Skip to content

Commit 4edcaae

Browse files
lixmallixmal
committed
Add native bsd methods
1 parent baac3e9 commit 4edcaae

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+812
-440
lines changed

‎client/firewall/iptables/manager_linux_test.go

Lines changed: 15 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ package iptables
22

33
import (
44
"fmt"
5-
"net"
5+
"net/netip"
66
"testing"
77
"time"
88

@@ -19,11 +19,8 @@ var ifaceMock = &iFaceMock{
1919
},
2020
AddressFunc: func() wgaddr.Address {
2121
return wgaddr.Address{
22-
IP: net.ParseIP("10.20.0.1"),
23-
Network: &net.IPNet{
24-
IP: net.ParseIP("10.20.0.0"),
25-
Mask: net.IPv4Mask(255, 255, 255, 0),
26-
},
22+
IP: netip.MustParseAddr("10.20.0.1"),
23+
Network: netip.MustParsePrefix("10.20.0.0/24"),
2724
}
2825
},
2926
}
@@ -70,12 +67,12 @@ func TestIptablesManager(t *testing.T) {
7067

7168
var rule2 []fw.Rule
7269
t.Run("add second rule", func(t *testing.T) {
73-
ip := net.ParseIP("10.20.0.3")
70+
ip := netip.MustParseAddr("10.20.0.3")
7471
port := &fw.Port{
7572
IsRange: true,
7673
Values: []uint16{8043, 8046},
7774
}
78-
rule2, err = manager.AddPeerFiltering(nil, ip, "tcp", port, nil, fw.ActionAccept, "")
75+
rule2, err = manager.AddPeerFiltering(nil, ip.AsSlice(), "tcp", port, nil, fw.ActionAccept, "")
7976
require.NoError(t, err, "failed to add rule")
8077

8178
for _, r := range rule2 {
@@ -95,9 +92,9 @@ func TestIptablesManager(t *testing.T) {
9592

9693
t.Run("reset check", func(t *testing.T) {
9794
// add second rule
98-
ip := net.ParseIP("10.20.0.3")
95+
ip := netip.MustParseAddr("10.20.0.3")
9996
port := &fw.Port{Values: []uint16{5353}}
100-
_, err = manager.AddPeerFiltering(nil, ip, "udp", nil, port, fw.ActionAccept, "")
97+
_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), "udp", nil, port, fw.ActionAccept, "")
10198
require.NoError(t, err, "failed to add rule")
10299

103100
err = manager.Close(nil)
@@ -119,11 +116,8 @@ func TestIptablesManagerIPSet(t *testing.T) {
119116
},
120117
AddressFunc: func() wgaddr.Address {
121118
return wgaddr.Address{
122-
IP: net.ParseIP("10.20.0.1"),
123-
Network: &net.IPNet{
124-
IP: net.ParseIP("10.20.0.0"),
125-
Mask: net.IPv4Mask(255, 255, 255, 0),
126-
},
119+
IP: netip.MustParseAddr("10.20.0.1"),
120+
Network: netip.MustParsePrefix("10.20.0.0/24"),
127121
}
128122
},
129123
}
@@ -144,11 +138,11 @@ func TestIptablesManagerIPSet(t *testing.T) {
144138

145139
var rule2 []fw.Rule
146140
t.Run("add second rule", func(t *testing.T) {
147-
ip := net.ParseIP("10.20.0.3")
141+
ip := netip.MustParseAddr("10.20.0.3")
148142
port := &fw.Port{
149143
Values: []uint16{443},
150144
}
151-
rule2, err = manager.AddPeerFiltering(nil, ip, "tcp", port, nil, fw.ActionAccept, "default")
145+
rule2, err = manager.AddPeerFiltering(nil, ip.AsSlice(), "tcp", port, nil, fw.ActionAccept, "default")
152146
for _, r := range rule2 {
153147
require.NoError(t, err, "failed to add rule")
154148
require.Equal(t, r.(*Rule).ipsetName, "default-sport", "ipset name must be set")
@@ -186,11 +180,8 @@ func TestIptablesCreatePerformance(t *testing.T) {
186180
},
187181
AddressFunc: func() wgaddr.Address {
188182
return wgaddr.Address{
189-
IP: net.ParseIP("10.20.0.1"),
190-
Network: &net.IPNet{
191-
IP: net.ParseIP("10.20.0.0"),
192-
Mask: net.IPv4Mask(255, 255, 255, 0),
193-
},
183+
IP: netip.MustParseAddr("10.20.0.1"),
184+
Network: netip.MustParsePrefix("10.20.0.0/24"),
194185
}
195186
},
196187
}
@@ -212,11 +203,11 @@ func TestIptablesCreatePerformance(t *testing.T) {
212203

213204
require.NoError(t, err)
214205

215-
ip := net.ParseIP("10.20.0.100")
206+
ip := netip.MustParseAddr("10.20.0.100")
216207
start := time.Now()
217208
for i := 0; i < testMax; i++ {
218209
port := &fw.Port{Values: []uint16{uint16(1000 + i)}}
219-
_, err = manager.AddPeerFiltering(nil, ip, "tcp", nil, port, fw.ActionAccept, "")
210+
_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), "tcp", nil, port, fw.ActionAccept, "")
220211

221212
require.NoError(t, err, "failed to add rule")
222213
}

‎client/firewall/nftables/manager_linux_test.go

Lines changed: 11 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package nftables
33
import (
44
"bytes"
55
"fmt"
6-
"net"
76
"net/netip"
87
"os/exec"
98
"testing"
@@ -25,11 +24,8 @@ var ifaceMock = &iFaceMock{
2524
},
2625
AddressFunc: func() wgaddr.Address {
2726
return wgaddr.Address{
28-
IP: net.ParseIP("100.96.0.1"),
29-
Network: &net.IPNet{
30-
IP: net.ParseIP("100.96.0.0"),
31-
Mask: net.IPv4Mask(255, 255, 255, 0),
32-
},
27+
IP: netip.MustParseAddr("100.96.0.1"),
28+
Network: netip.MustParsePrefix("100.96.0.0/16"),
3329
}
3430
},
3531
}
@@ -70,11 +66,11 @@ func TestNftablesManager(t *testing.T) {
7066
time.Sleep(time.Second)
7167
}()
7268

73-
ip := net.ParseIP("100.96.0.1")
69+
ip := netip.MustParseAddr("100.96.0.1").Unmap()
7470

7571
testClient := &nftables.Conn{}
7672

77-
rule, err := manager.AddPeerFiltering(nil, ip, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{53}}, fw.ActionDrop, "")
73+
rule, err := manager.AddPeerFiltering(nil, ip.AsSlice(), fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{53}}, fw.ActionDrop, "")
7874
require.NoError(t, err, "failed to add rule")
7975

8076
err = manager.Flush()
@@ -109,8 +105,6 @@ func TestNftablesManager(t *testing.T) {
109105
}
110106
compareExprsIgnoringCounters(t, rules[0].Exprs, expectedExprs1)
111107

112-
ipToAdd, _ := netip.AddrFromSlice(ip)
113-
add := ipToAdd.Unmap()
114108
expectedExprs2 := []expr.Any{
115109
&expr.Payload{
116110
DestRegister: 1,
@@ -132,7 +126,7 @@ func TestNftablesManager(t *testing.T) {
132126
&expr.Cmp{
133127
Op: expr.CmpOpEq,
134128
Register: 1,
135-
Data: add.AsSlice(),
129+
Data: ip.AsSlice(),
136130
},
137131
&expr.Payload{
138132
DestRegister: 1,
@@ -173,11 +167,8 @@ func TestNFtablesCreatePerformance(t *testing.T) {
173167
},
174168
AddressFunc: func() wgaddr.Address {
175169
return wgaddr.Address{
176-
IP: net.ParseIP("100.96.0.1"),
177-
Network: &net.IPNet{
178-
IP: net.ParseIP("100.96.0.0"),
179-
Mask: net.IPv4Mask(255, 255, 255, 0),
180-
},
170+
IP: netip.MustParseAddr("100.96.0.1"),
171+
Network: netip.MustParsePrefix("100.96.0.0/16"),
181172
}
182173
},
183174
}
@@ -197,11 +188,11 @@ func TestNFtablesCreatePerformance(t *testing.T) {
197188
time.Sleep(time.Second)
198189
}()
199190

200-
ip := net.ParseIP("10.20.0.100")
191+
ip := netip.MustParseAddr("10.20.0.100")
201192
start := time.Now()
202193
for i := 0; i < testMax; i++ {
203194
port := &fw.Port{Values: []uint16{uint16(1000 + i)}}
204-
_, err = manager.AddPeerFiltering(nil, ip, "tcp", nil, port, fw.ActionAccept, "")
195+
_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), "tcp", nil, port, fw.ActionAccept, "")
205196
require.NoError(t, err, "failed to add rule")
206197

207198
if i%100 == 0 {
@@ -282,8 +273,8 @@ func TestNftablesManagerCompatibilityWithIptables(t *testing.T) {
282273
verifyIptablesOutput(t, stdout, stderr)
283274
})
284275

285-
ip := net.ParseIP("100.96.0.1")
286-
_, err = manager.AddPeerFiltering(nil, ip, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept, "")
276+
ip := netip.MustParseAddr("100.96.0.1")
277+
_, err = manager.AddPeerFiltering(nil, ip.AsSlice(), fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept, "")
287278
require.NoError(t, err, "failed to add peer filtering rule")
288279

289280
_, err = manager.AddRouteFiltering(

‎client/firewall/uspfilter/forwarder/forwarder.go

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ type Forwarder struct {
4141
udpForwarder *udpForwarder
4242
ctx context.Context
4343
cancel context.CancelFunc
44-
ip net.IP
44+
ip tcpip.Address
4545
netstack bool
4646
}
4747

@@ -71,12 +71,11 @@ func New(iface common.IFaceMapper, logger *nblog.Logger, flowLogger nftypes.Flow
7171
return nil, fmt.Errorf("failed to create NIC: %v", err)
7272
}
7373

74-
ones, _ := iface.Address().Network.Mask.Size()
7574
protoAddr := tcpip.ProtocolAddress{
7675
Protocol: ipv4.ProtocolNumber,
7776
AddressWithPrefix: tcpip.AddressWithPrefix{
78-
Address: tcpip.AddrFromSlice(iface.Address().IP.To4()),
79-
PrefixLen: ones,
77+
Address: tcpip.AddrFromSlice(iface.Address().IP.AsSlice()),
78+
PrefixLen: iface.Address().Network.Bits(),
8079
},
8180
}
8281

@@ -116,7 +115,7 @@ func New(iface common.IFaceMapper, logger *nblog.Logger, flowLogger nftypes.Flow
116115
ctx: ctx,
117116
cancel: cancel,
118117
netstack: netstack,
119-
ip: iface.Address().IP,
118+
ip: tcpip.AddrFromSlice(iface.Address().IP.AsSlice()),
120119
}
121120

122121
receiveWindow := defaultReceiveWindow
@@ -167,7 +166,7 @@ func (f *Forwarder) Stop() {
167166
}
168167

169168
func (f *Forwarder) determineDialAddr(addr tcpip.Address) net.IP {
170-
if f.netstack && f.ip.Equal(addr.AsSlice()) {
169+
if f.netstack && f.ip.Equal(addr) {
171170
return net.IPv4(127, 0, 0, 1)
172171
}
173172
return addr.AsSlice()
@@ -179,7 +178,6 @@ func (f *Forwarder) RegisterRuleID(srcIP, dstIP netip.Addr, srcPort, dstPort uin
179178
}
180179

181180
func (f *Forwarder) getRuleID(srcIP, dstIP netip.Addr, srcPort, dstPort uint16) ([]byte, bool) {
182-
183181
if value, ok := f.ruleIdMap.Load(buildKey(srcIP, dstIP, srcPort, dstPort)); ok {
184182
return value.([]byte), true
185183
} else if value, ok := f.ruleIdMap.Load(buildKey(dstIP, srcIP, dstPort, srcPort)); ok {

‎client/firewall/uspfilter/localip.go

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -45,24 +45,26 @@ func (m *localIPManager) setBitmapBit(ip net.IP) {
4545
m.ipv4Bitmap[high].bitmap[index] |= 1 << bit
4646
}
4747

48-
func (m *localIPManager) setBitInBitmap(ip net.IP, bitmap *[256]*ipv4LowBitmap, ipv4Set map[string]struct{}, ipv4Addresses *[]string) {
49-
if ipv4 := ip.To4(); ipv4 != nil {
50-
high := uint16(ipv4[0])
51-
low := (uint16(ipv4[1]) << 8) | (uint16(ipv4[2]) << 4) | uint16(ipv4[3])
48+
func (m *localIPManager) setBitInBitmap(ip netip.Addr, bitmap *[256]*ipv4LowBitmap, ipv4Set map[netip.Addr]struct{}, ipv4Addresses *[]netip.Addr) {
49+
if !ip.Is4() {
50+
return
51+
}
52+
ipv4 := ip.AsSlice()
5253

53-
if bitmap[high] == nil {
54-
bitmap[high] = &ipv4LowBitmap{}
55-
}
54+
high := uint16(ipv4[0])
55+
low := (uint16(ipv4[1]) << 8) | (uint16(ipv4[2]) << 4) | uint16(ipv4[3])
56+
57+
if bitmap[high] == nil {
58+
bitmap[high] = &ipv4LowBitmap{}
59+
}
5660

57-
index := low / 32
58-
bit := low % 32
59-
bitmap[high].bitmap[index] |= 1 << bit
61+
index := low / 32
62+
bit := low % 32
63+
bitmap[high].bitmap[index] |= 1 << bit
6064

61-
ipStr := ipv4.String()
62-
if _, exists := ipv4Set[ipStr]; !exists {
63-
ipv4Set[ipStr] = struct{}{}
64-
*ipv4Addresses = append(*ipv4Addresses, ipStr)
65-
}
65+
if _, exists := ipv4Set[ip]; !exists {
66+
ipv4Set[ip] = struct{}{}
67+
*ipv4Addresses = append(*ipv4Addresses, ip)
6668
}
6769
}
6870

@@ -79,12 +81,12 @@ func (m *localIPManager) checkBitmapBit(ip []byte) bool {
7981
return (m.ipv4Bitmap[high].bitmap[index] & (1 << bit)) != 0
8082
}
8183

82-
func (m *localIPManager) processIP(ip net.IP, bitmap *[256]*ipv4LowBitmap, ipv4Set map[string]struct{}, ipv4Addresses *[]string) error {
84+
func (m *localIPManager) processIP(ip netip.Addr, bitmap *[256]*ipv4LowBitmap, ipv4Set map[netip.Addr]struct{}, ipv4Addresses *[]netip.Addr) error {
8385
m.setBitInBitmap(ip, bitmap, ipv4Set, ipv4Addresses)
8486
return nil
8587
}
8688

87-
func (m *localIPManager) processInterface(iface net.Interface, bitmap *[256]*ipv4LowBitmap, ipv4Set map[string]struct{}, ipv4Addresses *[]string) {
89+
func (m *localIPManager) processInterface(iface net.Interface, bitmap *[256]*ipv4LowBitmap, ipv4Set map[netip.Addr]struct{}, ipv4Addresses *[]netip.Addr) {
8890
addrs, err := iface.Addrs()
8991
if err != nil {
9092
log.Debugf("get addresses for interface %s failed: %v", iface.Name, err)
@@ -102,7 +104,13 @@ func (m *localIPManager) processInterface(iface net.Interface, bitmap *[256]*ipv
102104
continue
103105
}
104106

105-
if err := m.processIP(ip, bitmap, ipv4Set, ipv4Addresses); err != nil {
107+
addr, ok := netip.AddrFromSlice(ip)
108+
if !ok {
109+
log.Warnf("invalid IP address %s in interface %s", ip.String(), iface.Name)
110+
continue
111+
}
112+
113+
if err := m.processIP(addr.Unmap(), bitmap, ipv4Set, ipv4Addresses); err != nil {
106114
log.Debugf("process IP failed: %v", err)
107115
}
108116
}
@@ -116,8 +124,8 @@ func (m *localIPManager) UpdateLocalIPs(iface common.IFaceMapper) (err error) {
116124
}()
117125

118126
var newIPv4Bitmap [256]*ipv4LowBitmap
119-
ipv4Set := make(map[string]struct{})
120-
var ipv4Addresses []string
127+
ipv4Set := make(map[netip.Addr]struct{})
128+
var ipv4Addresses []netip.Addr
121129

122130
// 127.0.0.0/8
123131
newIPv4Bitmap[127] = &ipv4LowBitmap{}

0 commit comments

Comments
 (0)