You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

James Tucker 8d6793fd70 wgengine/router,util/kmod: load & log xt_mark ... Attempt to load the xt_mark kernel module when it is not present. If the load fails, log error information. It may be tempting to promote this failure to an error once it has been in use for some time, so as to avoid reaching an error with the iptables invocation, however, there are conditions under which the two stages may disagree - this change adds more useful breadcrumbs. Example new output from tailscaled running under my WSL2: ``` router: ensure module xt_mark: "/usr/sbin/modprobe xt_mark" failed: exit status 1; modprobe: FATAL: Module xt_mark not found in directory /lib/modules/5.10.43.3-microsoft-standard-WSL2 ``` Background: There are two places to lookup modules, one is `/proc/modules` "old", the other is `/sys/module/` "new". There was query_modules(2) in linux <2.6, alas, it is gone. In a docker container in the default configuration, you would get /proc/modules and /sys/module/ both populated. lsmod may work file, modprobe will fail with EPERM at `finit_module()` for an unpriviliged container. In a priviliged container the load may *succeed*, if some conditions are met. This condition should be avoided, but the code landing in this change does not attempt to avoid this scenario as it is both difficult to detect, and has a very uncertain impact. In an nspawn container `/proc/modules` is populated, but `/sys/module` does not exist. Modern `lsmod` versions will fail to gather most module information, without sysfs being populated with module information. In WSL2 modules are likely missing, as the in-use kernel typically is not provided by the distribution filesystem, and WSL does not mount in a module filesystem of its own. Notably the WSL2 kernel supports iptables marks without listing the xt_mark module in /sys/module, and /proc/modules is empty. On a recent kernel, we can ask the capabilities system about SYS_MODULE, that will help to disambiguate between the non-privileged container case and just being root. On older kernels these calls may fail. Update #4329 Signed-off-by: James Tucker <james@tailscale.com>		4 years ago
..
cibuild	all: use cibuild.On	4 years ago
clientmetric	all: use any instead of interface{}	4 years ago
cmpver	util/cmpver: move into OSS from corp repo.	5 years ago
codegen	all: use any instead of interface{}	4 years ago
deephash	all: use any instead of interface{}	4 years ago
dnsname	all: use Go 1.18's strings.Cut	4 years ago
endian	all: gofmt with Go 1.17	4 years ago
groupmember	util/groupmember: remove redundant code (#4298)	4 years ago
jsonutil	all: use any instead of interface{}	4 years ago
kmod	wgengine/router,util/kmod: load & log xt_mark	4 years ago
lineread	util/lineread: add docs to Reader	5 years ago
multierr	all: use any instead of interface{}	4 years ago
netconv	util/netconv: add package to convert between netip and netaddr types	4 years ago
osshare	all: gofmt with Go 1.17	4 years ago
pidowner	all: gofmt with Go 1.17	4 years ago
racebuild	all: gofmt with Go 1.17	4 years ago
systemd	all: use any instead of interface{}	4 years ago
uniq	all: use any instead of interface{}	4 years ago
winutil	util/winutil: migrate corp's winutil into OSS.	4 years ago