summaryrefslogtreecommitdiffhomepage
path: root/wgengine/netstack
diff options
context:
space:
mode:
Diffstat (limited to 'wgengine/netstack')
-rw-r--r--wgengine/netstack/netstack.go75
-rw-r--r--wgengine/netstack/netstack_test.go280
2 files changed, 341 insertions, 14 deletions
diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go
index c2b5d8a32..17f9cfd7d 100644
--- a/wgengine/netstack/netstack.go
+++ b/wgengine/netstack/netstack.go
@@ -21,6 +21,7 @@ import (
"time"
"github.com/tailscale/wireguard-go/conn"
+ "gvisor.dev/gvisor/pkg/buffer"
"gvisor.dev/gvisor/pkg/refs"
"gvisor.dev/gvisor/pkg/tcpip"
"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
@@ -119,8 +120,8 @@ func maxInFlightConnectionAttemptsPerClient() int {
var debugNetstack = envknob.RegisterBool("TS_DEBUG_NETSTACK")
var (
- serviceIP = tsaddr.TailscaleServiceIP()
- serviceIPv6 = tsaddr.TailscaleServiceIPv6()
+ tsServiceIP = tsaddr.TailscaleServiceIP()
+ tsServiceIPv6 = tsaddr.TailscaleServiceIPv6()
)
func init() {
@@ -176,6 +177,22 @@ type Impl struct {
// It can only be set before calling Start.
ProcessSubnets bool
+ // HandleIPPacket, if non-nil, is called for incoming TCP/UDP packets that
+ // netstack will not process.
+ //
+ // The packet slice contains a complete IP packet starting with the IP header.
+ // The packet slice is only valid for the duration of the call and must not
+ // be retained.
+ //
+ // If HandleIPPacket returns true, the packet is consumed. If false, the packet
+ // is passed to the host network stack (if available).
+ //
+ // The handler will NOT see packets processed by netstack (local IPs, subnet IPs,
+ // PeerAPI, SSH, service IPs, or flows handled by GetTCPHandlerForFlow/GetUDPHandlerForFlow).
+ //
+ // The handler is called from the packet receive path and must not block.
+ HandleIPPacket func(packet []byte) bool
+
ipstack *stack.Stack
linkEP *linkEndpoint
tundev *tstun.Wrapper
@@ -415,6 +432,16 @@ func (ns *Impl) Close() error {
return nil
}
+// InjectOutbound sends an IP packet through the Tailscale network.
+// The packet must be a complete IP packet starting with the IP header.
+func (ns *Impl) InjectOutbound(pkt []byte) error {
+ packetBuf := stack.NewPacketBuffer(stack.PacketBufferOptions{
+ Payload: buffer.MakeWithData(pkt),
+ })
+ // InjectOutboundPacketBuffer decrements the buffer reference count.
+ return ns.tundev.InjectOutboundPacketBuffer(packetBuf)
+}
+
// SetTransportProtocolOption forwards to the underlying
// [stack.Stack.SetTransportProtocolOption]. Callers are responsible for
// ensuring that the options are valid, compatible and appropriate for their use
@@ -772,7 +799,7 @@ func (ns *Impl) handleLocalPackets(p *packet.Parsed, t *tstun.Wrapper, gro *gro.
// Determine if we care about this local packet.
dst := p.Dst.Addr()
switch {
- case dst == serviceIP || dst == serviceIPv6:
+ case dst == tsServiceIP || dst == tsServiceIPv6:
// We want to intercept some traffic to the "service IP" (e.g.
// 100.100.100.100 for IPv4). However, of traffic to the
// service IP, we only care about UDP 53, and TCP on port 53,
@@ -994,13 +1021,13 @@ func (ns *Impl) shouldSendToHost(pkt *stack.PacketBuffer) bool {
switch v := hdr.(type) {
case header.IPv4:
srcIP := netip.AddrFrom4(v.SourceAddress().As4())
- if serviceIP == srcIP {
+ if tsServiceIP == srcIP {
return true
}
case header.IPv6:
srcIP := netip.AddrFrom16(v.SourceAddress().As16())
- if srcIP == serviceIPv6 {
+ if srcIP == tsServiceIPv6 {
return true
}
@@ -1064,7 +1091,7 @@ func (ns *Impl) shouldProcessInbound(p *packet.Parsed, t *tstun.Wrapper) bool {
// Handle incoming peerapi connections in netstack.
dstIP := p.Dst.Addr()
isLocal := ns.isLocalIP(dstIP)
- isService := ns.isVIPServiceIP(dstIP)
+ isVIPService := ns.isVIPServiceIP(dstIP)
// Handle TCP connection to the Tailscale IP(s) in some cases:
if ns.lb != nil && p.IPProto == ipproto.TCP && isLocal {
@@ -1087,7 +1114,20 @@ func (ns *Impl) shouldProcessInbound(p *packet.Parsed, t *tstun.Wrapper) bool {
return true
}
}
- if buildfeatures.HasServe && isService {
+ hittingServiceIP := dstIP == tsServiceIP || dstIP == tsServiceIPv6
+ if hittingServiceIP {
+ if p.IsEchoRequest() {
+ return true
+ }
+ if p.Dst.Port() == 53 {
+ return true
+ }
+ if ns.isLoopbackPort(p.Dst.Port()) {
+ return true
+ }
+ return false
+ }
+ if buildfeatures.HasServe && isVIPService {
if p.IsEchoRequest() {
return true
}
@@ -1103,6 +1143,13 @@ func (ns *Impl) shouldProcessInbound(p *packet.Parsed, t *tstun.Wrapper) bool {
if p.IPVersion == 6 && !isLocal && viaRange.Contains(dstIP) {
return ns.lb != nil && ns.lb.ShouldHandleViaIP(dstIP)
}
+ // If HandleIPPacket is set, don't process normal traffic in netstack.
+ // This allows the handler to receive all non-special packets.
+ // Special traffic (PeerAPI, SSH, service IP, VIP services) is still
+ // handled by netstack via the checks above.
+ if ns.HandleIPPacket != nil {
+ return false
+ }
if ns.ProcessLocalIPs && isLocal {
return true
}
@@ -1189,7 +1236,11 @@ func (ns *Impl) injectInbound(p *packet.Parsed, t *tstun.Wrapper, gro *gro.GRO)
}
if !ns.shouldProcessInbound(p, t) {
- // Let the host network stack (if any) deal with it.
+ if ns.HandleIPPacket != nil {
+ if ns.HandleIPPacket(p.Buffer()) {
+ return filter.DropSilently, gro
+ }
+ }
return filter.Accept, gro
}
@@ -1392,7 +1443,7 @@ func (ns *Impl) acceptTCP(r *tcp.ForwarderRequest) {
}
// Local Services (DNS and WebDAV)
- hittingServiceIP := dialIP == serviceIP || dialIP == serviceIPv6
+ hittingServiceIP := dialIP == tsServiceIP || dialIP == tsServiceIPv6
hittingDNS := hittingServiceIP && reqDetails.LocalPort == 53
if hittingDNS {
c := getConnOrReset()
@@ -1433,7 +1484,7 @@ func (ns *Impl) acceptTCP(r *tcp.ForwarderRequest) {
}
switch {
case hittingServiceIP && ns.isLoopbackPort(reqDetails.LocalPort):
- if dialIP == serviceIPv6 {
+ if dialIP == tsServiceIPv6 {
dialIP = ipv6Loopback
} else {
dialIP = ipv4Loopback
@@ -1635,14 +1686,14 @@ func (ns *Impl) acceptUDP(r *udp.ForwarderRequest) {
}
// Handle magicDNS and loopback traffic (via UDP) here.
- if dst := dstAddr.Addr(); dst == serviceIP || dst == serviceIPv6 {
+ if dst := dstAddr.Addr(); dst == tsServiceIP || dst == tsServiceIPv6 {
switch {
case dstAddr.Port() == 53:
c := gonet.NewUDPConn(&wq, ep)
go ns.handleMagicDNSUDP(srcAddr, c)
return
case ns.isLoopbackPort(dstAddr.Port()):
- if dst == serviceIPv6 {
+ if dst == tsServiceIPv6 {
dstAddr = netip.AddrPortFrom(ipv6Loopback, dstAddr.Port())
} else {
dstAddr = netip.AddrPortFrom(ipv4Loopback, dstAddr.Port())
diff --git a/wgengine/netstack/netstack_test.go b/wgengine/netstack/netstack_test.go
index 93022811c..3eeb4d56b 100644
--- a/wgengine/netstack/netstack_test.go
+++ b/wgengine/netstack/netstack_test.go
@@ -847,13 +847,13 @@ func TestShouldSendToHost(t *testing.T) {
// not over WireGuard.
{
name: "from_service_ip_to_localhost",
- src: netip.AddrPortFrom(serviceIP, 53),
+ src: netip.AddrPortFrom(tsServiceIP, 53),
dst: netip.MustParseAddrPort("127.0.0.1:9999"),
want: true,
},
{
name: "from_service_ip_to_localhost_v6",
- src: netip.AddrPortFrom(serviceIPv6, 53),
+ src: netip.AddrPortFrom(tsServiceIPv6, 53),
dst: netip.MustParseAddrPort("[::1]:9999"),
want: true,
},
@@ -1019,3 +1019,279 @@ func makeUDP6PacketBuffer(src, dst netip.AddrPort) *stack.PacketBuffer {
return pkt
}
+
+func TestHandleIPPacket(t *testing.T) {
+ impl := makeNetstack(t, func(ns *Impl) {})
+
+ client := netip.MustParseAddr("100.64.1.2")
+ destAddr := netip.MustParseAddr("100.64.1.1")
+ pkt := tcp4syn(t, client, destAddr, 1234, 5678)
+
+ var handlerCalled bool
+ var receivedPacket []byte
+ impl.HandleIPPacket = func(p []byte) bool {
+ handlerCalled = true
+ receivedPacket = append([]byte(nil), p...)
+ return true
+ }
+
+ var parsed packet.Parsed
+ parsed.Decode(pkt)
+
+ resp, _ := impl.injectInbound(&parsed, impl.tundev, nil)
+
+ if !handlerCalled {
+ t.Error("HandleIPPacket was not called")
+ }
+ if resp != filter.DropSilently {
+ t.Errorf("Expected DropSilently response when handler returns true, got %v", resp)
+ }
+ if len(receivedPacket) == 0 {
+ t.Error("Handler received empty packet")
+ }
+ if len(receivedPacket) < 20 {
+ t.Errorf("Packet too short: %d bytes", len(receivedPacket))
+ }
+ ipVer := receivedPacket[0] >> 4
+ if ipVer != 4 {
+ t.Errorf("Expected IPv4 packet (version 4), got version %d", ipVer)
+ }
+
+ handlerCalled = false
+ receivedPacket = nil
+ impl.HandleIPPacket = func(p []byte) bool {
+ handlerCalled = true
+ receivedPacket = append([]byte(nil), p...)
+ return false
+ }
+
+ var parsed2 packet.Parsed
+ parsed2.Decode(pkt)
+ resp2, _ := impl.injectInbound(&parsed2, impl.tundev, nil)
+
+ if !handlerCalled {
+ t.Error("HandleIPPacket was not called on second test")
+ }
+ if resp2 != filter.Accept {
+ t.Errorf("Expected Accept when handler declines, got %v", resp2)
+ }
+ if len(receivedPacket) == 0 {
+ t.Error("Handler received empty packet on second test")
+ }
+
+ impl.HandleIPPacket = nil
+ var parsed3 packet.Parsed
+ parsed3.Decode(pkt)
+ resp3, _ := impl.injectInbound(&parsed3, impl.tundev, nil)
+
+ if resp3 != filter.Accept {
+ t.Errorf("Expected Accept with no handler, got %v", resp3)
+ }
+}
+
+func TestHandleIPPacketIPv6(t *testing.T) {
+ impl := makeNetstack(t, func(ns *Impl) {})
+
+ src := netip.MustParseAddr("fd7a:115c:a1e0::2")
+ dst := netip.MustParseAddr("fd7a:115c:a1e0::1")
+ const tcpLen = header.TCPMinimumSize
+ ip := header.IPv6(make([]byte, header.IPv6MinimumSize+tcpLen))
+ ip.Encode(&header.IPv6Fields{
+ TransportProtocol: header.TCPProtocolNumber,
+ PayloadLength: tcpLen,
+ HopLimit: 64,
+ SrcAddr: tcpip.AddrFrom16(src.As16()),
+ DstAddr: tcpip.AddrFrom16(dst.As16()),
+ })
+
+ tcp := header.TCP(ip[header.IPv6MinimumSize:])
+ tcp.Encode(&header.TCPFields{
+ SrcPort: 1234,
+ DstPort: 5678,
+ SeqNum: 0,
+ DataOffset: header.TCPMinimumSize,
+ Flags: header.TCPFlagSyn,
+ WindowSize: 65535,
+ })
+
+ pkt := []byte(ip)
+
+ var receivedPacket []byte
+ impl.HandleIPPacket = func(p []byte) bool {
+ receivedPacket = append([]byte(nil), p...)
+ return true
+ }
+
+ var parsed packet.Parsed
+ parsed.Decode(pkt)
+
+ resp, _ := impl.injectInbound(&parsed, impl.tundev, nil)
+
+ if resp != filter.DropSilently {
+ t.Errorf("Expected DropSilently, got %v", resp)
+ }
+ if len(receivedPacket) < 40 {
+ t.Errorf("Packet too short for IPv6: %d bytes", len(receivedPacket))
+ }
+ ipVer := receivedPacket[0] >> 4
+ if ipVer != 6 {
+ t.Errorf("Expected IPv6 packet (version 6), got version %d", ipVer)
+ }
+}
+
+func TestHandleIPPacketNotProcessed(t *testing.T) {
+ impl := makeNetstack(t, func(ns *Impl) {
+ ns.ProcessLocalIPs = false
+ ns.ProcessSubnets = false
+ })
+
+ var handlerCalled bool
+ impl.HandleIPPacket = func(p []byte) bool {
+ handlerCalled = true
+ return true
+ }
+
+ client := netip.MustParseAddr("100.64.1.2")
+ destAddr := netip.MustParseAddr("100.64.1.1")
+ pkt := tcp4syn(t, client, destAddr, 1234, 5678)
+
+ var parsed packet.Parsed
+ parsed.Decode(pkt)
+
+ resp, _ := impl.injectInbound(&parsed, impl.tundev, nil)
+
+ if !handlerCalled {
+ t.Error("HandleIPPacket should be called when shouldProcessInbound returns false")
+ }
+ if resp != filter.DropSilently {
+ t.Errorf("Expected DropSilently when handler consumes packet, got %v", resp)
+ }
+}
+
+func TestHandleIPPacketRealPacket(t *testing.T) {
+ impl := makeNetstack(t, func(ns *Impl) {})
+
+ client := netip.MustParseAddr("100.64.1.2")
+ destAddr := netip.MustParseAddr("100.64.1.1")
+ pkt := tcp4syn(t, client, destAddr, 1234, 5678)
+
+ var parsed packet.Parsed
+ parsed.Decode(pkt)
+ if parsed.IPVersion != 4 {
+ t.Fatalf("Expected IPv4, got version %d", parsed.IPVersion)
+ }
+ if parsed.Src.Addr() != client {
+ t.Errorf("Expected src %v, got %v", client, parsed.Src.Addr())
+ }
+ if parsed.Dst.Addr() != destAddr {
+ t.Errorf("Expected dst %v, got %v", destAddr, parsed.Dst.Addr())
+ }
+
+ var receivedPacket []byte
+ impl.HandleIPPacket = func(p []byte) bool {
+ receivedPacket = append([]byte(nil), p...)
+ return true
+ }
+
+ resp, _ := impl.injectInbound(&parsed, impl.tundev, nil)
+
+ if resp != filter.DropSilently {
+ t.Errorf("Expected DropSilently, got %v", resp)
+ }
+
+ if len(receivedPacket) != len(pkt) {
+ t.Errorf("Packet length mismatch: got %d, want %d", len(receivedPacket), len(pkt))
+ }
+
+ var parsedFromHandler packet.Parsed
+ parsedFromHandler.Decode(receivedPacket)
+ if parsedFromHandler.IPVersion != 4 {
+ t.Errorf("Handler received non-IPv4 packet: version %d", parsedFromHandler.IPVersion)
+ }
+ if parsedFromHandler.Src.Addr() != client {
+ t.Errorf("Handler packet src mismatch: got %v, want %v", parsedFromHandler.Src.Addr(), client)
+ }
+}
+
+// TestHandleIPPacketWithServices verifies that PeerAPI and Service IP packets
+// don't reach the handler (they're handled by shouldProcessInbound).
+func TestHandleIPPacketWithServices(t *testing.T) {
+ var handlerCalledFor []string
+ var handlerFunc = func(p []byte) bool {
+ var parsed packet.Parsed
+ parsed.Decode(p)
+ handlerCalledFor = append(handlerCalledFor, fmt.Sprintf("%v->%v", parsed.Src, parsed.Dst))
+ return true
+ }
+
+ client := netip.MustParseAddr("100.64.1.2")
+ selfIP := netip.MustParseAddr("100.64.1.1")
+
+ tests := []struct {
+ name string
+ setupImpl func(*Impl)
+ dstAddr netip.Addr
+ dstPort uint16
+ shouldReach bool
+ expectedResp filter.Response
+ description string
+ }{
+ {
+ name: "peerapi_packet",
+ setupImpl: func(ns *Impl) {
+ ns.ProcessLocalIPs = true
+ ns.peerapiPort4Atomic.Store(5555)
+ },
+ dstAddr: selfIP,
+ dstPort: 5555,
+ shouldReach: false,
+ expectedResp: filter.DropSilently,
+ description: "PeerAPI packets should NOT reach handler (handled by netstack)",
+ },
+ {
+ name: "service_ip_dns",
+ setupImpl: func(ns *Impl) {},
+ dstAddr: netip.MustParseAddr("100.100.100.100"),
+ dstPort: 53,
+ shouldReach: false,
+ expectedResp: filter.DropSilently,
+ description: "Service IP (DNS) packets should NOT reach handler",
+ },
+ {
+ name: "normal_packet",
+ setupImpl: func(ns *Impl) {},
+ dstAddr: selfIP,
+ dstPort: 8080,
+ shouldReach: true,
+ expectedResp: filter.DropSilently,
+ description: "Normal packets (not processed by netstack) should reach handler",
+ },
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ impl := makeNetstack(t, tt.setupImpl)
+ impl.HandleIPPacket = handlerFunc
+ handlerCalledFor = nil
+
+ pkt := tcp4syn(t, client, tt.dstAddr, 1234, tt.dstPort)
+ var parsed packet.Parsed
+ parsed.Decode(pkt)
+
+ resp, _ := impl.injectInbound(&parsed, impl.tundev, nil)
+
+ handlerCalled := len(handlerCalledFor) > 0
+
+ if tt.shouldReach && !handlerCalled {
+ t.Errorf("%s: handler was not called, but should have been", tt.description)
+ }
+ if !tt.shouldReach && handlerCalled {
+ t.Errorf("%s: handler was called for %v, but should NOT have been", tt.description, handlerCalledFor)
+ }
+
+ if resp != tt.expectedResp {
+ t.Errorf("Expected %v, got %v", tt.expectedResp, resp)
+ }
+ })
+ }
+}
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.