You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Oliver Ford 0452b1d520 util/linuxfw: fix only implicitly accepted forward pkts ... This rule appears intended to `ACCEPT` the packets `MARK`ed in the rule immediately prior; for that to work though the `MARK` rule would need to be in the `mangle` table, as it's here in the `filter` table it doesn't match, the chain continues, and the packets happen to be accepted once they fall-through and hit (rely on) the `FORWARD` table's default `ACCEPT` policy. This commit changes the `ACCEPT` rule to explicitly match the same as `MARK`ed above, so as not to rely on this implicit behaviour (and have a misleading no-op rule). Note also - I have not found it documented - that for devices behind the subnet router to be able to reach the tailnet (as opposed to vice versa), there will need to be an additional rule added by the user, such as: -t mangle -A FORWARD -s 192.168.88.0/24 -i veth-tailscale -o tailscale0 -j MARK --set-xmark 0x40000/0xff0000 where `192.168.88.0/24` is the subnet behind the subnet router (that should be able to access the tailnet; not necessarily equivalent to the advertised routes) and `veth-tailscale` is the LAN interface - or else to ensure that these packets are equivalently accepted and masqueraded as if marked. A better fix (it would preserve the ability to handle LAN-initiated routing with a single `MARK` rule as above) might be to instead move the `MARK` rule to a (new) `ts-forward` chain in the `mangle` table, so that it can be matched here with the existing rule. Signed-off-by: Oliver Ford <dev@ojford.com>		1 week ago
..
backoff	control/controlclient: remove unused reference to mapCtx (#17614)	2 months ago
checkchange	net/dns, ipn/ipnlocal: fix regressions from change moving away from deephash	3 months ago
cibuild	all: update copyright and license headers	3 years ago
clientmetric	client/local: add method to set gauge metric to a value	4 weeks ago
cloudenv	feature/featuretags, all: add build features, use existing ones in more places	3 months ago
cmpver	util/cmpver: add Less/LessEq helper funcs	2 years ago
codegen	cmd/viewer, types/views: implement support for json/v2 (#16852)	5 months ago
cstruct	all: use Go 1.21's binary.NativeEndian	1 year ago
ctxkey	all: use reflect.TypeFor now available in Go 1.22 (#11078)	2 years ago
deephash	wgengine/wgcfg: remove two unused Config fields	2 months ago
dirwalk	all: use tstest.Replace more	3 years ago
dnsname	util/dnsname: fix test error message	2 months ago
eventbus	util/eventbus: use unbounded event queues for DeliveredEvents in subscribers	2 months ago
execqueue	util/execqueue: don't hold mutex in RunSync	2 months ago
expvarx	syncs: add Mutex/RWMutex alias/wrappers for future mutex debugging	2 months ago
goroutines	syncs: add Mutex/RWMutex alias/wrappers for future mutex debugging	2 months ago
groupmember	util/groupmember: fail earlier if group doesn't exist, use slices.Contains	2 years ago
hashx	all: use Go 1.22 range-over-int	2 years ago
httphdr	util/httphdr: add new package for parsing HTTP headers (#9797)	2 years ago
httpm	util/httpm: don't run test if .git doesn't exist	2 years ago
limiter	all: rename variables with lowercase-l/uppercase-I	2 months ago
lineiter	types/result, util/lineiter: add package for a result type, use it	1 year ago
lineread	all: update copyright and license headers	3 years ago
linuxfw	util/linuxfw: fix only implicitly accepted forward pkts	1 week ago
lru	all: rename variables with lowercase-l/uppercase-I	2 months ago
mak	util/mak: delete long-deprecated, unused, pre-generics NonNil func	9 months ago
multierr	all: use Go 1.22 range-over-int	2 years ago
must	util/must: add Get2 for functions that return two values	7 months ago
nocasemaps	all: use Go 1.22 range-over-int	2 years ago
osdiag	go.mod: bump golang.org/x/crypto (#17907)	2 months ago
osshare	clientupdate, util/osshare, util/winutil, version: improve Windows GUI filename resolution and WinUI build awareness	3 months ago
osuser	ssh/tailssh: add Plan 9 support for Tailscale SSH	9 months ago
pidowner	types/result, util/lineiter: add package for a result type, use it	1 year ago
pool	util/pool: add package for storing and using a pool of items	2 years ago
precompress	all: update copyright and license headers	3 years ago
progresstracking	ipn/localapi: add support for multipart POST to file-put	2 years ago
prompt	util/prompt: add a default and take default in non-interactive cases	3 months ago
quarantine	all: update copyright and license headers	3 years ago
race	all: use Go 1.22 range-over-int	2 years ago
racebuild	all: update copyright and license headers	3 years ago
rands	wgengine/magicsock: use math/rands/v2	2 years ago
reload	all: use math/rand/v2 more	2 years ago
ringlog	syncs: add Mutex/RWMutex alias/wrappers for future mutex debugging	2 months ago
safediff	cmd/jsonimports: add static analyzer for consistent "json" imports (#17669)	3 months ago
set	control/controlclient: restore aggressive Direct.Close teardown	3 months ago
singleflight	util/singleflight: add DoChanContext	2 years ago
slicesx	util/slicesx: add AppendNonzero	12 months ago
stringsx	util/stringsx: add package for extra string functions, like CompareFold	1 year ago
syspolicy	all: rename variables with lowercase-l/uppercase-I	2 months ago
sysresources	util/sysresources, magicsock: scale DERP buffer based on system memory	3 years ago
testenv	nettest, *: add option to run HTTP tests with in-memory network	9 months ago
topk	all: use Go 1.22 range-over-int	2 years ago
truncate	util/truncate: support []byte as well (#11614)	2 years ago
usermetric	feature/featuretags: make usermetrics modular	3 months ago
vizerror	util/vizerror: add WrapWithMessage	1 year ago
winutil	all: rename variables with lowercase-l/uppercase-I	2 months ago
zstdframe	all: use Go 1.22 range-over-int	2 years ago