MigrateRepos/OpenGFW
1
0
Fork 0
mirror of https://github.com/apernet/OpenGFW.git synced 2024-12-23 01:19:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #75 from apernet/fix-missing-verdict

Browse Source 
fix: verdict is missing for multicast packets
This commit is contained in:
Toby 2024-02-26 00:12:42 -08:00 committed by GitHub
commit bc2e21e35d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
io/nfqueue.go
View File

@ -138,9 +138,10 @@ func NewNFQueuePacketIO(config NFQueuePacketIOConfig) (PacketIO, error) {
func (n *nfqueuePacketIO) Register(ctx context.Context, cb PacketCallback) error { func (n *nfqueuePacketIO) Register(ctx context.Context, cb PacketCallback) error {
err := n.n.RegisterWithErrorFunc(ctx, err := n.n.RegisterWithErrorFunc(ctx,
func(a nfqueue.Attribute) int { func(a nfqueue.Attribute) int {
if a.PacketID == nil || a.Ct == nil || a.Payload == nil || len(*a.Payload) < 20 { if ok, verdict := n.packetAttributeSanityCheck(a); !ok {
// Invalid packet, ignore if a.PacketID != nil {
// 20 is the minimum possible size of an IP packet _ = n.n.SetVerdict(*a.PacketID, verdict)
}
return 0 return 0
} }
p := &nfqueuePacket{ p := &nfqueuePacket{
@ -170,6 +171,25 @@ func (n *nfqueuePacketIO) Register(ctx context.Context, cb PacketCallback) error
return nil return nil
} }
func (n *nfqueuePacketIO) packetAttributeSanityCheck(a nfqueue.Attribute) (ok bool, verdict int) {
if a.PacketID == nil {
// Re-inject to NFQUEUE is actually not possible in this condition
return false, -1
}
if a.Payload == nil || len(*a.Payload) < 20 {
// 20 is the minimum possible size of an IP packet
return false, nfqueue.NfDrop
}
if a.Ct == nil {
// Multicast packets may not have a conntrack, but only appear in local mode
if n.local {
return false, nfqueue.NfAccept
}
return false, nfqueue.NfDrop
}
return true, -1
}
func (n *nfqueuePacketIO) SetVerdict(p Packet, v Verdict, newPacket []byte) error { func (n *nfqueuePacketIO) SetVerdict(p Packet, v Verdict, newPacket []byte) error {
nP, ok := p.(*nfqueuePacket) nP, ok := p.(*nfqueuePacket)
if !ok { if !ok {