raw sockets: don't overwrite destination address

Also makes the behavior of raw sockets WRT fragmentation clearer, and makes the
ICMPv4 header-length check explicit.

Fixes #3160.

PiperOrigin-RevId: 380033450

8 files changed, 62 insertions, 27 deletions

diff --git a/pkg/tcpip/network/ip_test.go b/pkg/tcpip/network/ip_test.go
index bd63e0289..771b9173a 100644
--- a/pkg/tcpip/network/ip_test.go
+++ b/pkg/tcpip/network/ip_test.go
@@ -88,6 +88,7 @@ type testObject struct {
 
 	dataCalls    int
 	controlCalls int
+	rawCalls     int
 }
 
 // checkValues verifies that the transport protocol, data contents, src & dst
@@ -148,6 +149,10 @@ func (t *testObject) DeliverTransportError(local, remote tcpip.Address, net tcpi
 	t.controlCalls++
 }
 
+func (t *testObject) DeliverRawPacket(tcpip.TransportProtocolNumber, *stack.PacketBuffer) {
+	t.rawCalls++
+}
+
 // Attach is only implemented to satisfy the LinkEndpoint interface.
 func (*testObject) Attach(stack.NetworkDispatcher) {}
 
@@ -717,7 +722,10 @@ func TestReceive(t *testing.T) {
 			}
 			test.handlePacket(t, ep, &nic)
 			if nic.testObject.dataCalls != 1 {
-				t.Errorf("Bad number of data calls: got %x, want 1", nic.testObject.dataCalls)
+				t.Errorf("Bad number of data calls: got %d, want 1", nic.testObject.dataCalls)
+			}
+			if nic.testObject.rawCalls != 1 {
+				t.Errorf("Bad number of raw calls: got %d, want 1", nic.testObject.rawCalls)
 			}
 			if got := stat.Value(); got != 1 {
 				t.Errorf("got s.Stats().IP.PacketsReceived.Value() = %d, want = 1", got)
@@ -968,7 +976,10 @@ func TestIPv4FragmentationReceive(t *testing.T) {
 
 	ep.HandlePacket(pkt)
 	if nic.testObject.dataCalls != 0 {
-		t.Fatalf("Bad number of data calls: got %x, want 0", nic.testObject.dataCalls)
+		t.Fatalf("Bad number of data calls: got %d, want 0", nic.testObject.dataCalls)
+	}
+	if nic.testObject.rawCalls != 0 {
+		t.Errorf("Bad number of raw calls: got %d, want 0", nic.testObject.rawCalls)
 	}
 
 	// Send second segment.
@@ -977,7 +988,10 @@ func TestIPv4FragmentationReceive(t *testing.T) {
 	})
 	ep.HandlePacket(pkt)
 	if nic.testObject.dataCalls != 1 {
-		t.Fatalf("Bad number of data calls: got %x, want 1", nic.testObject.dataCalls)
+		t.Fatalf("Bad number of data calls: got %d, want 1", nic.testObject.dataCalls)
+	}
+	if nic.testObject.rawCalls != 1 {
+		t.Errorf("Bad number of raw calls: got %d, want 1", nic.testObject.rawCalls)
 	}
 }
 
@@ -1310,7 +1324,7 @@ func TestWriteHeaderIncludedPacket(t *testing.T) {
 					Protocol: transportProto,
 					TTL:      ipv4.DefaultTTL,
 					SrcAddr:  src,
-					DstAddr:  header.IPv4Any,
+					DstAddr:  remoteIPv4Addr,
 				})
 				return hdr.View().ToVectorisedView()
 			},
@@ -1351,7 +1365,7 @@ func TestWriteHeaderIncludedPacket(t *testing.T) {
 					Protocol: transportProto,
 					TTL:      ipv4.DefaultTTL,
 					SrcAddr:  src,
-					DstAddr:  header.IPv4Any,
+					DstAddr:  remoteIPv4Addr,
 				})
 				ip.SetHeaderLength(header.IPv4MinimumSize - 1)
 				return hdr.View().ToVectorisedView()
@@ -1370,7 +1384,7 @@ func TestWriteHeaderIncludedPacket(t *testing.T) {
 					Protocol: transportProto,
 					TTL:      ipv4.DefaultTTL,
 					SrcAddr:  src,
-					DstAddr:  header.IPv4Any,
+					DstAddr:  remoteIPv4Addr,
 				})
 				return buffer.View(ip[:len(ip)-1]).ToVectorisedView()
 			},
@@ -1388,7 +1402,7 @@ func TestWriteHeaderIncludedPacket(t *testing.T) {
 					Protocol: transportProto,
 					TTL:      ipv4.DefaultTTL,
 					SrcAddr:  src,
-					DstAddr:  header.IPv4Any,
+					DstAddr:  remoteIPv4Addr,
 				})
 				return buffer.View(ip).ToVectorisedView()
 			},
@@ -1430,7 +1444,7 @@ func TestWriteHeaderIncludedPacket(t *testing.T) {
 					Protocol: transportProto,
 					TTL:      ipv4.DefaultTTL,
 					SrcAddr:  src,
-					DstAddr:  header.IPv4Any,
+					DstAddr:  remoteIPv4Addr,
 					Options:  ipv4Options,
 				})
 				return hdr.View().ToVectorisedView()
@@ -1469,7 +1483,7 @@ func TestWriteHeaderIncludedPacket(t *testing.T) {
 					Protocol: transportProto,
 					TTL:      ipv4.DefaultTTL,
 					SrcAddr:  src,
-					DstAddr:  header.IPv4Any,
+					DstAddr:  remoteIPv4Addr,
 					Options:  ipv4Options,
 				})
 				vv := buffer.View(ip).ToVectorisedView()
@@ -1515,7 +1529,7 @@ func TestWriteHeaderIncludedPacket(t *testing.T) {
 					TransportProtocol: transportProto,
 					HopLimit:          ipv6.DefaultTTL,
 					SrcAddr:           src,
-					DstAddr:           header.IPv4Any,
+					DstAddr:           remoteIPv6Addr,
 				})
 				return hdr.View().ToVectorisedView()
 			},
@@ -1560,7 +1574,7 @@ func TestWriteHeaderIncludedPacket(t *testing.T) {
 					TransportProtocol: tcpip.TransportProtocolNumber(header.IPv6FragmentExtHdrIdentifier),
 					HopLimit:          ipv6.DefaultTTL,
 					SrcAddr:           src,
-					DstAddr:           header.IPv4Any,
+					DstAddr:           remoteIPv6Addr,
 				})
 				return hdr.View().ToVectorisedView()
 			},
@@ -1595,7 +1609,7 @@ func TestWriteHeaderIncludedPacket(t *testing.T) {
 					TransportProtocol: transportProto,
 					HopLimit:          ipv6.DefaultTTL,
 					SrcAddr:           src,
-					DstAddr:           header.IPv4Any,
+					DstAddr:           remoteIPv6Addr,
 				})
 				return buffer.View(ip).ToVectorisedView()
 			},
@@ -1630,7 +1644,7 @@ func TestWriteHeaderIncludedPacket(t *testing.T) {
 					TransportProtocol: transportProto,
 					HopLimit:          ipv6.DefaultTTL,
 					SrcAddr:           src,
-					DstAddr:           header.IPv4Any,
+					DstAddr:           remoteIPv4Addr,
 				})
 				return buffer.View(ip[:len(ip)-1]).ToVectorisedView()
 			},
diff --git a/pkg/tcpip/network/ipv4/ipv4.go b/pkg/tcpip/network/ipv4/ipv4.go
index f08b008ac..44c85bdb8 100644
--- a/pkg/tcpip/network/ipv4/ipv4.go
+++ b/pkg/tcpip/network/ipv4/ipv4.go
@@ -614,10 +614,6 @@ func (e *endpoint) WriteHeaderIncludedPacket(r *stack.Route, pkt *stack.PacketBu
 		ipH.SetSourceAddress(r.LocalAddress())
 	}
 
-	// Set the destination. If the packet already included a destination, it will
-	// be part of the route anyways.
-	ipH.SetDestinationAddress(r.RemoteAddress())
-
 	// Set the packet ID when zero.
 	if ipH.ID() == 0 {
 		// RFC 6864 section 4.3 mandates uniqueness of ID values for
@@ -860,6 +856,13 @@ func (e *endpoint) handleLocalPacket(pkt *stack.PacketBuffer, canSkipRXChecksum
 }
 
 func (e *endpoint) handleValidatedPacket(h header.IPv4, pkt *stack.PacketBuffer, inNICName string) {
+	// Raw socket packets are delivered based solely on the transport protocol
+	// number. We only require that the packet be valid IPv4, and that they not
+	// be fragmented.
+	if !h.More() && h.FragmentOffset() == 0 {
+		e.dispatcher.DeliverRawPacket(h.TransportProtocol(), pkt)
+	}
+
 	pkt.NICID = e.nic.ID()
 	stats := e.stats
 	stats.ip.ValidPacketsReceived.Increment()
@@ -995,6 +998,9 @@ func (e *endpoint) handleValidatedPacket(h header.IPv4, pkt *stack.PacketBuffer,
 		// to do it here.
 		h.SetTotalLength(uint16(pkt.Data().Size() + len(h)))
 		h.SetFlagsFragmentOffset(0, 0)
+
+		// Now that the packet is reassembled, it can be sent to raw sockets.
+		e.dispatcher.DeliverRawPacket(h.TransportProtocol(), pkt)
 	}
 	stats.ip.PacketsDelivered.Increment()
 
diff --git a/pkg/tcpip/network/ipv6/icmp_test.go b/pkg/tcpip/network/ipv6/icmp_test.go
index c2e9544c1..7c2a3e56b 100644
--- a/pkg/tcpip/network/ipv6/icmp_test.go
+++ b/pkg/tcpip/network/ipv6/icmp_test.go
@@ -90,6 +90,10 @@ func (*stubDispatcher) DeliverTransportPacket(tcpip.TransportProtocolNumber, *st
 	return stack.TransportPacketHandled
 }
 
+func (*stubDispatcher) DeliverRawPacket(tcpip.TransportProtocolNumber, *stack.PacketBuffer) {
+	// No-op.
+}
+
 var _ stack.NetworkInterface = (*testInterface)(nil)
 
 type testInterface struct {
diff --git a/pkg/tcpip/network/ipv6/ipv6.go b/pkg/tcpip/network/ipv6/ipv6.go
index 8c8fafcda..f5693defe 100644
--- a/pkg/tcpip/network/ipv6/ipv6.go
+++ b/pkg/tcpip/network/ipv6/ipv6.go
@@ -928,10 +928,6 @@ func (e *endpoint) WriteHeaderIncludedPacket(r *stack.Route, pkt *stack.PacketBu
 		ipH.SetSourceAddress(r.LocalAddress())
 	}
 
-	// Set the destination. If the packet already included a destination, it will
-	// be part of the route anyways.
-	ipH.SetDestinationAddress(r.RemoteAddress())
-
 	// Populate the packet buffer's network header and don't allow an invalid
 	// packet to be sent.
 	//
@@ -1128,6 +1124,10 @@ func (e *endpoint) handleLocalPacket(pkt *stack.PacketBuffer, canSkipRXChecksum
 }
 
 func (e *endpoint) handleValidatedPacket(h header.IPv6, pkt *stack.PacketBuffer, inNICName string) {
+	// Raw socket packets are delivered based solely on the transport protocol
+	// number. We only require that the packet be valid IPv6.
+	e.dispatcher.DeliverRawPacket(h.TransportProtocol(), pkt)
+
 	pkt.NICID = e.nic.ID()
 	stats := e.stats.ip
 	stats.ValidPacketsReceived.Increment()
diff --git a/pkg/tcpip/stack/nic.go b/pkg/tcpip/stack/nic.go
index 9cac6bbd1..b854d868c 100644
--- a/pkg/tcpip/stack/nic.go
+++ b/pkg/tcpip/stack/nic.go
@@ -779,11 +779,6 @@ func (n *nic) DeliverTransportPacket(protocol tcpip.TransportProtocolNumber, pkt
 
 	transProto := state.proto
 
-	// Raw socket packets are delivered based solely on the transport
-	// protocol number. We do not inspect the payload to ensure it's
-	// validly formed.
-	n.stack.demux.deliverRawPacket(protocol, pkt)
-
 	// TransportHeader is empty only when pkt is an ICMP packet or was reassembled
 	// from fragments.
 	if pkt.TransportHeader().View().IsEmpty() {
@@ -877,6 +872,17 @@ func (n *nic) DeliverTransportError(local, remote tcpip.Address, net tcpip.Netwo
 	}
 }
 
+// DeliverRawPacket implements TransportDispatcher.
+func (n *nic) DeliverRawPacket(protocol tcpip.TransportProtocolNumber, pkt *PacketBuffer) {
+	// For ICMPv4 only we validate the header length for compatibility with
+	// raw(7) ICMP_FILTER. The same check is made in Linux here:
+	// https://github.com/torvalds/linux/blob/70585216/net/ipv4/raw.c#L189.
+	if protocol == header.ICMPv4ProtocolNumber && pkt.TransportHeader().View().Size()+pkt.Data().Size() < header.ICMPv4MinimumSize {
+		return
+	}
+	n.stack.demux.deliverRawPacket(protocol, pkt)
+}
+
 // ID implements NetworkInterface.
 func (n *nic) ID() tcpip.NICID {
 	return n.id
diff --git a/pkg/tcpip/stack/registration.go b/pkg/tcpip/stack/registration.go
index a038389e0..dfe2c886f 100644
--- a/pkg/tcpip/stack/registration.go
+++ b/pkg/tcpip/stack/registration.go
@@ -265,6 +265,11 @@ type TransportDispatcher interface {
 	//
 	// DeliverTransportError takes ownership of the packet buffer.
 	DeliverTransportError(local, remote tcpip.Address, _ tcpip.NetworkProtocolNumber, _ tcpip.TransportProtocolNumber, _ TransportError, _ *PacketBuffer)
+
+	// DeliverRawPacket delivers a packet to any subscribed raw sockets.
+	//
+	// DeliverRawPacket does NOT take ownership of the packet buffer.
+	DeliverRawPacket(tcpip.TransportProtocolNumber, *PacketBuffer)
 }
 
 // PacketLooping specifies where an outbound packet should be sent.
diff --git a/pkg/tcpip/stack/transport_demuxer.go b/pkg/tcpip/stack/transport_demuxer.go
index 8a8454a6a..21af0cf37 100644
--- a/pkg/tcpip/stack/transport_demuxer.go
+++ b/pkg/tcpip/stack/transport_demuxer.go
@@ -16,6 +16,7 @@ package stack
 
 import (
 	"fmt"
+
 	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/hash/jenkins"
diff --git a/pkg/tcpip/transport/packet/endpoint.go b/pkg/tcpip/transport/packet/endpoint.go
index cd8c99d41..ed21c92ad 100644
--- a/pkg/tcpip/transport/packet/endpoint.go
+++ b/pkg/tcpip/transport/packet/endpoint.go
@@ -424,7 +424,6 @@ func (ep *endpoint) HandlePacket(nicID tcpip.NICID, localAddr tcpip.LinkAddress,
 		default:
 			panic(fmt.Sprintf("unexpected PktType in pkt: %+v", pkt))
 		}
-
 	} else {
 		// Raw packets need their ethernet headers prepended before
 		// queueing.