wgengine/magicsock: don't use BPF receive when SO_MARK doesn't work.

Fixes #5607

Signed-off-by: David Anderson <danderson@tailscale.com>

wgengine/magicsock/magicsock_linux.go

@@ -18,6 +18,7 @@ import (
 	"golang.org/x/net/bpf"
 	"golang.org/x/sys/unix"
 	"tailscale.com/envknob"
+	"tailscale.com/net/netns"
 	"tailscale.com/types/key"
 )
 
@@ -128,6 +129,11 @@ func (c *Conn) listenRawDisco(family string) (io.Closer, error) {
 		return nil, errors.New("raw disco listening disabled by debug flag")
 	}
 
+	// https://github.com/tailscale/tailscale/issues/5607
+	if !netns.UseSocketMark() {
+		return nil, errors.New("raw disco listening disabled, SO_MARK unavailable")
+	}
+
 	var (
 		network  string
 		addr     string