You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

James Tucker 8d1249550a net/netcheck,wgengine/magicsock: add potential workaround for Palo Alto DIPP misbehavior ... Palo Alto firewalls have a typically hard NAT, but also have a mode called Persistent DIPP that is supposed to provide consistent port mapping suitable for STUN resolution of public ports. Persistent DIPP works initially on most Palo Alto firewalls, but some models/software versions have a bug which this works around. The bug symptom presents as follows: - STUN sessions resolve a consistent public IP:port to start with - Much later netchecks report the same IP:Port for a subset of sessions, most often the users active DERP, and/or the port related to sustained traffic. - The broader set of DERPs in a full netcheck will now consistently observe a new IP:Port. - After this point of observation, new inbound connections will only succeed to the new IP:Port observed, and existing/old sessions will only work to the old binding. In this patch we now advertise the lowest latency global endpoint discovered as we always have, but in addition any global endpoints that are observed more than once in a single netcheck report. This should provide viable endpoints for potential connection establishment across a NAT with this behavior. Updates tailscale/corp#19106 Signed-off-by: James Tucker <james@tailscale.com>		1 month ago
..
bench	ipn/ipnlocal, all: plumb health trackers in tests	2 months ago
capture	various: add golangci-lint, fix issues (#7905)	1 year ago
filter	all: use Go 1.22 range-over-int	2 months ago
magicsock	net/netcheck,wgengine/magicsock: add potential workaround for Palo Alto DIPP misbehavior	1 month ago
netlog	wgengine: add exit destination logging enable for wgengine logger (#11952)	2 months ago
netstack	xcode: allow ICMP ping relay on macOS + iOS platforms (#12048)	1 month ago
router	wgengine/router: print Docker warning when stateful filtering is enabled	2 months ago
wgcfg	tailcfg,all: add/plumb Node.IsJailed	2 months ago
wgint	wgengine{,/wgint}: add wgint.Peer wrapper type, add to wgengine.Engine	4 months ago
wglog	all: use Go 1.22 range-over-int	2 months ago
winnet	all: update copyright and license headers	1 year ago
mem_ios.go	all: update copyright and license headers	1 year ago
pendopen.go	wgengine: make pendOpen time later, after dup check	4 months ago
userspace.go	ipn/ipnlocal, all: plumb health trackers in tests	2 months ago
userspace_ext_test.go	ipn/ipnlocal, all: plumb health trackers in tests	2 months ago
userspace_test.go	ipn/ipnlocal, all: plumb health trackers in tests	2 months ago
watchdog.go	ipn/ipnlocal,net/tstun,wgengine: create and plumb jailed packet filter	2 months ago
watchdog_js.go	all: update copyright and license headers	1 year ago
watchdog_test.go	ipn/ipnlocal, all: plumb health trackers in tests	2 months ago
wgengine.go	ipn/ipnlocal,net/tstun,wgengine: create and plumb jailed packet filter	2 months ago