Cert v2 + tun changes for Linux #1224
Conversation
JackDoan
force-pushed
the
cert-v2-v6-linux
branch
from
559e8f2 to
8bf2f2d
Compare
JackDoan
force-pushed
the
cert-v2-v6-linux
branch
from
c2a1f13 to
2f8ad7c
Compare
| @@ -52,11 +52,13 @@ func newWaterTun(c *config.C, l *logrus.Logger, cidr netip.Prefix, _ bool) (*wat | |||
|
|
|||
| func (t *waterTun) Activate() error { | |||
| var err error | |||
| //TODO multi-ip support | |||
There was a problem hiding this comment.
this is a very ugly hack
There was a problem hiding this comment.
We can probably safely remove the fallback windows tap driver support now.
| @@ -1170,6 +1170,9 @@ func (lhh *LightHouseHandler) handleHostUpdateNotification(n *NebulaMeta, vpnAdd | |||
| useVersion = 2 | |||
| } | |||
|
|
|||
| //todo hosts with only v2 certs cannot provide their ipv6 addr when contacting the lighthouse via v4? | |||
| //todo why do we care about the vpnip in the packet? We know where it came from, right? | |||
There was a problem hiding this comment.
Its a great question and I have it in my internals notes as well as ditching the V4AddrPort in v2 protocol stuff.
| @@ -1170,6 +1170,9 @@ func (lhh *LightHouseHandler) handleHostUpdateNotification(n *NebulaMeta, vpnAdd | |||
| useVersion = 2 | |||
| } | |||
|
|
|||
| //todo hosts with only v2 certs cannot provide their ipv6 addr when contacting the lighthouse via v4? | |||
There was a problem hiding this comment.
They should default to protocol v2, are you seeing something I'm missing?
There was a problem hiding this comment.
protocol v2 is working, this is actually a multi-IP issue in a funny hat.
If you have a LH at 10.0.0.1 and you contact it via 10.0.0.2 (who is also fc00:02), because we try to use the IP in the message instead of the hostmap, the LH will never learn the underlay IP for fc00:02, unless you also contact it via overlay-ipv6.
There was a problem hiding this comment.
Unless of course, I have something backwards
There was a problem hiding this comment.
Ah gotcha. Yeah this and the hostmap don't understand follow on addresses yet. We need a final loop on the updates to point all subsequent addresses to the primary address. I have some of this code staged but its not ready just yet.
| if err != nil { | ||
| return fmt.Errorf("failed to get tun device link: %s", err) | ||
| // Run the interface | ||
| ifrf.Flags = ifrf.Flags | unix.IFF_UP | unix.IFF_RUNNING |
There was a problem hiding this comment.
It's likely entirely academic but we had waited until everything else was done before RUNNING the device to avoid packet loss from not yet fully configured devices
|
Ship it! |
No description provided.