You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

James Tucker 672c2c8de8 wgengine/magicsock: add filter to ignore disco to old/other ports ... Incoming disco packets are now dropped unless they match one of the current bound ports, or have a zero port*. The BPF filter passes all packets with a disco header to the raw packet sockets regardless of destination port (in order to avoid needing to reconfigure BPF on rebind). If a BPF enabled node has just rebound, due to restart or rebind, it may receive and reply to disco ping packets destined for ports other than those which are presently bound. If the pong is accepted, the pinging node will now assume that it can send WireGuard traffic to the pinged port - such traffic will not reach the node as it is not destined for a bound port. *The zero port is ignored, if received. This is a speculative defense and would indicate a problem in the receive path, or the BPF filter. This condition is allowed to pass as it may enable traffic to flow, however it will also enable problems with the same symptoms this patch otherwise fixes. Fixes #5536 Signed-off-by: James Tucker <james@tailscale.com>		2 years ago
..
debughttp.go	all: convert more code to use net/netip directly	2 years ago
debugknobs.go	wasm: exclude code that's not used on iOS for Wasm too	3 years ago
debugknobs_stubs.go	wasm: exclude code that's not used on iOS for Wasm too	3 years ago
discopingpurpose_string.go	wgengine/magicsock: make discoPingPurpose a stringer	4 years ago
magicsock.go	wgengine/magicsock: add filter to ignore disco to old/other ports	2 years ago
magicsock_default.go	wgengine/magicsock: use AF_PACKET socket + BPF to read disco messages	2 years ago
magicsock_linux.go	wgengine/magicsock: add filter to ignore disco to old/other ports	2 years ago
magicsock_test.go	wgengine/magicsock: use AF_PACKET socket + BPF to read disco messages	2 years ago