458 Commits (037daad47a030b1e3cc77660bae104a444267666)

Author	SHA1	Message	Date
Brad Fitzpatrick	3e493e0417	wgengine: fix lazy wireguard config bug on sent packet minute+ later ... A comparison operator was backwards. The bad case went: * device A send packet to B at t=1s * B gets added to A's wireguard config * B gets packet (5 minutes pass) * some other activity happens, causing B to expire to be removed from A's network map, since it's been over 5 minutes since sent or received activity * device A sends packet to B at t=5m1s * normally, B would get added back, but the old send time was not zero (we sent earlier!) and the time comparison was backwards, so we never regenerated the wireguard config. This also refactors the code for legibility and moves constants up top, with comments.	4 years ago
Dmytro Shynkevych	8c850947db	router: split off sandboxed path from router_darwin (#624) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	cb970539a6	wgengine/magicsock: remove TODO comment that's no longer applicable	4 years ago
Brad Fitzpatrick	915f65ddae	wgengine/magicsock: stop disco activity on IPN stop ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c180abd7cf	wgengine/magicsock: merge errClosed and errConnClosed	4 years ago
Brad Fitzpatrick	7cc8fcb784	wgengine/filter: remove leftover debug knob that staticcheck doesn't like	4 years ago
Brad Fitzpatrick	b4d97d2532	wgengine/filter: fix IPv4 IGMP spam omission, also omit ff02::16 spam ... And add tests. Fixes #618 Updates #402	4 years ago
Dmytro Shynkevych	2ce2b63239	router: stop iOS subprocess sandbox violations (#617) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	154d1cde05	router: reload systemd-resolved after changing /etc/resolv.conf (#619) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	b3fc61b132	wgengine: disable wireguard config trimming for now except iOS w/ many peers ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d55fdd4669	wgengine/magicsock: update, flesh out a TODO	4 years ago
Brad Fitzpatrick	d96d26c22a	wgengine/filter: don't spam logs on dropped outgoing IPv6 ICMP or IPv4 IGMP ... The OS (tries) to send these but we drop them. No need to worry the user with spam that we're dropping it. Fixes #402 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Dmytro Shynkevych	c7582dc234	ipn: fix netmap change tracking and dns map generation (#609) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	3e3c24b8f6	wgengine/packet: add IPVersion field, don't use IPProto to note version ... As prep for IPv6 log spam fixes in a future change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	f8e4c75f6b	wgengine/magicsock: check slightly less aggressively for connectivity. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	58b721f374	wgengine/magicsock: deflake some tests with an ugly hack ... Starting with fe68841dc7, some e2e tests got flaky. Rather than debug them (they're gnarly), just revert to the old behavior as far as those tests are concerned. The tests were somehow using magicsock without a private key and expecting it to do ... something. My goal with fe68841dc7 was to stop log spam and unnecessary work I saw on the iOS app when when stopping the app. Instead, only stop doing that work on any transition from once-had-a-private-key to no-longer-have-a-private-key. That fixes what I wanted to fix while still making the mysterious e2e tests happy.	4 years ago
David Anderson	41d0c81859	wgengine/magicsock: make disco subtest name more precise. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9beea8b314	wgengine/magicsock: remove unnecessary use of context. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b62341d308	wgengine/magicsock: add docstring. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9265296b33	wgengine/magicsock: don't deadlock on shutdown if sending blocks. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0249236cc0	ipn/ipnstate: record assigned Tailscale IPs. ... wgengine/magicsock: use ipnstate to find assigned Tailscale IPs. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c3958898f1	tstest/natlab: be a bit more lenient during test shutdown. ... There is a race in natlab where we might start shutdown while natlab is still running a goroutine or two to deliver packets. This adds a small grace period to try and receive it before continuing shutdown. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7578c815be	wgengine/magicsock: give pinger a more generous packet timeout. ... The first packet to transit may take several seconds to do so, because setup rates in wgengine may result in the initial WireGuard handshake init to get dropped. So, we have to wait at least long enough for a retransmit to correct the fault. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c3994fd77c	derp: remove OnlyDisco option. ... Active discovery lets us introspect the state of the network stack precisely enough that it's unnecessary, and dropping the initial DERP packets greatly slows down tests. Additionally, it's unrealistic since our production network will never deliver _only_ discovery packets, it'll be all or nothing. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	5455c64f1d	wgengine/magicsock: add a test for two facing endpoint-independent NATs. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f794493b4f	wgengine/magicsock: explicitly check path discovery, add a firewall test. ... The test proves that active discovery can traverse two facing firewalls. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f582eeabd1	wgengine/magicsock: add a test for active path discovery. ... Uses natlab only, because the point of this active discovery test is going to be that it should get through a lot of obstacles. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	37903a9056	wgengine/magicsock: fix occasional deadlock on Conn.Close on c.derpStarted ... The deadlock was: * Conn.Close was called, which acquired c.mu * Then this goroutine scheduled: if firstDerp { startGate = c.derpStarted go func() { dc.Connect(ctx) close(c.derpStarted) }() } * The getRegion hook for that derphttp.Client then ran, which also tries to acquire c.mu. This change makes that hook first see if we're already in a closing state and then it can pretend that region doesn't exist.	4 years ago
Brad Fitzpatrick	fe68841dc7	wgengine/magicsock: log better with less spam on transition to stopped state ... Required a minor test update too, which now needs a private key to get far enough to test the thing being tested.	4 years ago
Brad Fitzpatrick	e298327ba8	wgengine/magicsock: remove overkill, slow reflect.DeepEqual of NetworkMap ... No need to allocate or compare all the fields we don't care about.	4 years ago
Brad Fitzpatrick	4970e771ab	wgengine: add debug knob to disable the watchdog during debugging ... It launches goroutines and interferes with panic-based debugging, obscuring stacks.	4 years ago
David Anderson	3669296cef	wgengine/magicsock: refactor twoDevicePing to make stack construction cleaner. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	16a9cfe2f4	wgengine: configure wireguard peers lazily, as needed ... wireguard-go uses 3 goroutines per peer (with reasonably large stacks & buffers). Rather than tell wireguard-go about all our peers, only tell it about peers we're actively communicating with. That means we need hooks into magicsock's packet receiving path and tstun's packet sending path to lazily create a wireguard peer on demand from the network map. This frees up lots of memory for iOS (where we have almost nothing left for larger domains with many users). We should ideally do this in wireguard-go itself one day, but that'd be a pretty big change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	5066b824a6	wgengine/magicsock: don't log about disco ping timeouts if we have a working address ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a89d610a3d	wgengine/tstun: move sync.Pool to package global ... sync.Pools should almost always be packate globals, even though in this case we only have exactly 1 TUN device anyway, so it matters less. Still, it's unusual to see a Pool that's not a package global, so move it.	4 years ago
Dmytro Shynkevych	c53ab3111d	wgengine/router: support legacy resolvconf ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
David Anderson	189d86cce5	wgengine/router: don't use 88 or 8888 as table/rule numbers. ... We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	972a42cb33	wgengine/router: fix router_test to match the new marks. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d60917c0f1	wgengine/router: switch packet marks to avoid conflict with Weave Net. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	c06d2a8513	wgengine/magicsock: fix typo in comment	4 years ago
Brad Fitzpatrick	bf195cd3d8	wgengine/magicsock: reduce log verbosity of discovery messages ... Don't log heartbeat pings & pongs. Track the reason for pings and then only log the ping/pong traffic if it was for initial path discovery.	4 years ago
Dmytro Shynkevych	a3e7252ce6	wgengine/router: use better NetworkManager API ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Eduardo Kienetz	5df6be9d38	Use LittleEndian for correct byte order on DNS IPs ... Nameserver IP 10.11.12.13 would otherwise get written to resolv.conf as 13.12.11.10, as was happening on my client. Signed-off-by: Eduardo Kienetz <eduardo@kienetz.com>	4 years ago
Brad Fitzpatrick	a6559a8924	wgengine/magicsock: run test DERP in mode where only disco packets allowed ... So we don't accidentally pass a NAT traversal test by having DERP pick up our slack when we really just wanted DERP as an OOB messaging channel.	4 years ago
Brad Fitzpatrick	10ac066013	all: fix vet warnings	4 years ago
Brad Fitzpatrick	d74c9aa95b	wgengine/magicsock: update comment, fix earlier commit ... 891898525c had a continue that meant the didCopy synchronization never ran. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c976264bd1	wgengine/magicsock: gofmt	4 years ago
Dmytro Shynkevych	f3e2b65637	wgengine/magicsock: time.Sleep -> time.After ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	380ee76d00	wgengine/magicsock: make time.Sleep in runDerpReader respect cancellation. ... Before this patch, the 250ms sleep would not be interrupted by context cancellation, which would result in the goroutine sometimes lingering in tests (100ms grace period). Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	891898525c	wgengine/magicsock: make receive from didCopy respect cancellation. ... Very rarely, cancellation occurs between a successful send on derpRecvCh and a call to copyBuf on the receiving side. Without this patch, this situation results in <-copyBuf blocking indefinitely. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	a2267aae99	wgengine: only launch pingers for peers predating the discovery protocol ... Peers advertising a discovery key know how to speak the discovery protocol and do their own heartbeats to get through NATs and keep NATs open. No need for the pinger except for with legacy peers.	4 years ago
Brad Fitzpatrick	cdfea347d0	wgengine: update for tailscale/wireguard-go API changes ... * update to new HandshakeDone signature * use new Device.IpcGetOperationFiltered call to avoid sending allowed_ips See dd6c1c8fe1	4 years ago
David Anderson	45578b47f3	tstest/natlab: refactor PacketHandler into a larger interface. ... The new interface lets implementors more precisely distinguish local traffic from forwarded traffic, and applies different forwarding logic within Machines for each type. This allows Machines to be packet forwarders, which didn't quite work with the implementation of Inject. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Dmytro Shynkevych	19867b2b6d	tstun: remove buggy-looking log line. ... This log line looks buggy, even though lacking a filter is expected during bringup. We already know if we forget to SetFilter: it breaks the magicsock test, so no useful information is lost. Resolves #559. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Wendi Yu	c3736250a4	wgengine: fix macos staticcheck errors (#557) ... Signed-off-by: Wendi <wendi.yu@yahoo.ca>	4 years ago
Dmytro Shynkevych	3b36400e35	tsdns: response to type ANY queries ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	2f15894a10	wgengine/magicsock: wait for derphttp client goroutine to exit ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	30bbbe9467	wgengine/router: dns: unify on *BSD, multimode on Linux, Magic DNS (#536) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	61abab999e	cmd/tailscaled: graceful shutdown (#534) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
David Anderson	88e8456e9b	wgengine/magicsock: add a connectivity test for facing firewalls. ... The test demonstrates that magicsock can traverse two stateful firewalls facing each other, that each require localhost to initiate connections. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1f7b1a4c6c	wgengine/magicsock: rearrange TwoDevicePing test for future natlab tests. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	977381f9cc	wgengine/magicsock: make trivial natlab test pass. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	6c74065053	wgengine/magicsock, tstest/natlab: start hooking up natlab to magicsock ... Also adds ephemeral port support to natlab. Work in progress. Pairing with @danderson.	4 years ago
Dmytro Shynkevych	21d1dbfce0	wgengine/tsdns: local DNS server for testing ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	248d28671b	tsdns: fix race in delegate ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	bd59bba8e6	wgengine/magicsock: stop discoEndpoint timers on Close ... And add some defensive early returns on c.closed.	4 years ago
Brad Fitzpatrick	de875a4d87	wgengine/magicsock: remove DisableSTUNForTesting	4 years ago
Dmytro Shynkevych	67ebba90e1	tsdns: dual resolution mode, IPv6 support (#526) ... This change adds to tsdns the ability to delegate lookups to upstream nameservers. This is crucial for setting Magic DNS as the system resolver. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	ce1b52bb71	wgengine/monitor: fix other potential crashes on Linux ... Never return "nil, nil" anymore. The caller expected a usable interface now. I missed some of these earlier. Also, handle address deletion now. Updates #532	4 years ago
Brad Fitzpatrick	4b75a27969	wgengine/monitor: fix crash on Linux on type 21 messages ... Fixes #532	4 years ago
Brad Fitzpatrick	724ad13fe1	wgengine/tstun: fix alignment of 64-bit atomic field ... We had a test for it, but no 32-bit builder apparently. :( Fixes #529	4 years ago
Brad Fitzpatrick	4db60a8436	wgengine/monitor: parse Linux netlink messages, ignore our own events ... Fixes tailscale/corp#412 ("flood of link change events at start-up") Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	742b8b44a8	net/tsaddr: new package to hold Tailscale-specific IPs/ranges ... And update existing callers with (near) duplicated cases.	4 years ago
Brad Fitzpatrick	5c6d8e3053	netcheck, tailcfg, interfaces, magicsock: survey UPnP, NAT-PMP, PCP ... Don't do anything with UPnP, NAT-PMP, PCP yet, but see how common they are in the wild. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6196b7e658	wgengine/magicsock: change API to not permit disco key changes ... Generate the disco key ourselves and give out the public half instead. Fixes #525	4 years ago
Brad Fitzpatrick	5132edacf7	wgengine/magicsock: fix data race from undocumented wireguard-go requirement ... Endpoints need to be Stringers apparently. Fixes tailscale/corp#422	4 years ago
Brad Fitzpatrick	630379a1d0	cmd/tailscale: add tailscale status region name, last write, consistently star ... There's a lot of confusion around what tailscale status shows, so make it better: show region names, last write time, and put stars around DERP too if active. Now stars are always present if activity, and always somewhere.	4 years ago
Brad Fitzpatrick	9a8700b02a	wgengine/magicsock: add discoEndpoint heartbeat ... Updates #483	4 years ago
Brad Fitzpatrick	9f930ef2bf	wgengine/magicsock: remove the discoEndpoint.timers map ... It ended up being more complicated than it was worth.	4 years ago
Brad Fitzpatrick	f5f3885b5b	wgengine/magicsock: bunch of misc discovery path cleanups ... * fix tailscale status for peers using discovery * as part of that, pull out disco address selection into reusable and testable discoEndpoint.addrForSendLocked * truncate ping/pong logged hex txids in half to eliminate noise * move a bunch of random time constants into named constants with docs * track a history of per-endpoint pong replies for future use & status display * add "send" and " got" prefix to discovery message logging immediately before the frame type so it's easier to read than searching for the "<-" or "->" arrows earlier in the line; but keep those as the more reasily machine readable part for later. Updates #483	4 years ago
Dmytro Shynkevych	e9643ae724	wgengine: prevent log after exit in watchdog test ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	16b2bbbbbb	wgengine: close in reverse order of bringup ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	6c70cf7222	wgengine/magicsock: stop ping timeout timer on pong receipt, misc log cleanup ... Updates #483	4 years ago
Brad Fitzpatrick	c52905abaa	wgengine/magicsock: log less on no-op disco route switches ... Also, renew trustBestAddrUntil even if latency isn't better.	4 years ago
Brad Fitzpatrick	0f0ed3dca0	wgengine/magicsock: clean up discovery logging ... Updates #483	4 years ago
Brad Fitzpatrick	056fbee4ef	wgengine/magicsock: add TS_DEBUG_OMIT_LOCAL_ADDRS knob to force STUN use only ... For debugging.	4 years ago
Brad Fitzpatrick	e03cc2ef57	wgengine/magicsock: populate discoOfAddr upon receiving ping frames ... Updates #483	4 years ago
Brad Fitzpatrick	275a20f817	wgengine/magicsock: keep discoOfAddr populated, use it for findEndpoint ... Update the mapping from ip:port to discokey, so when we retrieve a packet from the network, we can find the same conn.Endpoint that we gave to wireguard-go previously, without making it think we've roamed. (We did, but we're not using its roaming.) Updates #483	4 years ago
Brad Fitzpatrick	77e89c4a72	wgengine/magicsock: handle CallMeMaybe discovery mesages ... Roughly feature complete now. Testing and polish remains. Updates #483	4 years ago
Brad Fitzpatrick	710ee88e94	wgengine/magicsock: add timeout on discovery pings, clean up state ... Updates #483	4 years ago
Brad Fitzpatrick	77d3ef36f4	wgengine/magicsock: hook up discovery messages, upgrade to LAN works ... Ping messages now go out somewhat regularly, pong replies are sent, and pong replies are now partially handled enough to upgrade off DERP to LAN. CallMeMaybe packets are sent & received over DERP, but aren't yet handled. That's next (and regular maintenance timers), and then WAN should work. Updates #483	4 years ago
Brad Fitzpatrick	9b8ca219a1	wgengine/magicsock: remove allocs in UDP write, use new netaddr.PutUDPAddr ... The allocs were only introduced yesterday with a TODO. Now they're gone again.	4 years ago
Brad Fitzpatrick	7b3c0bb7f6	wgengine/magicsock: fix crash reading DERP packet ... Starting at yesterday's e96f22e560 (convering some UDPAddrs to IPPorts), Conn.ReceiveIPv4 could return a nil addr, which would make its way through wireguard-go and blow up later. The DERP read path wasn't initializing the addr result parameter any more, and wgRecvAddr wasn't checking it either. Fixes #515	4 years ago
Brad Fitzpatrick	47b4a19786	wgengine/magicsock: use netaddr.ParseIPPort instead of net.ResolveUDPAddr	4 years ago
Brad Fitzpatrick	f7124c7f06	wgengine/magicsock: start of discoEndpoint state tracking ... Updates #483	4 years ago
Brad Fitzpatrick	92252b0988	wgengine/magicsock: add a little LRU cache for netaddr.IPPort lookups ... And while plumbing, a bit of discovery work I'll need: the endpointOfAddr map to map from validated paths to the discoEndpoint. Not being populated yet. Updates #483	4 years ago
Brad Fitzpatrick	2d6e84e19e	net/netcheck, wgengine/magicsock: replace more UDPAddr with netaddr.IPPort	4 years ago
Brad Fitzpatrick	9070aacdee	wgengine/magicsock: minor comments & logging & TODO changes	4 years ago
Brad Fitzpatrick	e96f22e560	wgengine/magicsock: start handling disco message, use netaddr.IPPort more ... Updates #483	4 years ago
Brad Fitzpatrick	a83ca9e734	wgengine/magicsock: cache precomputed nacl/box shared keys ... Updates #483	4 years ago
Brad Fitzpatrick	a975e86bb8	wgengine/magicsock: add new endpoint type used for discovery-supporting peers ... This adds a new magicsock endpoint type only used when both sides support discovery (that is, are advertising a discovery key). Otherwise the old code is used. So far the new code only communicates over DERP as proof that the new code paths are wired up. None of the actually discovery messaging is implemented yet. Support for discovery (generating and advertising a key) are still behind an environment variable for now. Updates #483	4 years ago
Brad Fitzpatrick	6f73f2c15a	wgengine, internal/deepprint: replace UAPI usage as hash func; add deepprint ... The new deepprint package just walks a Go data structure and writes to an io.Writer. It's not pretty like go-spew, etc. We then use it to replace the use of UAPI (which we have a TODO to remove) to generate signatures of data structures to detect whether anything changed (without retaining the old copy). This was necessary because the UAPI conversion ends up trying to do DNS lookups which an upcoming change depends on not happening.	4 years ago
Brad Fitzpatrick	103c06cc68	wgengine/magicsock: open discovery naclbox messages from known peers ... And track known peers. Doesn't yet do anything with the messages. (nor does it send any yet) Start of docs on the message format. More will come in subsequent changes. Updates #483	4 years ago
David Crawshaw	9258d64261	wgengine/router: do not call ifconfig up if SetRoutesFunc is set ... The NetworkExtension brings up the interface itself and does not have access to `ifconfig`, which the underlying BSD userspace router attempts to use when Up is called. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Brad Fitzpatrick	23e74a0f7a	wgengine, magicsock, tstun: don't regularly STUN when idle (mobile only for now) ... If there's been 5 minutes of inactivity, stop doing STUN lookups. That means NAT mappings will expire, but they can resume later when there's activity again. We'll do this for all platforms later. Updates tailscale/corp#320 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	fe50cd0c48	ipn, wgengine: plumb NetworkMap down to magicsock ... Now we can have magicsock make decisions based on tailcfg.Debug settings sent by the server. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	19d95e095a	wgengine: fix blank line in interface method comment	4 years ago
Reinaldo de Souza	a8635784bc	wgengine: add BSD userspace router to darwin ... Darwin and FreeBSD are compatible enough to share the userspace router. The OSX router delegates to the BSD userspace router unless `SetRoutesFunc` is set. That preserves the mechanism that allows `ipn-go-bridge` to specify its own routing behavior. Fixes #177 Signed-off-by: Reinaldo de Souza <github@rei.nal.do>	4 years ago
Dmytro Shynkevych	de5f6d70a8	magicsock: eliminate logging race in test ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	53fb25fc2f	all: generate discovery key, plumb it around ... Not actually used yet. Updates #483	4 years ago
Brad Fitzpatrick	d9054da86a	wgengine: disambiguate Reconfig logging paths	4 years ago
Brad Fitzpatrick	abd79ea368	derp: reduce DERP memory use; don't require callers to pass in memory to use ... The magicsock derpReader was holding onto 65KB for each DERP connection forever, just in case. Make the derp{,http}.Client be in charge of memory instead. It can reuse its bufio.Reader buffer space.	4 years ago
Brad Fitzpatrick	280e8884dd	wgengine/magicsock: limit redundant log spam on packets from low-pri addresses ... Fixes #407 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	d05b0500ac	wgengine: loop back tuntap packets destined for local IPs. ... macOS incorrectly sends packets for the local Tailscale IP into our tunnel interface. We have to turn the packets around and send them back to the kernel. Fixes tailscale/corp#189. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Avery Pennarun	51d176ecff	wgengine: Remove leftover debug message. ... Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Dmytro Shynkevych	07e02ec9d3	wgengine/tsdns: add test and prevent useless updates (#449) ... Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	511840b1f6	tsdns: initial implementation of a Tailscale DNS resolver (#396) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	02231e968e	wgengine/tstun: add tests and benchmarks (#436) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	059b1d10bb	wgengine/packet: refactor and expose UDP header marshaling (#408) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
David Anderson	5a32f8e181	wgengine/router: also accept exit code 254 from `ip rule del`. ... iproute2 3.16.0-2 from Debian Jessie (oldoldstable) doesn't return exit code 2 when deleting a non-existent IP rule. Fixes #434 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	08a38f21c9	wgengine/router: don't filter subnet routing in netfilter. ... We have a filter in tailscaled itself now, which is more robust against weird network topologies (such as the one Docker creates). Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Dmytro Shynkevych	73c40c77b0	filter: prevent escape of QDecode to the heap (#417) ... Performance impact: name old time/op new time/op delta Filter/tcp_in-4 70.7ns ± 1% 30.9ns ± 1% -56.30% (p=0.008 n=5+5) Filter/tcp_out-4 58.6ns ± 0% 19.4ns ± 0% -66.87% (p=0.000 n=5+4) Filter/udp_in-4 96.8ns ± 2% 55.5ns ± 0% -42.64% (p=0.016 n=5+4) Filter/udp_out-4 120ns ± 1% 79ns ± 1% -33.87% (p=0.008 n=5+5) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	722673f307	Update go4.org/mem, adjust to revised API.	4 years ago
Brad Fitzpatrick	9e5d79e2f1	wgengine/magicsock: drop a bytes.Buffer sync.Pool, use logger.ArgWriter instead	4 years ago
Brad Fitzpatrick	becce82246	net/netns, misc tests: remove TestOnlySkipPrivilegedOps, argv checks ... The netns UID check is sufficient for now. We can do something else later if/when needed.	4 years ago
Avery Pennarun	e7ae6a2e06	net/netns, wgengine/router: support Linux machines that don't have 'ip rule'. ... We'll use SO_BINDTODEVICE instead of fancy policy routing. This has some limitations: for example, we will route all traffic through the interface that has the main "default" (0.0.0.0/0) route, so machines that have multiple physical interfaces might have to go through DERP to get to some peers. But machines with multiple physical interfaces are very likely to have policy routing (ip rule) support anyway. So far, the only OS I know of that needs this feature is ChromeOS (crostini). Fixes #245. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	e46238a2af	wgengine: separately dedupe wireguard configs and router configs. ... Otherwise iOS/macOS will reconfigure their routing every time anything minor changes in the netmap (in particular, endpoints and DERP homes), which is way too often. Some users reported "network reconfigured" errors from Chrome when this happens. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	f0b6ba78e8	wgengine: don't pass nil router.Config objects. ... These are hard for swift to decode in the iOS app. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
David Anderson	5114df415e	net/netns: set the bypass socket mark on linux. ... This allows tailscaled's own traffic to bypass Tailscale-managed routes, so that things like tailscale-provided default routes don't break tailscaled itself. Progress on #144. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	db2a216561	wgengine/magicsock: don't log on UDP send errors if address family known missing ... Fixes #376	4 years ago
David Crawshaw	cf5d25e15b	wgengine: ensure pingers are gone before returning from Close ... We canceled the pingers in Close, but didn't wait around for their goroutines to be cleaned up. This caused the ipn/e2e_test to catch pingers in its resource leak check. This commit introduces an object, but also simplifies the semantics around the pinger's cancel functions. They no longer need to be called while holding the mutex. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Brad Fitzpatrick	9e3ad4f79f	net/netns: add package for start of network namespace support ... And plumb in netcheck STUN packets. TODO: derphttp, logs, control. Updates #144 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a428656280	wgengine/magicsock: don't report v4 localhost addresses on IPv6-only systems ... Updates #376	4 years ago
David Anderson	fff062b461	wgengine/router: make runner.go linux-only for now. ... Otherwise, staticcheck complains that these functions are unused and unexported on macOS. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Avery Pennarun	f69003fd46	router_linux: work around terrible bugs in old iptables-compat versions. ... Specifically, this sequence: iptables -N ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT iptables -A FORWARD -j ts-forward doesn't work on Debian-9-using-nftables, but this sequence: iptables -N ts-forward iptables -A FORWARD -j ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT does work. I'm sure the reason why is totally fascinating, but it's an old version of iptables and the bug doesn't seem to exist on modern nftables, so let's refactor our code to add rules in the always-safe order and pretend this never happened. Fixes #401. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	9ff51909a3	router_linux: fix behaviour when switching --netfilter-mode. ... On startup, and when switching into =off and =nodivert, we were deleting netfilter rules even if we weren't the ones that added them. In order to avoid interfering with rules added by the sysadmin, we have to be sure to delete rules only in the case that we added them in the first place. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	a496cdc943	router_linux: remove need for iptables.ListChains(). ... Instead of retrieving the list of chains, or the list of rules in a chain, just try deleting the ones we don't want and then adding the ones we do want. An error in flushing/deleting still means the rule doesn't exist anymore, so there was no need to check for it first. This avoids the need to parse iptables output, which avoids the need to ever call iptables -S, which fixes #403, among other things. It's also much more future proof in case the iptables command line changes. Unfortunately the iptables go module doesn't properly pass the iptables command exit code back up when doing .Delete(), so we can't correctly check the exit code there. (exit code 1 really means the rule didn't exist, rather than some other weird problem). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	8a6bd21baf	router_linux: extract process runner routines into runner.go. ... These will probably be useful across platforms. They're not really Linux-specific at all. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	34c30eaea0	router_linux: use only baseline 'ip rule' features that exist in old kernels. ... This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	30e5c19214	magicsock: work around race condition initializing .Regions[]. ... Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Dmytro Shynkevych	737124ef70	tstun: tolerate zero reads ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	b0c10fa610	stun, netcheck: move under net	5 years ago
Brad Fitzpatrick	43ded2b581	wgengine/packet: add some tests, more docs, minor Go style, performance changes	5 years ago
Brad Fitzpatrick	e6b84f2159	all: make client use server-provided DERP map, add DERP region support ... Instead of hard-coding the DERP map (except for cmd/tailscale netcheck for now), get it from the control server at runtime. And make the DERP map support multiple nodes per region with clients picking the first one that's available. (The server will balance the order presented to clients for load balancing) This deletes the stunner package, merging it into the netcheck package instead, to minimize all the config hooks that would've been required. Also fix some test flakes & races. Fixes #387 (Don't hard-code the DERP map) Updates #388 (Add DERP region support) Fixes #399 (wgengine: flaky tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	e8b3a5e7a1	wgengine/filter: implement a destination IP pre-filter. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	7fb33123d3	wgengine/router: warn about another variation of busybox's `ip`. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Dmytro Shynkevych	635f7b99f1	wgengine: pass tun.NativeDevice to router ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
David Anderson	9c914dc7dd	wgengine/router: stop using -m comment. ... The comment module is compiled out on several embedded systems (and also gentoo, because netfilter can't go brrrr with comments holding it back). Attempting to use comments results in a confusing error, and a non-functional firewall. Additionally, make the legacy rule cleanup non-fatal, because we *do* have to probe for the existence of these -m comment rules, and doing so will error out on these systems. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	3e27b3c33c	wgengine/router: more comments. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	0fe262f093	ipn: plumb NetfilterMode all the way out to the CLI. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago