You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

James Tucker 8d1249550a net/netcheck,wgengine/magicsock: add potential workaround for Palo Alto DIPP misbehavior ... Palo Alto firewalls have a typically hard NAT, but also have a mode called Persistent DIPP that is supposed to provide consistent port mapping suitable for STUN resolution of public ports. Persistent DIPP works initially on most Palo Alto firewalls, but some models/software versions have a bug which this works around. The bug symptom presents as follows: - STUN sessions resolve a consistent public IP:port to start with - Much later netchecks report the same IP:Port for a subset of sessions, most often the users active DERP, and/or the port related to sustained traffic. - The broader set of DERPs in a full netcheck will now consistently observe a new IP:Port. - After this point of observation, new inbound connections will only succeed to the new IP:Port observed, and existing/old sessions will only work to the old binding. In this patch we now advertise the lowest latency global endpoint discovered as we always have, but in addition any global endpoints that are observed more than once in a single netcheck report. This should provide viable endpoints for potential connection establishment across a NAT with this behavior. Updates tailscale/corp#19106 Signed-off-by: James Tucker <james@tailscale.com>		2 weeks ago
..
art	all: use Go 1.22 range-over-int	2 months ago
connstats	all: use Go 1.22 range-over-int	2 months ago
dns	Net/DNS/Publicdns: update the IPv6 range that we use to recreate route endpoint for control D	2 weeks ago
dnscache	net/netns, net/dns/resolver, etc: make netmon required in most places	1 month ago
dnsfallback	tsd, ipnlocal, etc: add tsd.System.HealthTracker, start some plumbing	1 month ago
flowtrack	all: update copyright and license headers	1 year ago
ktimeout	net/ktimeout: add a package to set TCP user timeout	3 months ago
memnet	net/memnet: export the network name (#9111)	9 months ago
netaddr	all: update copyright and license headers	1 year ago
netcheck	net/netcheck,wgengine/magicsock: add potential workaround for Palo Alto DIPP misbehavior	2 weeks ago
neterror	net/neterror, wgengine/magicsock: use UDP GSO and GRO on Linux (#7791)	1 year ago
netkernelconf	client/tailscale,ipn/{ipnlocal,localapi}: check UDP GRO config (#10071)	7 months ago
netknob	all: update copyright and license headers	1 year ago
netmon	net/netmon: remove spammy log statements (#11953)	1 month ago
netns	net/{interfaces,netmon}, all: merge net/interfaces package into net/netmon	1 month ago
netstat	net/{netns,netstat}: use new x/sys/cpu.IsBigEndian	1 year ago
netutil	net/netmon, add: add netmon.State type alias of interfaces.State	1 month ago
packet	all: use Go 1.22 range-over-int	2 months ago
ping	net/ping: fix ICMP echo code field to 0	9 months ago
portmapper	net/portmapper: add envknob to disable portmapper in localhost integration tests	4 weeks ago
proxymux	all: cleanup unused code, part 1 (#10661)	5 months ago
routetable	net/{interfaces,netmon}, all: merge net/interfaces package into net/netmon	1 month ago
socks5	net/socks5: add password auth support	1 year ago
sockstats	net/{interfaces,netmon}, all: merge net/interfaces package into net/netmon	1 month ago
speedtest	all: update copyright and license headers	1 year ago
stun	all: make more tests pass/skip in airplane mode	4 weeks ago
stunserver	all: use Go 1.22 range-over-int	2 months ago
tcpinfo	all: use Go 1.22 range-over-int	2 months ago
tlsdial	tsd, ipnlocal, etc: add tsd.System.HealthTracker, start some plumbing	1 month ago
tsaddr	types/views: remove duplicate SliceContainsFunc	4 weeks ago
tsdial	ipn/ipnlocal, net/tsdial: plumb routes into tsdial and use them in UserDial	4 weeks ago
tshttpproxy	all: use Go 1.22 range-over-int	2 months ago
tstun	net/tstun: do SNAT after filterPacketOutboundToWireGuard	2 weeks ago
wsconn	net/wsconn: accept a remote addr string and plumb it through	9 months ago