use core::num::NonZeroU16;
use std::{
net::{Ipv4Addr, SocketAddr, SocketAddrV4},
sync::Arc,
};
use kameo::{
actor::ActorRef,
message::{Context, Message},
};
use netstack::{
CreateSocket, HasChannel,
netcore::{Channel, NetstackControl},
};
use tokio::{sync::watch, task::JoinSet};
use ts_transport::OverlayTransport;
use ts_transport_tun::{AsyncTunTransport, Config as TunDeviceConfig};
use crate::{
Error,
dataplane::{OverlayFromDataplane, OverlayToDataplane},
env::Env,
magic_dns::{
ClientTransport, Decision, DnsView, RecursivePlan, check_response_size_and_set_tc, decide,
forward_plan, forward_query,
},
peer_tracker::PeerState,
};
const MAGIC_DNS_IP: Ipv4Addr = Ipv4Addr::new(100, 100, 100, 100);
const MAGIC_DNS_PORT: u16 = 53;
const SERVICE_IP_REPLY_TTL: u8 = 64;
pub struct TunActor {
_joinset: JoinSet<()>,
env: Env,
tun_config: ts_control::TunConfig,
overlay_to_dataplane: Option<OverlayToDataplane>,
overlay_from_dataplane: Option<OverlayFromDataplane>,
host_guard: Option<HostGuard>,
peers: Option<Arc<crate::peer_tracker::PeerDb>>,
self_node: Option<Arc<ts_control::Node>>,
if_name: Option<String>,
last_magic_dns: bool,
dns_view: watch::Sender<Arc<DnsView>>,
channel: Channel,
}
struct HostGuard(Box<dyn ts_host_net::HostNet>);
impl HostGuard {
fn apply_routes(
&mut self,
routes: &ts_host_net::HostRoutes,
) -> Result<(), ts_host_net::HostNetError> {
self.0.apply_routes(routes)
}
}
impl Drop for HostGuard {
fn drop(&mut self) {
self.0.teardown();
}
}
pub(crate) fn tun_config_from_control(
cfg: &ts_control::TunConfig,
prefix: ipnet::Ipv4Net,
) -> TunDeviceConfig {
TunDeviceConfig {
name: cfg.name.clone().unwrap_or_else(|| "tailscale0".to_owned()),
mtu: cfg
.mtu
.and_then(NonZeroU16::new)
.unwrap_or(NonZeroU16::new(1280).unwrap()),
prefix: ipnet::IpNet::V4(prefix),
}
}
pub(crate) fn host_routes_from_node(
node: &ts_control::Node,
peers: Option<&crate::peer_tracker::PeerDb>,
if_name: String,
accept_routes: bool,
exit_id: Option<&ts_control::StableNodeId>,
magic_dns: bool,
) -> ts_host_net::HostRoutes {
let self_v4 = node.tailnet_address.ipv4;
let push_v4 = |routed: &mut Vec<ipnet::Ipv4Net>, net: ipnet::Ipv4Net| {
if net != self_v4 && !routed.contains(&net) {
routed.push(net);
}
};
let mut routed: Vec<ipnet::Ipv4Net> = Vec::new();
for route in &node.accepted_routes {
let ipnet::IpNet::V4(v4) = route else {
continue;
};
if v4.prefix_len() == 0 {
continue;
}
if accept_routes || !node.is_subnet_route(route) {
push_v4(&mut routed, *v4);
}
}
if let Some(peers) = peers {
for peer in peers.peers().values() {
for route in peer.routes_to_install(accept_routes, exit_id) {
if let ipnet::IpNet::V4(v4) = route {
push_v4(&mut routed, *v4);
}
}
}
}
if magic_dns {
let magic_dns_net = ipnet::Ipv4Net::new(MAGIC_DNS_IP, 32).expect("/32 is a valid prefix");
push_v4(&mut routed, magic_dns_net);
}
ts_host_net::HostRoutes {
if_name,
self_v4,
routed,
}
}
pub(crate) fn host_dns_from_dns_config(
dns: Option<&ts_control::DnsConfig>,
if_name: String,
accept_dns: bool,
) -> ts_host_net::HostDns {
let magic_dns = accept_dns && matches!(dns, Some(d) if d.magic_dns);
let match_domains = if let Some(d) = dns.filter(|_| magic_dns) {
let mut domains = d.search_domains.clone();
for suffix in d.routes.keys() {
if !domains.contains(suffix) {
domains.push(suffix.clone());
}
}
domains
} else {
vec![]
};
ts_host_net::HostDns {
if_name,
nameservers: if magic_dns {
vec![MAGIC_DNS_IP]
} else {
vec![]
},
match_domains,
}
}
struct MagicDnsQuery<'a> {
src: SocketAddrV4,
dns_payload: &'a [u8],
}
enum ServiceIpPacket<'a> {
Foreign,
DnsQuery(MagicDnsQuery<'a>),
DnsStream,
Absorbed {
reset: Option<Vec<u8>>,
},
}
fn classify_service_ip(pkt: &[u8]) -> ServiceIpPacket<'_> {
let Ok(sliced) = etherparse::SlicedPacket::from_ip(pkt) else {
return ServiceIpPacket::Foreign;
};
let (src_ip, dst_ip) = match sliced.net {
Some(etherparse::NetSlice::Ipv4(ipv4)) => (
ipv4.header().source_addr(),
ipv4.header().destination_addr(),
),
_ => return ServiceIpPacket::Foreign,
};
if dst_ip != MAGIC_DNS_IP {
return ServiceIpPacket::Foreign;
}
match sliced.transport {
Some(etherparse::TransportSlice::Udp(udp)) if udp.destination_port() == MAGIC_DNS_PORT => {
ServiceIpPacket::DnsQuery(MagicDnsQuery {
src: SocketAddrV4::new(src_ip, udp.source_port()),
dns_payload: udp.payload(),
})
}
Some(etherparse::TransportSlice::Tcp(tcp)) if tcp.destination_port() == MAGIC_DNS_PORT => {
ServiceIpPacket::DnsStream
}
Some(etherparse::TransportSlice::Tcp(tcp)) => ServiceIpPacket::Absorbed {
reset: build_tcp_reset(src_ip, &tcp),
},
_ => ServiceIpPacket::Absorbed { reset: None },
}
}
fn build_tcp_reset(dst_ip: Ipv4Addr, tcp: ðerparse::TcpSlice<'_>) -> Option<Vec<u8>> {
if tcp.rst() {
return None;
}
let builder = etherparse::PacketBuilder::ipv4(
MAGIC_DNS_IP.octets(),
dst_ip.octets(),
SERVICE_IP_REPLY_TTL,
)
.tcp(
tcp.destination_port(),
tcp.source_port(),
if tcp.ack() {
tcp.acknowledgment_number()
} else {
0
},
0,
)
.rst();
let builder = if tcp.ack() {
builder
} else {
let seg_len = tcp.payload().len() as u32 + u32::from(tcp.syn()) + u32::from(tcp.fin());
builder.ack(tcp.sequence_number().wrapping_add(seg_len))
};
let mut out = Vec::with_capacity(builder.size(0));
builder
.write(&mut out, &[])
.expect("writing an IPv4+TCP packet into a Vec is infallible");
Some(out)
}
fn build_dns_response(dst: SocketAddrV4, dns_response: &[u8]) -> Vec<u8> {
let builder = etherparse::PacketBuilder::ipv4(
MAGIC_DNS_IP.octets(),
dst.ip().octets(),
SERVICE_IP_REPLY_TTL,
)
.udp(MAGIC_DNS_PORT, dst.port());
let mut out = Vec::with_capacity(builder.size(dns_response.len()));
builder
.write(&mut out, dns_response)
.expect("writing an IPv4+UDP packet into a Vec is infallible");
out
}
fn build_dns_view(
env: &Env,
update: &ts_control::StateUpdate,
peers: Option<Arc<crate::peer_tracker::PeerDb>>,
enable_ipv6: bool,
) -> DnsView {
let exit_doh = env.exit_node().as_ref().and_then(|sel| {
let peers = peers.as_ref()?;
let id = sel.resolve(peers.peers().values())?;
peers
.peers()
.values()
.find(|peer| peer.stable_id == id)
.and_then(|n| n.peerapi_doh_addr())
});
DnsView {
cfg: update.dns_config.clone().unwrap_or_default(),
peers,
self_node: update.node.clone(),
exit_doh,
enable_ipv6,
accept_dns: env.accept_dns(),
}
}
enum Intercept {
NotIntercepted,
Dropped,
Absorbed {
reset: Option<Vec<u8>>,
},
DnsStream,
Reply {
response: Vec<u8>,
src: SocketAddrV4,
},
Forward {
plan: RecursivePlan,
query: Vec<u8>,
servfail: Vec<u8>,
src: SocketAddrV4,
},
}
fn plan_intercept(view: &DnsView, pkt: &[u8]) -> Intercept {
let query = match classify_service_ip(pkt) {
ServiceIpPacket::Foreign => return Intercept::NotIntercepted,
ServiceIpPacket::Absorbed { reset } => return Intercept::Absorbed { reset },
ServiceIpPacket::DnsStream => return Intercept::DnsStream,
ServiceIpPacket::DnsQuery(query) => query,
};
let src = query.src;
match decide(view, query.dns_payload) {
None => Intercept::Dropped,
Some(Decision::Reply(response)) => Intercept::Reply {
response: check_response_size_and_set_tc(
query.dns_payload,
response,
ClientTransport::Udp,
),
src,
},
Some(Decision::Forward {
upstreams,
query,
servfail,
recursive,
}) => {
let plan = forward_plan(view, upstreams, recursive);
Intercept::Forward {
plan,
query,
servfail,
src,
}
}
}
}
async fn send_dns_reply(device: &Arc<AsyncTunTransport>, src: SocketAddrV4, response: &[u8]) {
send_local_reply(
device,
build_dns_response(src, response),
"magic dns tun reply",
)
.await;
}
async fn send_local_reply(device: &Arc<AsyncTunTransport>, pkt: Vec<u8>, what: &str) {
if let Err(e) = device
.send(core::iter::once(ts_packet::PacketMut::from(pkt)))
.await
{
tracing::warn!(error = %e, what, "tun local reply send failed");
}
}
async fn up_pump(
dev_up: Arc<AsyncTunTransport>,
up: OverlayToDataplane,
dns_view_rx: watch::Receiver<Arc<DnsView>>,
dns_channel: Channel,
dns_tcp_tx: netstack::WakingPipeSender,
) {
const MAX_INFLIGHT_FORWARDS: usize = 256;
let mut forwards: JoinSet<()> = JoinSet::new();
loop {
let batch: Vec<_> = dev_up.recv().await.into_iter().collect();
for pkt in batch {
match pkt {
Ok(p) => {
let plan = plan_intercept(&dns_view_rx.borrow(), p.as_ref());
match plan {
Intercept::NotIntercepted => {
if up.send(vec![p]).is_err() {
return;
}
}
Intercept::Dropped => {}
Intercept::Absorbed { reset } => {
if let Some(reset) = reset {
send_local_reply(&dev_up, reset, "service ip tcp reset").await;
}
}
Intercept::DnsStream => {
dns_tcp_tx.send_async(p.as_ref()).await;
}
Intercept::Reply { response, src } => {
send_dns_reply(&dev_up, src, &response).await;
}
Intercept::Forward {
plan,
query,
servfail,
src,
} => {
if forwards.len() >= MAX_INFLIGHT_FORWARDS {
drop(forwards.join_next().await);
}
forwards.spawn(run_forward(
dev_up.clone(),
dns_channel.clone(),
plan,
query,
servfail,
src,
));
}
}
}
Err(e) => tracing::warn!(error = %e, "tun recv error"),
}
}
while forwards.try_join_next().is_some() {}
}
}
async fn run_forward(
device: Arc<AsyncTunTransport>,
channel: Channel,
plan: RecursivePlan,
query: Vec<u8>,
servfail: Vec<u8>,
src: SocketAddrV4,
) {
let response = match plan {
RecursivePlan::Udp(ups) => {
forward_query(&channel, &ups, &query, servfail, ClientTransport::Udp).await
}
RecursivePlan::Doh(addr) => {
crate::peerapi_doh::forward_doh(&channel, addr, &query, servfail, ClientTransport::Udp)
.await
}
};
send_local_reply(
&device,
build_dns_response(src, &response),
"magic dns tun forwarded reply",
)
.await;
}
const DNS_TCP_BUFFER: usize = 16 * 1024;
const DNS_TCP_BACKLOG: usize = 16;
async fn spawn_dns_tcp_service(
joinset: &mut JoinSet<()>,
device: Arc<AsyncTunTransport>,
mtu: u16,
dns_view_rx: watch::Receiver<Arc<DnsView>>,
forward_channel: Channel,
) -> netstack::WakingPipeSender {
let (up_tx, mut down_rx) =
spawn_dns_tcp_netstack(joinset, mtu, dns_view_rx, forward_channel).await;
joinset.spawn(async move {
while let Some(buf) = down_rx.recv_async().await {
send_local_reply(&device, buf.to_vec(), "magic dns tcp reply").await;
}
});
up_tx
}
async fn spawn_dns_tcp_netstack(
joinset: &mut JoinSet<()>,
mtu: u16,
dns_view_rx: watch::Receiver<Arc<DnsView>>,
forward_channel: Channel,
) -> (netstack::WakingPipeSender, netstack::WakingPipeReceiver) {
let config = netstack::netcore::Config {
mtu: usize::from(mtu),
tcp_buffer_size: DNS_TCP_BUFFER,
tcp_listen_backlog: DNS_TCP_BACKLOG,
..Default::default()
};
let (
mut netstack,
netstack::WakingPipe {
rx: down_rx,
tx: up_tx,
},
) = netstack::piped(config);
let channel = netstack.command_channel();
joinset.spawn(async move {
netstack.run_tokio().await;
tracing::warn!("magic dns tcp netstack stopped!");
});
if let Err(e) = channel.set_ips([core::net::IpAddr::V4(MAGIC_DNS_IP)]).await {
tracing::error!(error = %e, "magic dns tcp netstack address assignment failed; dns over tcp inert");
return (up_tx, down_rx);
}
let addr = SocketAddr::V4(SocketAddrV4::new(MAGIC_DNS_IP, MAGIC_DNS_PORT));
match channel.tcp_listen(addr).await {
Ok(listener) => {
joinset.spawn(crate::dns_over_tcp::serve(
listener,
dns_view_rx,
forward_channel,
));
}
Err(e) => {
tracing::error!(error = %e, %addr, "magic dns tcp listen failed; dns over tcp inert");
}
}
(up_tx, down_rx)
}
impl kameo::Actor for TunActor {
type Args = (
Env,
ts_control::TunConfig,
OverlayToDataplane,
OverlayFromDataplane,
Channel,
);
type Error = Error;
async fn on_start(
(env, tun_config, overlay_to_dataplane, overlay_from_dataplane, channel): Self::Args,
slf: ActorRef<Self>,
) -> Result<Self, Self::Error> {
env.subscribe::<Arc<ts_control::StateUpdate>>(&slf).await?;
env.subscribe::<Arc<PeerState>>(&slf).await?;
let (dns_view, _) = watch::channel(Arc::new(DnsView {
enable_ipv6: env.enable_ipv6,
accept_dns: env.accept_dns(),
..DnsView::default()
}));
Ok(Self {
_joinset: JoinSet::new(),
env,
tun_config,
overlay_to_dataplane: Some(overlay_to_dataplane),
overlay_from_dataplane: Some(overlay_from_dataplane),
host_guard: None,
peers: None,
self_node: None,
if_name: None,
last_magic_dns: false,
dns_view,
channel,
})
}
}
impl Message<Arc<ts_control::StateUpdate>> for TunActor {
type Reply = ();
async fn handle(
&mut self,
msg: Arc<ts_control::StateUpdate>,
_ctx: &mut Context<Self, Self::Reply>,
) {
let env = &self.env;
self.dns_view.send_modify(|view| {
*view = Arc::new(build_dns_view(
env,
&msg,
view.peers.clone(),
view.enable_ipv6,
));
});
let Some(self_node) = &msg.node else {
return;
};
let (Some(up), Some(down)) = (
self.overlay_to_dataplane.take(),
self.overlay_from_dataplane.take(),
) else {
return;
};
let device_config =
tun_config_from_control(&self.tun_config, self_node.tailnet_address.ipv4);
let device = match AsyncTunTransport::new(&device_config) {
Ok(d) => Arc::new(d),
Err(e) => {
tracing::error!(error = %e, "TUN device creation failed; no overlay data path (fail-closed)");
return;
}
};
let if_name = device.name();
let mut host = match ts_host_net::host_net() {
Ok(h) => h,
Err(e) => {
tracing::error!(error = %e, "host net unsupported; TUN idle (fail-closed)");
return;
}
};
let accept_dns = self.env.accept_dns();
let magic_dns = accept_dns && msg.dns_config.as_ref().is_some_and(|d| d.magic_dns);
let accept_routes = self.env.accept_routes();
let exit_id = self.env.exit_node().as_ref().and_then(|sel| {
self.peers
.as_ref()
.and_then(|peers| sel.resolve(peers.peers().values()))
});
let routes = host_routes_from_node(
self_node,
self.peers.as_deref(),
if_name.clone(),
accept_routes,
exit_id.as_ref(),
magic_dns,
);
if let Err(e) = host.apply_routes(&routes) {
tracing::error!(error = %e, "host route programming failed; TUN idle (fail-closed)");
host.teardown();
return; }
self.self_node = Some(Arc::new(self_node.clone()));
self.if_name = Some(if_name.clone());
self.last_magic_dns = magic_dns;
if let Err(e) = host.apply_dns(&host_dns_from_dns_config(
msg.dns_config.as_ref(),
if_name,
accept_dns,
)) {
tracing::warn!(error = %e, "host dns programming failed (continuing; routes are up)");
}
self.host_guard = Some(HostGuard(host));
let dev_up = device.clone();
let dns_view_rx = self.dns_view.subscribe();
let dns_channel = self.channel.clone();
let dns_tcp_tx = spawn_dns_tcp_service(
&mut self._joinset,
device.clone(),
device_config.mtu.get(),
self.dns_view.subscribe(),
dns_channel.clone(),
)
.await;
self._joinset
.spawn(up_pump(dev_up, up, dns_view_rx, dns_channel, dns_tcp_tx));
let dev_down = device.clone();
let mut down = down;
self._joinset.spawn(async move {
while let Some(bufs) = down.recv().await {
if let Err(e) = dev_down.send(bufs).await {
tracing::warn!(error = %e, "tun send error");
}
}
tracing::warn!("tun downlink shut down!");
});
tracing::debug!(prefix = ?self_node.tailnet_address.ipv4, "TUN device created");
}
}
impl Message<Arc<PeerState>> for TunActor {
type Reply = ();
async fn handle(&mut self, state: Arc<PeerState>, _ctx: &mut Context<Self, Self::Reply>) {
self.peers = Some(state.peers.clone());
let exit_id = self
.env
.exit_node()
.as_ref()
.and_then(|sel| sel.resolve(state.peers.peers().values()));
let exit_doh = exit_id.as_ref().and_then(|id| {
state
.peers
.peers()
.values()
.find(|peer| &peer.stable_id == id)
.and_then(|n| n.peerapi_doh_addr())
});
let accept_dns = self.env.accept_dns();
self.dns_view.send_modify(|view| {
let mut next = (**view).clone();
next.peers = Some(state.peers.clone());
next.exit_doh = exit_doh;
next.accept_dns = accept_dns;
*view = Arc::new(next);
});
if let (Some(guard), Some(self_node), Some(if_name)) = (
self.host_guard.as_mut(),
self.self_node.as_ref(),
self.if_name.as_ref(),
) {
let routes = host_routes_from_node(
self_node,
Some(&state.peers),
if_name.clone(),
self.env.accept_routes(),
exit_id.as_ref(),
self.last_magic_dns,
);
if let Err(e) = guard.apply_routes(&routes) {
tracing::error!(error = %e, "host route re-steer failed; tearing down host FIB (fail-closed)");
self.host_guard = None;
}
}
}
}
#[cfg(test)]
mod tests {
use core::net::{Ipv4Addr, SocketAddr, SocketAddrV4};
use std::sync::Arc;
use ipnet::Ipv4Net;
use tokio::sync::watch;
use ts_control::TunConfig;
use super::{
Intercept, MAGIC_DNS_IP, MAGIC_DNS_PORT, build_dns_view, host_dns_from_dns_config,
host_routes_from_node, plan_intercept, spawn_dns_tcp_netstack, tun_config_from_control,
};
use crate::{
env::{Env, ForwarderConfig},
magic_dns::{Decision, RecursivePlan, decide, recursive_plan},
peer_tracker::PeerDb,
};
fn test_env(exit_node: Option<ts_control::ExitNodeSelector>) -> Env {
let (_shutdown_tx, shutdown_rx) = watch::channel(false);
Env::new(
ts_keys::NodeState::generate(),
shutdown_rx,
ForwarderConfig {
accept_routes: false,
accept_dns: true,
exit_node,
forward_routes: Vec::new(),
forward_tcp_ports: Vec::new(),
forward_udp_ports: Vec::new(),
forward_all_ports: false,
forward_exit_egress: false,
block_incoming: false,
exit_proxy: None,
peerapi_port: None,
taildrop_dir: None,
enable_ipv6: false,
wireguard_listen_port: None,
network_monitor: false,
persistent_keepalive_interval: None,
ingress_active: Arc::new(std::sync::atomic::AtomicBool::new(false)),
},
)
}
fn exit_peer(stable_id: &str, ipv4: &str, peerapi_port: u16) -> ts_control::Node {
use ts_control::{Node, StableNodeId, TailnetAddress};
Node {
id: 2,
user_id: 0,
stable_id: StableNodeId(stable_id.to_string()),
hostname: stable_id.to_string(),
tailnet: Some("ts.net".to_string()),
tags: vec![],
addresses: vec![
format!("{ipv4}/32").parse().unwrap(),
"fd7a::2/128".parse().unwrap(),
],
tailnet_address: TailnetAddress {
ipv4: format!("{ipv4}/32").parse().unwrap(),
ipv6: "fd7a::2/128".parse().unwrap(),
},
node_key: [1u8; 32].into(),
node_key_expiry: None,
key_signature: vec![],
machine_key: None,
disco_key: None,
accepted_routes: vec!["0.0.0.0/0".parse().unwrap()],
underlay_addresses: vec![],
derp_region: None,
cap: Default::default(),
cap_map: Default::default(),
peerapi_port: Some(peerapi_port),
peerapi_dns_proxy: true,
is_wireguard_only: false,
exit_node_dns_resolvers: vec![],
peer_relay: false,
ssh_host_keys: vec![],
service_vips: Default::default(),
unsigned_peer_api_only: false,
online: None,
last_seen: None,
}
}
fn peer_db_with(peer: &ts_control::Node) -> Arc<PeerDb> {
let mut db = PeerDb::default();
db.upsert(peer);
Arc::new(db)
}
fn udp_resolver(addr: &str) -> ts_control::DnsResolver {
ts_control::DnsResolver {
transport: ts_control::ResolverTransport::Udp(addr.parse().unwrap()),
use_with_exit_node: false,
}
}
fn build_query(id: u16, labels: &[&str]) -> Vec<u8> {
let mut buf: Vec<u8> = Vec::new();
buf.extend_from_slice(&id.to_be_bytes());
buf.extend_from_slice(&0u16.to_be_bytes()); buf.extend_from_slice(&1u16.to_be_bytes()); buf.extend_from_slice(&0u16.to_be_bytes()); buf.extend_from_slice(&0u16.to_be_bytes()); buf.extend_from_slice(&0u16.to_be_bytes()); for label in labels {
buf.push(label.len() as u8);
buf.extend_from_slice(label.as_bytes());
}
buf.push(0); buf.extend_from_slice(&1u16.to_be_bytes()); buf.extend_from_slice(&1u16.to_be_bytes()); buf
}
fn build_edns_query(id: u16, labels: &[&str], udp_size: u16) -> Vec<u8> {
let mut buf = build_query(id, labels);
buf[11] = 1; buf.push(0); buf.extend_from_slice(&41u16.to_be_bytes()); buf.extend_from_slice(&udp_size.to_be_bytes()); buf.extend_from_slice(&0u32.to_be_bytes()); buf.extend_from_slice(&0u16.to_be_bytes()); buf
}
fn tailnet_peer(stable_id: &str, id: u32, ipv4: &str, subnets: &[&str]) -> ts_control::Node {
use ts_control::{Node, StableNodeId, TailnetAddress};
let mut accepted_routes: Vec<ipnet::IpNet> =
vec![format!("{ipv4}/32").parse::<ipnet::IpNet>().unwrap()];
for s in subnets {
accepted_routes.push(s.parse().unwrap());
}
Node {
id: id as i64,
user_id: 0,
stable_id: StableNodeId(stable_id.to_string()),
hostname: stable_id.to_string(),
tailnet: Some("ts.net".to_string()),
tags: vec![],
addresses: vec![
format!("{ipv4}/32").parse().unwrap(),
format!("fd7a::{id}/128").parse().unwrap(),
],
tailnet_address: TailnetAddress {
ipv4: format!("{ipv4}/32").parse().unwrap(),
ipv6: format!("fd7a::{id}/128").parse().unwrap(),
},
node_key: [id as u8; 32].into(),
node_key_expiry: None,
key_signature: vec![],
machine_key: None,
disco_key: None,
accepted_routes,
underlay_addresses: vec![],
derp_region: None,
cap: Default::default(),
cap_map: Default::default(),
peerapi_port: None,
peerapi_dns_proxy: false,
is_wireguard_only: false,
exit_node_dns_resolvers: vec![],
peer_relay: false,
ssh_host_keys: vec![],
service_vips: Default::default(),
unsigned_peer_api_only: false,
online: None,
last_seen: None,
}
}
fn peer_db_from(peers: &[&ts_control::Node]) -> PeerDb {
let mut db = PeerDb::default();
for p in peers {
db.upsert(p);
}
db
}
fn prefix() -> Ipv4Net {
Ipv4Net::new(Ipv4Addr::new(100, 64, 0, 1), 32).unwrap()
}
fn fixture_node() -> ts_control::Node {
use ts_control::{Node, StableNodeId, TailnetAddress};
Node {
id: 1,
user_id: 0,
stable_id: StableNodeId("n1".to_string()),
hostname: "self".to_string(),
tailnet: Some("ts.net".to_string()),
tags: vec![],
addresses: vec![
"100.64.0.1/32".parse().unwrap(),
"fd7a::1/128".parse().unwrap(),
],
tailnet_address: TailnetAddress {
ipv4: "100.64.0.1/32".parse().unwrap(),
ipv6: "fd7a::1/128".parse().unwrap(),
},
node_key: [0u8; 32].into(),
node_key_expiry: None,
key_signature: vec![],
machine_key: None,
disco_key: None,
accepted_routes: vec![
"100.64.0.1/32".parse().unwrap(),
"fd7a::1/128".parse().unwrap(),
"192.168.1.0/24".parse().unwrap(),
"0.0.0.0/0".parse().unwrap(),
],
underlay_addresses: vec![],
derp_region: None,
cap: Default::default(),
cap_map: Default::default(),
peerapi_port: None,
peerapi_dns_proxy: false,
is_wireguard_only: false,
exit_node_dns_resolvers: vec![],
peer_relay: false,
ssh_host_keys: vec![],
service_vips: Default::default(),
unsigned_peer_api_only: false,
online: None,
last_seen: None,
}
}
#[test]
fn host_routes_includes_self_subnet_excludes_self_and_self_default() {
let node = fixture_node();
let routes = host_routes_from_node(&node, None, "utun9".to_owned(), true, None, false);
assert_eq!(routes.if_name, "utun9");
assert_eq!(routes.self_v4, "100.64.0.1/32".parse::<Ipv4Net>().unwrap());
assert!(
routes.routed.contains(&"192.168.1.0/24".parse().unwrap()),
"self-advertised subnet /24 must be routed when accept_routes is set"
);
assert!(
!routes.routed.contains(&"0.0.0.0/0".parse().unwrap()),
"the self node's own /0 echo must NOT be installed (host /0 is per-exit-peer)"
);
assert!(
!routes.routed.contains(&"100.64.0.1/32".parse().unwrap()),
"self /32 must never be re-routed"
);
}
#[test]
fn host_routes_excludes_subnet_without_accept_routes() {
let node = fixture_node();
let peer = tailnet_peer("p", 2, "100.64.0.2", &["10.0.0.0/24"]);
let db = peer_db_from(&[&peer]);
let routes =
host_routes_from_node(&node, Some(&db), "utun9".to_owned(), false, None, false);
assert!(
!routes.routed.contains(&"192.168.1.0/24".parse().unwrap()),
"self subnet /24 must be excluded when accept_routes is false"
);
assert!(
!routes.routed.contains(&"10.0.0.0/24".parse().unwrap()),
"peer subnet /24 must be excluded when accept_routes is false"
);
assert!(
routes.routed.contains(&"100.64.0.2/32".parse().unwrap()),
"peer /32 must always be routed even with accept_routes false"
);
}
#[test]
fn host_routes_drops_ipv6() {
let baseline =
host_routes_from_node(&fixture_node(), None, "utun9".to_owned(), true, None, false);
let mut node_v6 = fixture_node();
node_v6
.accepted_routes
.push("2001:db8::/32".parse().unwrap());
let routes_v6 =
host_routes_from_node(&node_v6, None, "utun9".to_owned(), true, None, false);
assert_eq!(
routes_v6.routed, baseline.routed,
"adding a v6 subnet to the self node must not change the v4-only routed set"
);
let mut v6_peer = tailnet_peer("v6p", 3, "100.64.0.3", &[]);
v6_peer
.accepted_routes
.push("2001:db8:1::/48".parse().unwrap());
let db = peer_db_from(&[&v6_peer]);
let routes_peer_v6 = host_routes_from_node(
&fixture_node(),
Some(&db),
"utun9".to_owned(),
true,
None,
false,
);
assert!(
routes_peer_v6
.routed
.contains(&"100.64.0.3/32".parse().unwrap()),
"the peer's v4 /32 is installed"
);
assert!(
!routes_peer_v6
.routed
.iter()
.any(|n| n.to_string().contains("2001")),
"no v6 prefix can appear in the v4-only routed set"
);
}
#[test]
fn host_routes_folds_peer_allowed_ips_and_gates_default_on_exit() {
use ts_control::StableNodeId;
let node = fixture_node();
let p1 = tailnet_peer("p1", 2, "100.64.0.2", &[]); let p2 = tailnet_peer("p2", 3, "100.64.0.3", &["10.1.0.0/24"]); let exit = tailnet_peer("exit", 4, "100.64.0.4", &["0.0.0.0/0"]); let db = peer_db_from(&[&p1, &p2, &exit]);
let p1_32: Ipv4Net = "100.64.0.2/32".parse().unwrap();
let p2_32: Ipv4Net = "100.64.0.3/32".parse().unwrap();
let exit_32: Ipv4Net = "100.64.0.4/32".parse().unwrap();
let p2_subnet: Ipv4Net = "10.1.0.0/24".parse().unwrap();
let default: Ipv4Net = "0.0.0.0/0".parse().unwrap();
let magic: Ipv4Net = "100.100.100.100/32".parse().unwrap();
let routes = host_routes_from_node(&node, Some(&db), "utun9".to_owned(), true, None, true);
assert!(routes.routed.contains(&p1_32), "peer p1 /32 must be routed");
assert!(routes.routed.contains(&p2_32), "peer p2 /32 must be routed");
assert!(
routes.routed.contains(&exit_32),
"peer exit /32 must be routed"
);
assert!(
routes.routed.contains(&p2_subnet),
"peer-advertised subnet must be routed when accept_routes is true"
);
assert!(!routes.routed.contains(&"100.64.0.1/32".parse().unwrap()));
assert!(
routes.routed.contains(&magic),
"MagicDNS /32 must be present when magic_dns"
);
assert!(
!routes.routed.contains(&default),
"no /0 may appear when no exit peer is selected (anti-leak)"
);
let no_accept =
host_routes_from_node(&node, Some(&db), "utun9".to_owned(), false, None, true);
assert!(no_accept.routed.contains(&p1_32));
assert!(no_accept.routed.contains(&p2_32));
assert!(no_accept.routed.contains(&exit_32));
assert!(
!no_accept.routed.contains(&p2_subnet),
"peer subnet must drop when accept_routes is false"
);
let exit_id = StableNodeId("exit".to_owned());
let with_exit = host_routes_from_node(
&node,
Some(&db),
"utun9".to_owned(),
true,
Some(&exit_id),
true,
);
assert!(
with_exit.routed.contains(&default),
"the selected exit peer's /0 must be installed"
);
assert!(
with_exit.routed.contains(&exit_32),
"the exit peer's /32 stays routed"
);
let p1_id = StableNodeId("p1".to_owned());
let wrong_exit = host_routes_from_node(
&node,
Some(&db),
"utun9".to_owned(),
true,
Some(&p1_id),
true,
);
assert!(
!wrong_exit.routed.contains(&default),
"a selected peer that advertises no /0 contributes no host /0"
);
let p2_id = StableNodeId("p2".to_owned());
let other_exit = host_routes_from_node(
&node,
Some(&db),
"utun9".to_owned(),
true,
Some(&p2_id),
true,
);
assert!(
!other_exit.routed.contains(&default),
"the /0 advertised by `exit` must NOT be installed when a different peer (p2) is the \
selected exit — the default route is keyed on the selected peer only (anti-leak)"
);
assert!(other_exit.routed.contains(&p2_32));
assert!(other_exit.routed.contains(&p2_subnet));
}
#[test]
fn host_routes_dedups_overlapping_peer_subnets() {
let node = fixture_node(); let a = tailnet_peer("a", 2, "100.64.0.2", &["10.9.0.0/24"]);
let b = tailnet_peer("b", 3, "100.64.0.3", &["10.9.0.0/24", "192.168.1.0/24"]);
let db = peer_db_from(&[&a, &b]);
let routes = host_routes_from_node(&node, Some(&db), "utun9".to_owned(), true, None, false);
let shared: Ipv4Net = "10.9.0.0/24".parse().unwrap();
let self_subnet: Ipv4Net = "192.168.1.0/24".parse().unwrap();
assert_eq!(
routes.routed.iter().filter(|n| **n == shared).count(),
1,
"a subnet advertised by two peers must be installed exactly once"
);
assert_eq!(
routes.routed.iter().filter(|n| **n == self_subnet).count(),
1,
"a subnet advertised by both the self node and a peer must be installed exactly once"
);
}
#[test]
fn host_dns_nameservers_point_at_magic_dns_when_enabled() {
let none = host_dns_from_dns_config(None, "utun9".to_owned(), true);
assert!(none.nameservers.is_empty());
assert!(none.match_domains.is_empty());
let on = ts_control::DnsConfig {
magic_dns: true,
search_domains: vec!["user.ts.net.".to_owned()],
..Default::default()
};
let dns_on = host_dns_from_dns_config(Some(&on), "utun9".to_owned(), true);
assert_eq!(
dns_on.nameservers,
vec![Ipv4Addr::new(100, 100, 100, 100)],
"nameservers must point at the MagicDNS IP when MagicDNS is enabled"
);
assert_eq!(dns_on.match_domains, vec!["user.ts.net.".to_owned()]);
let dns_no_accept = host_dns_from_dns_config(Some(&on), "utun9".to_owned(), false);
assert!(
dns_no_accept.nameservers.is_empty(),
"accept_dns off must not point the resolver at the MagicDNS IP"
);
assert!(
dns_no_accept.match_domains.is_empty(),
"accept_dns off must program no search domains"
);
let off = ts_control::DnsConfig {
magic_dns: false,
search_domains: vec!["user.ts.net.".to_owned()],
..Default::default()
};
let dns_off = host_dns_from_dns_config(Some(&off), "utun9".to_owned(), true);
assert!(
dns_off.nameservers.is_empty(),
"nameservers must stay empty when MagicDNS is disabled"
);
assert!(dns_off.match_domains.is_empty());
}
#[test]
fn host_dns_match_domains_union_search_and_routes() {
use std::collections::BTreeMap;
let mut routes = BTreeMap::new();
routes.insert("corp.example.com".to_owned(), vec![]);
routes.insert("user.ts.net".to_owned(), vec![]); let cfg = ts_control::DnsConfig {
magic_dns: true,
search_domains: vec!["user.ts.net".to_owned()],
routes,
..Default::default()
};
let host = host_dns_from_dns_config(Some(&cfg), "utun9".to_owned(), true);
assert_eq!(
host.match_domains,
vec!["user.ts.net".to_owned(), "corp.example.com".to_owned()],
"match_domains = search ∪ route suffixes, deduped, search-first"
);
}
#[test]
fn host_dns_route_only_still_scopes() {
use std::collections::BTreeMap;
let mut routes = BTreeMap::new();
routes.insert("internal.corp".to_owned(), vec![]);
let cfg = ts_control::DnsConfig {
magic_dns: true,
search_domains: vec![], routes,
..Default::default()
};
let host = host_dns_from_dns_config(Some(&cfg), "utun9".to_owned(), true);
assert_eq!(
host.match_domains,
vec!["internal.corp".to_owned()],
"a route-only config must still scope the resolver to the route suffix"
);
}
#[test]
fn host_dns_no_domains_yields_empty_match_domains() {
let cfg = ts_control::DnsConfig {
magic_dns: true,
search_domains: vec![],
..Default::default()
};
let host = host_dns_from_dns_config(Some(&cfg), "utun9".to_owned(), true);
assert_eq!(
host.nameservers,
vec![Ipv4Addr::new(100, 100, 100, 100)],
"MagicDNS on still points nameservers at quad-100"
);
assert!(
host.match_domains.is_empty(),
"no search domain and no route ⇒ empty match_domains (host layer installs no resolver)"
);
}
#[test]
fn host_dns_match_domains_never_global_or_empty() {
use std::collections::BTreeMap;
let mut routes = BTreeMap::new();
routes.insert("corp.ts.net".to_owned(), vec![]);
let cfg = ts_control::DnsConfig {
magic_dns: true,
search_domains: vec![],
routes,
..Default::default()
};
let host = host_dns_from_dns_config(Some(&cfg), "utun9".to_owned(), true);
assert!(
!host.match_domains.iter().any(|d| d == "." || d.is_empty()),
"no global/empty match domain may ever reach the host resolver"
);
assert_eq!(host.match_domains, vec!["corp.ts.net".to_owned()]);
}
#[test]
fn host_routes_includes_magic_dns_when_enabled() {
let node = fixture_node();
let magic_dns_net: Ipv4Net = "100.100.100.100/32".parse().unwrap();
let with = host_routes_from_node(&node, None, "utun9".to_owned(), true, None, true);
assert!(
with.routed.contains(&magic_dns_net),
"100.100.100.100/32 must be routed when MagicDNS is enabled"
);
let without = host_routes_from_node(&node, None, "utun9".to_owned(), true, None, false);
assert!(
!without.routed.contains(&magic_dns_net),
"100.100.100.100/32 must not be routed when MagicDNS is disabled"
);
}
#[test]
fn classify_and_build_round_trip() {
use super::{ServiceIpPacket, build_dns_response, classify_service_ip};
let client: SocketAddrV4 = "100.64.0.7:34567".parse().unwrap();
let payload = b"hello-dns-query";
let query_pkt = {
let b = etherparse::PacketBuilder::ipv4(client.ip().octets(), [100, 100, 100, 100], 64)
.udp(client.port(), 53);
let mut out = Vec::with_capacity(b.size(payload.len()));
b.write(&mut out, payload).unwrap();
out
};
let ServiceIpPacket::DnsQuery(q) = classify_service_ip(&query_pkt) else {
panic!("quad-100/udp/53 is classified as DNS");
};
assert_eq!(q.src, client, "source endpoint extracted");
assert_eq!(q.dns_payload, payload, "DNS payload extracted");
let resp_payload = b"a-dns-answer";
let reply_pkt = build_dns_response(client, resp_payload);
let sliced = etherparse::SlicedPacket::from_ip(&reply_pkt).expect("reply parses");
match sliced.net {
Some(etherparse::NetSlice::Ipv4(ip)) => {
assert_eq!(
ip.header().source_addr(),
Ipv4Addr::new(100, 100, 100, 100),
"reply is FROM the MagicDNS service IP"
);
assert_eq!(
ip.header().destination_addr(),
*client.ip(),
"reply is TO the original querier"
);
}
_ => panic!("reply must be IPv4"),
}
match sliced.transport {
Some(etherparse::TransportSlice::Udp(udp)) => {
assert_eq!(udp.source_port(), 53, "reply source port is 53");
assert_eq!(
udp.destination_port(),
client.port(),
"reply dest port is the querier's source port"
);
assert_eq!(udp.payload(), resp_payload, "reply carries the DNS answer");
}
_ => panic!("reply must be UDP"),
}
}
fn udp_packet(client: SocketAddrV4, dst: [u8; 4], dport: u16) -> Vec<u8> {
let b = etherparse::PacketBuilder::ipv4(client.ip().octets(), dst, 64)
.udp(client.port(), dport);
let mut out = Vec::new();
b.write(&mut out, b"x").unwrap();
out
}
fn syn_packet(client: SocketAddrV4, dst: [u8; 4], dport: u16, seq: u32) -> Vec<u8> {
let b = etherparse::PacketBuilder::ipv4(client.ip().octets(), dst, 64)
.tcp(client.port(), dport, seq, 1024)
.syn();
let mut out = Vec::new();
b.write(&mut out, &[]).unwrap();
out
}
fn icmp_packet(client: SocketAddrV4, dst: [u8; 4]) -> Vec<u8> {
let b = etherparse::PacketBuilder::ipv4(client.ip().octets(), dst, 64)
.icmpv4_echo_request(1, 1);
let mut out = Vec::new();
b.write(&mut out, b"ping").unwrap();
out
}
#[test]
fn classify_passthrough_for_foreign_destinations() {
use super::{ServiceIpPacket, classify_service_ip};
let client: SocketAddrV4 = "100.64.0.7:1234".parse().unwrap();
assert!(
matches!(
classify_service_ip(&udp_packet(client, [8, 8, 8, 8], 53)),
ServiceIpPacket::Foreign
),
"UDP/53 to a non-quad-100 IP must pass through"
);
assert!(
matches!(
classify_service_ip(&syn_packet(client, [192, 0, 2, 10], 853, 7)),
ServiceIpPacket::Foreign
),
"a TCP SYN to a non-quad-100 IP must pass through"
);
assert!(
matches!(classify_service_ip(&[0u8; 4]), ServiceIpPacket::Foreign),
"unparseable bytes must pass through"
);
}
#[test]
fn service_ip_absorbs_every_non_dns_packet() {
use super::{ServiceIpPacket, classify_service_ip};
let client: SocketAddrV4 = "100.64.0.7:1234".parse().unwrap();
const QUAD_100: [u8; 4] = [100, 100, 100, 100];
for (pkt, what) in [
(syn_packet(client, QUAD_100, 853, 7), "a DoT SYN on :853"),
(syn_packet(client, QUAD_100, 80, 7), "an HTTP SYN on :80"),
] {
let ServiceIpPacket::Absorbed { reset } = classify_service_ip(&pkt) else {
panic!("{what} to quad-100 must be absorbed, never forwarded to the overlay");
};
assert!(reset.is_some(), "{what} must be answered with a RST");
}
for (pkt, what) in [
(udp_packet(client, QUAD_100, 443), "UDP to a non-53 port"),
(icmp_packet(client, QUAD_100), "an ICMP echo request"),
] {
let ServiceIpPacket::Absorbed { reset } = classify_service_ip(&pkt) else {
panic!("{what} to quad-100 must be absorbed, never forwarded to the overlay");
};
assert!(reset.is_none(), "{what} is dropped silently — no RST");
}
}
#[tokio::test]
async fn service_ip_tcp_dns_is_terminated_not_reset() {
use super::{ServiceIpPacket, classify_service_ip};
let client: SocketAddrV4 = "100.64.0.7:44321".parse().unwrap();
const QUAD_100: [u8; 4] = [100, 100, 100, 100];
assert!(
matches!(
classify_service_ip(&syn_packet(client, QUAD_100, 53, 7)),
ServiceIpPacket::DnsStream
),
"a SYN to quad-100:53 must be handed to the DNS-over-TCP service, never RST"
);
let view = build_dns_view(&test_env(None), &dns_update(vec![]), None, false);
assert!(
matches!(
plan_intercept(&view, &syn_packet(client, QUAD_100, 53, 7)),
Intercept::DnsStream
),
"the UP pump must route a quad-100:53 segment into the DNS-over-TCP service"
);
for port in [52, 54, 853] {
let ServiceIpPacket::Absorbed { reset } =
classify_service_ip(&syn_packet(client, QUAD_100, port, 7))
else {
panic!("quad-100:{port} is not served and must be absorbed with a RST");
};
assert!(
reset.is_some(),
"quad-100:{port} is not served and must be answered with a RST"
);
}
}
#[tokio::test]
async fn service_netstack_answers_a_dns_query_over_tcp() {
use netstack::{CreateSocket, HasChannel, netcore::NetstackControl};
use tokio::io::{AsyncReadExt, AsyncWriteExt};
const CLIENT: SocketAddrV4 = SocketAddrV4::new(Ipv4Addr::new(100, 64, 0, 1), 44321);
let mut joinset = tokio::task::JoinSet::new();
let mut peer = exit_peer("peer", "100.64.0.9", 1080);
peer.tailnet = Some("user.ts.net".to_owned());
let view = build_dns_view(
&test_env(None),
&dns_update(vec![]),
Some(peer_db_with(&peer)),
false,
);
let (_view_tx, view_rx) = watch::channel(Arc::new(view));
let (unused_stack, _unused_pipe) = netstack::piped(netstack::netcore::Config::default());
let forward_channel = unused_stack.command_channel();
let (service_tx, mut service_rx) =
spawn_dns_tcp_netstack(&mut joinset, 1280, view_rx, forward_channel).await;
let (mut client_stack, mut client_pipe) = netstack::piped(netstack::netcore::Config {
mtu: 1280,
..Default::default()
});
let client_channel = client_stack.command_channel();
joinset.spawn(async move { client_stack.run_tokio().await });
client_channel
.set_ips([core::net::IpAddr::V4(*CLIENT.ip())])
.await
.expect("client netstack takes its address");
let client_out = client_pipe.tx.clone();
joinset.spawn(async move {
while let Some(pkt) = service_rx.recv_async().await {
client_out.send_async(&pkt).await;
}
});
joinset.spawn(async move {
while let Some(pkt) = client_pipe.rx.recv_async().await {
service_tx.send_async(&pkt).await;
}
});
let mut stream = client_channel
.tcp_connect(
SocketAddr::V4(CLIENT),
SocketAddr::V4(SocketAddrV4::new(MAGIC_DNS_IP, MAGIC_DNS_PORT)),
)
.await
.expect("the service netstack completes the handshake instead of resetting it");
let query = build_query(0x7777, &["peer", "user", "ts", "net"]);
let len = u16::try_from(query.len()).expect("a query fits a length prefix");
stream
.write_all(&len.to_be_bytes())
.await
.expect("write the length prefix");
stream.write_all(&query).await.expect("write the query");
let mut len_buf = [0u8; 2];
stream
.read_exact(&mut len_buf)
.await
.expect("the answer carries its own length prefix");
let mut answer = vec![0u8; usize::from(u16::from_be_bytes(len_buf))];
stream
.read_exact(&mut answer)
.await
.expect("read the answer");
assert_eq!(
answer[0..2],
query[0..2],
"the answer echoes the query's transaction id"
);
assert_eq!(answer[3] & 0x0F, 0, "NOERROR");
assert_eq!(
u16::from_be_bytes([answer[6], answer[7]]),
1,
"one answer record"
);
assert_eq!(
&answer[answer.len() - 4..],
&[100, 64, 0, 9],
"and it is the peer's tailnet address"
);
}
#[test]
fn unserved_service_ip_tcp_port_is_reset() {
use super::{ServiceIpPacket, classify_service_ip};
let client: SocketAddrV4 = "100.64.0.7:44321".parse().unwrap();
const QUAD_100: [u8; 4] = [100, 100, 100, 100];
let ServiceIpPacket::Absorbed { reset: Some(rst) } =
classify_service_ip(&syn_packet(client, QUAD_100, 853, 1000))
else {
panic!("a SYN to an unserved quad-100 port must produce a RST");
};
let sliced = etherparse::SlicedPacket::from_ip(&rst).expect("the RST parses");
match sliced.net {
Some(etherparse::NetSlice::Ipv4(ip)) => {
assert_eq!(
ip.header().source_addr(),
Ipv4Addr::new(100, 100, 100, 100),
"the RST comes FROM the service IP"
);
assert_eq!(
ip.header().destination_addr(),
*client.ip(),
"the RST goes back TO the host that probed"
);
}
_ => panic!("the RST must be IPv4"),
}
match sliced.transport {
Some(etherparse::TransportSlice::Tcp(tcp)) => {
assert!(tcp.rst(), "RST flag set");
assert_eq!(tcp.source_port(), 853, "RST comes from the probed port");
assert_eq!(
tcp.destination_port(),
client.port(),
"RST goes to the prober's port"
);
assert!(tcp.ack(), "an un-ACKed SYN is answered with RST|ACK");
assert_eq!(tcp.sequence_number(), 0, "RST|ACK carries sequence 0");
assert_eq!(
tcp.acknowledgment_number(),
1001,
"SYN occupies one sequence number: ack = SEG.SEQ + 1"
);
}
_ => panic!("the RST must be TCP"),
}
let acked = {
let b = etherparse::PacketBuilder::ipv4(client.ip().octets(), QUAD_100, 64)
.tcp(client.port(), 853, 5, 1024)
.ack(4242);
let mut out = Vec::new();
b.write(&mut out, b"payload").unwrap();
out
};
let ServiceIpPacket::Absorbed { reset: Some(rst) } = classify_service_ip(&acked) else {
panic!("an ACKed segment to an unserved quad-100 port must produce a RST");
};
let sliced = etherparse::SlicedPacket::from_ip(&rst).expect("the RST parses");
match sliced.transport {
Some(etherparse::TransportSlice::Tcp(tcp)) => {
assert!(tcp.rst(), "RST flag set");
assert!(
!tcp.ack(),
"an ACKed segment gets a bare RST, no ACK of ours"
);
assert_eq!(
tcp.sequence_number(),
4242,
"the bare RST sits at the sequence the sender already acknowledged"
);
}
_ => panic!("the RST must be TCP"),
}
let inbound_rst = {
let b = etherparse::PacketBuilder::ipv4(client.ip().octets(), QUAD_100, 64)
.tcp(client.port(), 853, 9, 0)
.rst();
let mut out = Vec::new();
b.write(&mut out, &[]).unwrap();
out
};
let ServiceIpPacket::Absorbed { reset } = classify_service_ip(&inbound_rst) else {
panic!("an inbound RST to quad-100 is still absorbed");
};
assert!(reset.is_none(), "a RST is never answered with another RST");
}
fn dns_update(resolvers: Vec<ts_control::DnsResolver>) -> ts_control::StateUpdate {
ts_control::StateUpdate {
session_handle: None,
seq: 0,
keep_alive: false,
derp: None,
node: Some(fixture_node()),
peer_update: None,
peer_patches: Vec::new(),
user_profiles: Vec::new(),
ping: None,
packetfilter: None,
cap_grants: None,
pop_browser_url: None,
dial_plan: None,
dns_config: Some(ts_control::DnsConfig {
magic_dns: true,
search_domains: vec!["user.ts.net".to_owned()],
resolvers,
..Default::default()
}),
ssh_policy: None,
tka: None,
online_change: Default::default(),
peer_seen_change: Default::default(),
}
}
#[tokio::test]
async fn build_dns_view_maps_update() {
let update = dns_update(vec![]);
let no_exit_env = test_env(None);
let peer = exit_peer("exit", "100.64.0.9", 1080);
let db = peer_db_with(&peer);
let view = build_dns_view(&no_exit_env, &update, Some(db.clone()), true);
assert!(view.cfg.magic_dns, "dns config carried");
assert!(view.self_node.is_some(), "self node carried");
assert!(view.peers.is_some(), "peer db passed through");
assert!(
view.exit_doh.is_none(),
"no exit node configured ⇒ exit_doh None"
);
assert!(view.enable_ipv6, "ipv6 gate threaded from Env");
let exit_env = test_env(Some(ts_control::ExitNodeSelector::StableId(
ts_control::StableNodeId("exit".to_owned()),
)));
let view = build_dns_view(&exit_env, &update, Some(db), true);
assert_eq!(
view.exit_doh,
peer.peerapi_doh_addr(),
"exit_doh resolves to the active exit peer's peerAPI DoH address"
);
assert_eq!(
view.exit_doh,
Some("100.64.0.9:1080".parse().unwrap()),
"exit_doh is the peer's tailnet IPv4 + peerAPI port"
);
let ghost_env = test_env(Some(ts_control::ExitNodeSelector::StableId(
ts_control::StableNodeId("ghost".to_owned()),
)));
let view = build_dns_view(&ghost_env, &update, Some(peer_db_with(&peer)), true);
assert!(
view.exit_doh.is_none(),
"unresolved selector ⇒ exit_doh None (fail-closed)"
);
}
#[tokio::test]
async fn forward_decision_produces_udp_then_doh_plan() {
let update = dns_update(vec![udp_resolver("8.8.8.8:53")]);
let env = test_env(None);
let peer = exit_peer("exit", "100.64.0.9", 1080);
let view = build_dns_view(&env, &update, Some(peer_db_with(&peer)), true);
let query = build_query(0x4242, &["example", "com"]);
let (upstreams, recursive) = match decide(&view, &query).expect("decides") {
Decision::Forward {
upstreams,
recursive,
..
} => (upstreams, recursive),
Decision::Reply(_) => panic!("a public name with a global resolver must Forward"),
};
assert!(recursive, "an unrouted public name is a recursive forward");
assert_eq!(
upstreams,
vec!["8.8.8.8:53".parse().unwrap()],
"the IPv4 global resolver is the upstream (v4-only filter inherited)"
);
match recursive_plan(&view, upstreams.clone()) {
RecursivePlan::Udp(ups) => assert_eq!(ups, upstreams, "no exit node ⇒ UDP plan"),
RecursivePlan::Doh(_) => panic!("no exit node configured ⇒ must not delegate to DoH"),
}
let exit_env = test_env(Some(ts_control::ExitNodeSelector::StableId(
ts_control::StableNodeId("exit".to_owned()),
)));
let exit_view = build_dns_view(&exit_env, &update, Some(peer_db_with(&peer)), true);
match recursive_plan(&exit_view, upstreams) {
RecursivePlan::Doh(addr) => assert_eq!(
Some(addr),
peer.peerapi_doh_addr(),
"active exit node ⇒ delegate recursion to its peerAPI DoH endpoint"
),
RecursivePlan::Udp(_) => panic!("active exit node with no kept-local resolvers ⇒ DoH"),
}
}
fn quad100_query_packet(client: SocketAddrV4, payload: &[u8]) -> Vec<u8> {
let b = etherparse::PacketBuilder::ipv4(client.ip().octets(), [100, 100, 100, 100], 64)
.udp(client.port(), 53);
let mut out = Vec::with_capacity(b.size(payload.len()));
b.write(&mut out, payload).unwrap();
out
}
#[tokio::test]
async fn an_inline_authoritative_reply_honours_the_clients_edns_size() {
let client: SocketAddrV4 = "100.64.0.7:34567".parse().unwrap();
let update = dns_update(vec![udp_resolver("8.8.8.8:53")]);
let env = test_env(None);
let view = build_dns_view(&env, &update, None, true);
let query = build_edns_query(0x9001, &["nope", "user", "ts", "net"], 20);
let pkt = quad100_query_packet(client, &query);
match plan_intercept(&view, &pkt) {
Intercept::Reply { src, response } => {
assert_eq!(src, client);
assert!(
response.len() > 20,
"the fixture only works if the answer overflows the advertised 20 bytes"
);
assert_ne!(
response[2] & 0x02,
0,
"an answer over the advertised EDNS size must carry TC, even on the local path"
);
}
_ => panic!("an unknown name in the tailnet search domain is answered authoritatively"),
}
let plain = build_query(0x9002, &["nope", "user", "ts", "net"]);
match plan_intercept(&view, &quad100_query_packet(client, &plain)) {
Intercept::Reply { response, .. } => {
assert!(response.len() <= 512);
assert_eq!(
response[2] & 0x02,
0,
"TC must stay clear on an answer that fits"
);
}
_ => panic!("an unknown name in the tailnet search domain is answered authoritatively"),
}
}
#[tokio::test]
async fn intercept_plan_spawns_forward_and_classifies_fast_paths() {
let client: SocketAddrV4 = "100.64.0.7:34567".parse().unwrap();
let update = dns_update(vec![udp_resolver("8.8.8.8:53")]);
let env = test_env(None);
let peer = exit_peer("exit", "100.64.0.9", 1080);
let view = build_dns_view(&env, &update, Some(peer_db_with(&peer)), true);
let fwd_pkt = quad100_query_packet(client, &build_query(0x4242, &["example", "com"]));
match plan_intercept(&view, &fwd_pkt) {
Intercept::Forward {
plan, src, query, ..
} => {
assert_eq!(
src, client,
"forward reply is addressed back to the querier"
);
assert!(
!query.is_empty(),
"the original query bytes are carried verbatim"
);
match plan {
RecursivePlan::Udp(ups) => assert_eq!(
ups,
vec!["8.8.8.8:53".parse().unwrap()],
"no exit node ⇒ UDP plan of the v4-only-filtered upstream (never built here)"
),
RecursivePlan::Doh(_) => panic!("no exit node configured ⇒ must not be DoH"),
}
}
_ => panic!("a public name with a global resolver must yield a SPAWNED Forward plan"),
}
let reply_pkt =
quad100_query_packet(client, &build_query(0x1, &["self", "user", "ts", "net"]));
match plan_intercept(&view, &reply_pkt) {
Intercept::Reply { src, response } => {
assert_eq!(
src, client,
"the inline reply is addressed back to the querier"
);
assert!(
!response.is_empty(),
"an authoritative reply carries response bytes"
);
}
other => assert!(
matches!(other, Intercept::Forward { .. }),
"a tailnet self-name is answered authoritatively (Reply) or, lacking overlay data, \
Forwarded — never NotIntercepted/Dropped"
),
}
let passthrough = {
let b = etherparse::PacketBuilder::ipv4(client.ip().octets(), [8, 8, 8, 8], 64)
.udp(client.port(), 53);
let mut out = Vec::new();
b.write(&mut out, b"x").unwrap();
out
};
assert!(
matches!(
plan_intercept(&view, &passthrough),
Intercept::NotIntercepted
),
"a packet not destined to quad-100:53 must pass through to the overlay"
);
let malformed = quad100_query_packet(client, &[0xff, 0x00]);
assert!(
matches!(plan_intercept(&view, &malformed), Intercept::Dropped),
"a malformed quad-100/UDP/53 query is dropped, never forwarded to the overlay"
);
}
#[tokio::test]
async fn exit_node_default_route_never_sees_service_ip_traffic() {
use ts_bart::{RoutingTable, Table};
use ts_overlay_router::outbound::{RouteAction, Router};
use ts_packet::PacketMut;
use ts_transport::PeerId;
let client: SocketAddrV4 = "100.64.0.7:44321".parse().unwrap();
const QUAD_100: [u8; 4] = [100, 100, 100, 100];
let exit = PeerId(7);
let mut table = Table::default();
table.insert("0.0.0.0/0".parse().unwrap(), RouteAction::Wireguard(exit));
let mut router = Router::default();
router.swap(table);
let probes = [
syn_packet(client, QUAD_100, 853, 7),
syn_packet(client, QUAD_100, 80, 7),
udp_packet(client, QUAD_100, 443),
icmp_packet(client, QUAD_100),
];
let leaked = router.route(probes.iter().cloned().map(PacketMut::from));
assert_eq!(
leaked.to_wireguard.get(&exit).map(Vec::len),
Some(probes.len()),
"0.0.0.0/0 matches 100.100.100.100 — every probe would be encrypted to the exit peer"
);
let update = dns_update(vec![udp_resolver("8.8.8.8:53")]);
let env = test_env(None);
let view = build_dns_view(&env, &update, None, true);
let forwarded: Vec<PacketMut> = probes
.iter()
.filter(|pkt| matches!(plan_intercept(&view, pkt), Intercept::NotIntercepted))
.cloned()
.map(PacketMut::from)
.collect();
assert!(
forwarded.is_empty(),
"no quad-100 packet may reach the overlay: {} of {} were still forwarded",
forwarded.len(),
probes.len()
);
assert_eq!(
router.route(forwarded),
ts_overlay_router::outbound::Result::default(),
"with the absorb in place the exit peer receives nothing addressed to the service IP"
);
}
#[tokio::test]
async fn both_transports_absorb_service_ip_traffic() {
use core::net::IpAddr;
let client: SocketAddrV4 = "100.64.0.7:44321".parse().unwrap();
const QUAD_100: [u8; 4] = [100, 100, 100, 100];
assert!(
crate::netstack_actor::overlay_addresses(&fixture_node(), false)
.contains(&IpAddr::V4(Ipv4Addr::new(100, 100, 100, 100))),
"netstack mode: the service IP is a netstack interface address, so it absorbs quad-100"
);
let update = dns_update(vec![udp_resolver("8.8.8.8:53")]);
let env = test_env(None);
let view = build_dns_view(&env, &update, None, true);
for pkt in [
syn_packet(client, QUAD_100, 853, 7),
syn_packet(client, QUAD_100, 53, 7),
udp_packet(client, QUAD_100, 443),
icmp_packet(client, QUAD_100),
] {
assert!(
!matches!(plan_intercept(&view, &pkt), Intercept::NotIntercepted),
"tun mode must absorb the same quad-100 traffic the netstack terminates"
);
}
}
#[test]
fn defaults_and_prefix() {
let cfg = TunConfig {
name: None,
mtu: None,
};
let dev = tun_config_from_control(&cfg, prefix());
assert_eq!(dev.name, "tailscale0");
assert_eq!(dev.mtu.get(), 1280);
assert_eq!(dev.prefix, ipnet::IpNet::V4(prefix()));
}
#[test]
fn mtu_zero_falls_back_and_overrides_honored() {
let zero = TunConfig {
name: Some("tun9".to_owned()),
mtu: Some(0),
};
let dev_zero = tun_config_from_control(&zero, prefix());
assert_eq!(dev_zero.name, "tun9");
assert_eq!(
dev_zero.mtu.get(),
1280,
"mtu=Some(0) must fall back to 1280"
);
let big = TunConfig {
name: None,
mtu: Some(9000),
};
let dev_big = tun_config_from_control(&big, prefix());
assert_eq!(dev_big.mtu.get(), 9000, "a valid mtu must be honored");
}
}