Something went wrong. Try again.
forked from tailscale/tailscale
Something went wrong. Try again.
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317// Copyright (c) Tailscale Inc & contributors// SPDX-License-Identifier: BSD-3-Clause
// Package netstack wires up gVisor's netstack into Tailscale.package netstack
import ( "bytes" "context" "errors" "expvar" "fmt" "io" "math" "net" "net/netip" "runtime" "strconv" "sync" "sync/atomic" "time"
"github.com/tailscale/wireguard-go/conn" "gvisor.dev/gvisor/pkg/refs" "gvisor.dev/gvisor/pkg/tcpip" "gvisor.dev/gvisor/pkg/tcpip/adapters/gonet" "gvisor.dev/gvisor/pkg/tcpip/header" "gvisor.dev/gvisor/pkg/tcpip/network/ipv4" "gvisor.dev/gvisor/pkg/tcpip/network/ipv6" "gvisor.dev/gvisor/pkg/tcpip/stack" "gvisor.dev/gvisor/pkg/tcpip/transport/icmp" "gvisor.dev/gvisor/pkg/tcpip/transport/tcp" "gvisor.dev/gvisor/pkg/tcpip/transport/udp" "gvisor.dev/gvisor/pkg/waiter" "tailscale.com/envknob" "tailscale.com/feature/buildfeatures" "tailscale.com/ipn/ipnlocal" "tailscale.com/metrics" "tailscale.com/net/dns" "tailscale.com/net/ipset" "tailscale.com/net/netaddr" "tailscale.com/net/netx" "tailscale.com/net/packet" "tailscale.com/net/tsaddr" "tailscale.com/net/tsdial" "tailscale.com/net/tstun" "tailscale.com/proxymap" "tailscale.com/syncs" "tailscale.com/tailcfg" "tailscale.com/types/ipproto" "tailscale.com/types/logger" "tailscale.com/types/netmap" "tailscale.com/types/nettype" "tailscale.com/types/views" "tailscale.com/util/clientmetric" "tailscale.com/util/set" "tailscale.com/version" "tailscale.com/wgengine" "tailscale.com/wgengine/filter" "tailscale.com/wgengine/magicsock" "tailscale.com/wgengine/netstack/gro")
const debugPackets = false
// If non-zero, these override the values returned from the corresponding// functions, below.var ( maxInFlightConnectionAttemptsForTest int maxInFlightConnectionAttemptsPerClientForTest int)
// maxInFlightConnectionAttempts returns the global number of in-flight// connection attempts that we allow for a single netstack Impl. Any new// forwarded TCP connections that are opened after the limit has been hit are// rejected until the number of in-flight connections drops below the limit// again.//// Each in-flight connection attempt is a new goroutine and an open TCP// connection, so we want to ensure that we don't allow an unbounded number of// connections.func maxInFlightConnectionAttempts() int { if n := maxInFlightConnectionAttemptsForTest; n > 0 { return n }
if version.IsMobile() { return 1024 // previous global value } switch version.OS() { case "linux": // On the assumption that most subnet routers deployed in // production are running on Linux, we return a higher value. // // TODO(andrew-d): tune this based on the amount of system // memory instead of a fixed limit. return 8192 default: // On all other platforms, return a reasonably high value that // most users won't hit. return 2048 }}
// maxInFlightConnectionAttemptsPerClient is the same as// maxInFlightConnectionAttempts, but applies on a per-client basis// (i.e. keyed by the remote Tailscale IP).func maxInFlightConnectionAttemptsPerClient() int { if n := maxInFlightConnectionAttemptsPerClientForTest; n > 0 { return n }
// For now, allow each individual client at most 2/3rds of the global // limit. On all platforms except mobile, this won't be a visible // change for users since this limit was added at the same time as we // bumped the global limit, above. return maxInFlightConnectionAttempts() * 2 / 3}
var debugNetstack = envknob.RegisterBool("TS_DEBUG_NETSTACK")
// netstackKeepaliveIdle overrides the netstack default (~2h) TCP keepalive// idle time for forwarded connections. When a tailnet peer goes away without// closing its connections (pod deleted, peer removed from netmap, silent// network partition), the forwardTCP io.Copy goroutines block until keepalive// fires. Under high-churn forwarding — many short-lived peers, or peers// holding thousands of proxied connections that drop at once — the 2h default// lets stuck goroutines accumulate faster than they clear. Value is a Go// duration, e.g. "60s". See tailscale/tailscale#4522.var netstackKeepaliveIdle = envknob.RegisterDuration("TS_NETSTACK_KEEPALIVE_IDLE")
// netstackKeepaliveInterval overrides the netstack default (75s) TCP keepalive// probe interval for forwarded connections. Independent of// netstackKeepaliveIdle; setting one without the other leaves the unset knob// at the netstack default. Value is a Go duration, e.g. "15s".var netstackKeepaliveInterval = envknob.RegisterDuration("TS_NETSTACK_KEEPALIVE_INTERVAL")
var ( serviceIP = tsaddr.TailscaleServiceIP() serviceIPv6 = tsaddr.TailscaleServiceIPv6())
func init() { mode := envknob.String("TS_DEBUG_NETSTACK_LEAK_MODE") if mode == "" { return } var lm refs.LeakMode if err := lm.Set(mode); err != nil { panic(err) } refs.SetLeakMode(lm)}
// Impl contains the state for the netstack implementation,// and implements wgengine.FakeImpl to act as a userspace network// stack when Tailscale is running in fake mode.type Impl struct { // GetTCPHandlerForFlow conditionally handles an incoming TCP flow for the // provided (src/port, dst/port) 4-tuple. // // A nil value is equivalent to a func returning (nil, false). // // If func returns intercept=false, the default forwarding behavior (if // ProcessLocalIPs and/or ProcesssSubnetIPs) takes place. // // When intercept=true, the behavior depends on whether the returned handler // is non-nil: if nil, the connection is rejected. If non-nil, handler takes // over the TCP conn. GetTCPHandlerForFlow func(src, dst netip.AddrPort) (handler func(net.Conn), intercept bool)
// GetUDPHandlerForFlow conditionally handles an incoming UDP flow for the // provided (src/port, dst/port) 4-tuple. // // A nil value is equivalent to a func returning (nil, false). // // If func returns intercept=false, the default forwarding behavior (if // ProcessLocalIPs and/or ProcesssSubnetIPs) takes place. // // When intercept=true, the behavior depends on whether the returned handler // is non-nil: if nil, the connection is rejected. If non-nil, handler takes // over the UDP flow. GetUDPHandlerForFlow func(src, dst netip.AddrPort) (handler func(nettype.ConnPacketConn), intercept bool)
// CheckLocalTransportEndpoints, if true, causes netstack to check if gVisor // has a registered endpoint for incoming packets to local IPs. This is used // by tsnet to intercept packets for registered listeners and outbound // connections when ProcessLocalIPs is false (i.e., when using a TUN). // It can only be set before calling Start. // TODO(raggi): refactor the way we handle both CheckLocalTransportEndpoints // and the earlier netstack registrations for serve, funnel, peerAPI and so // on. Currently this optimizes away cost for tailscaled in TUN mode, while // enabling extension support when using tsnet in TUN mode. See #18423. CheckLocalTransportEndpoints bool
// ProcessLocalIPs is whether netstack should handle incoming // traffic directed at the Node.Addresses (local IPs). // It can only be set before calling Start. ProcessLocalIPs bool
// ProcessSubnets is whether netstack should handle incoming // traffic destined to non-local IPs (i.e. whether it should // be a subnet router). // It can only be set before calling Start. ProcessSubnets bool
ipstack *stack.Stack linkEP *linkEndpoint tundev *tstun.Wrapper e wgengine.Engine pm *proxymap.Mapper mc *magicsock.Conn logf logger.Logf dialer *tsdial.Dialer ctx context.Context // alive until Close ctxCancel context.CancelFunc // called on Close lb *ipnlocal.LocalBackend // or nil dns *dns.Manager
// Before Start is called, there can IPv6 Neighbor Discovery from the // OS landing on netstack. We need to drop those packets until Start. ready atomic.Bool // set to true once Start has been called
// loopbackPort, if non-nil, will enable Impl to loop back (dnat to // <address-family-loopback>:loopbackPort) TCP & UDP flows originally // destined to serviceIP{v6}:loopbackPort. loopbackPort *int
peerapiPort4Atomic atomic.Uint32 // uint16 port number for IPv4 peerapi peerapiPort6Atomic atomic.Uint32 // uint16 port number for IPv6 peerapi
// atomicIsLocalIPFunc holds a func that reports whether an IP // is a local (non-subnet) Tailscale IP address of this // machine. It's always a non-nil func. It's changed on netmap // updates. atomicIsLocalIPFunc syncs.AtomicValue[func(netip.Addr) bool]
atomicIsVIPServiceIPFunc syncs.AtomicValue[func(netip.Addr) bool]
atomicIPVIPServiceMap syncs.AtomicValue[netmap.IPServiceMappings] // make this a set of strings for faster lookup atomicActiveVIPServices syncs.AtomicValue[set.Set[tailcfg.ServiceName]]
// forwardDialFunc, if non-nil, is the net.Dialer.DialContext-style // function that is used to make outgoing connections when forwarding a // TCP connection to another host (e.g. in subnet router mode). // // This is currently only used in tests. forwardDialFunc netx.DialFunc
// forwardInFlightPerClientDropped is a metric that tracks how many // in-flight TCP forward requests were dropped due to the per-client // limit. forwardInFlightPerClientDropped expvar.Int
mu sync.Mutex // connsOpenBySubnetIP keeps track of number of connections open // for each subnet IP temporarily registered on netstack for active // TCP connections, so they can be unregistered when connections are // closed. connsOpenBySubnetIP map[netip.Addr]int // connsInFlightByClient keeps track of the number of in-flight // connections by the client ("Tailscale") IP. This is used to apply a // per-client limit on in-flight connections that's smaller than the // global limit, preventing a misbehaving client from starving the // global limit. connsInFlightByClient map[netip.Addr]int // packetsInFlight tracks whether we're already handling a packet by // the given endpoint ID; clients can send repeated SYN packets while // trying to establish a connection (and while we're dialing the // upstream address). If we don't deduplicate based on the endpoint, // each SYN retransmit results in us incrementing // connsInFlightByClient, and not decrementing them because the // underlying TCP forwarder returns 'true' to indicate that the packet // is handled but never actually launches our acceptTCP function. // // This mimics the 'inFlight' map in the TCP forwarder; it's // unfortunate that we have to track this all twice, but thankfully the // map only holds pending (in-flight) packets, and it's reasonably cheap. packetsInFlight map[stack.TransportEndpointID]struct{}}
const nicID = 1
// maxUDPPacketSize is the maximum size of a UDP packet we copy in// startPacketCopy when relaying UDP packets. The user can configure// the tailscale MTU to anything up to this size so we can potentially// have a UDP packet as big as the MTU.const maxUDPPacketSize = tstun.MaxPacketSize
func setTCPBufSizes(ipstack *stack.Stack) error { // tcpip.TCP{Receive,Send}BufferSizeRangeOption is gVisor's version of // Linux's tcp_{r,w}mem. Application within gVisor differs as some Linux // features are not (yet) implemented, and socket buffer memory is not // controlled within gVisor, e.g. we allocate *stack.PacketBuffer's for the // write path within Tailscale. Therefore, we loosen our understanding of // the relationship between these Linux and gVisor tunables. The chosen // values are biased towards higher throughput on high bandwidth-delay // product paths, except on memory-constrained platforms. tcpRXBufOpt := tcpip.TCPReceiveBufferSizeRangeOption{ // Min is unused by gVisor at the time of writing, but partially plumbed // for application by the TCP_WINDOW_CLAMP socket option. Min: tcpRXBufMinSize, // Default is used by gVisor at socket creation. Default: tcpRXBufDefSize, // Max is used by gVisor to cap the advertised receive window post-read. // (tcp_moderate_rcvbuf=true, the default). Max: tcpRXBufMaxSize, } tcpipErr := ipstack.SetTransportProtocolOption(tcp.ProtocolNumber, &tcpRXBufOpt) if tcpipErr != nil { return fmt.Errorf("could not set TCP RX buf size: %v", tcpipErr) } tcpTXBufOpt := tcpip.TCPSendBufferSizeRangeOption{ // Min in unused by gVisor at the time of writing. Min: tcpTXBufMinSize, // Default is used by gVisor at socket creation. Default: tcpTXBufDefSize, // Max is used by gVisor to cap the send window. Max: tcpTXBufMaxSize, } tcpipErr = ipstack.SetTransportProtocolOption(tcp.ProtocolNumber, &tcpTXBufOpt) if tcpipErr != nil { return fmt.Errorf("could not set TCP TX buf size: %v", tcpipErr) } return nil}
// Create creates and populates a new Impl.func Create(logf logger.Logf, tundev *tstun.Wrapper, e wgengine.Engine, mc *magicsock.Conn, dialer *tsdial.Dialer, dns *dns.Manager, pm *proxymap.Mapper) (*Impl, error) { if mc == nil { return nil, errors.New("nil magicsock.Conn") } if tundev == nil { return nil, errors.New("nil tundev") } if logf == nil { return nil, errors.New("nil logger") } if e == nil { return nil, errors.New("nil Engine") } if pm == nil { return nil, errors.New("nil proxymap.Mapper") } if dialer == nil { return nil, errors.New("nil Dialer") } ipstack := stack.New(stack.Options{ NetworkProtocols: []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol}, TransportProtocols: []stack.TransportProtocolFactory{tcp.NewProtocol, udp.NewProtocol, icmp.NewProtocol4, icmp.NewProtocol6}, }) sackEnabledOpt := tcpip.TCPSACKEnabled(true) // TCP SACK is disabled by default tcpipErr := ipstack.SetTransportProtocolOption(tcp.ProtocolNumber, &sackEnabledOpt) if tcpipErr != nil { return nil, fmt.Errorf("could not enable TCP SACK: %v", tcpipErr) } // See https://github.com/tailscale/tailscale/issues/9707 // gVisor's RACK performs poorly. ACKs do not appear to be handled in a // timely manner, leading to spurious retransmissions and a reduced // congestion window. tcpRecoveryOpt := tcpip.TCPRecovery(0) tcpipErr = ipstack.SetTransportProtocolOption(tcp.ProtocolNumber, &tcpRecoveryOpt) if tcpipErr != nil { return nil, fmt.Errorf("could not disable TCP RACK: %v", tcpipErr) } // gVisor defaults to reno at the time of writing. We explicitly set reno // congestion control in order to prevent unexpected changes. Netstack // has an int overflow in sender congestion window arithmetic that is more // prone to trigger with cubic congestion control. // See https://github.com/google/gvisor/issues/11632 renoOpt := tcpip.CongestionControlOption("reno") tcpipErr = ipstack.SetTransportProtocolOption(tcp.ProtocolNumber, &renoOpt) if tcpipErr != nil { return nil, fmt.Errorf("could not set reno congestion control: %v", tcpipErr) } err := setTCPBufSizes(ipstack) if err != nil { return nil, err } supportedGSOKind := stack.GSONotSupported supportedGROKind := groNotSupported if runtime.GOOS == "linux" && buildfeatures.HasGRO { // TODO(jwhited): add Windows support https://github.com/tailscale/corp/issues/21874 supportedGROKind = tcpGROSupported supportedGSOKind = stack.HostGSOSupported } linkEP := newLinkEndpoint(512, uint32(tstun.DefaultTUNMTU()), "", supportedGROKind) linkEP.SupportedGSOKind = supportedGSOKind if tcpipProblem := ipstack.CreateNIC(nicID, linkEP); tcpipProblem != nil { return nil, fmt.Errorf("could not create netstack NIC: %v", tcpipProblem) } // By default the netstack NIC will only accept packets for the IPs // registered to it. Since in some cases we dynamically register IPs // based on the packets that arrive, the NIC needs to accept all // incoming packets. The NIC won't receive anything it isn't meant to // since WireGuard will only send us packets that are meant for us. ipstack.SetPromiscuousMode(nicID, true) // Add IPv4 and IPv6 default routes, so all incoming packets from the Tailscale side // are handled by the one fake NIC we use. ipv4Subnet, err := tcpip.NewSubnet(tcpip.AddrFromSlice(make([]byte, 4)), tcpip.MaskFromBytes(make([]byte, 4))) if err != nil { return nil, fmt.Errorf("could not create IPv4 subnet: %v", err) } ipv6Subnet, err := tcpip.NewSubnet(tcpip.AddrFromSlice(make([]byte, 16)), tcpip.MaskFromBytes(make([]byte, 16))) if err != nil { return nil, fmt.Errorf("could not create IPv6 subnet: %v", err) } ipstack.SetRouteTable([]tcpip.Route{ { Destination: ipv4Subnet, NIC: nicID, }, { Destination: ipv6Subnet, NIC: nicID, }, }) ns := &Impl{ logf: logf, ipstack: ipstack, linkEP: linkEP, tundev: tundev, e: e, pm: pm, mc: mc, dialer: dialer, connsOpenBySubnetIP: make(map[netip.Addr]int), connsInFlightByClient: make(map[netip.Addr]int), packetsInFlight: make(map[stack.TransportEndpointID]struct{}), dns: dns, } loopbackPort, ok := envknob.LookupInt("TS_DEBUG_NETSTACK_LOOPBACK_PORT") if ok && loopbackPort >= 0 && loopbackPort <= math.MaxUint16 { ns.loopbackPort = &loopbackPort } ns.ctx, ns.ctxCancel = context.WithCancel(context.Background()) ns.atomicIsLocalIPFunc.Store(ipset.FalseContainsIPFunc()) ns.atomicIsVIPServiceIPFunc.Store(ipset.FalseContainsIPFunc()) ns.tundev.PostFilterPacketInboundFromWireGuard = ns.injectInbound ns.tundev.PreFilterPacketOutboundToWireGuardNetstackIntercept = ns.handleLocalPackets stacksForMetrics.Store(ns, struct{}{}) return ns, nil}
func (ns *Impl) Close() error { stacksForMetrics.Delete(ns) ns.ctxCancel() ns.ipstack.Close() ns.ipstack.Wait() return nil}
// SetTransportProtocolOption forwards to the underlying// [stack.Stack.SetTransportProtocolOption]. Callers are responsible for// ensuring that the options are valid, compatible and appropriate for their use// case. Compatibility may change at any version.func (ns *Impl) SetTransportProtocolOption(transport tcpip.TransportProtocolNumber, option tcpip.SettableTransportProtocolOption) tcpip.Error { return ns.ipstack.SetTransportProtocolOption(transport, option)}
// A single process might have several netstacks running at the same time.// Exported clientmetric counters will have a sum of counters of all of them.var stacksForMetrics syncs.Map[*Impl, struct{}]
func init() { // Please take care to avoid exporting clientmetrics with the same metric // names as the ones used by Impl.ExpVar. Both get exposed via the same HTTP // endpoint, and name collisions will result in Prometheus scraping errors. clientmetric.NewCounterFunc("netstack_tcp_forward_dropped_attempts", func() int64 { var total uint64 for ns := range stacksForMetrics.Keys() { delta := ns.ipstack.Stats().TCP.ForwardMaxInFlightDrop.Value() if total+delta > math.MaxInt64 { total = math.MaxInt64 break } total += delta } return int64(total) })}
type protocolHandlerFunc func(stack.TransportEndpointID, *stack.PacketBuffer) bool
// wrapUDPProtocolHandler wraps the protocol handler we pass to netstack for UDP.func (ns *Impl) wrapUDPProtocolHandler(h protocolHandlerFunc) protocolHandlerFunc { return func(tei stack.TransportEndpointID, pb *stack.PacketBuffer) bool { addr := tei.LocalAddress ip, ok := netip.AddrFromSlice(addr.AsSlice()) if !ok { ns.logf("netstack: could not parse local address for incoming connection") return false }
// Dynamically reconfigure ns's subnet addresses as needed for // outbound traffic. ip = ip.Unmap() if !ns.isLocalIP(ip) { ns.addSubnetAddress(ip) } return h(tei, pb) }}
var ( metricPerClientForwardLimit = clientmetric.NewCounter("netstack_tcp_forward_dropped_attempts_per_client"))
// wrapTCPProtocolHandler wraps the protocol handler we pass to netstack for TCP.func (ns *Impl) wrapTCPProtocolHandler(h protocolHandlerFunc) protocolHandlerFunc { // 'handled' is whether the packet should be accepted by netstack; if // true, then the TCP connection is accepted by the transport layer and // passes through our acceptTCP handler/etc. If false, then the packet // is dropped and the TCP connection is rejected (typically with an // ICMP Port Unreachable or ICMP Protocol Unreachable message). return func(tei stack.TransportEndpointID, pb *stack.PacketBuffer) (handled bool) { localIP, ok := netip.AddrFromSlice(tei.LocalAddress.AsSlice()) if !ok { ns.logf("netstack: could not parse local address for incoming connection") return false } localIP = localIP.Unmap()
remoteIP, ok := netip.AddrFromSlice(tei.RemoteAddress.AsSlice()) if !ok { ns.logf("netstack: could not parse remote address for incoming connection") return false }
// If we have too many in-flight connections for this client, abort // early and don't open a new one. // // NOTE: the counter is decremented in // decrementInFlightTCPForward, called from the acceptTCP // function, below.
ns.mu.Lock() if _, ok := ns.packetsInFlight[tei]; ok { // We're already handling this packet; just bail early // (this is also what would happen in the TCP // forwarder). ns.mu.Unlock() return true }
// Check the per-client limit. inFlight := ns.connsInFlightByClient[remoteIP] tooManyInFlight := inFlight >= maxInFlightConnectionAttemptsPerClient() if !tooManyInFlight { ns.connsInFlightByClient[remoteIP]++ }
// We're handling this packet now; see the comment on the // packetsInFlight field for more details. ns.packetsInFlight[tei] = struct{}{} ns.mu.Unlock()
if debugNetstack() { ns.logf("[v2] netstack: in-flight connections for client %v: %d", remoteIP, inFlight) } if tooManyInFlight { ns.logf("netstack: ignoring a new TCP connection from %v to %v because the client already has %d in-flight connections", localIP, remoteIP, inFlight) metricPerClientForwardLimit.Add(1) ns.forwardInFlightPerClientDropped.Add(1) return false // unhandled }
// On return, if this packet isn't handled by the inner handler // we're wrapping (`h`), we need to decrement the per-client // in-flight count and remove the ID from our tracking map. // This can happen if the underlying forwarder's limit has been // reached, at which point it will return false to indicate // that it's not handling the packet, and it will not run // acceptTCP. If we don't decrement here, then we would // eventually increment the per-client counter up to the limit // and never decrement because we'd never hit the codepath in // acceptTCP, below, or just drop all packets from the same // endpoint due to the packetsInFlight check. defer func() { if !handled { ns.mu.Lock() delete(ns.packetsInFlight, tei) ns.connsInFlightByClient[remoteIP]-- new := ns.connsInFlightByClient[remoteIP] ns.mu.Unlock() ns.logf("netstack: decrementing connsInFlightByClient[%v] because the packet was not handled; new value is %d", remoteIP, new) } }()
// Dynamically reconfigure ns's subnet addresses as needed for // outbound traffic. if !ns.isLocalIP(localIP) && !ns.isVIPServiceIP(localIP) { ns.addSubnetAddress(localIP) }
return h(tei, pb) }}
func (ns *Impl) decrementInFlightTCPForward(tei stack.TransportEndpointID, remoteAddr netip.Addr) { ns.mu.Lock() defer ns.mu.Unlock()
// Remove this packet so future SYNs from this address will be handled. delete(ns.packetsInFlight, tei)
was := ns.connsInFlightByClient[remoteAddr] newVal := was - 1 if newVal == 0 { delete(ns.connsInFlightByClient, remoteAddr) // free up space in the map } else { ns.connsInFlightByClient[remoteAddr] = newVal }}
// LocalBackend is a fake name for *ipnlocal.LocalBackend to avoid an import cycle.type LocalBackend = any
// Start sets up all the handlers so netstack can start working. Implements// wgengine.FakeImpl.//// The provided LocalBackend interface can be either nil, for special case users// of netstack that don't have a LocalBackend, or a non-nil// *ipnlocal.LocalBackend. Any other type will cause Start to panic.//// Start currently (2026-03-11) never returns a non-nil error, but maybe it did// in the past and maybe it will in the future.func (ns *Impl) Start(b LocalBackend) error { switch b := b.(type) { case nil: // No backend, so just continue with ns.lb unset. case *ipnlocal.LocalBackend: if b == nil { panic("nil LocalBackend") } ns.lb = b default: panic(fmt.Sprintf("unexpected type for LocalBackend: %T", b)) } tcpFwd := tcp.NewForwarder(ns.ipstack, tcpRXBufDefSize, maxInFlightConnectionAttempts(), ns.acceptTCP) udpFwd := udp.NewForwarder(ns.ipstack, ns.acceptUDPNoICMP) ns.ipstack.SetTransportProtocolHandler(tcp.ProtocolNumber, ns.wrapTCPProtocolHandler(tcpFwd.HandlePacket)) ns.ipstack.SetTransportProtocolHandler(udp.ProtocolNumber, ns.wrapUDPProtocolHandler(udpFwd.HandlePacket)) go ns.inject() if ns.ready.Swap(true) { panic("already started") } return nil}
func (ns *Impl) addSubnetAddress(ip netip.Addr) { ns.mu.Lock() ns.connsOpenBySubnetIP[ip]++ needAdd := ns.connsOpenBySubnetIP[ip] == 1 ns.mu.Unlock() // Only register address into netstack for first concurrent connection. if needAdd { pa := tcpip.ProtocolAddress{ AddressWithPrefix: tcpip.AddrFromSlice(ip.AsSlice()).WithPrefix(), } if ip.Is4() { pa.Protocol = ipv4.ProtocolNumber } else if ip.Is6() { pa.Protocol = ipv6.ProtocolNumber } ns.ipstack.AddProtocolAddress(nicID, pa, stack.AddressProperties{ PEB: stack.CanBePrimaryEndpoint, // zero value default ConfigType: stack.AddressConfigStatic, // zero value default }) }}
func (ns *Impl) removeSubnetAddress(ip netip.Addr) { ns.mu.Lock() defer ns.mu.Unlock() ns.connsOpenBySubnetIP[ip]-- // Only unregister address from netstack after last concurrent connection. if ns.connsOpenBySubnetIP[ip] == 0 { ns.ipstack.RemoveAddress(nicID, tcpip.AddrFromSlice(ip.AsSlice())) delete(ns.connsOpenBySubnetIP, ip) }}
func ipPrefixToAddressWithPrefix(ipp netip.Prefix) tcpip.AddressWithPrefix { return tcpip.AddressWithPrefix{ Address: tcpip.AddrFromSlice(ipp.Addr().AsSlice()), PrefixLen: int(ipp.Bits()), }}
var v4broadcast = netaddr.IPv4(255, 255, 255, 255)
// UpdateNetstackIPs updates the set of local IPs that netstack should handle// from nm.//// TODO(bradfitz): don't pass the whole netmap here; just pass the two// address slice views.func (ns *Impl) UpdateNetstackIPs(nm *netmap.NetworkMap) { var selfNode tailcfg.NodeView var serviceAddrSet set.Set[netip.Addr] if nm != nil { ns.atomicIsLocalIPFunc.Store(ipset.NewContainsIPFunc(nm.GetAddresses())) if buildfeatures.HasServe { vipServiceIPMap := nm.GetVIPServiceIPMap() serviceAddrSet = make(set.Set[netip.Addr], len(vipServiceIPMap)*2) for _, addrs := range vipServiceIPMap { serviceAddrSet.AddSlice(addrs) } ns.atomicIsVIPServiceIPFunc.Store(serviceAddrSet.Contains) } selfNode = nm.SelfNode } else { ns.atomicIsLocalIPFunc.Store(ipset.FalseContainsIPFunc()) ns.atomicIsVIPServiceIPFunc.Store(ipset.FalseContainsIPFunc()) }
oldPfx := make(map[netip.Prefix]bool) for _, protocolAddr := range ns.ipstack.AllAddresses()[nicID] { ap := protocolAddr.AddressWithPrefix ip := netaddrIPFromNetstackIP(ap.Address) if ip == v4broadcast && ap.PrefixLen == 32 { // Don't add 255.255.255.255/32 to oldIPs so we don't // delete it later. We didn't install it, so it's not // ours to delete. continue } p := netip.PrefixFrom(ip, ap.PrefixLen) oldPfx[p] = true } newPfx := make(map[netip.Prefix]bool)
if selfNode.Valid() { for _, p := range selfNode.Addresses().All() { newPfx[p] = true } if ns.ProcessSubnets { for _, p := range selfNode.AllowedIPs().All() { newPfx[p] = true } } }
for addr := range serviceAddrSet { p := netip.PrefixFrom(addr, addr.BitLen()) newPfx[p] = true }
pfxToAdd := make(map[netip.Prefix]bool) for p := range newPfx { if !oldPfx[p] { pfxToAdd[p] = true } } pfxToRemove := make(map[netip.Prefix]bool) for p := range oldPfx { if !newPfx[p] { pfxToRemove[p] = true } } ns.mu.Lock() for ip := range ns.connsOpenBySubnetIP { // TODO(maisem): this looks like a bug, remove or document. It seems as // though we might end up either leaking the address on the netstack // NIC, or where we do accounting for connsOpenBySubnetIP from 1 to 0, // we might end up removing the address from the netstack NIC that was // still being advertised. delete(pfxToRemove, netip.PrefixFrom(ip, ip.BitLen())) } ns.mu.Unlock()
for p := range pfxToRemove { err := ns.ipstack.RemoveAddress(nicID, tcpip.AddrFromSlice(p.Addr().AsSlice())) if err != nil { ns.logf("netstack: could not deregister IP %s: %v", p, err) } else { ns.logf("[v2] netstack: deregistered IP %s", p) } } for p := range pfxToAdd { if !p.IsValid() { ns.logf("netstack: [unexpected] skipping invalid IP (%v/%v)", p.Addr(), p.Bits()) continue } tcpAddr := tcpip.ProtocolAddress{ AddressWithPrefix: ipPrefixToAddressWithPrefix(p), } if p.Addr().Is6() { tcpAddr.Protocol = ipv6.ProtocolNumber } else { tcpAddr.Protocol = ipv4.ProtocolNumber } var tcpErr tcpip.Error // not error tcpErr = ns.ipstack.AddProtocolAddress(nicID, tcpAddr, stack.AddressProperties{ PEB: stack.CanBePrimaryEndpoint, // zero value default ConfigType: stack.AddressConfigStatic, // zero value default }) if tcpErr != nil { ns.logf("netstack: could not register IP %s: %v", p, tcpErr) } else { ns.logf("[v2] netstack: registered IP %s", p) } }}
// UpdateIPServiceMappings updates the IPServiceMappings when there is a change// in this value in localbackend. This is usually triggered from a netmap update.func (ns *Impl) UpdateIPServiceMappings(mappings netmap.IPServiceMappings) { ns.mu.Lock() defer ns.mu.Unlock() ns.atomicIPVIPServiceMap.Store(mappings)}
// UpdateActiveVIPServices updates the set of active VIP services names.func (ns *Impl) UpdateActiveVIPServices(activeServices views.Slice[string]) { ns.mu.Lock() defer ns.mu.Unlock() activeServicesSet := make(set.Set[tailcfg.ServiceName], activeServices.Len()) for _, s := range activeServices.All() { activeServicesSet.Add(tailcfg.AsServiceName(s)) } ns.atomicActiveVIPServices.Store(activeServicesSet)}
func (ns *Impl) isLoopbackPort(port uint16) bool { if ns.loopbackPort != nil && int(port) == *ns.loopbackPort { return true } return false}
// handleLocalPackets is hooked into the tun datapath for packets leaving// the host and arriving at tailscaled. This method returns filter.DropSilently// to intercept a packet for handling, for instance traffic to quad-100.// Caution: can be called before Startfunc (ns *Impl) handleLocalPackets(p *packet.Parsed, t *tstun.Wrapper, gro *gro.GRO) (filter.Response, *gro.GRO) { if !ns.ready.Load() || ns.ctx.Err() != nil { return filter.DropSilently, gro }
// Determine if we care about this local packet. dst := p.Dst.Addr() serviceName, isVIPServiceIP := ns.atomicIPVIPServiceMap.Load()[dst] switch { case dst == serviceIP || dst == serviceIPv6: // We want to intercept some traffic to the "service IP" (e.g. // 100.100.100.100 for IPv4). However, of traffic to the // service IP, we only care about UDP 53, and TCP on port 53, // 80, and 8080. switch p.IPProto { case ipproto.TCP: if port := p.Dst.Port(); port != 53 && port != 80 && port != 8080 && !ns.isLoopbackPort(port) { return filter.Accept, gro } case ipproto.UDP: if port := p.Dst.Port(); port != 53 && !ns.isLoopbackPort(port) { return filter.Accept, gro } } case isVIPServiceIP: // returns all active VIP services in a set, since the IPVIPServiceMap // contains inactive service IPs when node hosts the service, we need to // check the service is active or not before dropping the packet. activeServices := ns.atomicActiveVIPServices.Load() if !activeServices.Contains(serviceName) { // Other host might have the service active, so we let the packet go through. return filter.Accept, gro } if p.IPProto != ipproto.TCP { // We currenly only support VIP services over TCP. If service is in Tun mode, // it's up to the service host to set up local packet handling which shouldn't // arrive here. return filter.DropSilently, gro } if debugNetstack() { ns.logf("netstack: intercepting local VIP service packet: proto=%v dst=%v src=%v", p.IPProto, p.Dst, p.Src) } case viaRange.Contains(dst): // We need to handle 4via6 packets leaving the host if the via // route is for this host; otherwise the packet will be dropped // because nothing will translate it. var shouldHandle bool if p.IPVersion == 6 && !ns.isLocalIP(dst) { shouldHandle = ns.lb != nil && ns.lb.ShouldHandleViaIP(dst) } if !shouldHandle { // Unhandled means that we let the regular processing // occur without doing anything ourselves. return filter.Accept, gro }
if debugNetstack() { ns.logf("netstack: handling local 4via6 packet: version=%d proto=%v dst=%v src=%v", p.IPVersion, p.IPProto, p.Dst, p.Src) }
// If this is a ping message, handle it and don't pass to // netstack. pingIP, handlePing := ns.shouldHandlePing(p) if handlePing { ns.logf("netstack: handling local 4via6 ping: dst=%v pingIP=%v", dst, pingIP)
var pong []byte // the reply to the ping, if our relayed ping works if dst.Is4() { h := p.ICMP4Header() h.ToResponse() pong = packet.Generate(&h, p.Payload()) } else if dst.Is6() { h := p.ICMP6Header() h.ToResponse() pong = packet.Generate(&h, p.Payload()) }
go ns.userPing(pingIP, pong, userPingDirectionInbound) return filter.DropSilently, gro }
// Fall through to writing inbound so netstack handles the // 4via6 via connection.
default: // Not traffic to the service IP or a 4via6 IP, so we don't // care about the packet; resume processing. return filter.Accept, gro } if debugPackets { ns.logf("[v2] service packet in (from %v): % x", p.Src, p.Buffer()) }
gro = ns.linkEP.gro(p, gro) return filter.DropSilently, gro}
func (ns *Impl) DialContextTCP(ctx context.Context, ipp netip.AddrPort) (*gonet.TCPConn, error) { remoteAddress := tcpip.FullAddress{ NIC: nicID, Addr: tcpip.AddrFromSlice(ipp.Addr().AsSlice()), Port: ipp.Port(), } var ipType tcpip.NetworkProtocolNumber if ipp.Addr().Is4() { ipType = ipv4.ProtocolNumber } else { ipType = ipv6.ProtocolNumber }
return gonet.DialContextTCP(ctx, ns.ipstack, remoteAddress, ipType)}
// DialContextTCPWithBind creates a new gonet.TCPConn connected to the specified// remoteAddress with its local address bound to localAddr on an available port.func (ns *Impl) DialContextTCPWithBind(ctx context.Context, localAddr netip.Addr, remoteAddr netip.AddrPort) (*gonet.TCPConn, error) { remoteAddress := tcpip.FullAddress{ NIC: nicID, Addr: tcpip.AddrFromSlice(remoteAddr.Addr().AsSlice()), Port: remoteAddr.Port(), } localAddress := tcpip.FullAddress{ NIC: nicID, Addr: tcpip.AddrFromSlice(localAddr.AsSlice()), } var ipType tcpip.NetworkProtocolNumber if remoteAddr.Addr().Is4() { ipType = ipv4.ProtocolNumber } else { ipType = ipv6.ProtocolNumber } return gonet.DialTCPWithBind(ctx, ns.ipstack, localAddress, remoteAddress, ipType)}
func (ns *Impl) DialContextUDP(ctx context.Context, ipp netip.AddrPort) (*gonet.UDPConn, error) { remoteAddress := &tcpip.FullAddress{ NIC: nicID, Addr: tcpip.AddrFromSlice(ipp.Addr().AsSlice()), Port: ipp.Port(), } var ipType tcpip.NetworkProtocolNumber if ipp.Addr().Is4() { ipType = ipv4.ProtocolNumber } else { ipType = ipv6.ProtocolNumber }
return gonet.DialUDP(ns.ipstack, nil, remoteAddress, ipType)}
// DialContextUDPWithBind creates a new gonet.UDPConn. Connected to remoteAddr.// With its local address bound to localAddr on an available port.func (ns *Impl) DialContextUDPWithBind(ctx context.Context, localAddr netip.Addr, remoteAddr netip.AddrPort) (*gonet.UDPConn, error) { remoteAddress := &tcpip.FullAddress{ NIC: nicID, Addr: tcpip.AddrFromSlice(remoteAddr.Addr().AsSlice()), Port: remoteAddr.Port(), } localAddress := &tcpip.FullAddress{ NIC: nicID, Addr: tcpip.AddrFromSlice(localAddr.AsSlice()), } var ipType tcpip.NetworkProtocolNumber if remoteAddr.Addr().Is4() { ipType = ipv4.ProtocolNumber } else { ipType = ipv6.ProtocolNumber }
return gonet.DialUDP(ns.ipstack, localAddress, remoteAddress, ipType)}
// getInjectInboundBuffsSizes returns packet memory and a sizes slice for usage// when calling tstun.Wrapper.InjectInboundPacketBuffer(). These are sized with// consideration for MTU and GSO support on ns.linkEP. They should be recycled// across subsequent inbound packet injection calls.func (ns *Impl) getInjectInboundBuffsSizes() (buffs [][]byte, sizes []int) { batchSize := 1 gsoEnabled := ns.linkEP.SupportedGSO() == stack.HostGSOSupported if gsoEnabled { batchSize = conn.IdealBatchSize } buffs = make([][]byte, batchSize) sizes = make([]int, batchSize) for i := 0; i < batchSize; i++ { if i == 0 && gsoEnabled { buffs[i] = make([]byte, tstun.PacketStartOffset+ns.linkEP.GSOMaxSize()) } else { buffs[i] = make([]byte, tstun.PacketStartOffset+tstun.DefaultTUNMTU()) } } return buffs, sizes}
// The inject goroutine reads in packets that netstack generated, and delivers// them to the correct path.func (ns *Impl) inject() { inboundBuffs, inboundBuffsSizes := ns.getInjectInboundBuffsSizes() for { pkt := ns.linkEP.ReadContext(ns.ctx) if pkt == nil { if ns.ctx.Err() != nil { // Return without logging. return } ns.logf("[v2] ReadContext-for-write = ok=false") continue }
if debugPackets { ns.logf("[v2] packet Write out: % x", stack.PayloadSince(pkt.NetworkHeader()).AsSlice()) }
// In the normal case, netstack synthesizes the bytes for // traffic which should transit back into WG and go to peers. // However, some uses of netstack (presently, magic DNS) // send traffic destined for the local device, hence must // be injected 'inbound'. sendToHost := ns.shouldSendToHost(pkt)
// pkt has a non-zero refcount, so injection methods takes // ownership of one count and will decrement on completion. if sendToHost { if err := ns.tundev.InjectInboundPacketBuffer(pkt, inboundBuffs, inboundBuffsSizes); err != nil { ns.logf("netstack inject inbound: %v", err) return } } else { // Self-addressed packet: deliver back into gVisor directly // via the link endpoint's dispatcher, but only if the packet is not // earmarked for the host. Neither the inbound path (fakeTUN Write is a // no-op) nor the outbound path (WireGuard has no peer for our own IP) // can handle these. if ns.isSelfDst(pkt) { ns.linkEP.DeliverLoopback(pkt) continue }
if err := ns.tundev.InjectOutboundPacketBuffer(pkt); err != nil { ns.logf("netstack inject outbound: %v", err) return } } }}
// shouldSendToHost determines if the provided packet should be sent to the// host (i.e the current machine running Tailscale), in which case it will// return true. It will return false if the packet should be sent outbound, for// transit via WireGuard to another Tailscale node.func (ns *Impl) shouldSendToHost(pkt *stack.PacketBuffer) bool { // Determine if the packet is from a service IP (100.100.100.100 or the // IPv6 variant), in which case it needs to go back into the machine's // network (inbound) instead of out. hdr := pkt.Network() switch v := hdr.(type) { case header.IPv4: srcIP := netip.AddrFrom4(v.SourceAddress().As4()) if serviceIP == srcIP { return true }
if ns.isVIPServiceIP(srcIP) { dstIP := netip.AddrFrom4(v.DestinationAddress().As4()) if ns.isLocalIP(dstIP) { if debugNetstack() { ns.logf("netstack: sending VIP service packet to host: src=%v dst=%v", srcIP, dstIP) } return true } }
case header.IPv6: srcIP := netip.AddrFrom16(v.SourceAddress().As16()) if srcIP == serviceIPv6 { return true }
if ns.isVIPServiceIP(srcIP) { dstIP := netip.AddrFrom16(v.DestinationAddress().As16()) if ns.isLocalIP(dstIP) { if debugNetstack() { ns.logf("netstack: sending VIP service packet to host: src=%v dst=%v", srcIP, dstIP) } return true } }
if viaRange.Contains(srcIP) { // Only send to the host if this 4via6 route is // something this node handles. if ns.lb != nil && ns.lb.ShouldHandleViaIP(srcIP) { dstIP := netip.AddrFrom16(v.DestinationAddress().As16()) // Also, only forward to the host if the packet // is destined for a local IP; otherwise, we'd // send traffic that's intended for another // peer from the local 4via6 address to the // host instead of outbound to WireGuard. See: // https://github.com/tailscale/tailscale/issues/12448 if ns.isLocalIP(dstIP) { return true } if debugNetstack() { ns.logf("netstack: sending 4via6 packet to host: src=%v dst=%v", srcIP, dstIP) } } } default: // unknown; don't forward to host if debugNetstack() { ns.logf("netstack: unexpected packet in shouldSendToHost: %T", v) } }
return false}
// isSelfDst reports whether pkt's destination IP is a local Tailscale IP// assigned to this node. This is used by inject() to detect self-addressed// packets that need loopback delivery.func (ns *Impl) isSelfDst(pkt *stack.PacketBuffer) bool { hdr := pkt.Network() switch v := hdr.(type) { case header.IPv4: return ns.isLocalIP(netip.AddrFrom4(v.DestinationAddress().As4())) case header.IPv6: return ns.isLocalIP(netip.AddrFrom16(v.DestinationAddress().As16())) } return false}
// isLocalIP reports whether ip is a Tailscale IP assigned to this// node directly (but not a subnet-routed IP).func (ns *Impl) isLocalIP(ip netip.Addr) bool { return ns.atomicIsLocalIPFunc.Load()(ip)}
// isVIPServiceIP reports whether ip is an IP address that's// assigned to a VIP service.func (ns *Impl) isVIPServiceIP(ip netip.Addr) bool { if !buildfeatures.HasServe { return false } return ns.atomicIsVIPServiceIPFunc.Load()(ip)}
func (ns *Impl) peerAPIPortAtomic(ip netip.Addr) *atomic.Uint32 { if ip.Is4() { return &ns.peerapiPort4Atomic } else { return &ns.peerapiPort6Atomic }}
var viaRange = tsaddr.TailscaleViaRange()
// shouldProcessInbound reports whether an inbound packet (a packet from a// WireGuard peer) should be handled by netstack.func (ns *Impl) shouldProcessInbound(p *packet.Parsed, t *tstun.Wrapper) bool { // Handle incoming peerapi connections in netstack. dstIP := p.Dst.Addr() isLocal := ns.isLocalIP(dstIP) isService := ns.isVIPServiceIP(dstIP)
// Handle TCP connection to the Tailscale IP(s) in some cases: if ns.lb != nil && p.IPProto == ipproto.TCP && isLocal { var peerAPIPort uint16
if p.TCPFlags&packet.TCPSynAck == packet.TCPSyn { if port, ok := ns.lb.GetPeerAPIPort(dstIP); ok { peerAPIPort = port ns.peerAPIPortAtomic(dstIP).Store(uint32(port)) } } else { peerAPIPort = uint16(ns.peerAPIPortAtomic(dstIP).Load()) } dport := p.Dst.Port() if dport == peerAPIPort { return true } // Also handle SSH connections, webserver, etc, if enabled: if ns.lb.ShouldInterceptTCPPort(dport) { return true } } if buildfeatures.HasServe && isService { if p.IsEchoRequest() { return true } if ns.lb != nil && p.IPProto == ipproto.TCP { // An assumption holds for this to work: when tun mode is on for a service, // its tcp and web are not set. This is enforced in b.setServeConfigLocked. if ns.lb.ShouldInterceptVIPServiceTCPPort(p.Dst) { return true } } return false } if p.IPVersion == 6 && !isLocal && viaRange.Contains(dstIP) { return ns.lb != nil && ns.lb.ShouldHandleViaIP(dstIP) } if ns.ProcessLocalIPs && isLocal { return true } if ns.ProcessSubnets && !isLocal { return true } if isLocal && ns.CheckLocalTransportEndpoints { // Handle packets to registered listeners and replies to outbound // connections by checking if gVisor has a registered endpoint. // This covers TCP listeners, UDP listeners, and outbound TCP replies. if p.IPProto == ipproto.TCP || p.IPProto == ipproto.UDP { var netProto tcpip.NetworkProtocolNumber var id stack.TransportEndpointID if p.Dst.Addr().Is4() { netProto = ipv4.ProtocolNumber id = stack.TransportEndpointID{ LocalAddress: tcpip.AddrFrom4(p.Dst.Addr().As4()), LocalPort: p.Dst.Port(), RemoteAddress: tcpip.AddrFrom4(p.Src.Addr().As4()), RemotePort: p.Src.Port(), } } else { netProto = ipv6.ProtocolNumber id = stack.TransportEndpointID{ LocalAddress: tcpip.AddrFrom16(p.Dst.Addr().As16()), LocalPort: p.Dst.Port(), RemoteAddress: tcpip.AddrFrom16(p.Src.Addr().As16()), RemotePort: p.Src.Port(), } } var transProto tcpip.TransportProtocolNumber if p.IPProto == ipproto.TCP { transProto = tcp.ProtocolNumber } else { transProto = udp.ProtocolNumber } ep := ns.ipstack.FindTransportEndpoint(netProto, transProto, id, nicID) if debugNetstack() { ns.logf("[v2] FindTransportEndpoint: id=%+v found=%v", id, ep != nil) } if ep != nil { return true } } } return false}
var userPingSem = syncs.NewSemaphore(20) // 20 child ping processes at once
type userPingDirection int
const ( // userPingDirectionOutbound is used when the pong packet is to be sent // "outbound"–i.e. from this node to a peer via WireGuard. userPingDirectionOutbound userPingDirection = iota // userPingDirectionInbound is used when the pong packet is to be sent // "inbound"–i.e. from Tailscale to another process on this host. userPingDirectionInbound)
// userPing tried to ping dstIP and if it succeeds, injects pingResPkt// into the tundev.//// It's used in userspace/netstack mode when we don't have kernel// support or raw socket access. As such, this does the dumbest thing// that can work: runs the ping command. It's not super efficient, so// it bounds the number of pings going on at once. The idea is that// people only use ping occasionally to see if their internet's working// so this doesn't need to be great.// On Apple platforms, this function doesn't run the ping command. Instead,// it sends a non-privileged ping.//// The 'direction' parameter is used to determine where the response "pong"// packet should be written, if the ping succeeds. See the documentation on the// constants for more details.//// TODO(bradfitz): when we're running on Windows as the system user, use// raw socket APIs instead of ping child processes.func (ns *Impl) userPing(dstIP netip.Addr, pingResPkt []byte, direction userPingDirection) { if !userPingSem.TryAcquire() { return } defer userPingSem.Release()
t0 := time.Now() err := ns.sendOutboundUserPing(dstIP, 3*time.Second) d := time.Since(t0) if err != nil { if d < time.Second/2 { // If it failed quicker than the 3 second // timeout we gave above (500 ms is a // reasonable threshold), then assume the ping // failed for problems finding/running // ping. We don't want to log if the host is // just down. ns.logf("exec ping of %v failed in %v: %v", dstIP, d, err) } return } if debugNetstack() { ns.logf("exec pinged %v in %v", dstIP, time.Since(t0)) } if direction == userPingDirectionOutbound { if err := ns.tundev.InjectOutbound(pingResPkt); err != nil { ns.logf("InjectOutbound ping response: %v", err) } } else if direction == userPingDirectionInbound { if err := ns.tundev.InjectInboundCopy(pingResPkt); err != nil { ns.logf("InjectInboundCopy ping response: %v", err) } }}
// injectInbound is installed as a packet hook on the 'inbound' (from a// WireGuard peer) path. Returning filter.Accept releases the packet to// continue normally (typically being delivered to the host networking stack),// whereas returning filter.DropSilently is done when netstack intercepts the// packet and no further processing towards to host should be done.// Caution: can be called before Startfunc (ns *Impl) injectInbound(p *packet.Parsed, t *tstun.Wrapper, gro *gro.GRO) (filter.Response, *gro.GRO) { if !ns.ready.Load() || ns.ctx.Err() != nil { return filter.DropSilently, gro }
if !ns.shouldProcessInbound(p, t) { // Let the host network stack (if any) deal with it. return filter.Accept, gro }
destIP := p.Dst.Addr()
// If this is an echo request and we're a subnet router, handle pings // ourselves instead of forwarding the packet on. pingIP, handlePing := ns.shouldHandlePing(p) if handlePing { var pong []byte // the reply to the ping, if our relayed ping works if destIP.Is4() { h := p.ICMP4Header() h.ToResponse() pong = packet.Generate(&h, p.Payload()) } else if destIP.Is6() { h := p.ICMP6Header() h.ToResponse() pong = packet.Generate(&h, p.Payload()) } go ns.userPing(pingIP, pong, userPingDirectionOutbound) return filter.DropSilently, gro }
if debugPackets { ns.logf("[v2] packet in (from %v): % x", p.Src, p.Buffer()) } gro = ns.linkEP.gro(p, gro)
// We've now delivered this to netstack, so we're done. // Instead of returning a filter.Accept here (which would also // potentially deliver it to the host OS), and instead of // filter.Drop (which would log about rejected traffic), // instead return filter.DropSilently which just quietly stops // processing it in the tstun TUN wrapper. return filter.DropSilently, gro}
// shouldHandlePing returns whether or not netstack should handle an incoming// ICMP echo request packet, and the IP address that should be pinged from this// process. The IP address can be different from the destination in the packet// if the destination is a 4via6 address.func (ns *Impl) shouldHandlePing(p *packet.Parsed) (_ netip.Addr, ok bool) { if !p.IsEchoRequest() { return netip.Addr{}, false }
destIP := p.Dst.Addr()
// We need to handle pings for all 4via6 addresses, even if this // netstack instance normally isn't responsible for processing subnets. // // For example, on Linux, subnet router traffic could be handled via // tun+iptables rules for most packets, but we still need to handle // ICMP echo requests over 4via6 since the host networking stack // doesn't know what to do with a 4via6 address. // // shouldProcessInbound returns 'true' to say that we should process // all IPv6 packets with a destination address in the 'via' range, so // check before we check the "ProcessSubnets" boolean below. if viaRange.Contains(destIP) { // The input echo request was to a 4via6 address, which we cannot // simply ping as-is from this process. Translate the destination to an // IPv4 address, so that our relayed ping (in userPing) is pinging the // underlying destination IP. // // ICMPv4 and ICMPv6 are different protocols with different on-the-wire // representations, so normally you can't send an ICMPv6 message over // IPv4 and expect to get a useful result. However, in this specific // case things are safe because the 'userPing' function doesn't make // use of the input packet. return tsaddr.UnmapVia(destIP), true }
// If we get here, we don't do anything unless this netstack instance // is responsible for processing subnet traffic. if !ns.ProcessSubnets { return netip.Addr{}, false }
// For non-4via6 addresses, we don't handle pings if they're destined // for a Tailscale IP. if tsaddr.IsTailscaleIP(destIP) { return netip.Addr{}, false }
// This netstack instance is processing subnet traffic, so handle the // ping ourselves. return destIP, true}
func netaddrIPFromNetstackIP(s tcpip.Address) netip.Addr { switch s.Len() { case 4: return netip.AddrFrom4(s.As4()) case 16: return netip.AddrFrom16(s.As16()).Unmap() } return netip.Addr{}}
var ( ipv4Loopback = netip.MustParseAddr("127.0.0.1") ipv6Loopback = netip.MustParseAddr("::1"))
func (ns *Impl) acceptTCP(r *tcp.ForwarderRequest) { reqDetails := r.ID() if debugNetstack() { ns.logf("[v2] TCP ForwarderRequest: %s", stringifyTEI(reqDetails)) } clientRemoteIP := netaddrIPFromNetstackIP(reqDetails.RemoteAddress) if !clientRemoteIP.IsValid() { ns.logf("invalid RemoteAddress in TCP ForwarderRequest: %s", stringifyTEI(reqDetails)) r.Complete(true) // sends a RST return }
// After we've returned from this function or have otherwise reached a // non-pending state, decrement the per-client in-flight count and // remove this endpoint from our packet tracking map so future TCP // connections aren't dropped. inFlightCompleted := false tei := r.ID() defer func() { if !inFlightCompleted { ns.decrementInFlightTCPForward(tei, clientRemoteIP) } }()
clientRemotePort := reqDetails.RemotePort clientRemoteAddrPort := netip.AddrPortFrom(clientRemoteIP, clientRemotePort)
dialIP := netaddrIPFromNetstackIP(reqDetails.LocalAddress) isTailscaleIP := tsaddr.IsTailscaleIP(dialIP) isLocal := ns.isLocalIP(dialIP) // i.e. not a subnet routed or 4via6 target
dstAddrPort := netip.AddrPortFrom(dialIP, reqDetails.LocalPort)
if viaRange.Contains(dialIP) { isTailscaleIP = false dialIP = tsaddr.UnmapVia(dialIP) }
defer func() { if !isTailscaleIP { // if this is a subnet IP, we added this in before the TCP handshake // so netstack is happy TCP-handshaking as a subnet IP ns.removeSubnetAddress(dialIP) } }()
var wq waiter.Queue
// We can't actually create the endpoint or complete the inbound // request until we're sure that the connection can be handled by this // endpoint. This function sets up the TCP connection and should be // called immediately before a connection is handled. getConnOrReset := func(opts ...tcpip.SettableSocketOption) *gonet.TCPConn { ep, err := r.CreateEndpoint(&wq) if err != nil { ns.logf("CreateEndpoint error for %s: %v", stringifyTEI(reqDetails), err) r.Complete(true) // sends a RST return nil } r.Complete(false) for _, opt := range opts { ep.SetSockOpt(opt) } // SetKeepAlive so that idle connections to peers that have forgotten about // the connection or gone completely offline eventually time out. // Applications might be setting this on a forwarded connection, but from // userspace we can not see those, so the best we can do is to always // perform them with conservative timing. // Netstack defaults match the Linux defaults and result in a little over // two hours before the socket is closed due to keepalive. Operators can // shorten the timers with TS_NETSTACK_KEEPALIVE_IDLE and // TS_NETSTACK_KEEPALIVE_INTERVAL (see netstackKeepaliveIdle); the // defaults are left unchanged because the long timers are low-impact for // battery-powered peers and this has broad implications in userspace // mode (lingering connections to fork-style daemons, etc). See // tailscale/tailscale#4522. if d := netstackKeepaliveIdle(); d > 0 { idle := tcpip.KeepaliveIdleOption(d) if err := ep.SetSockOpt(&idle); err != nil { ns.logf("netstack: SetSockOpt(KeepaliveIdle=%v) failed: %v", d, err) } } if d := netstackKeepaliveInterval(); d > 0 { intvl := tcpip.KeepaliveIntervalOption(d) if err := ep.SetSockOpt(&intvl); err != nil { ns.logf("netstack: SetSockOpt(KeepaliveInterval=%v) failed: %v", d, err) } } ep.SocketOptions().SetKeepAlive(true)
// This function is called when we're ready to use the // underlying connection, and thus it's no longer in a // "in-flight" state; decrement our per-client limit right now, // and tell the defer in acceptTCP that it doesn't need to do // so upon return. ns.decrementInFlightTCPForward(tei, clientRemoteIP) inFlightCompleted = true
// The ForwarderRequest.CreateEndpoint above asynchronously // starts the TCP handshake. Note that the gonet.TCPConn // methods c.RemoteAddr() and c.LocalAddr() will return nil // until the handshake actually completes. But we have the // remote address in reqDetails instead, so we don't use // gonet.TCPConn.RemoteAddr. The byte copies in both // directions to/from the gonet.TCPConn in forwardTCP will // block until the TCP handshake is complete. return gonet.NewTCPConn(&wq, ep) }
// Local Services (DNS and WebDAV) hittingServiceIP := dialIP == serviceIP || dialIP == serviceIPv6 hittingDNS := hittingServiceIP && reqDetails.LocalPort == 53 if hittingDNS { c := getConnOrReset() if c == nil { return } addrPort := netip.AddrPortFrom(clientRemoteIP, reqDetails.RemotePort) go ns.dns.HandleTCPConn(c, addrPort) return }
if ns.lb != nil { handler, opts := ns.lb.TCPHandlerForDst(clientRemoteAddrPort, dstAddrPort) if handler != nil { c := getConnOrReset(opts...) // will send a RST if it fails if c == nil { return } handler(c) return } }
if ns.GetTCPHandlerForFlow != nil { handler, ok := ns.GetTCPHandlerForFlow(clientRemoteAddrPort, dstAddrPort) if ok { if handler == nil { r.Complete(true) return } c := getConnOrReset() // will send a RST if it fails if c == nil { return } handler(c) return } } switch { case hittingServiceIP && ns.isLoopbackPort(reqDetails.LocalPort): if dialIP == serviceIPv6 { dialIP = ipv6Loopback } else { dialIP = ipv4Loopback } case isTailscaleIP: dialIP = ipv4Loopback } dialAddr := netip.AddrPortFrom(dialIP, uint16(reqDetails.LocalPort))
if !ns.forwardTCP(getConnOrReset, clientRemoteIP, &wq, dialAddr, isLocal) { r.Complete(true) // sends a RST }}
// tcpCloser is an interface to abstract around various TCPConn types that// allow closing of the read and write streams independently of each other.type tcpCloser interface { CloseRead() error CloseWrite() error}
func (ns *Impl) forwardTCP(getClient func(...tcpip.SettableSocketOption) *gonet.TCPConn, clientRemoteIP netip.Addr, wq *waiter.Queue, dialAddr netip.AddrPort, isLocal bool) (handled bool) { dialAddrStr := dialAddr.String() if debugNetstack() { ns.logf("[v2] netstack: forwarding incoming connection to %s", dialAddrStr) }
ctx, cancel := context.WithCancel(context.Background()) defer cancel()
waitEntry, notifyCh := waiter.NewChannelEntry(waiter.EventHUp) // TODO(bradfitz): right EventMask? wq.EventRegister(&waitEntry) defer wq.EventUnregister(&waitEntry) done := make(chan bool) // netstack doesn't close the notification channel automatically if there was no // hup signal, so we close done after we're done to not leak the goroutine below. defer close(done) go func() { select { case <-notifyCh: if debugNetstack() { ns.logf("[v2] netstack: forwardTCP notifyCh fired; canceling context for %s", dialAddrStr) } case <-done: } cancel() }()
// Attempt to dial the outbound connection before we accept the inbound one. var dialFunc netx.DialFunc if ns.forwardDialFunc != nil { dialFunc = ns.forwardDialFunc } else { var stdDialer net.Dialer dialFunc = stdDialer.DialContext }
// TODO: this is racy, dialing before we register our local address. See // https://github.com/tailscale/tailscale/issues/1616. backend, err := dialFunc(ctx, "tcp", dialAddrStr) if err != nil { ns.logf("netstack: could not connect to local backend server at %s: %v", dialAddr.String(), err) return } defer backend.Close()
backendLocalAddr := backend.LocalAddr().(*net.TCPAddr) backendLocalIPPort := netaddr.Unmap(backendLocalAddr.AddrPort()) if isLocal { if err := ns.pm.RegisterIPPortIdentity("tcp", backendLocalIPPort, clientRemoteIP); err != nil { ns.logf("netstack: could not register TCP mapping %s: %v", backendLocalIPPort, err) return } defer ns.pm.UnregisterIPPortIdentity("tcp", backendLocalIPPort) }
// If we get here, either the getClient call below will succeed and // return something we can Close, or it will fail and will properly // respond to the client with a RST. Either way, the caller no longer // needs to clean up the client connection. handled = true
// We dialed the connection; we can complete the client's TCP handshake. client := getClient() if client == nil { return } defer client.Close()
// As of 2025-07-03, backend is always either a net.TCPConn // from stdDialer.DialContext (which has the requisite functions), // or nil from hangDialer in tests (in which case we would have // errored out by now), so this conversion should always succeed. backendTCPCloser, backendIsTCPCloser := backend.(tcpCloser) connClosed := make(chan error, 2) go func() { _, err := io.Copy(backend, client) if err != nil { err = fmt.Errorf("client -> backend: %w", err) } connClosed <- err err = nil if backendIsTCPCloser { err = backendTCPCloser.CloseWrite() } err = errors.Join(err, client.CloseRead()) if err != nil { ns.logf("client -> backend close connection: %v", err) } }() go func() { _, err := io.Copy(client, backend) if err != nil { err = fmt.Errorf("backend -> client: %w", err) } connClosed <- err err = nil if backendIsTCPCloser { err = backendTCPCloser.CloseRead() } err = errors.Join(err, client.CloseWrite()) if err != nil { ns.logf("backend -> client close connection: %v", err) } }() // Wait for both ends of the connection to close. for range 2 { err = <-connClosed if err != nil { ns.logf("proxy connection closed with error: %v", err) } } ns.logf("[v2] netstack: forwarder connection to %s closed", dialAddrStr) return}
// ListenPacket listens for incoming packets for the given network and address.// Address must be of the form "ip:port" or "[ip]:port".//// As of 2024-05-18, only udp4 and udp6 are supported.func (ns *Impl) ListenPacket(network, address string) (net.PacketConn, error) { ap, err := netip.ParseAddrPort(address) if err != nil { return nil, fmt.Errorf("netstack: ParseAddrPort(%q): %w", address, err) }
var networkProto tcpip.NetworkProtocolNumber switch network { case "udp": return nil, fmt.Errorf("netstack: udp not supported; use udp4 or udp6") case "udp4": networkProto = ipv4.ProtocolNumber if !ap.Addr().Is4() { return nil, fmt.Errorf("netstack: udp4 requires an IPv4 address") } case "udp6": networkProto = ipv6.ProtocolNumber if !ap.Addr().Is6() { return nil, fmt.Errorf("netstack: udp6 requires an IPv6 address") } default: return nil, fmt.Errorf("netstack: unsupported network %q", network) } var wq waiter.Queue ep, nserr := ns.ipstack.NewEndpoint(udp.ProtocolNumber, networkProto, &wq) if nserr != nil { return nil, fmt.Errorf("netstack: NewEndpoint: %v", nserr) } localAddress := tcpip.FullAddress{ NIC: nicID, Addr: tcpip.AddrFromSlice(ap.Addr().AsSlice()), Port: ap.Port(), } if err := ep.Bind(localAddress); err != nil { ep.Close() return nil, fmt.Errorf("netstack: Bind(%v): %v", localAddress, err) } return gonet.NewUDPConn(&wq, ep), nil}
// ListenTCP listens for TCP connections on the given address.func (ns *Impl) ListenTCP(network, address string) (*gonet.TCPListener, error) { ap, err := netip.ParseAddrPort(address) if err != nil { return nil, fmt.Errorf("netstack: ParseAddrPort(%q): %w", address, err) }
var networkProto tcpip.NetworkProtocolNumber switch network { case "tcp4": networkProto = ipv4.ProtocolNumber if ap.Addr().IsValid() && !ap.Addr().Is4() { return nil, fmt.Errorf("netstack: tcp4 requires an IPv4 address") } case "tcp6": networkProto = ipv6.ProtocolNumber if ap.Addr().IsValid() && !ap.Addr().Is6() { return nil, fmt.Errorf("netstack: tcp6 requires an IPv6 address") } default: return nil, fmt.Errorf("netstack: unsupported network %q", network) }
localAddress := tcpip.FullAddress{ NIC: nicID, Port: ap.Port(), } if ap.Addr().IsValid() && !ap.Addr().IsUnspecified() { localAddress.Addr = tcpip.AddrFromSlice(ap.Addr().AsSlice()) }
return gonet.ListenTCP(ns.ipstack, localAddress, networkProto)}
// acceptUDPNoICMP wraps acceptUDP to satisfy udp.ForwarderHandler.// A gvisor bump from 9414b50a to 573d5e71 on 2026-02-27 changed// udp.ForwarderHandler from func(*ForwarderRequest) to// func(*ForwarderRequest) bool, where returning false means unhandled// and causes gvisor to send an ICMP port unreachable. Previously there// was no such distinction and all packets were implicitly treated as// handled. Always returning true preserves the old behavior of silently// dropping packets we don't service rather than sending ICMP errors.func (ns *Impl) acceptUDPNoICMP(r *udp.ForwarderRequest) bool { ns.acceptUDP(r) return true}
func (ns *Impl) acceptUDP(r *udp.ForwarderRequest) { sess := r.ID() if debugNetstack() { ns.logf("[v2] UDP ForwarderRequest: %v", stringifyTEI(sess)) } var wq waiter.Queue ep, err := r.CreateEndpoint(&wq) if err != nil { ns.logf("acceptUDP: could not create endpoint: %v", err) return } dstAddr, ok := ipPortOfNetstackAddr(sess.LocalAddress, sess.LocalPort) if !ok { ep.Close() return } srcAddr, ok := ipPortOfNetstackAddr(sess.RemoteAddress, sess.RemotePort) if !ok { ep.Close() return }
// Handle magicDNS and loopback traffic (via UDP) here. if dst := dstAddr.Addr(); dst == serviceIP || dst == serviceIPv6 { switch { case dstAddr.Port() == 53: c := gonet.NewUDPConn(&wq, ep) go ns.handleMagicDNSUDP(srcAddr, c) return case ns.isLoopbackPort(dstAddr.Port()): if dst == serviceIPv6 { dstAddr = netip.AddrPortFrom(ipv6Loopback, dstAddr.Port()) } else { dstAddr = netip.AddrPortFrom(ipv4Loopback, dstAddr.Port()) } default: ep.Close() return // Only MagicDNS and loopback traffic runs on the service IPs for now. } }
if get := ns.GetUDPHandlerForFlow; get != nil { h, intercept := get(srcAddr, dstAddr) if intercept { if h == nil { ep.Close() return } go h(gonet.NewUDPConn(&wq, ep)) return } }
c := gonet.NewUDPConn(&wq, ep) go ns.forwardUDP(c, srcAddr, dstAddr)}
// Buffer pool for forwarding UDP packets. Implementations are advised not to// exceed 512 bytes per DNS request due to fragmenting but in reality can and do// send much larger packets, so use the maximum possible UDP packet size.var udpBufPool = &sync.Pool{ New: func() any { b := make([]byte, maxUDPPacketSize) return &b },}
func (ns *Impl) handleMagicDNSUDP(srcAddr netip.AddrPort, c *gonet.UDPConn) { // Packets are being generated by the local host, so there should be // very, very little latency. 150ms was chosen as something of an upper // bound on resource usage, while hopefully still being long enough for // a heavily loaded system. const readDeadline = 150 * time.Millisecond
defer c.Close()
bufp := udpBufPool.Get().(*[]byte) defer udpBufPool.Put(bufp) q := *bufp
// libresolv from glibc is quite adamant that transmitting multiple DNS // requests down the same UDP socket is valid. To support this, we read // in a loop (with a tight deadline so we don't chew too many resources). // // See: https://github.com/bminor/glibc/blob/f7fbb99652eceb1b6b55e4be931649df5946497c/resolv/res_send.c#L995 for { c.SetReadDeadline(time.Now().Add(readDeadline)) n, _, err := c.ReadFrom(q) if err != nil { if oe, ok := err.(*net.OpError); !(ok && oe.Timeout()) { ns.logf("dns udp read: %v", err) // log non-timeout errors } return } resp, err := ns.dns.Query(context.Background(), q[:n], "udp", srcAddr) if err != nil { ns.logf("dns udp query: %v", err) return } c.Write(resp) }}
// forwardUDP proxies between client (with addr clientAddr) and dstAddr.//// dstAddr may be either a local Tailscale IP, in which we case we proxy to// 127.0.0.1, or any other IP (from an advertised subnet), in which case we// proxy to it directly.func (ns *Impl) forwardUDP(client *gonet.UDPConn, clientAddr, dstAddr netip.AddrPort) { port, srcPort := dstAddr.Port(), clientAddr.Port() if debugNetstack() { ns.logf("[v2] netstack: forwarding incoming UDP connection on port %v", port) }
var backendListenAddr *net.UDPAddr var backendRemoteAddr *net.UDPAddr isLocal := ns.isLocalIP(dstAddr.Addr()) isLoopback := dstAddr.Addr() == ipv4Loopback || dstAddr.Addr() == ipv6Loopback if isLocal { backendRemoteAddr = &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: int(port)} backendListenAddr = &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: int(srcPort)} } else if isLoopback { ip := net.IP(ipv4Loopback.AsSlice()) if dstAddr.Addr() == ipv6Loopback { ip = ipv6Loopback.AsSlice() } backendRemoteAddr = &net.UDPAddr{IP: ip, Port: int(port)} backendListenAddr = &net.UDPAddr{IP: ip, Port: int(srcPort)} } else { if dstIP := dstAddr.Addr(); viaRange.Contains(dstIP) { dstAddr = netip.AddrPortFrom(tsaddr.UnmapVia(dstIP), dstAddr.Port()) } backendRemoteAddr = net.UDPAddrFromAddrPort(dstAddr) if dstAddr.Addr().Is4() { backendListenAddr = &net.UDPAddr{IP: net.ParseIP("0.0.0.0"), Port: int(srcPort)} } else { backendListenAddr = &net.UDPAddr{IP: net.ParseIP("::"), Port: int(srcPort)} } }
backendConn, err := net.ListenUDP("udp", backendListenAddr) if err != nil { ns.logf("netstack: could not bind local port %v: %v, trying again with random port", backendListenAddr.Port, err) backendListenAddr.Port = 0 backendConn, err = net.ListenUDP("udp", backendListenAddr) if err != nil { ns.logf("netstack: could not create UDP socket, preventing forwarding to %v: %v", dstAddr, err) return } } backendLocalAddr := backendConn.LocalAddr().(*net.UDPAddr)
backendLocalIPPort := netip.AddrPortFrom(backendListenAddr.AddrPort().Addr().Unmap().WithZone(backendLocalAddr.Zone), backendLocalAddr.AddrPort().Port()) if !backendLocalIPPort.IsValid() { ns.logf("could not get backend local IP:port from %v:%v", backendLocalAddr.IP, backendLocalAddr.Port) } if isLocal { if err := ns.pm.RegisterIPPortIdentity("udp", backendLocalIPPort, clientAddr.Addr()); err != nil { ns.logf("netstack: could not register UDP mapping %s: %v", backendLocalIPPort, err) return } } ctx, cancel := context.WithCancel(context.Background())
idleTimeout := 2 * time.Minute if port == 53 { // Make DNS packet copies time out much sooner. // // TODO(bradfitz): make DNS queries over UDP forwarding even // cheaper by adding an additional idleTimeout post-DNS-reply. // For instance, after the DNS response goes back out, then only // wait a few seconds (or zero, really) idleTimeout = 30 * time.Second } timer := time.AfterFunc(idleTimeout, func() { if isLocal { ns.pm.UnregisterIPPortIdentity("udp", backendLocalIPPort) } ns.logf("netstack: UDP session between %s and %s timed out", backendListenAddr, backendRemoteAddr) cancel() client.Close() backendConn.Close() }) extend := func() { timer.Reset(idleTimeout) } startPacketCopy(ctx, cancel, client, net.UDPAddrFromAddrPort(clientAddr), backendConn, ns.logf, extend) startPacketCopy(ctx, cancel, backendConn, backendRemoteAddr, client, ns.logf, extend) if isLocal { // Wait for the copies to be done before decrementing the // subnet address count to potentially remove the route. <-ctx.Done() ns.removeSubnetAddress(dstAddr.Addr()) }}
func startPacketCopy(ctx context.Context, cancel context.CancelFunc, dst net.PacketConn, dstAddr net.Addr, src net.PacketConn, logf logger.Logf, extend func()) { if debugNetstack() { logf("[v2] netstack: startPacketCopy to %v (%T) from %T", dstAddr, dst, src) } go func() { defer cancel() // tear down the other direction's copy
bufp := udpBufPool.Get().(*[]byte) defer udpBufPool.Put(bufp) pkt := *bufp
for { select { case <-ctx.Done(): return default: n, srcAddr, err := src.ReadFrom(pkt) if err != nil { if ctx.Err() == nil { logf("read packet from %s failed: %v", srcAddr, err) } return } _, err = dst.WriteTo(pkt[:n], dstAddr) if err != nil { if ctx.Err() == nil { logf("write packet to %s failed: %v", dstAddr, err) } return } if debugNetstack() { logf("[v2] wrote UDP packet %s -> %s", srcAddr, dstAddr) } extend() } } }()}
func stringifyTEI(tei stack.TransportEndpointID) string { localHostPort := net.JoinHostPort(tei.LocalAddress.String(), strconv.Itoa(int(tei.LocalPort))) remoteHostPort := net.JoinHostPort(tei.RemoteAddress.String(), strconv.Itoa(int(tei.RemotePort))) return fmt.Sprintf("%s -> %s", remoteHostPort, localHostPort)}
func ipPortOfNetstackAddr(a tcpip.Address, port uint16) (ipp netip.AddrPort, ok bool) { if addr, ok := netip.AddrFromSlice(a.AsSlice()); ok { return netip.AddrPortFrom(addr, port), true } return netip.AddrPort{}, false}
func readStatCounter(sc *tcpip.StatCounter) int64 { vv := sc.Value() if vv > math.MaxInt64 { return int64(math.MaxInt64) } return int64(vv)}
// ExpVar returns an expvar variable suitable for registering with expvar.Publish.func (ns *Impl) ExpVar() expvar.Var { m := new(metrics.Set)
// Global metrics stats := ns.ipstack.Stats() m.Set("counter_dropped_packets", expvar.Func(func() any { return readStatCounter(stats.DroppedPackets) }))
// IP statistics ipStats := ns.ipstack.Stats().IP ipMetrics := []struct { name string field *tcpip.StatCounter }{ {"packets_received", ipStats.PacketsReceived}, {"valid_packets_received", ipStats.ValidPacketsReceived}, {"disabled_packets_received", ipStats.DisabledPacketsReceived}, {"invalid_destination_addresses_received", ipStats.InvalidDestinationAddressesReceived}, {"invalid_source_addresses_received", ipStats.InvalidSourceAddressesReceived}, {"packets_delivered", ipStats.PacketsDelivered}, {"packets_sent", ipStats.PacketsSent}, {"outgoing_packet_errors", ipStats.OutgoingPacketErrors}, {"malformed_packets_received", ipStats.MalformedPacketsReceived}, {"malformed_fragments_received", ipStats.MalformedFragmentsReceived}, {"iptables_prerouting_dropped", ipStats.IPTablesPreroutingDropped}, {"iptables_input_dropped", ipStats.IPTablesInputDropped}, {"iptables_forward_dropped", ipStats.IPTablesForwardDropped}, {"iptables_output_dropped", ipStats.IPTablesOutputDropped}, {"iptables_postrouting_dropped", ipStats.IPTablesPostroutingDropped}, {"option_timestamp_received", ipStats.OptionTimestampReceived}, {"option_record_route_received", ipStats.OptionRecordRouteReceived}, {"option_router_alert_received", ipStats.OptionRouterAlertReceived}, {"option_unknown_received", ipStats.OptionUnknownReceived}, } for _, metric := range ipMetrics { m.Set("counter_ip_"+metric.name, expvar.Func(func() any { return readStatCounter(metric.field) })) }
// IP forwarding statistics fwdStats := ipStats.Forwarding fwdMetrics := []struct { name string field *tcpip.StatCounter }{ {"unrouteable", fwdStats.Unrouteable}, {"exhausted_ttl", fwdStats.ExhaustedTTL}, {"initializing_source", fwdStats.InitializingSource}, {"link_local_source", fwdStats.LinkLocalSource}, {"link_local_destination", fwdStats.LinkLocalDestination}, {"packet_too_big", fwdStats.PacketTooBig}, {"host_unreachable", fwdStats.HostUnreachable}, {"extension_header_problem", fwdStats.ExtensionHeaderProblem}, {"unexpected_multicast_input_interface", fwdStats.UnexpectedMulticastInputInterface}, {"unknown_output_endpoint", fwdStats.UnknownOutputEndpoint}, {"no_multicast_pending_queue_buffer_space", fwdStats.NoMulticastPendingQueueBufferSpace}, {"outgoing_device_no_buffer_space", fwdStats.OutgoingDeviceNoBufferSpace}, {"errors", fwdStats.Errors}, } for _, metric := range fwdMetrics { m.Set("counter_ip_forward_"+metric.name, expvar.Func(func() any { return readStatCounter(metric.field) })) }
// TCP metrics tcpStats := ns.ipstack.Stats().TCP tcpMetrics := []struct { name string field *tcpip.StatCounter }{ {"active_connection_openings", tcpStats.ActiveConnectionOpenings}, {"passive_connection_openings", tcpStats.PassiveConnectionOpenings}, {"established_resets", tcpStats.EstablishedResets}, {"established_closed", tcpStats.EstablishedClosed}, {"established_timeout", tcpStats.EstablishedTimedout}, {"listen_overflow_syn_drop", tcpStats.ListenOverflowSynDrop}, {"listen_overflow_ack_drop", tcpStats.ListenOverflowAckDrop}, {"listen_overflow_syn_cookie_sent", tcpStats.ListenOverflowSynCookieSent}, {"listen_overflow_syn_cookie_rcvd", tcpStats.ListenOverflowSynCookieRcvd}, {"listen_overflow_invalid_syn_cookie_rcvd", tcpStats.ListenOverflowInvalidSynCookieRcvd}, {"failed_connection_attempts", tcpStats.FailedConnectionAttempts}, {"valid_segments_received", tcpStats.ValidSegmentsReceived}, {"invalid_segments_received", tcpStats.InvalidSegmentsReceived}, {"segments_sent", tcpStats.SegmentsSent}, {"segment_send_errors", tcpStats.SegmentSendErrors}, {"resets_sent", tcpStats.ResetsSent}, {"resets_received", tcpStats.ResetsReceived}, {"retransmits", tcpStats.Retransmits}, {"fast_recovery", tcpStats.FastRecovery}, {"sack_recovery", tcpStats.SACKRecovery}, {"tlp_recovery", tcpStats.TLPRecovery}, {"slow_start_retransmits", tcpStats.SlowStartRetransmits}, {"fast_retransmit", tcpStats.FastRetransmit}, {"timeouts", tcpStats.Timeouts}, {"checksum_errors", tcpStats.ChecksumErrors}, {"failed_port_reservations", tcpStats.FailedPortReservations}, {"segments_acked_with_dsack", tcpStats.SegmentsAckedWithDSACK}, {"spurious_recovery", tcpStats.SpuriousRecovery}, {"spurious_rto_recovery", tcpStats.SpuriousRTORecovery}, {"forward_max_in_flight_drop", tcpStats.ForwardMaxInFlightDrop}, } for _, metric := range tcpMetrics { m.Set("counter_tcp_"+metric.name, expvar.Func(func() any { return readStatCounter(metric.field) })) } m.Set("gauge_tcp_current_established", expvar.Func(func() any { return readStatCounter(tcpStats.CurrentEstablished) })) m.Set("gauge_tcp_current_connected", expvar.Func(func() any { return readStatCounter(tcpStats.CurrentConnected) }))
// UDP metrics udpStats := ns.ipstack.Stats().UDP udpMetrics := []struct { name string field *tcpip.StatCounter }{ {"packets_received", udpStats.PacketsReceived}, {"unknown_port_errors", udpStats.UnknownPortErrors}, {"receive_buffer_errors", udpStats.ReceiveBufferErrors}, {"malformed_packets_received", udpStats.MalformedPacketsReceived}, {"packets_sent", udpStats.PacketsSent}, {"packet_send_errors", udpStats.PacketSendErrors}, {"checksum_errors", udpStats.ChecksumErrors}, } for _, metric := range udpMetrics { m.Set("counter_udp_"+metric.name, expvar.Func(func() any { return readStatCounter(metric.field) })) }
// Export gauges that show the current TCP forwarding limits. m.Set("gauge_tcp_forward_in_flight_limit", expvar.Func(func() any { return maxInFlightConnectionAttempts() })) m.Set("gauge_tcp_forward_in_flight_per_client_limit", expvar.Func(func() any { return maxInFlightConnectionAttemptsPerClient() }))
// This metric tracks the number of in-flight TCP forwarding // connections that are "in-flight"–i.e. waiting to complete. m.Set("gauge_tcp_forward_in_flight", expvar.Func(func() any { ns.mu.Lock() defer ns.mu.Unlock()
var sum int64 for _, n := range ns.connsInFlightByClient { sum += int64(n) } return sum }))
m.Set("counter_tcp_forward_max_in_flight_per_client_drop", &ns.forwardInFlightPerClientDropped)
// This metric tracks how many (if any) of the per-client limit on // in-flight TCP forwarding requests have been reached. m.Set("gauge_tcp_forward_in_flight_per_client_limit_reached", expvar.Func(func() any { ns.mu.Lock() defer ns.mu.Unlock()
limit := maxInFlightConnectionAttemptsPerClient()
var count int64 for _, n := range ns.connsInFlightByClient { if n == limit { count++ } } return count }))
return m}
// windowsPingOutputIsSuccess reports whether the ping.exe output b contains a// success ping response for ip.//// See https://github.com/tailscale/tailscale/issues/13654//// TODO(bradfitz,nickkhyl): delete this and use the proper Windows APIs.func windowsPingOutputIsSuccess(ip netip.Addr, b []byte) bool { // Look for a line that contains " <ip>: " and then three equal signs. // As a special case, the 2nd equal sign may be a '<' character // for sub-millisecond pings. // This heuristic seems to match the ping.exe output in any language. sub := fmt.Appendf(nil, " %s: ", ip)
eqSigns := func(bb []byte) (n int) { for _, b := range bb { if b == '=' || (b == '<' && n == 1) { n++ } } return }
for len(b) > 0 { var line []byte line, b, _ = bytes.Cut(b, []byte("\n")) if _, rest, ok := bytes.Cut(line, sub); ok && eqSigns(rest) == 3 { return true } } return false}