tailscale/wgengine/netstack/netstack_userping.go, branch knyar/netmapdiff2The easiest, most secure way to use WireGuard and 2FAhttp://git.waynecole.info/tailscale/atom?h=knyar%2Fnetmapdiff22024-10-03T16:07:39Zwgengine/netstack: check userspace ping success on Windows2024-10-03T16:07:39ZBrad Fitzpatrickbradfitz@tailscale.com2024-10-02T17:01:46Zurn:sha1:5f88b65764925c397761d306fd6b228578948ac7
Hacky temporary workaround until we do #13654 correctly.
Updates #13654
Change-Id: I764eaedbb112fb3a34dddb89572fec1b2543fd4a
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
xcode: allow ICMP ping relay on macOS + iOS platforms (#12048)2024-05-16T18:57:57ZAndrea Gottardoandrea@tailscale.com2024-05-16T18:57:57Zurn:sha1:e5f67f90a24d64593c12cff50b2c272dfde16f86
Fixes tailscale/tailscale#10393
Fixes tailscale/corp#15412
Fixes tailscale/corp#19808
On Apple platforms, exit nodes and subnet routers have been unable to relay pings from Tailscale devices to non-Tailscale devices due to sandbox restrictions imposed on our network extensions by Apple. The sandbox prevented the code in netstack.go from spawning the `ping` process which we were using.
Replace that exec call with logic to send an ICMP echo request directly, which appears to work in userspace, and not trigger a sandbox violation in the syslog.
Signed-off-by: Andrea Gottardo <andrea@gottardo.me>