aboutsummaryrefslogtreecommitdiffstats
path: root/tun/netstack/tun.go (unfollow)
Commit message (Collapse)AuthorFilesLines
2022-02-02Handle whole ICMP headerstp/icmp-fixestqbf1-21/+3
Theoretically, this change would allow us to send ICMP replies from these sockets. In practice, netstack filters anything but EchoRequest, so this change mostly just adds annoyance right now. But in the future, netstack might fix this, and this API would then work for more than one use case. Signed-off-by: Thomas Ptacek <thomas@sockpuppet.org>
2022-02-02fix addressing and deadlinestqbf1-16/+61
- setting a now deadline unblocks a blocked read - setting a specific deadline over a previous deadline honors the new one - WriteTo will accept a net.Addr, not just a PingAddr Signed-off-by: Thomas Ptacek <thomas@sockpuppet.org>
2022-02-01tun/netstack: implement ICMP pingThomas H. Ptacek2-24/+264
Provide a PacketConn interface for netstack's ICMP endpoint; netstack currently only provides EchoRequest/EchoResponse ICMP support, so this code exposes only an interface for doing ping. Currently is missing: - Write deadlines - Context support Signed-off-by: Thomas Ptacek <thomas@sockpuppet.org> [Jason: rework structure, match std go interfaces, add example code] Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-01-17version: bump snapshot0.0.20220117Jason A. Donenfeld1-1/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-01-14ipc: bsd: try again if kqueue returns EINTRJason A. Donenfeld1-1/+1
Reported-by: J. Michael McAtee <mmcatee@jumptrading.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-12-09global: apply gofumptJason A. Donenfeld28-71/+56
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-29device: handle peer post config on blank lineJason A. Donenfeld1-0/+1
We missed a function exit point. This was exacerbated by e3134bf ("device: defer state machine transitions until configuration is complete"), but the bug existed prior. Minus provided the following useful reproducer script: #!/usr/bin/env bash set -eux make wireguard-go || exit 125 ip netns del test-ns || true ip netns add test-ns ip link add test-kernel type wireguard wg set test-kernel listen-port 0 private-key <(echo "QMCfZcp1KU27kEkpcMCgASEjDnDZDYsfMLHPed7+538=") peer "eDPZJMdfnb8ZcA/VSUnLZvLB2k8HVH12ufCGa7Z7rHI=" allowed-ips 10.51.234.10/32 ip link set test-kernel netns test-ns up ip -n test-ns addr add 10.51.234.1/24 dev test-kernel port=$(ip netns exec test-ns wg show test-kernel listen-port) ip link del test-go || true ./wireguard-go test-go wg set test-go private-key <(echo "WBM7qimR3vFk1QtWNfH+F4ggy/hmO+5hfIHKxxI4nF4=") peer "+nj9Dkqpl4phsHo2dQliGm5aEiWJJgBtYKbh7XjeNjg=" allowed-ips 0.0.0.0/0 endpoint 127.0.0.1:$port ip addr add 10.51.234.10/24 dev test-go ip link set test-go up ping -c2 -W1 10.51.234.1 Reported-by: minus <minus@mnus.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-23device: reduce peer lock critical section in UAPIJosh Bleecher Snyder1-26/+28
The deferred RUnlock calls weren't executing until all peers had been processed. Add an anonymous function so that each peer may be unlocked as soon as it is completed. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-23device: remove code using unsafeJosh Bleecher Snyder1-33/+13
There is no performance impact. name old time/op new time/op delta TrieIPv4Peers100Addresses1000-8 78.6ns ± 1% 79.4ns ± 3% ~ (p=0.604 n=10+9) TrieIPv4Peers10Addresses10-8 29.1ns ± 2% 28.8ns ± 1% -1.12% (p=0.014 n=10+9) TrieIPv6Peers100Addresses1000-8 78.9ns ± 1% 78.6ns ± 1% ~ (p=0.492 n=10+10) TrieIPv6Peers10Addresses10-8 29.3ns ± 2% 28.6ns ± 2% -2.16% (p=0.000 n=10+10) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-23global: use netip where possible nowJason A. Donenfeld22-285/+247
There are more places where we'll need to add it later, when Go 1.18 comes out with support for it in the "net" package. Also, allowedips still uses slices internally, which might be suboptimal. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-16device: only propagate roaming value before peer is referenced elsewhereJason A. Donenfeld1-1/+3
A peer.endpoint never becomes nil after being not-nil, so creation is the only time we actually need to set this. This prevents a race from when the variable is actually used elsewhere, and allows us to avoid an expensive atomic. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-16device: align 64-bit atomic member in DeviceJason A. Donenfeld1-5/+6
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-16device: start peers before running handshake testJason A. Donenfeld1-0/+2
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-16Makefile: don't use test -v because it hides failures in scrollbackJason A. Donenfeld1-1/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-16device: fix nil pointer dereference in uapi readDavid Anderson1-2/+2
Signed-off-by: David Anderson <danderson@tailscale.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-15device: make new peers inherit broken mobile semanticsJason A. Donenfeld3-0/+5
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-15device: defer state machine transitions until configuration is completeJason A. Donenfeld3-15/+18
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-15device: do not consume handshake messages if not runningJason A. Donenfeld1-1/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-04tun: move wintun to its own repoJason A. Donenfeld3-7/+10
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-11-04namedpipe: rename from winpipe to keep in sync with CL299009Jason A. Donenfeld7-475/+132
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-28device: timers: use pre-seeded per-thread unlocked fastrandn for jitterJason A. Donenfeld1-10/+5
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-28device: timers: seed unsafe rng before use for jitterJason A. Donenfeld1-3/+11
Forgetting to seed the unsafe rng, the jitter before followed a fixed pattern, which didn't help when a fleet of computers all boot at once. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-26wintun: align 64-bit argument on ARM32Jason A. Donenfeld1-1/+5
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-25README: raise minimum Go to 1.17Jason A. Donenfeld1-1/+1
Suggested-by: Adam Bliss <abliss@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-22tun/netstack: update gvisorMikael Magnusson3-22/+403
Update gvisor to v0.0.0-20211020211948-f76a604701b6, which requires some changes to tun.go: WriteRawPacket: Add function with not implemented error. CreateNetTUN: Replace stack.AddAddress with stack.AddProtocolAddress, and fix IPv6 address in error message. Signed-off-by: Mikael Magnusson <mikma@users.sourceforge.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-20ipc, rwcancel: compile on js/wasmBrad Fitzpatrick3-1/+18
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-20wintun: allow retrieving DLL versionJason A. Donenfeld4-7/+37
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-16version: bump snapshot0.0.20211016Jason A. Donenfeld1-1/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-16wintun: remove memmod option for dll loadingJason A. Donenfeld13-1481/+39
Only wireguard-windows used this, and it's moving to wgnt exclusively. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-12global: remove old-style build tagsJason A. Donenfeld24-24/+0
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-12global: add newer-style build tagsJason A. Donenfeld7-0/+7
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-12wintun: use new swdevice-based API for upcoming Wintun 0.14Jason A. Donenfeld2-149/+61
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-11conn,wintun: use unsafe.Slice instead of unsafeSliceJason A. Donenfeld2-41/+3
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-11memmod: import from wireguard-windowsJason A. Donenfeld6-34/+96
We'll eventually be getting rid of it here, but keep it sync'd up for now. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-09-27rwcancel: use unix.Poll again but bump x/sys so it uses ppoll under the hoodJason A. Donenfeld5-54/+14
This reverts commit fcc601dbf0f6b626ec1d47a880cbe64f9c8fe385 but then bumps go.mod. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-09-26rwcancel: use ppoll on Linux for AndroidJason A. Donenfeld3-2/+34
This is a temporary measure while we wait for https://go-review.googlesource.com/c/sys/+/352310 to land. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-09-23tun: make operateonfd.go build tags more specificTobias Klauser1-2/+2
(*NativeTun).operateOnFd is only used on darwin and freebsd. Adjust the build tags accordingly. Signed-off-by: Tobias Klauser <tklauser@distanz.ch> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-09-23tun: avoid leaking sock fd in CreateTUN error casesTobias Klauser2-6/+11
At these points, the socket file descriptor is not yet wrapped in an *os.File, so it needs to be closed explicitly on error. Signed-off-by: Tobias Klauser <tklauser@distanz.ch> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-09-05global: add new go 1.17 build commentsJason A. Donenfeld13-2/+15
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-08-05memmod: register exception handler tablesJason A. Donenfeld2-0/+19
Otherwise recent WDK binaries fail on ARM64, where an exception handler is used for trapping an illegal instruction when ARMv8.1 atomics are being tested for functionality. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-07-29memmod: fix protected delayed load the right wayJason A. Donenfeld2-9/+13
The reason this was failing before is that dloadsup.h's DloadObtainSection was doing a linear search of sections to find which header corresponds with the IMAGE_DELAYLOAD_DESCRIPTOR section, and we were stupidly overwriting the VirtualSize field, so the linear search wound up matching the .text section, which then it found to not be marked writable and failed with FAST_FAIL_DLOAD_PROTECTION_FAILURE. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-07-29memmod: disable protected delayed load for nowJason A. Donenfeld4-2/+155
Probably a bad idea, but we don't currently support it, and those huge windows.NewCallback trampolines make juicer targets anyway. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-06-24ipc: allow admins but require high integrity labelJason A. Donenfeld1-2/+1
Might be more reasonable. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-06-04device: zero out allowedip node pointers when removingJason A. Donenfeld2-1/+22
This should make it a bit easier for the garbage collector. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-06-03device: limit allowedip fuzzer a to 4 times throughJason A. Donenfeld1-5/+10
Trying this for every peer winds up being very slow and precludes it from acceptable runtime in the CI, so reduce this to 4. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-06-03device: simplify allowedips lookup signatureJason A. Donenfeld5-17/+18
The inliner should handle this for us. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-06-03device: remove nodes by peer in O(1) instead of O(n)Jason A. Donenfeld2-72/+82
Now that we have parent pointers hooked up, we can simply go right to the node and remove it in place, rather than having to recursively walk the entire trie. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-06-03device: remove recursion from insertion and connect parent pointersJason A. Donenfeld3-59/+95
This makes the insertion algorithm a bit more efficient, while also now taking on the additional task of connecting up parent pointers. This will be handy in the following commit. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-06-03device: reduce size of trie structJason A. Donenfeld5-53/+45
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-05-25go.mod: bump golang.org/x/sys againJosh Bleecher Snyder2-1/+7
To pick up https://go-review.googlesource.com/c/sys/+/307129. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.