Explicitly allow martian loopback packets
...instead of opting out of them.
Loopback traffic should be stack-local but gVisor has some clients
that depend on the ability to receive loopback traffic that originated
from outside of the stack. Because of this, we guard this change behind
IP protocol options.
A previous change provided the facility to deny these martian loopback
packets but this change requires client to opt-in to accepting martian
loopback packets as accepting martian loopback packets are not meant
to be accepted, as per RFC 1122 section 3.2.1.3.g:
(g) { 127, <any> }
Internal host loopback address. Addresses of this form
MUST NOT appear outside a host.
PiperOrigin-RevId: 364581174
diff --git a/pkg/tcpip/network/ipv4/ipv4.go b/pkg/tcpip/network/ipv4/ipv4.go
index a43107d..a1660e9 100644
--- a/pkg/tcpip/network/ipv4/ipv4.go
+++ b/pkg/tcpip/network/ipv4/ipv4.go
@@ -641,7 +641,7 @@
}
if !e.nic.IsLoopback() {
- if e.protocol.options.DropExternalLoopbackTraffic {
+ if !e.protocol.options.AllowExternalLoopbackTraffic {
if header.IsV4LoopbackAddress(h.SourceAddress()) {
stats.InvalidSourceAddressesReceived.Increment()
return
@@ -1230,9 +1230,9 @@
// IGMP holds options for IGMP.
IGMP IGMPOptions
- // DropExternalLoopbackTraffic indicates that inbound loopback packets (i.e.
- // martian loopback packets) should be dropped.
- DropExternalLoopbackTraffic bool
+ // AllowExternalLoopbackTraffic indicates that inbound loopback packets (i.e.
+ // martian loopback packets) should be accepted.
+ AllowExternalLoopbackTraffic bool
}
// NewProtocolWithOptions returns an IPv4 network protocol.
diff --git a/pkg/tcpip/network/ipv6/ipv6.go b/pkg/tcpip/network/ipv6/ipv6.go
index b94cb42..83e98ba 100644
--- a/pkg/tcpip/network/ipv6/ipv6.go
+++ b/pkg/tcpip/network/ipv6/ipv6.go
@@ -931,7 +931,7 @@
}
if !e.nic.IsLoopback() {
- if e.protocol.options.DropExternalLoopbackTraffic {
+ if !e.protocol.options.AllowExternalLoopbackTraffic {
if header.IsV6LoopbackAddress(h.SourceAddress()) {
stats.InvalidSourceAddressesReceived.Increment()
return
@@ -2071,9 +2071,9 @@
// DADConfigs holds the default DAD configurations used by IPv6 endpoints.
DADConfigs stack.DADConfigurations
- // DropExternalLoopbackTraffic indicates that inbound loopback packets (i.e.
- // martian loopback packets) should be dropped.
- DropExternalLoopbackTraffic bool
+ // AllowExternalLoopbackTraffic indicates that inbound loopback packets (i.e.
+ // martian loopback packets) should be accepted.
+ AllowExternalLoopbackTraffic bool
}
// NewProtocolWithOptions returns an IPv6 network protocol.
