Brad Fitzpatrick ee029383f7 net/{pktinfo,stunserver}: reply from the address the request was sent to ...

If people ran derper on a multi-NIC or multi-address host, STUN replies
could go out from the wrong address. The wildcard UDP socket let the
kernel pick the reply's source address by routing to the client, which
means the default route's address rather than the one the request came
in on. With connmark-based policy routing (e.g. DNAT through a tunnel),
the reply then doesn't match the inbound conntrack entry, goes out the
wrong interface, and the client never sees it. DERP over TCP was fine,
since accepted sockets are pinned to the local address.

Add net/pktinfo, a small Linux-only package that uses IP_PKTINFO and
IPV6_RECVPKTINFO to learn each datagram's destination address and to
reply from it, and use it in the STUN server. Only the source address is
pinned; routing still picks the interface. Other platforms are unchanged.

Fixes #21404

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I7b3e9c2d41a8f60e5d9c1b2a3f4e5d6c7b8a9f01

2026-09-21 15:43:30 -07:00

..

endpoint

cmd/vet: add subtestnames analyzer; fix all existing violations

2026-04-05 15:52:51 -07:00

status

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

metrics_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

metrics.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

server_linux.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

server_notlinux.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

server_test.go

wgengine/magicsock, net/udprelay: reject zero relay disco keys

2026-09-14 12:05:26 -07:00

server.go

net/{pktinfo,stunserver}: reply from the address the request was sent to

2026-09-21 15:43:30 -07:00