Documentation
¶
Overview ¶
Package netns contains the common code for using the Go net package in a logical "network namespace" to avoid routing loops where Tailscale-created packets would otherwise loop back through Tailscale routes.
Despite the name netns, the exact mechanism used differs by operating system, and perhaps even by version of the OS.
The netns package also handles connecting via SOCKS proxies when configured by the environment.
Index ¶
- func IsSOCKSDialer(d Dialer) bool
- func Listener(logf logger.Logf, netMon *netmon.Monitor) *net.ListenConfig
- func SetBindToInterfaceByRoute(logf logger.Logf, v bool)
- func SetDisableAndroidBindToActiveNetwork(logf logger.Logf, v bool)
- func SetDisableBindConnToInterface(logf logger.Logf, v bool)
- func SetDisableBindConnToInterfaceAppleExt(logf logger.Logf, v bool)
- func SetEnabled(on bool)
- func SetListenConfigInterfaceName(lc *net.ListenConfig, ifName string) error
- func UseSocketMark() bool
- type Dialer
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsSOCKSDialer ¶
IsSOCKSDialer reports whether d is SOCKS-proxying dialer as returned by NewDialer or FromDialer.
func Listener ¶
Listener returns a new net.Listener with its Control hook func initialized as necessary to run in logical network namespace that doesn't route back into Tailscale.
func SetBindToInterfaceByRoute ¶ added in v1.36.1
SetBindToInterfaceByRoute enables or disables whether we use the system's route information to bind to a particular interface. It is the same as setting the TS_BIND_TO_INTERFACE_BY_ROUTE.
Currently, this only changes the behaviour on macOS and Windows.
func SetDisableAndroidBindToActiveNetwork ¶ added in v1.98.0
SetDisableAndroidBindToActiveNetwork disables the default behavior of binding sockets to the currently active network on Android.
func SetDisableBindConnToInterface ¶ added in v1.36.1
SetDisableBindConnToInterface disables the (normal) behavior of binding connections to the default network interface on Darwin nodes.
Unless you intended to disable this for tailscaled on macos (which is likely to break things), you probably wanted to set SetDisableBindConnToInterfaceAppleExt which will disable explicit interface binding only when tailscaled is running inside a network extension process.
func SetDisableBindConnToInterfaceAppleExt ¶ added in v1.92.0
SetDisableBindConnToInterfaceAppleExt disables the (normal) behavior of binding connections to the default network interface but only on Apple clients where tailscaled is running inside a network extension.
func SetEnabled ¶ added in v1.16.0
func SetEnabled(on bool)
SetEnabled enables or disables netns for the process. It defaults to being enabled.
func SetListenConfigInterfaceName ¶ added in v1.104.0
func SetListenConfigInterfaceName(lc *net.ListenConfig, ifName string) error
SetListenConfigInterfaceName sets lc.Control so that sockets created with it are bound to the named interface using SO_BINDTODEVICE, and thus only receive packets that arrived on that interface. It is the Linux counterpart of darwin's SetListenConfigInterfaceIndex.
Failures to set the socket option are logged and otherwise ignored: the socket then simply listens as it would have without this call. Setting SO_BINDTODEVICE requires CAP_NET_RAW, and hardening must not take out the caller's listener on systems where that is unavailable.
func UseSocketMark ¶ added in v1.32.0
func UseSocketMark() bool
UseSocketMark reports whether SO_MARK is in use. If it doesn't, we have to use SO_BINDTODEVICE on our sockets instead.
Types ¶
type Dialer ¶
type Dialer interface {
Dial(network, address string) (net.Conn, error)
DialContext(ctx context.Context, network, address string) (net.Conn, error)
}
Dialer is the interface for a dialer that can dial with or without a context. It's the type implemented both by net.Dialer and the Go SOCKS dialer.
func FromDialer ¶
FromDialer returns sets d.Control as necessary to run in a logical network namespace that doesn't route back into Tailscale. It also handles using a SOCKS if configured in the environment with ALL_PROXY.
Source Files