personal_interest_mirrors/nebula
1
0
Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2026-08-15 10:36:57 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

linux: let the kernel resolve the tun.dev %d template atomically

Browse Source 
Resolving the template in userspace (LinkList then TUNSETIFF) races with
concurrent instances: both can pick nebula0, and with multiqueue the loser
silently attaches as a second queue to the winner's device instead of
failing. TUNSETIFF natively substitutes a single %d via dev_alloc_name,
atomically and always allocating a fresh device, so keep the fail-fast
validation but pass the template through and read the resolved name back.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg7oD3uZ4jZjjQ4gRsPAwB
This commit is contained in:
JackDoan
2026-07-09 18:37:30 -05:00
parent 57e1a9b6af
commit bc04261d0b
3 changed files with 17 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
overlay/tun_linux.go
+12 -49
View File
@@ -251,10 +251,14 @@ func newTunFromFd(c *config.C, l *slog.Logger, deviceFd int, vpnNetworks []netip
}
func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, multiqueue bool) (*tun, error) {
// Resolve (and validate) the device name up front so a bad tun.dev fails
// fast, before we open /dev/net/tun or leak a file descriptor.
tunName, err := findNextTunName(c.GetString("tun.dev", "nebula%d"))
if err != nil {
// Validate the device name up front so a bad tun.dev fails fast, before we
// open /dev/net/tun or leak a file descriptor. A single %d in the name is
// substituted by the kernel during TUNSETIFF (dev_alloc_name) with the
// lowest number that yields an unused device name. Resolving the template
// in the kernel keeps the pick-a-name/create-the-device pair atomic, so
// concurrent callers can never race each other to the same name.
tunName := c.GetString("tun.dev", "nebula%d")
if err := validateTunName(tunName); err != nil {
return nil, err
}
@@ -318,55 +322,14 @@ func validateTunName(tunName string) error {
if tunName == "%d" {
return errors.New("please don't name your tun device '%d'")
}
// The shortest name a template can produce replaces %d with a single digit;
// if even that is not shorter than IFNAMSIZ the template can never yield a
// usable name.
if len(tunName)-len("%d")+len("0") >= unix.IFNAMSIZ {
return fmt.Errorf("tun.dev template %q would result in a name that is not shorter than the maximum device name length of %d", tunName, unix.IFNAMSIZ)
// The kernel substitutes the %d itself and requires the template, like a
// literal name, to be NUL-terminated within IFNAMSIZ bytes.
if len(tunName) >= unix.IFNAMSIZ {
return fmt.Errorf("tun.dev template %q is not shorter than the maximum device name length of %d", tunName, unix.IFNAMSIZ)
}
return nil
}
// findNextTunName resolves a tun.dev value into a concrete device name. A value
// without a "%d" is returned unchanged; a "%d" placeholder (anywhere in the
// name) has the lowest unused integer substituted in based on the devices
// currently present.
func findNextTunName(tunName string) (string, error) {
if err := validateTunName(tunName); err != nil {
return "", err
}
if !strings.Contains(tunName, "%d") {
return tunName, nil
}
links, err := netlink.LinkList()
if err != nil {
return "", err
}
used := make(map[string]struct{}, len(links))
for _, link := range links {
used[link.Attrs().Name] = struct{}{}
}
return nextTunName(tunName, used)
}
// nextTunName substitutes the lowest unused integer into a template's "%d"
// placeholder, skipping any name present in used. tunName is assumed to have
// already passed validateTunName (exactly one "%d", room for a digit). It errors
// only if every candidate that is shorter than IFNAMSIZ is already taken.
func nextTunName(tunName string, used map[string]struct{}) (string, error) {
prefix, suffix, _ := strings.Cut(tunName, "%d")
for i := 0; ; i++ {
candidateName := fmt.Sprintf("%s%d%s", prefix, i, suffix)
if len(candidateName) >= unix.IFNAMSIZ {
return "", fmt.Errorf("all device names matching template %q shorter than the maximum length of %d are already in use", tunName, unix.IFNAMSIZ)
}
if _, taken := used[candidateName]; !taken {
return candidateName, nil
}
}
}
// newTunGeneric does all the stuff common to different tun initialization paths. It will close your files on error.
func newTunGeneric(c *config.C, l *slog.Logger, fd int, vpnNetworks []netip.Prefix) (*tun, error) {
tfd, err := newTunFd(fd)