You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

James Tucker 8d6793fd70 wgengine/router,util/kmod: load & log xt_mark ... Attempt to load the xt_mark kernel module when it is not present. If the load fails, log error information. It may be tempting to promote this failure to an error once it has been in use for some time, so as to avoid reaching an error with the iptables invocation, however, there are conditions under which the two stages may disagree - this change adds more useful breadcrumbs. Example new output from tailscaled running under my WSL2: ``` router: ensure module xt_mark: "/usr/sbin/modprobe xt_mark" failed: exit status 1; modprobe: FATAL: Module xt_mark not found in directory /lib/modules/5.10.43.3-microsoft-standard-WSL2 ``` Background: There are two places to lookup modules, one is `/proc/modules` "old", the other is `/sys/module/` "new". There was query_modules(2) in linux <2.6, alas, it is gone. In a docker container in the default configuration, you would get /proc/modules and /sys/module/ both populated. lsmod may work file, modprobe will fail with EPERM at `finit_module()` for an unpriviliged container. In a priviliged container the load may *succeed*, if some conditions are met. This condition should be avoided, but the code landing in this change does not attempt to avoid this scenario as it is both difficult to detect, and has a very uncertain impact. In an nspawn container `/proc/modules` is populated, but `/sys/module` does not exist. Modern `lsmod` versions will fail to gather most module information, without sysfs being populated with module information. In WSL2 modules are likely missing, as the in-use kernel typically is not provided by the distribution filesystem, and WSL does not mount in a module filesystem of its own. Notably the WSL2 kernel supports iptables marks without listing the xt_mark module in /sys/module, and /proc/modules is empty. On a recent kernel, we can ask the capabilities system about SYS_MODULE, that will help to disambiguate between the non-privileged container case and just being root. On older kernels these calls may fail. Update #4329 Signed-off-by: James Tucker <james@tailscale.com>		3 years ago
..
callback.go	net/dns: add GetBaseConfig to CallbackRouter.	3 years ago
ifconfig_windows.go	util/multierr: new package	3 years ago
ifconfig_windows_test.go	wgengine/router{win}: ignore broadcast routes added by Windows when removing routes.	4 years ago
router.go	wgengine/router: take a link monitor	3 years ago
router_darwin.go	wgengine/router: take a link monitor	3 years ago
router_default.go	all: fix some js/wasm compilation issues	3 years ago
router_fake.go	wgengine: pass in an explicit router.Router, rather than a generator.	4 years ago
router_freebsd.go	wgengine/router: take a link monitor	3 years ago
router_linux.go	wgengine/router,util/kmod: load & log xt_mark	3 years ago
router_linux_test.go	wgengine/router: demote TestDebugListRules fail to skip	3 years ago
router_openbsd.go	wgengine/router: take a link monitor	3 years ago
router_test.go	all: gofmt with Go 1.17	3 years ago
router_userspace_bsd.go	all: gofmt with Go 1.17	3 years ago
router_windows.go	all: use any instead of interface{}	3 years ago
runner.go	wgengine/router: ignore Linux ip route error adding dup route	3 years ago