You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/util/linuxfw
James Tucker 055117ad45
util/linuxfw: fix support for containers without IPv6 iptables filters (#11381)
There are container environments such as GitHub codespaces that have
partial IPv6 support - routing support is enabled at the kernel level,
but lacking IPv6 filter support in the iptables module.

In the specific example of the codespaces environment, this also has
pre-existing legacy iptables rules in the IPv4 tables, as such the
nascent firewall mode detection will always pick iptables.

We would previously fault trying to install rules to the filter table,
this catches that condition earlier, and disables IPv6 support under
these conditions.

Updates #5621
Updates #11344
Updates #11354

Signed-off-by: James Tucker <james@tailscale.com>
2 years ago
..
linuxfwtest util/linuxfw: initial implementation of package 3 years ago
detector.go linuxfw,wgengine/route,ipn: add c2n and nodeattrs to control linux netfilter 2 years ago
fake.go util/linuxfw: move fake runner into pkg 2 years ago
helpers.go all: cleanup unused code, part 2 (#10670) 2 years ago
iptables.go util/linuxfw: move detection logic 2 years ago
iptables_runner.go util/linuxfw: fix support for containers without IPv6 iptables filters (#11381) 2 years ago
iptables_runner_test.go util/linuxfw: move fake runner into pkg 2 years ago
linuxfw.go util/linuxfw: add container-friendly IPv6 NAT check (#11353) 2 years ago
linuxfw_unsupported.go all: cleanup unused code, part 2 (#10670) 2 years ago
nftables.go util/cmpx: delete now that we're using Go 1.22 2 years ago
nftables_runner.go util/linuxfw: add container-friendly IPv6 NAT check (#11353) 2 years ago
nftables_runner_test.go util/linuxfw: add missing error checks in tests 2 years ago
nftables_types.go util/linuxfw: add new arch build constraints 2 years ago