tailscale

Commit Graph

Author	SHA1	Message	Date
Dmytro Shynkevych	059b1d10bb	wgengine/packet: refactor and expose UDP header marshaling (#408 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
David Anderson	5a32f8e181	wgengine/router: also accept exit code 254 from `ip rule del`. iproute2 3.16.0-2 from Debian Jessie (oldoldstable) doesn't return exit code 2 when deleting a non-existent IP rule. Fixes #434 Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	08a38f21c9	wgengine/router: don't filter subnet routing in netfilter. We have a filter in tailscaled itself now, which is more robust against weird network topologies (such as the one Docker creates). Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Dmytro Shynkevych	73c40c77b0	filter: prevent escape of QDecode to the heap (#417 ) Performance impact: name old time/op new time/op delta Filter/tcp_in-4 70.7ns ± 1% 30.9ns ± 1% -56.30% (p=0.008 n=5+5) Filter/tcp_out-4 58.6ns ± 0% 19.4ns ± 0% -66.87% (p=0.000 n=5+4) Filter/udp_in-4 96.8ns ± 2% 55.5ns ± 0% -42.64% (p=0.016 n=5+4) Filter/udp_out-4 120ns ± 1% 79ns ± 1% -33.87% (p=0.008 n=5+5) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	722673f307	Update go4.org/mem, adjust to revised API.	5 years ago
Brad Fitzpatrick	9e5d79e2f1	wgengine/magicsock: drop a bytes.Buffer sync.Pool, use logger.ArgWriter instead	5 years ago
Brad Fitzpatrick	becce82246	net/netns, misc tests: remove TestOnlySkipPrivilegedOps, argv checks The netns UID check is sufficient for now. We can do something else later if/when needed.	5 years ago
Avery Pennarun	e7ae6a2e06	net/netns, wgengine/router: support Linux machines that don't have 'ip rule'. We'll use SO_BINDTODEVICE instead of fancy policy routing. This has some limitations: for example, we will route all traffic through the interface that has the main "default" (0.0.0.0/0) route, so machines that have multiple physical interfaces might have to go through DERP to get to some peers. But machines with multiple physical interfaces are very likely to have policy routing (ip rule) support anyway. So far, the only OS I know of that needs this feature is ChromeOS (crostini). Fixes #245. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	e46238a2af	wgengine: separately dedupe wireguard configs and router configs. Otherwise iOS/macOS will reconfigure their routing every time anything minor changes in the netmap (in particular, endpoints and DERP homes), which is way too often. Some users reported "network reconfigured" errors from Chrome when this happens. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	f0b6ba78e8	wgengine: don't pass nil router.Config objects. These are hard for swift to decode in the iOS app. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
David Anderson	5114df415e	net/netns: set the bypass socket mark on linux. This allows tailscaled's own traffic to bypass Tailscale-managed routes, so that things like tailscale-provided default routes don't break tailscaled itself. Progress on #144. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	db2a216561	wgengine/magicsock: don't log on UDP send errors if address family known missing Fixes #376	5 years ago
David Crawshaw	cf5d25e15b	wgengine: ensure pingers are gone before returning from Close We canceled the pingers in Close, but didn't wait around for their goroutines to be cleaned up. This caused the ipn/e2e_test to catch pingers in its resource leak check. This commit introduces an object, but also simplifies the semantics around the pinger's cancel functions. They no longer need to be called while holding the mutex. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	9e3ad4f79f	net/netns: add package for start of network namespace support And plumb in netcheck STUN packets. TODO: derphttp, logs, control. Updates #144 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a428656280	wgengine/magicsock: don't report v4 localhost addresses on IPv6-only systems Updates #376	5 years ago
David Anderson	fff062b461	wgengine/router: make runner.go linux-only for now. Otherwise, staticcheck complains that these functions are unused and unexported on macOS. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	f69003fd46	router_linux: work around terrible bugs in old iptables-compat versions. Specifically, this sequence: iptables -N ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT iptables -A FORWARD -j ts-forward doesn't work on Debian-9-using-nftables, but this sequence: iptables -N ts-forward iptables -A FORWARD -j ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT does work. I'm sure the reason why is totally fascinating, but it's an old version of iptables and the bug doesn't seem to exist on modern nftables, so let's refactor our code to add rules in the always-safe order and pretend this never happened. Fixes #401. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	9ff51909a3	router_linux: fix behaviour when switching --netfilter-mode. On startup, and when switching into =off and =nodivert, we were deleting netfilter rules even if we weren't the ones that added them. In order to avoid interfering with rules added by the sysadmin, we have to be sure to delete rules only in the case that we added them in the first place. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	a496cdc943	router_linux: remove need for iptables.ListChains(). Instead of retrieving the list of chains, or the list of rules in a chain, just try deleting the ones we don't want and then adding the ones we do want. An error in flushing/deleting still means the rule doesn't exist anymore, so there was no need to check for it first. This avoids the need to parse iptables output, which avoids the need to ever call iptables -S, which fixes #403, among other things. It's also much more future proof in case the iptables command line changes. Unfortunately the iptables go module doesn't properly pass the iptables command exit code back up when doing .Delete(), so we can't correctly check the exit code there. (exit code 1 really means the rule didn't exist, rather than some other weird problem). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	8a6bd21baf	router_linux: extract process runner routines into runner.go. These will probably be useful across platforms. They're not really Linux-specific at all. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	34c30eaea0	router_linux: use only baseline 'ip rule' features that exist in old kernels. This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	30e5c19214	magicsock: work around race condition initializing .Regions[]. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Dmytro Shynkevych	737124ef70	tstun: tolerate zero reads Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	b0c10fa610	stun, netcheck: move under net	5 years ago
Brad Fitzpatrick	43ded2b581	wgengine/packet: add some tests, more docs, minor Go style, performance changes	5 years ago
Brad Fitzpatrick	e6b84f2159	all: make client use server-provided DERP map, add DERP region support Instead of hard-coding the DERP map (except for cmd/tailscale netcheck for now), get it from the control server at runtime. And make the DERP map support multiple nodes per region with clients picking the first one that's available. (The server will balance the order presented to clients for load balancing) This deletes the stunner package, merging it into the netcheck package instead, to minimize all the config hooks that would've been required. Also fix some test flakes & races. Fixes #387 (Don't hard-code the DERP map) Updates #388 (Add DERP region support) Fixes #399 (wgengine: flaky tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	e8b3a5e7a1	wgengine/filter: implement a destination IP pre-filter. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	7fb33123d3	wgengine/router: warn about another variation of busybox's `ip`. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Dmytro Shynkevych	635f7b99f1	wgengine: pass tun.NativeDevice to router Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
David Anderson	9c914dc7dd	wgengine/router: stop using -m comment. The comment module is compiled out on several embedded systems (and also gentoo, because netfilter can't go brrrr with comments holding it back). Attempting to use comments results in a confusing error, and a non-functional firewall. Additionally, make the legacy rule cleanup non-fatal, because we do have to probe for the existence of these -m comment rules, and doing so will error out on these systems. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	3e27b3c33c	wgengine/router: more comments. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	0fe262f093	ipn: plumb NetfilterMode all the way out to the CLI. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	c67c8913c3	wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	292606a975	wgengine/router: support multiple levels of netfilter involvement. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	e6d0c92b1d	wgengine/magicsock: clean up earlier fix a bit Move WaitReady from `fc88e34f42` into the test code, and keep the derp-reading goroutine named for debugging.	5 years ago
Avery Pennarun	d53e8fc0da	router_darwin_support: we can build this on every platform. Our new build scripts try to build ipn-go-bridge on more than just linux and darwin, so let's enable this file so it can be successful on every platform.	5 years ago
Avery Pennarun	fc88e34f42	wgengine/magicsock/tests: wait for home DERP connection before sending packets. This fixes an elusive test flake. Fixes #161. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	4f128745d8	magicsock/test: oops, fix a data race in nested-test logf hack. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	42a0e0c601	wgengine/magicsock/tests: call tstest.ResourceCheck for each test. This didn't catch anything yet, but it's good practice for detecting goroutine leaks that we might not find otherwise. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	08acb502e5	Add tstest.PanicOnLog(), and fix various problems detected by this. If a test calls log.Printf, 'go test' horrifyingly rearranges the output to no longer be in chronological order, which makes debugging virtually impossible. Let's stop that from happening by making log.Printf panic if called from any module, no matter how deep, during tests. This required us to change the default error handler in at least one http.Server, as well as plumbing a bunch of logf functions around, especially in magicsock and wgengine, but also in logtail and backoff. To add insult to injury, 'go test' also rearranges the output when a parent test has multiple sub-tests (all the sub-test's t.Logf is always printed after all the parent tests t.Logf), so we need to screw around with a special Logf that can point at the "current" t (current_t.Logf) in some places. Probably our entire way of using subtests is wrong, since 'go test' would probably like to run them all in parallel if you called t.Parallel(), but it definitely can't because the're all manipulating the shared state created by the parent test. They should probably all be separate toplevel tests instead, with common setup/teardown logic. But that's a job for another time. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Dmytro Shynkevych	33b2f30cea	wgengine: wrap tun.Device to support filtering and packet injection (#358 ) Right now, filtering and packet injection in wgengine depend on a patch to wireguard-go that probably isn't suitable for upstreaming. This need not be the case: wireguard-go/tun.Device is an interface. For example, faketun.go implements it to mock a TUN device for testing. This patch implements the same interface to provide filtering and packet injection at the tunnel device level, at which point the wireguard-go patch should no longer be necessary. This patch has the following performance impact on i7-7500U @ 2.70GHz, tested in the following namespace configuration: ┌────────────────┐ ┌─────────────────────────────────┐ ┌────────────────┐ │ $ns1 │ │ $ns0 │ │ $ns2 │ │ client0 │ │ tailcontrol, logcatcher │ │ client1 │ │ ┌─────┐ │ │ ┌──────┐ ┌──────┐ │ │ ┌─────┐ │ │ │vethc│───────┼────┼──│vethrc│ │vethrs│──────┼─────┼──│veths│ │ │ ├─────┴─────┐ │ │ ├──────┴────┐ ├──────┴────┐ │ │ ├─────┴─────┐ │ │ │10.0.0.2/24│ │ │ │10.0.0.1/24│ │10.0.1.1/24│ │ │ │10.0.1.2/24│ │ │ └───────────┘ │ │ └───────────┘ └───────────┘ │ │ └───────────┘ │ └────────────────┘ └─────────────────────────────────┘ └────────────────┘ Before: --------------------------------------------------- \| TCP send \| UDP send \| \|------------------------\|------------------------\| \| 557.0 (±8.5) Mbits/sec \| 3.03 (±0.02) Gbits/sec \| --------------------------------------------------- After: --------------------------------------------------- \| TCP send \| UDP send \| \|------------------------\|------------------------\| \| 544.8 (±1.6) Mbits/sec \| 3.13 (±0.02) Gbits/sec \| --------------------------------------------------- The impact on receive performance is similar. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
David Anderson	9ccbcda612	wgengine/router: rename config.Settings to config.Config, make pointer. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	72cae5504c	wgengine: generate and plumb router.Settings in from ipn. This saves a layer of translation, and saves us having to pass in extra bits and pieces of the netmap and prefs to wgengine. Now it gets one Wireguard config, and one OS network stack config. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	cd01bcc395	wgengine/router: allow loopback traffic from our own IP(s). Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	bfdc8175b1	wgengine/router: add a setting to disable SNAT for subnet routes. Part of #320. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	8a3e77fc43	ipn, wgengine/filter: remove exported type aliases	5 years ago
David Anderson	21ac65d3da	wgengine/router: explicitly detect and complain about busybox's `ip`. Defensive programming against #368 in environments other than Docker, e.g. if you try using Tailscale in Alpine Linux directly, sans container. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	381b94d4d1	wgengine/router: include command output if `ip rule list` fails. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	e83d02ffd1	wgengine: don't double-close tundev on setup error. Part of #368. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	efc1feedc9	wgengine/router: include more information when iptables ops fail. The iptables package we use doesn't include command output, so we're left with guessing what went wrong most of the time. This will at least narrow things down to which operation failed. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago

1 2 3 4 5

240 Commits (059b1d10bb75c868b3c7122b08350c4c904ff12b)