Update dependencies

vendor/tailscale.com/net/packet/checksum/checksum.go

@@ -0,0 +1,197 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package checksum provides functions for updating checksums in parsed packets.
+package checksum
+
+import (
+	"encoding/binary"
+	"net/netip"
+
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"tailscale.com/net/packet"
+	"tailscale.com/types/ipproto"
+)
+
+// UpdateSrcAddr updates the source address in the packet buffer (e.g. during
+// SNAT). It also updates the checksum. Currently (2023-09-22) only TCP/UDP/ICMP
+// is supported. It panics if provided with an address in a different
+// family to the parsed packet.
+func UpdateSrcAddr(q *packet.Parsed, src netip.Addr) {
+	if src.Is6() && q.IPVersion != 6 {
+		panic("UpdateSrcAddr: cannot write IPv6 address to v4 packet")
+	} else if src.Is4() && q.IPVersion != 4 {
+		panic("UpdateSrcAddr: cannot write IPv4 address to v6 packet")
+	}
+	q.CaptureMeta.DidSNAT = true
+	q.CaptureMeta.OriginalSrc = q.Src
+
+	old := q.Src.Addr()
+	q.Src = netip.AddrPortFrom(src, q.Src.Port())
+
+	b := q.Buffer()
+	if src.Is6() {
+		v6 := src.As16()
+		copy(b[8:24], v6[:])
+		updateV6PacketChecksums(q, old, src)
+	} else {
+		v4 := src.As4()
+		copy(b[12:16], v4[:])
+		updateV4PacketChecksums(q, old, src)
+	}
+}
+
+// UpdateDstAddr updates the destination address in the packet buffer (e.g. during
+// DNAT). It also updates the checksum. Currently (2022-12-10) only TCP/UDP/ICMP
+// is supported. It panics if provided with an address in a different
+// family to the parsed packet.
+func UpdateDstAddr(q *packet.Parsed, dst netip.Addr) {
+	if dst.Is6() && q.IPVersion != 6 {
+		panic("UpdateDstAddr: cannot write IPv6 address to v4 packet")
+	} else if dst.Is4() && q.IPVersion != 4 {
+		panic("UpdateDstAddr: cannot write IPv4 address to v6 packet")
+	}
+	q.CaptureMeta.DidDNAT = true
+	q.CaptureMeta.OriginalDst = q.Dst
+
+	old := q.Dst.Addr()
+	q.Dst = netip.AddrPortFrom(dst, q.Dst.Port())
+
+	b := q.Buffer()
+	if dst.Is6() {
+		v6 := dst.As16()
+		copy(b[24:40], v6[:])
+		updateV6PacketChecksums(q, old, dst)
+	} else {
+		v4 := dst.As4()
+		copy(b[16:20], v4[:])
+		updateV4PacketChecksums(q, old, dst)
+	}
+}
+
+// updateV4PacketChecksums updates the checksums in the packet buffer.
+// Currently (2023-03-01) only TCP/UDP/ICMP over IPv4 is supported.
+// p is modified in place.
+// If p.IPProto is unknown, only the IP header checksum is updated.
+func updateV4PacketChecksums(p *packet.Parsed, old, new netip.Addr) {
+	if len(p.Buffer()) < 12 {
+		// Not enough space for an IPv4 header.
+		return
+	}
+	o4, n4 := old.As4(), new.As4()
+
+	// First update the checksum in the IP header.
+	updateV4Checksum(p.Buffer()[10:12], o4[:], n4[:])
+
+	// Now update the transport layer checksums, where applicable.
+	tr := p.Transport()
+	switch p.IPProto {
+	case ipproto.UDP, ipproto.DCCP:
+		if len(tr) < header.UDPMinimumSize {
+			// Not enough space for a UDP header.
+			return
+		}
+		updateV4Checksum(tr[6:8], o4[:], n4[:])
+	case ipproto.TCP:
+		if len(tr) < header.TCPMinimumSize {
+			// Not enough space for a TCP header.
+			return
+		}
+		updateV4Checksum(tr[16:18], o4[:], n4[:])
+	case ipproto.GRE:
+		if len(tr) < 6 {
+			// Not enough space for a GRE header.
+			return
+		}
+		if tr[0] == 1 { // checksum present
+			updateV4Checksum(tr[4:6], o4[:], n4[:])
+		}
+	case ipproto.SCTP, ipproto.ICMPv4:
+		// No transport layer update required.
+	}
+}
+
+// updateV6PacketChecksums updates the checksums in the packet buffer.
+// p is modified in place.
+// If p.IPProto is unknown, no checksums are updated.
+func updateV6PacketChecksums(p *packet.Parsed, old, new netip.Addr) {
+	if len(p.Buffer()) < 40 {
+		// Not enough space for an IPv6 header.
+		return
+	}
+	o6, n6 := tcpip.AddrFrom16Slice(old.AsSlice()), tcpip.AddrFrom16Slice(new.AsSlice())
+
+	// Now update the transport layer checksums, where applicable.
+	tr := p.Transport()
+	switch p.IPProto {
+	case ipproto.ICMPv6:
+		if len(tr) < header.ICMPv6MinimumSize {
+			return
+		}
+		header.ICMPv6(tr).UpdateChecksumPseudoHeaderAddress(o6, n6)
+	case ipproto.UDP, ipproto.DCCP:
+		if len(tr) < header.UDPMinimumSize {
+			return
+		}
+		header.UDP(tr).UpdateChecksumPseudoHeaderAddress(o6, n6, true)
+	case ipproto.TCP:
+		if len(tr) < header.TCPMinimumSize {
+			return
+		}
+		header.TCP(tr).UpdateChecksumPseudoHeaderAddress(o6, n6, true)
+	case ipproto.SCTP:
+		// No transport layer update required.
+	}
+}
+
+// updateV4Checksum calculates and updates the checksum in the packet buffer for
+// a change between old and new. The oldSum must point to the 16-bit checksum
+// field in the packet buffer that holds the old checksum value, it will be
+// updated in place.
+//
+// The old and new must be the same length, and must be an even number of bytes.
+func updateV4Checksum(oldSum, old, new []byte) {
+	if len(old) != len(new) {
+		panic("old and new must be the same length")
+	}
+	if len(old)%2 != 0 {
+		panic("old and new must be of even length")
+	}
+	/*
+		RFC 1624
+		Given the following notation:
+
+		    HC  - old checksum in header
+		    C   - one's complement sum of old header
+		    HC' - new checksum in header
+		    C'  - one's complement sum of new header
+		    m   - old value of a 16-bit field
+		    m'  - new value of a 16-bit field
+
+		    HC' = ~(C + (-m) + m')  --    [Eqn. 3]
+		    HC' = ~(~HC + ~m + m')
+
+		This can be simplified to:
+		    HC' = ~(C + ~m + m')    --    [Eqn. 3]
+		    HC' = ~C'
+		    C'  = C + ~m + m'
+	*/
+
+	c := uint32(^binary.BigEndian.Uint16(oldSum))
+
+	cPrime := c
+	for len(new) > 0 {
+		mNot := uint32(^binary.BigEndian.Uint16(old[:2]))
+		mPrime := uint32(binary.BigEndian.Uint16(new[:2]))
+		cPrime += mPrime + mNot
+		new, old = new[2:], old[2:]
+	}
+
+	// Account for overflows by adding the carry bits back into the sum.
+	for (cPrime >> 16) > 0 {
+		cPrime = cPrime&0xFFFF + cPrime>>16
+	}
+	hcPrime := ^uint16(cPrime)
+	binary.BigEndian.PutUint16(oldSum, hcPrime)
+}

vendor/tailscale.com/net/packet/doc.go

@@ -0,0 +1,15 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package packet contains packet parsing and marshaling utilities.
+//
+// Parsed provides allocation-free minimal packet header decoding, for
+// use in packet filtering. The other types in the package are for
+// constructing and marshaling packets into []bytes.
+//
+// To support allocation-free parsing, this package defines IPv4 and
+// IPv6 address types. You should prefer to use netaddr's types,
+// except where you absolutely need allocation-free IP handling
+// (i.e. in the tunnel datapath) and are willing to implement all
+// codepaths and data structures twice, once per IP family.
+package packet

vendor/tailscale.com/net/packet/header.go

@@ -0,0 +1,66 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"errors"
+	"math"
+)
+
+const tcpHeaderLength = 20
+const sctpHeaderLength = 12
+
+// maxPacketLength is the largest length that all headers support.
+// IPv4 headers using uint16 for this forces an upper bound of 64KB.
+const maxPacketLength = math.MaxUint16
+
+var (
+	// errSmallBuffer is returned when Marshal receives a buffer
+	// too small to contain the header to marshal.
+	errSmallBuffer = errors.New("buffer too small")
+	// errLargePacket is returned when Marshal receives a payload
+	// larger than the maximum representable size in header
+	// fields.
+	errLargePacket = errors.New("packet too large")
+)
+
+// Header is a packet header capable of marshaling itself into a byte
+// buffer.
+type Header interface {
+	// Len returns the length of the marshaled packet.
+	Len() int
+	// Marshal serializes the header into buf, which must be at
+	// least Len() bytes long. Implementations of Marshal assume
+	// that bytes after the first Len() are payload bytes for the
+	// purpose of computing length and checksum fields. Marshal
+	// implementations must not allocate memory.
+	Marshal(buf []byte) error
+}
+
+// HeaderChecksummer is implemented by Header implementations that
+// need to do a checksum over their payloads.
+type HeaderChecksummer interface {
+	Header
+
+	// WriteCheck writes the correct checksum into buf, which should
+	// be be the already-marshalled header and payload.
+	WriteChecksum(buf []byte)
+}
+
+// Generate generates a new packet with the given Header and
+// payload. This function allocates memory, see Header.Marshal for an
+// allocation-free option.
+func Generate(h Header, payload []byte) []byte {
+	hlen := h.Len()
+	buf := make([]byte, hlen+len(payload))
+
+	copy(buf[hlen:], payload)
+	h.Marshal(buf)
+
+	if hc, ok := h.(HeaderChecksummer); ok {
+		hc.WriteChecksum(buf)
+	}
+
+	return buf
+}

vendor/tailscale.com/net/packet/icmp.go

@@ -0,0 +1,28 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	crand "crypto/rand"
+
+	"encoding/binary"
+)
+
+// ICMPEchoPayload generates a new random ID/Sequence pair, and returns a uint32
+// derived from them, along with the id, sequence and given payload in a buffer.
+// It returns an error if the random source could not be read.
+func ICMPEchoPayload(payload []byte) (idSeq uint32, buf []byte) {
+	buf = make([]byte, len(payload)+4)
+
+	// make a completely random id/sequence combo, which is very unlikely to
+	// collide with a running ping sequence on the host system. Errors are
+	// ignored, that would result in collisions, but errors reading from the
+	// random device are rare, and will cause this process universe to soon end.
+	crand.Read(buf[:4])
+
+	idSeq = binary.LittleEndian.Uint32(buf)
+	copy(buf[4:], payload)
+
+	return
+}

vendor/tailscale.com/net/packet/icmp4.go

@@ -0,0 +1,96 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"encoding/binary"
+
+	"tailscale.com/types/ipproto"
+)
+
+// icmp4HeaderLength is the size of the ICMPv4 packet header, not
+// including the outer IP layer or the variable "response data"
+// trailer.
+const icmp4HeaderLength = 4
+
+// ICMP4Type is an ICMPv4 type, as specified in
+// https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
+type ICMP4Type uint8
+
+const (
+	ICMP4EchoReply    ICMP4Type = 0x00
+	ICMP4EchoRequest  ICMP4Type = 0x08
+	ICMP4Unreachable  ICMP4Type = 0x03
+	ICMP4TimeExceeded ICMP4Type = 0x0b
+	ICMP4ParamProblem ICMP4Type = 0x12
+)
+
+func (t ICMP4Type) String() string {
+	switch t {
+	case ICMP4EchoReply:
+		return "EchoReply"
+	case ICMP4EchoRequest:
+		return "EchoRequest"
+	case ICMP4Unreachable:
+		return "Unreachable"
+	case ICMP4TimeExceeded:
+		return "TimeExceeded"
+	case ICMP4ParamProblem:
+		return "ParamProblem"
+	default:
+		return "Unknown"
+	}
+}
+
+// ICMP4Code is an ICMPv4 code, as specified in
+// https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
+type ICMP4Code uint8
+
+const (
+	ICMP4NoCode ICMP4Code = 0
+)
+
+// ICMP4Header is an IPv4+ICMPv4 header.
+type ICMP4Header struct {
+	IP4Header
+	Type ICMP4Type
+	Code ICMP4Code
+}
+
+// Len implements Header.
+func (h ICMP4Header) Len() int {
+	return h.IP4Header.Len() + icmp4HeaderLength
+}
+
+// Marshal implements Header.
+func (h ICMP4Header) Marshal(buf []byte) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if len(buf) > maxPacketLength {
+		return errLargePacket
+	}
+	// The caller does not need to set this.
+	h.IPProto = ipproto.ICMPv4
+
+	buf[20] = uint8(h.Type)
+	buf[21] = uint8(h.Code)
+
+	h.IP4Header.Marshal(buf)
+
+	binary.BigEndian.PutUint16(buf[22:24], ip4Checksum(buf))
+
+	return nil
+}
+
+// ToResponse implements Header. TODO: it doesn't implement it
+// correctly, instead it statically generates an ICMP Echo Reply
+// packet.
+func (h *ICMP4Header) ToResponse() {
+	// TODO: this doesn't implement ToResponse correctly, as it
+	// assumes the ICMP request type.
+	h.Type = ICMP4EchoReply
+	h.Code = ICMP4NoCode
+	h.IP4Header.ToResponse()
+}

vendor/tailscale.com/net/packet/icmp6.go

@@ -0,0 +1,172 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"encoding/binary"
+
+	"tailscale.com/types/ipproto"
+)
+
+// icmp6HeaderLength is the size of the ICMPv6 packet header, not
+// including the outer IP layer or the variable "response data"
+// trailer.
+const icmp6HeaderLength = 4
+
+// ICMP6Type is an ICMPv6 type, as specified in
+// https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml
+type ICMP6Type uint8
+
+const (
+	ICMP6Unreachable  ICMP6Type = 1
+	ICMP6PacketTooBig ICMP6Type = 2
+	ICMP6TimeExceeded ICMP6Type = 3
+	ICMP6ParamProblem ICMP6Type = 4
+	ICMP6EchoRequest  ICMP6Type = 128
+	ICMP6EchoReply    ICMP6Type = 129
+)
+
+func (t ICMP6Type) String() string {
+	switch t {
+	case ICMP6Unreachable:
+		return "Unreachable"
+	case ICMP6PacketTooBig:
+		return "PacketTooBig"
+	case ICMP6TimeExceeded:
+		return "TimeExceeded"
+	case ICMP6ParamProblem:
+		return "ParamProblem"
+	case ICMP6EchoRequest:
+		return "EchoRequest"
+	case ICMP6EchoReply:
+		return "EchoReply"
+	default:
+		return "Unknown"
+	}
+}
+
+// ICMP6Code is an ICMPv6 code, as specified in
+// https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml
+type ICMP6Code uint8
+
+const (
+	ICMP6NoCode ICMP6Code = 0
+)
+
+// ICMP6Header is an IPv4+ICMPv4 header.
+type ICMP6Header struct {
+	IP6Header
+	Type ICMP6Type
+	Code ICMP6Code
+}
+
+// Len implements Header.
+func (h ICMP6Header) Len() int {
+	return h.IP6Header.Len() + icmp6HeaderLength
+}
+
+// Marshal implements Header.
+func (h ICMP6Header) Marshal(buf []byte) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if len(buf) > maxPacketLength {
+		return errLargePacket
+	}
+	// The caller does not need to set this.
+	h.IPProto = ipproto.ICMPv6
+
+	h.IP6Header.Marshal(buf)
+
+	const o = ip6HeaderLength // start offset of ICMPv6 header
+	buf[o+0] = uint8(h.Type)
+	buf[o+1] = uint8(h.Code)
+	buf[o+2] = 0 // checksum, to be filled in later
+	buf[o+3] = 0 // checksum, to be filled in later
+	return nil
+}
+
+// ToResponse implements Header. TODO: it doesn't implement it
+// correctly, instead it statically generates an ICMP Echo Reply
+// packet.
+func (h *ICMP6Header) ToResponse() {
+	// TODO: this doesn't implement ToResponse correctly, as it
+	// assumes the ICMP request type.
+	h.Type = ICMP6EchoReply
+	h.Code = ICMP6NoCode
+	h.IP6Header.ToResponse()
+}
+
+// WriteChecksum implements HeaderChecksummer, writing just the checksum bytes
+// into the otherwise fully marshaled ICMP6 packet p (which should include the
+// IPv6 header, ICMPv6 header, and payload).
+func (h ICMP6Header) WriteChecksum(p []byte) {
+	const payOff = ip6HeaderLength + icmp6HeaderLength
+	xsum := icmp6Checksum(p[ip6HeaderLength:payOff], h.Src.As16(), h.Dst.As16(), p[payOff:])
+	binary.BigEndian.PutUint16(p[ip6HeaderLength+2:], xsum)
+}
+
+// Adapted from gVisor:
+
+// icmp6Checksum calculates the ICMP checksum over the provided ICMPv6
+// header (without the IPv6 header), IPv6 src/dst addresses and the
+// payload.
+//
+// The header's existing checksum must be zeroed.
+func icmp6Checksum(header []byte, src, dst [16]byte, payload []byte) uint16 {
+	// Calculate the IPv6 pseudo-header upper-layer checksum.
+	xsum := checksumBytes(src[:], 0)
+	xsum = checksumBytes(dst[:], xsum)
+
+	var scratch [4]byte
+	binary.BigEndian.PutUint32(scratch[:], uint32(len(header)+len(payload)))
+	xsum = checksumBytes(scratch[:], xsum)
+	xsum = checksumBytes(append(scratch[:0], 0, 0, 0, uint8(ipproto.ICMPv6)), xsum)
+	xsum = checksumBytes(payload, xsum)
+
+	var hdrz [icmp6HeaderLength]byte
+	copy(hdrz[:], header)
+	// Zero out the header.
+	hdrz[2] = 0
+	hdrz[3] = 0
+	xsum = ^checksumBytes(hdrz[:], xsum)
+	return xsum
+}
+
+// checksumCombine combines the two uint16 to form their
+// checksum. This is done by adding them and the carry.
+//
+// Note that checksum a must have been computed on an even number of
+// bytes.
+func checksumCombine(a, b uint16) uint16 {
+	v := uint32(a) + uint32(b)
+	return uint16(v + v>>16)
+}
+
+// checksumBytes calculates the checksum (as defined in RFC 1071) of
+// the bytes in buf.
+//
+// The initial checksum must have been computed on an even number of bytes.
+func checksumBytes(buf []byte, initial uint16) uint16 {
+	v := uint32(initial)
+
+	odd := len(buf)%2 == 1
+	if odd {
+		v += uint32(buf[0])
+		buf = buf[1:]
+	}
+
+	n := len(buf)
+	odd = n&1 != 0
+	if odd {
+		n--
+		v += uint32(buf[n]) << 8
+	}
+
+	for i := 0; i < n; i += 2 {
+		v += (uint32(buf[i]) << 8) + uint32(buf[i+1])
+	}
+
+	return checksumCombine(uint16(v), uint16(v>>16))
+}

vendor/tailscale.com/net/packet/ip4.go

@@ -0,0 +1,116 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"encoding/binary"
+	"errors"
+	"net/netip"
+
+	"tailscale.com/types/ipproto"
+)
+
+// ip4HeaderLength is the length of an IPv4 header with no IP options.
+const ip4HeaderLength = 20
+
+// IP4Header represents an IPv4 packet header.
+type IP4Header struct {
+	IPProto ipproto.Proto
+	IPID    uint16
+	Src     netip.Addr
+	Dst     netip.Addr
+}
+
+// Len implements Header.
+func (h IP4Header) Len() int {
+	return ip4HeaderLength
+}
+
+var errWrongFamily = errors.New("wrong address family for src/dst IP")
+
+// Marshal implements Header.
+func (h IP4Header) Marshal(buf []byte) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if len(buf) > maxPacketLength {
+		return errLargePacket
+	}
+	if !h.Src.Is4() || !h.Dst.Is4() {
+		return errWrongFamily
+	}
+
+	buf[0] = 0x40 | (byte(h.Len() >> 2))                   // IPv4 + IHL
+	buf[1] = 0x00                                          // DSCP + ECN
+	binary.BigEndian.PutUint16(buf[2:4], uint16(len(buf))) // Total length
+	binary.BigEndian.PutUint16(buf[4:6], h.IPID)           // ID
+	binary.BigEndian.PutUint16(buf[6:8], 0)                // Flags + fragment offset
+	buf[8] = 64                                            // TTL
+	buf[9] = uint8(h.IPProto)                              // Inner protocol
+	// Blank checksum. This is necessary even though we overwrite
+	// it later, because the checksum computation runs over these
+	// bytes and expects them to be zero.
+	binary.BigEndian.PutUint16(buf[10:12], 0)
+	src := h.Src.As4()
+	dst := h.Dst.As4()
+	copy(buf[12:16], src[:])
+	copy(buf[16:20], dst[:])
+
+	binary.BigEndian.PutUint16(buf[10:12], ip4Checksum(buf[0:20])) // Checksum
+
+	return nil
+}
+
+// ToResponse implements Header.
+func (h *IP4Header) ToResponse() {
+	h.Src, h.Dst = h.Dst, h.Src
+	// Flip the bits in the IPID. If incoming IPIDs are distinct, so are these.
+	h.IPID = ^h.IPID
+}
+
+// ip4Checksum computes an IPv4 checksum, as specified in
+// https://tools.ietf.org/html/rfc1071
+func ip4Checksum(b []byte) uint16 {
+	var ac uint32
+	i := 0
+	n := len(b)
+	for n >= 2 {
+		ac += uint32(binary.BigEndian.Uint16(b[i : i+2]))
+		n -= 2
+		i += 2
+	}
+	if n == 1 {
+		ac += uint32(b[i]) << 8
+	}
+	for (ac >> 16) > 0 {
+		ac = (ac >> 16) + (ac & 0xffff)
+	}
+	return uint16(^ac)
+}
+
+// ip4PseudoHeaderOffset is the number of bytes by which the IPv4 UDP
+// pseudo-header is smaller than the real IPv4 header.
+const ip4PseudoHeaderOffset = 8
+
+// marshalPseudo serializes h into buf in the "pseudo-header" form
+// required when calculating UDP checksums. The pseudo-header starts
+// at buf[ip4PseudoHeaderOffset] so as to abut the following UDP
+// header, while leaving enough space in buf for a full IPv4 header.
+func (h IP4Header) marshalPseudo(buf []byte) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if len(buf) > maxPacketLength {
+		return errLargePacket
+	}
+
+	length := len(buf) - h.Len()
+	src, dst := h.Src.As4(), h.Dst.As4()
+	copy(buf[8:12], src[:])
+	copy(buf[12:16], dst[:])
+	buf[16] = 0x0
+	buf[17] = uint8(h.IPProto)
+	binary.BigEndian.PutUint16(buf[18:20], uint16(length))
+	return nil
+}

vendor/tailscale.com/net/packet/ip6.go

@@ -0,0 +1,76 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"encoding/binary"
+	"net/netip"
+
+	"tailscale.com/types/ipproto"
+)
+
+// ip6HeaderLength is the length of an IPv6 header with no IP options.
+const ip6HeaderLength = 40
+
+// IP6Header represents an IPv6 packet header.
+type IP6Header struct {
+	IPProto ipproto.Proto
+	IPID    uint32 // only lower 20 bits used
+	Src     netip.Addr
+	Dst     netip.Addr
+}
+
+// Len implements Header.
+func (h IP6Header) Len() int {
+	return ip6HeaderLength
+}
+
+// Marshal implements Header.
+func (h IP6Header) Marshal(buf []byte) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if len(buf) > maxPacketLength {
+		return errLargePacket
+	}
+
+	binary.BigEndian.PutUint32(buf[:4], h.IPID&0x000FFFFF)
+	buf[0] = 0x60
+	binary.BigEndian.PutUint16(buf[4:6], uint16(len(buf)-ip6HeaderLength)) // Total length
+	buf[6] = uint8(h.IPProto)                                              // Inner protocol
+	buf[7] = 64                                                            // TTL
+	src, dst := h.Src.As16(), h.Dst.As16()
+	copy(buf[8:24], src[:])
+	copy(buf[24:40], dst[:])
+
+	return nil
+}
+
+// ToResponse implements Header.
+func (h *IP6Header) ToResponse() {
+	h.Src, h.Dst = h.Dst, h.Src
+	// Flip the bits in the IPID. If incoming IPIDs are distinct, so are these.
+	h.IPID = (^h.IPID) & 0x000FFFFF
+}
+
+// marshalPseudo serializes h into buf in the "pseudo-header" form
+// required when calculating UDP checksums.
+func (h IP6Header) marshalPseudo(buf []byte, proto ipproto.Proto) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if len(buf) > maxPacketLength {
+		return errLargePacket
+	}
+
+	src, dst := h.Src.As16(), h.Dst.As16()
+	copy(buf[:16], src[:])
+	copy(buf[16:32], dst[:])
+	binary.BigEndian.PutUint32(buf[32:36], uint32(len(buf)-h.Len()))
+	buf[36] = 0
+	buf[37] = 0
+	buf[38] = 0
+	buf[39] = byte(proto) // NextProto
+	return nil
+}

vendor/tailscale.com/net/packet/packet.go

@@ -0,0 +1,521 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"encoding/binary"
+	"fmt"
+	"net"
+	"net/netip"
+	"strings"
+
+	"tailscale.com/net/netaddr"
+	"tailscale.com/types/ipproto"
+)
+
+const unknown = ipproto.Unknown
+
+// RFC1858: prevent overlapping fragment attacks.
+const minFragBlks = (60 + 20) / 8 // max IPv4 header + basic TCP header in fragment blocks (8 bytes each)
+
+type TCPFlag uint8
+
+const (
+	TCPFin     TCPFlag = 0x01
+	TCPSyn     TCPFlag = 0x02
+	TCPRst     TCPFlag = 0x04
+	TCPPsh     TCPFlag = 0x08
+	TCPAck     TCPFlag = 0x10
+	TCPUrg     TCPFlag = 0x20
+	TCPECNEcho TCPFlag = 0x40
+	TCPCWR     TCPFlag = 0x80
+	TCPSynAck  TCPFlag = TCPSyn | TCPAck
+	TCPECNBits TCPFlag = TCPECNEcho | TCPCWR
+)
+
+// CaptureMeta contains metadata that is used when debugging.
+type CaptureMeta struct {
+	DidSNAT     bool           // SNAT was performed & the address was updated.
+	OriginalSrc netip.AddrPort // The source address before SNAT was performed.
+	DidDNAT     bool           // DNAT was performed & the address was updated.
+	OriginalDst netip.AddrPort // The destination address before DNAT was performed.
+}
+
+// Parsed is a minimal decoding of a packet suitable for use in filters.
+type Parsed struct {
+	// b is the byte buffer that this decodes.
+	b []byte
+	// subofs is the offset of IP subprotocol.
+	subofs int
+	// dataofs is the offset of IP subprotocol payload.
+	dataofs int
+	// length is the total length of the packet.
+	// This is not the same as len(b) because b can have trailing zeros.
+	length int
+
+	// IPVersion is the IP protocol version of the packet (4 or
+	// 6), or 0 if the packet doesn't look like IPv4 or IPv6.
+	IPVersion uint8
+	// IPProto is the IP subprotocol (UDP, TCP, etc.). Valid iff IPVersion != 0.
+	IPProto ipproto.Proto
+	// SrcIP4 is the source address. Family matches IPVersion. Port is
+	// valid iff IPProto == TCP || IPProto == UDP.
+	Src netip.AddrPort
+	// DstIP4 is the destination address. Family matches IPVersion.
+	Dst netip.AddrPort
+	// TCPFlags is the packet's TCP flag bits. Valid iff IPProto == TCP.
+	TCPFlags TCPFlag
+
+	// CaptureMeta contains metadata that is used when debugging.
+	CaptureMeta CaptureMeta
+}
+
+func (p *Parsed) String() string {
+	if p.IPVersion != 4 && p.IPVersion != 6 {
+		return "Unknown{???}"
+	}
+
+	// max is the maximum reasonable length of the string we are constructing.
+	// It's OK to overshoot, as the temp buffer is allocated on the stack.
+	const max = len("ICMPv6{[ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff%enp5s0]:65535 > [ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff%enp5s0]:65535}")
+	b := make([]byte, 0, max)
+	b = append(b, p.IPProto.String()...)
+	b = append(b, '{')
+	b = p.Src.AppendTo(b)
+	b = append(b, ' ', '>', ' ')
+	b = p.Dst.AppendTo(b)
+	b = append(b, '}')
+	return string(b)
+}
+
+// Decode extracts data from the packet in b into q.
+// It performs extremely simple packet decoding for basic IPv4 and IPv6 packet types.
+// It extracts only the subprotocol id, IP addresses, and (if any) ports,
+// and shouldn't need any memory allocation.
+func (q *Parsed) Decode(b []byte) {
+	q.b = b
+	q.CaptureMeta = CaptureMeta{} // Clear any capture metadata if it exists.
+
+	if len(b) < 1 {
+		q.IPVersion = 0
+		q.IPProto = unknown
+		return
+	}
+
+	q.IPVersion = b[0] >> 4
+	switch q.IPVersion {
+	case 4:
+		q.decode4(b)
+	case 6:
+		q.decode6(b)
+	default:
+		q.IPVersion = 0
+		q.IPProto = unknown
+	}
+}
+
+// StuffForTesting makes Parsed contain a len-bytes buffer. Used in
+// tests to build up a synthetic parse result with a non-zero buffer.
+func (q *Parsed) StuffForTesting(len int) {
+	q.b = make([]byte, len)
+}
+
+func (q *Parsed) decode4(b []byte) {
+	if len(b) < ip4HeaderLength {
+		q.IPVersion = 0
+		q.IPProto = unknown
+		return
+	}
+
+	// Check that it's IPv4.
+	q.IPProto = ipproto.Proto(b[9])
+	q.length = int(binary.BigEndian.Uint16(b[2:4]))
+	if len(b) < q.length {
+		// Packet was cut off before full IPv4 length.
+		q.IPProto = unknown
+		return
+	}
+
+	// If it's valid IPv4, then the IP addresses are valid
+	q.Src = withIP(q.Src, netaddr.IPv4(b[12], b[13], b[14], b[15]))
+	q.Dst = withIP(q.Dst, netaddr.IPv4(b[16], b[17], b[18], b[19]))
+
+	q.subofs = int((b[0] & 0x0F) << 2)
+	if q.subofs > q.length {
+		// next-proto starts beyond end of packet.
+		q.IPProto = unknown
+		return
+	}
+	sub := b[q.subofs:]
+	sub = sub[:len(sub):len(sub)] // help the compiler do bounds check elimination
+
+	// We don't care much about IP fragmentation, except insofar as it's
+	// used for firewall bypass attacks. The trick is make the first
+	// fragment of a TCP or UDP packet so short that it doesn't fit
+	// the TCP or UDP header, so we can't read the port, in hope that
+	// it'll sneak past. Then subsequent fragments fill it in, but we're
+	// missing the first part of the header, so we can't read that either.
+	//
+	// A "perfectly correct" implementation would have to reassemble
+	// fragments before deciding what to do. But the truth is there's
+	// zero reason to send such a short first fragment, so we can treat
+	// it as Unknown. We can also treat any subsequent fragment that starts
+	// at such a low offset as Unknown.
+	fragFlags := binary.BigEndian.Uint16(b[6:8])
+	moreFrags := (fragFlags & 0x2000) != 0
+	fragOfs := fragFlags & 0x1FFF
+
+	if fragOfs == 0 {
+		// This is the first fragment
+		if moreFrags && len(sub) < minFragBlks {
+			// Suspiciously short first fragment, dump it.
+			q.IPProto = unknown
+			return
+		}
+		// otherwise, this is either non-fragmented (the usual case)
+		// or a big enough initial fragment that we can read the
+		// whole subprotocol header.
+		switch q.IPProto {
+		case ipproto.ICMPv4:
+			if len(sub) < icmp4HeaderLength {
+				q.IPProto = unknown
+				return
+			}
+			q.Src = withPort(q.Src, 0)
+			q.Dst = withPort(q.Dst, 0)
+			q.dataofs = q.subofs + icmp4HeaderLength
+			return
+		case ipproto.IGMP:
+			// Keep IPProto, but don't parse anything else
+			// out.
+			return
+		case ipproto.TCP:
+			if len(sub) < tcpHeaderLength {
+				q.IPProto = unknown
+				return
+			}
+			q.Src = withPort(q.Src, binary.BigEndian.Uint16(sub[0:2]))
+			q.Dst = withPort(q.Dst, binary.BigEndian.Uint16(sub[2:4]))
+			q.TCPFlags = TCPFlag(sub[13])
+			headerLength := (sub[12] & 0xF0) >> 2
+			q.dataofs = q.subofs + int(headerLength)
+			return
+		case ipproto.UDP:
+			if len(sub) < udpHeaderLength {
+				q.IPProto = unknown
+				return
+			}
+			q.Src = withPort(q.Src, binary.BigEndian.Uint16(sub[0:2]))
+			q.Dst = withPort(q.Dst, binary.BigEndian.Uint16(sub[2:4]))
+			q.dataofs = q.subofs + udpHeaderLength
+			return
+		case ipproto.SCTP:
+			if len(sub) < sctpHeaderLength {
+				q.IPProto = unknown
+				return
+			}
+			q.Src = withPort(q.Src, binary.BigEndian.Uint16(sub[0:2]))
+			q.Dst = withPort(q.Dst, binary.BigEndian.Uint16(sub[2:4]))
+			return
+		case ipproto.TSMP:
+			// Inter-tailscale messages.
+			q.dataofs = q.subofs
+			return
+		case ipproto.Fragment:
+			// An IPProto value of 0xff (our Fragment constant for internal use)
+			// should never actually be used in the wild; if we see it,
+			// something's suspicious and we map it back to zero (unknown).
+			q.IPProto = unknown
+		}
+	} else {
+		// This is a fragment other than the first one.
+		if fragOfs < minFragBlks {
+			// First frag was suspiciously short, so we can't
+			// trust the followup either.
+			q.IPProto = unknown
+			return
+		}
+		// otherwise, we have to permit the fragment to slide through.
+		// Second and later fragments don't have sub-headers.
+		// Ideally, we would drop fragments that we can't identify,
+		// but that would require statefulness. Anyway, receivers'
+		// kernels know to drop fragments where the initial fragment
+		// doesn't arrive.
+		q.IPProto = ipproto.Fragment
+		return
+	}
+}
+
+func (q *Parsed) decode6(b []byte) {
+	if len(b) < ip6HeaderLength {
+		q.IPVersion = 0
+		q.IPProto = unknown
+		return
+	}
+
+	q.IPProto = ipproto.Proto(b[6])
+	q.length = int(binary.BigEndian.Uint16(b[4:6])) + ip6HeaderLength
+	if len(b) < q.length {
+		// Packet was cut off before the full IPv6 length.
+		q.IPProto = unknown
+		return
+	}
+
+	// okay to ignore `ok` here, because IPs pulled from packets are
+	// always well-formed stdlib IPs.
+	srcIP, _ := netip.AddrFromSlice(net.IP(b[8:24]))
+	dstIP, _ := netip.AddrFromSlice(net.IP(b[24:40]))
+	q.Src = withIP(q.Src, srcIP)
+	q.Dst = withIP(q.Dst, dstIP)
+
+	// We don't support any IPv6 extension headers. Don't try to
+	// be clever. Therefore, the IP subprotocol always starts at
+	// byte 40.
+	//
+	// Note that this means we don't support fragmentation in
+	// IPv6. This is fine, because IPv6 strongly mandates that you
+	// should not fragment, which makes fragmentation on the open
+	// internet extremely uncommon.
+	//
+	// This also means we don't support IPSec headers (AH/ESP), or
+	// IPv6 jumbo frames. Those will get marked Unknown and
+	// dropped.
+	q.subofs = 40
+	sub := b[q.subofs:]
+	sub = sub[:len(sub):len(sub)] // help the compiler do bounds check elimination
+
+	switch q.IPProto {
+	case ipproto.ICMPv6:
+		if len(sub) < icmp6HeaderLength {
+			q.IPProto = unknown
+			return
+		}
+		q.Src = withPort(q.Src, 0)
+		q.Dst = withPort(q.Dst, 0)
+		q.dataofs = q.subofs + icmp6HeaderLength
+	case ipproto.TCP:
+		if len(sub) < tcpHeaderLength {
+			q.IPProto = unknown
+			return
+		}
+		q.Src = withPort(q.Src, binary.BigEndian.Uint16(sub[0:2]))
+		q.Dst = withPort(q.Dst, binary.BigEndian.Uint16(sub[2:4]))
+		q.TCPFlags = TCPFlag(sub[13])
+		headerLength := (sub[12] & 0xF0) >> 2
+		q.dataofs = q.subofs + int(headerLength)
+		return
+	case ipproto.UDP:
+		if len(sub) < udpHeaderLength {
+			q.IPProto = unknown
+			return
+		}
+		q.Src = withPort(q.Src, binary.BigEndian.Uint16(sub[0:2]))
+		q.Dst = withPort(q.Dst, binary.BigEndian.Uint16(sub[2:4]))
+		q.dataofs = q.subofs + udpHeaderLength
+	case ipproto.SCTP:
+		if len(sub) < sctpHeaderLength {
+			q.IPProto = unknown
+			return
+		}
+		q.Src = withPort(q.Src, binary.BigEndian.Uint16(sub[0:2]))
+		q.Dst = withPort(q.Dst, binary.BigEndian.Uint16(sub[2:4]))
+		return
+	case ipproto.TSMP:
+		// Inter-tailscale messages.
+		q.dataofs = q.subofs
+		return
+	case ipproto.Fragment:
+		// An IPProto value of 0xff (our Fragment constant for internal use)
+		// should never actually be used in the wild; if we see it,
+		// something's suspicious and we map it back to zero (unknown).
+		q.IPProto = unknown
+		return
+	}
+}
+
+func (q *Parsed) IP4Header() IP4Header {
+	if q.IPVersion != 4 {
+		panic("IP4Header called on non-IPv4 Parsed")
+	}
+	ipid := binary.BigEndian.Uint16(q.b[4:6])
+	return IP4Header{
+		IPID:    ipid,
+		IPProto: q.IPProto,
+		Src:     q.Src.Addr(),
+		Dst:     q.Dst.Addr(),
+	}
+}
+
+func (q *Parsed) IP6Header() IP6Header {
+	if q.IPVersion != 6 {
+		panic("IP6Header called on non-IPv6 Parsed")
+	}
+	ipid := (binary.BigEndian.Uint32(q.b[:4]) << 12) >> 12
+	return IP6Header{
+		IPID:    ipid,
+		IPProto: q.IPProto,
+		Src:     q.Src.Addr(),
+		Dst:     q.Dst.Addr(),
+	}
+}
+
+func (q *Parsed) ICMP4Header() ICMP4Header {
+	return ICMP4Header{
+		IP4Header: q.IP4Header(),
+		Type:      ICMP4Type(q.b[q.subofs+0]),
+		Code:      ICMP4Code(q.b[q.subofs+1]),
+	}
+}
+
+func (q *Parsed) ICMP6Header() ICMP6Header {
+	return ICMP6Header{
+		IP6Header: q.IP6Header(),
+		Type:      ICMP6Type(q.b[q.subofs+0]),
+		Code:      ICMP6Code(q.b[q.subofs+1]),
+	}
+}
+
+func (q *Parsed) UDP4Header() UDP4Header {
+	return UDP4Header{
+		IP4Header: q.IP4Header(),
+		SrcPort:   q.Src.Port(),
+		DstPort:   q.Dst.Port(),
+	}
+}
+
+// Buffer returns the entire packet buffer.
+// This is a read-only view; that is, q retains the ownership of the buffer.
+func (q *Parsed) Buffer() []byte {
+	return q.b
+}
+
+// Payload returns the payload of the IP subprotocol section.
+// This is a read-only view; that is, q retains the ownership of the buffer.
+func (q *Parsed) Payload() []byte {
+	// If the packet is truncated, return nothing instead of crashing.
+	if q.length > len(q.b) || q.dataofs > len(q.b) {
+		return nil
+	}
+
+	return q.b[q.dataofs:q.length]
+}
+
+// Transport returns the transport header and payload (IP subprotocol, such as TCP or UDP).
+// This is a read-only view; that is, p retains the ownership of the buffer.
+func (p *Parsed) Transport() []byte {
+	return p.b[p.subofs:]
+}
+
+// IsTCPSyn reports whether q is a TCP SYN packet,
+// without ACK set. (i.e. the first packet in a new connection)
+func (q *Parsed) IsTCPSyn() bool {
+	return (q.TCPFlags & TCPSynAck) == TCPSyn
+}
+
+// IsError reports whether q is an ICMP "Error" packet.
+func (q *Parsed) IsError() bool {
+	switch q.IPProto {
+	case ipproto.ICMPv4:
+		if len(q.b) < q.subofs+8 {
+			return false
+		}
+		t := ICMP4Type(q.b[q.subofs])
+		return t == ICMP4Unreachable || t == ICMP4TimeExceeded || t == ICMP4ParamProblem
+	case ipproto.ICMPv6:
+		if len(q.b) < q.subofs+8 {
+			return false
+		}
+		t := ICMP6Type(q.b[q.subofs])
+		return t == ICMP6Unreachable || t == ICMP6PacketTooBig || t == ICMP6TimeExceeded || t == ICMP6ParamProblem
+	default:
+		return false
+	}
+}
+
+// IsEchoRequest reports whether q is an ICMP Echo Request.
+func (q *Parsed) IsEchoRequest() bool {
+	switch q.IPProto {
+	case ipproto.ICMPv4:
+		return len(q.b) >= q.subofs+8 && ICMP4Type(q.b[q.subofs]) == ICMP4EchoRequest && ICMP4Code(q.b[q.subofs+1]) == ICMP4NoCode
+	case ipproto.ICMPv6:
+		return len(q.b) >= q.subofs+8 && ICMP6Type(q.b[q.subofs]) == ICMP6EchoRequest && ICMP6Code(q.b[q.subofs+1]) == ICMP6NoCode
+	default:
+		return false
+	}
+}
+
+// IsEchoResponse reports whether q is an IPv4 ICMP Echo Response.
+func (q *Parsed) IsEchoResponse() bool {
+	switch q.IPProto {
+	case ipproto.ICMPv4:
+		return len(q.b) >= q.subofs+8 && ICMP4Type(q.b[q.subofs]) == ICMP4EchoReply && ICMP4Code(q.b[q.subofs+1]) == ICMP4NoCode
+	case ipproto.ICMPv6:
+		return len(q.b) >= q.subofs+8 && ICMP6Type(q.b[q.subofs]) == ICMP6EchoReply && ICMP6Code(q.b[q.subofs+1]) == ICMP6NoCode
+	default:
+		return false
+	}
+}
+
+// EchoIDSeq extracts the identifier/sequence bytes from an ICMP Echo response,
+// and returns them as a uint32, used to lookup internally routed ICMP echo
+// responses. This function is intentionally lightweight as it is called on
+// every incoming ICMP packet.
+func (q *Parsed) EchoIDSeq() uint32 {
+	switch q.IPProto {
+	case ipproto.ICMPv4:
+		offset := ip4HeaderLength + icmp4HeaderLength
+		if len(q.b) < offset+4 {
+			return 0
+		}
+		return binary.LittleEndian.Uint32(q.b[offset:])
+	case ipproto.ICMPv6:
+		offset := ip6HeaderLength + icmp6HeaderLength
+		if len(q.b) < offset+4 {
+			return 0
+		}
+		return binary.LittleEndian.Uint32(q.b[offset:])
+	default:
+		return 0
+	}
+}
+
+func Hexdump(b []byte) string {
+	out := new(strings.Builder)
+	for i := 0; i < len(b); i += 16 {
+		if i > 0 {
+			fmt.Fprintf(out, "\n")
+		}
+		fmt.Fprintf(out, "  %04x  ", i)
+		j := 0
+		for ; j < 16 && i+j < len(b); j++ {
+			if j == 8 {
+				fmt.Fprintf(out, " ")
+			}
+			fmt.Fprintf(out, "%02x ", b[i+j])
+		}
+		for ; j < 16; j++ {
+			if j == 8 {
+				fmt.Fprintf(out, " ")
+			}
+			fmt.Fprintf(out, "   ")
+		}
+		fmt.Fprintf(out, " ")
+		for j = 0; j < 16 && i+j < len(b); j++ {
+			if b[i+j] >= 32 && b[i+j] < 128 {
+				fmt.Fprintf(out, "%c", b[i+j])
+			} else {
+				fmt.Fprintf(out, ".")
+			}
+		}
+	}
+	return out.String()
+}
+
+func withIP(ap netip.AddrPort, ip netip.Addr) netip.AddrPort {
+	return netip.AddrPortFrom(ip, ap.Port())
+}
+
+func withPort(ap netip.AddrPort, port uint16) netip.AddrPort {
+	return netip.AddrPortFrom(ap.Addr(), port)
+}

vendor/tailscale.com/net/packet/tsmp.go

@@ -0,0 +1,264 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// TSMP is our ICMP-like "Tailscale Message Protocol" for signaling
+// Tailscale-specific messages between nodes. It uses IP protocol 99
+// (reserved for "any private encryption scheme") within
+// WireGuard's normal encryption between peers and never hits the host
+// network stack.
+
+package packet
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"net/netip"
+
+	"tailscale.com/net/flowtrack"
+	"tailscale.com/types/ipproto"
+)
+
+// TailscaleRejectedHeader is a TSMP message that says that one
+// Tailscale node has rejected the connection from another. Unlike a
+// TCP RST, this includes a reason.
+//
+// On the wire, after the IP header, it's currently 7 or 8 bytes:
+//   - '!'
+//   - IPProto byte (IANA protocol number: TCP or UDP)
+//   - 'A' or 'S' (RejectedDueToACLs, RejectedDueToShieldsUp)
+//   - srcPort big endian uint16
+//   - dstPort big endian uint16
+//   - [optional] byte of flag bits:
+//     lowest bit (0x1): MaybeBroken
+//
+// In the future it might also accept 16 byte IP flow src/dst IPs
+// after the header, if they're different than the IP-level ones.
+type TailscaleRejectedHeader struct {
+	IPSrc  netip.Addr            // IPv4 or IPv6 header's src IP
+	IPDst  netip.Addr            // IPv4 or IPv6 header's dst IP
+	Src    netip.AddrPort        // rejected flow's src
+	Dst    netip.AddrPort        // rejected flow's dst
+	Proto  ipproto.Proto         // proto that was rejected (TCP or UDP)
+	Reason TailscaleRejectReason // why the connection was rejected
+
+	// MaybeBroken is whether the rejection is non-terminal (the
+	// client should not fail immediately). This is sent by a
+	// target when it's not sure whether it's totally broken, but
+	// it might be. For example, the target tailscaled might think
+	// its host firewall or IP forwarding aren't configured
+	// properly, but tailscaled might be wrong (not having enough
+	// visibility into what the OS is doing). When true, the
+	// message is simply an FYI as a potential reason to use for
+	// later when the pendopen connection tracking timer expires.
+	MaybeBroken bool
+}
+
+const rejectFlagBitMaybeBroken = 0x1
+
+func (rh TailscaleRejectedHeader) Flow() flowtrack.Tuple {
+	return flowtrack.MakeTuple(rh.Proto, rh.Src, rh.Dst)
+}
+
+func (rh TailscaleRejectedHeader) String() string {
+	return fmt.Sprintf("TSMP-reject-flow{%s %s > %s}: %s", rh.Proto, rh.Src, rh.Dst, rh.Reason)
+}
+
+type TSMPType uint8
+
+const (
+	// TSMPTypeRejectedConn is the type byte for a TailscaleRejectedHeader.
+	TSMPTypeRejectedConn TSMPType = '!'
+
+	// TSMPTypePing is the type byte for a TailscalePingRequest.
+	TSMPTypePing TSMPType = 'p'
+
+	// TSMPTypePong is the type byte for a TailscalePongResponse.
+	TSMPTypePong TSMPType = 'o'
+)
+
+type TailscaleRejectReason byte
+
+// IsZero reports whether r is the zero value, representing no rejection.
+func (r TailscaleRejectReason) IsZero() bool { return r == TailscaleRejectReasonNone }
+
+const (
+	// TailscaleRejectReasonNone is the TailscaleRejectReason zero value.
+	TailscaleRejectReasonNone TailscaleRejectReason = 0
+
+	// RejectedDueToACLs means that the host rejected the connection due to ACLs.
+	RejectedDueToACLs TailscaleRejectReason = 'A'
+
+	// RejectedDueToShieldsUp means that the host rejected the connection due to shields being up.
+	RejectedDueToShieldsUp TailscaleRejectReason = 'S'
+
+	// RejectedDueToIPForwarding means that the relay node's IP
+	// forwarding is disabled.
+	RejectedDueToIPForwarding TailscaleRejectReason = 'F'
+
+	// RejectedDueToHostFirewall means that the target host's
+	// firewall is blocking the traffic.
+	RejectedDueToHostFirewall TailscaleRejectReason = 'W'
+)
+
+func (r TailscaleRejectReason) String() string {
+	switch r {
+	case RejectedDueToACLs:
+		return "acl"
+	case RejectedDueToShieldsUp:
+		return "shields"
+	case RejectedDueToIPForwarding:
+		return "host-ip-forwarding-unavailable"
+	case RejectedDueToHostFirewall:
+		return "host-firewall"
+	}
+	return fmt.Sprintf("0x%02x", byte(r))
+}
+
+func (h TailscaleRejectedHeader) hasFlags() bool {
+	return h.MaybeBroken // the only one currently
+}
+
+func (h TailscaleRejectedHeader) Len() int {
+	v := 1 + // TSMPType byte
+		1 + // IPProto byte
+		1 + // TailscaleRejectReason byte
+		2*2 // 2 uint16 ports
+	if h.IPSrc.Is4() {
+		v += ip4HeaderLength
+	} else if h.IPSrc.Is6() {
+		v += ip6HeaderLength
+	}
+	if h.hasFlags() {
+		v++
+	}
+	return v
+}
+
+func (h TailscaleRejectedHeader) Marshal(buf []byte) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if len(buf) > maxPacketLength {
+		return errLargePacket
+	}
+	if h.Src.Addr().Is4() {
+		iph := IP4Header{
+			IPProto: ipproto.TSMP,
+			Src:     h.IPSrc,
+			Dst:     h.IPDst,
+		}
+		iph.Marshal(buf)
+		buf = buf[ip4HeaderLength:]
+	} else if h.Src.Addr().Is6() {
+		iph := IP6Header{
+			IPProto: ipproto.TSMP,
+			Src:     h.IPSrc,
+			Dst:     h.IPDst,
+		}
+		iph.Marshal(buf)
+		buf = buf[ip6HeaderLength:]
+	} else {
+		return errors.New("bogus src IP")
+	}
+	buf[0] = byte(TSMPTypeRejectedConn)
+	buf[1] = byte(h.Proto)
+	buf[2] = byte(h.Reason)
+	binary.BigEndian.PutUint16(buf[3:5], h.Src.Port())
+	binary.BigEndian.PutUint16(buf[5:7], h.Dst.Port())
+
+	if h.hasFlags() {
+		var flags byte
+		if h.MaybeBroken {
+			flags |= rejectFlagBitMaybeBroken
+		}
+		buf[7] = flags
+	}
+	return nil
+}
+
+// AsTailscaleRejectedHeader parses pp as an incoming rejection
+// connection TSMP message.
+//
+// ok reports whether pp was a valid TSMP rejection packet.
+func (pp *Parsed) AsTailscaleRejectedHeader() (h TailscaleRejectedHeader, ok bool) {
+	p := pp.Payload()
+	if len(p) < 7 || p[0] != byte(TSMPTypeRejectedConn) {
+		return
+	}
+	h = TailscaleRejectedHeader{
+		Proto:  ipproto.Proto(p[1]),
+		Reason: TailscaleRejectReason(p[2]),
+		IPSrc:  pp.Src.Addr(),
+		IPDst:  pp.Dst.Addr(),
+		Src:    netip.AddrPortFrom(pp.Dst.Addr(), binary.BigEndian.Uint16(p[3:5])),
+		Dst:    netip.AddrPortFrom(pp.Src.Addr(), binary.BigEndian.Uint16(p[5:7])),
+	}
+	if len(p) > 7 {
+		flags := p[7]
+		h.MaybeBroken = (flags & rejectFlagBitMaybeBroken) != 0
+	}
+	return h, true
+}
+
+// TSMPPingRequest is a TSMP message that's like an ICMP ping request.
+//
+// On the wire, after the IP header, it's currently 9 bytes:
+//   - 'p' (TSMPTypePing)
+//   - 8 opaque ping bytes to copy back in the response
+type TSMPPingRequest struct {
+	Data [8]byte
+}
+
+func (pp *Parsed) AsTSMPPing() (h TSMPPingRequest, ok bool) {
+	if pp.IPProto != ipproto.TSMP {
+		return
+	}
+	p := pp.Payload()
+	if len(p) < 9 || p[0] != byte(TSMPTypePing) {
+		return
+	}
+	copy(h.Data[:], p[1:])
+	return h, true
+}
+
+type TSMPPongReply struct {
+	IPHeader    Header
+	Data        [8]byte
+	PeerAPIPort uint16
+}
+
+// AsTSMPPong returns pp as a TSMPPongReply and whether it is one.
+// The pong.IPHeader field is not populated.
+func (pp *Parsed) AsTSMPPong() (pong TSMPPongReply, ok bool) {
+	if pp.IPProto != ipproto.TSMP {
+		return
+	}
+	p := pp.Payload()
+	if len(p) < 9 || p[0] != byte(TSMPTypePong) {
+		return
+	}
+	copy(pong.Data[:], p[1:])
+	if len(p) >= 11 {
+		pong.PeerAPIPort = binary.BigEndian.Uint16(p[9:])
+	}
+	return pong, true
+}
+
+func (h TSMPPongReply) Len() int {
+	return h.IPHeader.Len() + 11
+}
+
+func (h TSMPPongReply) Marshal(buf []byte) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if err := h.IPHeader.Marshal(buf); err != nil {
+		return err
+	}
+	buf = buf[h.IPHeader.Len():]
+	buf[0] = byte(TSMPTypePong)
+	copy(buf[1:], h.Data[:])
+	binary.BigEndian.PutUint16(buf[9:11], h.PeerAPIPort)
+	return nil
+}

vendor/tailscale.com/net/packet/udp4.go

@@ -0,0 +1,58 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"encoding/binary"
+
+	"tailscale.com/types/ipproto"
+)
+
+// udpHeaderLength is the size of the UDP packet header, not including
+// the outer IP header.
+const udpHeaderLength = 8
+
+// UDP4Header is an IPv4+UDP header.
+type UDP4Header struct {
+	IP4Header
+	SrcPort uint16
+	DstPort uint16
+}
+
+// Len implements Header.
+func (h UDP4Header) Len() int {
+	return h.IP4Header.Len() + udpHeaderLength
+}
+
+// Marshal implements Header.
+func (h UDP4Header) Marshal(buf []byte) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if len(buf) > maxPacketLength {
+		return errLargePacket
+	}
+	// The caller does not need to set this.
+	h.IPProto = ipproto.UDP
+
+	length := len(buf) - h.IP4Header.Len()
+	binary.BigEndian.PutUint16(buf[20:22], h.SrcPort)
+	binary.BigEndian.PutUint16(buf[22:24], h.DstPort)
+	binary.BigEndian.PutUint16(buf[24:26], uint16(length))
+	binary.BigEndian.PutUint16(buf[26:28], 0) // blank checksum
+
+	// UDP checksum with IP pseudo header.
+	h.IP4Header.marshalPseudo(buf)
+	binary.BigEndian.PutUint16(buf[26:28], ip4Checksum(buf[ip4PseudoHeaderOffset:]))
+
+	h.IP4Header.Marshal(buf)
+
+	return nil
+}
+
+// ToResponse implements Header.
+func (h *UDP4Header) ToResponse() {
+	h.SrcPort, h.DstPort = h.DstPort, h.SrcPort
+	h.IP4Header.ToResponse()
+}

vendor/tailscale.com/net/packet/udp6.go

@@ -0,0 +1,54 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"encoding/binary"
+
+	"tailscale.com/types/ipproto"
+)
+
+// UDP6Header is an IPv6+UDP header.
+type UDP6Header struct {
+	IP6Header
+	SrcPort uint16
+	DstPort uint16
+}
+
+// Len implements Header.
+func (h UDP6Header) Len() int {
+	return h.IP6Header.Len() + udpHeaderLength
+}
+
+// Marshal implements Header.
+func (h UDP6Header) Marshal(buf []byte) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if len(buf) > maxPacketLength {
+		return errLargePacket
+	}
+	// The caller does not need to set this.
+	h.IPProto = ipproto.UDP
+
+	length := len(buf) - h.IP6Header.Len()
+	binary.BigEndian.PutUint16(buf[40:42], h.SrcPort)
+	binary.BigEndian.PutUint16(buf[42:44], h.DstPort)
+	binary.BigEndian.PutUint16(buf[44:46], uint16(length))
+	binary.BigEndian.PutUint16(buf[46:48], 0) // blank checksum
+
+	// UDP checksum with IP pseudo header.
+	h.IP6Header.marshalPseudo(buf, ipproto.UDP)
+	binary.BigEndian.PutUint16(buf[46:48], ip4Checksum(buf[:]))
+
+	h.IP6Header.Marshal(buf)
+
+	return nil
+}
+
+// ToResponse implements Header.
+func (h *UDP6Header) ToResponse() {
+	h.SrcPort, h.DstPort = h.DstPort, h.SrcPort
+	h.IP6Header.ToResponse()
+}