Added EC2 Metadata Service Access Flag

cmd/gvproxy/main.go

@@ -30,24 +30,25 @@ import (
 )
 
 var (
-	debug            bool
-	mtu              int
-	endpoints        arrayFlags
-	vpnkitSocket     string
-	qemuSocket       string
-	bessSocket       string
-	stdioSocket      string
-	vfkitSocket      string
-	forwardSocket    arrayFlags
-	forwardDest      arrayFlags
-	forwardUser      arrayFlags
-	forwardIdentify  arrayFlags
-	sshPort          int
-	pidFile          string
-	pcapFile         string
-	exitCode         int
-	logFile          string
-	servicesEndpoint string
+	debug             bool
+	mtu               int
+	endpoints         arrayFlags
+	vpnkitSocket      string
+	qemuSocket        string
+	bessSocket        string
+	stdioSocket       string
+	vfkitSocket       string
+	forwardSocket     arrayFlags
+	forwardDest       arrayFlags
+	forwardUser       arrayFlags
+	forwardIdentify   arrayFlags
+	sshPort           int
+	pidFile           string
+	pcapFile          string
+	exitCode          int
+	logFile           string
+	servicesEndpoint  string
+	ec2MetadataAccess bool
 )
 
 const (
@@ -78,6 +79,7 @@ func main() {
 	flag.StringVar(&pidFile, "pid-file", "", "Generate a file with the PID in it")
 	flag.StringVar(&logFile, "log-file", "", "Output log messages (logrus) to a given file path")
 	flag.StringVar(&servicesEndpoint, "services", "", "Exposes the same HTTP API as the --listen flag, without the /connect endpoint")
+	flag.BoolVar(&ec2MetadataAccess, "ec2-metadata-access", false, "Permits access to EC2 Metadata Service (TCP only)")
 	flag.Parse()
 
 	if version.ShowVersion() {
@@ -262,7 +264,8 @@ func main() {
 		VpnKitUUIDMacAddresses: map[string]string{
 			"c3d68012-0208-11ea-9fd7-f2189899ab08": "5a:94:ef:e4:0c:ee",
 		},
-		Protocol: protocol,
+		Protocol:          protocol,
+		Ec2MetadataAccess: ec2MetadataAccess,
 	}
 
 	groupErrs.Go(func() error {

pkg/services/forwarder/tcp.go

@@ -17,11 +17,11 @@ import (
 
 const linkLocalSubnet = "169.254.0.0/16"
 
-func TCP(s *stack.Stack, nat map[tcpip.Address]tcpip.Address, natLock *sync.Mutex) *tcp.Forwarder {
+func TCP(s *stack.Stack, nat map[tcpip.Address]tcpip.Address, natLock *sync.Mutex, ec2MetadataAccess bool) *tcp.Forwarder {
 	return tcp.NewForwarder(s, 0, 10, func(r *tcp.ForwarderRequest) {
 		localAddress := r.ID().LocalAddress
 
-		if linkLocal().Contains(localAddress) {
+		if (!ec2MetadataAccess) && linkLocal().Contains(localAddress) {
 			r.Complete(true)
 			return
 		}

pkg/types/configuration.go

@@ -50,6 +50,9 @@ type Configuration struct {
 
 	// Protocol to be used. Only for /connect mux
 	Protocol Protocol
+
+	// EC2 Metadata Service Access
+	Ec2MetadataAccess bool
 }
 
 type Protocol string

pkg/virtualnetwork/services.go

@@ -24,7 +24,7 @@ func addServices(configuration *types.Configuration, s *stack.Stack, ipPool *tap
 	var natLock sync.Mutex
 	translation := parseNATTable(configuration)
 
-	tcpForwarder := forwarder.TCP(s, translation, &natLock)
+	tcpForwarder := forwarder.TCP(s, translation, &natLock, configuration.Ec2MetadataAccess)
 	s.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)
 	udpForwarder := forwarder.UDP(s, translation, &natLock)
 	s.SetTransportProtocolHandler(udp.ProtocolNumber, udpForwarder.HandlePacket)