541 Commits (017dcd520f3cb485faea037b2a6e9fad438afa43)

Author	SHA1	Message	Date
Josh Bleecher Snyder	020084e84d	wgengine: adapt to removal of wgcfg.Key in wireguard-go	3 years ago
Smitty	b2a08ddacd	wgengine/tsdns: return NOERROR instead of NOTIMP for most records ... This is what every other DNS resolver I could find does, so tsdns should do it to. This also helps avoid weird error messages about non-existent records being unimplemented, and thus fixes #848. Signed-off-by: Smitty <me@smitop.com>	3 years ago
Denton Gentry	8349e10907	magicsock: add description of testClosingContext ... Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	2e9728023b	magicsock: test error case in sendDiscoMessage ... In sendDiscoMessage there is a check of whether the connection is closed, which is not being reliably exercised by other tests. This shows up in code coverage reports, the lines of code in sendDiscoMessage are alternately added and subtracted from code coverage. Add a test to specifically exercise and verify this code path. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	0aa55bffce	magicsock: test error case in derpWriteChanOfAddr ... In derpWriteChanOfAddr when we call derphttp.NewRegionClient(), there is a check of whether the connection is already errored and if so it returns before grabbing the lock. The lock might already be held and would be a deadlock. This corner case is not being reliably exercised by other tests. This shows up in code coverage reports, the lines of code in derpWriteChanOfAddr are alternately added and subtracted from code coverage. Add a test to specifically exercise this code path, and verify that it doesn't deadlock. This is the best tradeoff I could come up with: + the moment code calls Err() to check if there is an error, we grab the lock to make sure it would deadlock if it tries to grab the lock itself. + if a new call to Err() is added in this code path, only the first one will be covered and the rest will not be tested. + this test doesn't verify whether code is checking for Err() in the right place, which ideally I guess it would. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	85e54af0d7	wgengine: on TCP connect fail/timeout, log some clues about why it failed ... So users can see why things aren't working. A start. More diagnostics coming. Updates #1094	4 years ago
Brad Fitzpatrick	5eeaea9ef9	net/packet: add TCPFlag type and some more constants ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f85769b1ed	wgengine/magicsock: drop netaddr.IPPort cache ... netaddr.IP no longer allocates, so don't need a cache or all its associated code/complexity. This totally removes groupcache/lru from the deps. Also go mod tidy.	4 years ago
Brad Fitzpatrick	4d15e954bd	net/flowtrack: add new package to specialize groupcache/lru key type ... Reduces allocs. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	f69e46175d	wengine/netstack: bump gvisor to latest version ... * wengine/netstack: bump gvisor to latest version Signed-off-by: Naman Sood <naman@tailscale.com> * update dependencies Signed-off-by: Naman Sood <naman@tailscale.com> * Don't change hardcoded IP Signed-off-by: Naman Sood <naman@tailscale.com>	4 years ago
Brad Fitzpatrick	8b0112649a	wgengine/netstack: don't build netstack on 32-bit platforms ... See google/gvisor#5241	4 years ago
Brad Fitzpatrick	5aa5db89d6	cmd/tailscaled, wgengine/netstack: add start of gvisor userspace netstack work ... Not usefully functional yet (mostly a proof of concept), but getting it submitted for some work @namansood is going to do atop this. Updates #707 Updates #634 Updates #48 Updates #835	4 years ago
Brad Fitzpatrick	5efb0a8bca	cmd/tailscale: change formatting of "tailscale status" ... * show DNS name over hostname, removing domain's common MagicDNS suffix. only show hostname if there's no DNS name. but still show shared devices' MagicDNS FQDN. * remove nerdy low-level details by default: endpoints, DERP relay, public key. They're available in JSON mode still for those who need them. * only show endpoint or DERP relay when it's active with the goal of making debugging easier. (so it's easier for users to understand what's happening) The asterisks are gone. * remove Tx/Rx numbers by default for idle peers; only show them when there's traffic. * include peers' owner login names * add CLI option to not show peers (matching --self=true, --peers= also defaults to true) * sort by DNS/host name, not public key * reorder columns	4 years ago
Brad Fitzpatrick	b5b9866ba2	wgengine/magicsock: copy self DNS name to PeerStatus, re-fill OS ... The OS used to be sent back from the server but that has since been removed as being redundant.	4 years ago
Josh Bleecher Snyder	1271e135cd	wgengine/tstun: initialize wireguard-go TUN parameters ... This will enable us to remove the corresponding code from our fork of wireguard-go. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1e4604f60e	wgengine: quiet some wireguard-go logging ... The log lines that wireguard-go prints as it starts and stops its worker routines are mostly noise. They also happen after other work is completed, which causes failures in some of the log testing packages. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	e0c4ffa71f	wgengine/tsdns: respond with any available addrs for ALL queries ... This appears to have been the intent of the previous code, but in practice, it only returned A records. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Denton Gentry	df64b7abf8	Add IPv6 Reverse DNS Lookup test. ... To be honest I'm not fond of Golden Bytes tests like this, but not so much as to want to rewrite the whole test. The DNS byte format is essentially immutable at this point, the encoded bytes aren't going to change. The rest of the test assumptions about hostnames might, but we can fix that when it comes. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Alex Brainman	9985b3f1ed	wgengine/monitor: close closeHandle ... eccc167 introduced closeHandle which opened the handle, but never closed it. Windows handles should be closed. Updates #921 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	4 years ago
Brad Fitzpatrick	e8ae355bb8	ipn: delete domainsForProxying, require explicit DNS search domains (mapver 9) (#1078) ... Previously the client had heuristics to calculate which DNS search domains to set, based on the peers' names. Unfortunately that prevented us from doing some things we wanted to do server-side related to node sharing. So, bump MapRequest.Version to 9 to signal that the client only uses the explicitly configured DNS search domains and doesn't augment it with its own list. Updates tailscale/corp#1026 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	86fe22a1b1	Update netaddr, and adjust wgengine/magicsock due to API change. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package ... This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	0d94fe5f69	wgengine/router: disable IPv6 on Linux if ip rule -6 fails (#1074) ... Updates #562 Fixes #973 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Matt Layher	bfbd6b9241	go.mod: bump github.com/mdlayher/netlink to v1.2.0 ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Brad Fitzpatrick	80c94168ae	wgengine: finish updating isTrimmablePeer ... I accidentally merged Dave's change with the XXXX DO NOT SUBMIT comment in it.	4 years ago
David Anderson	cb96b14bf4	net/packet: remove the custom IP4/IP6 types in favor of netaddr.IP. ... Upstream netaddr has a change that makes it alloc-free, so it's safe to use in hot codepaths. This gets rid of one of the many IP types in our codebase. Performance is currently worse across the board. This is likely due in part to netaddr.IP being a larger value type (4b -> 24b for IPv4, 16b -> 24b for IPv6), and in other part due to missing low-hanging fruit optimizations in netaddr. However, the regression is less bad than it looks at first glance, because we'd micro-optimized packet.IP* in the past few weeks. This change drops us back to roughly where we were at the 1.2 release, but with the benefit of a significant code and architectural simplification. name old time/op new time/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 12.2ns ± 5% 29.7ns ± 2% +142.32% (p=0.008 n=5+5) Decode/tcp6-8 12.6ns ± 3% 65.1ns ± 2% +418.47% (p=0.008 n=5+5) Decode/udp4-8 11.8ns ± 3% 30.5ns ± 2% +157.94% (p=0.008 n=5+5) Decode/udp6-8 27.1ns ± 1% 65.7ns ± 2% +142.36% (p=0.016 n=4+5) Decode/icmp4-8 24.6ns ± 2% 30.5ns ± 2% +23.65% (p=0.016 n=4+5) Decode/icmp6-8 22.9ns ±51% 65.5ns ± 2% +186.19% (p=0.008 n=5+5) Decode/igmp-8 18.1ns ±44% 30.2ns ± 1% +66.89% (p=0.008 n=5+5) Decode/unknown-8 20.8ns ± 1% 10.6ns ± 9% -49.11% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 30.5ns ± 1% 77.9ns ± 3% +155.01% (p=0.008 n=5+5) Filter/tcp4_syn_in-8 43.7ns ± 3% 123.0ns ± 3% +181.72% (p=0.008 n=5+5) Filter/tcp4_syn_out-8 24.5ns ± 2% 45.7ns ± 6% +86.22% (p=0.008 n=5+5) Filter/udp4_in-8 64.8ns ± 1% 210.0ns ± 2% +223.87% (p=0.008 n=5+5) Filter/udp4_out-8 119ns ± 0% 278ns ± 0% +133.78% (p=0.016 n=4+5) Filter/icmp6-8 40.3ns ± 2% 204.4ns ± 4% +407.70% (p=0.008 n=5+5) Filter/tcp6_syn_in-8 35.3ns ± 3% 199.2ns ± 2% +464.95% (p=0.008 n=5+5) Filter/tcp6_syn_out-8 32.8ns ± 2% 81.0ns ± 2% +147.10% (p=0.008 n=5+5) Filter/udp6_in-8 106ns ± 2% 290ns ± 2% +174.48% (p=0.008 n=5+5) Filter/udp6_out-8 184ns ± 2% 314ns ± 3% +70.43% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/tstun goos:linux goarch:amd64 Write-8 9.02ns ± 3% 8.92ns ± 1% ~ (p=0.421 n=5+5) name old alloc/op new alloc/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00B 0.00B ~ (all equal) Decode/tcp6-8 0.00B 0.00B ~ (all equal) Decode/udp4-8 0.00B 0.00B ~ (all equal) Decode/udp6-8 0.00B 0.00B ~ (all equal) Decode/icmp4-8 0.00B 0.00B ~ (all equal) Decode/icmp6-8 0.00B 0.00B ~ (all equal) Decode/igmp-8 0.00B 0.00B ~ (all equal) Decode/unknown-8 0.00B 0.00B ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp4_in-8 0.00B 0.00B ~ (all equal) Filter/udp4_out-8 16.0B ± 0% 64.0B ± 0% +300.00% (p=0.008 n=5+5) Filter/icmp6-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp6_in-8 0.00B 0.00B ~ (all equal) Filter/udp6_out-8 48.0B ± 0% 64.0B ± 0% +33.33% (p=0.008 n=5+5) name old allocs/op new allocs/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00 0.00 ~ (all equal) Decode/tcp6-8 0.00 0.00 ~ (all equal) Decode/udp4-8 0.00 0.00 ~ (all equal) Decode/udp6-8 0.00 0.00 ~ (all equal) Decode/icmp4-8 0.00 0.00 ~ (all equal) Decode/icmp6-8 0.00 0.00 ~ (all equal) Decode/igmp-8 0.00 0.00 ~ (all equal) Decode/unknown-8 0.00 0.00 ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp4_in-8 0.00 0.00 ~ (all equal) Filter/udp4_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Filter/icmp6-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp6_in-8 0.00 0.00 ~ (all equal) Filter/udp6_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Crawshaw	2b2a16d9a2	wgengine/router/dns: reduce windows registry key open timeout ... The windows key timeout is longer than the wgengine watchdog timeout, which means we never reach the timeout, instead the process exits. Reduce the timeout so if we do hit it, at least the process continues. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
David Crawshaw	b4f70d8232	wgengine/router/dns: use the correct interface GUID ... On Win10, there's a hardcoded GUID and this works. On Win7, this GUID changes and we need to ask the tun for its LUID and convert that from the GUID. This commit uses the computed GUID that is placed in InterfaceName. Diagnosed by Jason Donnenfeld. (Thanks!)	4 years ago
Brad Fitzpatrick	15c064f76f	wgengine/router/dns: remove unsafe endianness detection on Linux	4 years ago
Brad Fitzpatrick	f9659323df	wgengine/router/dns: fix typo in comment	4 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints ... Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	294ceb513c	ipn, wgengine/magicsock: fix `tailscale status` display. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	891110e64c	wgengine: expand lazy config to work with dual-stacked peers. ... Lazy wg configuration now triggers if a peer has only endpoint addresses (/32 for IPv4, /128 for IPv6). Subnet routers still trigger eager configuration to avoid the need for a CIDR match in the hot packet path. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c8c493f3d9	wgengine/magicsock: make ReceiveIPv4 a little easier to follow. ... The previous code used a lot of whole-function variables and shared behavior that only triggered based on prior action from a single codepath. Instead of that, move the small amounts of "shared" code into each switch case. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0ad109f63d	wgengine/magicsock: move legacy endpoint creation into legacy.go. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f873da5b16	wgengine/magicsock: move more legacy endpoint handling. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	58fcd103c4	wgengine/magicsock: move legacy sending code to legacy.go. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	65ae66260f	wgengine/magicsock: unexport AddrSet. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c9b9afd761	wgengine/magicsock: move most legacy nat traversal bits to another file. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	741c513e51	wgengine/tsdns: fix error response marshaling, improve bad query logs ... Updates #995 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	554a20becb	wgengine/magicsock: only log about lazy config when actually doing lazy config. ... Before, tailscaled would log every 10 seconds when the periodic noteRecvActivity call happens. This is noisy, but worse it's misleading, because the message suggests that the disco code is starting a lazy config run for a missing peer, whereas in fact it's just an internal piece of keepalive logic. With this change, we still log when going from 0->1 tunnel for the peer, but not every 10s thereafter. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	fa412c8760	wgengine/filter, wgengine/magicsock: use new IP.BitLen to simplify some code	4 years ago
Brad Fitzpatrick	afcf134812	wgengine/filter, tailcfg: support CIDRs+ranges in PacketFilter (mapver 7) ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	9cee0bfa8c	wgengine/magicsock: sprinkle more docstrings. ... Magicsock is too damn big, but this might help me page it back in faster next time. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	6db9c4a173	wgenginer/router/dns: use constant from golang.org/x/sys/windows ... Made available in https://golang.org/cl/277153	4 years ago
Aleksandar Pesic	0dc295a640	Isolate WireGuard code into a separate file with appropriate copyright info in header. ... Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Aleksandar Pesic	d854fe95d2	Trivial change in function description. ... Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Aleksandar Pesic	338fd44657	Replace registry-access code, update wireguard-go and x/sys/windows. ... Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Aleksandar Pesic	274d32d0aa	Prepare for the new wireguard-go API. ... Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago