personal_interest_mirrors/nebula
1
0
Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2026-04-01 05:45:19 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

rename

Browse Source
This commit is contained in:
JackDoan
2026-03-04 13:11:23 -06:00
parent 2e50518066
commit a2c2235b9b
3 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
firewall.go
View File

@@ -566,7 +566,7 @@ func (f *Firewall) identifyRemoteNetworkType(h *HostInfo, fp firewall.Packet) Ne
//RemoteAddr not in our networks table //RemoteAddr not in our networks table
if f.snatAddr.IsValid() && fp.IsIPv4() && h.HasOnlyV6Addresses() { if f.snatAddr.IsValid() && fp.IsIPv4() && h.HasOnlyV6Addresses() {
return NetworkTypeUncheckedSNATPeer return NetworkTypeUnverifiedSNATPeer
} else { } else {
return NetworkTypeInvalidPeer return NetworkTypeInvalidPeer
} }
@@ -583,7 +583,7 @@ func (f *Firewall) allowRemoteNetworkType(nwType NetworkType, fp firewall.Packet
return ErrPeerRejected // reject for now, one day this may have different FW rules return ErrPeerRejected // reject for now, one day this may have different FW rules
case NetworkTypeUnsafe: case NetworkTypeUnsafe:
return nil // nothing special, one day this may have different FW rules return nil // nothing special, one day this may have different FW rules
case NetworkTypeUncheckedSNATPeer: case NetworkTypeUnverifiedSNATPeer:
if f.unsafeIPv4Origin.IsValid() && fp.LocalAddr == f.unsafeIPv4Origin { if f.unsafeIPv4Origin.IsValid() && fp.LocalAddr == f.unsafeIPv4Origin {
return nil //the client case return nil //the client case
} }
@@ -668,7 +668,7 @@ func (f *Firewall) Drop(fp firewall.Packet, pkt []byte, incoming bool, h *HostIn
// We always want to conntrack since it is a faster operation // We always want to conntrack since it is a faster operation
c = f.addConn(fp, incoming) c = f.addConn(fp, incoming)
if incoming && remoteNetworkType == NetworkTypeUncheckedSNATPeer { if incoming && remoteNetworkType == NetworkTypeUnverifiedSNATPeer {
return f.applySnat(pkt, &fp, c, h) return f.applySnat(pkt, &fp, c, h)
} else { } else {
//outgoing snat is handled before this function is called //outgoing snat is handled before this function is called

4
hostmap.go
View File

@@ -224,8 +224,8 @@ const (
NetworkTypeVPNPeer NetworkTypeVPNPeer
// NetworkTypeUnsafe is a network from Certificate.UnsafeNetworks() // NetworkTypeUnsafe is a network from Certificate.UnsafeNetworks()
NetworkTypeUnsafe NetworkTypeUnsafe
// NetworkTypeUncheckedSNATPeer is used to indicate traffic we're willing to route, but never deliver to a NetworkTypeVPN // NetworkTypeUnverifiedSNATPeer is used to indicate traffic we're willing to route, but never deliver to a NetworkTypeVPN
NetworkTypeUncheckedSNATPeer NetworkTypeUnverifiedSNATPeer
NetworkTypeInvalidPeer NetworkTypeInvalidPeer
) )

10
snat_test.go
View File

@@ -335,7 +335,7 @@ func TestFirewall_IdentifyNetworkType_SNATPeer(t *testing.T) {
RemoteAddr: netip.MustParseAddr("10.0.0.1"), RemoteAddr: netip.MustParseAddr("10.0.0.1"),
LocalAddr: netip.MustParseAddr("192.168.1.1"), LocalAddr: netip.MustParseAddr("192.168.1.1"),
} }
assert.Equal(t, NetworkTypeUncheckedSNATPeer, fw.identifyRemoteNetworkType(h, fp)) assert.Equal(t, NetworkTypeUnverifiedSNATPeer, fw.identifyRemoteNetworkType(h, fp))
}) })
t.Run("v4 packet from v4 host is not snat peer", func(t *testing.T) { t.Run("v4 packet from v4 host is not snat peer", func(t *testing.T) {
@@ -373,12 +373,12 @@ func TestFirewall_AllowNetworkType_SNAT(t *testing.T) {
//todo fix! //todo fix!
//t.Run("snat peer allowed with snat addr", func(t *testing.T) { //t.Run("snat peer allowed with snat addr", func(t *testing.T) {
// fw := &Firewall{snatAddr: netip.MustParseAddr("169.254.55.96")} // fw := &Firewall{snatAddr: netip.MustParseAddr("169.254.55.96")}
// assert.NoError(t, fw.allowRemoteNetworkType(NetworkTypeUncheckedSNATPeer, fp)) // assert.NoError(t, fw.allowRemoteNetworkType(NetworkTypeUnverifiedSNATPeer, fp))
//}) //})
// //
//t.Run("snat peer rejected without snat addr", func(t *testing.T) { //t.Run("snat peer rejected without snat addr", func(t *testing.T) {
// fw := &Firewall{} // fw := &Firewall{}
// assert.ErrorIs(t, fw.allowRemoteNetworkType(NetworkTypeUncheckedSNATPeer, fp), ErrInvalidRemoteIP) // assert.ErrorIs(t, fw.allowRemoteNetworkType(NetworkTypeUnverifiedSNATPeer, fp), ErrInvalidRemoteIP)
//}) //})
t.Run("vpn always allowed", func(t *testing.T) { t.Run("vpn always allowed", func(t *testing.T) {
@@ -1291,7 +1291,7 @@ func TestFirewall_Drop_IPv4HostNotSNATted(t *testing.T) {
} }
nwType := fw.identifyRemoteNetworkType(h, fp) nwType := fw.identifyRemoteNetworkType(h, fp)
assert.Equal(t, NetworkTypeVPN, nwType, "v4 peer using its own VPN addr should be NetworkTypeVPN") assert.Equal(t, NetworkTypeVPN, nwType, "v4 peer using its own VPN addr should be NetworkTypeVPN")
assert.NotEqual(t, NetworkTypeUncheckedSNATPeer, nwType, "must NOT be classified as SNAT peer") assert.NotEqual(t, NetworkTypeUnverifiedSNATPeer, nwType, "must NOT be classified as SNAT peer")
}) })
t.Run("identifyRemoteNetworkType v4 peer with mismatched source", func(t *testing.T) { t.Run("identifyRemoteNetworkType v4 peer with mismatched source", func(t *testing.T) {
@@ -1305,6 +1305,6 @@ func TestFirewall_Drop_IPv4HostNotSNATted(t *testing.T) {
} }
nwType := fw.identifyRemoteNetworkType(h, fp) nwType := fw.identifyRemoteNetworkType(h, fp)
assert.Equal(t, NetworkTypeInvalidPeer, nwType, "v4 peer with mismatched source should be InvalidPeer") assert.Equal(t, NetworkTypeInvalidPeer, nwType, "v4 peer with mismatched source should be InvalidPeer")
assert.NotEqual(t, NetworkTypeUncheckedSNATPeer, nwType, "must NOT be classified as SNAT peer") assert.NotEqual(t, NetworkTypeUnverifiedSNATPeer, nwType, "must NOT be classified as SNAT peer")
}) })
} }