From bcb979f8bf2ce59eb99d4cf5c5a6780b8a4ac0b9 Mon Sep 17 00:00:00 2001 From: Brad Fitzpatrick Date: Fri, 19 Nov 2021 11:05:34 -0800 Subject: [PATCH] wgengine/router: don't assume Linux was built with IP_MULTIPLE_TABLES Updates #3351 Updates #391 Change-Id: I7e66b686e05f3c970846513679cc62556ebe322a Signed-off-by: Brad Fitzpatrick (cherry picked from commit 9259377a7f65a5f4c21b096d0da5249d75b97134) --- wgengine/router/router_linux.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/wgengine/router/router_linux.go b/wgengine/router/router_linux.go index fcd00ee4b..593975878 100644 --- a/wgengine/router/router_linux.go +++ b/wgengine/router/router_linux.go @@ -99,7 +99,7 @@ type linuxRouter struct { ipRuleFixLimiter *rate.Limiter // Various feature checks for the network stack. - ipRuleAvailable bool + ipRuleAvailable bool // whether kernel was built with IP_MULTIPLE_TABLES v6Available bool v6NATAvailable bool @@ -165,8 +165,13 @@ func newUserspaceRouterAdvanced(logf logger.Logf, tunname string, linkMon *monit if r.useIPCommand() { r.ipRuleAvailable = (cmd.run("ip", "rule") == nil) } else { - // Pretend it is. - r.ipRuleAvailable = true + if rules, err := netlink.RuleList(netlink.FAMILY_V4); err != nil { + r.logf("error querying IP rules (does kernel have IP_MULTIPLE_TABLES?): %v", err) + r.logf("warning: running without policy routing") + } else { + r.logf("policy routing available; found %d rules", len(rules)) + r.ipRuleAvailable = true + } } return r, nil