From 409a11445442488ec7e0397372a673910062fa5f Mon Sep 17 00:00:00 2001 From: Ghanan Gowripalan Date: Tue, 23 Mar 2021 09:54:57 -0700 Subject: Explicitly allow martian loopback packets ...instead of opting out of them. Loopback traffic should be stack-local but gVisor has some clients that depend on the ability to receive loopback traffic that originated from outside of the stack. Because of this, we guard this change behind IP protocol options. A previous change provided the facility to deny these martian loopback packets but this change requires client to opt-in to accepting martian loopback packets as accepting martian loopback packets are not meant to be accepted, as per RFC 1122 section 3.2.1.3.g: (g) { 127, } Internal host loopback address. Addresses of this form MUST NOT appear outside a host. PiperOrigin-RevId: 364581174 --- pkg/tcpip/network/ipv4/ipv4.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'pkg/tcpip/network/ipv4') diff --git a/pkg/tcpip/network/ipv4/ipv4.go b/pkg/tcpip/network/ipv4/ipv4.go index a43107d30..a1660e9a3 100644 --- a/pkg/tcpip/network/ipv4/ipv4.go +++ b/pkg/tcpip/network/ipv4/ipv4.go @@ -641,7 +641,7 @@ func (e *endpoint) HandlePacket(pkt *stack.PacketBuffer) { } if !e.nic.IsLoopback() { - if e.protocol.options.DropExternalLoopbackTraffic { + if !e.protocol.options.AllowExternalLoopbackTraffic { if header.IsV4LoopbackAddress(h.SourceAddress()) { stats.InvalidSourceAddressesReceived.Increment() return @@ -1230,9 +1230,9 @@ type Options struct { // IGMP holds options for IGMP. IGMP IGMPOptions - // DropExternalLoopbackTraffic indicates that inbound loopback packets (i.e. - // martian loopback packets) should be dropped. - DropExternalLoopbackTraffic bool + // AllowExternalLoopbackTraffic indicates that inbound loopback packets (i.e. + // martian loopback packets) should be accepted. + AllowExternalLoopbackTraffic bool } // NewProtocolWithOptions returns an IPv4 network protocol. -- cgit v1.2.3