You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

James Tucker 8d1249550a net/netcheck,wgengine/magicsock: add potential workaround for Palo Alto DIPP misbehavior ... Palo Alto firewalls have a typically hard NAT, but also have a mode called Persistent DIPP that is supposed to provide consistent port mapping suitable for STUN resolution of public ports. Persistent DIPP works initially on most Palo Alto firewalls, but some models/software versions have a bug which this works around. The bug symptom presents as follows: - STUN sessions resolve a consistent public IP:port to start with - Much later netchecks report the same IP:Port for a subset of sessions, most often the users active DERP, and/or the port related to sustained traffic. - The broader set of DERPs in a full netcheck will now consistently observe a new IP:Port. - After this point of observation, new inbound connections will only succeed to the new IP:Port observed, and existing/old sessions will only work to the old binding. In this patch we now advertise the lowest latency global endpoint discovered as we always have, but in addition any global endpoints that are observed more than once in a single netcheck report. This should provide viable endpoints for potential connection establishment across a NAT with this behavior. Updates tailscale/corp#19106 Signed-off-by: James Tucker <james@tailscale.com>		2 years ago
..
art	all: use Go 1.22 range-over-int	2 years ago
connstats	all: use Go 1.22 range-over-int	2 years ago
dns	Net/DNS/Publicdns: update the IPv6 range that we use to recreate route endpoint for control D	2 years ago
dnscache	net/netns, net/dns/resolver, etc: make netmon required in most places	2 years ago
dnsfallback	tsd, ipnlocal, etc: add tsd.System.HealthTracker, start some plumbing	2 years ago
flowtrack	all: update copyright and license headers	3 years ago
ktimeout	net/ktimeout: add a package to set TCP user timeout	2 years ago
memnet	net/memnet: export the network name (#9111)	2 years ago
netaddr	all: update copyright and license headers	3 years ago
netcheck	net/netcheck,wgengine/magicsock: add potential workaround for Palo Alto DIPP misbehavior	2 years ago
neterror	net/neterror, wgengine/magicsock: use UDP GSO and GRO on Linux (#7791)	3 years ago
netkernelconf	client/tailscale,ipn/{ipnlocal,localapi}: check UDP GRO config (#10071)	2 years ago
netknob	all: update copyright and license headers	3 years ago
netmon	net/netmon: remove spammy log statements (#11953)	2 years ago
netns	net/{interfaces,netmon}, all: merge net/interfaces package into net/netmon	2 years ago
netstat	net/{netns,netstat}: use new x/sys/cpu.IsBigEndian	3 years ago
netutil	net/netmon, add: add netmon.State type alias of interfaces.State	2 years ago
packet	all: use Go 1.22 range-over-int	2 years ago
ping	net/ping: fix ICMP echo code field to 0	2 years ago
portmapper	net/portmapper: add envknob to disable portmapper in localhost integration tests	2 years ago
proxymux	all: cleanup unused code, part 1 (#10661)	2 years ago
routetable	net/{interfaces,netmon}, all: merge net/interfaces package into net/netmon	2 years ago
socks5	net/socks5: add password auth support	3 years ago
sockstats	net/{interfaces,netmon}, all: merge net/interfaces package into net/netmon	2 years ago
speedtest	all: update copyright and license headers	3 years ago
stun	all: make more tests pass/skip in airplane mode	2 years ago
stunserver	all: use Go 1.22 range-over-int	2 years ago
tcpinfo	all: use Go 1.22 range-over-int	2 years ago
tlsdial	tsd, ipnlocal, etc: add tsd.System.HealthTracker, start some plumbing	2 years ago
tsaddr	types/views: remove duplicate SliceContainsFunc	2 years ago
tsdial	ipn/ipnlocal, net/tsdial: plumb routes into tsdial and use them in UserDial	2 years ago
tshttpproxy	all: use Go 1.22 range-over-int	2 years ago
tstun	net/tstun: do SNAT after filterPacketOutboundToWireGuard	2 years ago
wsconn	net/wsconn: accept a remote addr string and plumb it through	2 years ago