Skip to content

Commit

Permalink
Fixes
Browse files Browse the repository at this point in the history
  • Loading branch information
@nbrownus
nbrownus committed Sep 20, 2024
1 parent fda8f96 commit 5567697
Show file tree
Hide file tree
Showing 4 changed files with 66 additions and 76 deletions.
4 changes: 2 additions & 2 deletions inside.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet

// Ignore local broadcast packets
if f.dropLocalBroadcast {
_, found := f.myBroadcastAddr.Lookup(fwPacket.RemoteIP)
_, found := f.myBroadcastAddrsTable.Lookup(fwPacket.RemoteIP)
if found {
return
}
Expand Down Expand Up @@ -129,7 +129,7 @@ func (f *Interface) Handshake(vpnIp netip.Addr) {
// getOrHandshake returns nil if the vpnIp is not routable.
// If the 2nd return var is false then the hostinfo is not ready to be used in a tunnel
func (f *Interface) getOrHandshake(vpnIp netip.Addr, cacheCallback func(*HandshakeHostInfo)) (*HostInfo, bool) {
_, found := f.myVpnNetworks.Lookup(vpnIp)
_, found := f.myVpnNetworksTable.Lookup(vpnIp)
if !found {
vpnIp = f.inside.RouteFor(vpnIp)
if !vpnIp.IsValid() {
Expand Down
103 changes: 43 additions & 60 deletions interface.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ import (
"github.com/gaissmai/bart"
"github.com/rcrowley/go-metrics"
"github.com/sirupsen/logrus"
"github.com/slackhq/nebula/cert"
"github.com/slackhq/nebula/config"
"github.com/slackhq/nebula/firewall"
"github.com/slackhq/nebula/header"
Expand Down Expand Up @@ -52,26 +51,27 @@ type InterfaceConfig struct {
}

type Interface struct {
hostMap *HostMap
outside udp.Conn
inside overlay.Device
pki *PKI
firewall *Firewall
connectionManager *connectionManager
handshakeManager *HandshakeManager
serveDns bool
createTime time.Time
lightHouse *LightHouse
myBroadcastAddr *bart.Table[struct{}]
myVpnAddrs []netip.Addr // A list of addresses assigned to us via our certificate
myVpnAddrsTable *bart.Table[struct{}] // A table of addresses assigned to us via our certificate
myVpnNetworks *bart.Table[struct{}] // A table of networks assigned to us via our certificate
dropLocalBroadcast bool
dropMulticast bool
routines int
disconnectInvalid atomic.Bool
closed atomic.Bool
relayManager *relayManager
hostMap *HostMap
outside udp.Conn
inside overlay.Device
pki *PKI
firewall *Firewall
connectionManager *connectionManager
handshakeManager *HandshakeManager
serveDns bool
createTime time.Time
lightHouse *LightHouse
myBroadcastAddrsTable *bart.Table[struct{}]
myVpnAddrs []netip.Addr // A list of addresses assigned to us via our certificate
myVpnAddrsTable *bart.Table[struct{}] // A table of addresses assigned to us via our certificate
myVpnNetworks []netip.Prefix // A table of networks assigned to us via our certificate
myVpnNetworksTable *bart.Table[struct{}] // A table of networks assigned to us via our certificate
dropLocalBroadcast bool
dropMulticast bool
routines int
disconnectInvalid atomic.Bool
closed atomic.Bool
relayManager *relayManager

tryPromoteEvery atomic.Uint32
reQueryEvery atomic.Uint32
Expand Down Expand Up @@ -157,25 +157,29 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
return nil, errors.New("no firewall rules")
}

cs := c.pki.getCertState()
ifce := &Interface{
pki: c.pki,
hostMap: c.HostMap,
outside: c.Outside,
inside: c.Inside,
firewall: c.Firewall,
serveDns: c.ServeDns,
handshakeManager: c.HandshakeManager,
createTime: time.Now(),
lightHouse: c.lightHouse,
dropLocalBroadcast: c.DropLocalBroadcast,
dropMulticast: c.DropMulticast,
routines: c.routines,
version: c.version,
writers: make([]udp.Conn, c.routines),
readers: make([]io.ReadWriteCloser, c.routines),
myVpnNetworks: new(bart.Table[struct{}]),
myVpnAddrsTable: new(bart.Table[struct{}]),
relayManager: c.relayManager,
pki: c.pki,
hostMap: c.HostMap,
outside: c.Outside,
inside: c.Inside,
firewall: c.Firewall,
serveDns: c.ServeDns,
handshakeManager: c.HandshakeManager,
createTime: time.Now(),
lightHouse: c.lightHouse,
dropLocalBroadcast: c.DropLocalBroadcast,
dropMulticast: c.DropMulticast,
routines: c.routines,
version: c.version,
writers: make([]udp.Conn, c.routines),
readers: make([]io.ReadWriteCloser, c.routines),
myVpnNetworks: cs.myVpnNetworks,
myVpnNetworksTable: cs.myVpnNetworksTable,
myVpnAddrs: cs.myVpnAddrs,
myVpnAddrsTable: cs.myVpnAddrsTable,
myBroadcastAddrsTable: cs.myVpnBroadcastAddrsTable,
relayManager: c.relayManager,

conntrackCacheTimeout: c.ConntrackCacheTimeout,

Expand All @@ -189,27 +193,6 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
l: c.l,
}

var crt cert.Certificate
cs := c.pki.getCertState()
crt = cs.getCertificate(cert.Version2)
if crt == nil {
// v2 certificates are a superset, only look at v1 if its all we have
crt = cs.getCertificate(cert.Version1)
}

for _, network := range crt.Networks() {
ifce.myVpnNetworks.Insert(network, struct{}{})
ifce.myVpnAddrsTable.Insert(netip.PrefixFrom(network.Addr(), network.Addr().BitLen()), struct{}{})
ifce.myVpnAddrs = append(ifce.myVpnAddrs, network.Addr())

if network.Addr().Is4() {
//TODO: finish calculating the broadcast ips
//addr := network.Masked().Addr().As4()
//binary.BigEndian.PutUint32(addr[:], binary.BigEndian.Uint32(addr[:])|^binary.BigEndian.Uint32(certificate.Details.Ips[0].Mask))
//ifce.myBroadcastAddr = netip.AddrFrom4(addr)
}
}

ifce.tryPromoteEvery.Store(c.tryPromoteEvery)
ifce.reQueryEvery.Store(c.reQueryEvery)
ifce.reQueryWait.Store(int64(c.reQueryWait))
Expand Down
2 changes: 1 addition & 1 deletion outside.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ func (f *Interface) readOutsidePackets(ip netip.AddrPort, via *ViaSender, out []

//l.Error("in packet ", header, packet[HeaderLen:])
if ip.IsValid() {
_, found := f.myVpnNetworks.Lookup(ip.Addr())
_, found := f.myVpnNetworksTable.Lookup(ip.Addr())
if found {
if f.l.Level >= logrus.DebugLevel {
f.l.WithField("udpAddr", ip).Debug("Refusing to process double encrypted packet")
Expand Down
33 changes: 20 additions & 13 deletions pki.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"encoding/json"
"errors"
"fmt"
"net"
"net/netip"
"os"
"slices"
Expand Down Expand Up @@ -37,10 +38,11 @@ type CertState struct {
pkcs11Backed bool
cipher string

myVpnNetworks []netip.Prefix
myVpnNetworksTable *bart.Table[struct{}]
myVpnAddrs []netip.Addr
myVpnAddrsTable *bart.Table[struct{}]
myVpnNetworks []netip.Prefix
myVpnNetworksTable *bart.Table[struct{}]
myVpnAddrs []netip.Addr
myVpnAddrsTable *bart.Table[struct{}]
myVpnBroadcastAddrsTable *bart.Table[struct{}]
}

func NewPKIFromConfig(l *logrus.Logger, c *config.C) (*PKI, error) {
Expand Down Expand Up @@ -294,7 +296,7 @@ func newCertStateFromConfig(c *config.C) (*CertState, error) {
}

var crt, v1, v2 cert.Certificate
for len(rawCert) != 0 {
for {
// Load the certificate
crt, rawCert, err = loadCertificate(rawCert)
if err != nil {
Expand All @@ -316,6 +318,10 @@ func newCertStateFromConfig(c *config.C) (*CertState, error) {
default:
return nil, fmt.Errorf("unknown certificate version %v", crt.Version())
}

if len(rawCert) == 0 || strings.TrimSpace(string(rawCert)) == "" {
break
}
}

rawDefaultVersion := c.GetUint32("pki.default_version", 1)
Expand All @@ -334,10 +340,11 @@ func newCertStateFromConfig(c *config.C) (*CertState, error) {

func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, privateKeyCurve cert.Curve, privateKey []byte) (*CertState, error) {
cs := CertState{
privateKey: privateKey,
pkcs11Backed: pkcs11backed,
myVpnNetworksTable: new(bart.Table[struct{}]),
myVpnAddrsTable: new(bart.Table[struct{}]),
privateKey: privateKey,
pkcs11Backed: pkcs11backed,
myVpnNetworksTable: new(bart.Table[struct{}]),
myVpnAddrsTable: new(bart.Table[struct{}]),
myVpnBroadcastAddrsTable: new(bart.Table[struct{}]),
}

if v1 != nil && v2 != nil {
Expand Down Expand Up @@ -409,10 +416,10 @@ func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, p
cs.myVpnAddrsTable.Insert(netip.PrefixFrom(network.Addr(), network.Addr().BitLen()), struct{}{})

if network.Addr().Is4() {
//TODO: finish calculating the broadcast ips
//addr := network.Masked().Addr().As4()
//binary.BigEndian.PutUint32(addr[:], binary.BigEndian.Uint32(addr[:])|^binary.BigEndian.Uint32(certificate.Details.Ips[0].Mask))
//ifce.myBroadcastAddr = netip.AddrFrom4(addr)
addr := network.Masked().Addr().As4()
mask := net.CIDRMask(network.Bits(), network.Addr().BitLen())
binary.BigEndian.PutUint32(addr[:], binary.BigEndian.Uint32(addr[:])|^binary.BigEndian.Uint32(mask))
cs.myVpnBroadcastAddrsTable.Insert(netip.PrefixFrom(netip.AddrFrom4(addr), network.Addr().BitLen()), struct{}{})
}
}

Expand Down

0 comments on commit 5567697

Please sign in to comment.