mirror of https://github.com/ethereum/go-ethereum
Merge pull request #3325 from fjl/p2p-netrestrict
Prevent relay of invalid IPs, add --netrestrictpull/3309/head
Felix Lange
8 years ago
committed by
GitHub
commit
d1a95c643e
@ -1,40 +0,0 @@ |
|||||||
// Copyright 2016 The go-ethereum Authors
|
|
||||||
// This file is part of the go-ethereum library.
|
|
||||||
//
|
|
||||||
// The go-ethereum library is free software: you can redistribute it and/or modify
|
|
||||||
// it under the terms of the GNU Lesser General Public License as published by
|
|
||||||
// the Free Software Foundation, either version 3 of the License, or
|
|
||||||
// (at your option) any later version.
|
|
||||||
//
|
|
||||||
// The go-ethereum library is distributed in the hope that it will be useful,
|
|
||||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
// GNU Lesser General Public License for more details.
|
|
||||||
//
|
|
||||||
// You should have received a copy of the GNU Lesser General Public License
|
|
||||||
// along with the go-ethereum library. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
//+build windows
|
|
||||||
|
|
||||||
package discv5 |
|
||||||
|
|
||||||
import ( |
|
||||||
"net" |
|
||||||
"os" |
|
||||||
"syscall" |
|
||||||
) |
|
||||||
|
|
||||||
const _WSAEMSGSIZE = syscall.Errno(10040) |
|
||||||
|
|
||||||
// reports whether err indicates that a UDP packet didn't
|
|
||||||
// fit the receive buffer. On Windows, WSARecvFrom returns
|
|
||||||
// code WSAEMSGSIZE and no data if this happens.
|
|
||||||
func isPacketTooBig(err error) bool { |
|
||||||
if opErr, ok := err.(*net.OpError); ok { |
|
||||||
if scErr, ok := opErr.Err.(*os.SyscallError); ok { |
|
||||||
return scErr.Err == _WSAEMSGSIZE |
|
||||||
} |
|
||||||
return opErr.Err == _WSAEMSGSIZE |
|
||||||
} |
|
||||||
return false |
|
||||||
} |
|
||||||
@ -0,0 +1,73 @@ |
|||||||
|
// Copyright 2016 The go-ethereum Authors
|
||||||
|
// This file is part of the go-ethereum library.
|
||||||
|
//
|
||||||
|
// The go-ethereum library is free software: you can redistribute it and/or modify
|
||||||
|
// it under the terms of the GNU Lesser General Public License as published by
|
||||||
|
// the Free Software Foundation, either version 3 of the License, or
|
||||||
|
// (at your option) any later version.
|
||||||
|
//
|
||||||
|
// The go-ethereum library is distributed in the hope that it will be useful,
|
||||||
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
// GNU Lesser General Public License for more details.
|
||||||
|
//
|
||||||
|
// You should have received a copy of the GNU Lesser General Public License
|
||||||
|
// along with the go-ethereum library. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
package netutil |
||||||
|
|
||||||
|
import ( |
||||||
|
"net" |
||||||
|
"testing" |
||||||
|
"time" |
||||||
|
) |
||||||
|
|
||||||
|
// This test checks that isPacketTooBig correctly identifies
|
||||||
|
// errors that result from receiving a UDP packet larger
|
||||||
|
// than the supplied receive buffer.
|
||||||
|
func TestIsPacketTooBig(t *testing.T) { |
||||||
|
listener, err := net.ListenPacket("udp", "127.0.0.1:0") |
||||||
|
if err != nil { |
||||||
|
t.Fatal(err) |
||||||
|
} |
||||||
|
defer listener.Close() |
||||||
|
sender, err := net.Dial("udp", listener.LocalAddr().String()) |
||||||
|
if err != nil { |
||||||
|
t.Fatal(err) |
||||||
|
} |
||||||
|
defer sender.Close() |
||||||
|
|
||||||
|
sendN := 1800 |
||||||
|
recvN := 300 |
||||||
|
for i := 0; i < 20; i++ { |
||||||
|
go func() { |
||||||
|
buf := make([]byte, sendN) |
||||||
|
for i := range buf { |
||||||
|
buf[i] = byte(i) |
||||||
|
} |
||||||
|
sender.Write(buf) |
||||||
|
}() |
||||||
|
|
||||||
|
buf := make([]byte, recvN) |
||||||
|
listener.SetDeadline(time.Now().Add(1 * time.Second)) |
||||||
|
n, _, err := listener.ReadFrom(buf) |
||||||
|
if err != nil { |
||||||
|
if nerr, ok := err.(net.Error); ok && nerr.Timeout() { |
||||||
|
continue |
||||||
|
} |
||||||
|
if !isPacketTooBig(err) { |
||||||
|
t.Fatalf("unexpected read error: %v", err) |
||||||
|
} |
||||||
|
continue |
||||||
|
} |
||||||
|
if n != recvN { |
||||||
|
t.Fatalf("short read: %d, want %d", n, recvN) |
||||||
|
} |
||||||
|
for i := range buf { |
||||||
|
if buf[i] != byte(i) { |
||||||
|
t.Fatalf("error in pattern") |
||||||
|
break |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,166 @@ |
|||||||
|
// Copyright 2016 The go-ethereum Authors
|
||||||
|
// This file is part of the go-ethereum library.
|
||||||
|
//
|
||||||
|
// The go-ethereum library is free software: you can redistribute it and/or modify
|
||||||
|
// it under the terms of the GNU Lesser General Public License as published by
|
||||||
|
// the Free Software Foundation, either version 3 of the License, or
|
||||||
|
// (at your option) any later version.
|
||||||
|
//
|
||||||
|
// The go-ethereum library is distributed in the hope that it will be useful,
|
||||||
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
// GNU Lesser General Public License for more details.
|
||||||
|
//
|
||||||
|
// You should have received a copy of the GNU Lesser General Public License
|
||||||
|
// along with the go-ethereum library. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
// Package netutil contains extensions to the net package.
|
||||||
|
package netutil |
||||||
|
|
||||||
|
import ( |
||||||
|
"errors" |
||||||
|
"net" |
||||||
|
"strings" |
||||||
|
) |
||||||
|
|
||||||
|
var lan4, lan6, special4, special6 Netlist |
||||||
|
|
||||||
|
func init() { |
||||||
|
// Lists from RFC 5735, RFC 5156,
|
||||||
|
// https://www.iana.org/assignments/iana-ipv4-special-registry/
|
||||||
|
lan4.Add("0.0.0.0/8") // "This" network
|
||||||
|
lan4.Add("10.0.0.0/8") // Private Use
|
||||||
|
lan4.Add("172.16.0.0/12") // Private Use
|
||||||
|
lan4.Add("192.168.0.0/16") // Private Use
|
||||||
|
lan6.Add("fe80::/10") // Link-Local
|
||||||
|
lan6.Add("fc00::/7") // Unique-Local
|
||||||
|
special4.Add("192.0.0.0/29") // IPv4 Service Continuity
|
||||||
|
special4.Add("192.0.0.9/32") // PCP Anycast
|
||||||
|
special4.Add("192.0.0.170/32") // NAT64/DNS64 Discovery
|
||||||
|
special4.Add("192.0.0.171/32") // NAT64/DNS64 Discovery
|
||||||
|
special4.Add("192.0.2.0/24") // TEST-NET-1
|
||||||
|
special4.Add("192.31.196.0/24") // AS112
|
||||||
|
special4.Add("192.52.193.0/24") // AMT
|
||||||
|
special4.Add("192.88.99.0/24") // 6to4 Relay Anycast
|
||||||
|
special4.Add("192.175.48.0/24") // AS112
|
||||||
|
special4.Add("198.18.0.0/15") // Device Benchmark Testing
|
||||||
|
special4.Add("198.51.100.0/24") // TEST-NET-2
|
||||||
|
special4.Add("203.0.113.0/24") // TEST-NET-3
|
||||||
|
special4.Add("255.255.255.255/32") // Limited Broadcast
|
||||||
|
|
||||||
|
// http://www.iana.org/assignments/iana-ipv6-special-registry/
|
||||||
|
special6.Add("100::/64") |
||||||
|
special6.Add("2001::/32") |
||||||
|
special6.Add("2001:1::1/128") |
||||||
|
special6.Add("2001:2::/48") |
||||||
|
special6.Add("2001:3::/32") |
||||||
|
special6.Add("2001:4:112::/48") |
||||||
|
special6.Add("2001:5::/32") |
||||||
|
special6.Add("2001:10::/28") |
||||||
|
special6.Add("2001:20::/28") |
||||||
|
special6.Add("2001:db8::/32") |
||||||
|
special6.Add("2002::/16") |
||||||
|
} |
||||||
|
|
||||||
|
// Netlist is a list of IP networks.
|
||||||
|
type Netlist []net.IPNet |
||||||
|
|
||||||
|
// ParseNetlist parses a comma-separated list of CIDR masks.
|
||||||
|
// Whitespace and extra commas are ignored.
|
||||||
|
func ParseNetlist(s string) (*Netlist, error) { |
||||||
|
ws := strings.NewReplacer(" ", "", "\n", "", "\t", "") |
||||||
|
masks := strings.Split(ws.Replace(s), ",") |
||||||
|
l := make(Netlist, 0) |
||||||
|
for _, mask := range masks { |
||||||
|
if mask == "" { |
||||||
|
continue |
||||||
|
} |
||||||
|
_, n, err := net.ParseCIDR(mask) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
l = append(l, *n) |
||||||
|
} |
||||||
|
return &l, nil |
||||||
|
} |
||||||
|
|
||||||
|
// Add parses a CIDR mask and appends it to the list. It panics for invalid masks and is
|
||||||
|
// intended to be used for setting up static lists.
|
||||||
|
func (l *Netlist) Add(cidr string) { |
||||||
|
_, n, err := net.ParseCIDR(cidr) |
||||||
|
if err != nil { |
||||||
|
panic(err) |
||||||
|
} |
||||||
|
*l = append(*l, *n) |
||||||
|
} |
||||||
|
|
||||||
|
// Contains reports whether the given IP is contained in the list.
|
||||||
|
func (l *Netlist) Contains(ip net.IP) bool { |
||||||
|
if l == nil { |
||||||
|
return false |
||||||
|
} |
||||||
|
for _, net := range *l { |
||||||
|
if net.Contains(ip) { |
||||||
|
return true |
||||||
|
} |
||||||
|
} |
||||||
|
return false |
||||||
|
} |
||||||
|
|
||||||
|
// IsLAN reports whether an IP is a local network address.
|
||||||
|
func IsLAN(ip net.IP) bool { |
||||||
|
if ip.IsLoopback() { |
||||||
|
return true |
||||||
|
} |
||||||
|
if v4 := ip.To4(); v4 != nil { |
||||||
|
return lan4.Contains(v4) |
||||||
|
} |
||||||
|
return lan6.Contains(ip) |
||||||
|
} |
||||||
|
|
||||||
|
// IsSpecialNetwork reports whether an IP is located in a special-use network range
|
||||||
|
// This includes broadcast, multicast and documentation addresses.
|
||||||
|
func IsSpecialNetwork(ip net.IP) bool { |
||||||
|
if ip.IsMulticast() { |
||||||
|
return true |
||||||
|
} |
||||||
|
if v4 := ip.To4(); v4 != nil { |
||||||
|
return special4.Contains(v4) |
||||||
|
} |
||||||
|
return special6.Contains(ip) |
||||||
|
} |
||||||
|
|
||||||
|
var ( |
||||||
|
errInvalid = errors.New("invalid IP") |
||||||
|
errUnspecified = errors.New("zero address") |
||||||
|
errSpecial = errors.New("special network") |
||||||
|
errLoopback = errors.New("loopback address from non-loopback host") |
||||||
|
errLAN = errors.New("LAN address from WAN host") |
||||||
|
) |
||||||
|
|
||||||
|
// CheckRelayIP reports whether an IP relayed from the given sender IP
|
||||||
|
// is a valid connection target.
|
||||||
|
//
|
||||||
|
// There are four rules:
|
||||||
|
// - Special network addresses are never valid.
|
||||||
|
// - Loopback addresses are OK if relayed by a loopback host.
|
||||||
|
// - LAN addresses are OK if relayed by a LAN host.
|
||||||
|
// - All other addresses are always acceptable.
|
||||||
|
func CheckRelayIP(sender, addr net.IP) error { |
||||||
|
if len(addr) != net.IPv4len && len(addr) != net.IPv6len { |
||||||
|
return errInvalid |
||||||
|
} |
||||||
|
if addr.IsUnspecified() { |
||||||
|
return errUnspecified |
||||||
|
} |
||||||
|
if IsSpecialNetwork(addr) { |
||||||
|
return errSpecial |
||||||
|
} |
||||||
|
if addr.IsLoopback() && !sender.IsLoopback() { |
||||||
|
return errLoopback |
||||||
|
} |
||||||
|
if IsLAN(addr) && !IsLAN(sender) { |
||||||
|
return errLAN |
||||||
|
} |
||||||
|
return nil |
||||||
|
} |
||||||
@ -0,0 +1,173 @@ |
|||||||
|
// Copyright 2016 The go-ethereum Authors
|
||||||
|
// This file is part of the go-ethereum library.
|
||||||
|
//
|
||||||
|
// The go-ethereum library is free software: you can redistribute it and/or modify
|
||||||
|
// it under the terms of the GNU Lesser General Public License as published by
|
||||||
|
// the Free Software Foundation, either version 3 of the License, or
|
||||||
|
// (at your option) any later version.
|
||||||
|
//
|
||||||
|
// The go-ethereum library is distributed in the hope that it will be useful,
|
||||||
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
// GNU Lesser General Public License for more details.
|
||||||
|
//
|
||||||
|
// You should have received a copy of the GNU Lesser General Public License
|
||||||
|
// along with the go-ethereum library. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
package netutil |
||||||
|
|
||||||
|
import ( |
||||||
|
"net" |
||||||
|
"reflect" |
||||||
|
"testing" |
||||||
|
|
||||||
|
"github.com/davecgh/go-spew/spew" |
||||||
|
) |
||||||
|
|
||||||
|
func TestParseNetlist(t *testing.T) { |
||||||
|
var tests = []struct { |
||||||
|
input string |
||||||
|
wantErr error |
||||||
|
wantList *Netlist |
||||||
|
}{ |
||||||
|
{ |
||||||
|
input: "", |
||||||
|
wantList: &Netlist{}, |
||||||
|
}, |
||||||
|
{ |
||||||
|
input: "127.0.0.0/8", |
||||||
|
wantErr: nil, |
||||||
|
wantList: &Netlist{{IP: net.IP{127, 0, 0, 0}, Mask: net.CIDRMask(8, 32)}}, |
||||||
|
}, |
||||||
|
{ |
||||||
|
input: "127.0.0.0/44", |
||||||
|
wantErr: &net.ParseError{Type: "CIDR address", Text: "127.0.0.0/44"}, |
||||||
|
}, |
||||||
|
{ |
||||||
|
input: "127.0.0.0/16, 23.23.23.23/24,", |
||||||
|
wantList: &Netlist{ |
||||||
|
{IP: net.IP{127, 0, 0, 0}, Mask: net.CIDRMask(16, 32)}, |
||||||
|
{IP: net.IP{23, 23, 23, 0}, Mask: net.CIDRMask(24, 32)}, |
||||||
|
}, |
||||||
|
}, |
||||||
|
} |
||||||
|
|
||||||
|
for _, test := range tests { |
||||||
|
l, err := ParseNetlist(test.input) |
||||||
|
if !reflect.DeepEqual(err, test.wantErr) { |
||||||
|
t.Errorf("%q: got error %q, want %q", test.input, err, test.wantErr) |
||||||
|
continue |
||||||
|
} |
||||||
|
if !reflect.DeepEqual(l, test.wantList) { |
||||||
|
spew.Dump(l) |
||||||
|
spew.Dump(test.wantList) |
||||||
|
t.Errorf("%q: got %v, want %v", test.input, l, test.wantList) |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
func TestNilNetListContains(t *testing.T) { |
||||||
|
var list *Netlist |
||||||
|
checkContains(t, list.Contains, nil, []string{"1.2.3.4"}) |
||||||
|
} |
||||||
|
|
||||||
|
func TestIsLAN(t *testing.T) { |
||||||
|
checkContains(t, IsLAN, |
||||||
|
[]string{ // included
|
||||||
|
"0.0.0.0", |
||||||
|
"0.2.0.8", |
||||||
|
"127.0.0.1", |
||||||
|
"10.0.1.1", |
||||||
|
"10.22.0.3", |
||||||
|
"172.31.252.251", |
||||||
|
"192.168.1.4", |
||||||
|
"fe80::f4a1:8eff:fec5:9d9d", |
||||||
|
"febf::ab32:2233", |
||||||
|
"fc00::4", |
||||||
|
}, |
||||||
|
[]string{ // excluded
|
||||||
|
"192.0.2.1", |
||||||
|
"1.0.0.0", |
||||||
|
"172.32.0.1", |
||||||
|
"fec0::2233", |
||||||
|
}, |
||||||
|
) |
||||||
|
} |
||||||
|
|
||||||
|
func TestIsSpecialNetwork(t *testing.T) { |
||||||
|
checkContains(t, IsSpecialNetwork, |
||||||
|
[]string{ // included
|
||||||
|
"192.0.2.1", |
||||||
|
"192.0.2.44", |
||||||
|
"2001:db8:85a3:8d3:1319:8a2e:370:7348", |
||||||
|
"255.255.255.255", |
||||||
|
"224.0.0.22", // IPv4 multicast
|
||||||
|
"ff05::1:3", // IPv6 multicast
|
||||||
|
}, |
||||||
|
[]string{ // excluded
|
||||||
|
"192.0.3.1", |
||||||
|
"1.0.0.0", |
||||||
|
"172.32.0.1", |
||||||
|
"fec0::2233", |
||||||
|
}, |
||||||
|
) |
||||||
|
} |
||||||
|
|
||||||
|
func checkContains(t *testing.T, fn func(net.IP) bool, inc, exc []string) { |
||||||
|
for _, s := range inc { |
||||||
|
if !fn(parseIP(s)) { |
||||||
|
t.Error("returned false for included address", s) |
||||||
|
} |
||||||
|
} |
||||||
|
for _, s := range exc { |
||||||
|
if fn(parseIP(s)) { |
||||||
|
t.Error("returned true for excluded address", s) |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
func parseIP(s string) net.IP { |
||||||
|
ip := net.ParseIP(s) |
||||||
|
if ip == nil { |
||||||
|
panic("invalid " + s) |
||||||
|
} |
||||||
|
return ip |
||||||
|
} |
||||||
|
|
||||||
|
func TestCheckRelayIP(t *testing.T) { |
||||||
|
tests := []struct { |
||||||
|
sender, addr string |
||||||
|
want error |
||||||
|
}{ |
||||||
|
{"127.0.0.1", "0.0.0.0", errUnspecified}, |
||||||
|
{"192.168.0.1", "0.0.0.0", errUnspecified}, |
||||||
|
{"23.55.1.242", "0.0.0.0", errUnspecified}, |
||||||
|
{"127.0.0.1", "255.255.255.255", errSpecial}, |
||||||
|
{"192.168.0.1", "255.255.255.255", errSpecial}, |
||||||
|
{"23.55.1.242", "255.255.255.255", errSpecial}, |
||||||
|
{"192.168.0.1", "127.0.2.19", errLoopback}, |
||||||
|
{"23.55.1.242", "192.168.0.1", errLAN}, |
||||||
|
|
||||||
|
{"127.0.0.1", "127.0.2.19", nil}, |
||||||
|
{"127.0.0.1", "192.168.0.1", nil}, |
||||||
|
{"127.0.0.1", "23.55.1.242", nil}, |
||||||
|
{"192.168.0.1", "192.168.0.1", nil}, |
||||||
|
{"192.168.0.1", "23.55.1.242", nil}, |
||||||
|
{"23.55.1.242", "23.55.1.242", nil}, |
||||||
|
} |
||||||
|
|
||||||
|
for _, test := range tests { |
||||||
|
err := CheckRelayIP(parseIP(test.sender), parseIP(test.addr)) |
||||||
|
if err != test.want { |
||||||
|
t.Errorf("%s from %s: got %q, want %q", test.addr, test.sender, err, test.want) |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
func BenchmarkCheckRelayIP(b *testing.B) { |
||||||
|
sender := parseIP("23.55.1.242") |
||||||
|
addr := parseIP("23.55.1.2") |
||||||
|
for i := 0; i < b.N; i++ { |
||||||
|
CheckRelayIP(sender, addr) |
||||||
|
} |
||||||
|
} |
||||||
Loading…
Reference in new issue