4 Commits (8a6bd21baf126f91bb331f37733eb7203675da30)

Author	SHA1	Message	Date
Avery Pennarun	34c30eaea0	router_linux: use only baseline 'ip rule' features that exist in old kernels. ... This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
David Anderson	9c914dc7dd	wgengine/router: stop using -m comment. ... The comment module is compiled out on several embedded systems (and also gentoo, because netfilter can't go brrrr with comments holding it back). Attempting to use comments results in a confusing error, and a non-functional firewall. Additionally, make the legacy rule cleanup non-fatal, because we *do* have to probe for the existence of these -m comment rules, and doing so will error out on these systems. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0fe262f093	ipn: plumb NetfilterMode all the way out to the CLI. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c67c8913c3	wgengine/router: add a test for linux router state transitions. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago