Documentation
¶
Overview ¶
Package netlog provides a logger that monitors a TUN device and periodically records any traffic into a log stream.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Device ¶
type Device interface {
SetConnectionCounter(netlogfunc.ConnectionCounter)
}
Device is an abstraction over a tunnel device or a magic socket. Both *tstun.Wrapper and *magicsock.Conn implement this interface.
type Logger ¶
type Logger struct {
// contains filtered or unexported fields
}
Logger logs statistics about every connection. At present, it only logs connections within a tailscale network. By default, exit node traffic is not logged for privacy reasons unless the Tailnet administrator opts-into explicit logging. The zero value is ready for use.
func (*Logger) ReconfigRoutes ¶
ReconfigRoutes configures the network logger with updated routes. The cfg is used to classify the types of connections captured by the tun Device passed to Startup.
func (*Logger) Shutdown ¶
Shutdown shuts down the network logger. This attempts to flush out all pending log messages. Even if an error is returned, the logger is still shut down.
func (*Logger) Startup ¶
func (nl *Logger) Startup(logf logger.Logf, source NodeSource, nodeLogID, domainLogID logid.PrivateID, tun, sock Device, netMon *netmon.Monitor, health *health.Tracker, bus *eventbus.Bus, logExitFlowEnabledEnabled bool) error
Startup starts an asynchronous network logger that monitors statistics for the provided tun and/or sock device.
The tun Device captures packets within the tailscale network, where at least one address is usually a tailscale IP address. The source is usually from the perspective of the current node. If one of the other endpoint is not a tailscale IP address, then it suggests the use of a subnet router or exit node. For example, when using a subnet router, the source address is the tailscale IP address of the current node, and the destination address is an IP address within the subnet range. In contrast, when acting as a subnet router, the source address is an IP address within the subnet range, and the destination is a tailscale IP address that initiated the subnet proxy connection. In this case, the node acting as a subnet router is acting on behalf of some remote endpoint within the subnet range. The tun is used to populate the VirtualTraffic, SubnetTraffic, and ExitTraffic fields in netlogtype.Message.
The sock Device captures packets at the magicsock layer. The source is always a tailscale IP address and the destination is a non-tailscale IP address to contact for that particular tailscale node. The IP protocol and source port are always zero. The sock is used to populated the PhysicalTraffic field in netlogtype.Message.
The netMon parameter is optional; if non-nil it's used to do faster interface lookups.
source provides on-demand node lookups for connections seen by the logger. It must be non-nil.
type NodeSource ¶ added in v1.102.0
type NodeSource interface {
// SelfNode returns the local node and its owning user profile.
// Both views may be invalid if no self node is known yet.
SelfNode() (node tailcfg.NodeView, user tailcfg.UserProfileView)
// NodeByAddr returns the node assigned the given address along with
// its owning user profile.
// ok is false if no node is known to own addr.
NodeByAddr(addr netip.Addr) (node tailcfg.NodeView, user tailcfg.UserProfileView, ok bool)
}
NodeSource provides node lookups for the network logger. Methods may be called concurrently.
Source Files