net/netns: set the bypass socket mark on linux.

This allows tailscaled's own traffic to bypass Tailscale-managed routes,
so that things like tailscale-provided default routes don't break
tailscaled itself.

Progress on #144.

Signed-off-by: David Anderson <danderson@tailscale.com>

net/netns/netns.go

@@ -13,9 +13,12 @@ package netns
 
 import (
 	"net"
-	"syscall"
+
+	"tailscale.com/syncs"
 )
 
+var skipPrivileged syncs.AtomicBool
+
 // Listener returns a new net.Listener with its Control hook func
 // initialized as necessary to run in logical network namespace that
 // doesn't route back into Tailscale.
@@ -30,11 +33,9 @@ func Dialer() *net.Dialer {
 	return &net.Dialer{Control: control}
 }
 
-// control marks c as necessary to dial in a separate network namespace.
-//
-// It's intentionally the same signature as net.Dialer.Control
-// and net.ListenConfig.Control.
-func control(network, address string, c syscall.RawConn) error {
-	// TODO: implement
-	return nil
+// TestOnlySkipPrivilegedOps disables any behavior in this package
+// that requires root or other elevated privileges. It's used only in
+// tests, and using it definitely breaks some Tailscale functionality.
+func TestOnlySkipPrivilegedOps() {
+	skipPrivileged.Set(true)
 }

net/netns/netns_default.go

@@ -0,0 +1,14 @@
+// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !linux
+
+package netns
+
+import "syscall"
+
+// control does nothing to c.
+func control(network, address string, c syscall.RawConn) error {
+	return nil
+}

net/netns/netns_linux.go

@@ -0,0 +1,46 @@
+// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build linux
+
+package netns
+
+import (
+	"fmt"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+// tailscaleBypassMark is the mark indicating that packets originating
+// from a socket should bypass Tailscale-managed routes during routing
+// table lookups.
+//
+// Keep this in sync with tailscaleBypassMark in
+// wgengine/router/router_linux.go.
+const tailscaleBypassMark = 0x20000
+
+// control marks c as necessary to dial in a separate network namespace.
+//
+// It's intentionally the same signature as net.Dialer.Control
+// and net.ListenConfig.Control.
+func control(network, address string, c syscall.RawConn) error {
+	if skipPrivileged.Get() {
+		// We can't set socket marks without CAP_NET_ADMIN on linux,
+		// skip as requested.
+		return nil
+	}
+
+	var controlErr error
+	err := c.Control(func(fd uintptr) {
+		controlErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK, tailscaleBypassMark)
+	})
+	if err != nil {
+		return fmt.Errorf("setting socket mark: %w", err)
+	}
+	if controlErr != nil {
+		return fmt.Errorf("setting socket mark: %w", controlErr)
+	}
+	return nil
+}