You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 
Go to file
James Tucker 8d6793fd70 wgengine/router,util/kmod: load & log xt_mark
Attempt to load the xt_mark kernel module when it is not present. If the
load fails, log error information.

It may be tempting to promote this failure to an error once it has been
in use for some time, so as to avoid reaching an error with the iptables
invocation, however, there are conditions under which the two stages may
disagree - this change adds more useful breadcrumbs.

Example new output from tailscaled running under my WSL2:

```
router: ensure module xt_mark: "/usr/sbin/modprobe xt_mark" failed: exit status 1; modprobe: FATAL: Module xt_mark not found in directory /lib/modules/5.10.43.3-microsoft-standard-WSL2
```

Background:

There are two places to lookup modules, one is `/proc/modules` "old",
the other is `/sys/module/` "new".

There was query_modules(2) in linux <2.6, alas, it is gone.

In a docker container in the default configuration, you would get
/proc/modules and /sys/module/ both populated. lsmod may work file,
modprobe will fail with EPERM at `finit_module()` for an unpriviliged
container.

In a priviliged container the load may *succeed*, if some conditions are
met. This condition should be avoided, but the code landing in this
change does not attempt to avoid this scenario as it is both difficult
to detect, and has a very uncertain impact.

In an nspawn container `/proc/modules` is populated, but `/sys/module`
does not exist. Modern `lsmod` versions will fail to gather most module
information, without sysfs being populated with module information.

In WSL2 modules are likely missing, as the in-use kernel typically is
not provided by the distribution filesystem, and WSL does not mount in a
module filesystem of its own. Notably the WSL2 kernel supports iptables
marks without listing the xt_mark module in /sys/module, and
/proc/modules is empty.

On a recent kernel, we can ask the capabilities system about SYS_MODULE,
that will help to disambiguate between the non-privileged container case
and just being root. On older kernels these calls may fail.

Update #4329

Signed-off-by: James Tucker <james@tailscale.com>
3 years ago
.bencher bencher: add config to suppress failures on benchmark regressions. 3 years ago
.github Revert ".github/workflows: work around golang/go#51629" 3 years ago
atomicfile atomicfile: don't Chmod on windows 4 years ago
chirp all: use any instead of interface{} 3 years ago
client/tailscale cmd/tailscale, etc: make "tailscale up --ssh" fail fast when unavailable 3 years ago
cmd wgengine/router,util/kmod: load & log xt_mark 3 years ago
control tailcfg, logtail: provide Debug bit to disable logtail 3 years ago
derp derp/derphttp,net/netcheck: improve netcheck behavior under MITM proxies 3 years ago
disco types/key: export constants for key size, not a method. 3 years ago
docs fix minor typo 3 years ago
envknob ipn/ipnlocal: reject tailscale up --ssh if disabled on tailnet 3 years ago
health net/dns: add health check for particular broken-ish Linux DNS config 3 years ago
hostinfo hostinfo, tailcfg: add desktop detection on Linux to hostinfo 3 years ago
internal/tooldeps util/deephash: move internal/deephash to util/deephash 3 years ago
ipn ipn/ipnlocal: close peerapi listeners on LocalBackend.Shutdown 3 years ago
kube all: use any instead of interface{} 3 years ago
log all: use any instead of interface{} 3 years ago
logpolicy all: use any instead of interface{} 3 years ago
logtail tailcfg, logtail: provide Debug bit to disable logtail 3 years ago
metrics all: use testingutil.MinAllocsPerRun 3 years ago
net cmd/tailscale: add "debug via" subcommand to do CIDR math for via ranges 3 years ago
packages/deb all: use any instead of interface{} 3 years ago
paths cmd/tailscaled: default to userspace-networking mode on gokrazy, set paths 3 years ago
portlist envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) 3 years ago
prober prober: used keyed initializer for LimitedReader. 3 years ago
safesocket safesocket: add ConnectionStrategy, provide control over fallbacks 3 years ago
scripts scripts/install: add Alma Linux. 3 years ago
smallzstd smallzstd: new package that constructs zstd small encoders/decoders. 4 years ago
ssh/tailssh ssh/tailssh: fix double SSH-2.0- prefix in greeting banner 3 years ago
syncs syncs: use TryLock and TryRLock instead of unsafe 3 years ago
tailcfg tailcfg: document SSHPrincipal.PubKeys URL expansions 3 years ago
tempfork ssh/tailssh: send banner messages during auth, move more to conn 3 years ago
tool tool/go: add wrapper to download and use go.toolchain.rev go version. 3 years ago
tsconst net/interfaces/windows: update Tailscale interface detection logic to 3 years ago
tsnet tsnet: set Hostinfo.Package to "tsnet" on use 3 years ago
tstest tstest/iosdeps: add test for forbidden iOS dependencies 3 years ago
tstime tstime/mono: fix Before function comment 3 years ago
tsweb tsweb: add PrometheusVar, for vars that want to output varz themselves. 3 years ago
types net/dns: schedule DoH upgrade explicitly, fix Resolver.Addr confusion 3 years ago
util wgengine/router,util/kmod: load & log xt_mark 3 years ago
version version: use Go 1.18's git stamping as default implementation 3 years ago
wf all: use any instead of interface{} 3 years ago
wgengine wgengine/router,util/kmod: load & log xt_mark 3 years ago
words words: more hamsters, less hampsters (#3938) 3 years ago
.gitattributes .: add .gitattributes entry to use Go hunk-header driver 3 years ago
.gitignore Makefile: update make spk target to use the new go spk builder 3 years ago
AUTHORS Move Linux client & common packages into a public repo. 5 years ago
CODE_OF_CONDUCT.md Add a code of conduct. 5 years ago
Dockerfile Dockerfile: require Go 1.18 3 years ago
Dockerfile.base Dockerfile.base: update to alpine:3.15 3 years ago
LICENSE LICENSE: Reformat for Github 4 years ago
Makefile Makefile: add tidy target 3 years ago
PATENTS Move Linux client & common packages into a public repo. 5 years ago
README.md README.md: update current Go release 3 years ago
SECURITY.md Add a SECURITY.md for vulnerability reports. 5 years ago
VERSION.txt VERSION.txt: This is 1.23. 3 years ago
api.md api: update acl/validate data format (#4366) 3 years ago
build_dist.sh tool/go: add wrapper to download and use go.toolchain.rev go version. 3 years ago
build_docker.sh tool/go: add wrapper to download and use go.toolchain.rev go version. 3 years ago
go.mod wgengine/router,util/kmod: load & log xt_mark 3 years ago
go.sum wgengine/router,util/kmod: load & log xt_mark 3 years ago
go.toolchain.branch go.toolchain.branch: upgrade to Go 1.18 3 years ago
go.toolchain.rev go.toolchain.rev: update to go1.18.1 (#4438) 3 years ago
pull-toolchain.sh go.toolchain.rev: add update script 3 years ago
shell.nix shell.nix: use tailscale-go for compilation 3 years ago
staticcheck.conf staticcheck.conf: remove unnecessary warning 4 years ago
version-embed.go go.toolchain.rev: add Go toolchain rev, tool to print it out 3 years ago

README.md

Tailscale

https://tailscale.com

Private WireGuard® networks made easy

Overview

This repository contains all the open source Tailscale client code and the tailscaled daemon and tailscale CLI tool. The tailscaled daemon runs on Linux, Windows and macOS, and to varying degrees on FreeBSD, OpenBSD, and Darwin. (The Tailscale iOS and Android apps use this repo's code, but this repo doesn't contain the mobile GUI code.)

The Android app is at https://github.com/tailscale/tailscale-android

The Synology package is at https://github.com/tailscale/tailscale-synology

Using

We serve packages for a variety of distros at https://pkgs.tailscale.com .

Other clients

The macOS, iOS, and Windows clients use the code in this repository but additionally include small GUI wrappers that are not open source.

Building

go install tailscale.com/cmd/tailscale{,d}

If you're packaging Tailscale for distribution, use build_dist.sh instead, to burn commit IDs and version info into the binaries:

./build_dist.sh tailscale.com/cmd/tailscale
./build_dist.sh tailscale.com/cmd/tailscaled

If your distro has conventions that preclude the use of build_dist.sh, please do the equivalent of what it does in your distro's way, so that bug reports contain useful version information.

We only guarantee to support the latest Go release and any Go beta or release candidate builds (currently Go 1.18) in module mode. It might work in earlier Go versions or in GOPATH mode, but we're making no effort to keep those working.

Bugs

Please file any issues about this code or the hosted service on the issue tracker.

Contributing

PRs welcome! But please file bugs. Commit messages should reference bugs.

We require Developer Certificate of Origin Signed-off-by lines in commits.

About Us

Tailscale is primarily developed by the people at https://github.com/orgs/tailscale/people. For other contributors, see:

WireGuard is a registered trademark of Jason A. Donenfeld.