436 Commits (0088c5ddc094116fb5788e57cf849e49c84297f8)

Author	SHA1	Message	Date
Andrew Dunham	b1867457a6	doctor: add package for running in-depth healthchecks; use in bugreport (#5413) ... Change-Id: Iaa4e5b021a545447f319cfe8b3da2bd3e5e5782b Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Brad Fitzpatrick	2c447de6cc	cmd/tailscaled: use explicit equal sign in --port=$PORT in tailscaled.service ... Personal preference (so it's obvious it's not a bool flag), but it also matches the --state= before it. Bonus: stop allowing PORT to sneak in extra flags to be passed as their own arguments, as $FOO and ${FOO} expand differently. (${FOO} is required to concat to strings) Change-Id: I994626a5663fe0948116b46a971e5eb2c4023216 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	41bb47de0e	cmd/tailscaled: respect $PORT on all platforms, not just Linux ... Updates #5114 Change-Id: I6c6e28c493d6a026a03088157d08f9fd182ef373 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3562b5bdfa	envknob, health: support Synology, show parse errors in status ... Updates #5114 Change-Id: I8ac7a22a511f5a7d0dcb8cac470d4a403aa8c817 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	65c24b6334	envknob: generalize Windows tailscaled-env.txt support ... ipnserver previously had support for a Windows-only environment variable mechanism that further only worked when Windows was running as a service, not from a console. But we want it to work from tailscaed too, and we want it to work on macOS and Synology. So move it to envknob, now that envknob can change values at runtime post-init. A future change will wire this up for more platforms, and do something more for CLI flags like --port, which the bug was originally about. Updates #5114 Change-Id: I9fd69a9a91bb0f308fc264d4a6c33e0cbe352d71 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Eng Zer Jun	f0347e841f	refactor: move from io/ioutil to io and os packages ... The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	2 years ago
Brad Fitzpatrick	74674b110d	envknob: support changing envknobs post-init ... Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	45a3de14a6	cmd/tailscaled, tailcfg, hostinfo: add flag to disable logging + support ... As noted in #5617, our documented method of blocking log.tailscale.io DNS no longer works due to bootstrap DNS. Instead, provide an explicit flag (--no-logs-no-support) and/or env variable (TS_NO_LOGS_NO_SUPPORT=true) to explicitly disable logcatcher uploads. It also sets a bit on Hostinfo to say that the node is in that mode so we can end any support tickets from such nodes more quickly. This does not yet provide an easy mechanism for users on some platforms (such as Windows, macOS, Synology) to set flags/env. On Linux you'd used /etc/default/tailscaled typically. Making it easier to set flags for other platforms is tracked in #5114. Fixes #5617 Fixes tailscale/corp#1475 Change-Id: I72404e1789f9e56ec47f9b7021b44c025f7a373a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	58abae1f83	net/dns/{publicdns,resolver}: add NextDNS DoH support ... NextDNS is unique in that users create accounts and then get user-specific DNS IPs & DoH URLs. For DoH, the customer ID is in the URL path. For IPv6, the IP address includes the customer ID in the lower bits. For IPv4, there's a fragile "IP linking" mechanism to associate your public IPv4 with an assigned NextDNS IPv4 and that tuple maps to your customer ID. We don't use the IP linking mechanism. Instead, NextDNS is DoH-only. Which means using NextDNS necessarily shunts all DNS traffic through 100.100.100.100 (programming the OS to use 100.100.100.100 as the global resolver) because operating systems can't usually do DoH themselves. Once it's in Tailscale's DoH client, we then connect out to the known NextDNS IPv4/IPv6 anycast addresses. If the control plane sends the client a NextDNS IPv6 address, we then map it to the corresponding NextDNS DoH with the same client ID, and we dial that DoH server using the combination of v4/v6 anycast IPs. Updates #2452 Change-Id: I3439d798d21d5fc9df5a2701839910f5bef85463 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	c72caa6672	wgengine/magicsock: use AF_PACKET socket + BPF to read disco messages ... This is entirely optional (i.e. failing in this code is non-fatal) and only enabled on Linux for now. Additionally, this new behaviour can be disabled by setting the TS_DEBUG_DISABLE_AF_PACKET environment variable. Updates #3824 Replaces #5474 Co-authored-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
James Tucker	ad1cc6cff9	wgengine: use Go API rather than UAPI for status ... Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Brad Fitzpatrick	c66f99fcdc	tailcfg, control/controlclient, ipn/ipnlocal: add c2n (control-to-node) system ... This lets the control plane can make HTTP requests to nodes. Then we can use this for future things rather than slapping more stuff into MapResponse, etc. Change-Id: Ic802078c50d33653ae1f79d1e5257e7ade4408fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	9197dd14cc	net/dns: [win] add MagicDNS entries to etc/hosts ... This works around the 2.3s delay in short name lookups when SNR is enabled. C:\Windows\System32\drivers\etc\hosts file. We only add known hosts that match the search domains, and we populate the list in order of Search Domains so that our matching algorithm mimics what Windows would otherwise do itself if SNR was off. Updates #1659 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Joe Tsai	03f7e4e577	util/hashx: move from sha256x (#5388)	2 years ago
Brad Fitzpatrick	766ea96adf	cmd/tailscaled: enable hybrid netstack mode on openbsd too ... Apparently OpenBSD can forward packets with manual configuration, https://github.com/tailscale/tailscale/issues/2498#issuecomment-1114216999 But this makes it work by default. People doing things by hand can set TS_DEBUG_WRAP_NETSTACK=0 in the environment. Change-Id: Iee5f32252f83af2baa0ebbe3f20ce9fec5f29e96 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	1f7479466e	util/deephash: use sha256x (#5339) ... Switch deephash to use sha256x.Hash. We add sha256x.HashString to efficiently hash a string. It uses unsafe under the hood to convert a string to a []byte. We also modify sha256x.Hash to export the underlying hash.Hash for testing purposes so that we can intercept all hash.Hash calls. Performance: name old time/op new time/op delta Hash-24 19.8µs ± 1% 19.2µs ± 1% -3.01% (p=0.000 n=10+10) HashPacketFilter-24 2.61µs ± 0% 2.53µs ± 1% -3.01% (p=0.000 n=8+10) HashMapAcyclic-24 31.3µs ± 1% 29.8µs ± 0% -4.80% (p=0.000 n=10+9) TailcfgNode-24 1.83µs ± 1% 1.82µs ± 2% ~ (p=0.305 n=10+10) HashArray-24 344ns ± 2% 323ns ± 1% -6.02% (p=0.000 n=9+10) The performance gains is not as dramatic as sha256x over sha256 due to: 1. most of the hashing already occurring through the direct memory hashing logic, and 2. what does not go through direct memory hashing is slowed down by reflect. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	ec9d13bce5	hostinfo, net/netcheck: use CutPrefix ... Updates #5309 Change-Id: I37e594cfd245784bf810c493de68a66d3ff20677 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	f0d6f173c9	net/netcheck: try ICMP if UDP is blocked (#5056) ... Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Tom DNetto	f50043f6cb	tka,types/key: remove dependency for tailcfg & types/ packages on tka ... Following the pattern elsewhere, we create a new tka-specific types package for the types that need to couple between the serialized structure types, and tka. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	4950fe60bd	syncs, all: move to using Go's new atomic types instead of ours ... Fixes #5185 Change-Id: I850dd532559af78c3895e2924f8237ccc328449d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	4001d0bf25	assorted: plumb tka initialization & network-lock key into tailscaled ... - A network-lock key is generated if it doesn't already exist, and stored in the StateStore. The public component is communicated to control during registration. - If TKA state exists on the filesystem, a tailnet key authority is initialized (but nothing is done with it for now). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	8725b14056	all: migrate more code code to net/netip directly ... Instead of going through the tailscale.com/net/netaddr transitional wrappers. Updates #5162 Change-Id: I3dafd1c2effa1a6caa9b7151ecf6edd1a3fda3dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	eb32847d85	tailcfg: add CapabilityFileSharingTarget to identify FileTargets ... This adds the inverse to CapabilityFileSharingSend so that senders can identify who they can Taildrop to. Updates #2101 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	e1309e1323	all: require Go 1.19 ... Updates #5210 Change-Id: I2e950b4776636b4ea89b6566b60e4a87596a3a43 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	47f91dd732	cmd/tailscale{,d}: update depaware ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	acc3b7f259	go.mod: bump inet.af/wf, tidy ... This removes inet.af/netaddr from go.{mod,sum}. Updates #5162 Change-Id: I7121e9fbb96d036cf188c51f0b53731570252d69 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	0a6aa75a2d	cmd/tailscaled: add opt-in support for linking CLI into daemon ... Doesn't help much, though. $ go install --tags=ts_include_cli ./cmd/tailscaled/ $ ls -lh ~/go/bin/tailscaled -rwxr-xr-x 2 bradfitz bradfitz 34M Jul 27 11:00 /home/bradfitz/go/bin/tailscaled $ go install --tags= ./cmd/tailscaled/ $ ls -lh ~/go/bin/tailscaled -rwxr-xr-x 1 bradfitz bradfitz 23M Jul 27 11:00 /home/bradfitz/go/bin/tailscaled $ ls -lh ~/go/bin/tailscale -rwxr-xr-x 1 bradfitz bradfitz 13M Jul 25 21:30 /home/bradfitz/go/bin/tailscale Fixes #2233 Change-Id: I46bae91bb38eb47a76251c1b5c1e9e455fc234b6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a12aad6b47	all: convert more code to use net/netip directly ... perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6a396731eb	all: use various net/netip parse funcs directly ... Mechanical change with perl+goimports. Changed {Must,}Parse{IP,IPPrefix,IPPort} to their netip variants, then goimports -d . Finally, removed the net/netaddr wrappers, to prevent future use. Updates #5162 Change-Id: I59c0e38b5fbca5a935d701645789cddf3d7863ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7eaf5e509f	net/netaddr: start migrating to net/netip via new netaddr adapter package ... Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	9514ed33d2	go.mod: bump gvisor.dev/gvisor ... Pick up https://github.com/google/gvisor/pull/7787 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	4d0461f721	ipn/ipnlocal: logout ephemeral nodes on shutdown ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	0d52674a84	net/tstun: diagnose /dev/net/tun fd leak, give better failure message ... Updates #5029 Change-Id: Ibee5e0c9076fe764eb5d856d5ef8b09f4d0e2921 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	505ca2750d	cmd/tailscaled: fix Windows "Allow local LAN access" regression ... 3f686688a6 regressed the Windows beFirewallKillswitch code, preventing the /firewall subprocess from running. Fixes tailscale/corp#6063 Change-Id: Ibd105759e5fecfeffc54f587f8ddcd0f1cbc4dca Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6b71568eb7	util/cloudenv: add Azure support & DNS IPs ... And rewrite cloud detection to try to do only zero or one metadata discovery request for all clouds, only doing a first (or second) as confidence increases. Work remains for Windows, but a start. And add Cloud to tailcfg.Hostinfo, which helped with testing using "tailcfg debug hostinfo". Updates #4983 (Linux only) Updates #4984 Change-Id: Ib03337089122ce0cb38c34f724ba4b4812bc614e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	aa37aece9c	ipn/ipnlocal, net/dns*, util/cloudenv: add AWS DNS support ... And remove the GCP special-casing from ipn/ipnlocal; do it only in the forwarder for *.internal. Fixes #4980 Fixes #4981 Change-Id: I5c481e96d91f3d51d274a80fbd37c38f16dfa5cb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	88c2afd1e3	ipn/ipnlocal, net/dns*, util/cloudenv: specialize DNS config on Google Cloud ... This does three things: * If you're on GCP, it adds a *.internal DNS split route to the metadata server, so we never break GCP DNS names. This lets people have some Tailscale nodes on GCP and some not (e.g. laptops at home) without having to add a Tailnet-wide *.internal DNS route. If you already have such a route, though, it won't overwrite it. * If the 100.100.100.100 DNS forwarder has nowhere to forward to, it forwards it to the GCP metadata IP, which forwards to 8.8.8.8. This means there are never errNoUpstreams ("upstream nameservers not set") errors on GCP due to e.g. mangled /etc/resolv.conf (GCP default VMs don't have systemd-resolved, so it's likely a DNS supremacy fight) * makes the DNS fallback mechanism use the GCP metadata IP as a fallback before our hosted HTTP-based fallbacks I created a default GCP VM from their web wizard. It has no systemd-resolved. I then made its /etc/resolv.conf be empty and deleted its GCP hostnames in /etc/hosts. I then logged in to a tailnet with no global DNS settings. With this, tailscaled writes /etc/resolv.conf (direct mode, as no systemd-resolved) and sets it to 100.100.100.100, which then has regular DNS via the metadata IP and *.internal DNS via the metadata IP as well. If the tailnet configures explicit DNS servers, those are used instead, except for *.internal. This also adds a new util/cloudenv package based on version/distro where the cloud type is only detected once. We'll likely expand it in the future for other clouds, doing variants of this change for other popular cloud environments. Fixes #4911 RELNOTES=Google Cloud DNS improvements Change-Id: I19f3c2075983669b2b2c0f29a548da8de373c7cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	13d0b8e6a4	control/controlclient, net/dnscache: use typed singleflight fork ... Change-Id: I12be4c5a91ae3a812fe88d9b2d15526fdbb5a921 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	edc90ebc61	net/wsconn: remove homegrown wrapper for turning a websocket.Conn into a net.Conn ... The one from the nhooyr/websocket package seems to work equally well. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Brad Fitzpatrick	a9b4bf1535	ipn/ipnserver, cmd/tailscaled: fix peerapi on Windows ... We weren't wiring up netstack.Impl to the LocalBackend in some cases on Windows. This fixes Windows 7 when run as a service. Updates #4750 (fixes after pull in to corp repo) Change-Id: I9ce51b797710f2bedfa90545776b7628c7528e99 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Mihai Parparita	a9f32656f5	control/controlhttp: allow client and server to communicate over WebSockets ... We can't do Noise-over-HTTP in Wasm/JS (because we don't have bidirectional communication), but we should be able to do it over WebSockets. Reuses derp WebSocket support that allows us to turn a WebSocket connection into a net.Conn. Updates #3157 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Maisem Ali	81487169f0	build_docker.sh: pin github.com/tailscale/mkctr ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Aaron Klotz	b005b79236	net/dns, paths, util/winutil: change net/dns/windowsManager NRPT management to support more than 50 domains. ... AFAICT this isn't documented on MSDN, but based on the issue referenced below, NRPT rules are not working when a rule specifies > 50 domains. This patch modifies our NRPT rule generator to split the list of domains into chunks as necessary, and write a separate rule for each chunk. For compatibility reasons, we continue to use the hard-coded rule ID, but as additional rules are required, we generate new GUIDs. Those GUIDs are stored under the Tailscale registry path so that we know which rules are ours. I made some changes to winutils to add additional helper functions in support of both the code and its test: I added additional registry accessors, and also moved some token accessors from paths to util/winutil. Fixes https://github.com/tailscale/coral/issues/63 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
James Tucker	3f686688a6	cmd/tailscaled: fix state path for windows svc ... Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Aaron Klotz	c163b2a3f1	util/winutil, util/winutil/vss: remove winrestore and vss as they are unnecessary. ... I wrote this code way back at the beginning of my tenure at Tailscale when we had concerns about needing to restore deleted machine keys from backups. We never ended up using this functionality, and the code is now getting in the way, so we might as well remove it. Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
James Tucker	4bb7440094	cmd/tailscaled: use --statedir as documented ... Enables the behavior described in the statepath flag, where if only statedir is passed, then state is statedir/tailscaled.state. Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Tom DNetto	9dee6adfab	cmd/tailscaled,ipn/ipnlocal,wgengine/...: pass dns.Manager into netstack ... Needed for a following commit which moves magicDNS handling into netstack. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Aaron Klotz	d915e0054c	cmd/tailscaled: change Windows service shutdown and add optional event logging ... Once a stop request is received and the service updates its status to `svc.StopPending`, it should continue running *until the shutdown sequence is complete*, and then return out of `(*ipnService).Execute`, which automatically sends a `svc.Stopped` notification to Windows. To make this happen, I changed the loop so that it runs until `doneCh` is closed, and then returns. I also removed a spurious `svc.StopPending` notification that the Windows Service Control Manager might be interpreting as a request for more time to shut down. Finally, I added some optional logging that sends a record of service notifications to the Windows event log, allowing us to more easily correlate with any Service Control Manager errors that are sent to the same log. Change-Id: I5b596122e5e89c4c655fe747a612a52cb4e8f1e0 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	6bed781259	all: gofmt all ... Well, goimports actually (which adds the normal import grouping order we do) Change-Id: I0ce1b1c03185f3741aad67c14a7ec91a838de389 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	5a1ef1bbb9	net/tsdial: add SystemDial as a wrapper on netns.Dial ... The connections returned from SystemDial are automatically closed when there is a major link change. Also plumb through the dialer to the noise client so that connections are auto-reset when moving from cellular to WiFi etc. Updates #3363 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	c88506caa6	ipn/ipnlocal: add Wake-on-LAN function to peerapi ... No CLI support yet. Just the curl'able version if you know the peerapi port. (like via a TSMP ping) Updates #306 Change-Id: I0662ba6530f7ab58d0ddb24e3664167fcd1c4bcf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3601b43530	ipn: add IPCVersion override func ... I've done this a handful of times in the past and again today. Time to make it a supported thing for the future. Used while debugging tailscale/corp#4559 (macsys CLI issues) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	910ae68e0b	util/mak: move tailssh's mapSet into a new package for reuse elsewhere ... Change-Id: Idfe95db82275fd2be6ca88f245830731a0d5aecf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	695f8a1d7e	ssh/tailssh: add support for sftp ... Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	53588f632d	Revert "wgengine/router,util/kmod: load & log xt_mark" ... This reverts commit 8d6793fd70. Reason: breaks Android build (cgo/pthreads addition) We can try again next cycle. Change-Id: I5e7e1730a8bf399a8acfce546a6d22e11fb835d5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	8d6793fd70	wgengine/router,util/kmod: load & log xt_mark ... Attempt to load the xt_mark kernel module when it is not present. If the load fails, log error information. It may be tempting to promote this failure to an error once it has been in use for some time, so as to avoid reaching an error with the iptables invocation, however, there are conditions under which the two stages may disagree - this change adds more useful breadcrumbs. Example new output from tailscaled running under my WSL2: ``` router: ensure module xt_mark: "/usr/sbin/modprobe xt_mark" failed: exit status 1; modprobe: FATAL: Module xt_mark not found in directory /lib/modules/5.10.43.3-microsoft-standard-WSL2 ``` Background: There are two places to lookup modules, one is `/proc/modules` "old", the other is `/sys/module/` "new". There was query_modules(2) in linux <2.6, alas, it is gone. In a docker container in the default configuration, you would get /proc/modules and /sys/module/ both populated. lsmod may work file, modprobe will fail with EPERM at `finit_module()` for an unpriviliged container. In a priviliged container the load may *succeed*, if some conditions are met. This condition should be avoided, but the code landing in this change does not attempt to avoid this scenario as it is both difficult to detect, and has a very uncertain impact. In an nspawn container `/proc/modules` is populated, but `/sys/module` does not exist. Modern `lsmod` versions will fail to gather most module information, without sysfs being populated with module information. In WSL2 modules are likely missing, as the in-use kernel typically is not provided by the distribution filesystem, and WSL does not mount in a module filesystem of its own. Notably the WSL2 kernel supports iptables marks without listing the xt_mark module in /sys/module, and /proc/modules is empty. On a recent kernel, we can ask the capabilities system about SYS_MODULE, that will help to disambiguate between the non-privileged container case and just being root. On older kernels these calls may fail. Update #4329 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	8ee044ea4a	ssh/tailssh: make the SSH server a singleton, register with LocalBackend ... Remove the weird netstack -> tailssh dependency and instead have tailssh register itself with ipnlocal when linked. This makes tailssh.server a singleton, so we can have a global map of all sessions. Updates #3802 Change-Id: Iad5caec3a26a33011796878ab66b8e7b49339f29 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
phirework	83c734a6e0	net/dns, util/publicdns: extract public DNS mapping into own package (#4405) ... This extracts DOH mapping of known public DNS providers in forwarder.go into its own package, to be consumed by other repos Signed-off-by: Jenny Zhang <jz@tailscale.com>	3 years ago
James Tucker	8de7f9bff7	tailscaled: no longer tune gcpercent ... Usage of userspace-networking is increasing, and the aggressive GC tuning causes a significant reduction in performance in that mode. Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
James Tucker	2550acfd9d	go.mod: bump netstack for clone reset fix (#4379) ... In tracking down issue #4144 and reading through the netstack code in detail, I discovered that the packet buf Clone path did not reset the packetbuf it was getting from the sync.Pool. The fix was sent upstream https://github.com/google/gvisor/pull/7385, and this bump pulls that in. At this time there is no known path that this fixes, however at the time of upstream submission this reset at least one field that could lead to incorrect packet routing if exercised, a situation that could therefore lead to an information leak. Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
James Tucker	c6ac29bcc4	wgengine/netstack: disable refsvfs2 leak tracking (#4378) ... In addition an envknob (TS_DEBUG_NETSTACK_LEAK_MODE) now provides access to set leak tracking to more useful values. Fixes #4309 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	5a44f9f5b5	tempfork: temporarily fork gliderlabs/ssh and x/crypto/ssh ... While we rearrange/upstream things. gliderlabs/ssh is forked into tempfork from our prior fork at be8b7add40 x/crypto/ssh OTOH is forked at https://github.com/tailscale/golang-x-crypto because it was gnarlier to vendor with various internal packages, etc. Its git history shows where it starts (2c7772ba30643b7a2026cbea938420dce7c6384d). Updates #3802 Change-Id: I546e5cdf831cfc030a6c42557c0ad2c58766c65f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	77b4fe0afa	all: remove "no 1.18 support" failures ... We have worked around the issue in DERP, so the vanilla Go 1.18 toolchain now works. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Aaron Klotz	6e91f872af	net/tshttpproxy: ensure we pass the correct flags to WinHttpOpen on Win7 and Win8.0 ... The best flag to use on Win7 and Win8.0 is deprecated in Win8.1, so we resolve the flag depending on OS version info. Fixes https://github.com/tailscale/tailscale/issues/4201 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	1db46919ab	cmd/tailscaled: make build fail nicely on older Go versions ... Due to a bug in Go (golang/go#51778), cmd/go doesn't warn about your Go version being older than the go.mod's declared Go version in that case that package loading fails before the build starts, such as when you use packages that are only in the current version of Go, like our use of net/netip. This change works around that Go bug by adding build tags and a pre-Go1.18-only file that will cause Go 1.17 and earlier to fail like: $ ~/sdk/go1.17/bin/go install ./cmd/tailscaled # tailscale.com/cmd/tailscaled ./required_version.go:11:2: undefined: you_need_Go_1_18_to_compile_Tailscale note: module requires Go 1.18 Change-Id: I39f5820de646703e19dde448dd86a7022252f75c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	997b19545b	syncs: use TryLock and TryRLock instead of unsafe ... The docs say: Note that while correct uses of TryLock do exist, they are rare, and use of TryLock is often a sign of a deeper problem in a particular use of mutexes. Rare code! Or bad code! Who can tell! Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	ead16b24ec	cmd/tailscaled: fail early with nice error on macOS with go1.18 ... Due to golang/go#51759 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	8c2cb4b431	go.mod: update to latest certstore ... It includes a fix to allow us to use Go 1.18. We can now remove our Tailscale-only build tags. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	26021b07ec	control/controlclient: only build certstore-related code with the Tailscale Go toolchain ... The certstore code is impacted by golang/go#51726. The Tailscale Go toolchain fork contains a temporary workaround, so it can compile it. Once the upstream toolchain can compile certstore, presumably in Go 1.18.1, we can revert this change. Note that depaware runs with the upstream toolchain. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	1b57b0380d	wgengine/magicsock: remove final alloc from ReceiveFrom ... And now that we don't have to play escape analysis and inlining games, simplify the code. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	71b535fc94	go.mod: require Go 1.18 ... Also, update depaware for Go 1.18's dependency tree. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Maisem Ali	da6ce27416	go.mod: move from github.com/gliderlabs/ssh to github.com/tailscale/ssh ... Updates #4146 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	ba1adf6c24	ssh/tailssh: make pty termios options match OpenSSH ... Still not sure the exact rules of how/when/who's supposed to set these, but this works for now on making them match. Baby steps. Will research more and adjust later. Updates #4146 (but not enough to fix it, something's still wrong) Updates #3802 Change-Id: I496d8cd7e31d45fe9ede88fc8894f35dc096de67 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	06c147d848	ssh/tailssh: create login sessions for new connections ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	0f31a0fc76	control/controlclient: add Noise client ... Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	db85384f9c	cmd/tailscaled: default to userspace-networking mode on gokrazy, set paths ... One of the current few steps to run Tailscale on gokrazy is to specify the --tun=userspace-networking flag: https://gokrazy.org/userguide/install/tailscale/ Instead, make it the default for now. Later we can change the default to kernel mode if available and fall back to userspace mode like Synology, once #391 is done. Likewise, set default paths for Gokrazy, as its filesystem hierarchy is not the Linux standard one. Instead, use the conventional paths as documented at https://gokrazy.org/userguide/install/tailscale/. Updates #1866 RELNOTE=default to userspace-networking mode on gokrazy Change-Id: I3766159a294738597b4b30629d2860312dbb7609 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	55095df644	net/interfaces: get Linux default route from netlink as fallback ... If it's in a non-standard table, as it is on Unifi UDM Pro, apparently. Updates #4038 (probably fixes, but don't have hardware to verify) Change-Id: I2cb9a098d8bb07d1a97a6045b686aca31763a937 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	497324ddf6	ipn/store: add common package for instantiating ipn.StateStores ... Also move KubeStore and MemStore into their own package. RELNOTE: tsnet now supports providing a custom ipn.StateStore. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Dmytro Shynkevych	d9a7205be5	net/tstun: set link speed to SPEED_UNKNOWN ... Fixes #3933. Signed-off-by: Dmytro Shynkevych <dm.shynk@gmail.com>	3 years ago
Brad Fitzpatrick	4686224e5a	cmd/tailscaled: add a no-op test for profiling init-time memory allocs ... Turns out we're pretty good already at init-time work in tailscaled. The regexp/syntax shows up but it's hard to get rid of that; zstd even uses regexp. *shrug* Change-Id: I856aca056dcb7489f5fc22ef07f55f34ddf19bd6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4cbdc84d27	cmd/tailscaled/childproc: add be-child registration mechanism ... For ssh and maybe windows service babysitter later. Updates #3802 Change-Id: I7492b98df98971b3fb72d148ba92c2276cca491f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c9eca9451a	ssh: make it build on darwin ... For local dev testing initially. Product-wise, it'll probably only be workable on the two unsandboxed builds. Updates #3802 Change-Id: Ic352f966e7fb29aff897217d79b383131bf3f92b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7d897229d9	net/dns: ignore permission errors on Synology DSM7 for now ... Updates #4017 Change-Id: Ia7fd4df47588c010dea8e63d88f397cc8eb748e5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	c7a8f0992d	ipn/ipnlocal: use views for Peer.PrimaryRoutes and Peer.Tags ... RELNOTE=`tailscale status --json` now shows Tags and PrimaryRoutes Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	f9a50779e2	cmd/tailscaled: add `-state=mem:` to support creation of an ephemeral node. ... RELNOTE=`tailscaled --state=mem:` registers as an ephemeral node and does not store state to disk. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	72d8672ef7	tailcfg: make Node.Hostinfo a HostinfoView ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	1b87e025e9	ssh/tailssh: move SSH code from wgengine/netstack to this new package ... Still largely incomplete, but in a better home now. Updates #3802 Change-Id: I46c5ffdeb12e306879af801b06266839157bc624 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c988bd6ed1	net/dns/resolvconffile: unify three /etc/resolv.conf parsers into new package ... Change-Id: I2120893ca802d12f1bd0407d49077d3672627d33 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8fe503057d	net/netutil: unify two oneConnListeners into a new package ... I was about to add a third copy, so unify them now instead. Change-Id: I3b93896aa1249b1250a6b1df4829d57717f2311a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Klotz	3a74f2d2d7	cmd/tailscaled, util/winutil: add accessor functions for Windows system policies. ... This patch adds new functions to be used when accessing system policies, and revises callers to use the new functions. They first attempt the new registry path for policies, and if that fails, attempt to fall back to the legacy path. We keep non-policy variants of these functions because we should be able to retain the ability to read settings from locations that are not exposed to sysadmins for group policy edits. The remaining changes will be done in corp. Updates https://github.com/tailscale/tailscale/issues/3584 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	1af26222b6	go.mod: bump netstack, switch to upstream netstack ... Now that Go 1.17 has module graph pruning (https://go.dev/doc/go1.17#go-command), we should be able to use upstream netstack without breaking our private repo's build that then depends on the tailscale.com Go module. This is that experiment. Updates #1518 (the original bug to break out netstack to own module) Updates #2642 (this updates netstack, but doesn't remove workaround) Change-Id: I27a252c74a517053462e5250db09f379de8ac8ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f3c0023add	wgengine/netstack: add an SSH server experiment ... Disabled by default. To use, run tailscaled with: TS_SSH_ALLOW_LOGIN=you@bar.com And enable with: $ TAILSCALE_USE_WIP_CODE=true tailscale up --ssh=true Then ssh [any-user]@[your-tailscale-ip] for a root bash shell. (both the "root" and "bash" part are temporary) Updates #3802 Change-Id: I268f8c3c95c8eed5f3231d712a5dc89615a406f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) ... A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	92dfaf53bb	cmd/tailscaled: include Go runtime metrics in /debug/metrics ... Fixes #3772 Change-Id: I237ea23268664d99e83d27890146018b04474556 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7d9b1de3aa	netcheck,portmapper,magicsock: ignore some UDP write errors on Linux ... Treat UDP send EPERM errors as a lost UDP packet, not something super fatal. That's just the Linux firewall preventing it from going out. And add a leaf package net/neterror for that (and future) policy that all three packages can share, with tests. Updates #3619 Change-Id: Ibdb838c43ee9efe70f4f25f7fc7fdf4607ba9c1d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ae319b4636	wgengine/magicsock: add HTML debug handler to see magicsock state ... Change-Id: Ibc46f4e9651e1c86ec6f5d139f5e9bdc7a488415 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3dedcd1640	logpolicy, ipn/ipnserver: connect to logtail via tailscaled when needed ... This is for use by the Windows GUI client to log via when an exit node is in use, so the logs don't go out via the exit node and instead go directly, like tailscaled's. The dialer tried to do that in the unprivileged GUI by binding to a specific interface, but the "Internet Kill Switch" installed by tailscaled for exit nodes precludes that from working and instead the GUI fails to dial out. So, go through tailscaled (with a CONNECT request) instead. Fixes tailscale/corp#3169 Change-Id: I17a8efdc1d4b8fed53a29d1c19995592b651b215 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	40e2b312b6	ipn/ipnserver, logpolicy: move Windows disk logging up earlier ... This moves the Windows-only initialization of the filelogger into logpolicy. Previously we only did it when babysitting the tailscaled subprocess, but this meant that log messages from the service itself never made it to disk. Examples that weren't logged to disk: * logtail unable to dial out, * DNS flush messages from the service * svc.ChangeRequest messages (#3581) This is basically the same fix as #3571 but staying in the Logf type, and avoiding build-tagged file (which wasn't quite a goal, but happened and seemed nice) Fixes #3570 Co-authored-by: Aaron Klotz <aaron@tailscale.com> Change-Id: Iacd80c4720b7218365ec80ae143339d030842702	3 years ago
Brad Fitzpatrick	689426d6bc	cmd/tailscaled: log Windows service change requests ... And add a little comment. Change-Id: If0bedf8aefd8d528149548fba829e7a9a8b2e114 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	59f4f33f60	cmd/tailscaled: fix windows logtail integration ... I broke it in 1.17.x sometime while rewiring some logs stuff, mostly in 0653efb092 (but with a handful of logs-related changes around that time) Fixes tailscale/corp#3265 Change-Id: Icb5c07412dc6d55f1d9244c5d0b51dceca6a7e34 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago