wgengine/router: add auto selection heuristic for iptables/nftables
This commit replaces the TS_DEBUG_USE_NETLINK_NFTABLES envknob with a TS_DEBUG_FIREWALL_MODE that should be set to either 'iptables' or 'nftables' to select firewall mode manually, other wise tailscaled will automatically choose between iptables and nftables depending on environment and system availability. updates: #319 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
This commit is contained in:

committed by
KevinLiang10

parent
17ed2da94d
commit
ae63c51ff1
@ -29,6 +29,31 @@ const (
|
||||
Masq
|
||||
)
|
||||
|
||||
type ErrorFWModeNotSupported struct {
|
||||
Mode FirewallMode
|
||||
Err error
|
||||
}
|
||||
|
||||
func (e ErrorFWModeNotSupported) Error() string {
|
||||
return fmt.Sprintf("firewall mode %q not supported: %v", e.Mode, e.Err)
|
||||
}
|
||||
|
||||
func (e ErrorFWModeNotSupported) Is(target error) bool {
|
||||
_, ok := target.(ErrorFWModeNotSupported)
|
||||
return ok
|
||||
}
|
||||
|
||||
func (e ErrorFWModeNotSupported) Unwrap() error {
|
||||
return e.Err
|
||||
}
|
||||
|
||||
type FirewallMode string
|
||||
|
||||
const (
|
||||
FirewallModeIPTables FirewallMode = "iptables"
|
||||
FirewallModeNfTables FirewallMode = "nftables"
|
||||
)
|
||||
|
||||
// The following bits are added to packet marks for Tailscale use.
|
||||
//
|
||||
// We tried to pick bits sufficiently out of the way that it's
|
||||
|
Reference in New Issue
Block a user