mirror of
https://github.com/tailscale/tailscale.git
synced 2026-07-22 13:32:08 -04:00
9d01b036c7
The tun-layer per-peer data plane (jailed packet filter selection and masquerade NAT rewrites) had no end-to-end coverage: nothing asserted that a peer the control server marks jailed actually has its flows dropped, or that masquerade addresses assigned by control actually carry rewritten traffic in both directions. Add a two-gokrazy-node natlab test driving both knobs from the test control server and probing with HTTP requests between the nodes' webservers after each netmap transition, asserting each response carries the serving node's greeting so masqueraded flows provably reach the intended node. TSMP pings are deliberately not used as probes: tstun answers those before running the packet filter, so they succeed even for jailed peers. Updates #12542 Change-Id: Ia978e8d368f08a5a1117280f12bd50310969d0ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>