack) IsSubnetBroadcast(nicID tcpip.NICID, protocol tcpip.NetworkProtocolNumber, addr tcpip.Address) bool {
|
|
s.mu.RLock()
|
|
defer s.mu.RUnlock()
|
|
|
|
if nicID != 0 {
|
|
nic, ok := s.nics[nicID]
|
|
if !ok {
|
|
return false
|
|
}
|
|
|
|
return isSubnetBroadcastOnNIC(nic, protocol, addr)
|
|
}
|
|
|
|
for _, nic := range s.nics {
|
|
if isSubnetBroadcastOnNIC(nic, protocol, addr) {
|
|
return true
|
|
}
|
|
}
|
|
|
|
return false
|
|
}
|