conn25

package
v1.98.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 14, 2026 License: BSD-3-Clause Imports: 38 Imported by: 0

Documentation

Overview

Package conn25 registers the conn25 feature and implements its associated ipnext.Extension. conn25 will be an app connector like feature that routes traffic for configured domains via connector devices and avoids the "too many routes" pitfall of app connector. It is currently (2026-02-04) some peer API routes for clients to tell connectors about their desired routing.

Index

Constants

View Source
const (
	// OK indicates that the mapping was created as requested.
	OK TransitIPResponseCode = 0

	// OtherFailure indicates that the mapping failed for a reason that does not have
	// another relevant [TransitIPResponseCode].
	OtherFailure TransitIPResponseCode = 1

	// DuplicateTransitIP indicates that the same transit address appeared more than
	// once in a [ConnectorTransitIPRequest].
	DuplicateTransitIP TransitIPResponseCode = 2

	// NoMatchingPeerIPFamily indicates that the peer did not have an associated
	// IP with the same family as transit IP being registered.
	NoMatchingPeerIPFamily = 3

	// AddrFamilyMismatch indicates that the transit IP and destination IP addresses
	// do not belong to the same IP family.
	AddrFamilyMismatch = 4

	// UnknownAppName indicates that the connector is not configured to handle requests
	// for the App name that was specified in the request.
	UnknownAppName = 5
)
View Source
const AppConnectorsExperimentalAttrName = "tailscale.com/app-connectors-experimental"

Variables

View Source
var (
	ErrUnmappedMagicIP         = errors.New("unmapped magic IP")
	ErrUnmappedSrcAndTransitIP = errors.New("unmapped src and transit IP")
)

Functions

This section is empty.

Types

type Conn25

type Conn25 struct {
	// contains filtered or unexported fields
}

Conn25 holds state for routing traffic for a domain via a connector.

func (*Conn25) ClientTransitIPForMagicIP added in v1.98.0

func (c *Conn25) ClientTransitIPForMagicIP(m netip.Addr) (netip.Addr, error)

ClientTransitIPForMagicIP implements IPMapper.

func (*Conn25) ConnectorRealIPForTransitIPConnection added in v1.98.0

func (c *Conn25) ConnectorRealIPForTransitIPConnection(src, transit netip.Addr) (netip.Addr, error)

ConnectorRealIPForTransitIPConnection implements IPMapper.

type ConnectorTransitIPRequest

type ConnectorTransitIPRequest struct {
	// TransitIPs is the list of requested mappings.
	TransitIPs []TransitIPRequest `json:"transitIPs,omitempty"`
}

ConnectorTransitIPRequest is the request body for a PeerAPI request to /connector/transit-ip and can include zero or more TransitIP allocation requests.

type ConnectorTransitIPResponse

type ConnectorTransitIPResponse struct {
	// TransitIPs is the list of outcomes for each requested mapping. Elements
	// correspond to the order of [ConnectorTransitIPRequest.TransitIPs].
	TransitIPs []TransitIPResponse `json:"transitIPs,omitempty"`
}

ConnectorTransitIPResponse is the response to a ConnectorTransitIPRequest

type FlowData added in v1.98.0

type FlowData struct {
	Tuple  flowtrack.Tuple
	Action PacketAction
}

FlowData is an entry stored in the FlowTable.

type FlowTable added in v1.98.0

type FlowTable struct {
	// contains filtered or unexported fields
}

FlowTable stores and retrieves FlowData that can be looked up by 5-tuple. New entries specify the tuple to use for both directions of traffic flow. The underlying cache is LRU, and the maximum number of entries is specified in calls to NewFlowTable. FlowTable has its own mutex and is safe for concurrent use.

func NewFlowTable added in v1.98.0

func NewFlowTable(maxEntries int) *FlowTable

NewFlowTable returns a FlowTable maxEntries maximum entries. A maxEntries of 0 indicates no maximum. See also FlowTable.

func (*FlowTable) LookupFromTunDevice added in v1.98.0

func (t *FlowTable) LookupFromTunDevice(k flowtrack.Tuple) (FlowData, bool)

LookupFromTunDevice looks up a FlowData entry that is valid to run for packets observed as coming from the tun device. The tuple must match the direction it was stored with.

func (*FlowTable) LookupFromWireGuard added in v1.98.0

func (t *FlowTable) LookupFromWireGuard(k flowtrack.Tuple) (FlowData, bool)

LookupFromWireGuard looks up a FlowData entry that is valid to run for packets observed as coming from the WireGuard tunnel. The tuple must match the direction it was stored with.

func (*FlowTable) NewFlowFromTunDevice added in v1.98.0

func (t *FlowTable) NewFlowFromTunDevice(fwd, rev FlowData) error

NewFlowFromTunDevice installs (or overwrites) both the forward and return entries. The forward tuple is tagged as FromTun, and the return tuple is tagged as FromWireGuard. If overwriting, it removes the old paired tuple for the forward key to avoid stale reverse mappings.

func (*FlowTable) NewFlowFromWireGuard added in v1.98.0

func (t *FlowTable) NewFlowFromWireGuard(fwd, rev FlowData) error

NewFlowFromWireGuard installs (or overwrites) both the forward and return entries. The forward tuple is tagged as FromWireGuard, and the return tuple is tagged as FromTun. If overwriting, it removes the old paired tuple for the forward key to avoid stale reverse mappings.

type IPMapper added in v1.98.0

type IPMapper interface {
	// ClientTransitIPForMagicIP returns a Transit IP for the given magicIP on a client.
	// If the magicIP is within a configured Magic IP range for an app on the client,
	// but not mapped to an active Transit IP, implementations should return [ErrUnmappedMagicIP].
	// If magicIP is not within a configured Magic IP range, i.e. it is not actually a Magic IP,
	// implementations should return a nil error, and a zero-value [netip.Addr] to indicate
	// this potentially valid, non-app-connector traffic.
	ClientTransitIPForMagicIP(magicIP netip.Addr) (netip.Addr, error)

	// ConnectorRealIPForTransitIPConnection returns a real destination IP for the given
	// srcIP and transitIP on a connector. If the transitIP is within a configured Transit IP
	// range for an app on the connector, but not mapped to the client at srcIP, implementations
	// should return [ErrUnmappedSrcAndTransitIP]. If the transitIP is not within a configured
	// Transit IP range, i.e. it is not actually a Transit IP, implementations should return
	// a nil error, and a zero-value [netip.Addr] to indicate this is potentially valid,
	// non-app-connector traffic.
	ConnectorRealIPForTransitIPConnection(srcIP netip.Addr, transitIP netip.Addr) (netip.Addr, error)
}

IPMapper provides methods for mapping special app connector IPs to each other in aid of performing DNAT and SNAT on app connector packets.

type Origin added in v1.98.0

type Origin uint8

Origin is used to track the direction of a flow.

const (
	// FromTun indicates the flow is from the tun device.
	FromTun Origin = iota

	// FromWireGuard indicates the flow is from the WireGuard tunnel.
	FromWireGuard
)

type PacketAction added in v1.98.0

type PacketAction func(*packet.Parsed)

PacketAction may modify the packet.

type TransitIPRequest

type TransitIPRequest struct {
	// TransitIP is the intermediate destination IP that will be received at this
	// connector and will be replaced by DestinationIP when performing DNAT.
	TransitIP netip.Addr `json:"transitIP,omitzero"`

	// DestinationIP is the final destination IP that connections to the TransitIP
	// should be mapped to when performing DNAT.
	DestinationIP netip.Addr `json:"destinationIP,omitzero"`

	// App is the name of the connector application from the tailnet
	// configuration.
	App string `json:"app,omitzero"`
}

TransitIPRequest details a single TransitIP allocation request from a client to a connector.

type TransitIPResponse

type TransitIPResponse struct {
	// Code is an error code indicating success or failure of the [TransitIPRequest].
	Code TransitIPResponseCode `json:"code,omitzero"`
	// Message is an error message explaining what happened, suitable for logging but
	// not necessarily suitable for displaying in a UI to non-technical users. It
	// should be empty when [Code] is [OK].
	Message string `json:"message,omitzero"`
}

TransitIPResponse is the response to a TransitIPRequest

type TransitIPResponseCode

type TransitIPResponseCode int

TransitIPResponseCode appears in TransitIPResponse and signifies success or failure status.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL