wgengine: add exit destination logging enable for wgengine logger
Updates tailscale/corp#18625
This commit is contained in:
parent
7f587d0321
commit
1887f3044a
|
@ -93,7 +93,7 @@ var testClient *http.Client
|
|||
// The IP protocol and source port are always zero.
|
||||
// The sock is used to populated the PhysicalTraffic field in Message.
|
||||
// The netMon parameter is optional; if non-nil it's used to do faster interface lookups.
|
||||
func (nl *Logger) Startup(nodeID tailcfg.StableNodeID, nodeLogID, domainLogID logid.PrivateID, tun, sock Device, netMon *netmon.Monitor, health *health.Tracker) error {
|
||||
func (nl *Logger) Startup(nodeID tailcfg.StableNodeID, nodeLogID, domainLogID logid.PrivateID, tun, sock Device, netMon *netmon.Monitor, health *health.Tracker, logExitFlowEnabledEnabled bool) error {
|
||||
nl.mu.Lock()
|
||||
defer nl.mu.Unlock()
|
||||
if nl.logger != nil {
|
||||
|
@ -131,7 +131,7 @@ func (nl *Logger) Startup(nodeID tailcfg.StableNodeID, nodeLogID, domainLogID lo
|
|||
addrs := nl.addrs
|
||||
prefixes := nl.prefixes
|
||||
nl.mu.Unlock()
|
||||
recordStatistics(nl.logger, nodeID, start, end, virtual, physical, addrs, prefixes)
|
||||
recordStatistics(nl.logger, nodeID, start, end, virtual, physical, addrs, prefixes, logExitFlowEnabledEnabled)
|
||||
})
|
||||
|
||||
// Register the connection tracker into the TUN device.
|
||||
|
@ -151,7 +151,7 @@ func (nl *Logger) Startup(nodeID tailcfg.StableNodeID, nodeLogID, domainLogID lo
|
|||
return nil
|
||||
}
|
||||
|
||||
func recordStatistics(logger *logtail.Logger, nodeID tailcfg.StableNodeID, start, end time.Time, connstats, sockStats map[netlogtype.Connection]netlogtype.Counts, addrs map[netip.Addr]bool, prefixes map[netip.Prefix]bool) {
|
||||
func recordStatistics(logger *logtail.Logger, nodeID tailcfg.StableNodeID, start, end time.Time, connstats, sockStats map[netlogtype.Connection]netlogtype.Counts, addrs map[netip.Addr]bool, prefixes map[netip.Prefix]bool, logExitFlowEnabled bool) {
|
||||
m := netlogtype.Message{NodeID: nodeID, Start: start.UTC(), End: end.UTC()}
|
||||
|
||||
classifyAddr := func(a netip.Addr) (isTailscale, withinRoute bool) {
|
||||
|
@ -180,7 +180,7 @@ func recordStatistics(logger *logtail.Logger, nodeID tailcfg.StableNodeID, start
|
|||
m.SubnetTraffic = append(m.SubnetTraffic, netlogtype.ConnectionCounts{Connection: conn, Counts: cnts})
|
||||
default:
|
||||
const anonymize = true
|
||||
if anonymize {
|
||||
if anonymize && !logExitFlowEnabled {
|
||||
// Only preserve the address if it is a Tailscale IP address.
|
||||
srcOrig, dstOrig := conn.Src, conn.Dst
|
||||
conn = netlogtype.Connection{} // scrub everything by default
|
||||
|
|
|
@ -965,8 +965,9 @@ func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config,
|
|||
if netLogRunning && !e.networkLogger.Running() {
|
||||
nid := cfg.NetworkLogging.NodeID
|
||||
tid := cfg.NetworkLogging.DomainID
|
||||
logExitFlowEnabled := cfg.NetworkLogging.LogExitFlowEnabled
|
||||
e.logf("wgengine: Reconfig: starting up network logger (node:%s tailnet:%s)", nid.Public(), tid.Public())
|
||||
if err := e.networkLogger.Startup(cfg.NodeID, nid, tid, e.tundev, e.magicConn, e.netMon, e.health); err != nil {
|
||||
if err := e.networkLogger.Startup(cfg.NodeID, nid, tid, e.tundev, e.magicConn, e.netMon, e.health, logExitFlowEnabled); err != nil {
|
||||
e.logf("wgengine: Reconfig: error starting up network logger: %v", err)
|
||||
}
|
||||
e.networkLogger.ReconfigRoutes(routerCfg)
|
||||
|
|
|
@ -27,9 +27,11 @@ type Config struct {
|
|||
|
||||
// NetworkLogging enables network logging.
|
||||
// It is disabled if either ID is the zero value.
|
||||
// LogExitFlowEnabled indicates whether or not exit flows should be logged.
|
||||
NetworkLogging struct {
|
||||
NodeID logid.PrivateID
|
||||
DomainID logid.PrivateID
|
||||
NodeID logid.PrivateID
|
||||
DomainID logid.PrivateID
|
||||
LogExitFlowEnabled bool
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
@ -63,6 +63,7 @@ func WGCfg(nm *netmap.NetworkMap, logf logger.Logf, flags netmap.WGConfigFlags,
|
|||
if nm.SelfNode.Valid() {
|
||||
cfg.NodeID = nm.SelfNode.StableID()
|
||||
canNetworkLog := nm.SelfNode.HasCap(tailcfg.CapabilityDataPlaneAuditLogs)
|
||||
logExitFlowEnabled := nm.SelfNode.HasCap(tailcfg.NodeAttrLogExitFlows)
|
||||
if canNetworkLog && nm.SelfNode.DataPlaneAuditLogID() != "" && nm.DomainAuditLogID != "" {
|
||||
nodeID, errNode := logid.ParsePrivateID(nm.SelfNode.DataPlaneAuditLogID())
|
||||
if errNode != nil {
|
||||
|
@ -75,6 +76,7 @@ func WGCfg(nm *netmap.NetworkMap, logf logger.Logf, flags netmap.WGConfigFlags,
|
|||
if errNode == nil && errDomain == nil {
|
||||
cfg.NetworkLogging.NodeID = nodeID
|
||||
cfg.NetworkLogging.DomainID = domainID
|
||||
cfg.NetworkLogging.LogExitFlowEnabled = logExitFlowEnabled
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
@ -43,8 +43,9 @@ var _ConfigCloneNeedsRegeneration = Config(struct {
|
|||
DNS []netip.Addr
|
||||
Peers []Peer
|
||||
NetworkLogging struct {
|
||||
NodeID logid.PrivateID
|
||||
DomainID logid.PrivateID
|
||||
NodeID logid.PrivateID
|
||||
DomainID logid.PrivateID
|
||||
LogExitFlowEnabled bool
|
||||
}
|
||||
}{})
|
||||
|
||||
|
@ -76,3 +77,30 @@ var _PeerCloneNeedsRegeneration = Peer(struct {
|
|||
PersistentKeepalive uint16
|
||||
WGEndpoint key.NodePublic
|
||||
}{})
|
||||
|
||||
// Clone duplicates src into dst and reports whether it succeeded.
|
||||
// To succeed, <src, dst> must be of types <*T, *T> or <*T, **T>,
|
||||
// where T is one of Config,Peer.
|
||||
func Clone(dst, src any) bool {
|
||||
switch src := src.(type) {
|
||||
case *Config:
|
||||
switch dst := dst.(type) {
|
||||
case *Config:
|
||||
*dst = *src.Clone()
|
||||
return true
|
||||
case **Config:
|
||||
*dst = src.Clone()
|
||||
return true
|
||||
}
|
||||
case *Peer:
|
||||
switch dst := dst.(type) {
|
||||
case *Peer:
|
||||
*dst = *src.Clone()
|
||||
return true
|
||||
case **Peer:
|
||||
*dst = src.Clone()
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
|
|
@ -0,0 +1,173 @@
|
|||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
// Code generated by tailscale/cmd/viewer; DO NOT EDIT.
|
||||
|
||||
package wgcfg
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"net/netip"
|
||||
|
||||
"tailscale.com/tailcfg"
|
||||
"tailscale.com/types/key"
|
||||
"tailscale.com/types/logid"
|
||||
"tailscale.com/types/views"
|
||||
)
|
||||
|
||||
//go:generate go run tailscale.com/cmd/cloner -clonefunc=true -type=Config,Peer
|
||||
|
||||
// View returns a readonly view of Config.
|
||||
func (p *Config) View() ConfigView {
|
||||
return ConfigView{ж: p}
|
||||
}
|
||||
|
||||
// ConfigView provides a read-only view over Config.
|
||||
//
|
||||
// Its methods should only be called if `Valid()` returns true.
|
||||
type ConfigView struct {
|
||||
// ж is the underlying mutable value, named with a hard-to-type
|
||||
// character that looks pointy like a pointer.
|
||||
// It is named distinctively to make you think of how dangerous it is to escape
|
||||
// to callers. You must not let callers be able to mutate it.
|
||||
ж *Config
|
||||
}
|
||||
|
||||
// Valid reports whether underlying value is non-nil.
|
||||
func (v ConfigView) Valid() bool { return v.ж != nil }
|
||||
|
||||
// AsStruct returns a clone of the underlying value which aliases no memory with
|
||||
// the original.
|
||||
func (v ConfigView) AsStruct() *Config {
|
||||
if v.ж == nil {
|
||||
return nil
|
||||
}
|
||||
return v.ж.Clone()
|
||||
}
|
||||
|
||||
func (v ConfigView) MarshalJSON() ([]byte, error) { return json.Marshal(v.ж) }
|
||||
|
||||
func (v *ConfigView) UnmarshalJSON(b []byte) error {
|
||||
if v.ж != nil {
|
||||
return errors.New("already initialized")
|
||||
}
|
||||
if len(b) == 0 {
|
||||
return nil
|
||||
}
|
||||
var x Config
|
||||
if err := json.Unmarshal(b, &x); err != nil {
|
||||
return err
|
||||
}
|
||||
v.ж = &x
|
||||
return nil
|
||||
}
|
||||
|
||||
func (v ConfigView) Name() string { return v.ж.Name }
|
||||
func (v ConfigView) NodeID() tailcfg.StableNodeID { return v.ж.NodeID }
|
||||
func (v ConfigView) PrivateKey() key.NodePrivate { return v.ж.PrivateKey }
|
||||
func (v ConfigView) Addresses() views.Slice[netip.Prefix] { return views.SliceOf(v.ж.Addresses) }
|
||||
func (v ConfigView) MTU() uint16 { return v.ж.MTU }
|
||||
func (v ConfigView) DNS() views.Slice[netip.Addr] { return views.SliceOf(v.ж.DNS) }
|
||||
func (v ConfigView) Peers() Peer { panic("unsupported") }
|
||||
func (v ConfigView) NetworkLogging() struct {
|
||||
NodeID logid.PrivateID
|
||||
DomainID logid.PrivateID
|
||||
LogExitFlowEnabled bool
|
||||
} {
|
||||
return v.ж.NetworkLogging
|
||||
}
|
||||
|
||||
// A compilation failure here means this code must be regenerated, with the command at the top of this file.
|
||||
var _ConfigViewNeedsRegeneration = Config(struct {
|
||||
Name string
|
||||
NodeID tailcfg.StableNodeID
|
||||
PrivateKey key.NodePrivate
|
||||
Addresses []netip.Prefix
|
||||
MTU uint16
|
||||
DNS []netip.Addr
|
||||
Peers []Peer
|
||||
NetworkLogging struct {
|
||||
NodeID logid.PrivateID
|
||||
DomainID logid.PrivateID
|
||||
LogExitFlowEnabled bool
|
||||
}
|
||||
}{})
|
||||
|
||||
// View returns a readonly view of Peer.
|
||||
func (p *Peer) View() PeerView {
|
||||
return PeerView{ж: p}
|
||||
}
|
||||
|
||||
// PeerView provides a read-only view over Peer.
|
||||
//
|
||||
// Its methods should only be called if `Valid()` returns true.
|
||||
type PeerView struct {
|
||||
// ж is the underlying mutable value, named with a hard-to-type
|
||||
// character that looks pointy like a pointer.
|
||||
// It is named distinctively to make you think of how dangerous it is to escape
|
||||
// to callers. You must not let callers be able to mutate it.
|
||||
ж *Peer
|
||||
}
|
||||
|
||||
// Valid reports whether underlying value is non-nil.
|
||||
func (v PeerView) Valid() bool { return v.ж != nil }
|
||||
|
||||
// AsStruct returns a clone of the underlying value which aliases no memory with
|
||||
// the original.
|
||||
func (v PeerView) AsStruct() *Peer {
|
||||
if v.ж == nil {
|
||||
return nil
|
||||
}
|
||||
return v.ж.Clone()
|
||||
}
|
||||
|
||||
func (v PeerView) MarshalJSON() ([]byte, error) { return json.Marshal(v.ж) }
|
||||
|
||||
func (v *PeerView) UnmarshalJSON(b []byte) error {
|
||||
if v.ж != nil {
|
||||
return errors.New("already initialized")
|
||||
}
|
||||
if len(b) == 0 {
|
||||
return nil
|
||||
}
|
||||
var x Peer
|
||||
if err := json.Unmarshal(b, &x); err != nil {
|
||||
return err
|
||||
}
|
||||
v.ж = &x
|
||||
return nil
|
||||
}
|
||||
|
||||
func (v PeerView) PublicKey() key.NodePublic { return v.ж.PublicKey }
|
||||
func (v PeerView) DiscoKey() key.DiscoPublic { return v.ж.DiscoKey }
|
||||
func (v PeerView) AllowedIPs() views.Slice[netip.Prefix] { return views.SliceOf(v.ж.AllowedIPs) }
|
||||
func (v PeerView) V4MasqAddr() *netip.Addr {
|
||||
if v.ж.V4MasqAddr == nil {
|
||||
return nil
|
||||
}
|
||||
x := *v.ж.V4MasqAddr
|
||||
return &x
|
||||
}
|
||||
|
||||
func (v PeerView) V6MasqAddr() *netip.Addr {
|
||||
if v.ж.V6MasqAddr == nil {
|
||||
return nil
|
||||
}
|
||||
x := *v.ж.V6MasqAddr
|
||||
return &x
|
||||
}
|
||||
|
||||
func (v PeerView) PersistentKeepalive() uint16 { return v.ж.PersistentKeepalive }
|
||||
func (v PeerView) WGEndpoint() key.NodePublic { return v.ж.WGEndpoint }
|
||||
|
||||
// A compilation failure here means this code must be regenerated, with the command at the top of this file.
|
||||
var _PeerViewNeedsRegeneration = Peer(struct {
|
||||
PublicKey key.NodePublic
|
||||
DiscoKey key.DiscoPublic
|
||||
AllowedIPs []netip.Prefix
|
||||
V4MasqAddr *netip.Addr
|
||||
V6MasqAddr *netip.Addr
|
||||
PersistentKeepalive uint16
|
||||
WGEndpoint key.NodePublic
|
||||
}{})
|
Loading…
Reference in New Issue