diff options
| author | Maisem Ali <maisem@tailscale.com> | 2024-05-14 13:23:34 -0400 |
|---|---|---|
| committer | Maisem Ali <maisem@gmail.com> | 2024-05-14 17:19:09 -0400 |
| commit | 1f51bb68915eec6ba7e44a4fb184ff68b069d9d2 (patch) | |
| tree | e7b65a8ed5fa8abf5ef48dc7cdf7fd7e213afc87 /control/controlknobs | |
| parent | 60266be29878ceba887ea9195c257fcc29593cfe (diff) | |
| download | tailscale-1f51bb68915eec6ba7e44a4fb184ff68b069d9d2.tar.xz tailscale-1f51bb68915eec6ba7e44a4fb184ff68b069d9d2.zip | |
net/tstun: do SNAT after filterPacketOutboundToWireGuard
In a configuration where the local node (ip1) has a different IP (ip2)
that it uses to communicate with a peer (ip3) we would do UDP flow
tracking on the `ip2->ip3` tuple. When we receive the response from
the peer `ip3->ip2` we would dnat it back to `ip3->ip1` which would
then not match the flow track state and the packet would get dropped.
To fix this, we should do flow tracking on the `ip1->ip3` tuple instead
of `ip2->ip3` which requires doing SNAT after the running filterPacketOutboundToWireGuard.
Updates tailscale/corp#19971, tailscale/corp#8020
Signed-off-by: Maisem Ali <maisem@tailscale.com>
Diffstat (limited to 'control/controlknobs')
0 files changed, 0 insertions, 0 deletions