shater/protocol/tailscale/port.go

//go:build with_gvisor

package tailscale

import (
	"net/netip"

	"github.com/sagernet/sing-box/adapter"
	"github.com/sagernet/sing-tun"
	"github.com/sagernet/sing-tun/gtcpip/header"
	E "github.com/sagernet/sing/common/exceptions"
	tsTUN "github.com/sagernet/tailscale/net/tstun"
	"github.com/sagernet/tailscale/types/ipproto"
	"github.com/sagernet/tailscale/wgengine/filter"
)

func (t *Endpoint) PreMatchFlow(network string, destination netip.Addr) adapter.PreMatchAction {
	return adapter.PreMatchFlow
}

func (t *Endpoint) PortAddresses() (netip.Addr, netip.Addr) {
	if !t.started.Load() {
		return netip.Addr{}, netip.Addr{}
	}
	return t.server.TailscaleIPs()
}

func (t *Endpoint) PortMTU() uint32 {
	if t.systemInterface {
		return t.systemInterfaceMTU
	}
	return uint32(tsTUN.DefaultTUNMTU())
}

func (t *Endpoint) JudgeFlow(network uint8, source netip.AddrPort, destination netip.AddrPort, firstPacket []byte) tun.FlowVerdict {
	inet4Address, inet6Address := t.PortAddresses()
	if destination.Addr() == inet4Address || destination.Addr() == inet6Address {
		return tun.FlowVerdict{Action: tun.ActionAccept}
	}
	if t.filter != nil {
		tsFilter := t.filter.Load()
		if tsFilter != nil {
			var (
				ipProto         ipproto.Proto
				destinationPort uint16
			)
			switch network {
			case uint8(header.TCPProtocolNumber):
				ipProto = ipproto.TCP
				destinationPort = destination.Port()
			case uint8(header.UDPProtocolNumber):
				ipProto = ipproto.UDP
				destinationPort = destination.Port()
			case uint8(header.ICMPv4ProtocolNumber):
				ipProto = ipproto.ICMPv4
			case uint8(header.ICMPv6ProtocolNumber):
				ipProto = ipproto.ICMPv6
			}
			switch tsFilter.Check(source.Addr(), destination.Addr(), destinationPort, ipProto) {
			case filter.Drop:
				return tun.FlowVerdict{Action: tun.ActionReject}
			case filter.DropSilently:
				return tun.FlowVerdict{Action: tun.ActionDrop}
			}
		}
	}
	return adapter.JudgeFlow(t.router, t.Tag(), t.Type(), network, source, destination, firstPacket)
}

// lx: NO fragment reassembly here, and that is a finding, not an omission.
//
// The other two tun.Port implementations reassemble IP fragments before
// offering them to the return path, because sing-tun's classifyReturn answers
// `returnPass` for any fragment and the packet is then lost or misrouted (see
// transport/wireguard/frag_reassembly.go and protocol/bridge/frag_reassembly.go).
// The same blindness exists on this path — but not at a seam this package owns:
//
//   - The tunnel return path is tstun.Wrapper.Write, which calls
//     offerReturnPath BEFORE the inbound filter and before tdevWrite. Our
//     tunDeviceAdapter (tun_device_unix.go) is that tdev, i.e. it runs AFTER
//     the return path already declined. There is no hook in this tree ahead of
//     classifyReturn; github.com/sagernet/tailscale is pinned with no `replace`.
//
//   - The one ReturnPackets call this package does make — the BuildUnreachable
//     replies in WritePackets below — can never carry a fragment. sing-tun's
//     buildRejectICMPv4/v6 synthesise a fresh header (Flags and FragmentOffset
//     zero, total length capped at 576), and BuildUnreachable refuses an input
//     whose FragmentOffset is non-zero in the first place.
//
// Closing it would mean wrapping returnPath in a reassembling decorator here.
// That is possible, but it cannot simply divert fragments: a datagram the l3
// return path declines belongs to this node's own netstack, which reassembles
// it today — so the decorator would have to duplicate rather than consume, and
// nothing in this project exercises it (with_tailscale is in neither
// scripts/router-tags.sh nor Makefile.lx, so this file is not compiled into any
// binary we ship). Left deliberately undone, with the shape of the fix written
// down, rather than added untested to a hot path.
func (t *Endpoint) AttachReturn(returnPath tun.Return) error {
	t.returnAccess.Lock()
	defer t.returnAccess.Unlock()
	if t.returnPath == returnPath {
		return nil
	}
	if t.returnPath != nil {
		return E.New("return path already attached")
	}
	err := t.wgEngine.SetReturnPath(returnPath)
	if err != nil {
		return err
	}
	t.returnPath = returnPath
	return nil
}

func (t *Endpoint) DetachReturn(returnPath tun.Return) error {
	t.returnAccess.Lock()
	defer t.returnAccess.Unlock()
	if t.returnPath == returnPath {
		t.returnPath = nil
	}
	return nil
}

func (t *Endpoint) WritePackets(packets [][]byte) error {
	if !t.started.Load() {
		return E.New("Tailscale is not ready yet")
	}
	unmatched, err := t.wgEngine.InputPackets(packets)
	if err != nil || len(unmatched) == 0 {
		return err
	}
	t.returnAccess.Lock()
	returnPath := t.returnPath
	t.returnAccess.Unlock()
	if returnPath == nil {
		return nil
	}
	headroom := returnPath.ReturnHeadroom()
	inet4Address, inet6Address := t.PortAddresses()
	var replies [][]byte
	for _, packet := range unmatched {
		source := inet4Address
		if header.IPVersion(packet) == header.IPv6Version {
			source = inet6Address
		}
		reply, replyOk := tun.BuildUnreachable(packet, source, headroom)
		if replyOk {
			replies = append(replies, reply)
		}
	}
	if len(replies) > 0 {
		returnPath.ReturnPackets(replies)
	}
	return nil
}