* AWG3.1-related changes indroduced a new bug with HandshakeCookie
buffer size. Instead of adding trailerLen to the final size, it is
getting provided as a capacity param leading to the wrong behavior and
runtime panic while RandomTrailers is used
* Must be the typo :_)
* add RandomTrailers feature which appends random amount of bytes to the
end of each packet
* add DisableCookie feature which prohibits interface to send any cookie
replies
* feat: add header protection mechanism, random transport payload trailing size, and handshake timings randomization
* fix: use uint range instead of the int one
* fix: uapi typo
* fix: simultaneous padding access
* feat: prohibit Sx < 8 if headerProtection is set
* fix: do not count bytes on crypt
* fix: trailing size calculation
* fix: get rid of buffer copying on receival
* chore: rename random padding multiple
* fix: atomize junk packets
* fix: use padding from device by default
* chore: readme changes
* chore: add readme annotation about client-side params
* chore: add both side recommendation for content padding
* feat: change ContentPaddingMultiple to ContentPaddingAddition
* feat: bring chacha20 in there
* chore: use UintRange instead of magicHeader
* feat: make all timers parameters
* fix: reissue max_handshake_amount on successful handshake
* chore: add readme info about new timers
* fix: use ParseUint for UintRange
* feat: make persistent keepalive a range
* feat: use atomics everywhere where possible
* chore: readme changes
* fix: typo
* fix: minor timer fixes
Keepalive packets were excluded from S4 padding because the padding
logic was nested inside the dataSent guard. The receiving side
(DeterminePacketTypeAndPadding) expects S4 padding on all transport
packets, so unpadded keepalives fail H4 header validation and are
silently dropped.
This prevents the responder from completing key confirmation —
lastHandshakeNano stays 0 until real data flows through the tunnel.
* feat: added outline integration layer
* chore: make the function used in RegisterFallbackParser a standalone one
* fix: check if domain has a dot prior trimming it
* fix: use net.JoinHostPort instead of plain concat
Kernels below 5.12 are missing this:
commit 98184612aca0a9ee42b8eb0262a49900ee9eef0d
Author: Norman Maurer <norman_maurer@apple.com>
Date: Thu Apr 1 08:59:17 2021
net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...);
Support for UDP_GRO was added in the past but the implementation for
getsockopt was missed which did lead to an error when we tried to
retrieve the setting for UDP_GRO. This patch adds the missing switch
case for UDP_GRO
Fixes: e20cf8d3f1f7 ("udp: implement GRO for plain UDP sockets.")
Signed-off-by: Norman Maurer <norman_maurer@apple.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
That means we can't set the option and then read it back later. Given
how buggy UDP_GRO is in general on odd kernels, just disable it on older
kernels all together.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
It should be POLLIN because closeFd is read-only file.
Signed-off-by: Kurnia D Win <kurnia.d.win@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Colin's commit went a step further and protected tun.incomingPacket with
a lock on shutdown, but let's see if the tun.stack.Close() call actually
solves that on its own.
Suggested-by: kshangx <hikeshang@hotmail.com>
Suggested-by: Colin Adler <colin1adler@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Since 3c75945fd ("netstack: remove PacketBuffer.IsNil()") this has been
invalid. Follow the replacement pattern of that commit.
The old definition inlined to the same code anyway:
func (pk *PacketBuffer) IsNil() bool {
return pk == nil
}
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
The sync.Locker used with a sync.Cond must be acquired when changing
the associated condition, otherwise there is a window within
sync.Cond.Wait() where a wake-up may be missed.
Fixes: 4846070 ("device: use a waiting sync.Pool instead of a channel")
Reviewed-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Signed-off-by: Jordan Whited <jordan@tailscale.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Yaroslav Gurov