mirror/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2026-07-14 17:43:03 -04:00
Code Issues Packages Projects Releases Wiki Activity

feature/conn25: allow ICMP packets

Browse Source 
Allow packets with ICMPv4 or ICMPv6 proto to use the flow table and get
NATted.

Fixes tailscale/corp#40123

Signed-off-by: Fran Bull <fran@tailscale.com>
This commit is contained in:
Fran Bull
2026-07-02 09:49:49 -07:00
committed by franbull
parent 76eece2d15
commit b727675a8b
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
feature/conn25/datapath.go
View File

@@ -120,14 +120,17 @@ func (dh *datapathHandler) StartFlowExpirySweepers(ctx context.Context) {
go dh.connectorFlowTable.StartExpiredSweeper(ctx)
}
func isSupportedProtocol(proto ipproto.Proto) bool {
return proto == ipproto.TCP || proto == ipproto.UDP || proto == ipproto.ICMPv4 || proto == ipproto.ICMPv6
}
// HandlePacketFromWireGuard inspects packets coming from WireGuard, and performs
// appropriate DNAT or SNAT actions for Connectors 2025. Returning [filter.Accept] signals
// that the packet should pass through subsequent stages of the datapath pipeline.
// Returning [filter.Drop] signals the packet should be dropped. This method handles all
// packets coming from WireGuard, on both connectors, and clients of connectors.
func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed, tun *tstun.Wrapper) filter.Response {
// TODO(tailscale/corp#38764): Support other protocols, like ICMP for error messages.
if p.IPProto != ipproto.TCP && p.IPProto != ipproto.UDP {
if !isSupportedProtocol(p.IPProto) {
return filter.Accept
}
@@ -202,8 +205,7 @@ func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed, tun *tstu
// Returning [filter.Drop] signals the packet should be dropped. This method handles all
// packets coming from the tun device, on both connectors, and clients of connectors.
func (dh *datapathHandler) HandlePacketFromTunDevice(p *packet.Parsed) filter.Response {
// TODO(tailscale/corp#38764): Support other protocols, like ICMP for error messages.
if p.IPProto != ipproto.TCP && p.IPProto != ipproto.UDP {
if !isSupportedProtocol(p.IPProto) {
return filter.Accept
}