tailscale

Commit Graph

Author	SHA1	Message	Date
Anton Tolchanov	8cc5c51888	health: warn about reverse path filtering and exit nodes When reverse path filtering is in strict mode on Linux, using an exit node blocks all network connectivity. This change adds a warning about this to `tailscale status` and the logs. Example in `tailscale status`: ``` - not connected to home DERP region 22 - The following issues on your machine will likely make usage of exit nodes impossible: [interface "eth0" has strict reverse-path filtering enabled], please set rp_filter=2 instead of rp_filter=1; see https://github.com/tailscale/tailscale/issues/3310 ``` Example in the logs: ``` 2024/02/21 21:17:07 health("overall"): error: multiple errors: not in map poll The following issues on your machine will likely make usage of exit nodes impossible: [interface "eth0" has strict reverse-path filtering enabled], please set rp_filter=2 instead of rp_filter=1; see https://github.com/tailscale/tailscale/issues/3310 ``` Updates #3310 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 months ago
Nick Khyl	7ef1fb113d	cmd/tailscaled, ipn/ipnlocal, wgengine: shutdown tailscaled if wgdevice is closed Tailscaled becomes inoperative if the Tailscale Tunnel wintun adapter is abruptly removed. wireguard-go closes the device in case of a read error, but tailscaled keeps running. This adds detection of a closed WireGuard device, triggering a graceful shutdown of tailscaled. It is then restarted by the tailscaled watchdog service process. Fixes #11222 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago
Nick Khyl	b42b9817b0	net/dns: do not wait for the interface registry key to appear if the windowsManager is being closed The WinTun adapter may have been removed by the time we're closing the dns.windowsManager, and its associated interface registry key might also have been deleted. We shouldn't use winutil.OpenKeyWait and wait for the interface key to appear when performing a cleanup as a part of the windowsManager shutdown. Updates #11222 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago
Brad Fitzpatrick	e1bd7488d0	all: remove LenIter, use Go 1.22 range-over-int instead Updates #11058 Updates golang/go#65685 Change-Id: Ibb216b346e511d486271ab3d84e4546c521e4e22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
mrrfv	ff1391a97e	net/dns/publicdns: add Mullvad family DNS to the list of known DoH servers Adds the new Mullvad family DNS server to the known DNS over HTTPS server list. Signed-off-by: mrrfv <rm-rfv-no-preserve-root@protonmail.com>	3 months ago
James Tucker	8d0d46462b	net/dns: timeout DOH requests after 10s without response headers If a client socket is remotely lost but the client is not sent an RST in response to the next request, the socket might sit in RTO for extended lengths of time, resulting in "no internet" for users. Instead, timeout after 10s, which will close the underlying socket, recovering from the situation more promptly. Updates #10967 Signed-off-by: James Tucker <james@tailscale.com>	3 months ago
James Tucker	651c4899ac	net/interfaces: reduce & cleanup logs on iOS We don't need a log line every time defaultRoute is read in the good case, and we now only log default interface updates that are actually changes. Updates #3363 Signed-off-by: James Tucker <james@tailscale.com>	3 months ago
Andrew Dunham	e8d2fc7f7f	net/tshttpproxy: log when we're using a proxy Updates #11196 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id6334c10f52f4cfbda9f03dc8096ab7a6c54a088	3 months ago
James Tucker	8fe504241d	net/ktimeout: add a package to set TCP user timeout Setting a user timeout will be a more practical tuning knob for a number of endpoints, this provides a way to set it. Updates tailscale/corp#17587 Signed-off-by: James Tucker <james@tailscale.com>	3 months ago
Andrew Dunham	70b7201744	net/dns: fix infinite loop when run on Amazon Linux 2023 This fixes an infinite loop caused by the configuration of systemd-resolved on Amazon Linux 2023 and how that interacts with Tailscale's "direct" mode. We now drop the Tailscale service IP from the OS's "base configuration" when we detect this configuration. Updates #7816 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I73a4ea8e65571eb368c7e179f36af2c049a588ee	3 months ago
Andrew Dunham	b0e96a6c39	net/dns: log more info when openresolv commands fail Updates #11129 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic594868ba3bc31f6d3b0721ecba4090749a81f7f	3 months ago
Brad Fitzpatrick	2bd3c1474b	util/cmpx: delete now that we're using Go 1.22 Updates #11058 Change-Id: I09dea8e86f03ec148b715efca339eab8b1f0f644 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Andrew Dunham	fd94d96e2b	net/portmapper: support legacy "urn:dslforum-org" portmapping services These are functionally the same as the "urn:schemas-upnp-org" services with a few minor changes, and are still used by older devices. Support them to improve our ability to obtain an external IP on such networks. Updates #10911 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I05501fad9d6f0a3b8cf19fc95eee80e7d16cc2cf	4 months ago
Andrew Dunham	b45089ad85	net/portmapper: handle cases where we have no supported clients This no longer results in a nil pointer exception when we get a valid UPnP response with no supported clients. Updates #10911 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6e3715a49a193ff5261013871ad7fff197a4d77e	4 months ago
kari-ts	c9fd166cc6	net/netmon: when a new network is added, trigger netmon update (#10840 ) Fixes #10107	4 months ago
Andrew Dunham	20f3f706a4	net/netutil: allow 16-bit 4via6 site IDs The prefix has space for 32-bit site IDs, but the validateViaPrefix function would previously have disallowed site IDs greater than 255. Fixes tailscale/corp#16470 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I4cdb0711dafb577fae72d86c4014cf623fa538ef	4 months ago
James Tucker	953fa80c6f	cmd/{derper,stund},net/stunserver: add standalone stun server Add a standalone server for STUN that can be hosted independently of the derper, and factor that back into the derper. Fixes #8434 Closes #8435 Closes #10745 Signed-off-by: James Tucker <james@tailscale.com>	4 months ago
Andrew Dunham	35c303227a	net/dns/resolver: add ID to verbose logs in forwarder To make it easier to correlate the starting/ending log messages. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I2802d53ad98e19bc8914bc58f8c04d4443227b26	4 months ago
Andrea Gottardo	d9aeb30281	net/interfaces: handle iOS network transitions (#10680 ) Updates #8022 Updates #6075 On iOS, we currently rely on delegated interface information to figure out the default route interface. The NetworkExtension framework in iOS seems to set the delegate interface only once, upon the creation of the VPN tunnel. If a network transition (e.g. from Wi-Fi to Cellular) happens while the tunnel is connected, it will be ignored and we will still try to set Wi-Fi as the default route because the delegated interface is not getting updated as connectivity transitions. Here we work around this on the Swift side with a NWPathMonitor instance that observes the interface name of the first currently satisfied network path. Our Swift code will call into `UpdateLastKnownDefaultRouteInterface`, so we can rely on that when it is set. If for any reason the Swift machinery didn't work and we don't get any updates, here we also have some fallback logic: we try finding a hardcoded Wi-Fi interface called en0. If en0 is down, we fall back to cellular (pdp_ip0) as a last resort. This doesn't handle all edge cases like USB-Ethernet adapters or multiple Ethernet interfaces, but it is good enough to ensure connectivity isn't broken. I tested this on iPhones and iPads running iOS 17.1 and it appears to work. Switching between different cellular plans on a dual SIM configuration also works (the interface name remains pdp_ip0). Signed-off-by: Andrea Gottardo <andrea@tailscale.com>	5 months ago
Andrew Dunham	fa3639783c	net/portmapper: check returned epoch from PMP and PCP protocols If the epoch that we see during a Probe is less than the existing epoch, it means that the gateway has either restarted or reset its configuration, and an existing mapping is no longer valid. Reset any saved mapping(s) if we detect this case so that a future createOrGetMapping will not attempt to re-use it. Updates #10597 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie3cddaf625cb94a29885f7a1eeea25dbf6b97b47	5 months ago
Andrew Lytvynov	2716250ee8	all: cleanup unused code, part 2 (#10670 ) And enable U1000 check in staticcheck. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Nick Khyl	c9836b454d	net/netmon: fix goroutine leak in winMon if the monitor is never started When the portable Monitor creates a winMon via newOSMon, we register address and route change callbacks with Windows. Once a callback is hit, it starts a goroutine that attempts to send the event into messagec and returns. The newly started goroutine then blocks until it can send to the channel. However, if the monitor is never started and winMon.Receive is never called, the goroutines remain indefinitely blocked, leading to goroutine leaks and significant memory consumption in the tailscaled service process on Windows. Unlike the tailscaled subprocess, the service process creates but never starts a Monitor. This PR adds a check within the callbacks to confirm the monitor's active status, and exits immediately if the monitor hasn't started. Updates #9864 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Andrew Lytvynov	1302bd1181	all: cleanup unused code, part 1 (#10661 ) Run `staticcheck` with `U1000` to find unused code. This cleans up about a half of it. I'll do the other half separately to keep PRs manageable. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Andrew Dunham	3c333f6341	net/portmapper: add logs about obtained mapping(s) This logs additional information about what mapping(s) are obtained during the creation process, including whether we return an existing cached mapping. Updates #10597 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I9ff25071f064c91691db9ab0b9365ccc5f948d6e	5 months ago
Andrew Dunham	01286af82b	net/interfaces: better handle multiple interfaces in LikelyHomeRouterIP Currently, we get the "likely home router" gateway IP and then iterate through all IPs for all interfaces trying to match IPs to determine the source IP. However, on many platforms we know what interface the gateway is through, and thus we don't need to iterate through all interfaces checking IPs. Instead, use the IP address of the associated interface. This better handles the case where we have multiple interfaces on a system all connected to the same gateway, and where the first interface that we visit (as iterated by ForeachInterfaceAddress) isn't also the default internet route. Updates #8992 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8632f577f1136930f4ec60c76376527a19a47d1f	5 months ago
Andrew Dunham	09136e5995	net/netutil: add function to check rp_filter value (#5703 ) Updates #4432 Change-Id: Ifc332a5747fc1feffdbb87437308cf8ecb21b0b0 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	5 months ago
Andrew Dunham	d05a572db4	net/portmapper: handle multiple UPnP discovery responses Instead of taking the first UPnP response we receive and using that to create port mappings, store all received UPnP responses, sort and deduplicate them, and then try all of them to obtain an external address. Updates #10602 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I783ccb1834834ee2a9ecbae2b16d801f2354302f	5 months ago
Andrew Dunham	727acf96a6	net/netcheck: use DERP frames as a signal for home region liveness This uses the fact that we've received a frame from a given DERP region within a certain time as a signal that the region is stil present (and thus can still be a node's PreferredDERP / home region) even if we don't get a STUN response from that region during a netcheck. This should help avoid DERP flaps that occur due to losing STUN probes while still having a valid and active TCP connection to the DERP server. RELNOTE=Reduce home DERP flapping when there's still an active connection Updates #8603 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If7da6312581e1d434d5c0811697319c621e187a0	5 months ago
Andrew Dunham	bac4890467	net/portmapper: be smarter about selecting a UPnP device Previously, we would select the first WANIPConnection2 (and related) client from the root device, without any additional checks. However, some routers expose multiple UPnP devices in various states, and simply picking the first available one can result in attempting to perform a portmap with a device that isn't functional. Instead, mimic what the miniupnpc code does, and prefer devices that are (a) reporting as Connected, and (b) have a valid external IP address. For our use-case, we additionally prefer devices that have an external IP address that's a public address, to increase the likelihood that we can obtain a direct connection from peers. Finally, we split out fetching the root device (getUPnPRootDevice) from selecting the best service within that root device (selectBestService), and add some extensive tests for various UPnP server behaviours. RELNOTE=Improve UPnP portmapping when multiple UPnP services exist Updates #8364 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I71795cd80be6214dfcef0fe83115a5e3fe4b8753	5 months ago
Andrea Barisani	affe11c503	net/netcheck: only run HTTP netcheck for tamago clients Signed-off-by: Andrea Barisani <andrea@inversepath.com>	5 months ago
Denton Gentry	137e9f4c46	net/portmap: add test of Mikrotik Root Desc XML. Unfortunately in the test we can't reproduce the failure seen in the real system ("SOAP fault: UPnPError") Updates https://github.com/tailscale/tailscale/issues/8364 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	6 months ago
Andrew Dunham	c4ccdd1bd1	net/interfaces: ensure we return valid 'self' IP in LikelyHomeRouterIP Before this fix, LikelyHomeRouterIP could return a 'self' IP that doesn't correspond to the gateway address, since it picks the first private address when iterating over the set interfaces as the 'self' IP, without checking that the address corresponds with the previously-detected gateway. This behaviour was introduced by accident in `aaf2df7`, where we deleted the following code: for _, prefix := range privatev4s { if prefix.Contains(gateway) && prefix.Contains(ip) { myIP = ip ok = true return } } Other than checking that 'gateway' and 'ip' were private IP addresses (which were correctly replaced with a call to the netip.Addr.IsPrivate method), it also implicitly checked that both 'gateway' and 'ip' were a part of the same prefix, and thus likely to be the same interface. Restore that behaviour by explicitly checking pfx.Contains(gateway), which, given that the 'ip' variable is derived from our prefix 'pfx', ensures that the 'self' IP will correspond to the returned 'gateway'. Fixes #10466 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Iddd2ee70cefb9fb40071986fefeace9ca2441ee6	6 months ago
Aaron Klotz	64a26b221b	net/dns: use an additional registry setting to disable dynamic DNS updates for our interface on Windows Fixes #9775 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	6 months ago
Juergen Knaack	c27aa9e7ff	net/dns: fix darwin dns resolver files putting each nameserver on one line in /etc/resolver/<domain> fixes: #10134 Signed-off-by: Juergen Knaack <jk@jk-1.de>	6 months ago
Ryan Petris	c4855fe0ea	Fix Empty Resolver Set Config.singleResolverSet returns true if all routes have the same resolvers, even if the routes have no resolvers. If none of the routes have a specific resolver, the default should be used instead. Therefore, check for more than 0 instead of nil. Signed-off-by: Ryan Petris <ryan@petris.net>	6 months ago
Andrew Dunham	e33bc64cff	net/dnsfallback: add singleflight to recursive resolver This prevents running more than one recursive resolution for the same hostname in parallel, which can use excessive amounts of CPU when called in a tight loop. Additionally, add tests that hit the network (when run with a flag) to test the lookup behaviour. Updates tailscale/corp#15261 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I39351e1d2a8782dd4c52cb04b3bd982eb651c81e	6 months ago
Jordan Whited	12d5c99b04	client/tailscale,ipn/{ipnlocal,localapi}: check UDP GRO config (#10071 ) Updates tailscale/corp#9990 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
James Tucker	b48b7d82d0	appc,ipn/ipnlocal,net/dns/resolver: add App Connector wiring when enabled in prefs An EmbeddedAppConnector is added that when configured observes DNS responses from the PeerAPI. If a response is found matching a configured domain, routes are advertised when necessary. The wiring from a configuration in the netmap capmap is not yet done, so while the connector can be enabled, no domains can yet be added. Updates tailscale/corp#15437 Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
James Tucker	09fcbae900	net/dnscache: remove completed TODO The other IP types don't appear to be imported anymore, and after a scan through I couldn't see any substantial usage of other representations, so I think this TODO is complete. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
Andrew Dunham	57c5b5a77e	net/dns/recursive: update IP for b.root-servers.net As of 2023-11-27, the official IP addresses for b.root-servers.net will change to a new set, with the older IP addresses supported for at least a year after that date. These IPs are already active and returning results, so update these in our recursive DNS resolver package so as to be ready for the switchover. See: https://b.root-servers.org/news/2023/05/16/new-addresses.html Fixes #9994 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I29e2fe9f019163c9ec0e62bdb286e124aa90a487	7 months ago
Andrew Dunham	ef596aed9b	net/portmapper: avoid alloc in getUPnPErrorsMetric Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Iea558024c038face24cc46584421998d10f13a66	7 months ago
Val	19e5f242e0	net/portmapper: convert UPnP metrics to new syncs.Map.LoadOrInit method Simplify UPnP error metrics by using the new syncs.Map.LoadOrInit method. Updates #cleanup Signed-off-by: Val <valerie@tailscale.com>	7 months ago
Brad Fitzpatrick	95faefd1f6	net/dnsfallback: disable recursive resolver for now It seems to be implicated in a CPU consumption bug that's not yet understood. Disable it until we understand. Updates tailscale/corp#15261 Change-Id: Ia6d0c310da6464dda79a70fc3c18be0782812d3f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Denton Gentry	97ee3891f1	net/dns: use direct when NetworkManager has no systemd-resolved Endeavour OS, at least, uses NetworkManager 1.44.2 and does not use systemd-resolved behind the scenes at all. If we find ourselves in that situation, return "direct" not "systemd-resolved" Fixes https://github.com/tailscale/tailscale/issues/9687 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	7 months ago
Maisem Ali	5297bd2cff	cmd/tailscaled,net/tstun: fix data race on start-up in TUN mode Fixes #7894 Change-Id: Ice3f8019405714dd69d02bc07694f3872bb598b8 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	7 months ago
Maisem Ali	9d96e05267	net/packet: split off checksum munging into different pkg The current structure meant that we were embedding netstack in the tailscale CLI and in the GUIs. This removes that by isolating the checksum munging to a different pkg which is only called from `net/tstun`. Fixes #9756 Signed-off-by: Maisem Ali <maisem@tailscale.com>	7 months ago
Galen Guyer	04a8b8bb8e	net/dns: properly detect newer debian resolvconf Tailscale attempts to determine if resolvconf or openresolv is in use by running `resolvconf --version`, under the assumption this command will error when run with Debian's resolvconf. This assumption is no longer true and leads to the wrong commands being run on newer versions of Debian with resolvconf >= 1.90. We can now check if the returned version string starts with "Debian resolvconf" if the command is successful. Fixes #9218 Signed-off-by: Galen Guyer <galen@galenguyer.com>	7 months ago
Maisem Ali	78a083e144	types/ipproto: drop IPProto from IPProtoVersion Based on https://github.com/golang/go/wiki/CodeReviewComments#package-names. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	7 months ago
Val	893bdd729c	disco,net/tstun,wgengine/magicsock: probe peer MTU Automatically probe the path MTU to a peer when peer MTU is enabled, but do not use the MTU information for anything yet. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	7 months ago
Brad Fitzpatrick	7868393200	net/dns/resolver, ipnlocal: fix ExitDNS on Android and iOS Advertise it on Android (it looks like it already works once advertised). And both advertise & likely fix it on iOS. Yet untested. Updates #9672 Change-Id: If3b7e97f011dea61e7e75aff23dcc178b6cf9123 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Tom DNetto	da1b917575	net/tstun: finish wiring IPv6 NAT support Updates https://github.com/tailscale/corp/issues/11202 Updates ENG-991 Signed-off-by: Tom DNetto <tom@tailscale.com>	8 months ago
Andrew Dunham	91b9899402	net/dns/resolver: fix flaky test Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I2d073220bb6ac78ba88d8be35085cc23b727d69f	8 months ago
Andrew Dunham	286c6ce27c	net/dns/resolver: race UDP and TCP queries (#9544 ) Instead of just falling back to making a TCP query to an upstream DNS server when the UDP query returns a truncated query, also start a TCP query in parallel with the UDP query after a given race timeout. This ensures that if the upstream DNS server does not reply over UDP (or if the response packet is blocked, or there's an error), we can still make queries if the server replies to TCP queries. This also adds a new package, util/race, to contain the logic required for racing two different functions and returning the first non-error answer. Updates tailscale/corp#14809 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I4311702016c1093b1beaa31b135da1def6d86316	8 months ago
Tom DNetto	656a77ab4e	net/packet: implement methods for rewriting v6 addresses Implements the ability for the address-rewriting code to support rewriting IPv6 addresses. Specifically, UpdateSrcAddr & UpdateDstAddr. Signed-off-by: Tom DNetto <tom@tailscale.com> Updates https://github.com/tailscale/corp/issues/11202	8 months ago
Val	c26d91d6bd	net/tstun: remove unused function DefaultMTU() Now that corp is updated, remove the shim code to bridge the rename from DefaultMTU() to DefaultTUNMTU. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	8 months ago
James Tucker	e03f0d5f5c	net/dnsfallback: remove net/dnsfallback go:generate line We should be able to freely run `./tool/go generate ./...`, but we're continually dodging this particular generator. Instead of constantly dodging it, let's just remove it. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
James Tucker	84acf83019	go.mod,net/dnsfallback: bump go4.org/netipx Updates #8043 Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
Andrea Barisani	b5b4298325	go.mod,*: bump gvisor Updates #9253 Signed-off-by: Andrea Barisani <andrea@inversepath.com> Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
Andrew Dunham	d31460f793	net/portmapper: fix invalid UPnP metric name Fixes #9551 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I06f3a15a668be621675be6cbc7e5bdcc006e8570	8 months ago
Val	c608660d12	wgengine,net,ipn,disco: split up and define different types of MTU Prepare for path MTU discovery by splitting up the concept of DefaultMTU() into the concepts of the Tailscale TUN MTU, MTUs of underlying network interfaces, minimum "safe" TUN MTU, user configured TUN MTU, probed path MTU to a peer, and maximum probed MTU. Add a set of likely MTUs to probe. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	8 months ago
Andrew Dunham	530aaa52f1	net/dns: retry forwarder requests over TCP We weren't correctly retrying truncated requests to an upstream DNS server with TCP. Instead, we'd return a truncated request to the user, even if the user was querying us over TCP and thus able to handle a large response. Also, add an envknob and controlknob to allow users/us to disable this behaviour if it turns out to be buggy (✨ DNS ✨). Updates #9264 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ifb04b563839a9614c0ba03e9c564e8924c1a2bfd	8 months ago
Brad Fitzpatrick	241c983920	net/tstun: use untyped consts, simplify DefaultMTU func Updates #cleanup Change-Id: Ic9ad1d6134818699f777c66a31024e846dfdc5d4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	3b32d6c679	wgengine/magicsock, controlclient, net/dns: reduce some logspam Updates #cleanup Change-Id: I78b0697a01e94baa33f3de474b591e616fa5e6af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Val	6cc5b272d8	Revert "wgengine,net,ipn,disco: split up and define different types of MTU" This reverts commit `059051c58a`. Signed-off-by: Val <valerie@tailscale.com>	8 months ago
Val	059051c58a	wgengine,net,ipn,disco: split up and define different types of MTU Prepare for path MTU discovery by splitting up the concept of DefaultMTU() into the concepts of the Tailscale TUN MTU, MTUs of underlying network interfaces, minimum "safe" TUN MTU, user configured TUN MTU, probed path MTU to a peer, and maximum probed MTU. Add a set of likely MTUs to probe. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	8 months ago
James Tucker	1c88a77f68	net/dns/publicdns: update Quad9 addresses and references One Quad9 IPv6 address was incorrect, and an additional group needed adding. Additionally I checked Cloudflare and included source reference URLs for both. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
Maisem Ali	3056a98bbd	net/tstun: add better logging of natV4Config It might as well have been spewing out gibberish. This adds a nicer output format for us to be able to read and identify whats going on. Sample output ``` natV4Config{nativeAddr: 100.83.114.95, listenAddrs: [10.32.80.33], dstMasqAddrs: [10.32.80.33: 407 peers]} ``` Fixes tailscale/corp#14650 Signed-off-by: Maisem Ali <maisem@tailscale.com>	8 months ago
Tom DNetto	c08cf2a9c6	all: declare & plumb IPv6 masquerade address for peer This PR plumbs through awareness of an IPv6 SNAT/masquerade address from the wire protocol through to the low-level (tstun / wgengine). This PR is the first in two PRs for implementing IPv6 NAT support to/from peers. A subsequent PR will implement the data-plane changes to implement IPv6 NAT - this is just plumbing. Signed-off-by: Tom DNetto <tom@tailscale.com> Updates ENG-991	8 months ago
Andrew Dunham	d9ae7d670e	net/portmapper: add clientmetric for UPnP error codes This should allow us to gather a bit more information about errors that we encounter when creating UPnP mappings. Since we don't have a "LabelMap" construction for clientmetrics, do what sockstats does and lazily register a new metric when we see a new code. Updates #9343 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ibb5aadd6138beb58721f98123debcc7273b611ba	8 months ago
Brad Fitzpatrick	0d991249e1	types/netmap: remove NetworkMap.{Addresses,MachineStatus} And convert all callers over to the methods that check SelfNode. Now we don't have multiple ways to express things in tests (setting fields on SelfNode vs NetworkMap, sometimes inconsistently) and don't have multiple ways to check those two fields (often only checking one or the other). Updates #9443 Change-Id: I2d7ba1cf6556142d219fae2be6f484f528756e3c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	926c990a09	types/netmap: start phasing out Addresses, add GetAddresses method NetworkMap.Addresses is redundant with the SelfNode.Addresses. This works towards a TODO to delete NetworkMap.Addresses and replace it with a method. This is similar to #9389. Updates #cleanup Change-Id: Id000509ca5d16bb636401763d41bdb5f38513ba0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
James Tucker	8ab46952d4	net/ping: fix ICMP echo code field to 0 The code was trying to pass the ICMP protocol number here (1), which is not a valid code. Many servers will not respond to echo messages with codes other than 0. https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml#icmp-parameters-codes-8 Updates #9299 Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
James Tucker	4c693d2ee8	net/dns/publicdns: update Mullvad DoH server list The following IPs are not used anymore: 193.19.108.2 and 193.19.108.3. All of the servers are now named consistently under dns.mullvad.net. Several new servers were added. https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ Updates #5416 Updates #9345 Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
Andrew Dunham	ad4c11aca1	net/netmon: log when the gateway/self IP changes This logs that the gateway/self IP address has changed if one of the new values differs. Updates #8992 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I0919424b68ad97fbe1204dd36317ed6f5915411f	8 months ago
Andrew Dunham	9ee173c256	net/portmapper: fall back to permanent UPnP leases if necessary Some routers don't support lease times for UPnP portmapping; let's fall back to adding a permanent lease in these cases. Additionally, add a proper end-to-end test case for the UPnP portmapping behaviour. Updates #9343 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I17dec600b0595a5bfc9b4d530aff6ee3109a8b12	8 months ago
Brad Fitzpatrick	4e91cf20a8	control/controlknobs, all: add plumbed Knobs type, not global variables Previously two tsnet nodes in the same process couldn't have disjoint sets of controlknob settings from control as both would overwrite each other's global variables. This plumbs a new controlknobs.Knobs type around everywhere and hangs the knobs sent by control on that instead. Updates #9351 Change-Id: I75338646d36813ed971b4ffad6f9a8b41ec91560 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	dc7aa98b76	all: use set.Set consistently instead of map[T]struct{} I didn't clean up the more idiomatic map[T]bool with true values, at least yet. I just converted the relatively awkward struct{}-valued maps. Updates #cleanup Change-Id: I758abebd2bb1f64bc7a9d0f25c32298f4679c14f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Andrew Dunham	d413dd7ee5	net/dns/publicdns: add support for Wikimedia DNS RELNOTE=Adds support for Wikimedia DNS Updates #9255 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I4213c29e0f91ea5aa0304a5a026c32b6690fead9	9 months ago
Brad Fitzpatrick	1262df0578	net/netmon, net/tsdial: add some link change metrics Updates #9040 Change-Id: I2c87572d79d2118bcf1f0122eccfe712c1bea9d5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	8b3ea13af0	net/tsdial: be smarter about when to close SystemDial conns It was too aggressive before, as it only had the ill-defined "Major" bool to work with. Now it can check more precisely. Updates #9040 Change-Id: I20967283b64af6a9cad3f8e90cff406de91653b8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Andrea Barisani	0a74d46568	adjust build tags for tamago Signed-off-by: Andrea Barisani <andrea@inversepath.com>	9 months ago
David Anderson	8b492b4121	net/wsconn: accept a remote addr string and plumb it through This makes wsconn.Conns somewhat present reasonably when they are the client of an http.Request, rather than just put a placeholder in that field. Updates tailscale/corp#13777 Signed-off-by: David Anderson <danderson@tailscale.com>	9 months ago
Brad Fitzpatrick	11ece02f52	net/{interfaces,netmon}: remove "interesting", EqualFiltered API This removes a lot of API from net/interfaces (including all the filter types, EqualFiltered, active Tailscale interface func, etc) and moves the "major" change detection to net/netmon which knows more about the world and the previous/new states. Updates #9040 Change-Id: I7fe66a23039c6347ae5458745b709e7ebdcce245 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Joe Tsai	fcbb2bf348	net/memnet: export the network name (#9111 ) This makes it more maintainable for other code to statically depend on the exact value of this string. It also makes it easier to identify what code might depend on this string by looking up references to this constant. Updates tailscale/corp#13777 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	9 months ago
Andrew Dunham	c86a610eb3	cmd/tailscale, net/portmapper: add --log-http option to "debug portmap" This option allows logging the raw HTTP requests and responses that the portmapper Client makes when using UPnP. This can be extremely helpful when debugging strange UPnP issues with users' devices, and might allow us to avoid having to instruct users to perform a packet capture. Updates #8992 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I2c3cf6930b09717028deaff31738484cc9b008e4	9 months ago
Brad Fitzpatrick	98a5116434	all: adjust some build tags for plan9 I'm not saying it works, but it compiles. Updates #5794 Change-Id: I2f3c99732e67fe57a05edb25b758d083417f083e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	d58ba59fd5	cmd/tailscale/cli: make netcheck run even if machine lacks TLS certs We have a fancy package for doing TLS cert validation even if the machine doesn't have TLS certs (for LetsEncrypt only) but the CLI's netcheck command wasn't using it. Also, update the tlsdial's outdated package docs while here. Updates #cleanup Change-Id: I74b3cb645d07af4d8ae230fb39a60c809ec129ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	e881c1caec	net/netmon: factor out debounce loop, simplify polling impl This simplifies some netmon code in prep for other changes. It breaks up Monitor.debounce into a helper method so locking is easier to read and things unindent, and then it simplifies the polling netmon implementation to remove the redundant stuff that the caller (the Monitor.debounce loop) was already basically doing. Updates #9040 Change-Id: Idcfb45201d00ae64017042a7bdee6ef86ad37a9f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	9089efea06	net/netmon: make ChangeFunc's signature take new ChangeDelta, not bool Updates #9040 Change-Id: Ia43752064a1a6ecefc8802b58d6eaa0b71cf1f84 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Andrew Dunham	77ff705545	net/portmapper: never select port 0 in UPnP Port 0 is interpreted, per the spec (but inconsistently among router software) as requesting to map every single available port on the UPnP gateway to the internal IP address. We'd previously avoided picking ports below 1024 for one of the two UPnP methods (in #7457), and this change moves that logic so that we avoid it in all cases. Updates #8992 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I20d652c0cd47a24aef27f75c81f78ae53cc3c71e	9 months ago
Brad Fitzpatrick	58a4fd43d8	types/netmap, all: use read-only tailcfg.NodeView in NetworkMap Updates #8948 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	6e57dee7eb	cmd/viewer, types/views, all: un-special case slice of netip.Prefix Make it just a views.Slice[netip.Prefix] instead of its own named type. Having the special case led to circular dependencies in another WIP PR of mine. Updates #8948 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
David Anderson	e92adfe5e4	net/art: allow non-pointers as values Values are still turned into pointers internally to maintain the invariants of strideTable, but from the user's perspective it's now possible to tbl.Insert(pfx, true) rather than tbl.Insert(pfx, ptr.To(true)). Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>	9 months ago
Brad Fitzpatrick	e8551d6b40	all: use Go 1.21 slices, maps instead of x/exp/{slices,maps} Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
David Anderson	623d72c83b	net/art: move child table pointers out of strideEntry In preparation for a different refactor, but incidentally also saves 10-25% memory on overall table size in benchmarks. Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>	9 months ago
James Tucker	de8e55fda6	net/netcheck,wgengine/magicsock: reduce coupling between netcheck and magicsock Netcheck no longer performs I/O itself, instead it makes requests via SendPacket and expects users to route reply traffic to ReceiveSTUNPacket. Netcheck gains a Standalone function that stands up sockets and goroutines to implement I/O when used in a standalone fashion. Magicsock now unconditionally routes STUN traffic to the netcheck.Client that it hosts, and plumbs the send packet sink. The CLI is updated to make use of the Standalone mode. Fixes #8723 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Maisem Ali	98ec8924c2	ipn/ipnlocal,net/tsdial: update docs/rename funcs Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
Will Norris	69f1324c9e	cmd/tailscale: refactor shared utility methods Refactor two shared functions used by the tailscale cli, calcAdvertiseRoutes and licensesURL. These are used by the web client as well as other tailscale subcommands. The web client is being moved out of the cli package, so move these two functions to new locations. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	9 months ago
Brad Fitzpatrick	be4eb6a39e	derp, net/dns/recursive: use Go 1.21 min Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	66e46bf501	ipnlocal, net/*: deprecate interfaces.GetState, use netmon more for it Updates #cleanup Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago

1 2 3 4 5 ...

1012 Commits (main)