You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Andrew Dunham c5abbcd4b4 wgengine/netstack: add a per-client limit for in-flight TCP forwards ... This is a fun one. Right now, when a client is connecting through a subnet router, here's roughly what happens: 1. The client initiates a connection to an IP address behind a subnet router, and sends a TCP SYN 2. The subnet router gets the SYN packet from netstack, and after running through acceptTCP, starts DialContext-ing the destination IP, without accepting the connection¹ 3. The client retransmits the SYN packet a few times while the dial is in progress, until either... 4. The subnet router successfully establishes a connection to the destination IP and sends the SYN-ACK back to the client, or... 5. The subnet router times out and sends a RST to the client. 6. If the connection was successful, the client ACKs the SYN-ACK it received, and traffic starts flowing As a result, the notification code in forwardTCP never notices when a new connection attempt is aborted, and it will wait until either the connection is established, or until the OS-level connection timeout is reached and it aborts. To mitigate this, add a per-client limit on how many in-flight TCP forwarding connections can be in-progress; after this, clients will see a similar behaviour to the global limit, where new connection attempts are aborted instead of waiting. This prevents a single misbehaving client from blocking all other clients of a subnet router by ensuring that it doesn't starve the global limiter. Also, bump the global limit again to a higher value. ¹ We can't accept the connection before establishing a connection to the remote server since otherwise we'd be opening the connection and then immediately closing it, which breaks a bunch of stuff; see #5503 for more details. Updates tailscale/corp#12184 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I76e7008ddd497303d75d473f534e32309c8a5144		3 months ago
..
bench	tailcfg, all: use []netip.AddrPort instead of []string for Endpoints	8 months ago
capture	various: add golangci-lint, fix issues (#7905)	1 year ago
filter	wgengine/filter: add protocol-agnostic packet checker (#10446)	6 months ago
magicsock	all: remove LenIter, use Go 1.22 range-over-int instead	3 months ago
netlog	wgengine/netlog: fix nil pointer dereference in logtail (#8598)	11 months ago
netstack	wgengine/netstack: add a per-client limit for in-flight TCP forwards	3 months ago
router	wgengine/router: fix ip rule restoration	4 months ago
wgcfg	all: remove LenIter, use Go 1.22 range-over-int instead	3 months ago
wgint	ipn/ipnstate, wgengine/wgint: add handshake attempts accessors	3 months ago
wglog	wgengine/wglog: add TS_DEBUG_RAW_WGLOG envknob for raw wg logs	4 months ago
winnet	all: update copyright and license headers	1 year ago
mem_ios.go	all: update copyright and license headers	1 year ago
pendopen.go	wgengine: make pendOpen time later, after dup check	3 months ago
userspace.go	ipn/ipnstate, wgengine/wgint: add handshake attempts accessors	3 months ago
userspace_ext_test.go	tsd: add package with System type to unify subsystem init, discovery	1 year ago
userspace_test.go	control,tailcfg,wgengine/magicsock: add nodeAttr to enable/disable peer MTU	9 months ago
watchdog.go	cmd/tailscaled, ipn/ipnlocal, wgengine: shutdown tailscaled if wgdevice is closed	3 months ago
watchdog_js.go	all: update copyright and license headers	1 year ago
watchdog_test.go	all: update copyright and license headers	1 year ago
wgengine.go	cmd/tailscaled, ipn/ipnlocal, wgengine: shutdown tailscaled if wgdevice is closed	3 months ago