mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 18:36:52 +01:00
Jay WrenandClaude
e14772ac0c
RawConn builds IPv4 headers only, but WriteTo called As4() on every destination. Once a handshake passed tun.multiport.tx_handshake_delay, the handshake manager sent a multiport copy to every remote, and the first IPv6 address panicked with "As4 called on IPv6 address". The tunnel send path in inside.go had the same problem for any multiport tunnel with an IPv6 remote. Add udp.RawSupported and only use the raw socket for IPv4 (and IPv4-mapped) destinations; IPv6 remotes fall back to the normal UDP writer. RawConn.WriteTo now returns an error rather than panicking, matching ErrInvalidIPv6RemoteForSocket on the regular UDP sockets. Seen in production on v1.11.1-slack1: https://slack-pde.slack.com/archives/GK7NPNGPP/p1792590741819449 Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
28 lines
600 B
Go
28 lines
600 B
Go
package udp
|
|
|
|
import (
|
|
mathrand "math/rand"
|
|
"net/netip"
|
|
)
|
|
|
|
type SendPortGetter interface {
|
|
// UDPSendPort returns the port to use
|
|
UDPSendPort(maxPort int) uint16
|
|
}
|
|
|
|
type randomSendPort struct{}
|
|
|
|
func (randomSendPort) UDPSendPort(maxPort int) uint16 {
|
|
return uint16(mathrand.Intn(maxPort))
|
|
}
|
|
|
|
var RandomSendPort = randomSendPort{}
|
|
|
|
// RawSupported reports whether (*RawConn).WriteTo can send to addr. The raw
|
|
// socket only builds IPv4 headers, so IPv6 destinations must use the normal
|
|
// UDP socket.
|
|
func RawSupported(addr netip.AddrPort) bool {
|
|
a := addr.Addr()
|
|
return a.Is4() || a.Is4In6()
|
|
}
|