14 Commits (cb01058a53f4bec9642b04e5c549eaf5783d14de)

Author	SHA1	Message	Date
David Anderson	d60917c0f1	wgengine/router: switch packet marks to avoid conflict with Weave Net. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	24009241bf	net/netns: move SOCKS dialing to netns for now ... This lets control & logs also use SOCKS dials. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a5d6c9d616	net/netns: optimize defaultRouteInterface a bit ... It'll be called a bunch, so worth a bit of effort. Could go further, but not yet. (really, should hook into wgengine/monitor and only re-read on netlink changes?) name old time/op new time/op delta DefaultRouteInterface-8 60.8µs ±11% 44.6µs ± 5% -26.65% (p=0.000 n=20+19) name old alloc/op new alloc/op delta DefaultRouteInterface-8 3.29kB ± 0% 0.55kB ± 0% -83.21% (p=0.000 n=20+20) name old allocs/op new allocs/op delta DefaultRouteInterface-8 9.00 ± 0% 6.00 ± 0% -33.33% (p=0.000 n=20+20)	5 years ago
Brad Fitzpatrick	becce82246	net/netns, misc tests: remove TestOnlySkipPrivilegedOps, argv checks ... The netns UID check is sufficient for now. We can do something else later if/when needed.	5 years ago
Brad Fitzpatrick	7a410f9236	net/netns: unindent, refactor to remove some redunant code ... Also: * always error on Control failing. That's very unexpected. * pull out sockopt funcs into their own funcs for easier future testing	5 years ago
Brad Fitzpatrick	45b139d338	net/netns: remove redundant build tag ... Filename is sufficient.	5 years ago
Brad Fitzpatrick	dcd7a118d3	net/netns: add a test that tailscaleBypassMark stays in sync between packages	5 years ago
Brad Fitzpatrick	1e837b8e81	net/netns: refactor the sync.Once usage a bit	5 years ago
Avery Pennarun	e7ae6a2e06	net/netns, wgengine/router: support Linux machines that don't have 'ip rule'. ... We'll use SO_BINDTODEVICE instead of fancy policy routing. This has some limitations: for example, we will route all traffic through the interface that has the main "default" (0.0.0.0/0) route, so machines that have multiple physical interfaces might have to go through DERP to get to some peers. But machines with multiple physical interfaces are very likely to have policy routing (ip rule) support anyway. So far, the only OS I know of that needs this feature is ChromeOS (crostini). Fixes #245. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Brad Fitzpatrick	765695eaa2	net/netns: also don't err on tailscaled -fake as a regular user ... That's one of my dev workflows.	5 years ago
Brad Fitzpatrick	1407540b52	net/netns: don't return an error if we're not root and running the tailscale binary ... tailscale netcheck was broken otherwise. We can fix this a better way later; I'm just fixing a regression in some way because I'm trying to work on netcheck at the moment.	5 years ago
David Anderson	5114df415e	net/netns: set the bypass socket mark on linux. ... This allows tailscaled's own traffic to bypass Tailscale-managed routes, so that things like tailscale-provided default routes don't break tailscaled itself. Progress on #144. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	e9f7d01b91	derp/derphttp: make DERP client use netns for dial-outs.	5 years ago
Brad Fitzpatrick	9e3ad4f79f	net/netns: add package for start of network namespace support ... And plumb in netcheck STUN packets. TODO: derphttp, logs, control. Updates #144 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago