606 Commits (04d24d3a38da5469458f56ddf8f8575175c02603)

Author	SHA1	Message	Date
Alex Brainman	7689213aaa	cmd/tailscaled: add subcommands to install and remove tailscaled Windows service ... This change implements Windows version of install-system-daemon and uninstall-system-daemon subcommands. When running the commands the user will install or remove Tailscale Windows service. Updates #1232 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	4 years ago
Brad Fitzpatrick	f99e63bb17	ipn: don't Logout when Windows GUI disconnects ... Logout used to be a no-op, so the ipnserver previously synthensized a Logout on disconnect. Now that Logout actually invalidates the node key that was forcing all GUI closes to log people out. Instead, add a method to LocalBackend to specifically mean "the Windows GUI closed, please forget all the state". Fixes tailscale/corp#1591 (ignoring the notification issues, tracked elsewhere) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f42ded7acf	cmd/tailscale/cli: relax & improve the running-as-CLI check for macOS ... On macOS, we link the CLI into the GUI executable so it can be included in the Mac App Store build. You then need to run it like: /Applications/Tailscale.app/Contents/MacOS/Tailscale <command> But our old detection of whether you're running that Tailscale binary in CLI mode wasn't accurate and often bit people. For instance, when they made a typo, it then launched in GUI mode and broke their existing GUI connection (starting a new IPNExtension) and took down their network. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	8f3e453356	ipn, cmd/tailscale/cli: add pref to configure sudo-free operator user ... From discussion with @danderson. Fixes #1684 (in a different way) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	49808ae6ea	ipn{,/ipnlocal}, cmd/tailscale/cli: don't check pref reverts on initial up ... The ipn.NewPrefs func returns a populated ipn.Prefs for historical reasons. It's not used or as important as it once was, but it hasn't yet been removed. Meanwhile, it contains some default values that are used on some platforms. Notably, for this bug (#1725), Windows/Mac use its Prefs.RouteAll true value (to accept subnets), but Linux users have always gotten a "false" value for that, because that's what cmd/tailscale's CLI default flag is _for all operating systems_. That meant that "tailscale up" was rightfully reporting that the user was changing an implicit setting: RouteAll was changing from true with false with the user explicitly saying so. An obvious fix might be to change ipn.NewPrefs to return Prefs.RouteAll == false on some platforms, but the logic is complicated by darwin: we want RouteAll true on windows, android, ios, and the GUI mac app, but not the CLI tailscaled-on-macOS mode. But even if we used build tags (e.g. the "redo" build tag) to determine what the default is, that then means we have duplicated and differing "defaults" between both the CLI up flags and ipn.NewPrefs. Furthering that complication didn't seem like a good idea. So, changing the NewPrefs defaults is too invasive at this stage of the release, as is removing the NewPrefs func entirely. Instead, tweak slightly the semantics of the ipn.Prefs.ControlURL field. This now defines that a ControlURL of the empty string means both "we're uninitialized" and also "just use the default". Then, once we have the "empty-string-means-unintialized" semantics, use that to suppress "tailscale up"'s recent implicit-setting-revert checking safety net, if we've never initialized Tailscale yet. And update/add tests. Fixes #1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4df6e62fbc	ipn: add DefaultControlURL const, replace few literals with it ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f1d45bc4bb	cmd/tailscale/cli: pull out prefsFromUpArgs for testability, add tests ... Will add more tests later but this locks in all the existing warnings and errors at least, and some of the existing non-error behavior. Mostly I want this to exist before I actually fix #1725. Updates #1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4948ff6ecb	cmd/tailscale/cli: treat nil and non-nil zero length slices as equiv prefs ... Updates #1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	eb6115e295	cmd/tailscaled: let SOCKS5 dial non-Tailscale addrs in userspace mode ... Fixes #1617 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	2f422434aa	cmd/tailscale/cli: wait on the right contexts in up ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6da812b4cf	cmd/tailscale/cli: avoid a spammy log message on SIGINT ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Ross Zurowski	c748c20fba	cmd/tailscale: fix command descriptions (#1710) ... Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	4 years ago
Naman Sood	5ea53891fe	cmd/tailscaled: populate netstack variable to use dialer in SOCKS5 ... Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	75b99555f3	cmd/tailscale/cli: let ip take a peername ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	762180595d	ipn/ipnstate: add PeerStatus.TailscaleIPs slice, deprecate TailAddr ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a8d95a18b2	cmd/tailscale/cli: add up --unattended for Windows ... RELNOTE=Windows CLI behavior change: ForceDaemon now off by default Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a08d978476	cmd/tailscale/cli: make push get peerapi base via localapi, not TSMP ping ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1dc2cf4835	cmd/tailscale/cli: add push --targets to list possible targets ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d17f96b586	cmd/tailscale/cli: restore SIGINT/SIGTERM on context cancel ... This fixes Ctrl-C not interrupting "tailscale push". Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	db5e269463	client/tailscale/apitype: move local API types to new apitype package ... They were scattered/duplicated in misc places before. It can't be in the client package itself for circular dep reasons. This new package is basically tailcfg but for localhost communications, instead of to control. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	1b9d8771dc	ipn/ipnlocal,wgengine/router,cmd/tailscale: add flag to allow local lan access when routing traffic via an exit node. ... For #1527 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
David Anderson	854d5d36a1	net/dns: return error from NewOSManager, use it to initialize NM. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	9972c02b60	cmd/tailscale/cli: don't let up change prefs based on implicit flag values ... This changes the behavior of "tailscale up". Previously "tailscale up" always did a new Start and reset all the settings. Now "tailscale up" with no flags just brings the world [back] up. (The opposite of "tailscale down"). But with flags, "tailscale up" now only is allowed to change preferences if they're explicitly named in the flags. Otherwise it's an error. Or you need to use --reset to explicitly nuke everything. RELNOTE=tailscale up change Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	00d641d9fc	ipn/localapi: move EditPrefs to localapi ... Follow-up/revision to recent 53cfff109b which added EditPrefs. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	5480189313	net/dns: implement a DNS override workaround for legacy resolvconf. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	958782c737	cmd/{tailscale,tailscaled}: use netstack for subnet routing on Synology ... Updates #707 Fixes #451 Fixes tailscale/tailscale-synology#52 (just make it work by default) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	3b451509dd	cmd/tailscale/cli: make advertise-{routes,exit-node} available unconditionally ... It was only Linux and BSDs before, but now with netstack mode, it also works on Windows and darwin. It's not worth limiting it to certain platforms. Tailscaled itself can complain/fail if it doesn't like the settings for the mode/OS it's operating under. Updates #707 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	83402e2753	cmd/tailscale/cli: show nicer status output when logged out ... Also nicer output when running "down". Fixes #1680 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	3167e55ddf	ipn/{ipnlocal,localapi}, cmd/tailscale: add logout command ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6a7912e37a	cmd/tailscale/cli: add debug mode to push slowly for testing ... Also set Content-Length when known, and fail explicitly on sending directories for now. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	950fc28887	ipn, paths, cmd/tailscaled: remove LegacyConfigPath, relaynode migration ... It is time. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	50b309c1eb	ipn/localapi, cmd/tailscale: add API to get prefs, CLI debug command to show ... Updates #1436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d4b609e138	cmd/tailscale/cli: fix bug in earlier tailscale debug --local-creds addition ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	799973a68d	ipn: move Options.Notify to its own method ... We already had SetNotifyCallback elsewhere on controlclient, so use that name. Baby steps towards some CLI refactor work. Updates tailscale/tailscale#1436	4 years ago
Brad Fitzpatrick	d488678fdc	cmd/tailscaled, wgengine{,/netstack}: add netstack hybrid mode, add to Windows ... For #707 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1f99f889e1	ipn/{ipnlocal,localapi}: add localapi handler to dial/proxy file PUTs ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ea9e68280d	cmd/tailscale/cli: add debug command to print localapi curl command	4 years ago
David Anderson	bc4381447f	net/tstun: return the real interface name at device creation. ... This is usually the same as the requested interface, but on some unixes can vary based on device number allocation, and on Windows it's the GUID instead of the pretty name, since everything relating to configuration wants the GUID. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7d84ee6c98	net/dns: unify the OS manager and internal resolver. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4c61ebacf4	wgengine: move DNS configuration out of wgengine/router. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	b3ceca1dd7	wgengine/...: split into multiple receive functions ... Upstream wireguard-go has changed its receive model. NewDevice now accepts a conn.Bind interface. The conn.Bind is stateless; magicsock.Conns are stateful. To work around this, we add a connBind type that supports cheap teardown and bring-up, backed by a Conn. The new conn.Bind allows us to specify a set of receive functions, rather than having to shoehorn everything into ReceiveIPv4 and ReceiveIPv6. This lets us plumbing DERP messages directly into wireguard-go, instead of having to mux them via ReceiveIPv4. One consequence of the new conn.Bind layer is that closing the wireguard-go device is now indistinguishable from the routine bring-up and tear-down normally experienced by a conn.Bind. We thus have to explicitly close the magicsock.Conn when the close the wireguard-go device. One downside of this change is that we are reliant on wireguard-go to call receiveDERP to process DERP messages. This is fine for now, but is perhaps something we should fix in the future. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	f77ba75d6c	wgengine/router: move DNS cleanup into the DNS package. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	39b9ab3522	cmd/tailscaled: rename isUserspace to useNetstack ... The bool was already called useNetstack at the caller. isUserspace (to mean netstack) is confusing next to wgengine.NewUserspaceEngine, as that's a different type of 'userspace'. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	90f82b6946	net/dns/resolver: add live reconfig, plumb through to ipnlocal. ... The resolver still only supports a single upstream config, and ipn/wgengine still have to split up the DNS config, but this moves closer to unifying the DNS configs. As a handy side-effect of the refactor, IPv6 MagicDNS records exist now. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d99f5b1596	net/dns/resolver: factor the resolver out into a sub-package. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	53cfff109b	ipn: replace SetWantRunning(bool) with EditPrefs(MaskedPrefs) ... This adds a new ipn.MaskedPrefs embedding a ipn.Prefs, along with a bunch of "has bits", kept in sync with tests & reflect. Then it adds a Prefs.ApplyEdits(MaskedPrefs) method. Then the ipn.Backend interface loses its weirdo SetWantRunning(bool) method (that I added in 483141094c for "tailscale down") and replaces it with EditPrefs (alongside the existing SetPrefs for now). Then updates 'tailscale down' to use EditPrefs instead of SetWantRunning. In the future, we can use this to do more interesting things with the CLI, reconfiguring only certain properties without the reset-the-world "tailscale up". Updates #1436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	1c98c5f103	cmd/tailscaled: remove tailscaled binary on uninstall-system-daemon ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Maisem Ali	db13b2d0c8	cmd/tailscale, ipn/localapi: add "tailscale bugreport" subcommand ... Adding a subcommand which prints and logs a log marker. This should help diagnose any issues that users face. Fixes #1466 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	1bd14a072c	cmd/tailscale, ipn/localapi: move IP forwarding check to tailscaled, API ... Instead of having the CLI check whether IP forwarding is enabled, ask tailscaled. It has a better idea. If it's netstack, for instance, the sysctl values don't matter. And it's possible that only the daemon has permission to know. Fixes #1626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Crawshaw	ea714c6054	cmd/tailscale/cli: split out web.css file ... CSS formatted with: npx prettier --use-tabs --write cmd/tailscale/cli/web.css Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Ross Zurowski	8d57bce5ef	cmd/tailscale: add initial web UI (#1621) ... Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	4 years ago
Brad Fitzpatrick	6d1a9017c9	ipn/{ipnlocal,localapi}, client/tailscale: add file get/delete APIs ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	0301ccd275	cmd/tailscale/cli: add debug --ipn mode ... To watch the IPN message bus. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Crawshaw	e67f1b5da0	client/tailscale, cmd/tailscale/cli: plumb --socket through ... Without this, `tailscale status` ignores the --socket flag on macOS and always talks to the IPNExtension, even if you wanted it to inspect a userspace tailscaled. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Brad Fitzpatrick	3a1eae5b6b	cmd/tailscale/cli: factor out filename selection ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1e26d4ae19	cmd/tailscale/cli: add push subcommand ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	eeacf84dae	cmd/tailscale/cli: factor out tailscaleIPFromArg from ping command ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	41e4e02e57	net/{packet,tstun}: send peerapi port in TSMP pongs ... For discovery when an explicit hostname/IP is known. We'll still also send it via control for finding peers by a list. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Crawshaw	f0863346c2	cmd/tailscale: add web subcommand ... Used as an app frontend UI on Synology. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
David Anderson	0fb738760f	wgengine: make Tun optional again, default to fake. ... This makes setup more explicit in prod codepaths, without requiring a bunch of arguments or helpers for tests and userspace mode. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	93a4aa697c	wgengine: default Router to a no-op router. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	440effb21a	wgengine: remove Config.TUN argument.	4 years ago
David Anderson	2df8adef9d	wgengine: make the tun.Device required at construction. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	82ab7972f4	net/tstun: rename NewFakeTUN to NewFake. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	588b70f468	net/tstun: merge in wgengine/tstun. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	018200aeba	net/tstun: rename from net/tun. ... We depend on wireguard-go/tun, identical leaf packages can be confusing in code. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	2b4bfeda1a	wgengine: pass in an explicit router.Router, rather than a generator. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9ea5cbf81f	cmd/tailscaled: readd tun.Diagnose call, mistakenly lost during refactor. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	44d9929208	wgengine: remove Config.TUNName, require caller to create device. ... Also factors out device creation and associated OS workarounds to net/tun. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Adrian Dewhurst	04dd6d1dae	control/controlclient: sign RegisterRequest (#1549) ... control/controlclient: sign RegisterRequest Some customers wish to verify eligibility for devices to join their tailnets using machine identity certificates. TLS client certs could potentially fulfill this role but the initial customer for this feature has technical requirements that prevent their use. Instead, the certificate is loaded from the Windows local machine certificate store and uses its RSA public key to sign the RegisterRequest message. There is room to improve the flexibility of this feature in future and it is currently only tested on Windows (although Darwin theoretically works too), but this offers a reasonable starting place for now. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago
David Anderson	9f7f2af008	wgengine/router/dns: move to net/dns. ... Preparation for merging the APIs and whatnot. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	dad10fee9c	Revert "cmd/tailscaled: split package main into main shim + package" ... This reverts commit b81bd8025b. Not needed. See: https://github.com/golang/go/wiki/Modules#how-can-i-track-tool-dependencies-for-a-module	4 years ago
Brad Fitzpatrick	82c4cb765c	cmd/tailscaled: split package main into main shim + package ... So we can empty import the guts of cmd/tailscaled from another module for go mod tidy reasons. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b7f0e39bf2	cmd/tailscale: add "tailscale ip [-4] [-6]" command ... This adds an easy and portable way for us to document how to get your Tailscale IP address. $ tailscale ip 100.74.70.3 fd7a:115c:a1e0:ab12:4843:cd96:624a:4603 $ tailscale ip -4 100.74.70.3 $ tailscale ip -6 fd7a:115c:a1e0:ab12:4843:cd96:624a:4603 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	2384c112c9	net/packet, wgengine/{filter,tstun}: add TSMP ping ... Fixes #1467 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	01b90df2fa	net/packet, wgengine/filter: support SCTP ... Add proto to flowtrack.Tuple. Add types/ipproto leaf package to break a cycle. Server-side ACL work remains. Updates #1516 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	0406a7436a	cmd/tailscale/cli: use double hypens, make default usage func more clear ... Mash up some code from ffcli and std's flag package to make a default usage func that's super explicit for those not familiar with the Go style flags. Only show double hyphens in usage text (but still accept both), and show default values, and only show the proper usage of boolean flags. Fixes #1353 Fixes #1529 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	0a02aaf813	control, ipn, tailcfg: remove golang.org/x/oauth2 dep, add tailcfg.Oauth2Token ... golang.org/x/oauth2 pulls in App Engine and grpc module dependencies, screwing up builds that depend on this module. Some background on the problem: https://go.googlesource.com/proposal/+/master/design/36460-lazy-module-loading.md Fixes tailscale/corp#1471 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Aleksandar Pesic	7b57310966	net/interfaces: use windows API to get the default route instead of parsing `route print` output ... Fixes: #1470 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Brad Fitzpatrick	439d70dce2	cmd/tailscale, ipn/localapi: get daemon version from localapi status ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d0dffe33c0	cmd/tailscale, ipn/localapi: use localapi for status, not IPN acrobatics ... Yay simpler code. Tested on Linux, macOS and Windows. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	0c3e9722cc	cmd/tailscale/cli: fix typo in comment ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	a480b1baa5	logpolicy: set log target on windows based on a registry key (#1542) ... Signed-off-by: Christine Dodrill <xe@tailscale.com>	4 years ago
Brad Fitzpatrick	aa79a57f63	wgengine/netstack: use inet.af/netstack, remove 64-bit only limitation ... This reverts the revert commit 84aba349d9. And changes us to use inet.af/netstack. Updates #1518 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	84aba349d9	Revert "wgengine/netstack: update gvisor to remove 64-bit only limitation" ... Breaks our corp repo due to gRPC dependency hell. This reverts commit d42f8b7f9a.	4 years ago
Brad Fitzpatrick	27c4dd9a97	Revert "cmd/tailscaled, ipn/{ipnlocal,ipnserver}: let netstack get access to LocalBackend" ... This reverts commit 2bc518dcb2. @namansood didn't end up needing it in his 770aa71ffb.	4 years ago
Brad Fitzpatrick	d42f8b7f9a	wgengine/netstack: update gvisor to remove 64-bit only limitation ... gVisor fixed their google/gvisor#1446 so we can include gVisor mode on 32-bit machines. A few minor upstream API changes, as normal. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	98ab533324	cmd/tailscale/cli: include GOOS in BSD warning message ... instead of just lowercase "bsd" Updates #1475 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	380a3526f6	cmd/tailscale/cli: warn if using subnet routing on BSD ... Fixes #1475. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Naman Sood	770aa71ffb	client, cmd/hello, ipn, wgengine: fix whois for netstack-forwarded connections ... Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	44ab0acbdb	net/portmapper, wgengine/monitor: cache gateway IP info until link changes ... Cuts down allocs & CPU in steady state (on regular STUN probes) when network is unchanging. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	deff20edc6	cmd/tailscale/cli: don't permit setting self IP as exit node (#1491) ... This change makes it impossible to set your own IP address as the exit node for this system. Fixes #1489 Signed-off-by: Christine Dodrill <xe@tailscale.com>	4 years ago
Brad Fitzpatrick	2bc518dcb2	cmd/tailscaled, ipn/{ipnlocal,ipnserver}: let netstack get access to LocalBackend ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d491adbf09	cmd/tailscaled: on Synology, fall back to netstack if needed ... Updates tailscale/tailscale-synology#35 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	cc99059fc2	Revert "--advertise-routes option enabled in Mac tailscale CLI; it checks for IP forwarding enabled" ... This reverts commit 08949d4ef1. I think this code was aspirational. There's no code that sets up the appropriate NAT code using pfctl/etc. See #911 and #1475. Updates #1475 Updates #911	4 years ago
Brad Fitzpatrick	66480755c2	cmd/tailscale/cli: document how to see subcommand usage ... From user feedback. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d3e56aa979	cmd/tailscaled: fix monitor debug tool's output ... Logic was backwards, introduced in earlier monitor refactoring last week in e3df29d488. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Aleksandar Pesic	258d0e8d9a	wgengine/monitor: simplify the Windows monitor to make it more reliable ... Updates tailscale/tailscale#1414 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Brad Fitzpatrick	bc159dc689	cmd/tailscale: fix depaware.txt ... git fail. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c136f48b79	cmd/tailscale/cli: restore hidden debug subcommand ... The debub subcommand was moved in 6254efb9ef because the monitor brought in tons of dependencies to the cmd/tailscale binary, but there wasn't any need to remove the whole subcommand itself. Add it back, with a tool to dump the local daemon's goroutines. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	0d0ec7853c	cmd/tailscaled: don't require root on darwin with --tun=userspace-networking ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c0cdca6d06	cmd/tailscaled, logtail: share link monitor from wgengine to logtail ... Part of overall effort to clean up, unify, use link monitoring more, and make Tailscale quieter when all networks are down. This is especially bad on macOS where we can get killed for not being polite it seems. (But we should be polite in any case) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	793cb131f0	wgengine/router: toggle killswitch when using default routes on windows. ... Fixes #1398. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	30a37622b4	cmd/hello: break out local HTTP client into client/tailscale ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b46e337cdc	cmd/hello: use go:embed for the template ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	9df4185c94	control/controlclient, net/{dnscache,dnsfallback}: add DNS fallback mechanism ... Updates #1405 Updates #1403 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	03c344333e	cmd/tailscale: remove Windows console fixing ... Not needed, as we don't build this as a GUI app ever. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e3df29d488	wgengine{,/monitor}: move interface state fetching/comparing to monitor ... Gets it out of wgengine so the Engine isn't responsible for being a callback registration hub for it. This also removes the Engine.LinkChange method, as it's no longer necessary. The monitor tells us about changes; it doesn't seem to need any help. (Currently it was only used by Swift, but as of 14dc790137 we just do the same from Go) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	38dc6fe758	cmd/tailscaled, wgengine: remove --fake, replace with netstack ... And add a --socks5-server flag. And fix a race in SOCKS5 replies where the response header was written concurrently with the copy from the backend. Co-authored with Naman Sood. Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ee6475a44d	wgengine: unify NewUserspaceEngine, NewUserspaceEngineAdvanced ... Also rename EngineConfig to Config to avoid wgengine.EngineConfig stutter. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	dda03a911e	wgengine/monitor: change API to permit multiple independent callbakcks ... Currently it assumes exactly 1 registered callback. This changes it to support 0, 1, or more than 1. This is a step towards plumbing wgengine/monitor into more places (and moving some of wgengine's interface state fetching into monitor in a later step) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	fec9dcbda1	wgengine/netstack: start SOCKS5 server in netstack mode ... Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	f68431fc02	cmd/derper: add /bootstrap-dns handler ... For option (d) of #1405. For an HTTPS request of /bootstrap-dns, this returns e.g.: { "log.tailscale.io": [ "2600:1f14:436:d603:342:4c0d:2df9:191b", "34.210.105.16" ], "login.tailscale.com": [ "2a05:d014:386:203:f8b4:1d5a:f163:e187", "3.121.18.47" ] } Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	99d67493be	cmd/derper: update a link from godoc.org to pkg.go.dev ... Save a redirect. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	3fd00c4a40	cmd/tailscaled: create /usr/local/bin on macOS install-system-daemon if needed ... Fixes #1400 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	517c90d7e5	wgengine, cmd/tailscaled: refactor netstack, forward TCP to hello as demo (#1301) ... Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
David Anderson	ebf3f2fd9f	cmd/tailscale/cli: add CLI option to offer an exit node to the tailnet. ... Finishes up linux part of #1154. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	c64bd587ae	net/portmapper: add NAT-PMP client, move port mapping service probing ... * move probing out of netcheck into new net/portmapper package * use PCP ANNOUNCE op codes for PCP discovery, rather than causing short-lived (sub-second) side effects with a 1-second-expiring map + delete. * track when we heard things from the router so we can be less wasteful in querying the router's port mapping services in the future * use portmapper from magicsock to map a public port Fixes #1298 Fixes #1080 Fixes #1001 Updates #864 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Matt Layher	2c500cee23	go.mod: bump github.com/mdlayher/netlink, github.com/jsimonetti/rtnetlink ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Brad Fitzpatrick	86d3a6c9a6	Switch to Go 1.16. ... Fixes #1370 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	826f64e863	cmd/tailscale/cli: add netcheck dev knob TS_DEBUG_NETCHECK_UDP_BIND	4 years ago
Brad Fitzpatrick	7ad3af2141	cmd/tailscale/cli: remove outdated TODO ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Sonia Appasamy	76fb27bea7	dnsname,tailcfg: add hostname sanitation logic to node display names (#1304) ... Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	4 years ago
Brad Fitzpatrick	fd8e070d01	health, control/controlclient, wgengine: report when router unhealthy ... Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	38629b62fc	cmd/tailscaled: on darwin, fail early if not root with nicer message ... Don't do it on all platforms, as Linux folk might be playing container + capability games.	4 years ago
Brad Fitzpatrick	d3efe8caf6	safesocket, ipn/ipnserver: look up peer creds on Darwin ... And open up socket permissions like Linux, now that we know who connections are from. This uses the new inet.af/peercred that supports Linux and Darwin at the moment. Fixes #1347 Fixes #1348 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	dec01ef22b	safesocket: make ConnectDefault use paths pkg, fixing tailscaled-on-macOS ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	7e00100a0a	cmd/hello: make whois client work on macOS against GUI client ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	fdac0387a7	ipn/ipnserver, ipn/ipnlocal: move whois handler to new localapi package	4 years ago
Brad Fitzpatrick	d7569863b5	cmd/tailscaled: fix up install-system-daemon on darwin, add uninstall too ... Tangentially related to #987, #177, #594, #925, #505	4 years ago
Brad Fitzpatrick	52e24aa966	net/{interfaces,ns}: add tailscaled-mode darwin routing looping prevention ... Fixes #1331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	29b028b9c4	cmd/tailscaled: add subcommand on darwin to install+start tailscaled under launchd ... Tangentially related to #987, #177, #594, #925.	4 years ago
Brad Fitzpatrick	741d654aa3	derp/derphttp: add a context and infoLogger option to RunWatchConnectionLoop	4 years ago
Brad Fitzpatrick	6680976b50	cmd/tailscaled: pick automatic tun device name on darwin	4 years ago
Ross Zurowski	25321cbd01	cmd/hello: truncate long strings (#1328) ... Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	4 years ago
Brad Fitzpatrick	5378776043	cmd/hello: chop DNS name at first dot	4 years ago
Ross Zurowski	6075135e0a	cmd/hello: style welcome message (#1325) ... Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	4 years ago
Brad Fitzpatrick	34ffd4f7c6	cmd/hello: serve fake data in dev mode on whois failure	4 years ago
Brad Fitzpatrick	de3001bc79	cmd/hello: in dev mode, live reload template	4 years ago
Brad Fitzpatrick	1e7a35b225	types/netmap: split controlclient.NetworkMap off into its own leaf package ... Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ddfcc4326c	types/persist: split controlclient.Persist into a small leaf package ... This one alone doesn't modify the global dependency map much (depaware.txt if anything looks slightly worse), but it leave controlclient as only containing NetworkMap: bradfitz@tsdev:~/src/tailscale.com/ipn$ grep -F "controlclient." *.go backend.go: NetMap *controlclient.NetworkMap // new netmap received fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) handle.go: netmapCache *controlclient.NetworkMap handle.go:func (h *Handle) NetMap() *controlclient.NetworkMap { Once that goes into a leaf package, then ipn doesn't depend on controlclient at all, and then the client gets smaller. Updates #1278	4 years ago
David Anderson	a046b48593	cmd/tailscale/cli: display currently active exit node in `tailscale status`. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	6064b6ff47	wgengine/wgcfg/nmcfg: split control/controlclient/netmap.go into own package ... It couldn't move to ipnlocal due to test dependency cycles. Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	b9c2231fdf	ipn: program exit node into the data plane according to user pref. ... Part of #1153, #1154. Fixes #1224. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	fb6b0e247c	cmd/tailscaled: rename Windows service to just Tailscale ... Updates #1232	4 years ago
Brad Fitzpatrick	a7562be5e1	cmd/tailscaled: move more of the Windows server setup code into tailscaled ... Updates #1232	4 years ago
Brad Fitzpatrick	6f7974b7f2	cmd/tailscaled: add missing depaware.txt update	4 years ago
Brad Fitzpatrick	6099ecf7f4	cmd/tailscaled: run as a service on Windows ... Updates #1232	4 years ago
Josh Bleecher Snyder	aa6856a9eb	wgengine: adapt to wireguard-go changes ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	d76334d2f0	ipn: split LocalBackend off into new ipn/ipnlocal package ... And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6254efb9ef	cmd/tailscale{,d}: move debug subcommand to tailscaled ... Work on reducing the size of the tailscale binary, which is currently pulling in most of the same code as tailscaled. Updates #1181	4 years ago
Brad Fitzpatrick	9a70789853	cmd/tailscale: fix IPN message reading stall in tailscale status -web ... Fixes #1234 Updates #1254	4 years ago
Brad Fitzpatrick	c7d4bf2333	cmd/tailscale/cli: recommend sudo for 'tailscale up' on failure ... Fixes #1220	4 years ago
Brad Fitzpatrick	2889fabaef	cmd/tailscaled/tailscaled.service: revert recent hardening for now ... It broke Debian Stretch. We'll try again later. Updates #1245 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	60e189f699	cmd/hello: use safesocket client to connect	4 years ago
Brad Fitzpatrick	006a224f50	ipn/ipnserver, cmd/hello: do whois over unix socket, not debug http ... Start of a local HTTP API. Not a stable interface yet.	4 years ago
Josh Bleecher Snyder	fe7c3e9c17	all: move wgcfg from wireguard-go ... This is mostly code movement from the wireguard-go repo. Most of the new wgcfg package corresponds to the wireguard-go wgcfg package. wgengine/wgcfg/device{_test}.go was device/config{_test}.go. There were substantive but simple changes to device_test.go to remove internal package device references. The API of device.Config (now wgcfg.DeviceConfig) grew an error return; we previously logged the error and threw it away. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	0bc73f8e4f	cmd/hello: new hello.ipn.dev server ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	de497358b8	cmd/tailscaled: add /run to the allowed paths for iptables. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	692a011b54	net/interfaces: remove IsTailscaleIP, make callers use tsaddr. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	a7edcd0872	ipn/ipnstate: update tailscale status -web to match CLI	4 years ago
Sonia Appasamy	567c5a6d9e	tailcfg, controlclient: add DisplayName field to tailcfg.Node and populate it from controlclient (#1191) ... Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	4 years ago
Brad Fitzpatrick	9ce92aad3e	cmd/tailscaled: update depaware.txt	4 years ago
Brad Fitzpatrick	eb47cba435	cmd/tailscaled: don't require --state for --cleanup	4 years ago
Josh Bleecher Snyder	d5baeeed5c	wgengine: use Tailscale-style peer identifiers in logs ... Rewrite log lines on the fly, based on the set of known peers. This enables us to use upstream wireguard-go logging, but maintain the Tailscale-style peer public key identifiers that the rest of our systems (and people) expect. Fixes #1183 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	4306433d1c	cmd/tailscale: make "tailscale ping" also resolve names without DNS ... This lets "tailscale ping $NAME" work even if MagicDNS is off, letting you ping a name that shows up in "tailscale status". More user friendly.	4 years ago
Brad Fitzpatrick	9541886856	wgengine/magicsock: disable regular STUNs for all platforms by default ... Reduces background CPU & network. Updates #1034 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	ab9cccb292	cmd/tailscale/cli: require v4 and v6 default routes to be advertised together. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	a45665426b	cmd/tailscale/cli: tweak the status name column a bit ... * make peers without DNS names show their hostnames as always one column, for cut/etc users * remove trailing dot from shared peers' DNS names	4 years ago
Josh Bleecher Snyder	654b5f1570	all: convert from []wgcfg.Endpoint to string ... This eliminates a dependency on wgcfg.Endpoint, as part of the effort to eliminate our wireguard-go fork. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	9abcb18061	wgengine/magicsock: import more of wireguard-go, update docstrings. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	22507adf54	wgengine/magicsock: stop depending on UpdateDst in legacy codepaths. ... This makes connectivity between ancient and new tailscale nodes slightly worse in some cases, but only in cases where the ancient version would likely have failed to get connectivity anyway. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	85e54af0d7	wgengine: on TCP connect fail/timeout, log some clues about why it failed ... So users can see why things aren't working. A start. More diagnostics coming. Updates #1094	4 years ago
Brad Fitzpatrick	d6e9fb1df0	all: adjust Unix permissions for those without umasks ... Fixes tailscale/corp#1165 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f85769b1ed	wgengine/magicsock: drop netaddr.IPPort cache ... netaddr.IP no longer allocates, so don't need a cache or all its associated code/complexity. This totally removes groupcache/lru from the deps. Also go mod tidy.	4 years ago
Brad Fitzpatrick	a80446c026	Update depaware (removes lru from wgengine/filter)	4 years ago
Naman Sood	f69e46175d	wengine/netstack: bump gvisor to latest version ... * wengine/netstack: bump gvisor to latest version Signed-off-by: Naman Sood <naman@tailscale.com> * update dependencies Signed-off-by: Naman Sood <naman@tailscale.com> * Don't change hardcoded IP Signed-off-by: Naman Sood <naman@tailscale.com>	4 years ago
Brad Fitzpatrick	5aa5db89d6	cmd/tailscaled, wgengine/netstack: add start of gvisor userspace netstack work ... Not usefully functional yet (mostly a proof of concept), but getting it submitted for some work @namansood is going to do atop this. Updates #707 Updates #634 Updates #48 Updates #835	4 years ago
Brad Fitzpatrick	5efb0a8bca	cmd/tailscale: change formatting of "tailscale status" ... * show DNS name over hostname, removing domain's common MagicDNS suffix. only show hostname if there's no DNS name. but still show shared devices' MagicDNS FQDN. * remove nerdy low-level details by default: endpoints, DERP relay, public key. They're available in JSON mode still for those who need them. * only show endpoint or DERP relay when it's active with the goal of making debugging easier. (so it's easier for users to understand what's happening) The asterisks are gone. * remove Tx/Rx numbers by default for idle peers; only show them when there's traffic. * include peers' owner login names * add CLI option to not show peers (matching --self=true, --peers= also defaults to true) * sort by DNS/host name, not public key * reorder columns	4 years ago
Josh Bleecher Snyder	1271e135cd	wgengine/tstun: initialize wireguard-go TUN parameters ... This will enable us to remove the corresponding code from our fork of wireguard-go. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Frederik “Freso” S. Olesen	83fccf9fe5	tailscaled.service: Lock down clock and /dev (#1071) ... Research in issue #1063 uncovered why tailscaled would fail with ProtectClock enabled (it implicitly enabled DevicePolicy=closed). This knowledge in turn also opens the door for locking down /dev further, e.g. explicitly setting DevicePolicy=strict (instead of closed), and making /dev private for the unit. Additional possible future (or downstream) lockdown that can be done is setting `PrivateDevices=true` (with `BindPaths=/dev/net/`), however, systemd 233 or later is required for this, and tailscaled currently need to work for systemd down to version 215. Closes https://github.com/tailscale/tailscale/issues/1063 Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>	4 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package ... This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Charlotte Brandhorst-Satzkorn	ff2b3d02e6	Fix typo in cmd/tailscale/cli/cli.go (#1069) ... Remove duplicate 'to connect' in error message. Fixes #1068 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@catzkorn.dev>	4 years ago
Frederik “Freso” S. Olesen	a9a80ab372	tailscaled.service: Harden systemd unit somewhat (#1062) ... While not a full capability lockdown of the systemd unit, this still improves sandboxing and security of the running process a good deal. Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>	4 years ago
Matt Layher	1a42cef3a2	cmd/tailscale*: make updatedeps ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Brad Fitzpatrick	d0baece5fa	go.mod: bump inet.af/netaddr to non-allocating version	4 years ago
Brad Fitzpatrick	15c064f76f	wgengine/router/dns: remove unsafe endianness detection on Linux	4 years ago
Brad Fitzpatrick	57dd247376	cmd/tailscaled, logpolicy, logtail: support log levels ... Log levels can now be specified with "[v1] " or "[v2] " substrings that are then stripped and filtered at the final logger. This follows our existing "[unexpected]" etc convention and doesn't require a wholesale reworking of our logging at the moment. cmd/tailscaled then gets a new --verbose=N flag to take a log level that controls what gets logged to stderr (and thus systemd, syslog, etc). Logtail is unaffected by --verbose. This commit doesn't add annotations to any existing log prints. That is in the next commit. Updates #924 Updates #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	2485faf69a	Merge branch 'main' into report-status-systemd	4 years ago
Christine Dodrill	7ea809897d	ipn/ipnserver: enable systemd-notify support ... Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>	4 years ago
Josh Bleecher Snyder	34a0292433	depaware.txt: update ... Upgrading staticcheck upgraded golang.org/x/sync (one downside of mixing our tools in with our regular go.mod), which introduced a new dependency via https://go-review.googlesource.com/c/sync/+/251677 That CL could and probably should be written without runtime/debug, but it's not clear to me that that is better at this moment than simply accepting the additional package as a dependency. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Aleksandar Pesic	4749a96a5b	Update depaware.txt files. ... Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Brad Fitzpatrick	bce865b61b	logpolicy: migrate from x/crypto/ssh/terminal to x/term	4 years ago
Brad Fitzpatrick	c0af7deb86	tailcfg, cmd/tailscale: add Hostinfo.ShareeNode, hide in "tailscale status"	4 years ago
Josh Bleecher Snyder	aa9d7f4665	tstime: add Parse3339B, for byte slices ... Use go4.org/mem for memory safety. A slight performance hit, but a huge performance win for clients who start with a []byte. The perf hit is due largely to the MapHash call, which adds ~25ns. That is necessary to keep the fast path allocation-free. name old time/op new time/op delta GoParse3339/Z-8 281ns ± 1% 283ns ± 2% ~ (p=0.366 n=9+9) GoParse3339/TZ-8 509ns ± 0% 510ns ± 1% ~ (p=0.059 n=9+9) GoParse3339InLocation-8 330ns ± 1% 330ns ± 0% ~ (p=0.802 n=10+6) Parse3339/Z-8 69.3ns ± 1% 74.4ns ± 1% +7.45% (p=0.000 n=9+10) Parse3339/TZ-8 110ns ± 1% 140ns ± 3% +27.42% (p=0.000 n=9+10) ParseInt-8 8.20ns ± 1% 8.17ns ± 1% ~ (p=0.452 n=9+9) name old alloc/op new alloc/op delta GoParse3339/Z-8 0.00B 0.00B ~ (all equal) GoParse3339/TZ-8 160B ± 0% 160B ± 0% ~ (all equal) GoParse3339InLocation-8 0.00B 0.00B ~ (all equal) Parse3339/Z-8 0.00B 0.00B ~ (all equal) Parse3339/TZ-8 0.00B 0.00B ~ (all equal) name old allocs/op new allocs/op delta GoParse3339/Z-8 0.00 0.00 ~ (all equal) GoParse3339/TZ-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) GoParse3339InLocation-8 0.00 0.00 ~ (all equal) Parse3339/Z-8 0.00 0.00 ~ (all equal) Parse3339/TZ-8 0.00 0.00 ~ (all equal) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	8f76548fd9	tempfork/osexec: remove old fork of os/exec ... This package was a temporary fork of os/exec to fix an EINTR loop bug that was fixed upstream for Go 1.15 in 8c1db77a92 (https://go-review.googlesource.com/c/go/+/232862), in src/os/exec_unix.go: 8c1db77a92 (diff-72072cbd53a7240debad8aa506ff7ec795f9cfac7322e779f9bac29a4d0d0bd4)	4 years ago
Brad Fitzpatrick	51c8fd1dfc	logpolicy: add -race suffix to Go version when race detector in use	4 years ago
Brad Fitzpatrick	7a01cd27ca	net/netstat: remove some unsafe ... Just removing any unnecessary unsafe while auditing unsafe usage for #921.	4 years ago
Brad Fitzpatrick	45d96788b5	net/netns: remove use of unsafe on Windows ... Found while auditing unsafe for #921 via the list at: https://github.com/tailscale/tailscale/issues/921#issuecomment-727365383 No need for unsafe here, so remove it.	4 years ago
Brad Fitzpatrick	a2d78b4d3e	net/dnscache, control/controlclient: use DNS cache when dialing control ... Cache DNS results of earlier login.tailscale.com control dials, and use them for future dials if DNS is slow or broken. Fixes various issues with trickier setups with the domain's DNS server behind a subnet router. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	97e82c6cc0	net/netcheck: remove unused DNSCache from netcheck ... It's easy to add back later if/when the TODO is implemented.	4 years ago
Avery Pennarun	f99f6608ff	Reverse earlier "allow tag without 'tag:' prefix" changes. ... These accidentally make the tag syntax more flexible than was intended, which will create forward compatibility problems later. Let's go back to the old stricter parser. Revert "cmd/tailscale/cli: fix double tag: prefix in tailscale up" Revert "cmd/tailscale/cli, tailcfg: allow tag without "tag:" prefix in 'tailscale up'" This reverts commit a702921620. This reverts commit cd07437ade. Affects #861. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
David Anderson	7988f75b87	tailscaled.service: also cleanup prior to starting. ... Fixes #813. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	427bf2134f	net/packet: rename from wgengine/packet. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	ebd96bf4a9	wgengine/router/dns: use OpenKeyWait to set DNS configuration. ... Fixes tailscale/corp#839. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	696e160cfc	cmd/tailscale/cli: fix double tag: prefix in tailscale up ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	01ee638cca	Change some os.IsNotExist to errors.Is(err, os.ErrNotExist) for non-os errors. ... os.IsNotExist doesn't unwrap errors. errors.Is does. The ioutil.ReadFile ones happened to be fine but I changed them so we're consistent with the rule: if the error comes from os, you can use os.IsNotExist, but from any other package, use errors.Is. (errors.Is always would also work, but not worth updating all the code) The motivation here was that we were logging about failure to migrate legacy relay node prefs file on startup, even though the code tried to avoid that. See golang/go#41122	4 years ago
Brad Fitzpatrick	7e1a146e6c	cmd/tailscaled: update depaware.txt	4 years ago
David Anderson	54e6c3a290	version: use OSS repo's version when building. ... When building with redo, also include the git commit hash from the proprietary repo, so that we have a precise commit that identifies all build info (including Go toolchain version). Add a top-level build script demonstrating to downstream distros how to burn the right information into builds. Adjust `tailscale version` to print commit hashes when available. Fixes #841. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	cd07437ade	cmd/tailscale/cli, tailcfg: allow tag without "tag:" prefix in 'tailscale up' ... Fixes #861	4 years ago
Brad Fitzpatrick	7c8ca28c74	ipn: use cmd/cloner for Prefs.Clone ... Also, make cmd/cloner's top-level "func Clone" generation opt-in. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	86c271caba	types/logger: move RusagePrefixLog to logger package, disable by default ... The RusagePrefixLog is rarely useful, hasn't been useful in a long time, is rarely the measurement we need, and is pretty spammy (and syscall-heavy). Disable it by default. We can enable it when we're debugging memory.	4 years ago
Alex Brainman	f2ce64f0c6	wgengine/router: unfork winipcfg-go package, use upstream ... Use golang.zx2c4.com/wireguard/windows/tunnel/winipcfg instead of github.com/tailscale/winipcfg-go package. Updates #760 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	4 years ago
Brad Fitzpatrick	515866d7c6	ipn, ipnserver, cmd/tailscale: add "server mode" support on Windows ... This partially (but not yet fully) migrates Windows to tailscaled's StateStore storage system. This adds a new bool Pref, ForceDaemon, defined as: // ForceDaemon specifies whether a platform that normally // operates in "client mode" (that is, requires an active user // logged in with the GUI app running) should keep running after the // GUI ends and/or the user logs out. // // The only current applicable platform is Windows. This // forced Windows to go into "server mode" where Tailscale is // running even with no users logged in. This might also be // used for macOS in the future. This setting has no effect // for Linux/etc, which always operate in daemon mode. Then, when ForceDaemon becomes true, we now write use the StateStore to track which user started it in server mode, and store their prefs under that key. The ipnserver validates the connections/identities and informs that LocalBackend which userid is currently in charge. The GUI can then enable/disable server mode at runtime, without using the CLI. But the "tailscale up" CLI was also fixed, so Windows users can use authkeys or ACL tags, etc. Updates #275	4 years ago
Josh Bleecher Snyder	a5103a4cae	all: upgrade to latest version of depaware	4 years ago
Josh Bleecher Snyder	38dda1ea9e	all: update depaware.txt ... Broken by 8051ecff55. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	90b7293b3b	ipn: add/move some constants, update a comment ... And make the StateStore implementations be Stringers, for error messages.	4 years ago
Brad Fitzpatrick	8b94a769be	cmd/tailscaled: use the standard flag page instead of getopt ... Per discussion with @crawshaw. The CLI tool already used std flag anyway. If either of them, it would've made more sense for the CLI to use getopt.	4 years ago
Josh Bleecher Snyder	6e8328cba5	wgengine/tsdns: replace connections when net link changes (macOS) ... When the network link changes, existing UDP sockets fail immediately and permanently on macOS. The forwarder set up a single UDP conn and never changed it. As a result, any time there was a network link change, all forwarded DNS queries failed. To fix this, create a new connection when send requests fail because of network unreachability. This change is darwin-only, although extended it to other platforms should be straightforward. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	3528d28ed1	wgengine/router: move Tailscale's winipcfg additions into wgengine/router ... Part of unforking our winipcfg-go and using upstream (#760), move our additions into our repo. (We might upstream them later if upstream has interest) Originally these were: @apenwarr: "Add ifc.SyncAddresses() and SyncRoutes()." 609dcf2df5 @bradfitz: "winipcfg: make Interface.AddRoutes do as much as possible, return combined error" e9f93d53f3 @bradfitz: "prevent unnecessary Interface.SyncAddresses work; normalize IPNets in deltaNets" decb9ee8e1	4 years ago
Brad Fitzpatrick	3bdcfa7193	ipn: remove DisableDERP pref ... We depend on DERP for NAT traversal now[0] so disabling it entirely can't work. What we'll do instead in the future is let people specify alternate/additional DERP servers. And perhaps in the future we could also add a pref for nodes to say when they expect to never need/want to use DERP for data (but allow it for NAT traversal communication). But this isn't the right pref and it doesn't work, so delete it. Fixes #318 [0] https://tailscale.com/blog/how-nat-traversal-works/	4 years ago
Christina Wen	f0e9dcdc0a	wgengine/router: restore /etc/resolv.conf after tailscale down is called ... This change is to restore /etc/resolv.conf after tailscale down is called. This is done by setting the dns.Manager before errors occur. Error collection is also added. Fixes #723	4 years ago
Josh Bleecher Snyder	7f97cf654d	cmd/microproxy: add -insecure flag ... This makes it easier to run microproxy locally during development. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	3fa863e6d9	cmd/derper: add missing html.EscapeString calls in /debug page ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	931bcd44cb	control/controlclient: report Synology "distro" + its version to control	4 years ago
David Anderson	8f5b52e571	net/netns: add windows support. ... Also remove rebinding logic from the windows router. Magicsock will instead rebind based on link change signals. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	4f7751e025	Update depaware for previous ipnserver change.	4 years ago
Brad Fitzpatrick	a084c44afc	wgengine, wgengine/router, cmd/tailscale: force netfilter mode off on Synology ... For now. Get it working again so it's not stuck on 0.98. Subnet relay can come later. Updates #451 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	8b60936913	depaware: update deps	4 years ago
Brad Fitzpatrick	22ed3c503e	Add depaware.txt files and GitHub checks. (#745) ... See https://github.com/tailscale/depaware Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	7bd89359c9	cmd/cloner: generate a package-level Clone function ... This Clone function knows how to clone any types for which it has generated Clone methods. This allows callers to efficiently clone an inbound interface{} that might contain one of these types. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	99d223130c	cmd/cloner: fix found type detection ... This was causing any type to be reported as found, as long as there were any type decls at all. Oops. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	2352690bde	cmd/cloner: ensure cloner gets re-run when structs change ... If you change a struct and don't re-run cloner, your Cloner method might be inaccurate, leading to bad things. To prevent this, write out the struct as it is at the moment that cloner is caller, and attempt a conversion from that type. If the struct gets changed in any way, this conversion will fail. This will yield false positives: If you change a non-pointer field, you will be forced to re-run cloner, even though the actual generated code won't change. I think this is an acceptable cost: It is a minor annoyance, which will prevent real bugs. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	468bb3afce	cmd/tailscale/cli: add debug -derp mode	4 years ago
Brad Fitzpatrick	1e0be5a458	tshttp, derphttp: send Proxy-Authorization, not Authorization, to proxies ... Whoops. But weirdly, sending Authorization sometimes worked?	4 years ago
halulu	3af2d671e6	cmd/tailscale/cli: add new flag --force-reauth to up subcommand (#717) ... Signed-off-by: Halulu <lzjluzijie@gmail.com>	4 years ago
halulu	bd37e40d2b	cmd/tailscale/cli: status exit when disconnected (#720) ... cmd/tailscale/cli: make status report stopped status, exit non-zero Fixes #714	4 years ago
Brad Fitzpatrick	483141094c	cmd/tailscale/cli: add basic 'down' subcommand ... RELNOTE=yes	4 years ago
halulu	f27a57911b	cmd/tailscale: add derp and endpoints status (#703) ... cmd/tailscale: add local node's information to status output (by default) RELNOTE=yes Updates #477 Signed-off-by: Halulu <lzjluzijie@gmail.com>	4 years ago
Brad Fitzpatrick	f915ab6552	net/tshttpproxy: add start of Kerberos Negotiate auth to proxies on Windows ... For now only used by a new cmd/tailscale debug --get-url subcommand. Not yet wired up to the places making HTTP requests. Updates tailscale/corp#583	4 years ago
Brad Fitzpatrick	5e0375808b	cmd/tailscale/cli: fix vet warning ... And add vet to the "make check" target, like the CI has.	4 years ago
Brad Fitzpatrick	1be6c6dd70	cmd/tailscale/cli: add hidden debug subcommand	4 years ago
Brad Fitzpatrick	e415991256	derp, derp/derphttp: remove one RTT from DERP setup ... * advertise server's DERP public key following its ServerHello * have client look for that DEPR public key in the response PeerCertificates * let client advertise it's going into a "fast start" mode if it finds it * modify server to support that fast start mode, just not sending the HTTP response header Cuts down another round trip, bringing the latency of being able to write our first DERP frame from SF to Bangalore from ~725ms (3 RTT) to ~481ms (2 RTT: TCP and TLS). Fixes #693 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	771e9541c7	cmd/tailscale/cli: appease staticcheck	4 years ago
Brad Fitzpatrick	adf4f3cce0	cmd/tailscale/cli: make netcheck sort regions, show full region names	4 years ago
David Anderson	c2b63ba363	cmd/microproxy: add a quick hack for some malformed variables. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	4e63a4fda3	cmd/tailscale/cli: remove already done TODO	4 years ago
Brad Fitzpatrick	84dc891843	cmd/tailscale/cli: add ping subcommand ... For example: $ tailscale ping -h USAGE ping <hostname-or-IP> FLAGS -c 10 max number of pings to send -stop-once-direct true stop once a direct path is established -verbose false verbose output $ tailscale ping mon.ts.tailscale.com pong from monitoring (100.88.178.64) via DERP(sfo) in 65ms pong from monitoring (100.88.178.64) via DERP(sfo) in 252ms pong from monitoring (100.88.178.64) via [2604:a880:2:d1::36:d001]:41641 in 33ms Fixes #661 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	87cbc067c2	cmd/tailscale/cli: validate advertised routes' IP address-vs-network bits ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago