tun_common.go 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199
  1. package nebula
  2. import (
  3. "fmt"
  4. "net"
  5. "strconv"
  6. "github.com/slackhq/nebula/config"
  7. )
  8. const DEFAULT_MTU = 1300
  9. type route struct {
  10. mtu int
  11. route *net.IPNet
  12. via *net.IP
  13. }
  14. func parseRoutes(c *config.C, network *net.IPNet) ([]route, error) {
  15. var err error
  16. r := c.Get("tun.routes")
  17. if r == nil {
  18. return []route{}, nil
  19. }
  20. rawRoutes, ok := r.([]interface{})
  21. if !ok {
  22. return nil, fmt.Errorf("tun.routes is not an array")
  23. }
  24. if len(rawRoutes) < 1 {
  25. return []route{}, nil
  26. }
  27. routes := make([]route, len(rawRoutes))
  28. for i, r := range rawRoutes {
  29. m, ok := r.(map[interface{}]interface{})
  30. if !ok {
  31. return nil, fmt.Errorf("entry %v in tun.routes is invalid", i+1)
  32. }
  33. rMtu, ok := m["mtu"]
  34. if !ok {
  35. return nil, fmt.Errorf("entry %v.mtu in tun.routes is not present", i+1)
  36. }
  37. mtu, ok := rMtu.(int)
  38. if !ok {
  39. mtu, err = strconv.Atoi(rMtu.(string))
  40. if err != nil {
  41. return nil, fmt.Errorf("entry %v.mtu in tun.routes is not an integer: %v", i+1, err)
  42. }
  43. }
  44. if mtu < 500 {
  45. return nil, fmt.Errorf("entry %v.mtu in tun.routes is below 500: %v", i+1, mtu)
  46. }
  47. rRoute, ok := m["route"]
  48. if !ok {
  49. return nil, fmt.Errorf("entry %v.route in tun.routes is not present", i+1)
  50. }
  51. r := route{
  52. mtu: mtu,
  53. }
  54. _, r.route, err = net.ParseCIDR(fmt.Sprintf("%v", rRoute))
  55. if err != nil {
  56. return nil, fmt.Errorf("entry %v.route in tun.routes failed to parse: %v", i+1, err)
  57. }
  58. if !ipWithin(network, r.route) {
  59. return nil, fmt.Errorf(
  60. "entry %v.route in tun.routes is not contained within the network attached to the certificate; route: %v, network: %v",
  61. i+1,
  62. r.route.String(),
  63. network.String(),
  64. )
  65. }
  66. routes[i] = r
  67. }
  68. return routes, nil
  69. }
  70. func parseUnsafeRoutes(c *config.C, network *net.IPNet) ([]route, error) {
  71. var err error
  72. r := c.Get("tun.unsafe_routes")
  73. if r == nil {
  74. return []route{}, nil
  75. }
  76. rawRoutes, ok := r.([]interface{})
  77. if !ok {
  78. return nil, fmt.Errorf("tun.unsafe_routes is not an array")
  79. }
  80. if len(rawRoutes) < 1 {
  81. return []route{}, nil
  82. }
  83. routes := make([]route, len(rawRoutes))
  84. for i, r := range rawRoutes {
  85. m, ok := r.(map[interface{}]interface{})
  86. if !ok {
  87. return nil, fmt.Errorf("entry %v in tun.unsafe_routes is invalid", i+1)
  88. }
  89. rMtu, ok := m["mtu"]
  90. if !ok {
  91. rMtu = c.GetInt("tun.mtu", DEFAULT_MTU)
  92. }
  93. mtu, ok := rMtu.(int)
  94. if !ok {
  95. mtu, err = strconv.Atoi(rMtu.(string))
  96. if err != nil {
  97. return nil, fmt.Errorf("entry %v.mtu in tun.unsafe_routes is not an integer: %v", i+1, err)
  98. }
  99. }
  100. if mtu < 500 {
  101. return nil, fmt.Errorf("entry %v.mtu in tun.unsafe_routes is below 500: %v", i+1, mtu)
  102. }
  103. rVia, ok := m["via"]
  104. if !ok {
  105. return nil, fmt.Errorf("entry %v.via in tun.unsafe_routes is not present", i+1)
  106. }
  107. via, ok := rVia.(string)
  108. if !ok {
  109. return nil, fmt.Errorf("entry %v.via in tun.unsafe_routes is not a string: found %T", i+1, rVia)
  110. }
  111. nVia := net.ParseIP(via)
  112. if nVia == nil {
  113. return nil, fmt.Errorf("entry %v.via in tun.unsafe_routes failed to parse address: %v", i+1, via)
  114. }
  115. rRoute, ok := m["route"]
  116. if !ok {
  117. return nil, fmt.Errorf("entry %v.route in tun.unsafe_routes is not present", i+1)
  118. }
  119. r := route{
  120. via: &nVia,
  121. mtu: mtu,
  122. }
  123. _, r.route, err = net.ParseCIDR(fmt.Sprintf("%v", rRoute))
  124. if err != nil {
  125. return nil, fmt.Errorf("entry %v.route in tun.unsafe_routes failed to parse: %v", i+1, err)
  126. }
  127. if ipWithin(network, r.route) {
  128. return nil, fmt.Errorf(
  129. "entry %v.route in tun.unsafe_routes is contained within the network attached to the certificate; route: %v, network: %v",
  130. i+1,
  131. r.route.String(),
  132. network.String(),
  133. )
  134. }
  135. routes[i] = r
  136. }
  137. return routes, nil
  138. }
  139. func ipWithin(o *net.IPNet, i *net.IPNet) bool {
  140. // Make sure o contains the lowest form of i
  141. if !o.Contains(i.IP.Mask(i.Mask)) {
  142. return false
  143. }
  144. // Find the max ip in i
  145. ip4 := i.IP.To4()
  146. if ip4 == nil {
  147. return false
  148. }
  149. last := make(net.IP, len(ip4))
  150. copy(last, ip4)
  151. for x := range ip4 {
  152. last[x] |= ^i.Mask[x]
  153. }
  154. // Make sure o contains the max
  155. if !o.Contains(last) {
  156. return false
  157. }
  158. return true
  159. }