606 Commits (04d24d3a38da5469458f56ddf8f8575175c02603)

Author	SHA1	Message	Date
Dave Anderson	980acc38ba	types/key: add a special key with custom serialization for control private keys (#2792) ... * Revert "Revert "types/key: add MachinePrivate and MachinePublic."" This reverts commit 61c3b98a24. Signed-off-by: David Anderson <danderson@tailscale.com> * types/key: add ControlPrivate, with custom serialization. ControlPrivate is just a MachinePrivate that serializes differently in JSON, to be compatible with how the Tailscale control plane historically serialized its private key. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	61c3b98a24	Revert "types/key: add MachinePrivate and MachinePublic." ... Broke the tailscale control plane due to surprise different serialization. This reverts commit 4fdb88efe1.	3 years ago
David Anderson	4fdb88efe1	types/key: add MachinePrivate and MachinePublic. ... Plumb throughout the codebase as a replacement for the mixed use of tailcfg.MachineKey and wgkey.Private/Public. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	99a1c74a6a	metrics: optimize CurrentFDs to not allocate on Linux ... It was 50% of our allocs on one of our servers. (!!) Updates #2784 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5d800152d9	cmd/derper: increase port 80's WriteTimeout to permit longer CPU profiles ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Chuangbo Li	e4e4d336d9	cmd/derper: listen on host of flag server addr for port 80 and 3478 (#2768) ... cmd/derper: listen on host of flag server addr for port 80 and 3478 When using custom derp on the server with multiple IP addresses, we would like to bind derp 80, 443 and stun 3478 to a certain IP. derp command provides flag `-a` to customize which address to bind for port 443. But port :80 and :3478 were hard-coded. Fixes #2767 Signed-off-by: Li Chuangbo <im@chuangbo.li>	3 years ago
Maisem Ali	0842e2f45b	ipn/store: add ability to store data as k8s secrets. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	7f29dcaac1	cmd/tailscale/cli: make up block until state Running, not just Starting ... At "Starting", the DERP connection isn't yet up. After the first netmap and DERP connect, then it transitions into "Running". Fixes #2708 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7a7aa8f2b0	cmd/derper: also add port 80 timeouts ... Didn't notice this one in earlier 00b3c1c042 Updates tailscale/corp#2486 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3c8ca4b357	client/tailscale, cmd/tailscale/cli: move version mismatch check to CLI ... So people can use the package for whois checks etc without version skew errors. The earlier change faa891c1f2 for #1905 was a bit too aggressive. Fixes #2757 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	21cb0b361f	safesocket: add connect retry loop to wait for tailscaled ... Updates #2708 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	00b3c1c042	cmd/derper: add missing read/write timeouts ... Updates tailscale/corp#2486 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	97693f2e42	wgengine/magicsock: delete legacy AddrSet endpoints. ... Instead of using the legacy codepath, teach discoEndpoint to handle peers that have a home DERP, but no disco key. We can still communicate with them, but only over DERP. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maisem Ali	fd4838dc57	wgengine/userspace: add support to automatically enable/disable the tailscale ... protocol in BIRD, when the node is a primary subnet router as determined by control. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Will Lachance	a35c3ba221	cmd/tailscale: fix truncated characters in web controller (#2722) ... Fixes #2204 Signed-off-by: William Lachance <wlach@protonmail.com> Co-authored-by: William Lachance <wlach@protonmail.com> Co-authored-by: Ross Zurowski <ross@rosszurowski.com>	3 years ago
Brad Fitzpatrick	4aab083cae	cmd/tailscaled: add debug flag to print interfaces just once ... It previously only had a polling monitor mode. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	47045265b9	hostinfo: add SetDeviceModel setter, move remaining code from controlclient ... Updates tailscale/corp#1959 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	4ff0757d44	cmd/testcontrol: add test control server ... This is useful for manual performance testing of networks with many nodes. I imagine it'll grow more knobs over time. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	edb338f542	cmd/tailscale: fix sporadic 'context canceled' error on 'up' ... Fixes #2333 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	9f62cc665e	tailscaled: try migrating old state on synology devices ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	b7ae529ecc	client/tailscale: make GetCertificate guess cert if SNI lacks dots ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d5e1abd0c4	cmd/tailscale/cli: only write cert file if it changed ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	57b794c338	ipn/localapi: move cert fetching code to localapi, cache, add cert subcommand ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Matt Layher	8ab44b339e	net/tstun: use unix.Ifreq type for Linux TAP interface configuration ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	3 years ago
Josh Bleecher Snyder	d2aa144dcc	syncs: bump known good version to include Go 1.17 ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	25e060a841	cmd/tailscale/cli: fix cert fetch WaitOrder retry loop, misc cleanups ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b2eea1ee00	cmd/tailscale/cli: make cert fetch registration automatic, show valid domains ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	3e7ff5ff98	cmd/tailscaled: enable hybrid netstack mode for FreeBSD. ... Allows FreeBSD to function as an exit node in the same way that Windows and Tailscaled-on-MacOS do. RELNOTE=FreeBSD can now function as an exit node. Fixes https://github.com/tailscale/tailscale/issues/2498 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	ec9f3f4cc0	cmd/tailscale: update depaware ... Missing from prior commit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c68a12afe9	cmd/tailscale: add temporary debug command for getting DNS-01 LetsEncrypt cert ... Not even close to usable or well integrated yet, but submitting this before it bitrots or I lose it. Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	d2d55bd63c	cmd/microproxy: delete. ... Thank goodness. Fixes #2635 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	a4e19f2233	version: remove rsc.io/goversion dependency ... rsc.io/goversion is really expensive. Running version.ReadExe on tailscaled on darwin allocates 47k objects, almost 11mb. All we want is the module info. For that, all we need to do is scan through the binary looking for the magic start/end strings and then grab the bytes in between them. We can do that easily and quickly with nothing but a 64k buffer. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Crawshaw	360223fccb	types/dnstype: introduce new package for Resolver ... So the type can be used in net/dns without introducing a tailcfg dependency. For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Josh Bleecher Snyder	eee6b85b9b	cmd/tailscaled: don't require root for --cleanup ... Without this, the integration tests fail locally for me: --- FAIL: TestCollectPanic (7.61s) integration.go:74: built [tailscale.com/cmd/tailscaled tailscale.com/cmd/tailscale] in 1.59s integration_test.go:102: initial run: tailscaled requires root; use sudo tailscaled (or use --tun=userspace-networking) integration_test.go:108: cleanup failed: exit status 1: "tailscaled requires root; use sudo tailscaled (or use --tun=userspace-networking)\n" stuntest.go:64: STUN server shutdown FAIL FAIL tailscale.com/tstest/integration 9.678s FAIL Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	a5da4ed981	all: gofmt with Go 1.17 ... This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	a729070252	net/tstun: add start of Linux TAP support, with DHCP+ARP server ... Still very much a prototype (hard-coded IPs, etc) but should be non-invasive enough to submit at this point and iterate from here. Updates #2589 Co-Author: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fd7b738e5b	derp: use pad32 package for padding, reduce duplication ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fdc081c291	net/portmapper: fix UPnP probing, work against all ports ... Prior to Tailscale 1.12 it detected UPnP on any port. Starting with Tailscale 1.11.x, it stopped detecting UPnP on all ports. Then start plumbing its discovered Location header port number to the code that was assuming port 5000. Fixes #2109 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f3c96df162	ipn/ipnstate: move tailscale status "active" determination to tailscaled ... Fixes #2579 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1db9032ff5	cmd/tailscaled: let portmap debug mode have an gateway/IP override knob ... For testing pfSense clients "behind" pfSense on Digital Ocean where the main interface still exists. This is easier for debugging. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	31ea073a73	cmd/tailscaled: add debug -portmap mode ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	3e039daf95	logpolicy: actually collect panics ... (Written with Josh) For #2544 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	d37451bac6	cmd/derper: dial VPC address with right context ... Fix bug from just-submitted e422e9f4c9. Updates #2414 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e422e9f4c9	cmd/derper: mesh over VPC network ... Updates #2414 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	9da4181606	tstime/rate: new package ... This is a simplified rate limiter geared for exactly our needs: A fast, mono.Time-based rate limiter for use in tstun. It was generated by stripping down the x/time/rate rate limiter to just our needs and switching it to use mono.Time. It removes one time.Now call per packet. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	8a3d52e882	wgengine/magicsock: use mono.Time ... magicsock makes multiple calls to Now per packet. Move to mono.Now. Changing some of the calls to use package mono has a cascading effect, causing non-per-packet call sites to also switch. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	c2202cc27c	net/tstun: use mono.Time ... There's a call to Now once per packet. Move to mono.Now. Though the current implementation provides high precision, we document it to be coarse, to preserve the ability to switch to a coarse monotonic time later. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Aaron Bieber	c179b9b535	cmd/tsshd: switch from github.com/kr/pty to github.com/creack/pty ... The kr/pty module moved to creack/pty per the kr/pty README[1]. creack/pty brings in support for a number of OS/arch combos that are lacking in kr/pty. Run `go mod tidy` while here. [1] https://github.com/kr/pty/blob/master/README.md Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>	3 years ago
Brad Fitzpatrick	7b9f02fcb1	cmd/tailscale/cli: document that empty string disable exit nodes, routes ... Updates #2529 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Joe Tsai	d145c594ad	util/deephash: improve cycle detection (#2470) ... The previous algorithm used a map of all visited pointers. The strength of this approach is that it quickly prunes any nodes that we have ever visited before. The detriment of the approach is that pruning is heavily dependent on the order that pointers were visited. This is especially relevant for hashing a map where map entries are visited in a non-deterministic manner, which would cause the map hash to be non-deterministic (which defeats the point of a hash). This new algorithm uses a stack of all visited pointers, similar to how github.com/google/go-cmp performs cycle detection. When we visit a pointer, we push it onto the stack, and when we leave a pointer, we pop it from the stack. Before visiting a pointer, we first check whether the pointer exists anywhere in the stack. If yes, then we prune the node. The detriment of this approach is that we may hash a node more often than before since we do not prune as aggressively. The set of visited pointers up until any node is only the path of nodes up to that node and not any other pointers that may have been visited elsewhere. This provides us deterministic hashing regardless of visit order. We can now delete hashMapFallback and associated complexity, which only exists because the previous approach was non-deterministic in the presence of cycles. This fixes a failure of the old algorithm where obviously different values are treated as equal because the pruning was too aggresive. See https://github.com/tailscale/tailscale/issues/2443#issuecomment-883653534 The new algorithm is slightly slower since it prunes less aggresively: name old time/op new time/op delta Hash-8 66.1µs ± 1% 68.8µs ± 1% +4.09% (p=0.000 n=19+19) HashMapAcyclic-8 63.0µs ± 1% 62.5µs ± 1% -0.76% (p=0.000 n=18+19) TailcfgNode-8 9.79µs ± 2% 9.88µs ± 1% +0.95% (p=0.000 n=19+17) HashArray-8 643ns ± 1% 653ns ± 1% +1.64% (p=0.000 n=19+19) However, a slower but more correct algorithm seems more favorable than a faster but incorrect algorithm. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Brad Fitzpatrick	ed8587f90d	wgengine/router: take a link monitor ... Prep for #1591 which will need to make Linux's router react to changes that the link monitor observes. The router package already depended on the monitor package transitively. Now it's explicit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7f7a81e5ae	cmd/tailscaled: add func to create ipnserver.Opts ... To unify the Windows service and non-service/non-Windows paths a bit. And provides a way to make Linux act like Windows for testing. (notably, for testing the fix to #2137) One perhaps visible change of this is that tailscaled.exe when run in cmd.exe/powershell (not as a Windows Service) no longer uses the "_daemon" autostart key. But in addition to being naturally what falls out of this change, that's also what Windows users would likely want, as otherwise the unattended mode user is ignored when the "_daemon" autostart key is specified. Notably, this would let people debug what their normally-run-as-a-service tailscaled is doing, even when they're running in Unattended Mode. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	87244eda3f	cmd/tailscale/cli: allow effective GOOS to be changed for integration tests ... Adds TS_DEBUG_UP_FLAG_GOOS for integration tests to make "tailscale up" act like other OSes. For an upcoming change to test #2137. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	4dbbd0aa4a	cmd/addlicense: add command to add licenseheaders to generated code ... And use it to make our stringer invocations match the existing code. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	ec4d721572	cmd/tailscaled: use state key constant from ipn package ... Rather than redefining it again. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e2eaae8224	cmd/derpprobe: add in a delay to wait for mesh info to sync	3 years ago
julianknodt	1bb6abc604	net/portmapper: add upnp port mapping ... Add in UPnP portmapping, using goupnp library in order to get the UPnP client and run the portmapping functions. This rips out anywhere where UPnP used to be in portmapping, and has a flow separate from PMP and PCP. RELNOTE=portmapper now supports UPnP mappings Fixes #682 Updates #2109 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Aaditya Chaudhary	4f89fe17a2	Implemented Commandline Download Speedtest (#2064) ... Added the net/speedtest package that contains code for starting up a speedtest server and a client. The speedtest command for starting a client takes in a duration for the speedtest as well as the host and port of the speedtest server to connect to. The speedtest command for starting a server takes in a host:port pair to listen on. Signed-off-by: Aaditya Chaudhary <32117362+AadityaChaudhary@users.noreply.github.com>	3 years ago
julianknodt	b67a3007d5	cmd/derper: remove default for non-root users ... Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	9d4eddcef8	cmd/derper: add default -c arguments ... This adds some convenient defaults for -c, so that user-provided DERPs require less command line flags. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	ee71c966fd	cmd/derpprobe: bound node pair probe duration ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	e28bc49e5f	netns_linux: remove special handling for tests. ... With netns handling localhost now, existing tests no longer need special handling. The tests set up their connections to localhost, and the connections work without fuss. Remove the special handling for tests. Also remove the hostinfo.TestCase support, since this was the only use of it. It can be added back later if really needed, but it would be better to try to make tests work without special cases. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	d2480fd508	net/netns: support !CAP_NET_ADMIN ... netns_linux checked whether "ip rule" could run to determine whether to use SO_MARK for network namespacing. However in Linux environments which lack CAP_NET_ADMIN, such as various container runtimes, the "ip rule" command succeeds but SO_MARK fails due to lack of permission. SO_BINDTODEVICE would work in these environments, but isn't tried. In addition to running "ip rule" check directly whether SO_MARK works or not. Among others, this allows Microsoft Azure App Service and AWS App Runner to work. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Dan Bond	ceb8c2b34e	cmd/tailscale: update web server test copyright ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Dan Bond	52972679e6	cmd/tailscale: improve web server test structure ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Dan Bond	4c684fcf8c	cmd/tailscale: test web server url func ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Dan Bond	652bbc9aa0	cmd/tailscale: log web listen addr ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Brad Fitzpatrick	1cedd944cf	cmd/tailscale/cli: diagnose missing tailscaled on 'up' ... Fixes #2029 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	61e8fd4698	cmd/derpprobe: move from cmd/derper/derpprobe ... Because our corp build system is confused by nested binaries. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	05da2691a5	cmd/derper/derpprobe: add derp prober ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	87481282eb	ipn: another controlplane synonym ... This one doesn't bother me so much, as long term we want a synonym here. Fixes #2384 Fixes #2386 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	c84d7baf98	cmd/tailscale/cli: factor out more up code for testing ... In theory, some of the other table-driven tests could be moved into this form now but I didn't want to disturb too much good test code. Includes a commented-out test for #2384 that is currently failing. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	92077ae78c	wgengine/magicsock: make portmapping async ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Christine Dodrill	a19eea965f	tstest/integration/vms: use an in-process logcatcher (#2360) ... This adapts the existing in-process logcatcher from tstest/integration into a public type and uses it on the side of testcontrol. This also fixes a bug in the Alpine Linux OpenRC unit that makes every value in `/etc/default/tailscaled` exported into tailscaled's environment, a-la systemd [Service].EnviromentFile. Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Brad Fitzpatrick	a9fc583211	cmd/tailscale/cli: document the web subcommand a bit more ... Fixes #2326 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	700badd8f8	util/deephash: move internal/deephash to util/deephash ... No code changes. Just a minor package doc addition about lack of API stability.	3 years ago
Maisem Ali	ec52760a3d	wgengine/router_windows: support toggling local lan access when using ... exit nodes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Crawshaw	c37713b927	cmd/tailscale/cli: accept login server synonym ... Fixes #2272 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
julianknodt	e68d4d5805	cmd/tailscale: add debug flag to dump derp map ... This adds a flag in tailscale debug for dumping the derp map to stdout. Fixes #2249. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	506c2fe8e2	cmd/tailscale: make netcheck use active DERP map, delete static copy ... After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	3910c1edaf	net/socks5/tssocks: add new package, move SOCKS5 glue out of tailscaled ... Prep for #1970, #2264, #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	82e15d3450	cmd/tailscaled: log SOCKS5 port when port 0 requested ... Part of #2158 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	10d7c2583c	net/dnsfallback: don't depend on derpmap.Prod ... Move derpmap.Prod to a static JSON file (go:generate'd) instead, to make its role explicit. And add a TODO about making dnsfallback use an update-over-time DERP map file instead of a baked-in one. Updates #1264 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	148602a89a	derp,cmd/derper: allow server to verify clients ... This adds a flag to the DERP server which specifies to verify clients through a local tailscaled. It is opt-in, so should not affect existing clients, and is mainly intended for users who want to run their own DERP servers. It assumes there is a local tailscaled running and will attempt to hit it for peer status information. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	0f18801716	cmd/cloner: support maps with clone ptrs ... In order to clone DERPMaps, it was necessary to extend the cloner so that it supports nested pointers inside of maps which are also cloneable. This also adds cloning for DERPRegions and DERPNodes because they are on DERPMap's maps. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	38be964c2b	go.mod: update netstack ... Fixes a atomic alignment crash on 32-bit machines. Fixes #2129 Fixes tailscale/tailscale-synology#66 (same) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	ad288baaea	net/interfaces: use IPv4 link local if nothing better ... The only connectivity an AWS Lambda container has is an IPv4 link-local 169.254.x.x address using NAT: 12: vtarget_1@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 7e:1c:3f:00:00:00 brd ff:ff:ff:ff:ff:ff link-netnsid 1 inet 169.254.79.1/32 scope global vtarget_1 valid_lft forever preferred_lft forever If there are no other IPv4/v6 addresses available, and we are running in AWS Lambda, allow IPv4 169.254.x.x addresses to be used. ---- Similarly, a Google Cloud Run container's only connectivity is a Unique Local Address fddf:3978:feb1:d745::c001/128. If there are no other addresses available then allow IPv6 Unique Local Addresses to be used. We actually did this in an earlier release, but now refactor it to work the same way as the IPv4 link-local support is being done. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
David Crawshaw	297b3d6fa4	staticcheck.conf: turn off noisy lint errors ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
julianknodt	3728634af9	derp: add debug traffic handler ... This adds a handler on the DERP server for logging bytes send and received by clients of the server, by holding open a connection and recording if there is a difference between the number of bytes sent and received. It sends a JSON marshalled object if there is an increase in the number of bytes. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	03311bb0d6	hostinfo: add hostinfo package, move stuff out of controlclient ... And make it cheaper, so other parts of the code can check the environment. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	0022c3d2e2	tsweb: replace NewMux with a more flexible DebugHandler. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	48c25fa36f	tsweb: fold StdHandlerOpts and StdHandler200s with StdHandler. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	ac07ff43bf	cmd/tailscaled: start after NetworkManager and systemd-resolved. ... The dependency is a "soft" ordering dependency only, meaning that tailscaled will start after those services if those services were going to be run anyway, but doesn't force either of them to run. That's why it's safe to specify this dependency unconditionally, even for systems that don't run those services. Updates #2127. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	80a4052593	cmd/tailscale, wgengine, tailcfg: don't assume LastSeen is present [mapver 20] ... Updates #2107 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Christine Dodrill	8b2b899989	tstest/integration: test Alpine Linux (#2098) ... Alpine Linux[1] is a minimal Linux distribution built around musl libc. It boots very quickly, requires very little ram and is as close as you can get to an ideal citizen for testing Tailscale on musl. Alpine has a Tailscale package already[2], but this patch also makes it easier for us to provide an Alpine Linux package off of pkgs in the future. Alpine only offers Tailscale on the rolling-release edge branch. [1]: https://alpinelinux.org/ [2]: https://pkgs.alpinelinux.org/packages?name=tailscale&branch=edge Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Maisem Ali	f944614c5c	cmd/tailscale/web: add support for QNAP ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Matt Layher	6956645ec8	go.mod: bump github.com/mdlayher/netlink to v1.4.1 ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	3 years ago
David Anderson	1c6946f971	cmd/mkpkg: allow zero files in a package. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maisem Ali	95e296fd96	cmd/tailscale/web: restrict web access to synology admins. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Adrian Dewhurst	6d6cf88d82	control/controlclient: use our fork of certstore ... The cyolosecurity fork of certstore did not update its module name and thus can only be used with a replace directive. This interferes with installing using `go install` so I created a tailscale fork with an updated module name. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago