Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Localhost server access #68

Merged
merged 11 commits into from
Nov 25, 2024
Merged

Localhost server access #68

merged 11 commits into from
Nov 25, 2024

Conversation

Aptimex
Copy link
Collaborator

@Aptimex Aptimex commented Nov 19, 2024

Add ability to access the 127.0.0.1 IP of a Server. --localhost-ip argument is available for configure and add server commands to specify an IP that will be DNAT'ed (via userspace iptables) to 127.0.0.1.

  • Only works for IPv4 because RFC (and implementations) effectively disallows DNAT to the IPv6 loopback ::1.
  • Doesn't work for UDP packets, not sure why. In testing they were received as expected by the localhost listener, but replies were not received by the Client.
  • Didn't test with ICMP because I can't imagine anyone would ever really need to ping localhost.

Other changes:

  • Updated gvisor (and related dependencies) to a slightly newer version that supports necessary iptables stuff.
  • Updated Golang version requirement to use some new features.
  • API requests (like ones generated by status) now ignore proxy environment variables because trying to use a proxy will always break the request.

@Aptimex Aptimex requested a review from luker983 November 19, 2024 22:31
@Aptimex Aptimex linked an issue Nov 19, 2024 that may be closed by this pull request
Copy link
Collaborator

@luker983 luker983 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not immediately obvious to me why UDP is failing, but we do some strange things in the UDP handler that could cause the packet to not be properly processed through the DNAT rule in the reverse direction correctly.

The cool thing about this type of 1:1 address mapping is that you don't even really need a NAT table that keeps track of all the connections, you can just rewrite all destination addresses from addrA to addrB and the opposite on the return.

You might need to implement your own target for that though. I think that would work for ICMP, UDP, and ipv6. If the netstack dropping packets with ::1 in them is an issue, you could even move the rewriting to the transport handlers, but would be nice if we could avoid that.

src/cmd/serve.go Outdated Show resolved Hide resolved
src/cmd/serve.go Outdated Show resolved Hide resolved
src/cmd/serve.go Show resolved Hide resolved
@Aptimex
Copy link
Collaborator Author

Aptimex commented Nov 21, 2024

The cool thing about this type of 1:1 address mapping is that you don't even really need a NAT table that keeps track of all the connections, you can just rewrite all destination addresses from addrA to addrB and the opposite on the return.
You might need to implement your own target for that though.

Based on the code for the DNAT target, writing a custom target (possibly two of them, one for each direction) to do this looks pretty involved. Seems like it requires accessing non-exported variables and/or methods to modify those addresses: https://github.com/google/gvisor/blob/71bcc96c6e38b22e1aaf51863cde5b20f59e4617/pkg/tcpip/stack/iptables_targets.go#L324

Might consider looking into it more as a future improvement. IPv4 TCP should cover most use cases in the meantime.

@Aptimex Aptimex merged commit 21e6aba into main Nov 25, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Localhost access to server
2 participants