4 Commits

Author	SHA1	Message	Date
Avery Pennarun	85e675940d	wgengine/filter: allow ICMP response packets. ... Longer term, we should probably update the packet filter to be fully stateful, for both TCP and ICMP. That is, only ICMP packets related to a session *we* initiated should be allowed back in. But this is reasonably secure for now, since wireguard is already trimming most traffic. The current code would not protect against eg. Ping-of-Death style attacks from VPN nodes. Fixes tailscale/tailscale#290. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	2020-04-29 05:25:45 -04:00
Brad Fitzpatrick	2e420ad8b6	wgengine, wgengine/filter: minor doc, style, performance, locking changes ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2020-03-25 08:41:01 -07:00
Avery Pennarun	f53e78e0d5	wgengine: don't lose filter state on filter reconfig. ... We were abandoning the UDP port LRU every time we got a new packet filter from tailcontrol, which caused return packets to suddenly stop arriving.	2020-03-25 04:52:41 -04:00
Earl Lee	a8d8b8719a	Move Linux client & common packages into a public repo.	2020-02-09 09:32:57 -08:00