netstack: check inbound MAC addresses in the fdbased link endpoint

pkg/tcpip/link/fdbased/endpoint.go

@@ -559,18 +559,40 @@ func (e *endpoint) AddHeader(pkt *stack.PacketBuffer) {
 	}
 }
 
-func (e *endpoint) parseHeader(pkt *stack.PacketBuffer) bool {
-	_, ok := pkt.LinkHeader().Consume(e.hdrSize)
-	return ok
+func (e *endpoint) parseHeader(pkt *stack.PacketBuffer) (header.Ethernet, bool) {
+	if e.hdrSize <= 0 {
+		return nil, true
+	}
+	hdrBytes, ok := pkt.LinkHeader().Consume(e.hdrSize)
+	if !ok {
+		return nil, false
+	}
+	hdr := header.Ethernet(hdrBytes)
+	pkt.NetworkProtocolNumber = hdr.Type()
+	return hdr, true
+}
 
+// parseInboundHeader parses the link header of pkt and returns true if the
+// header is well-formed and sent to this endpoint's MAC or the broadcast
+// address.
+func (e *endpoint) parseInboundHeader(pkt *stack.PacketBuffer, wantAddr tcpip.LinkAddress) bool {
+	hdr, ok := e.parseHeader(pkt)
+	if !ok || e.hdrSize <= 0 {
+		return ok
+	}
+	dstAddr := hdr.DestinationAddress()
+	// Per RFC 9542 2.1 on the least significant bit of the first octet of
+	// a MAC address: "If it is zero, the MAC address is unicast. If it is
+	// a one, the address is groupcast (multicast or broadcast)." Multicast
+	// and broadcast are the same thing to ethernet; they are both sent to
+	// everyone.
+	return dstAddr == wantAddr || byte(dstAddr[0])&0x01 == 1
 }
 
 // ParseHeader implements stack.LinkEndpoint.ParseHeader.
 func (e *endpoint) ParseHeader(pkt *stack.PacketBuffer) bool {
-	if e.hdrSize > 0 {
-		return e.parseHeader(pkt)
-	}
-	return true
+	_, ok := e.parseHeader(pkt)
+	return ok
 }
 
 // writePacket writes outbound packets to the file descriptor. If it is not

pkg/tcpip/link/fdbased/endpoint_test.go

@@ -680,7 +680,12 @@ func TestDispatchPacketFormat(t *testing.T) {
 
 			// Create and run dispatcher once.
 			sink := &fakeNetworkDispatcher{}
+			var addr tcpip.LinkAddress
+			if len(test.ethHdr) > 0 {
+				addr = tcpip.LinkAddress(test.ethHdr[:header.EthernetAddressSize])
+			}
 			d, err := test.newDispatcher(fds[0], &endpoint{
+				addr:       addr,
 				hdrSize:    len(test.ethHdr),
 				dispatcher: sink,
 			}, &Options{ProcessorsPerChannel: 1})

pkg/tcpip/link/fdbased/mmap.go

@@ -19,13 +19,11 @@ package fdbased
 
 import (
 	"encoding/binary"
-	"fmt"
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/buffer"
 	"gvisor.dev/gvisor/pkg/rawfile"
 	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/header"
 	"gvisor.dev/gvisor/pkg/tcpip/link/stopfd"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 )
@@ -186,15 +184,13 @@ func (d *packetMMapDispatcher) dispatch() (bool, tcpip.Error) {
 	if err != nil || stopped {
 		return false, err
 	}
+	d.e.mu.RLock()
+	addr := d.e.addr
+	d.e.mu.RUnlock()
 	for _, pkt := range pkts.AsSlice() {
-		if d.e.hdrSize > 0 {
-			hdr, ok := pkt.LinkHeader().Consume(d.e.hdrSize)
-			if !ok {
-				panic(fmt.Sprintf("LinkHeader().Consume(%d) must succeed", d.e.hdrSize))
-			}
-			pkt.NetworkProtocolNumber = header.Ethernet(hdr).Type()
+		if d.e.parseInboundHeader(pkt, addr) {
+			d.mgr.queuePacket(pkt, d.e.hdrSize > 0)
 		}
-		d.mgr.queuePacket(pkt, d.e.hdrSize > 0)
 	}
 	if pkts.Len() > 0 {
 		d.mgr.wakeReady()

pkg/tcpip/link/fdbased/packet_dispatchers.go

@@ -22,7 +22,6 @@ import (
 	"gvisor.dev/gvisor/pkg/buffer"
 	"gvisor.dev/gvisor/pkg/rawfile"
 	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/header"
 	"gvisor.dev/gvisor/pkg/tcpip/link/stopfd"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 	"gvisor.dev/gvisor/pkg/tcpip/stack/gro"
@@ -197,11 +196,11 @@ func (d *readVDispatcher) dispatch() (bool, tcpip.Error) {
 	})
 	defer pkt.DecRef()
 
-	if d.e.hdrSize > 0 {
-		if !d.e.parseHeader(pkt) {
-			return false, nil
-		}
-		pkt.NetworkProtocolNumber = header.Ethernet(pkt.LinkHeader().Slice()).Type()
+	d.e.mu.RLock()
+	addr := d.e.addr
+	d.e.mu.RUnlock()
+	if !d.e.parseInboundHeader(pkt, addr) {
+		return false, nil
 	}
 	d.mgr.queuePacket(pkt, d.e.hdrSize > 0)
 	d.mgr.wakeReady()
@@ -301,6 +300,7 @@ func (d *recvMMsgDispatcher) dispatch() (bool, tcpip.Error) {
 	// Process each of received packets.
 
 	d.e.mu.RLock()
+	addr := d.e.addr
 	dsp := d.e.dispatcher
 	d.e.mu.RUnlock()
 
@@ -317,15 +317,10 @@ func (d *recvMMsgDispatcher) dispatch() (bool, tcpip.Error) {
 		// Mark that this iovec has been processed.
 		d.msgHdrs[k].Msg.Iovlen = 0
 
-		if d.e.hdrSize > 0 {
-			hdr, ok := pkt.LinkHeader().Consume(d.e.hdrSize)
-			if !ok {
-				return false, nil
-			}
-			pkt.NetworkProtocolNumber = header.Ethernet(hdr).Type()
+		if d.e.parseInboundHeader(pkt, addr) {
+			pkt.RXChecksumValidated = d.e.caps&stack.CapabilityRXChecksumOffload != 0
+			d.mgr.queuePacket(pkt, d.e.hdrSize > 0)
 		}
-		pkt.RXChecksumValidated = d.e.caps&stack.CapabilityRXChecksumOffload != 0
-		d.mgr.queuePacket(pkt, d.e.hdrSize > 0)
 	}
 	d.mgr.wakeReady()