TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2024-11-27 03:55:36 +00:00
Code Issues Packages Projects Releases Wiki Activity
cb66952a0d
tailscale/wgengine/router/router_linux_test.go

1140 lines
32 KiB
Go
Raw Normal View History

all: update copyright and license headers This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2023-01-27 21:37:20 +00:00
// Copyright (c) Tailscale Inc & AUTHORS
// SPDX-License-Identifier: BSD-3-Clause
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
package router
import (
"errors"
"fmt"
"math/rand"
all: use various net/netip parse funcs directly Mechanical change with perl+goimports. Changed {Must,}Parse{IP,IPPrefix,IPPort} to their netip variants, then goimports -d . Finally, removed the net/netaddr wrappers, to prevent future use. Updates #5162 Change-Id: I59c0e38b5fbca5a935d701645789cddf3d7863ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 03:55:44 +00:00
"net/netip"
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
"os"
wgengine/router: [linux] add before deleting interface addrs Deleting may temporarily result in no addrs on the interface, which results in all other rules (like routes) to get dropped by the OS. I verified this fixes the problem. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-20 14:22:27 +00:00
"reflect"
wgengine/router: fix tests on systems with older Busybox 'ip' binary Adjust the expected system output by removing the unsupported mask component including and after the slash in expected output like: fwmask 0xabc/0xdef This package's tests now pass in an Alpine container when the 'go' and 'iptables' packages are installed (and run as privileged so /dev/net/tun exists). Fixes #5928 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id1a3896282bfa36b64afaec7a47205e63ad88542
2022-12-09 18:21:10 +00:00
"regexp"
all: use Go 1.21 slices, maps instead of x/exp/{slices,maps} Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-17 05:09:53 +00:00
"slices"
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
"sort"
"strings"
wgengine/router: fix tests on systems with older Busybox 'ip' binary Adjust the expected system output by removing the unsupported mask component including and after the slash in expected output like: fwmask 0xabc/0xdef This package's tests now pass in an Alpine container when the 'go' and 'iptables' packages are installed (and run as privileged so /dev/net/tun exists). Fixes #5928 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id1a3896282bfa36b64afaec7a47205e63ad88542
2022-12-09 18:21:10 +00:00
"sync"
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
"sync/atomic"
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
"testing"
"github.com/google/go-cmp/cmp"
all: update golang.zx2c4.com/wireguard to github.com/tailscale/wireguard-go (#6692) This is temporary while we work to upstream performance work in https://github.com/WireGuard/wireguard-go/pull/64. A replace directive is less ideal as it breaks dependent code without duplication of the directive. Signed-off-by: Jordan Whited <jordan@tailscale.com>
2022-12-09 23:12:20 +00:00
"github.com/tailscale/wireguard-go/tun"
wgengine/router: start using netlink instead of 'ip' on Linux Converts up, down, add/del addresses, add/del routes. Not yet done: rules. Updates #391 Change-Id: I02554ca07046d18f838e04a626ba99bbd35266fb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 04:36:29 +00:00
"github.com/vishvananda/netlink"
all: update exp/slices and fix call sites slices.SortFunc suffered a late-in-cycle API breakage. Updates #cleanup Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-28 17:39:04 +00:00
"go4.org/netipx"
all: move network monitoring from wgengine/monitor to net/netmon We're using it in more and more places, and it's not really specific to our use of Wireguard (and does more just link/interface monitoring). Also removes the separate interface we had for it in sockstats -- it's a small enough package (we already pull in all of its dependencies via other paths) that it's not worth the extra complexity. Updates #7621 Updates #7850 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-18 21:26:58 +00:00
"tailscale.com/net/netmon"
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
"tailscale.com/net/tsaddr"
tstest: add MemLogger bytes.Buffer wrapper with Logf method We use it tons of places. Updated three at least in this PR. Another use in next commit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-09-07 22:17:39 +00:00
"tailscale.com/tstest"
wgengine/router: take a link monitor Prep for #1591 which will need to make Linux's router react to changes that the link monitor observes. The router package already depended on the monitor package transitively. Now it's explicit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-20 20:28:06 +00:00
"tailscale.com/types/logger"
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
"tailscale.com/util/linuxfw"
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
)
func TestRouterStates(t *testing.T) {
router_linux: use only baseline 'ip rule' features that exist in old kernels. This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28 07:44:09 +00:00
basic := `
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
ip rule add -4 pref 5210 fwmark 0x80000/0xff0000 table main
ip rule add -4 pref 5230 fwmark 0x80000/0xff0000 table default
ip rule add -4 pref 5250 fwmark 0x80000/0xff0000 type unreachable
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
ip rule add -4 pref 5270 table 52
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
ip rule add -6 pref 5210 fwmark 0x80000/0xff0000 table main
ip rule add -6 pref 5230 fwmark 0x80000/0xff0000 table default
ip rule add -6 pref 5250 fwmark 0x80000/0xff0000 type unreachable
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
ip rule add -6 pref 5270 table 52
router_linux: use only baseline 'ip rule' features that exist in old kernels. This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28 07:44:09 +00:00
`
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
states := []struct {
name string
in *Config
want string
}{
{
name: "no config",
in: nil,
want: `
router_linux: use only baseline 'ip rule' features that exist in old kernels. This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28 07:44:09 +00:00
up` + basic,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
{
name: "local addr only",
in: &Config{
ipn: plumb NetfilterMode all the way out to the CLI. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-15 02:07:06 +00:00
LocalAddrs: mustCIDRs("100.101.102.103/10"),
ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-04 21:12:42 +00:00
NetfilterMode: netfilterOff,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
want: `
up
router_linux: use only baseline 'ip rule' features that exist in old kernels. This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28 07:44:09 +00:00
ip addr add 100.101.102.103/10 dev tailscale0` + basic,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
{
name: "addr and routes",
in: &Config{
ipn: plumb NetfilterMode all the way out to the CLI. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-15 02:07:06 +00:00
LocalAddrs: mustCIDRs("100.101.102.103/10"),
Routes: mustCIDRs("100.100.100.100/32", "192.168.16.0/24"),
ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-04 21:12:42 +00:00
NetfilterMode: netfilterOff,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
want: `
up
ip addr add 100.101.102.103/10 dev tailscale0
wgengine/router: don't use 88 or 8888 as table/rule numbers. We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-07-22 18:08:08 +00:00
ip route add 100.100.100.100/32 dev tailscale0 table 52
ip route add 192.168.16.0/24 dev tailscale0 table 52` + basic,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
{
name: "addr and routes and subnet routes",
in: &Config{
ipn: plumb NetfilterMode all the way out to the CLI. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-15 02:07:06 +00:00
LocalAddrs: mustCIDRs("100.101.102.103/10"),
Routes: mustCIDRs("100.100.100.100/32", "192.168.16.0/24"),
SubnetRoutes: mustCIDRs("200.0.0.0/8"),
ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-04 21:12:42 +00:00
NetfilterMode: netfilterOff,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
want: `
up
ip addr add 100.101.102.103/10 dev tailscale0
wgengine/router: don't use 88 or 8888 as table/rule numbers. We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-07-22 18:08:08 +00:00
ip route add 100.100.100.100/32 dev tailscale0 table 52
ip route add 192.168.16.0/24 dev tailscale0 table 52` + basic,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
{
name: "addr and routes and subnet routes with netfilter",
in: &Config{
LocalAddrs: mustCIDRs("100.101.102.104/10"),
Routes: mustCIDRs("100.100.100.100/32", "10.0.0.0/8"),
SubnetRoutes: mustCIDRs("200.0.0.0/8"),
SNATSubnetRoutes: true,
ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-04 21:12:42 +00:00
NetfilterMode: netfilterOn,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
want: `
up
ip addr add 100.101.102.104/10 dev tailscale0
wgengine/router: don't use 88 or 8888 as table/rule numbers. We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-07-22 18:08:08 +00:00
ip route add 10.0.0.0/8 dev tailscale0 table 52
ip route add 100.100.100.100/32 dev tailscale0 table 52` + basic +
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
`v4/filter/FORWARD -j ts-forward
v4/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v4/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v4/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v4/filter/ts-forward -o tailscale0 -s 100.64.0.0/10 -j DROP
v4/filter/ts-forward -o tailscale0 -j ACCEPT
v4/filter/ts-input -i lo -s 100.101.102.104 -j ACCEPT
v4/filter/ts-input ! -i tailscale0 -s 100.115.92.0/23 -j RETURN
v4/filter/ts-input ! -i tailscale0 -s 100.64.0.0/10 -j DROP
v4/nat/POSTROUTING -j ts-postrouting
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v4/nat/ts-postrouting -m mark --mark 0x40000/0xff0000 -j MASQUERADE
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v6/filter/FORWARD -j ts-forward
v6/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v6/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v6/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v6/filter/ts-forward -o tailscale0 -j ACCEPT
v6/nat/POSTROUTING -j ts-postrouting
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v6/nat/ts-postrouting -m mark --mark 0x40000/0xff0000 -j MASQUERADE
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
`,
},
{
name: "addr and routes with netfilter",
in: &Config{
LocalAddrs: mustCIDRs("100.101.102.104/10"),
Routes: mustCIDRs("100.100.100.100/32", "10.0.0.0/8"),
ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-04 21:12:42 +00:00
NetfilterMode: netfilterOn,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
want: `
up
ip addr add 100.101.102.104/10 dev tailscale0
wgengine/router: don't use 88 or 8888 as table/rule numbers. We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-07-22 18:08:08 +00:00
ip route add 10.0.0.0/8 dev tailscale0 table 52
ip route add 100.100.100.100/32 dev tailscale0 table 52` + basic +
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
`v4/filter/FORWARD -j ts-forward
v4/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v4/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v4/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v4/filter/ts-forward -o tailscale0 -s 100.64.0.0/10 -j DROP
v4/filter/ts-forward -o tailscale0 -j ACCEPT
v4/filter/ts-input -i lo -s 100.101.102.104 -j ACCEPT
v4/filter/ts-input ! -i tailscale0 -s 100.115.92.0/23 -j RETURN
v4/filter/ts-input ! -i tailscale0 -s 100.64.0.0/10 -j DROP
v4/nat/POSTROUTING -j ts-postrouting
v6/filter/FORWARD -j ts-forward
v6/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v6/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v6/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v6/filter/ts-forward -o tailscale0 -j ACCEPT
v6/nat/POSTROUTING -j ts-postrouting
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
`,
},
{
name: "addr and routes and subnet routes with netfilter but no SNAT",
in: &Config{
LocalAddrs: mustCIDRs("100.101.102.104/10"),
Routes: mustCIDRs("100.100.100.100/32", "10.0.0.0/8"),
SubnetRoutes: mustCIDRs("200.0.0.0/8"),
SNATSubnetRoutes: false,
ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-04 21:12:42 +00:00
NetfilterMode: netfilterOn,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
want: `
up
ip addr add 100.101.102.104/10 dev tailscale0
wgengine/router: don't use 88 or 8888 as table/rule numbers. We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-07-22 18:08:08 +00:00
ip route add 10.0.0.0/8 dev tailscale0 table 52
ip route add 100.100.100.100/32 dev tailscale0 table 52` + basic +
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
`v4/filter/FORWARD -j ts-forward
v4/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v4/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v4/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v4/filter/ts-forward -o tailscale0 -s 100.64.0.0/10 -j DROP
v4/filter/ts-forward -o tailscale0 -j ACCEPT
v4/filter/ts-input -i lo -s 100.101.102.104 -j ACCEPT
v4/filter/ts-input ! -i tailscale0 -s 100.115.92.0/23 -j RETURN
v4/filter/ts-input ! -i tailscale0 -s 100.64.0.0/10 -j DROP
v4/nat/POSTROUTING -j ts-postrouting
v6/filter/FORWARD -j ts-forward
v6/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v6/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v6/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v6/filter/ts-forward -o tailscale0 -j ACCEPT
v6/nat/POSTROUTING -j ts-postrouting
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
`,
},
{
name: "addr and routes with netfilter",
in: &Config{
LocalAddrs: mustCIDRs("100.101.102.104/10"),
Routes: mustCIDRs("100.100.100.100/32", "10.0.0.0/8"),
ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-04 21:12:42 +00:00
NetfilterMode: netfilterOn,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
want: `
up
ip addr add 100.101.102.104/10 dev tailscale0
wgengine/router: don't use 88 or 8888 as table/rule numbers. We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-07-22 18:08:08 +00:00
ip route add 10.0.0.0/8 dev tailscale0 table 52
ip route add 100.100.100.100/32 dev tailscale0 table 52` + basic +
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
`v4/filter/FORWARD -j ts-forward
v4/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v4/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v4/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v4/filter/ts-forward -o tailscale0 -s 100.64.0.0/10 -j DROP
v4/filter/ts-forward -o tailscale0 -j ACCEPT
v4/filter/ts-input -i lo -s 100.101.102.104 -j ACCEPT
v4/filter/ts-input ! -i tailscale0 -s 100.115.92.0/23 -j RETURN
v4/filter/ts-input ! -i tailscale0 -s 100.64.0.0/10 -j DROP
v4/nat/POSTROUTING -j ts-postrouting
v6/filter/FORWARD -j ts-forward
v6/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v6/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v6/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v6/filter/ts-forward -o tailscale0 -j ACCEPT
v6/nat/POSTROUTING -j ts-postrouting
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
`,
},
{
name: "addr and routes with half netfilter",
in: &Config{
LocalAddrs: mustCIDRs("100.101.102.104/10"),
Routes: mustCIDRs("100.100.100.100/32", "10.0.0.0/8"),
ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-04 21:12:42 +00:00
NetfilterMode: netfilterNoDivert,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
want: `
up
ip addr add 100.101.102.104/10 dev tailscale0
wgengine/router: don't use 88 or 8888 as table/rule numbers. We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-07-22 18:08:08 +00:00
ip route add 10.0.0.0/8 dev tailscale0 table 52
ip route add 100.100.100.100/32 dev tailscale0 table 52` + basic +
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
`v4/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v4/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v4/filter/ts-forward -o tailscale0 -s 100.64.0.0/10 -j DROP
v4/filter/ts-forward -o tailscale0 -j ACCEPT
v4/filter/ts-input -i lo -s 100.101.102.104 -j ACCEPT
v4/filter/ts-input ! -i tailscale0 -s 100.115.92.0/23 -j RETURN
v4/filter/ts-input ! -i tailscale0 -s 100.64.0.0/10 -j DROP
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v6/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v6/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v6/filter/ts-forward -o tailscale0 -j ACCEPT
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
`,
},
{
router_linux: use only baseline 'ip rule' features that exist in old kernels. This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28 07:44:09 +00:00
name: "addr and routes with netfilter2",
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
in: &Config{
LocalAddrs: mustCIDRs("100.101.102.104/10"),
Routes: mustCIDRs("100.100.100.100/32", "10.0.0.0/8"),
ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-04 21:12:42 +00:00
NetfilterMode: netfilterOn,
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
},
want: `
up
ip addr add 100.101.102.104/10 dev tailscale0
wgengine/router: don't use 88 or 8888 as table/rule numbers. We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-07-22 18:08:08 +00:00
ip route add 10.0.0.0/8 dev tailscale0 table 52
ip route add 100.100.100.100/32 dev tailscale0 table 52` + basic +
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
`v4/filter/FORWARD -j ts-forward
v4/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v4/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v4/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v4/filter/ts-forward -o tailscale0 -s 100.64.0.0/10 -j DROP
v4/filter/ts-forward -o tailscale0 -j ACCEPT
v4/filter/ts-input -i lo -s 100.101.102.104 -j ACCEPT
v4/filter/ts-input ! -i tailscale0 -s 100.115.92.0/23 -j RETURN
v4/filter/ts-input ! -i tailscale0 -s 100.64.0.0/10 -j DROP
v4/nat/POSTROUTING -j ts-postrouting
v6/filter/FORWARD -j ts-forward
v6/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v6/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v6/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
v6/filter/ts-forward -o tailscale0 -j ACCEPT
v6/nat/POSTROUTING -j ts-postrouting
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
`,
},
ipn/ipnlocal,wgengine/router,cmd/tailscale: add flag to allow local lan access when routing traffic via an exit node. For #1527 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-04-08 22:56:51 +00:00
{
name: "addr, routes, and local routes with netfilter",
in: &Config{
LocalAddrs: mustCIDRs("100.101.102.104/10"),
Routes: mustCIDRs("100.100.100.100/32", "0.0.0.0/0"),
LocalRoutes: mustCIDRs("10.0.0.0/8"),
NetfilterMode: netfilterOn,
},
want: `
up
ip addr add 100.101.102.104/10 dev tailscale0
ip route add 0.0.0.0/0 dev tailscale0 table 52
ip route add 100.100.100.100/32 dev tailscale0 table 52
ip route add throw 10.0.0.0/8 table 52` + basic +
`v4/filter/FORWARD -j ts-forward
v4/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v4/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v4/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
ipn/ipnlocal,wgengine/router,cmd/tailscale: add flag to allow local lan access when routing traffic via an exit node. For #1527 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-04-08 22:56:51 +00:00
v4/filter/ts-forward -o tailscale0 -s 100.64.0.0/10 -j DROP
v4/filter/ts-forward -o tailscale0 -j ACCEPT
v4/filter/ts-input -i lo -s 100.101.102.104 -j ACCEPT
v4/filter/ts-input ! -i tailscale0 -s 100.115.92.0/23 -j RETURN
v4/filter/ts-input ! -i tailscale0 -s 100.64.0.0/10 -j DROP
v4/nat/POSTROUTING -j ts-postrouting
v6/filter/FORWARD -j ts-forward
v6/filter/INPUT -j ts-input
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
v6/filter/ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000
v6/filter/ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
ipn/ipnlocal,wgengine/router,cmd/tailscale: add flag to allow local lan access when routing traffic via an exit node. For #1527 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-04-08 22:56:51 +00:00
v6/filter/ts-forward -o tailscale0 -j ACCEPT
v6/nat/POSTROUTING -j ts-postrouting
`,
},
{
name: "addr, routes, and local routes with no netfilter",
in: &Config{
LocalAddrs: mustCIDRs("100.101.102.104/10"),
Routes: mustCIDRs("100.100.100.100/32", "0.0.0.0/0"),
LocalRoutes: mustCIDRs("10.0.0.0/8", "192.168.0.0/24"),
NetfilterMode: netfilterOff,
},
want: `
up
ip addr add 100.101.102.104/10 dev tailscale0
ip route add 0.0.0.0/0 dev tailscale0 table 52
ip route add 100.100.100.100/32 dev tailscale0 table 52
ip route add throw 10.0.0.0/8 table 52
ip route add throw 192.168.0.0/24 table 52` + basic,
},
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
all: move network monitoring from wgengine/monitor to net/netmon We're using it in more and more places, and it's not really specific to our use of Wireguard (and does more just link/interface monitoring). Also removes the separate interface we had for it in sockstats -- it's a small enough package (we already pull in all of its dependencies via other paths) that it's not worth the extra complexity. Updates #7621 Updates #7850 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-18 21:26:58 +00:00
mon, err := netmon.New(logger.Discard)
wgengine/router: take a link monitor Prep for #1591 which will need to make Linux's router react to changes that the link monitor observes. The router package already depended on the monitor package transitively. Now it's explicit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-20 20:28:06 +00:00
if err != nil {
t.Fatal(err)
}
mon.Start()
defer mon.Close()
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
fake := NewFakeOS(t)
wgengine/router: create netfilter runner in setNetfilterMode This will enable the runner to be replaced as a configuration side effect in a later change. Updates tailscale/corp#14029 Signed-off-by: James Tucker <james@tailscale.com>
2023-08-18 18:42:41 +00:00
router, err := newUserspaceRouterAdvanced(t.Logf, "tailscale0", mon, fake)
router.(*linuxRouter).nfr = fake.nfr
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
if err != nil {
t.Fatalf("failed to create router: %v", err)
}
if err := router.Up(); err != nil {
t.Fatalf("failed to up router: %v", err)
}
testState := func(t *testing.T, i int) {
t.Helper()
if err := router.Set(states[i].in); err != nil {
t.Fatalf("failed to set router config: %v", err)
}
got := fake.String()
wgengine/router: fix tests on systems with older Busybox 'ip' binary Adjust the expected system output by removing the unsupported mask component including and after the slash in expected output like: fwmask 0xabc/0xdef This package's tests now pass in an Alpine container when the 'go' and 'iptables' packages are installed (and run as privileged so /dev/net/tun exists). Fixes #5928 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id1a3896282bfa36b64afaec7a47205e63ad88542
2022-12-09 18:21:10 +00:00
want := adjustFwmask(t, strings.TrimSpace(states[i].want))
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
if diff := cmp.Diff(got, want); diff != "" {
t.Fatalf("unexpected OS state (-got+want):\n%s", diff)
}
}
for i, state := range states {
t.Run(state.name, func(t *testing.T) { testState(t, i) })
}
// Cycle through a bunch of states in pseudorandom order, to
// verify that we transition cleanly from state to state no matter
// the order.
for randRun := 0; randRun < 5*len(states); randRun++ {
i := rand.Intn(len(states))
state := states[i]
t.Run(state.name, func(t *testing.T) { testState(t, i) })
}
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
type fakeIPTablesRunner struct {
t *testing.T
ipt4 map[string][]string
ipt6 map[string][]string
//we always assume ipv6 and ipv6 nat are enabled when testing
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
util/linuxfw: move detection logic Just a refactor to consolidate the firewall detection logic in a single package so that it can be reused in a later commit by containerboot. Updates #9310 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-11 01:26:52 +00:00
func newIPTablesRunner(t *testing.T) linuxfw.NetfilterRunner {
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
return &fakeIPTablesRunner{
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
t: t,
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
ipt4: map[string][]string{
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
"filter/INPUT": nil,
"filter/OUTPUT": nil,
"filter/FORWARD": nil,
"nat/PREROUTING": nil,
"nat/OUTPUT": nil,
"nat/POSTROUTING": nil,
},
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
ipt6: map[string][]string{
"filter/INPUT": nil,
"filter/OUTPUT": nil,
"filter/FORWARD": nil,
"nat/PREROUTING": nil,
"nat/OUTPUT": nil,
"nat/POSTROUTING": nil,
},
}
}
func insertRule(n *fakeIPTablesRunner, curIPT map[string][]string, chain, newRule string) error {
// Get current rules for filter/ts-input chain with according IP version
curTSInputRules, ok := curIPT[chain]
if !ok {
n.t.Fatalf("no %s chain exists", chain)
return fmt.Errorf("no %s chain exists", chain)
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
// Add new rule to top of filter/ts-input
curTSInputRules = append(curTSInputRules, "")
copy(curTSInputRules[1:], curTSInputRules)
curTSInputRules[0] = newRule
curIPT[chain] = curTSInputRules
return nil
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
func appendRule(n *fakeIPTablesRunner, curIPT map[string][]string, chain, newRule string) error {
// Get current rules for filter/ts-input chain with according IP version
curTSInputRules, ok := curIPT[chain]
if !ok {
n.t.Fatalf("no %s chain exists", chain)
return fmt.Errorf("no %s chain exists", chain)
}
// Add new rule to end of filter/ts-input
curTSInputRules = append(curTSInputRules, newRule)
curIPT[chain] = curTSInputRules
return nil
}
func deleteRule(n *fakeIPTablesRunner, curIPT map[string][]string, chain, delRule string) error {
// Get current rules for filter/ts-input chain with according IP version
curTSInputRules, ok := curIPT[chain]
if !ok {
n.t.Fatalf("no %s chain exists", chain)
return fmt.Errorf("no %s chain exists", chain)
}
// Remove rule from filter/ts-input
for i, rule := range curTSInputRules {
if rule == delRule {
curTSInputRules = append(curTSInputRules[:i], curTSInputRules[i+1:]...)
break
}
}
curIPT[chain] = curTSInputRules
return nil
}
func (n *fakeIPTablesRunner) AddLoopbackRule(addr netip.Addr) error {
curIPT := n.ipt4
if addr.Is6() {
curIPT = n.ipt6
}
newRule := fmt.Sprintf("-i lo -s %s -j ACCEPT", addr.String())
return insertRule(n, curIPT, "filter/ts-input", newRule)
}
func (n *fakeIPTablesRunner) AddBase(tunname string) error {
util/linuxfw: add nftables support This commit adds nftable rule injection for tailscaled. If tailscaled is started with envknob TS_DEBUG_USE_NETLINK_NFTABLES = true, the router will use nftables to manage firewall rules. Updates: #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-19 20:05:14 +00:00
if err := n.addBase4(tunname); err != nil {
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
return err
}
if n.HasIPV6() {
util/linuxfw: add nftables support This commit adds nftable rule injection for tailscaled. If tailscaled is started with envknob TS_DEBUG_USE_NETLINK_NFTABLES = true, the router will use nftables to manage firewall rules. Updates: #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-19 20:05:14 +00:00
if err := n.addBase6(tunname); err != nil {
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
return err
}
}
return nil
}
cmd/containerboot: use linuxfw.NetfilterRunner This migrates containerboot to reuse the NetfilterRunner used by tailscaled instead of manipulating iptables rule itself. This has the added advantage of now working with nftables and we can potentially drop the `iptables` command from the container image in the future. Updates #9310 Co-authored-by: Irbe Krumina <irbe@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-11 14:26:40 +00:00
func (n *fakeIPTablesRunner) AddDNATRule(origDst, dst netip.Addr) error {
return errors.New("not implemented")
}
cmd{containerboot,k8s-operator},util/linuxfw: support ExternalName Services (#11802) * cmd/containerboot,util/linuxfw: support proxy backends specified by DNS name Adds support for optionally configuring containerboot to proxy traffic to backends configured by passing TS_EXPERIMENTAL_DEST_DNS_NAME env var to containerboot. Containerboot will periodically (every 10 minutes) attempt to resolve the DNS name and ensure that all traffic sent to the node's tailnet IP gets forwarded to the resolved backend IP addresses. Currently: - if the firewall mode is iptables, traffic will be load balanced accross the backend IP addresses using round robin. There are no health checks for whether the IPs are reachable. - if the firewall mode is nftables traffic will only be forwarded to the first IP address in the list. This is to be improved. * cmd/k8s-operator: support ExternalName Services Adds support for exposing endpoints, accessible from within a cluster to the tailnet via DNS names using ExternalName Services. This can be done by annotating the ExternalName Service with tailscale.com/expose: "true" annotation. The operator will deploy a proxy configured to route tailnet traffic to the backend IPs that service.spec.externalName resolves to. The backend IPs must be reachable from the operator's namespace. Updates tailscale/tailscale#10606 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-04-23 16:30:00 +00:00
func (n *fakeIPTablesRunner) DNATWithLoadBalancer(netip.Addr, []netip.Addr) error {
return errors.New("not implemented")
}
cmd/containerboot: use linuxfw.NetfilterRunner This migrates containerboot to reuse the NetfilterRunner used by tailscaled instead of manipulating iptables rule itself. This has the added advantage of now working with nftables and we can potentially drop the `iptables` command from the container image in the future. Updates #9310 Co-authored-by: Irbe Krumina <irbe@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-11 14:26:40 +00:00
func (n *fakeIPTablesRunner) AddSNATRuleForDst(src, dst netip.Addr) error {
return errors.New("not implemented")
}
func (n *fakeIPTablesRunner) DNATNonTailscaleTraffic(exemptInterface string, dst netip.Addr) error {
return errors.New("not implemented")
}
func (n *fakeIPTablesRunner) ClampMSSToPMTU(tun string, addr netip.Addr) error {
return errors.New("not implemented")
}
util/linuxfw: add nftables support This commit adds nftable rule injection for tailscaled. If tailscaled is started with envknob TS_DEBUG_USE_NETLINK_NFTABLES = true, the router will use nftables to manage firewall rules. Updates: #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-19 20:05:14 +00:00
func (n *fakeIPTablesRunner) addBase4(tunname string) error {
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
curIPT := n.ipt4
newRules := []struct{ chain, rule string }{
{"filter/ts-input", fmt.Sprintf("! -i %s -s %s -j RETURN", tunname, tsaddr.ChromeOSVMRange().String())},
{"filter/ts-input", fmt.Sprintf("! -i %s -s %s -j DROP", tunname, tsaddr.CGNATRange().String())},
{"filter/ts-forward", fmt.Sprintf("-i %s -j MARK --set-mark %s/%s", tunname, linuxfw.TailscaleSubnetRouteMark, linuxfw.TailscaleFwmarkMask)},
{"filter/ts-forward", fmt.Sprintf("-m mark --mark %s/%s -j ACCEPT", linuxfw.TailscaleSubnetRouteMark, linuxfw.TailscaleFwmarkMask)},
{"filter/ts-forward", fmt.Sprintf("-o %s -s %s -j DROP", tunname, tsaddr.CGNATRange().String())},
{"filter/ts-forward", fmt.Sprintf("-o %s -j ACCEPT", tunname)},
}
for _, rule := range newRules {
if err := appendRule(n, curIPT, rule.chain, rule.rule); err != nil {
return fmt.Errorf("add rule %q to chain %q: %w", rule.rule, rule.chain, err)
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
}
return nil
}
util/linuxfw: add nftables support This commit adds nftable rule injection for tailscaled. If tailscaled is started with envknob TS_DEBUG_USE_NETLINK_NFTABLES = true, the router will use nftables to manage firewall rules. Updates: #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-19 20:05:14 +00:00
func (n *fakeIPTablesRunner) addBase6(tunname string) error {
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
curIPT := n.ipt6
newRules := []struct{ chain, rule string }{
{"filter/ts-forward", fmt.Sprintf("-i %s -j MARK --set-mark %s/%s", tunname, linuxfw.TailscaleSubnetRouteMark, linuxfw.TailscaleFwmarkMask)},
{"filter/ts-forward", fmt.Sprintf("-m mark --mark %s/%s -j ACCEPT", linuxfw.TailscaleSubnetRouteMark, linuxfw.TailscaleFwmarkMask)},
{"filter/ts-forward", fmt.Sprintf("-o %s -j ACCEPT", tunname)},
}
for _, rule := range newRules {
if err := appendRule(n, curIPT, rule.chain, rule.rule); err != nil {
return fmt.Errorf("add rule %q to chain %q: %w", rule.rule, rule.chain, err)
}
}
return nil
}
func (n *fakeIPTablesRunner) DelLoopbackRule(addr netip.Addr) error {
curIPT := n.ipt4
if addr.Is6() {
curIPT = n.ipt6
}
delRule := fmt.Sprintf("-i lo -s %s -j ACCEPT", addr.String())
return deleteRule(n, curIPT, "filter/ts-input", delRule)
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
func (n *fakeIPTablesRunner) AddHooks() error {
newRules := []struct{ chain, rule string }{
{"filter/INPUT", "-j ts-input"},
{"filter/FORWARD", "-j ts-forward"},
{"nat/POSTROUTING", "-j ts-postrouting"},
}
for _, ipt := range []map[string][]string{n.ipt4, n.ipt6} {
for _, r := range newRules {
if err := insertRule(n, ipt, r.chain, r.rule); err != nil {
return err
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
}
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
return nil
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
func (n *fakeIPTablesRunner) DelHooks(logf logger.Logf) error {
delRules := []struct{ chain, rule string }{
{"filter/INPUT", "-j ts-input"},
{"filter/FORWARD", "-j ts-forward"},
{"nat/POSTROUTING", "-j ts-postrouting"},
}
for _, ipt := range []map[string][]string{n.ipt4, n.ipt6} {
for _, r := range delRules {
if err := deleteRule(n, ipt, r.chain, r.rule); err != nil {
return err
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
}
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
return nil
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
func (n *fakeIPTablesRunner) AddChains() error {
for _, ipt := range []map[string][]string{n.ipt4, n.ipt6} {
for _, chain := range []string{"filter/ts-input", "filter/ts-forward", "nat/ts-postrouting"} {
ipt[chain] = nil
}
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
return nil
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
func (n *fakeIPTablesRunner) DelChains() error {
for _, ipt := range []map[string][]string{n.ipt4, n.ipt6} {
for chain := range ipt {
if strings.HasPrefix(chain, "filter/ts-") || strings.HasPrefix(chain, "nat/ts-") {
delete(ipt, chain)
}
}
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
return nil
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
func (n *fakeIPTablesRunner) DelBase() error {
for _, ipt := range []map[string][]string{n.ipt4, n.ipt6} {
for _, chain := range []string{"filter/ts-input", "filter/ts-forward", "nat/ts-postrouting"} {
ipt[chain] = nil
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
return nil
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
func (n *fakeIPTablesRunner) AddSNATRule() error {
newRule := fmt.Sprintf("-m mark --mark %s/%s -j MASQUERADE", linuxfw.TailscaleSubnetRouteMark, linuxfw.TailscaleFwmarkMask)
for _, ipt := range []map[string][]string{n.ipt4, n.ipt6} {
if err := appendRule(n, ipt, "nat/ts-postrouting", newRule); err != nil {
return err
}
}
return nil
}
func (n *fakeIPTablesRunner) DelSNATRule() error {
delRule := fmt.Sprintf("-m mark --mark %s/%s -j MASQUERADE", linuxfw.TailscaleSubnetRouteMark, linuxfw.TailscaleFwmarkMask)
for _, ipt := range []map[string][]string{n.ipt4, n.ipt6} {
if err := deleteRule(n, ipt, "nat/ts-postrouting", delRule); err != nil {
return err
}
}
return nil
}
util/linuxfw, wgengine: allow ingress to magicsock UDP port on Linux (#10370) * util/linuxfw, wgengine: allow ingress to magicsock UDP port on Linux Updates #9084. Currently, we have to tell users to manually open UDP ports on Linux when certain firewalls (like ufw) are enabled. This change automates the process of adding and updating those firewall rules as magicsock changes what port it listens on. Signed-off-by: Naman Sood <mail@nsood.in>
2023-12-05 23:12:02 +00:00
// buildMagicsockPortRule builds a fake rule to use in AddMagicsockPortRule and
// DelMagicsockPortRule below.
func buildMagicsockPortRule(port uint16) string {
return fmt.Sprintf("-p udp --dport %v -j ACCEPT", port)
}
// AddMagicsockPortRule implements the NetfilterRunner interface, but stores
// rules in fakeIPTablesRunner's internal maps rather than actually calling out
// to iptables. This is mainly to test the linux router implementation.
func (n *fakeIPTablesRunner) AddMagicsockPortRule(port uint16, network string) error {
var ipt map[string][]string
switch network {
case "udp4":
ipt = n.ipt4
case "udp6":
ipt = n.ipt6
default:
return fmt.Errorf("unsupported network %s", network)
}
rule := buildMagicsockPortRule(port)
if err := appendRule(n, ipt, "filter/ts-input", rule); err != nil {
return err
}
return nil
}
// DelMagicsockPortRule implements the NetfilterRunner interface, but removes
// rules from fakeIPTablesRunner's internal maps rather than actually calling
// out to iptables. This is mainly to test the linux router implementation.
func (n *fakeIPTablesRunner) DelMagicsockPortRule(port uint16, network string) error {
var ipt map[string][]string
switch network {
case "udp4":
ipt = n.ipt4
case "udp6":
ipt = n.ipt6
default:
return fmt.Errorf("unsupported network %s", network)
}
rule := buildMagicsockPortRule(port)
if err := deleteRule(n, ipt, "filter/ts-input", rule); err != nil {
return err
}
return nil
}
util/linuxfw,wgengine/router: skip IPv6 firewall configuration in partial iptables mode (#11546) We have hosts that support IPv6, but not IPv6 firewall configuration in iptables mode. We also have hosts that have some support for IPv6 firewall configuration in iptables mode, but do not have iptables filter table. We should: - configure ip rules for all hosts that support IPv6 - only configure firewall rules in iptables mode if the host has iptables filter table. Updates tailscale/tailscale#11540 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-03-29 05:23:03 +00:00
func (n *fakeIPTablesRunner) HasIPV6() bool { return true }
func (n *fakeIPTablesRunner) HasIPV6NAT() bool { return true }
func (n *fakeIPTablesRunner) HasIPV6Filter() bool { return true }
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
// fakeOS implements commandRunner and provides v4 and v6
// netfilterRunners, but captures changes without touching the OS.
type fakeOS struct {
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
t *testing.T
up bool
ips []string
routes []string
rules []string
//This test tests on the router level, so we will not bother
//with using iptables or nftables, chose the simpler one.
util/linuxfw: move detection logic Just a refactor to consolidate the firewall detection logic in a single package so that it can be reused in a later commit by containerboot. Updates #9310 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-11 01:26:52 +00:00
nfr linuxfw.NetfilterRunner
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
}
func NewFakeOS(t *testing.T) *fakeOS {
return &fakeOS{
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
t: t,
nfr: newIPTablesRunner(t),
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
}
}
var errExec = errors.New("execution failed")
func (o *fakeOS) String() string {
var b strings.Builder
if o.up {
b.WriteString("up\n")
} else {
b.WriteString("down\n")
}
for _, ip := range o.ips {
fmt.Fprintf(&b, "ip addr add %s\n", ip)
}
for _, route := range o.routes {
fmt.Fprintf(&b, "ip route add %s\n", route)
}
for _, rule := range o.rules {
fmt.Fprintf(&b, "ip rule add %s\n", rule)
}
var chains []string
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
for chain := range o.nfr.(*fakeIPTablesRunner).ipt4 {
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
chains = append(chains, chain)
}
sort.Strings(chains)
for _, chain := range chains {
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
for _, rule := range o.nfr.(*fakeIPTablesRunner).ipt4[chain] {
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
fmt.Fprintf(&b, "v4/%s %s\n", chain, rule)
}
}
chains = nil
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
for chain := range o.nfr.(*fakeIPTablesRunner).ipt6 {
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
chains = append(chains, chain)
}
sort.Strings(chains)
for _, chain := range chains {
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
for _, rule := range o.nfr.(*fakeIPTablesRunner).ipt6[chain] {
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
fmt.Fprintf(&b, "v6/%s %s\n", chain, rule)
}
}
return b.String()[:len(b.String())-1]
}
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
func (o *fakeOS) run(args ...string) error {
unexpected := func() error {
o.t.Errorf("unexpected invocation %q", strings.Join(args, " "))
return errors.New("unrecognized invocation")
}
if args[0] != "ip" {
return unexpected()
}
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
if len(args) == 2 && args[1] == "rule" {
// naked invocation of `ip rule` is a feature test. Return
// successfully.
return nil
}
family := ""
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
rest := strings.Join(args[3:], " ")
wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-09-22 00:49:44 +00:00
if args[1] == "-4" || args[1] == "-6" {
family = args[1]
copy(args[1:], args[2:])
args = args[:len(args)-1]
rest = family + " " + strings.Join(args[3:], " ")
}
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
var l *[]string
switch args[1] {
case "link":
got := strings.Join(args[2:], " ")
switch got {
router_linux: use only baseline 'ip rule' features that exist in old kernels. This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28 07:44:09 +00:00
case "set dev tailscale0 up":
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
o.up = true
router_linux: use only baseline 'ip rule' features that exist in old kernels. This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28 07:44:09 +00:00
case "set dev tailscale0 down":
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
o.up = false
default:
return unexpected()
}
return nil
case "addr":
l = &o.ips
case "route":
l = &o.routes
case "rule":
l = &o.rules
default:
return unexpected()
}
switch args[2] {
case "add":
for _, el := range *l {
if el == rest {
o.t.Errorf("can't add %q, already present", rest)
return errors.New("already exists")
}
}
*l = append(*l, rest)
sort.Strings(*l)
case "del":
found := false
for i, el := range *l {
if el == rest {
found = true
*l = append((*l)[:i], (*l)[i+1:]...)
break
}
}
if !found {
router_linux: use only baseline 'ip rule' features that exist in old kernels. This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28 07:44:09 +00:00
o.t.Logf("note: can't delete %q, not present", rest)
// 'ip rule del' exits with code 2 when a row is
// missing. We don't want to consider that an error,
// for cleanup purposes.
// TODO(apenwarr): this is a hack.
// I'd like to return an exec.ExitError(2) here, but
// I can't, because the ExitCode is implemented in
// os.ProcessState, which is an opaque object I can't
// instantiate or modify. Go's 75 levels of abstraction
// between me and an 8-bit int are really paying off
// here, as you can see.
return errors.New("exitcode:2")
wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14 02:17:19 +00:00
}
default:
return unexpected()
}
return nil
}
func (o *fakeOS) output(args ...string) ([]byte, error) {
want := "ip rule list priority 10000"
got := strings.Join(args, " ")
if got != want {
o.t.Errorf("unexpected command that wants output: %v", got)
return nil, errExec
}
var ret []string
for _, rule := range o.rules {
if strings.Contains(rule, "10000") {
ret = append(ret, rule)
}
}
return []byte(strings.Join(ret, "\n")), nil
}
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
var tunTestNum int64
func createTestTUN(t *testing.T) tun.Device {
const minimalMTU = 1280
tunName := fmt.Sprintf("tuntest%d", atomic.AddInt64(&tunTestNum, 1))
tun, err := tun.CreateTUN(tunName, minimalMTU)
if err != nil {
t.Fatalf("CreateTUN(%q): %v", tunName, err)
}
return tun
}
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
type linuxTest struct {
tun tun.Device
all: move network monitoring from wgengine/monitor to net/netmon We're using it in more and more places, and it's not really specific to our use of Wireguard (and does more just link/interface monitoring). Also removes the separate interface we had for it in sockstats -- it's a small enough package (we already pull in all of its dependencies via other paths) that it's not worth the extra complexity. Updates #7621 Updates #7850 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-18 21:26:58 +00:00
mon *netmon.Monitor
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
r *linuxRouter
logOutput tstest.MemLogger
}
func (lt *linuxTest) Close() error {
if lt.tun != nil {
lt.tun.Close()
}
if lt.mon != nil {
lt.mon.Close()
}
return nil
}
func newLinuxRootTest(t *testing.T) *linuxTest {
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
if os.Getuid() != 0 {
t.Skip("test requires root")
}
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
lt := new(linuxTest)
lt.tun = createTestTUN(t)
logf := lt.logOutput.Logf
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
all: move network monitoring from wgengine/monitor to net/netmon We're using it in more and more places, and it's not really specific to our use of Wireguard (and does more just link/interface monitoring). Also removes the separate interface we had for it in sockstats -- it's a small enough package (we already pull in all of its dependencies via other paths) that it's not worth the extra complexity. Updates #7621 Updates #7850 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-18 21:26:58 +00:00
mon, err := netmon.New(logger.Discard)
wgengine/router: take a link monitor Prep for #1591 which will need to make Linux's router react to changes that the link monitor observes. The router package already depended on the monitor package transitively. Now it's explicit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-20 20:28:06 +00:00
if err != nil {
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
lt.Close()
wgengine/router: take a link monitor Prep for #1591 which will need to make Linux's router react to changes that the link monitor observes. The router package already depended on the monitor package transitively. Now it's explicit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-20 20:28:06 +00:00
t.Fatal(err)
}
mon.Start()
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
lt.mon = mon
wgengine/router: take a link monitor Prep for #1591 which will need to make Linux's router react to changes that the link monitor observes. The router package already depended on the monitor package transitively. Now it's explicit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-20 20:28:06 +00:00
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
r, err := newUserspaceRouter(logf, lt.tun, mon)
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
if err != nil {
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
lt.Close()
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
t.Fatal(err)
}
lr := r.(*linuxRouter)
if err := lr.upInterface(); err != nil {
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
lt.Close()
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
t.Fatal(err)
}
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
lt.r = lr
return lt
}
func TestDelRouteIdempotent(t *testing.T) {
lt := newLinuxRootTest(t)
defer lt.Close()
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
for _, s := range []string{
"192.0.2.0/24", // RFC 5737
"2001:DB8::/32", // RFC 3849
} {
all: use various net/netip parse funcs directly Mechanical change with perl+goimports. Changed {Must,}Parse{IP,IPPrefix,IPPort} to their netip variants, then goimports -d . Finally, removed the net/netaddr wrappers, to prevent future use. Updates #5162 Change-Id: I59c0e38b5fbca5a935d701645789cddf3d7863ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 03:55:44 +00:00
cidr := netip.MustParsePrefix(s)
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
if err := lt.r.addRoute(cidr); err != nil {
t.Error(err)
continue
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
}
all: use Go 1.22 range-over-int Updates #11058 Change-Id: I35e7ef9b90e83cac04ca93fd964ad00ed5b48430 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-16 20:15:13 +00:00
for i := range 2 {
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
if err := lt.r.delRoute(cidr); err != nil {
t.Errorf("delRoute(i=%d): %v", i, err)
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
}
}
}
if t.Failed() {
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
out := lt.logOutput.String()
wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18 06:11:59 +00:00
t.Logf("Log output:\n%s", out)
}
}
wgengine/router: start using netlink instead of 'ip' on Linux Converts up, down, add/del addresses, add/del routes. Not yet done: rules. Updates #391 Change-Id: I02554ca07046d18f838e04a626ba99bbd35266fb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 04:36:29 +00:00
wgengine/router: use netlink for ip rules on Linux Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 22:22:03 +00:00
func TestAddRemoveRules(t *testing.T) {
lt := newLinuxRootTest(t)
defer lt.Close()
r := lt.r
step := func(name string, f func() error) {
t.Logf("Doing %v ...", name)
if err := f(); err != nil {
t.Fatalf("%s: %v", name, err)
}
rules, err := netlink.RuleList(netlink.FAMILY_ALL)
if err != nil {
t.Fatal(err)
}
for _, r := range rules {
if r.Priority >= 5000 && r.Priority <= 5999 {
t.Logf("Rule: %+v", r)
}
}
}
step("init_del_and_add", r.addIPRules)
step("dup_add", r.justAddIPRules)
step("del", r.delIPRules)
step("dup_del", r.delIPRules)
}
wgengine/router: start using netlink instead of 'ip' on Linux Converts up, down, add/del addresses, add/del routes. Not yet done: rules. Updates #391 Change-Id: I02554ca07046d18f838e04a626ba99bbd35266fb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 04:36:29 +00:00
func TestDebugListLinks(t *testing.T) {
links, err := netlink.LinkList()
if err != nil {
t.Fatal(err)
}
for _, ln := range links {
t.Logf("Link: %+v", ln)
}
}
func TestDebugListRoutes(t *testing.T) {
// We need to pass a non-nil route to RouteListFiltered, along
// with the netlink.RT_FILTER_TABLE bit set in the filter
// mask, otherwise it ignores non-main routes.
filter := &netlink.Route{}
routes, err := netlink.RouteListFiltered(netlink.FAMILY_ALL, filter, netlink.RT_FILTER_TABLE)
if err != nil {
t.Fatal(err)
}
for _, r := range routes {
t.Logf("Route: %+v", r)
}
}
wgengine/router: add debug test to enumerate rules No non-test changes. Updates #391 Change-Id: Ia88610c08e07a119d002e58250463cb4659b9f54 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 18:11:37 +00:00
var famName = map[int]string{
netlink.FAMILY_ALL: "all",
netlink.FAMILY_V4: "v4",
netlink.FAMILY_V6: "v6",
}
func TestDebugListRules(t *testing.T) {
for _, fam := range []int{netlink.FAMILY_V4, netlink.FAMILY_V6, netlink.FAMILY_ALL} {
t.Run(famName[fam], func(t *testing.T) {
rules, err := netlink.RuleList(fam)
if err != nil {
wgengine/router: demote TestDebugListRules fail to skip Updates #3360 Change-Id: Ic5c98ea03f3171c13ab9293a0ae74d17fd04d149 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-22 18:54:04 +00:00
t.Skipf("skip; RuleList fails with: %v", err)
wgengine/router: add debug test to enumerate rules No non-test changes. Updates #391 Change-Id: Ia88610c08e07a119d002e58250463cb4659b9f54 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28 18:11:37 +00:00
}
for _, r := range rules {
t.Logf("Rule: %+v", r)
}
})
}
}
wgengine/router: remove last non-test "ip" command usage on Linux Updates #391 Change-Id: Ic2c3f8460b1e4b8d34b936a1725705fcc1effbae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-01 22:52:24 +00:00
func TestCheckIPRuleSupportsV6(t *testing.T) {
util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
2023-06-16 18:54:58 +00:00
err := linuxfw.CheckIPRuleSupportsV6(t.Logf)
wgengine/router: remove last non-test "ip" command usage on Linux Updates #391 Change-Id: Ic2c3f8460b1e4b8d34b936a1725705fcc1effbae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-01 22:52:24 +00:00
if err != nil && os.Getuid() != 0 {
t.Skipf("skipping, error when not root: %v", err)
}
// Just log it. For interactive testing only.
// Some machines running our tests might not have IPv6.
t.Logf("Got: %v", err)
}
wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-12 20:29:41 +00:00
func TestBusyboxParseVersion(t *testing.T) {
input := `BusyBox v1.34.1 (2022-09-01 16:10:29 UTC) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.
Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --show SCRIPT
or: busybox --install [-s] [DIR]
or: function [arguments]...
BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.
`
v1, v2, v3, err := busyboxParseVersion(input)
if err != nil {
t.Fatalf("busyboxParseVersion() failed: %v", err)
}
if got, want := fmt.Sprintf("%d.%d.%d", v1, v2, v3), "1.34.1"; got != want {
t.Errorf("version = %q, want %q", got, want)
}
}
wgengine/router: [linux] add before deleting interface addrs Deleting may temporarily result in no addrs on the interface, which results in all other rules (like routes) to get dropped by the OS. I verified this fixes the problem. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-20 14:22:27 +00:00
func TestCIDRDiff(t *testing.T) {
pfx := func(p ...string) []netip.Prefix {
var ret []netip.Prefix
for _, s := range p {
ret = append(ret, netip.MustParsePrefix(s))
}
return ret
}
tests := []struct {
old []netip.Prefix
new []netip.Prefix
wantAdd []netip.Prefix
wantDel []netip.Prefix
final []netip.Prefix
}{
{
old: nil,
new: pfx("1.1.1.1/32"),
wantAdd: pfx("1.1.1.1/32"),
final: pfx("1.1.1.1/32"),
},
{
old: pfx("1.1.1.1/32"),
new: pfx("1.1.1.1/32"),
final: pfx("1.1.1.1/32"),
},
{
old: pfx("1.1.1.1/32", "2.3.4.5/32"),
new: pfx("1.1.1.1/32"),
wantDel: pfx("2.3.4.5/32"),
final: pfx("1.1.1.1/32"),
},
{
old: pfx("1.1.1.1/32", "2.3.4.5/32"),
new: pfx("1.0.0.0/32", "3.4.5.6/32"),
wantDel: pfx("1.1.1.1/32", "2.3.4.5/32"),
wantAdd: pfx("1.0.0.0/32", "3.4.5.6/32"),
final: pfx("1.0.0.0/32", "3.4.5.6/32"),
},
}
for _, tc := range tests {
om := make(map[netip.Prefix]bool)
for _, p := range tc.old {
om[p] = true
}
var added []netip.Prefix
var deleted []netip.Prefix
fm, err := cidrDiff("test", om, tc.new, func(p netip.Prefix) error {
if len(deleted) > 0 {
t.Error("delete called before add")
}
added = append(added, p)
return nil
}, func(p netip.Prefix) error {
deleted = append(deleted, p)
return nil
}, t.Logf)
if err != nil {
t.Fatal(err)
}
all: update exp/slices and fix call sites slices.SortFunc suffered a late-in-cycle API breakage. Updates #cleanup Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-28 17:39:04 +00:00
slices.SortFunc(added, netipx.ComparePrefix)
slices.SortFunc(deleted, netipx.ComparePrefix)
wgengine/router: [linux] add before deleting interface addrs Deleting may temporarily result in no addrs on the interface, which results in all other rules (like routes) to get dropped by the OS. I verified this fixes the problem. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-20 14:22:27 +00:00
if !reflect.DeepEqual(added, tc.wantAdd) {
t.Errorf("added = %v, want %v", added, tc.wantAdd)
}
if !reflect.DeepEqual(deleted, tc.wantDel) {
t.Errorf("deleted = %v, want %v", deleted, tc.wantDel)
}
// Check that the final state is correct.
if len(fm) != len(tc.final) {
t.Fatalf("final state = %v, want %v", fm, tc.final)
}
for _, p := range tc.final {
if !fm[p] {
t.Errorf("final state = %v, want %v", fm, tc.final)
}
}
}
}
wgengine/router: fix tests on systems with older Busybox 'ip' binary Adjust the expected system output by removing the unsupported mask component including and after the slash in expected output like: fwmask 0xabc/0xdef This package's tests now pass in an Alpine container when the 'go' and 'iptables' packages are installed (and run as privileged so /dev/net/tun exists). Fixes #5928 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id1a3896282bfa36b64afaec7a47205e63ad88542
2022-12-09 18:21:10 +00:00
var (
fwmaskSupported bool
fwmaskSupportedOnce sync.Once
fwmaskAdjustRe = regexp.MustCompile(`(?m)(fwmark 0x[0-9a-f]+)/0x[0-9a-f]+`)
)
// adjustFwmask removes the "/0xmask" string from fwmask stanzas if the
// installed 'ip' binary does not support that format.
func adjustFwmask(t *testing.T, s string) string {
t.Helper()
fwmaskSupportedOnce.Do(func() {
fwmaskSupported, _ = ipCmdSupportsFwmask()
})
if fwmaskSupported {
return s
}
return fwmaskAdjustRe.ReplaceAllString(s, "$1")
}
Reference in New Issue Copy Permalink