parse?

Author: JackDoan

firewall.go

@@ -437,8 +437,8 @@ func (f *Firewall) Drop(key firewall.PacketKey, fp *firewall.Packet, incoming bo
 
 	// Conntrack miss → rule matching needs the rich Packet form. Hydrate
 	// from the key if the caller passed a zero-valued fp (the inbound path
-	// after ParseInbound). Outbound callers fill fp via newPacket and skip
-	// this hop.
+	// after batch.ParsePacket). Outbound callers Hydrate themselves and
+	// skip this hop.
 	if !fp.LocalAddr.IsValid() {
 		key.Hydrate(fp)
 	}

firewall/packet.go

@@ -50,10 +50,10 @@ type Packet struct {
 	Fragment   bool
 }
 
-// Key derives a PacketKey from a populated Packet. Used by the outgoing
-// path (inside.go) which still parses into a full Packet via newPacket
-// before the firewall check; the inbound path skips this hop entirely by
-// having its parser write straight into the PacketKey.
+// Key derives a PacketKey from a populated Packet. Used by the few code
+// paths that have a Packet but no Key in hand (e.g. tests). Both inbound
+// and outbound production parsers write straight into a PacketKey via
+// batch.ParsePacket, so this function is rarely on the hot path.
 func (fp *Packet) Key() PacketKey {
 	k := PacketKey{
 		Protocol: fp.Protocol,

inside.go

@@ -25,11 +25,11 @@ func (f *Interface) consumeInsidePacket(pkt tio.Packet, fwPacket *firewall.Packe
 	//
 	// pkt.Bytes is either one IP datagram (GSO zero) or a TSO/USO
 	// superpacket. In both cases the L3+L4 headers at the start describe
-	// the same 5-tuple every segment will share, so a single newPacket /
+	// the same 5-tuple every segment will share, so a single parse +
 	// firewall check covers the whole superpacket.
 	packet := pkt.Bytes
-	key, err := newPacketKey(packet, false)
-	if err != nil {
+	var parsed batch.RxParsed
+	if err := batch.ParsePacket(packet, false, &parsed); err != nil {
 		if f.l.Enabled(context.Background(), slog.LevelDebug) {
 			f.l.Debug("Error while validating outbound packet",
 				"packet", packet,
@@ -39,7 +39,7 @@ func (f *Interface) consumeInsidePacket(pkt tio.Packet, fwPacket *firewall.Packe
 		return
 	}
 
-	key.Hydrate(fwPacket)
+	parsed.Key.Hydrate(fwPacket)
 
 	// Ignore local broadcast packets
 	if f.dropLocalBroadcast {
@@ -107,7 +107,7 @@ func (f *Interface) consumeInsidePacket(pkt tio.Packet, fwPacket *firewall.Packe
 		return
 	}
 
-	dropReason := f.firewall.Drop(key, fwPacket, false, hostinfo, f.pki.GetCAPool(), localCache)
+	dropReason := f.firewall.Drop(parsed.Key, fwPacket, false, hostinfo, f.pki.GetCAPool(), localCache)
 	if dropReason == nil {
 		f.sendInsideMessage(hostinfo, pkt, nb, sendBatch, rejectBuf, q)
 	} else {
@@ -394,16 +394,16 @@ func (f *Interface) getOrHandshakeConsiderRouting(fwPacket *firewall.Packet, cac
 }
 
 func (f *Interface) sendMessageNow(t header.MessageType, st header.MessageSubType, hostinfo *HostInfo, p, nb, out []byte) {
-	key, err := newPacketKey(p, false)
-	if err != nil {
+	var parsed batch.RxParsed
+	if err := batch.ParsePacket(p, false, &parsed); err != nil {
 		f.l.Warn("error while parsing outgoing packet for firewall check", "error", err)
 		return
 	}
 	fp := &firewall.Packet{}
-	key.Hydrate(fp)
+	parsed.Key.Hydrate(fp)
 
 	// check if packet is in outbound fw rules
-	dropReason := f.firewall.Drop(key, fp, false, hostinfo, f.pki.GetCAPool(), nil)
+	dropReason := f.firewall.Drop(parsed.Key, fp, false, hostinfo, f.pki.GetCAPool(), nil)
 	if dropReason != nil {
 		if f.l.Enabled(context.Background(), slog.LevelDebug) {
 			f.l.Debug("dropping cached packet",

outside.go

@@ -2,24 +2,15 @@ package nebula
 
 import (
 	"context"
-	"encoding/binary"
 	"errors"
 	"log/slog"
 	"net/netip"
 	"time"
 
-	"github.com/google/gopacket/layers"
-	"golang.org/x/net/ipv6"
-
 	"github.com/slackhq/nebula/firewall"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/overlay/batch"
 	"github.com/slackhq/nebula/udp"
-	"golang.org/x/net/ipv4"
-)
-
-const (
-	minFwPacketLen = 4
 )
 
 func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte, h *header.H, fwPacket *firewall.Packet, parsedRx *batch.RxParsed, lhf *LightHouseHandler, nb []byte, q int, localCache firewall.ConntrackCache, meta udp.RxMeta) {
@@ -319,196 +310,17 @@ func (f *Interface) handleEncrypted(ci *ConnectionState, via ViaSender, h *heade
 	return true
 }
 
-var (
-	ErrPacketTooShort          = errors.New("packet is too short")
-	ErrUnknownIPVersion        = errors.New("packet is an unknown ip version")
-	ErrIPv4InvalidHeaderLength = errors.New("invalid ipv4 header length")
-	ErrIPv4PacketTooShort      = errors.New("ipv4 packet is too short")
-	ErrIPv6PacketTooShort      = errors.New("ipv6 packet is too short")
-	ErrIPv6CouldNotFindPayload = errors.New("could not find payload in ipv6 packet")
-)
-
-// newPacket validates and parses the interesting bits for the firewall out of the ip and sub protocol headers
-// newPacket parses data into a fully-hydrated firewall.Packet — kept as a
-// thin wrapper around newPacketKey + Hydrate so there's one source of
-// parse logic. Callers that don't need the netip.Addr-rich form (e.g.
-// conntrack-only paths) should use newPacketKey directly.
+// newPacket validates an IP packet and fills fp via the canonical batch
+// parser. Tests use this entry point directly; production paths use
+// batch.ParsePacket and Hydrate themselves so they can keep both the dense
+// PacketKey (for conntrack lookup) and the Packet form (for rule matching)
+// without an extra round-trip.
 func newPacket(data []byte, incoming bool, fp *firewall.Packet) error {
-	key, err := newPacketKey(data, incoming)
-	if err != nil {
+	var parsed batch.RxParsed
+	if err := batch.ParsePacket(data, incoming, &parsed); err != nil {
 		return err
 	}
-	key.Hydrate(fp)
-	return nil
-}
-
-// newPacketKey parses data into a dense firewall.PacketKey. Hot path: no
-// netip.Addr construction, no unique.Handle interning. Caller decides
-// whether to also Hydrate to a Packet (for rule matching) or pass the key
-// straight to conntrack.
-func newPacketKey(data []byte, incoming bool) (firewall.PacketKey, error) {
-	var k firewall.PacketKey
-	if len(data) < 1 {
-		return k, ErrPacketTooShort
-	}
-	switch int((data[0] >> 4) & 0x0f) {
-	case ipv4.Version:
-		return k, parseV4Key(data, incoming, &k)
-	case ipv6.Version:
-		k.IsV6 = true
-		return k, parseV6Key(data, incoming, &k)
-	}
-	return k, ErrUnknownIPVersion
-}
-
-func parseV6Key(data []byte, incoming bool, k *firewall.PacketKey) error {
-	dataLen := len(data)
-	if dataLen < ipv6.HeaderLen {
-		return ErrIPv6PacketTooShort
-	}
-
-	if incoming {
-		copy(k.RemoteAddr[:], data[8:24])
-		copy(k.LocalAddr[:], data[24:40])
-	} else {
-		copy(k.LocalAddr[:], data[8:24])
-		copy(k.RemoteAddr[:], data[24:40])
-	}
-
-	protoAt := 6
-	offset := ipv6.HeaderLen
-	next := 0
-	for {
-		if protoAt >= dataLen {
-			break
-		}
-		proto := layers.IPProtocol(data[protoAt])
-
-		switch proto {
-		case layers.IPProtocolESP, layers.IPProtocolNoNextHeader:
-			k.Protocol = uint8(proto)
-			k.RemotePort = 0
-			k.LocalPort = 0
-			k.Fragment = false
-			return nil
-
-		case layers.IPProtocolICMPv6:
-			if dataLen < offset+6 {
-				return ErrIPv6PacketTooShort
-			}
-			k.Protocol = uint8(proto)
-			k.LocalPort = 0
-			switch data[offset+1] {
-			case layers.ICMPv6TypeEchoRequest, layers.ICMPv6TypeEchoReply:
-				k.RemotePort = binary.BigEndian.Uint16(data[offset+4 : offset+6])
-			default:
-				k.RemotePort = 0
-			}
-			k.Fragment = false
-			return nil
-
-		case layers.IPProtocolTCP, layers.IPProtocolUDP:
-			if dataLen < offset+4 {
-				return ErrIPv6PacketTooShort
-			}
-			k.Protocol = uint8(proto)
-			if incoming {
-				k.RemotePort = binary.BigEndian.Uint16(data[offset : offset+2])
-				k.LocalPort = binary.BigEndian.Uint16(data[offset+2 : offset+4])
-			} else {
-				k.LocalPort = binary.BigEndian.Uint16(data[offset : offset+2])
-				k.RemotePort = binary.BigEndian.Uint16(data[offset+2 : offset+4])
-			}
-			k.Fragment = false
-			return nil
-
-		case layers.IPProtocolIPv6Fragment:
-			if dataLen < offset+8 {
-				return ErrIPv6PacketTooShort
-			}
-			fragmentOffset := binary.BigEndian.Uint16(data[offset+2:offset+4]) &^ uint16(0x7)
-			if fragmentOffset != 0 {
-				k.Protocol = data[offset]
-				k.Fragment = true
-				k.RemotePort = 0
-				k.LocalPort = 0
-				return nil
-			}
-			next = 8
-
-		case layers.IPProtocolAH:
-			if dataLen <= offset+1 {
-				break
-			}
-			next = int(data[offset+1]+2) << 2
-
-		default:
-			if dataLen <= offset+1 {
-				break
-			}
-			next = int(data[offset+1]+1) << 3
-		}
-
-		if next <= 0 {
-			next = 8
-		}
-		protoAt = offset
-		offset = offset + next
-	}
-
-	return ErrIPv6CouldNotFindPayload
-}
-
-func parseV4Key(data []byte, incoming bool, k *firewall.PacketKey) error {
-	if len(data) < ipv4.HeaderLen {
-		return ErrIPv4PacketTooShort
-	}
-	ihl := int(data[0]&0x0f) << 2
-	if ihl < ipv4.HeaderLen {
-		return ErrIPv4InvalidHeaderLength
-	}
-
-	flagsfrags := binary.BigEndian.Uint16(data[6:8])
-	k.Fragment = (flagsfrags & 0x1FFF) != 0
-	k.Protocol = data[9]
-
-	minLen := ihl
-	if !k.Fragment {
-		if k.Protocol == firewall.ProtoICMP {
-			minLen += minFwPacketLen + 2
-		} else {
-			minLen += minFwPacketLen
-		}
-	}
-	if len(data) < minLen {
-		return ErrIPv4InvalidHeaderLength
-	}
-
-	// Dense form: v4 in low 4 bytes, rest zero. Matches the coalescer's
-	// flowKey convention so the two stay byte-identical for the same flow.
-	if incoming {
-		copy(k.RemoteAddr[:4], data[12:16])
-		copy(k.LocalAddr[:4], data[16:20])
-	} else {
-		copy(k.LocalAddr[:4], data[12:16])
-		copy(k.RemoteAddr[:4], data[16:20])
-	}
-
-	switch {
-	case k.Fragment:
-		k.RemotePort = 0
-		k.LocalPort = 0
-	case k.Protocol == firewall.ProtoICMP:
-		k.RemotePort = binary.BigEndian.Uint16(data[ihl+4 : ihl+6])
-		k.LocalPort = 0
-	case incoming:
-		k.RemotePort = binary.BigEndian.Uint16(data[ihl : ihl+2])
-		k.LocalPort = binary.BigEndian.Uint16(data[ihl+2 : ihl+4])
-	default:
-		k.LocalPort = binary.BigEndian.Uint16(data[ihl : ihl+2])
-		k.RemotePort = binary.BigEndian.Uint16(data[ihl+2 : ihl+4])
-	}
-
+	parsed.Key.Hydrate(fp)
 	return nil
 }
 
@@ -598,7 +410,7 @@ func (f *Interface) decryptToTun(hostinfo *HostInfo, messageCounter uint64, out
 	// firewall.Drop's fast path uses Key alone and only hydrates fwPacket
 	// from Key on the slow path.
 	*fwPacket = firewall.Packet{}
-	err = batch.ParseInbound(out, parsedRx)
+	err = batch.ParsePacket(out, true, parsedRx)
 	if err != nil {
 		hostinfo.logger(f.l).Warn("Error while validating inbound packet",
 			"error", err,