mirror of https://github.com/tailscale/tailscale/
netcheck,portmapper,magicsock: ignore some UDP write errors on Linux
Treat UDP send EPERM errors as a lost UDP packet, not something super fatal. That's just the Linux firewall preventing it from going out. And add a leaf package net/neterror for that (and future) policy that all three packages can share, with tests. Updates #3619 Change-Id: Ibdb838c43ee9efe70f4f25f7fc7fdf4607ba9c1d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>pull/3651/head
Brad Fitzpatrick
3 years ago
committed by
Brad Fitzpatrick
parent
2c94e3c4ad
commit
7d9b1de3aa
@ -0,0 +1,42 @@
|
||||
// Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// Package neterror classifies network errors.
|
||||
package neterror
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"runtime"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
var errEPERM error = syscall.EPERM // box it into interface just once
|
||||
|
||||
// TreatAsLostUDP reports whether err is an error from a UDP send
|
||||
// operation that should be treated as a UDP packet that just got
|
||||
// lost.
|
||||
//
|
||||
// Notably, on Linux this reports true for EPERM errors (from outbound
|
||||
// firewall blocks) which aren't really send errors; they're just
|
||||
// sends that are never going to make it because the local OS blocked
|
||||
// it.
|
||||
func TreatAsLostUDP(err error) bool {
|
||||
if err == nil {
|
||||
return false
|
||||
}
|
||||
switch runtime.GOOS {
|
||||
case "linux":
|
||||
// Linux, while not documented in the man page,
|
||||
// returns EPERM when there's an OUTPUT rule with -j
|
||||
// DROP or -j REJECT. We use this very specific
|
||||
// Linux+EPERM check rather than something super broad
|
||||
// like net.Error.Temporary which could be anything.
|
||||
//
|
||||
// For now we only do this on Linux, as such outgoing
|
||||
// firewall violations mapping to syscall errors
|
||||
// hasn't yet been observed on other OSes.
|
||||
return errors.Is(err, errEPERM)
|
||||
}
|
||||
return false
|
||||
}
|
||||
@ -0,0 +1,55 @@
|
||||
// Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package neterror
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net"
|
||||
"os"
|
||||
"syscall"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestTreatAsLostUDP(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
err error
|
||||
want bool
|
||||
}{
|
||||
{"nil", nil, false},
|
||||
{"non-nil", errors.New("foo"), false},
|
||||
{"eperm", syscall.EPERM, true},
|
||||
{
|
||||
name: "operror",
|
||||
err: &net.OpError{
|
||||
Op: "write",
|
||||
Err: &os.SyscallError{
|
||||
Syscall: "sendto",
|
||||
Err: syscall.EPERM,
|
||||
},
|
||||
},
|
||||
want: true,
|
||||
},
|
||||
{
|
||||
name: "host_unreach",
|
||||
err: &net.OpError{
|
||||
Op: "write",
|
||||
Err: &os.SyscallError{
|
||||
Syscall: "sendto",
|
||||
Err: syscall.EHOSTUNREACH,
|
||||
},
|
||||
},
|
||||
want: false,
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
if got := TreatAsLostUDP(tt.err); got != tt.want {
|
||||
t.Errorf("got = %v; want %v", got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
}
|
||||
Loading…
Reference in New Issue