mirror of https://github.com/tailscale/tailscale/
all: implement pcap streaming for datapath debugging
Updates: tailscale/corp#8470 Signed-off-by: Tom DNetto <tom@tailscale.com>pull/7187/head^2
Tom DNetto
2 years ago
committed by
Tom
parent
1acdcff63e
commit
99b9d7a621
@ -0,0 +1,201 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
// Package capture formats packet logging into a debug pcap stream.
|
||||||
|
package capture
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"context"
|
||||||
|
"encoding/binary"
|
||||||
|
"io"
|
||||||
|
"net/http"
|
||||||
|
"sync"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
_ "embed"
|
||||||
|
|
||||||
|
"tailscale.com/util/set"
|
||||||
|
)
|
||||||
|
|
||||||
|
//go:embed ts-dissector.lua
|
||||||
|
var DissectorLua string
|
||||||
|
|
||||||
|
var bufferPool = sync.Pool{
|
||||||
|
New: func() any {
|
||||||
|
return new(bytes.Buffer)
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
const flushPeriod = 100 * time.Millisecond
|
||||||
|
|
||||||
|
func writePcapHeader(w io.Writer) {
|
||||||
|
binary.Write(w, binary.LittleEndian, uint32(0xA1B2C3D4)) // pcap magic number
|
||||||
|
binary.Write(w, binary.LittleEndian, uint16(2)) // version major
|
||||||
|
binary.Write(w, binary.LittleEndian, uint16(4)) // version minor
|
||||||
|
binary.Write(w, binary.LittleEndian, uint32(0)) // this zone
|
||||||
|
binary.Write(w, binary.LittleEndian, uint32(0)) // zone significant figures
|
||||||
|
binary.Write(w, binary.LittleEndian, uint32(65535)) // max packet len
|
||||||
|
binary.Write(w, binary.LittleEndian, uint32(147)) // link-layer ID - USER0
|
||||||
|
}
|
||||||
|
|
||||||
|
func writePktHeader(w *bytes.Buffer, when time.Time, length int) {
|
||||||
|
s := when.Unix()
|
||||||
|
us := when.UnixMicro() - (s * 1000000)
|
||||||
|
|
||||||
|
binary.Write(w, binary.LittleEndian, uint32(s)) // timestamp in seconds
|
||||||
|
binary.Write(w, binary.LittleEndian, uint32(us)) // timestamp microseconds
|
||||||
|
binary.Write(w, binary.LittleEndian, uint32(length)) // length present
|
||||||
|
binary.Write(w, binary.LittleEndian, uint32(length)) // total length
|
||||||
|
}
|
||||||
|
|
||||||
|
// Path describes where in the data path the packet was captured.
|
||||||
|
type Path uint8
|
||||||
|
|
||||||
|
// Valid Path values.
|
||||||
|
const (
|
||||||
|
// FromLocal indicates the packet was logged as it traversed the FromLocal path:
|
||||||
|
// i.e.: A packet from the local system into the TUN.
|
||||||
|
FromLocal Path = 0
|
||||||
|
// FromPeer indicates the packet was logged upon reception from a remote peer.
|
||||||
|
FromPeer Path = 1
|
||||||
|
// SynthesizedToLocal indicates the packet was generated from within tailscaled,
|
||||||
|
// and is being routed to the local machine's network stack.
|
||||||
|
SynthesizedToLocal Path = 2
|
||||||
|
// SynthesizedToPeer indicates the packet was generated from within tailscaled,
|
||||||
|
// and is being routed to a remote Wireguard peer.
|
||||||
|
SynthesizedToPeer Path = 3
|
||||||
|
)
|
||||||
|
|
||||||
|
// New creates a new capture sink.
|
||||||
|
func New() *Sink {
|
||||||
|
ctx, c := context.WithCancel(context.Background())
|
||||||
|
return &Sink{
|
||||||
|
ctx: ctx,
|
||||||
|
ctxCancel: c,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Type Sink handles callbacks with packets to be logged,
|
||||||
|
// formatting them into a pcap stream which is mirrored to
|
||||||
|
// all registered outputs.
|
||||||
|
type Sink struct {
|
||||||
|
ctx context.Context
|
||||||
|
ctxCancel context.CancelFunc
|
||||||
|
|
||||||
|
mu sync.Mutex
|
||||||
|
outputs set.HandleSet[io.Writer]
|
||||||
|
flushTimer *time.Timer // or nil if none running
|
||||||
|
}
|
||||||
|
|
||||||
|
// RegisterOutput connects an output to this sink, which
|
||||||
|
// will be written to with a pcap stream as packets are logged.
|
||||||
|
// A function is returned which unregisters the output when
|
||||||
|
// called.
|
||||||
|
//
|
||||||
|
// If w implements io.Closer, it will be closed upon error
|
||||||
|
// or when the sink is closed. If w implements http.Flusher,
|
||||||
|
// it will be flushed periodically.
|
||||||
|
func (s *Sink) RegisterOutput(w io.Writer) (unregister func()) {
|
||||||
|
select {
|
||||||
|
case <-s.ctx.Done():
|
||||||
|
return func() {}
|
||||||
|
default:
|
||||||
|
}
|
||||||
|
|
||||||
|
writePcapHeader(w)
|
||||||
|
s.mu.Lock()
|
||||||
|
hnd := s.outputs.Add(w)
|
||||||
|
s.mu.Unlock()
|
||||||
|
|
||||||
|
return func() {
|
||||||
|
s.mu.Lock()
|
||||||
|
defer s.mu.Unlock()
|
||||||
|
delete(s.outputs, hnd)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// NumOutputs returns the number of outputs registered with the sink.
|
||||||
|
func (s *Sink) NumOutputs() int {
|
||||||
|
s.mu.Lock()
|
||||||
|
defer s.mu.Unlock()
|
||||||
|
return len(s.outputs)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Close shuts down the sink. Future calls to LogPacket
|
||||||
|
// are ignored, and any registered output that implements
|
||||||
|
// io.Closer is closed.
|
||||||
|
func (s *Sink) Close() error {
|
||||||
|
s.ctxCancel()
|
||||||
|
s.mu.Lock()
|
||||||
|
defer s.mu.Unlock()
|
||||||
|
if s.flushTimer != nil {
|
||||||
|
s.flushTimer.Stop()
|
||||||
|
s.flushTimer = nil
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, o := range s.outputs {
|
||||||
|
if o, ok := o.(io.Closer); ok {
|
||||||
|
o.Close()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
s.outputs = nil
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// WaitCh returns a channel which blocks untill
|
||||||
|
// the sink is closed.
|
||||||
|
func (s *Sink) WaitCh() <-chan struct{} {
|
||||||
|
return s.ctx.Done()
|
||||||
|
}
|
||||||
|
|
||||||
|
// LogPacket is called to insert a packet into the capture.
|
||||||
|
//
|
||||||
|
// This function does not take ownership of the provided data slice.
|
||||||
|
func (s *Sink) LogPacket(path Path, when time.Time, data []byte) {
|
||||||
|
select {
|
||||||
|
case <-s.ctx.Done():
|
||||||
|
return
|
||||||
|
default:
|
||||||
|
}
|
||||||
|
|
||||||
|
b := bufferPool.Get().(*bytes.Buffer)
|
||||||
|
b.Reset()
|
||||||
|
b.Grow(16 + 2 + len(data)) // 16b pcap header + 2b custom data + len
|
||||||
|
defer bufferPool.Put(b)
|
||||||
|
|
||||||
|
writePktHeader(b, when, len(data)+2)
|
||||||
|
// Custom tailscale debugging data
|
||||||
|
binary.Write(b, binary.LittleEndian, uint16(path))
|
||||||
|
b.Write(data)
|
||||||
|
|
||||||
|
s.mu.Lock()
|
||||||
|
defer s.mu.Unlock()
|
||||||
|
|
||||||
|
var hadError []set.Handle
|
||||||
|
for hnd, o := range s.outputs {
|
||||||
|
if _, err := o.Write(b.Bytes()); err != nil {
|
||||||
|
hadError = append(hadError, hnd)
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for _, hnd := range hadError {
|
||||||
|
if o, ok := s.outputs[hnd].(io.Closer); ok {
|
||||||
|
o.Close()
|
||||||
|
}
|
||||||
|
delete(s.outputs, hnd)
|
||||||
|
}
|
||||||
|
|
||||||
|
if s.flushTimer == nil {
|
||||||
|
s.flushTimer = time.AfterFunc(flushPeriod, func() {
|
||||||
|
s.mu.Lock()
|
||||||
|
defer s.mu.Unlock()
|
||||||
|
for _, o := range s.outputs {
|
||||||
|
if f, ok := o.(http.Flusher); ok {
|
||||||
|
f.Flush()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
s.flushTimer = nil
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,27 @@
|
|||||||
|
tsdebug_ll = Proto("tsdebug", "Tailscale debug")
|
||||||
|
PATH = ProtoField.string("tsdebug.PATH","PATH", base.ASCII)
|
||||||
|
tsdebug_ll.fields = {PATH}
|
||||||
|
|
||||||
|
function tsdebug_ll.dissector(buffer, pinfo, tree)
|
||||||
|
pinfo.cols.protocol = tsdebug_ll.name
|
||||||
|
packet_length = buffer:len()
|
||||||
|
local offset = 0
|
||||||
|
local subtree = tree:add(tsdebug_ll, buffer(), "Tailscale packet")
|
||||||
|
|
||||||
|
-- -- Get path UINT16
|
||||||
|
local path_id = buffer:range(offset, 2):le_uint()
|
||||||
|
if path_id == 0 then subtree:add(PATH, "FromLocal")
|
||||||
|
elseif path_id == 1 then subtree:add(PATH, "FromPeer")
|
||||||
|
elseif path_id == 2 then subtree:add(PATH, "Synthesized (Inbound / ToLocal)")
|
||||||
|
elseif path_id == 3 then subtree:add(PATH, "Synthesized (Outbound / ToPeer)")
|
||||||
|
end
|
||||||
|
offset = offset + 2
|
||||||
|
|
||||||
|
-- -- Handover rest of data to ip dissector
|
||||||
|
local data_buffer = buffer:range(offset, packet_length-offset):tvb()
|
||||||
|
Dissector.get("ip"):call(data_buffer, pinfo, tree)
|
||||||
|
end
|
||||||
|
|
||||||
|
-- Install the dissector on link-layer ID 147 (User-defined protocol 0)
|
||||||
|
local eth_table = DissectorTable.get("wtap_encap")
|
||||||
|
eth_table:add(wtap.USER0, tsdebug_ll)
|
||||||
Loading…
Reference in New Issue