Method inject

wgengine/netstack/netstack.go:1047–1095

The inject goroutine reads in packets that netstack generated, and delivers them to the correct path.

()

// The inject goroutine reads in packets that netstack generated, and delivers
// them to the correct path.
func (ns *Impl) inject() {
	inboundBuffs, inboundBuffsSizes := ns.getInjectInboundBuffsSizes()
	for {
		pkt := ns.linkEP.ReadContext(ns.ctx)
		if pkt == nil {
			if ns.ctx.Err() != nil {
				// Return without logging.
				return
			}
			ns.logf("[v2] ReadContext-for-write = ok=false")
			continue
		}

		if debugPackets {
			ns.logf("[v2] packet Write out: % x", stack.PayloadSince(pkt.NetworkHeader()).AsSlice())
		}

		// In the normal case, netstack synthesizes the bytes for
		// traffic which should transit back into WG and go to peers.
		// However, some uses of netstack (presently, magic DNS)
		// send traffic destined for the local device, hence must
		// be injected 'inbound'.
		sendToHost := ns.shouldSendToHost(pkt)

		// pkt has a non-zero refcount, so injection methods takes
		// ownership of one count and will decrement on completion.
		if sendToHost {
			if err := ns.tundev.InjectInboundPacketBuffer(pkt, inboundBuffs, inboundBuffsSizes); err != nil {
				ns.logf("netstack inject inbound: %v", err)
				return
			}
		} else {
			// Self-addressed packet: deliver back into gVisor directly
			// via the link endpoint's dispatcher, but only if the packet is not
			// earmarked for the host. Neither the inbound path (fakeTUN Write is a
			// no-op) nor the outbound path (WireGuard has no peer for our own IP)
			// can handle these.
			if ns.isSelfDst(pkt) {
				ns.linkEP.DeliverLoopback(pkt)
				continue
			}

			if err := ns.tundev.InjectOutboundPacketBuffer(pkt); err != nil {
				ns.logf("netstack inject outbound: %v", err)
				return
			}
		}
	}
}

// shouldSendToHost determines if the provided packet should be sent to the
// host (i.e the current machine running Tailscale), in which case it will