TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2024-11-29 13:05:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipn, wgengine/filter: fix Shields Up recent regression and old bug

Browse Source 
Fixes #1192 (regression)
Fixes #1193 (old bug)
This commit is contained in:
Brad Fitzpatrick 2021-01-22 13:39:53 -08:00
parent 97496a83af
commit e7bf144c3f
2 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ipn/local.go
View File

@ -562,12 +562,13 @@ func (b *LocalBackend) updateFilter(netMap *controlclient.NetworkMap, prefs *Pre
localNets := unmapIPPrefixes(netMap.Addresses, advRoutes) localNets := unmapIPPrefixes(netMap.Addresses, advRoutes)
oldFilter := b.e.GetFilter()
if shieldsUp { if shieldsUp {
b.logf("netmap packet filter: (shields up)") b.logf("netmap packet filter: (shields up)")
b.e.SetFilter(filter.NewShieldsUpFilter(b.logf)) b.e.SetFilter(filter.NewShieldsUpFilter(localNets, oldFilter, b.logf))
} else { } else {
b.logf("netmap packet filter: %v", packetFilter) b.logf("netmap packet filter: %v", packetFilter)
b.e.SetFilter(filter.New(packetFilter, localNets, b.e.GetFilter(), b.logf)) b.e.SetFilter(filter.New(packetFilter, localNets, oldFilter, b.logf))
} }
} }

12
wgengine/filter/filter.go
View File

@ -132,8 +132,16 @@ func NewAllowNone(logf logger.Logf) *Filter {
return New(nil, nil, nil, logf) return New(nil, nil, nil, logf)
} }
func NewShieldsUpFilter(logf logger.Logf) *Filter { // NewShieldsUpFilter returns a packet filter that rejects incoming connections.
f := New(nil, nil, nil, logf) //
// If shareStateWith is non-nil, the returned filter shares state with the previous one,
// as long as the previous one was also a shields up filter.
func NewShieldsUpFilter(localNets []netaddr.IPPrefix, shareStateWith *Filter, logf logger.Logf) *Filter {
// Don't permit sharing state with a prior filter that wasn't a shields-up filter.
if shareStateWith != nil && !shareStateWith.shieldsUp {
shareStateWith = nil
}
f := New(nil, localNets, shareStateWith, logf)
f.shieldsUp = true f.shieldsUp = true
return f return f
} }