webnet/tailscale
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

feature/conn25: allow ICMP packets

Browse Source 
Allow packets with ICMPv4 or ICMPv6 proto to use the flow table and get
NATted.

Fixes tailscale/corp#40123

Signed-off-by: Fran Bull <fran@tailscale.com>
This commit is contained in:
Fran Bull
2026-07-02 10:31:31 -07:00
committed by franbull
parent 76eece2d15
commit b727675a8b
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
feature/conn25/datapath.go
+6 -4
View File
@@ -120,14 +120,17 @@ func (dh *datapathHandler) StartFlowExpirySweepers(ctx context.Context) {
go dh.connectorFlowTable.StartExpiredSweeper(ctx) go dh.connectorFlowTable.StartExpiredSweeper(ctx)
} }
func isSupportedProtocol(proto ipproto.Proto) bool {
return proto == ipproto.TCP || proto == ipproto.UDP || proto == ipproto.ICMPv4 || proto == ipproto.ICMPv6
}
// HandlePacketFromWireGuard inspects packets coming from WireGuard, and performs // HandlePacketFromWireGuard inspects packets coming from WireGuard, and performs
// appropriate DNAT or SNAT actions for Connectors 2025. Returning [filter.Accept] signals // appropriate DNAT or SNAT actions for Connectors 2025. Returning [filter.Accept] signals
// that the packet should pass through subsequent stages of the datapath pipeline. // that the packet should pass through subsequent stages of the datapath pipeline.
// Returning [filter.Drop] signals the packet should be dropped. This method handles all // Returning [filter.Drop] signals the packet should be dropped. This method handles all
// packets coming from WireGuard, on both connectors, and clients of connectors. // packets coming from WireGuard, on both connectors, and clients of connectors.
func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed, tun *tstun.Wrapper) filter.Response { func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed, tun *tstun.Wrapper) filter.Response {
// TODO(tailscale/corp#38764): Support other protocols, like ICMP for error messages. if !isSupportedProtocol(p.IPProto) {
if p.IPProto != ipproto.TCP && p.IPProto != ipproto.UDP {
return filter.Accept return filter.Accept
} }
@@ -202,8 +205,7 @@ func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed, tun *tstu
// Returning [filter.Drop] signals the packet should be dropped. This method handles all // Returning [filter.Drop] signals the packet should be dropped. This method handles all
// packets coming from the tun device, on both connectors, and clients of connectors. // packets coming from the tun device, on both connectors, and clients of connectors.
func (dh *datapathHandler) HandlePacketFromTunDevice(p *packet.Parsed) filter.Response { func (dh *datapathHandler) HandlePacketFromTunDevice(p *packet.Parsed) filter.Response {
// TODO(tailscale/corp#38764): Support other protocols, like ICMP for error messages. if !isSupportedProtocol(p.IPProto) {
if p.IPProto != ipproto.TCP && p.IPProto != ipproto.UDP {
return filter.Accept return filter.Accept
} }