You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/net/tstun
Maisem Ali 1f51bb6891 net/tstun: do SNAT after filterPacketOutboundToWireGuard
In a configuration where the local node (ip1) has a different IP (ip2)
that it uses to communicate with a peer (ip3) we would do UDP flow
tracking on the `ip2->ip3` tuple. When we receive the response from
the peer `ip3->ip2` we would dnat it back to `ip3->ip1` which would
then not match the flow track state and the packet would get dropped.

To fix this, we should do flow tracking on the `ip1->ip3` tuple instead
of `ip2->ip3` which requires doing SNAT after the running filterPacketOutboundToWireGuard.

Updates tailscale/corp#19971, tailscale/corp#8020

Signed-off-by: Maisem Ali <maisem@tailscale.com>
6 months ago
..
fake.go
ifstatus_noop.go
ifstatus_windows.go
linkattrs_linux.go
linkattrs_notlinux.go
mtu.go
mtu_test.go
tap_linux.go
tap_unsupported.go
tstun_stub.go
tun.go net/tstun: implement env var for disabling UDP GRO on Linux (#11924) 7 months ago
tun_features_linux.go net/tstun: implement env var for disabling UDP GRO on Linux (#11924) 7 months ago
tun_features_notlinux.go net/tstun: implement env var for disabling UDP GRO on Linux (#11924) 7 months ago
tun_linux.go
tun_macos.go
tun_notwindows.go
tun_windows.go
wrap.go net/tstun: do SNAT after filterPacketOutboundToWireGuard 6 months ago
wrap_test.go net/tstun: refactor peerConfig to allow storing more details 6 months ago