You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

James Tucker 8d6793fd70 wgengine/router,util/kmod: load & log xt_mark ... Attempt to load the xt_mark kernel module when it is not present. If the load fails, log error information. It may be tempting to promote this failure to an error once it has been in use for some time, so as to avoid reaching an error with the iptables invocation, however, there are conditions under which the two stages may disagree - this change adds more useful breadcrumbs. Example new output from tailscaled running under my WSL2: ``` router: ensure module xt_mark: "/usr/sbin/modprobe xt_mark" failed: exit status 1; modprobe: FATAL: Module xt_mark not found in directory /lib/modules/5.10.43.3-microsoft-standard-WSL2 ``` Background: There are two places to lookup modules, one is `/proc/modules` "old", the other is `/sys/module/` "new". There was query_modules(2) in linux <2.6, alas, it is gone. In a docker container in the default configuration, you would get /proc/modules and /sys/module/ both populated. lsmod may work file, modprobe will fail with EPERM at `finit_module()` for an unpriviliged container. In a priviliged container the load may *succeed*, if some conditions are met. This condition should be avoided, but the code landing in this change does not attempt to avoid this scenario as it is both difficult to detect, and has a very uncertain impact. In an nspawn container `/proc/modules` is populated, but `/sys/module` does not exist. Modern `lsmod` versions will fail to gather most module information, without sysfs being populated with module information. In WSL2 modules are likely missing, as the in-use kernel typically is not provided by the distribution filesystem, and WSL does not mount in a module filesystem of its own. Notably the WSL2 kernel supports iptables marks without listing the xt_mark module in /sys/module, and /proc/modules is empty. On a recent kernel, we can ask the capabilities system about SYS_MODULE, that will help to disambiguate between the non-privileged container case and just being root. On older kernels these calls may fail. Update #4329 Signed-off-by: James Tucker <james@tailscale.com>		3 years ago
..
bench	types/netmap: use key.NodePublic instead of tailcfg.NodeKey.	3 years ago
filter	all: add arbitrary capability support	3 years ago
magicsock	all: use strings.Cut even more	3 years ago
monitor	wgengine/monitor: split the unexpected stringification log line	3 years ago
netstack	ssh/tailssh: make the SSH server a singleton, register with LocalBackend	3 years ago
router	wgengine/router,util/kmod: load & log xt_mark	3 years ago
wgcfg	all: use any instead of interface{}	3 years ago
wglog	all: use any instead of interface{}	3 years ago
winnet	all: gofmt -w -s (simplify) tests	3 years ago
mem_ios.go	go.mod: upgrade wireguard-windows, de-fork wireguard-go	4 years ago
pendopen.go	envknob: add new package for all the strconv.ParseBool(os.Getenv(..))	3 years ago
userspace.go	net/dns, net/dns/resolver, wgengine: refactor DNS request path (#4364)	3 years ago
userspace_ext_test.go	go.mod: upgrade wireguard-windows, de-fork wireguard-go	4 years ago
userspace_test.go	all: gofmt -w -s (simplify) tests	3 years ago
watchdog.go	all: use any instead of interface{}	3 years ago
watchdog_test.go	all: use any instead of interface{}	3 years ago
wgengine.go	ipn/ipnlocal: do not process old status messages received out of order	3 years ago