summaryrefslogtreecommitdiffhomepage
path: root/net/packet
AgeCommit message (Collapse)AuthorFilesLines
2026-01-23all: remove AUTHORS file and references to itWill Norris19-19/+19
This file was never truly necessary and has never actually been used in the history of Tailscale's open source releases. A Brief History of AUTHORS files --- The AUTHORS file was a pattern developed at Google, originally for Chromium, then adopted by Go and a bunch of other projects. The problem was that Chromium originally had a copyright line only recognizing Google as the copyright holder. Because Google (and most open source projects) do not require copyright assignemnt for contributions, each contributor maintains their copyright. Some large corporate contributors then tried to add their own name to the copyright line in the LICENSE file or in file headers. This quickly becomes unwieldy, and puts a tremendous burden on anyone building on top of Chromium, since the license requires that they keep all copyright lines intact. The compromise was to create an AUTHORS file that would list all of the copyright holders. The LICENSE file and source file headers would then include that list by reference, listing the copyright holder as "The Chromium Authors". This also become cumbersome to simply keep the file up to date with a high rate of new contributors. Plus it's not always obvious who the copyright holder is. Sometimes it is the individual making the contribution, but many times it may be their employer. There is no way for the proejct maintainer to know. Eventually, Google changed their policy to no longer recommend trying to keep the AUTHORS file up to date proactively, and instead to only add to it when requested: https://opensource.google/docs/releasing/authors. They are also clear that: > Adding contributors to the AUTHORS file is entirely within the > project's discretion and has no implications for copyright ownership. It was primarily added to appease a small number of large contributors that insisted that they be recognized as copyright holders (which was entirely their right to do). But it's not truly necessary, and not even the most accurate way of identifying contributors and/or copyright holders. In practice, we've never added anyone to our AUTHORS file. It only lists Tailscale, so it's not really serving any purpose. It also causes confusion because Tailscalars put the "Tailscale Inc & AUTHORS" header in other open source repos which don't actually have an AUTHORS file, so it's ambiguous what that means. Instead, we just acknowledge that the contributors to Tailscale (whoever they are) are copyright holders for their individual contributions. We also have the benefit of using the DCO (developercertificate.org) which provides some additional certification of their right to make the contribution. The source file changes were purely mechanical with: git ls-files | xargs sed -i -e 's/\(Tailscale Inc &\) AUTHORS/\1 contributors/g' Updates #cleanup Change-Id: Ia101a4a3005adb9118051b3416f5a64a4a45987d Signed-off-by: Will Norris <will@tailscale.com>
2025-12-10net/{packet,tstun},wgengine: update disco key when receiving via TSMP (#18158)Claus Lensbøl1-2/+3
When receiving a TSMPDiscoAdvertisement from peer, update the discokey for said peer. Some parts taken from: https://github.com/tailscale/tailscale/pull/18073/ Updates #12639 Co-authored-by: James Tucker <james@tailscale.com>
2025-11-25net/tstun: add TSMPDiscoAdvertisement to TSMPPing (#17995)Claus Lensbøl2-0/+120
Adds a new types of TSMP messages for advertising disco keys keys to/from a peer, and implements the advertising triggered by a TSMP ping. Needed as part of the effort to cache the netmap and still let clients connect without control being reachable. Updates #12639 Signed-off-by: Claus Lensbøl <claus@tailscale.com> Co-authored-by: James Tucker <james@tailscale.com>
2025-10-04wgengine: stop importing flowtrack when unusedBrad Fitzpatrick1-5/+0
Updates #12614 Change-Id: I42b5c4d623d356af4bee5bbdabaaf0f6822f2bf4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-26net/packet/checksum: copy the gvisor checksum, remove the depBrad Fitzpatrick1-12/+110
As part of making Tailscale's gvisor dependency optional for small builds, this was one of the last places left that depended on gvisor. Just copy the couple functions were were using. Updates #17283 Change-Id: Id2bc07ba12039afe4c8a3f0b68f4d76d1863bbfe Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-08-13net/{batching,packet},wgengine/magicsock: export batchingConn (#16848)Jordan Whited2-12/+94
For eventual use by net/udprelay.Server. Updates tailscale/corp#31164 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-13net/packet: cleanup IPv4 fragment guardsJames Tucker4-10/+149
The first packet fragment guard had an additional guard clause that was incorrectly comparing a length in bytes to a length in octets, and was also comparing what should have been an entire IPv4 through transport header length to a subprotocol payload length. The subprotocol header size guards were otherwise protecting against short transport headers, as is the conservative non-first fragment minimum offset size. Add an explicit disallowing of fragmentation for TSMP for the avoidance of doubt. Updates #cleanup Updates #5727 Signed-off-by: James Tucker <james@tailscale.com>
2025-06-05net/packet: fix Parsed docs (#16200)Jordan Whited1-3/+4
Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-03-13net/packet: implement Geneve header serialization (#15301)Jordan Whited2-0/+136
Updates tailscale/corp#27100 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-01-24feature/capture: move packet capture to feature/*, out of iOS + CLIBrad Fitzpatrick2-8/+75
We had the debug packet capture code + Lua dissector in the CLI + the iOS app. Now we don't, with tests to lock it in. As a bonus, tailscale.com/net/packet and tailscale.com/net/flowtrack no longer appear in the CLI's binary either. A new build tag ts_omit_capture disables the packet capture code and was added to build_dist.sh's --extra-small mode. Updates #12614 Change-Id: I79b0628c0d59911bd4d510c732284d97b0160f10 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-09-03wgengine/magicsock: actually use AF_PACKET socket for raw discoAndrew Dunham1-0/+5
Previously, despite what the commit said, we were using a raw IP socket that was *not* an AF_PACKET socket, and thus was subject to the host firewall rules. Switch to using a real AF_PACKET socket to actually get the functionality we want. Updates #13140 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If657daeeda9ab8d967e75a4f049c66e2bca54b78
2024-08-03net/packet/checksum: fix v6 NATMaisem Ali2-5/+32
We were copying 12 out of the 16 bytes which meant that the 1:1 NAT required would only work if the last 4 bytes happened to match between the new and old address, something that our tests accidentally had. Fix it by copying the full 16 bytes and make the tests also verify the addr and use rand addresses. Updates #9511 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-06-18net/flowtrack: optimize Tuple type for use as map keyBrad Fitzpatrick1-1/+1
This gets UDP filter overhead closer to TCP. Still ~2x, but no longer ~3x. goos: darwin goarch: arm64 pkg: tailscale.com/wgengine/filter │ before │ after │ │ sec/op │ sec/op vs base │ FilterMatch/tcp-not-syn-v4-8 15.43n ± 3% 15.38n ± 5% ~ (p=0.339 n=10) FilterMatch/udp-existing-flow-v4-8 42.45n ± 0% 34.77n ± 1% -18.08% (p=0.000 n=10) geomean 25.59n 23.12n -9.65% Updates #12486 Change-Id: I595cfadcc6b7234604bed9c4dd4261e087c0d4c4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-16all: use Go 1.22 range-over-intBrad Fitzpatrick1-2/+2
Updates #11058 Change-Id: I35e7ef9b90e83cac04ca93fd964ad00ed5b48430 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-02net/packet: allow more ICMP errorsJames Tucker3-2/+11
We now allow some more ICMP errors to flow, specifically: - ICMP parameter problem in both IPv4 and IPv6 (corrupt headers) - ICMP Packet Too Big (for IPv6 PMTU) Updates #311 Updates #8102 Updates #11002 Signed-off-by: James Tucker <james@tailscale.com>
2023-12-20all: cleanup unused code, part 1 (#10661)Andrew Lytvynov1-23/+0
Run `staticcheck` with `U1000` to find unused code. This cleans up about a half of it. I'll do the other half separately to keep PRs manageable. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-10-11net/packet: split off checksum munging into different pkgMaisem Ali4-369/+393
The current structure meant that we were embedding netstack in the tailscale CLI and in the GUIs. This removes that by isolating the checksum munging to a different pkg which is only called from `net/tstun`. Fixes #9756 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-02net/packet: implement methods for rewriting v6 addressesTom DNetto2-18/+175
Implements the ability for the address-rewriting code to support rewriting IPv6 addresses. Specifically, UpdateSrcAddr & UpdateDstAddr. Signed-off-by: Tom DNetto <tom@tailscale.com> Updates https://github.com/tailscale/corp/issues/11202
2023-04-24net/packet: add NAT support for DCCP and GREMaisem Ali2-8/+44
Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-06net, wgengine/capture: encode NAT addresses in pcap streamTom DNetto1-0/+17
Signed-off-by: Tom DNetto <tom@tailscale.com>
2023-03-23net/packet: add checksum update testsMaisem Ali2-3/+74
Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-23net/tstun: add inital support for NAT v4Maisem Ali1-0/+100
This adds support in tstun to utitilize the SelfNodeV4MasqAddrForThisPeer and perform the necessary modifications to the packet as it passes through tstun. Currently this only handles ICMP, UDP and TCP traffic. Subnet routers and Exit Nodes are also unsupported. Updates tailscale/corp#8020 Co-authored-by: Melanie Warrick <warrick@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-01-27all: update copyright and license headersWill Norris14-42/+28
This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2023-01-14net/{packet,tstun}: fix typo in test helper docsBrad Fitzpatrick1-1/+1
Change-Id: Ifc1684fe77c7d2585e049e0dfd7340910c47a67a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-01-14net/{packet,tstun},wgengine/filter: fix unknown IP protocol handlingBrad Fitzpatrick2-3/+46
01b90df2fa4f9101e4f0ae8334b00dd9c3ccc148 added SCTP support before (with explicit parsing for ports) and 69de3bf7bfddb37b4c0e076c93115f82a51ec407 tried to add support for arbitrary IP protocols (as long as the ACL permited a port of "*", since we might not know how to find ports from an arbitrary IP protocol, if it even has such a concept). But apparently that latter commit wasn't tested end-to-end enough. It had a lot of tests, but the tests made assumptions about layering that either weren't true, or regressed since 1.20. Notably, it didn't remove the (*Filter).pre bidirectional filter that dropped all "unknown" protocol packets both leaving and entering, even if there were explicit protocol matches allowing them in. Also, don't map all unknown protocols to 0. Keep their IP protocol number parsed so it's matchable by later layers. Only reject illegal things. Fixes #6423 Updates #2162 Updates #2163 Change-Id: I9659b3ece86f4db51d644f9b34df78821758842c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-29all: fix spelling mistakesJosh Soref1-1/+1
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
2022-09-23net/packet: fix filtering of short IPv4 fragmentsJames Tucker2-16/+72
The fragment offset is an 8 byte offset rather than a byte offset, so the short packet limit is now in fragment block size in order to compare with the offset value. The packet flags are in the first 3 bits of the flags/frags byte, and so after conversion to a uint16 little endian value they are at the start, not the end of the value - the mask for extracting "more fragments" is adjusted to match this byte. Extremely short fragments less than 80 bytes are dropped, but fragments over 80 bytes are now accepted. Fixes #5727 Signed-off-by: James Tucker <james@tailscale.com>
2022-08-02all: migrate more code code to net/netip directlyBrad Fitzpatrick1-2/+2
Instead of going through the tailscale.com/net/netaddr transitional wrappers. Updates #5162 Change-Id: I3dafd1c2effa1a6caa9b7151ecf6edd1a3fda3dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-02all: gofmt for Go 1.19Brad Fitzpatrick1-9/+9
Updates #5210 Change-Id: Ib02cd5e43d0a8db60c1f09755a8ac7b140b670be Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25all: convert more code to use net/netip directlyBrad Fitzpatrick5-17/+16
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25all: use various net/netip parse funcs directlyBrad Fitzpatrick3-18/+18
Mechanical change with perl+goimports. Changed {Must,}Parse{IP,IPPrefix,IPPort} to their netip variants, then goimports -d . Finally, removed the net/netaddr wrappers, to prevent future use. Updates #5162 Change-Id: I59c0e38b5fbca5a935d701645789cddf3d7863ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25net/netaddr: start migrating to net/netip via new netaddr adapter packageBrad Fitzpatrick7-37/+46
Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-05-04*: use WireGuard where logged, printed or namedJames Tucker1-1/+1
Signed-off-by: James Tucker <james@tailscale.com>
2022-05-03wgengine, net/packet, cmd/tailscale: add ICMP echoJames Tucker2-0/+52
Updates tailscale/corp#754 Signed-off-by: James Tucker <james@tailscale.com>
2022-03-26net/packet, wgengine/netstack: remove workaround for old gvisor ECN bugBrad Fitzpatrick2-113/+0
Fixes #2642 Change-Id: Ic02251d24a4109679645d1c8336e0f961d0cce13 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-19wgengine/netstack: clear TCP ECN bits before giving to gvisorBrad Fitzpatrick2-10/+133
Updates #2642 Change-Id: Ic219442a2656dd9dc99ae1dd91e907fd3d924987 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-19net/packet: fix typo in commentBrad Fitzpatrick1-1/+1
Change-Id: Ia666609fde18db44bf38d4e656f490fc372ac3b6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-12-09net/packet: add ICMP6Header, like ICMP4HeaderBrad Fitzpatrick4-7/+226
So we can generate IPv6 ping replies. Change-Id: I79a9a38d8aa242e5dfca4cd15dfaffaea6cb1aee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-12-08net/packet: don't make IP6Header.marshalPseudo assume UDPBrad Fitzpatrick2-3/+3
It will be used for ICMPv6 next, so pass in the proto. Also, use the ipproto constants rather than hardcoding the mysterious number. Change-Id: I57b68bdd2d39fff75f82affe955aff9245de246b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-12-08net/packet: fix doc copy/paste-oBrad Fitzpatrick1-1/+1
Change-Id: I0aca490b3ccb0c124192afb362a10b19a15a3e2b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-10-28all: use testingutil.MinAllocsPerRunJosh Bleecher Snyder1-6/+7
There are a few remaining uses of testing.AllocsPerRun: Two in which we only log the number of allocations, and one in which dynamically calculate the allocations target based on a different AllocsPerRun run. This also allows us to tighten the "no allocs" test in wgengine/filter. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-05-20net/packet: use netaddr AppendTo methodsJosh Bleecher Snyder1-31/+11
This lets us remote the types/strbuilder package, which had only a single user. And it's faster. name old time/op new time/op delta String/tcp4-8 175ns ± 0% 58ns ± 1% -66.95% (p=0.000 n=10+9) String/tcp6-8 226ns ± 1% 136ns ± 1% -39.85% (p=0.000 n=10+10) String/udp4-8 175ns ± 1% 58ns ± 1% -67.01% (p=0.000 n=10+9) String/udp6-8 230ns ± 1% 140ns ± 0% -39.32% (p=0.000 n=10+9) String/icmp4-8 164ns ± 0% 50ns ± 1% -69.89% (p=0.000 n=10+10) String/icmp6-8 217ns ± 1% 129ns ± 0% -40.46% (p=0.000 n=10+10) String/igmp-8 196ns ± 0% 56ns ± 1% -71.32% (p=0.000 n=10+10) String/unknown-8 2.06ns ± 1% 2.06ns ± 2% ~ (p=0.985 n=10+10) name old alloc/op new alloc/op delta String/tcp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/tcp6-8 168B ± 0% 96B ± 0% -42.86% (p=0.000 n=10+10) String/udp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/udp6-8 168B ± 0% 96B ± 0% -42.86% (p=0.000 n=10+10) String/icmp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/icmp6-8 104B ± 0% 64B ± 0% -38.46% (p=0.000 n=10+10) String/igmp-8 48.0B ± 0% 48.0B ± 0% ~ (all equal) String/unknown-8 0.00B 0.00B ~ (all equal) name old allocs/op new allocs/op delta String/tcp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/tcp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/udp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/udp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/icmp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/icmp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/igmp-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/unknown-8 0.00 0.00 ~ (all equal) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-05-20net/packet: add BenchmarkStringJosh Bleecher Snyder1-3/+31
Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-05-16all: adapt to opaque netaddr typesJosh Bleecher Snyder2-38/+40
This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-03-29net/{packet,tstun}: send peerapi port in TSMP pongsBrad Fitzpatrick1-6/+13
For discovery when an explicit hostname/IP is known. We'll still also send it via control for finding peers by a list. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-03-24net/packet, wgengine/{filter,tstun}: add TSMP pingBrad Fitzpatrick2-0/+74
Fixes #1467 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-03-20net/packet, wgengine{,/filter}: remove net/packet IPProto forwarding constsBrad Fitzpatrick6-56/+71
Only use the ones in types/ipproto now. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-03-20net/packet, wgengine/filter: support SCTPBrad Fitzpatrick7-74/+76
Add proto to flowtrack.Tuple. Add types/ipproto leaf package to break a cycle. Server-side ACL work remains. Updates #1516 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-03-09wgengine/filter: only log packets to/from non-default routes.David Anderson1-0/+6
Fixes tailscale/corp#1429. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-02-04net/packet: add some more TSMP packet reject reasons and MaybeBroken bitBrad Fitzpatrick2-12/+80
Unused for now, but I want to backport this commit to 1.4 so 1.6 can start sending these and then at least 1.4 logs will stringify nicely. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.