wgengine/router: add auto selection heuristic for iptables/nftables

This commit replaces the TS_DEBUG_USE_NETLINK_NFTABLES envknob with
a TS_DEBUG_FIREWALL_MODE that should be set to either 'iptables' or
'nftables' to select firewall mode manually, other wise tailscaled
will automatically choose between iptables and nftables depending on
environment and system availability.

updates: #319
Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>
This commit is contained in:
KevinLiang10
2023-08-01 02:43:13 +00:00
committed by KevinLiang10
parent 17ed2da94d
commit ae63c51ff1
5 changed files with 217 additions and 14 deletions

View File

@ -29,6 +29,31 @@ const (
Masq
)
type ErrorFWModeNotSupported struct {
Mode FirewallMode
Err error
}
func (e ErrorFWModeNotSupported) Error() string {
return fmt.Sprintf("firewall mode %q not supported: %v", e.Mode, e.Err)
}
func (e ErrorFWModeNotSupported) Is(target error) bool {
_, ok := target.(ErrorFWModeNotSupported)
return ok
}
func (e ErrorFWModeNotSupported) Unwrap() error {
return e.Err
}
type FirewallMode string
const (
FirewallModeIPTables FirewallMode = "iptables"
FirewallModeNfTables FirewallMode = "nftables"
)
// The following bits are added to packet marks for Tailscale use.
//
// We tried to pick bits sufficiently out of the way that it's