wgengine/magicsock: make endpoint.bestAddr Geneve-aware (#16195)

This commit adds a new type to magicsock, epAddr, which largely ends up
replacing netip.AddrPort in packet I/O paths throughout, enabling
Geneve encapsulation over UDP awareness.

The conn.ReceiveFunc for UDP has been revamped to fix and more clearly
distinguish the different classes of packets we expect to receive: naked
STUN binding messages, naked disco, naked WireGuard, Geneve-encapsulated
disco, and Geneve-encapsulated WireGuard.

Prior to this commit, STUN matching logic in the RX path could swallow
a naked WireGuard packet if the keypair index, which is randomly
generated, happened to overlap with a subset of the STUN magic cookie.

Updates tailscale/corp#27502
Updates tailscale/corp#29326

Signed-off-by: Jordan Whited <jordan@tailscale.com>

wgengine/magicsock/debughttp.go

@@ -72,18 +72,18 @@ func (c *Conn) ServeHTTPDebug(w http.ResponseWriter, r *http.Request) {
 	fmt.Fprintf(w, "<h2 id=ipport><a href=#ipport>#</a> ip:port to endpoint</h2><ul>")
 	{
 		type kv struct {
-			ipp netip.AddrPort
-			pi  *peerInfo
+			addr epAddr
+			pi   *peerInfo
 		}
-		ent := make([]kv, 0, len(c.peerMap.byIPPort))
-		for k, v := range c.peerMap.byIPPort {
+		ent := make([]kv, 0, len(c.peerMap.byEpAddr))
+		for k, v := range c.peerMap.byEpAddr {
 			ent = append(ent, kv{k, v})
 		}
-		sort.Slice(ent, func(i, j int) bool { return ipPortLess(ent[i].ipp, ent[j].ipp) })
+		sort.Slice(ent, func(i, j int) bool { return epAddrLess(ent[i].addr, ent[j].addr) })
 		for _, e := range ent {
 			ep := e.pi.ep
 			shortStr := ep.publicKey.ShortString()
-			fmt.Fprintf(w, "<li>%v: <a href='#%v'>%v</a></li>\n", e.ipp, strings.Trim(shortStr, "[]"), shortStr)
+			fmt.Fprintf(w, "<li>%v: <a href='#%v'>%v</a></li>\n", e.addr, strings.Trim(shortStr, "[]"), shortStr)
 		}
 
 	}
@@ -148,11 +148,11 @@ func printEndpointHTML(w io.Writer, ep *endpoint) {
 	for ipp := range ep.endpointState {
 		eps = append(eps, ipp)
 	}
-	sort.Slice(eps, func(i, j int) bool { return ipPortLess(eps[i], eps[j]) })
+	sort.Slice(eps, func(i, j int) bool { return addrPortLess(eps[i], eps[j]) })
 	io.WriteString(w, "<p>Endpoints:</p><ul>")
 	for _, ipp := range eps {
 		s := ep.endpointState[ipp]
-		if ipp == ep.bestAddr.AddrPort {
+		if ipp == ep.bestAddr.ap && !ep.bestAddr.vni.isSet() {
 			fmt.Fprintf(w, "<li><b>%s</b>: (best)<ul>", ipp)
 		} else {
 			fmt.Fprintf(w, "<li>%s: ...<ul>", ipp)
@@ -196,9 +196,19 @@ func peerDebugName(p tailcfg.NodeView) string {
 	return p.Hostinfo().Hostname()
 }
 
-func ipPortLess(a, b netip.AddrPort) bool {
+func addrPortLess(a, b netip.AddrPort) bool {
 	if v := a.Addr().Compare(b.Addr()); v != 0 {
 		return v < 0
 	}
 	return a.Port() < b.Port()
 }
+
+func epAddrLess(a, b epAddr) bool {
+	if v := a.ap.Addr().Compare(b.ap.Addr()); v != 0 {
+		return v < 0
+	}
+	if a.ap.Port() == b.ap.Port() {
+		return a.vni.get() < b.vni.get()
+	}
+	return a.ap.Port() < b.ap.Port()
+}