Update

vendor/tailscale.com/net/tstun/wrap_linux.go

@@ -1,4 +1,4 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
 //go:build linux && !ts_omit_gro
@@ -15,22 +15,26 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/checksum"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"tailscale.com/control/controlknobs"
 	"tailscale.com/envknob"
 	"tailscale.com/net/tsaddr"
 )
 
 // SetLinkFeaturesPostUp configures link features on t based on select TS_TUN_
-// environment variables and OS feature tests. Callers should ensure t is
-// up prior to calling, otherwise OS feature tests may be inconclusive.
-func (t *Wrapper) SetLinkFeaturesPostUp() {
+// environment variables, control-plane node attributes (via knobs, which may be
+// nil), and OS feature tests. Callers should ensure t is up prior to calling,
+// otherwise OS feature tests may be inconclusive.
+func (t *Wrapper) SetLinkFeaturesPostUp(knobs *controlknobs.Knobs) {
 	if t.isTAP || runtime.GOOS == "android" {
 		return
 	}
 	if groDev, ok := t.tdev.(tun.GRODevice); ok {
-		if envknob.Bool("TS_TUN_DISABLE_UDP_GRO") {
+		if envknob.Bool("TS_TUN_DISABLE_UDP_GRO") ||
+			(knobs != nil && knobs.DisableTUNUDPGRO.Load()) {
 			groDev.DisableUDPGRO()
 		}
-		if envknob.Bool("TS_TUN_DISABLE_TCP_GRO") {
+		if envknob.Bool("TS_TUN_DISABLE_TCP_GRO") ||
+			(knobs != nil && knobs.DisableTUNTCPGRO.Load()) {
 			groDev.DisableTCPGRO()
 		}
 		err := probeTCPGRO(groDev)
@@ -42,6 +46,31 @@ func (t *Wrapper) SetLinkFeaturesPostUp() {
 	}
 }
 
+// ApplyGROKnobs applies the [tailcfg.NodeAttrDisableTUNUDPGRO] and
+// [tailcfg.NodeAttrDisableTUNTCPGRO] knob values (via knobs, which must be
+// non-nil) to t's underlying device. It is intended to be called when a
+// control-plane node attribute change is detected after [SetLinkFeaturesPostUp]
+// has already run.
+//
+// Note: wireguard-go's GRO disablement is one-way (sticky); ApplyGROKnobs can
+// move TUN UDP/TCP GRO from enabled to disabled, but the reverse requires a
+// client restart.
+func (t *Wrapper) ApplyGROKnobs(knobs *controlknobs.Knobs) {
+	if t.isTAP || runtime.GOOS == "android" || knobs == nil {
+		return
+	}
+	groDev, ok := t.tdev.(tun.GRODevice)
+	if !ok {
+		return
+	}
+	if knobs.DisableTUNUDPGRO.Load() {
+		groDev.DisableUDPGRO()
+	}
+	if knobs.DisableTUNTCPGRO.Load() {
+		groDev.DisableTCPGRO()
+	}
+}
+
 func probeTCPGRO(dev tun.GRODevice) error {
 	ipPort := netip.MustParseAddrPort(tsaddr.TailscaleServiceIPString + ":0")
 	fingerprint := []byte("tailscale-probe-tun-gro")
@@ -52,8 +81,8 @@ func probeTCPGRO(dev tun.GRODevice) error {
 	ipAs4 := ipPort.Addr().As4()
 	bufs := make([][]byte, 2)
 	for i := range bufs {
-		bufs[i] = make([]byte, PacketStartOffset+totalLen, PacketStartOffset+(totalLen*2))
-		ipv4H := header.IPv4(bufs[i][PacketStartOffset:])
+		bufs[i] = make([]byte, WritePacketStartOffset+totalLen, WritePacketStartOffset+(totalLen*2))
+		ipv4H := header.IPv4(bufs[i][WritePacketStartOffset:])
 		ipv4H.Encode(&header.IPv4Fields{
 			SrcAddr:  tcpip.AddrFromSlice(ipAs4[:]),
 			DstAddr:  tcpip.AddrFromSlice(ipAs4[:]),
@@ -63,7 +92,7 @@ func probeTCPGRO(dev tun.GRODevice) error {
 			TTL:         0,
 			TotalLength: uint16(totalLen),
 		})
-		tcpH := header.TCP(bufs[i][PacketStartOffset+iphLen:])
+		tcpH := header.TCP(bufs[i][WritePacketStartOffset+iphLen:])
 		tcpH.Encode(&header.TCPFields{
 			SrcPort:    ipPort.Port(),
 			DstPort:    ipPort.Port(),
@@ -73,12 +102,12 @@ func probeTCPGRO(dev tun.GRODevice) error {
 			Flags:      header.TCPFlagAck,
 			WindowSize: 3000,
 		})
-		copy(bufs[i][PacketStartOffset+iphLen+tcphLen:], fingerprint)
+		copy(bufs[i][WritePacketStartOffset+iphLen+tcphLen:], fingerprint)
 		ipv4H.SetChecksum(^ipv4H.CalculateChecksum())
 		pseudoCsum := header.PseudoHeaderChecksum(unix.IPPROTO_TCP, ipv4H.SourceAddress(), ipv4H.DestinationAddress(), uint16(tcphLen+segmentSize))
-		pseudoCsum = checksum.Checksum(bufs[i][PacketStartOffset+iphLen+tcphLen:], pseudoCsum)
+		pseudoCsum = checksum.Checksum(bufs[i][WritePacketStartOffset+iphLen+tcphLen:], pseudoCsum)
 		tcpH.SetChecksum(^tcpH.CalculateChecksum(pseudoCsum))
 	}
-	_, err := dev.Write(bufs, PacketStartOffset)
+	_, err := dev.Write(bufs, WritePacketStartOffset)
 	return err
 }