mirror of https://github.com/slackhq/nebula.git
Refuse to process double encrypted packets (#741)
This commit is contained in:
parent
feb3e1317f
commit
4c0ae3df5e
|
@ -86,8 +86,7 @@ func (f *Interface) Handshake(vpnIp iputil.VpnIp) {
|
|||
|
||||
// getOrHandshake returns nil if the vpnIp is not routable
|
||||
func (f *Interface) getOrHandshake(vpnIp iputil.VpnIp) *HostInfo {
|
||||
//TODO: we can find contains without converting back to bytes
|
||||
if f.hostMap.vpnCIDR.Contains(vpnIp.ToIP()) == false {
|
||||
if !ipMaskContains(f.lightHouse.myVpnIp, f.lightHouse.myVpnZeros, vpnIp) {
|
||||
vpnIp = f.inside.RouteFor(vpnIp)
|
||||
if vpnIp == 0 {
|
||||
return nil
|
||||
|
|
10
outside.go
10
outside.go
|
@ -34,6 +34,16 @@ func (f *Interface) readOutsidePackets(addr *udp.Addr, via interface{}, out []by
|
|||
}
|
||||
|
||||
//l.Error("in packet ", header, packet[HeaderLen:])
|
||||
if addr != nil {
|
||||
if ip4 := addr.IP.To4(); ip4 != nil {
|
||||
if ipMaskContains(f.lightHouse.myVpnIp, f.lightHouse.myVpnZeros, iputil.VpnIp(binary.BigEndian.Uint32(ip4))) {
|
||||
if f.l.Level >= logrus.DebugLevel {
|
||||
f.l.WithField("udpAddr", addr).Debug("Refusing to process double encrypted packet")
|
||||
}
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
var hostinfo *HostInfo
|
||||
// verify if we've seen this index before, otherwise respond to the handshake initiation
|
||||
|
|
Loading…
Reference in New Issue