Rework some things into packages (#489)
This commit is contained in:
Nate Brown
20
udp/conn.go
Normal file
20
udp/conn.go
Normal file
@ -0,0 +1,20 @@
|
||||
package udp
|
||||
|
||||
import (
|
||||
"github.com/slackhq/nebula/firewall"
|
||||
"github.com/slackhq/nebula/header"
|
||||
)
|
||||
|
||||
const MTU = 9001
|
||||
|
||||
type EncReader func(
|
||||
addr *Addr,
|
||||
out []byte,
|
||||
packet []byte,
|
||||
header *header.H,
|
||||
fwPacket *firewall.Packet,
|
||||
lhh LightHouseHandlerFunc,
|
||||
nb []byte,
|
||||
q int,
|
||||
localCache firewall.ConntrackCache,
|
||||
)
|
||||
14
udp/temp.go
Normal file
14
udp/temp.go
Normal file
@ -0,0 +1,14 @@
|
||||
package udp
|
||||
|
||||
import (
|
||||
"github.com/slackhq/nebula/header"
|
||||
"github.com/slackhq/nebula/iputil"
|
||||
)
|
||||
|
||||
//TODO: The items in this file belong in their own packages but doing that in a single PR is a nightmare
|
||||
|
||||
type EncWriter interface {
|
||||
SendMessageToVpnIp(t header.MessageType, st header.MessageSubType, vpnIp iputil.VpnIp, p, nb, out []byte)
|
||||
}
|
||||
|
||||
type LightHouseHandlerFunc func(rAddr *Addr, vpnIp iputil.VpnIp, p []byte, w EncWriter)
|
||||
84
udp/udp_all.go
Normal file
84
udp/udp_all.go
Normal file
@ -0,0 +1,84 @@
|
||||
package udp
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net"
|
||||
"strconv"
|
||||
)
|
||||
|
||||
type m map[string]interface{}
|
||||
|
||||
type Addr struct {
|
||||
IP net.IP
|
||||
Port uint16
|
||||
}
|
||||
|
||||
func NewAddr(ip net.IP, port uint16) *Addr {
|
||||
addr := Addr{IP: make([]byte, net.IPv6len), Port: port}
|
||||
copy(addr.IP, ip.To16())
|
||||
return &addr
|
||||
}
|
||||
|
||||
func NewAddrFromString(s string) *Addr {
|
||||
ip, port, err := ParseIPAndPort(s)
|
||||
//TODO: handle err
|
||||
_ = err
|
||||
return &Addr{IP: ip.To16(), Port: port}
|
||||
}
|
||||
|
||||
func (ua *Addr) Equals(t *Addr) bool {
|
||||
if t == nil || ua == nil {
|
||||
return t == nil && ua == nil
|
||||
}
|
||||
return ua.IP.Equal(t.IP) && ua.Port == t.Port
|
||||
}
|
||||
|
||||
func (ua *Addr) String() string {
|
||||
if ua == nil {
|
||||
return "<nil>"
|
||||
}
|
||||
|
||||
return net.JoinHostPort(ua.IP.String(), fmt.Sprintf("%v", ua.Port))
|
||||
}
|
||||
|
||||
func (ua *Addr) MarshalJSON() ([]byte, error) {
|
||||
if ua == nil {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
return json.Marshal(m{"ip": ua.IP, "port": ua.Port})
|
||||
}
|
||||
|
||||
func (ua *Addr) Copy() *Addr {
|
||||
if ua == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
nu := Addr{
|
||||
Port: ua.Port,
|
||||
IP: make(net.IP, len(ua.IP)),
|
||||
}
|
||||
|
||||
copy(nu.IP, ua.IP)
|
||||
return &nu
|
||||
}
|
||||
|
||||
func ParseIPAndPort(s string) (net.IP, uint16, error) {
|
||||
rIp, sPort, err := net.SplitHostPort(s)
|
||||
if err != nil {
|
||||
return nil, 0, err
|
||||
}
|
||||
|
||||
addr, err := net.ResolveIPAddr("ip", rIp)
|
||||
if err != nil {
|
||||
return nil, 0, err
|
||||
}
|
||||
|
||||
iPort, err := strconv.Atoi(sPort)
|
||||
if err != nil {
|
||||
return nil, 0, err
|
||||
}
|
||||
|
||||
return addr.IP, uint16(iPort), nil
|
||||
}
|
||||
39
udp/udp_android.go
Normal file
39
udp/udp_android.go
Normal file
@ -0,0 +1,39 @@
|
||||
//go:build !e2e_testing
|
||||
// +build !e2e_testing
|
||||
|
||||
package udp
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net"
|
||||
"syscall"
|
||||
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
func NewListenConfig(multi bool) net.ListenConfig {
|
||||
return net.ListenConfig{
|
||||
Control: func(network, address string, c syscall.RawConn) error {
|
||||
if multi {
|
||||
var controlErr error
|
||||
err := c.Control(func(fd uintptr) {
|
||||
if err := syscall.SetsockoptInt(int(fd), syscall.SOL_SOCKET, unix.SO_REUSEPORT, 1); err != nil {
|
||||
controlErr = fmt.Errorf("SO_REUSEPORT failed: %v", err)
|
||||
return
|
||||
}
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if controlErr != nil {
|
||||
return controlErr
|
||||
}
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Conn) Rebind() error {
|
||||
return nil
|
||||
}
|
||||
47
udp/udp_darwin.go
Normal file
47
udp/udp_darwin.go
Normal file
@ -0,0 +1,47 @@
|
||||
//go:build !e2e_testing
|
||||
// +build !e2e_testing
|
||||
|
||||
package udp
|
||||
|
||||
// Darwin support is primarily implemented in udp_generic, besides NewListenConfig
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net"
|
||||
"syscall"
|
||||
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
func NewListenConfig(multi bool) net.ListenConfig {
|
||||
return net.ListenConfig{
|
||||
Control: func(network, address string, c syscall.RawConn) error {
|
||||
if multi {
|
||||
var controlErr error
|
||||
err := c.Control(func(fd uintptr) {
|
||||
if err := syscall.SetsockoptInt(int(fd), syscall.SOL_SOCKET, unix.SO_REUSEPORT, 1); err != nil {
|
||||
controlErr = fmt.Errorf("SO_REUSEPORT failed: %v", err)
|
||||
return
|
||||
}
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if controlErr != nil {
|
||||
return controlErr
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Conn) Rebind() error {
|
||||
file, err := u.File()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return syscall.SetsockoptInt(int(file.Fd()), unix.IPPROTO_IPV6, unix.IPV6_BOUND_IF, 0)
|
||||
}
|
||||
41
udp/udp_freebsd.go
Normal file
41
udp/udp_freebsd.go
Normal file
@ -0,0 +1,41 @@
|
||||
//go:build !e2e_testing
|
||||
// +build !e2e_testing
|
||||
|
||||
package udp
|
||||
|
||||
// FreeBSD support is primarily implemented in udp_generic, besides NewListenConfig
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net"
|
||||
"syscall"
|
||||
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
func NewListenConfig(multi bool) net.ListenConfig {
|
||||
return net.ListenConfig{
|
||||
Control: func(network, address string, c syscall.RawConn) error {
|
||||
if multi {
|
||||
var controlErr error
|
||||
err := c.Control(func(fd uintptr) {
|
||||
if err := syscall.SetsockoptInt(int(fd), syscall.SOL_SOCKET, unix.SO_REUSEPORT, 1); err != nil {
|
||||
controlErr = fmt.Errorf("SO_REUSEPORT failed: %v", err)
|
||||
return
|
||||
}
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if controlErr != nil {
|
||||
return controlErr
|
||||
}
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Conn) Rebind() error {
|
||||
return nil
|
||||
}
|
||||
91
udp/udp_generic.go
Normal file
91
udp/udp_generic.go
Normal file
@ -0,0 +1,91 @@
|
||||
//go:build (!linux || android) && !e2e_testing
|
||||
// +build !linux android
|
||||
// +build !e2e_testing
|
||||
|
||||
// udp_generic implements the nebula UDP interface in pure Go stdlib. This
|
||||
// means it can be used on platforms like Darwin and Windows.
|
||||
|
||||
package udp
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
|
||||
"github.com/sirupsen/logrus"
|
||||
"github.com/slackhq/nebula/config"
|
||||
"github.com/slackhq/nebula/firewall"
|
||||
"github.com/slackhq/nebula/header"
|
||||
)
|
||||
|
||||
type Conn struct {
|
||||
*net.UDPConn
|
||||
l *logrus.Logger
|
||||
}
|
||||
|
||||
func NewListener(l *logrus.Logger, ip string, port int, multi bool, batch int) (*Conn, error) {
|
||||
lc := NewListenConfig(multi)
|
||||
pc, err := lc.ListenPacket(context.TODO(), "udp", fmt.Sprintf("%s:%d", ip, port))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if uc, ok := pc.(*net.UDPConn); ok {
|
||||
return &Conn{UDPConn: uc, l: l}, nil
|
||||
}
|
||||
return nil, fmt.Errorf("Unexpected PacketConn: %T %#v", pc, pc)
|
||||
}
|
||||
|
||||
func (uc *Conn) WriteTo(b []byte, addr *Addr) error {
|
||||
_, err := uc.UDPConn.WriteToUDP(b, &net.UDPAddr{IP: addr.IP, Port: int(addr.Port)})
|
||||
return err
|
||||
}
|
||||
|
||||
func (uc *Conn) LocalAddr() (*Addr, error) {
|
||||
a := uc.UDPConn.LocalAddr()
|
||||
|
||||
switch v := a.(type) {
|
||||
case *net.UDPAddr:
|
||||
addr := &Addr{IP: make([]byte, len(v.IP))}
|
||||
copy(addr.IP, v.IP)
|
||||
addr.Port = uint16(v.Port)
|
||||
return addr, nil
|
||||
|
||||
default:
|
||||
return nil, fmt.Errorf("LocalAddr returned: %#v", a)
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Conn) ReloadConfig(c *config.C) {
|
||||
// TODO
|
||||
}
|
||||
|
||||
func NewUDPStatsEmitter(udpConns []*Conn) func() {
|
||||
// No UDP stats for non-linux
|
||||
return func() {}
|
||||
}
|
||||
|
||||
type rawMessage struct {
|
||||
Len uint32
|
||||
}
|
||||
|
||||
func (u *Conn) ListenOut(r EncReader, lhf LightHouseHandlerFunc, cache *firewall.ConntrackCacheTicker, q int) {
|
||||
plaintext := make([]byte, MTU)
|
||||
buffer := make([]byte, MTU)
|
||||
h := &header.H{}
|
||||
fwPacket := &firewall.Packet{}
|
||||
udpAddr := &Addr{IP: make([]byte, 16)}
|
||||
nb := make([]byte, 12, 12)
|
||||
|
||||
for {
|
||||
// Just read one packet at a time
|
||||
n, rua, err := u.ReadFromUDP(buffer)
|
||||
if err != nil {
|
||||
u.l.WithError(err).Error("Failed to read packets")
|
||||
continue
|
||||
}
|
||||
|
||||
udpAddr.IP = rua.IP
|
||||
udpAddr.Port = uint16(rua.Port)
|
||||
r(udpAddr, plaintext[:0], buffer[:n], h, fwPacket, lhf, nb, q, cache.Get(u.l))
|
||||
}
|
||||
}
|
||||
295
udp/udp_linux.go
Normal file
295
udp/udp_linux.go
Normal file
@ -0,0 +1,295 @@
|
||||
//go:build !android && !e2e_testing
|
||||
// +build !android,!e2e_testing
|
||||
|
||||
package udp
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
"fmt"
|
||||
"net"
|
||||
"syscall"
|
||||
"unsafe"
|
||||
|
||||
"github.com/rcrowley/go-metrics"
|
||||
"github.com/sirupsen/logrus"
|
||||
"github.com/slackhq/nebula/config"
|
||||
"github.com/slackhq/nebula/firewall"
|
||||
"github.com/slackhq/nebula/header"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
//TODO: make it support reload as best you can!
|
||||
|
||||
type Conn struct {
|
||||
sysFd int
|
||||
l *logrus.Logger
|
||||
batch int
|
||||
}
|
||||
|
||||
var x int
|
||||
|
||||
// From linux/sock_diag.h
|
||||
const (
|
||||
_SK_MEMINFO_RMEM_ALLOC = iota
|
||||
_SK_MEMINFO_RCVBUF
|
||||
_SK_MEMINFO_WMEM_ALLOC
|
||||
_SK_MEMINFO_SNDBUF
|
||||
_SK_MEMINFO_FWD_ALLOC
|
||||
_SK_MEMINFO_WMEM_QUEUED
|
||||
_SK_MEMINFO_OPTMEM
|
||||
_SK_MEMINFO_BACKLOG
|
||||
_SK_MEMINFO_DROPS
|
||||
|
||||
_SK_MEMINFO_VARS
|
||||
)
|
||||
|
||||
type _SK_MEMINFO [_SK_MEMINFO_VARS]uint32
|
||||
|
||||
func NewListener(l *logrus.Logger, ip string, port int, multi bool, batch int) (*Conn, error) {
|
||||
syscall.ForkLock.RLock()
|
||||
fd, err := unix.Socket(unix.AF_INET6, unix.SOCK_DGRAM, unix.IPPROTO_UDP)
|
||||
if err == nil {
|
||||
unix.CloseOnExec(fd)
|
||||
}
|
||||
syscall.ForkLock.RUnlock()
|
||||
|
||||
if err != nil {
|
||||
unix.Close(fd)
|
||||
return nil, fmt.Errorf("unable to open socket: %s", err)
|
||||
}
|
||||
|
||||
var lip [16]byte
|
||||
copy(lip[:], net.ParseIP(ip))
|
||||
|
||||
if multi {
|
||||
if err = unix.SetsockoptInt(fd, unix.SOL_SOCKET, unix.SO_REUSEPORT, 1); err != nil {
|
||||
return nil, fmt.Errorf("unable to set SO_REUSEPORT: %s", err)
|
||||
}
|
||||
}
|
||||
|
||||
//TODO: support multiple listening IPs (for limiting ipv6)
|
||||
if err = unix.Bind(fd, &unix.SockaddrInet6{Addr: lip, Port: port}); err != nil {
|
||||
return nil, fmt.Errorf("unable to bind to socket: %s", err)
|
||||
}
|
||||
|
||||
//TODO: this may be useful for forcing threads into specific cores
|
||||
//unix.SetsockoptInt(fd, unix.SOL_SOCKET, unix.SO_INCOMING_CPU, x)
|
||||
//v, err := unix.GetsockoptInt(fd, unix.SOL_SOCKET, unix.SO_INCOMING_CPU)
|
||||
//l.Println(v, err)
|
||||
|
||||
return &Conn{sysFd: fd, l: l, batch: batch}, err
|
||||
}
|
||||
|
||||
func (u *Conn) Rebind() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (u *Conn) SetRecvBuffer(n int) error {
|
||||
return unix.SetsockoptInt(u.sysFd, unix.SOL_SOCKET, unix.SO_RCVBUFFORCE, n)
|
||||
}
|
||||
|
||||
func (u *Conn) SetSendBuffer(n int) error {
|
||||
return unix.SetsockoptInt(u.sysFd, unix.SOL_SOCKET, unix.SO_SNDBUFFORCE, n)
|
||||
}
|
||||
|
||||
func (u *Conn) GetRecvBuffer() (int, error) {
|
||||
return unix.GetsockoptInt(int(u.sysFd), unix.SOL_SOCKET, unix.SO_RCVBUF)
|
||||
}
|
||||
|
||||
func (u *Conn) GetSendBuffer() (int, error) {
|
||||
return unix.GetsockoptInt(int(u.sysFd), unix.SOL_SOCKET, unix.SO_SNDBUF)
|
||||
}
|
||||
|
||||
func (u *Conn) LocalAddr() (*Addr, error) {
|
||||
sa, err := unix.Getsockname(u.sysFd)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
addr := &Addr{}
|
||||
switch sa := sa.(type) {
|
||||
case *unix.SockaddrInet4:
|
||||
addr.IP = net.IP{sa.Addr[0], sa.Addr[1], sa.Addr[2], sa.Addr[3]}.To16()
|
||||
addr.Port = uint16(sa.Port)
|
||||
case *unix.SockaddrInet6:
|
||||
addr.IP = sa.Addr[0:]
|
||||
addr.Port = uint16(sa.Port)
|
||||
}
|
||||
|
||||
return addr, nil
|
||||
}
|
||||
|
||||
func (u *Conn) ListenOut(r EncReader, lhf LightHouseHandlerFunc, cache *firewall.ConntrackCacheTicker, q int) {
|
||||
plaintext := make([]byte, MTU)
|
||||
h := &header.H{}
|
||||
fwPacket := &firewall.Packet{}
|
||||
udpAddr := &Addr{}
|
||||
nb := make([]byte, 12, 12)
|
||||
|
||||
//TODO: should we track this?
|
||||
//metric := metrics.GetOrRegisterHistogram("test.batch_read", nil, metrics.NewExpDecaySample(1028, 0.015))
|
||||
msgs, buffers, names := u.PrepareRawMessages(u.batch)
|
||||
read := u.ReadMulti
|
||||
if u.batch == 1 {
|
||||
read = u.ReadSingle
|
||||
}
|
||||
|
||||
for {
|
||||
n, err := read(msgs)
|
||||
if err != nil {
|
||||
u.l.WithError(err).Error("Failed to read packets")
|
||||
continue
|
||||
}
|
||||
|
||||
//metric.Update(int64(n))
|
||||
for i := 0; i < n; i++ {
|
||||
udpAddr.IP = names[i][8:24]
|
||||
udpAddr.Port = binary.BigEndian.Uint16(names[i][2:4])
|
||||
r(udpAddr, plaintext[:0], buffers[i][:msgs[i].Len], h, fwPacket, lhf, nb, q, cache.Get(u.l))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Conn) ReadSingle(msgs []rawMessage) (int, error) {
|
||||
for {
|
||||
n, _, err := unix.Syscall6(
|
||||
unix.SYS_RECVMSG,
|
||||
uintptr(u.sysFd),
|
||||
uintptr(unsafe.Pointer(&(msgs[0].Hdr))),
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
)
|
||||
|
||||
if err != 0 {
|
||||
return 0, &net.OpError{Op: "recvmsg", Err: err}
|
||||
}
|
||||
|
||||
msgs[0].Len = uint32(n)
|
||||
return 1, nil
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Conn) ReadMulti(msgs []rawMessage) (int, error) {
|
||||
for {
|
||||
n, _, err := unix.Syscall6(
|
||||
unix.SYS_RECVMMSG,
|
||||
uintptr(u.sysFd),
|
||||
uintptr(unsafe.Pointer(&msgs[0])),
|
||||
uintptr(len(msgs)),
|
||||
unix.MSG_WAITFORONE,
|
||||
0,
|
||||
0,
|
||||
)
|
||||
|
||||
if err != 0 {
|
||||
return 0, &net.OpError{Op: "recvmmsg", Err: err}
|
||||
}
|
||||
|
||||
return int(n), nil
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Conn) WriteTo(b []byte, addr *Addr) error {
|
||||
|
||||
var rsa unix.RawSockaddrInet6
|
||||
rsa.Family = unix.AF_INET6
|
||||
p := (*[2]byte)(unsafe.Pointer(&rsa.Port))
|
||||
p[0] = byte(addr.Port >> 8)
|
||||
p[1] = byte(addr.Port)
|
||||
copy(rsa.Addr[:], addr.IP)
|
||||
|
||||
for {
|
||||
_, _, err := unix.Syscall6(
|
||||
unix.SYS_SENDTO,
|
||||
uintptr(u.sysFd),
|
||||
uintptr(unsafe.Pointer(&b[0])),
|
||||
uintptr(len(b)),
|
||||
uintptr(0),
|
||||
uintptr(unsafe.Pointer(&rsa)),
|
||||
uintptr(unix.SizeofSockaddrInet6),
|
||||
)
|
||||
|
||||
if err != 0 {
|
||||
return &net.OpError{Op: "sendto", Err: err}
|
||||
}
|
||||
|
||||
//TODO: handle incomplete writes
|
||||
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Conn) ReloadConfig(c *config.C) {
|
||||
b := c.GetInt("listen.read_buffer", 0)
|
||||
if b > 0 {
|
||||
err := u.SetRecvBuffer(b)
|
||||
if err == nil {
|
||||
s, err := u.GetRecvBuffer()
|
||||
if err == nil {
|
||||
u.l.WithField("size", s).Info("listen.read_buffer was set")
|
||||
} else {
|
||||
u.l.WithError(err).Warn("Failed to get listen.read_buffer")
|
||||
}
|
||||
} else {
|
||||
u.l.WithError(err).Error("Failed to set listen.read_buffer")
|
||||
}
|
||||
}
|
||||
|
||||
b = c.GetInt("listen.write_buffer", 0)
|
||||
if b > 0 {
|
||||
err := u.SetSendBuffer(b)
|
||||
if err == nil {
|
||||
s, err := u.GetSendBuffer()
|
||||
if err == nil {
|
||||
u.l.WithField("size", s).Info("listen.write_buffer was set")
|
||||
} else {
|
||||
u.l.WithError(err).Warn("Failed to get listen.write_buffer")
|
||||
}
|
||||
} else {
|
||||
u.l.WithError(err).Error("Failed to set listen.write_buffer")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Conn) getMemInfo(meminfo *_SK_MEMINFO) error {
|
||||
var vallen uint32 = 4 * _SK_MEMINFO_VARS
|
||||
_, _, err := unix.Syscall6(unix.SYS_GETSOCKOPT, uintptr(u.sysFd), uintptr(unix.SOL_SOCKET), uintptr(unix.SO_MEMINFO), uintptr(unsafe.Pointer(meminfo)), uintptr(unsafe.Pointer(&vallen)), 0)
|
||||
if err != 0 {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func NewUDPStatsEmitter(udpConns []*Conn) func() {
|
||||
// Check if our kernel supports SO_MEMINFO before registering the gauges
|
||||
var udpGauges [][_SK_MEMINFO_VARS]metrics.Gauge
|
||||
var meminfo _SK_MEMINFO
|
||||
if err := udpConns[0].getMemInfo(&meminfo); err == nil {
|
||||
udpGauges = make([][_SK_MEMINFO_VARS]metrics.Gauge, len(udpConns))
|
||||
for i := range udpConns {
|
||||
udpGauges[i] = [_SK_MEMINFO_VARS]metrics.Gauge{
|
||||
metrics.GetOrRegisterGauge(fmt.Sprintf("udp.%d.rmem_alloc", i), nil),
|
||||
metrics.GetOrRegisterGauge(fmt.Sprintf("udp.%d.rcvbuf", i), nil),
|
||||
metrics.GetOrRegisterGauge(fmt.Sprintf("udp.%d.wmem_alloc", i), nil),
|
||||
metrics.GetOrRegisterGauge(fmt.Sprintf("udp.%d.sndbuf", i), nil),
|
||||
metrics.GetOrRegisterGauge(fmt.Sprintf("udp.%d.fwd_alloc", i), nil),
|
||||
metrics.GetOrRegisterGauge(fmt.Sprintf("udp.%d.wmem_queued", i), nil),
|
||||
metrics.GetOrRegisterGauge(fmt.Sprintf("udp.%d.optmem", i), nil),
|
||||
metrics.GetOrRegisterGauge(fmt.Sprintf("udp.%d.backlog", i), nil),
|
||||
metrics.GetOrRegisterGauge(fmt.Sprintf("udp.%d.drops", i), nil),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return func() {
|
||||
for i, gauges := range udpGauges {
|
||||
if err := udpConns[i].getMemInfo(&meminfo); err == nil {
|
||||
for j := 0; j < _SK_MEMINFO_VARS; j++ {
|
||||
gauges[j].Update(int64(meminfo[j]))
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
55
udp/udp_linux_32.go
Normal file
55
udp/udp_linux_32.go
Normal file
@ -0,0 +1,55 @@
|
||||
//go:build linux && (386 || amd64p32 || arm || mips || mipsle) && !android && !e2e_testing
|
||||
// +build linux
|
||||
// +build 386 amd64p32 arm mips mipsle
|
||||
// +build !android
|
||||
// +build !e2e_testing
|
||||
|
||||
package udp
|
||||
|
||||
import (
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
type iovec struct {
|
||||
Base *byte
|
||||
Len uint32
|
||||
}
|
||||
|
||||
type msghdr struct {
|
||||
Name *byte
|
||||
Namelen uint32
|
||||
Iov *iovec
|
||||
Iovlen uint32
|
||||
Control *byte
|
||||
Controllen uint32
|
||||
Flags int32
|
||||
}
|
||||
|
||||
type rawMessage struct {
|
||||
Hdr msghdr
|
||||
Len uint32
|
||||
}
|
||||
|
||||
func (u *Conn) PrepareRawMessages(n int) ([]rawMessage, [][]byte, [][]byte) {
|
||||
msgs := make([]rawMessage, n)
|
||||
buffers := make([][]byte, n)
|
||||
names := make([][]byte, n)
|
||||
|
||||
for i := range msgs {
|
||||
buffers[i] = make([]byte, MTU)
|
||||
names[i] = make([]byte, unix.SizeofSockaddrInet6)
|
||||
|
||||
//TODO: this is still silly, no need for an array
|
||||
vs := []iovec{
|
||||
{Base: &buffers[i][0], Len: uint32(len(buffers[i]))},
|
||||
}
|
||||
|
||||
msgs[i].Hdr.Iov = &vs[0]
|
||||
msgs[i].Hdr.Iovlen = uint32(len(vs))
|
||||
|
||||
msgs[i].Hdr.Name = &names[i][0]
|
||||
msgs[i].Hdr.Namelen = uint32(len(names[i]))
|
||||
}
|
||||
|
||||
return msgs, buffers, names
|
||||
}
|
||||
58
udp/udp_linux_64.go
Normal file
58
udp/udp_linux_64.go
Normal file
@ -0,0 +1,58 @@
|
||||
//go:build linux && (amd64 || arm64 || ppc64 || ppc64le || mips64 || mips64le || s390x || riscv64) && !android && !e2e_testing
|
||||
// +build linux
|
||||
// +build amd64 arm64 ppc64 ppc64le mips64 mips64le s390x riscv64
|
||||
// +build !android
|
||||
// +build !e2e_testing
|
||||
|
||||
package udp
|
||||
|
||||
import (
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
type iovec struct {
|
||||
Base *byte
|
||||
Len uint64
|
||||
}
|
||||
|
||||
type msghdr struct {
|
||||
Name *byte
|
||||
Namelen uint32
|
||||
Pad0 [4]byte
|
||||
Iov *iovec
|
||||
Iovlen uint64
|
||||
Control *byte
|
||||
Controllen uint64
|
||||
Flags int32
|
||||
Pad1 [4]byte
|
||||
}
|
||||
|
||||
type rawMessage struct {
|
||||
Hdr msghdr
|
||||
Len uint32
|
||||
Pad0 [4]byte
|
||||
}
|
||||
|
||||
func (u *Conn) PrepareRawMessages(n int) ([]rawMessage, [][]byte, [][]byte) {
|
||||
msgs := make([]rawMessage, n)
|
||||
buffers := make([][]byte, n)
|
||||
names := make([][]byte, n)
|
||||
|
||||
for i := range msgs {
|
||||
buffers[i] = make([]byte, MTU)
|
||||
names[i] = make([]byte, unix.SizeofSockaddrInet6)
|
||||
|
||||
//TODO: this is still silly, no need for an array
|
||||
vs := []iovec{
|
||||
{Base: &buffers[i][0], Len: uint64(len(buffers[i]))},
|
||||
}
|
||||
|
||||
msgs[i].Hdr.Iov = &vs[0]
|
||||
msgs[i].Hdr.Iovlen = uint64(len(vs))
|
||||
|
||||
msgs[i].Hdr.Name = &names[i][0]
|
||||
msgs[i].Hdr.Namelen = uint32(len(names[i]))
|
||||
}
|
||||
|
||||
return msgs, buffers, names
|
||||
}
|
||||
137
udp/udp_tester.go
Normal file
137
udp/udp_tester.go
Normal file
@ -0,0 +1,137 @@
|
||||
//go:build e2e_testing
|
||||
// +build e2e_testing
|
||||
|
||||
package udp
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net"
|
||||
|
||||
"github.com/sirupsen/logrus"
|
||||
"github.com/slackhq/nebula/config"
|
||||
"github.com/slackhq/nebula/firewall"
|
||||
"github.com/slackhq/nebula/header"
|
||||
)
|
||||
|
||||
type Packet struct {
|
||||
ToIp net.IP
|
||||
ToPort uint16
|
||||
FromIp net.IP
|
||||
FromPort uint16
|
||||
Data []byte
|
||||
}
|
||||
|
||||
func (u *Packet) Copy() *Packet {
|
||||
n := &Packet{
|
||||
ToIp: make(net.IP, len(u.ToIp)),
|
||||
ToPort: u.ToPort,
|
||||
FromIp: make(net.IP, len(u.FromIp)),
|
||||
FromPort: u.FromPort,
|
||||
Data: make([]byte, len(u.Data)),
|
||||
}
|
||||
|
||||
copy(n.ToIp, u.ToIp)
|
||||
copy(n.FromIp, u.FromIp)
|
||||
copy(n.Data, u.Data)
|
||||
return n
|
||||
}
|
||||
|
||||
type Conn struct {
|
||||
Addr *Addr
|
||||
|
||||
RxPackets chan *Packet // Packets to receive into nebula
|
||||
TxPackets chan *Packet // Packets transmitted outside by nebula
|
||||
|
||||
l *logrus.Logger
|
||||
}
|
||||
|
||||
func NewListener(l *logrus.Logger, ip string, port int, _ bool, _ int) (*Conn, error) {
|
||||
return &Conn{
|
||||
Addr: &Addr{net.ParseIP(ip), uint16(port)},
|
||||
RxPackets: make(chan *Packet, 1),
|
||||
TxPackets: make(chan *Packet, 1),
|
||||
l: l,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// Send will place a UdpPacket onto the receive queue for nebula to consume
|
||||
// this is an encrypted packet or a handshake message in most cases
|
||||
// packets were transmitted from another nebula node, you can send them with Tun.Send
|
||||
func (u *Conn) Send(packet *Packet) {
|
||||
h := &header.H{}
|
||||
if err := h.Parse(packet.Data); err != nil {
|
||||
panic(err)
|
||||
}
|
||||
u.l.WithField("header", h).
|
||||
WithField("udpAddr", fmt.Sprintf("%v:%v", packet.FromIp, packet.FromPort)).
|
||||
WithField("dataLen", len(packet.Data)).
|
||||
Info("UDP receiving injected packet")
|
||||
u.RxPackets <- packet
|
||||
}
|
||||
|
||||
// Get will pull a UdpPacket from the transmit queue
|
||||
// nebula meant to send this message on the network, it will be encrypted
|
||||
// packets were ingested from the tun side (in most cases), you can send them with Tun.Send
|
||||
func (u *Conn) Get(block bool) *Packet {
|
||||
if block {
|
||||
return <-u.TxPackets
|
||||
}
|
||||
|
||||
select {
|
||||
case p := <-u.TxPackets:
|
||||
return p
|
||||
default:
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
//********************************************************************************************************************//
|
||||
// Below this is boilerplate implementation to make nebula actually work
|
||||
//********************************************************************************************************************//
|
||||
|
||||
func (u *Conn) WriteTo(b []byte, addr *Addr) error {
|
||||
p := &Packet{
|
||||
Data: make([]byte, len(b), len(b)),
|
||||
FromIp: make([]byte, 16),
|
||||
FromPort: u.Addr.Port,
|
||||
ToIp: make([]byte, 16),
|
||||
ToPort: addr.Port,
|
||||
}
|
||||
|
||||
copy(p.Data, b)
|
||||
copy(p.ToIp, addr.IP.To16())
|
||||
copy(p.FromIp, u.Addr.IP.To16())
|
||||
|
||||
u.TxPackets <- p
|
||||
return nil
|
||||
}
|
||||
|
||||
func (u *Conn) ListenOut(r EncReader, lhf LightHouseHandlerFunc, cache *firewall.ConntrackCacheTicker, q int) {
|
||||
plaintext := make([]byte, MTU)
|
||||
h := &header.H{}
|
||||
fwPacket := &firewall.Packet{}
|
||||
ua := &Addr{IP: make([]byte, 16)}
|
||||
nb := make([]byte, 12, 12)
|
||||
|
||||
for {
|
||||
p := <-u.RxPackets
|
||||
ua.Port = p.FromPort
|
||||
copy(ua.IP, p.FromIp.To16())
|
||||
r(ua, plaintext[:0], p.Data, h, fwPacket, lhf, nb, q, cache.Get(u.l))
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Conn) ReloadConfig(*config.C) {}
|
||||
|
||||
func NewUDPStatsEmitter(_ []*Conn) func() {
|
||||
// No UDP stats for non-linux
|
||||
return func() {}
|
||||
}
|
||||
|
||||
func (u *Conn) LocalAddr() (*Addr, error) {
|
||||
return u.Addr, nil
|
||||
}
|
||||
|
||||
func (u *Conn) Rebind() error {
|
||||
return nil
|
||||
}
|
||||
29
udp/udp_windows.go
Normal file
29
udp/udp_windows.go
Normal file
@ -0,0 +1,29 @@
|
||||
//go:build !e2e_testing
|
||||
// +build !e2e_testing
|
||||
|
||||
package udp
|
||||
|
||||
// Windows support is primarily implemented in udp_generic, besides NewListenConfig
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
func NewListenConfig(multi bool) net.ListenConfig {
|
||||
return net.ListenConfig{
|
||||
Control: func(network, address string, c syscall.RawConn) error {
|
||||
if multi {
|
||||
// There is no way to support multiple listeners safely on Windows:
|
||||
// https://docs.microsoft.com/en-us/windows/desktop/winsock/using-so-reuseaddr-and-so-exclusiveaddruse
|
||||
return fmt.Errorf("multiple udp listeners not supported on windows")
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (u *Conn) Rebind() error {
|
||||
return nil
|
||||
}
|
||||
Reference in New Issue
Block a user