From b727675a8be8eb307420eb5e6cb8d7b902eb751b Mon Sep 17 00:00:00 2001 From: Fran Bull Date: Thu, 2 Jul 2026 09:49:49 -0700 Subject: [PATCH] feature/conn25: allow ICMP packets Allow packets with ICMPv4 or ICMPv6 proto to use the flow table and get NATted. Fixes tailscale/corp#40123 Signed-off-by: Fran Bull --- feature/conn25/datapath.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/feature/conn25/datapath.go b/feature/conn25/datapath.go index edfd2a048..6eb8f897d 100644 --- a/feature/conn25/datapath.go +++ b/feature/conn25/datapath.go @@ -120,14 +120,17 @@ func (dh *datapathHandler) StartFlowExpirySweepers(ctx context.Context) { go dh.connectorFlowTable.StartExpiredSweeper(ctx) } +func isSupportedProtocol(proto ipproto.Proto) bool { + return proto == ipproto.TCP || proto == ipproto.UDP || proto == ipproto.ICMPv4 || proto == ipproto.ICMPv6 +} + // HandlePacketFromWireGuard inspects packets coming from WireGuard, and performs // appropriate DNAT or SNAT actions for Connectors 2025. Returning [filter.Accept] signals // that the packet should pass through subsequent stages of the datapath pipeline. // Returning [filter.Drop] signals the packet should be dropped. This method handles all // packets coming from WireGuard, on both connectors, and clients of connectors. func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed, tun *tstun.Wrapper) filter.Response { - // TODO(tailscale/corp#38764): Support other protocols, like ICMP for error messages. - if p.IPProto != ipproto.TCP && p.IPProto != ipproto.UDP { + if !isSupportedProtocol(p.IPProto) { return filter.Accept } @@ -202,8 +205,7 @@ func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed, tun *tstu // Returning [filter.Drop] signals the packet should be dropped. This method handles all // packets coming from the tun device, on both connectors, and clients of connectors. func (dh *datapathHandler) HandlePacketFromTunDevice(p *packet.Parsed) filter.Response { - // TODO(tailscale/corp#38764): Support other protocols, like ICMP for error messages. - if p.IPProto != ipproto.TCP && p.IPProto != ipproto.UDP { + if !isSupportedProtocol(p.IPProto) { return filter.Accept }