5 Commits (8c2fcef453eeaec16203c6cfe724c1d686a509ef)

Author	SHA1	Message	Date
Brad Fitzpatrick	7a5263e6d0	util/linuxfw: rename ErrorFWModeNotSupported ... Go style is for error variables to start with "err" (or "Err") and for error types to end in "Error". Updates #cleanup Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
KevinLiang10	ae63c51ff1	wgengine/router: add auto selection heuristic for iptables/nftables ... This commit replaces the TS_DEBUG_USE_NETLINK_NFTABLES envknob with a TS_DEBUG_FIREWALL_MODE that should be set to either 'iptables' or 'nftables' to select firewall mode manually, other wise tailscaled will automatically choose between iptables and nftables depending on environment and system availability. updates: #319 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	11 months ago
KevinLiang10	a3c7b21cd1	util/linuxfw: add nftables support ... This commit adds nftable rule injection for tailscaled. If tailscaled is started with envknob TS_DEBUG_USE_NETLINK_NFTABLES = true, the router will use nftables to manage firewall rules. Updates: #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	12 months ago
KevinLiang10	243ce6ccc1	util/linuxfw: decoupling IPTables logic from linux router ... This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	1 year ago
Andrew Dunham	ba48ec5e39	util/linuxfw: initial implementation of package ... This package is an initial implementation of something that can read netfilter and iptables rules from the Linux kernel without needing to shell out to an external utility; it speaks directly to the kernel using syscalls and parses the data returned. Currently this is read-only since it only knows how to parse a subset of the available data. Signed-off-by: Andrew Dunham <andrew@tailscale.com> Change-Id: Iccadf5dcc081b73268d8ccf8884c24eb6a6f1ff5	1 year ago