6 Commits (b94b91c1689954542a783fa58386008fecb623bf)

Author	SHA1	Message	Date
James Tucker	539c073cf0	wgengine/magicsock: set UDP socket buffer sizes to 7MB ... - At high data rates more buffer space is required in order to avoid packet loss during any cause of delay. - On slower machines more buffer space is required in order to avoid packet loss while decryption & tun writing is underway. - On higher latency network paths more buffer space is required in order to overcome BDP. - On Linux set with SO_*BUFFORCE to bypass net.core.{r,w}mem_max. - 7MB is the current default maximum on macOS 12.6 - Windows test is omitted, as Windows does not support getsockopt for these options. Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Brad Fitzpatrick	1841d0bf98	wgengine/magicsock: make debug-level stuff not logged by default ... And add a CLI/localapi and c2n mechanism to enable it for a fixed amount of time. Updates #1548 Change-Id: I71674aaf959a9c6761ff33bbf4a417ffd42195a7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	74674b110d	envknob: support changing envknobs post-init ... Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Anderson	7c49db02a2	wgengine/magicsock: don't use BPF receive when SO_MARK doesn't work. ... Fixes #5607 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
James Tucker	672c2c8de8	wgengine/magicsock: add filter to ignore disco to old/other ports ... Incoming disco packets are now dropped unless they match one of the current bound ports, or have a zero port*. The BPF filter passes all packets with a disco header to the raw packet sockets regardless of destination port (in order to avoid needing to reconfigure BPF on rebind). If a BPF enabled node has just rebound, due to restart or rebind, it may receive and reply to disco ping packets destined for ports other than those which are presently bound. If the pong is accepted, the pinging node will now assume that it can send WireGuard traffic to the pinged port - such traffic will not reach the node as it is not destined for a bound port. *The zero port is ignored, if received. This is a speculative defense and would indicate a problem in the receive path, or the BPF filter. This condition is allowed to pass as it may enable traffic to flow, however it will also enable problems with the same symptoms this patch otherwise fixes. Fixes #5536 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Andrew Dunham	c72caa6672	wgengine/magicsock: use AF_PACKET socket + BPF to read disco messages ... This is entirely optional (i.e. failing in this code is non-fatal) and only enabled on Linux for now. Additionally, this new behaviour can be disabled by setting the TS_DEBUG_DISABLE_AF_PACKET environment variable. Updates #3824 Replaces #5474 Co-authored-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago