1278 Commits (072e6a39f49faa4d209fcbb328fe2fb8d38f9e7f)

Author	SHA1	Message	Date
Jordan Whited	641a90ea33	net/sockopts,wgengine/magicsock: export socket buffer sizing logic (#16909) ... For eventual use by net/udprelay.Server Updates tailscale/corp#31164 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Jordan Whited	d4b7200129	net/udprelay: use batching.Conn (#16866) ... This significantly improves throughput of a peer relay server on Linux. Server.packetReadLoop no longer passes sockets down the stack. Instead, packet handling methods return a netip.AddrPort and []byte, which packetReadLoop gathers together for eventual batched writes on the appropriate socket(s). Updates tailscale/corp#31164 Signed-off-by: Jordan Whited <jordan@tailscale.com>	4 months ago
M. J. Fromberger	55698c8511	ipn/localapi: plumb an event bus through the localapi.Handler (#16892) ... Some of the operations of the local API need an event bus to correctly instantiate other components (notably including the portmapper). This commit adds that, and as the parameter list is starting to get a bit long and hard to read, I took the opportunity to move the arguments to a config type. Only a few call sites needed to be updated and this API is not intended for general use, so I did not bother to stage the change. Updates #15160 Updates #16842 Change-Id: I7b057d71161bd859f5acb96e2f878a34c85be0ef Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	4 months ago
Jonathan Nobels	6006bc92b5	net/{netns, netmon}: use LastKnownDefaultInterface if set and check for utun (#16873) ... fixes tailscale/corp#31299 Fixes two issues: getInterfaceIndex would occasionally race with netmon's state, returning the cached default interface index after it had be changed by NWNetworkMonitor. This had the potential to cause connections to bind to the prior default. The fix here is to preferentially use the interface index provided by NWNetworkMonitor preferentially. When no interfaces are available, macOS will set the tunnel as the default interface when an exit node is enabled, potentially causing getInterfaceIndex to return utun's index. We now guard against this when taking the defaultIdx path. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	4 months ago
Will Hannah	5b6c64b187	net/tshttpproxy: use errors.New for error creation (#16860) ... Updates tailscale/corp#30668 Signed-off-by: Will Hannah <willh@tailscale.com>	4 months ago
Jordan Whited	c083a9b053	net/batching: fix compile-time assert (#16864) ... Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	4 months ago
Will Hannah	5402620db8	net/tshttpproxy: add macOS support for system proxy (#16826) ... Adds a setter for proxyFunc to allow macOS to pull defined system proxies. Disallows overriding if proxyFunc is set via config. Updates tailscale/corp#30668 Signed-off-by: Will Hannah <willh@tailscale.com>	4 months ago
Jordan Whited	16bc0a5558	net/{batching,packet},wgengine/magicsock: export batchingConn (#16848) ... For eventual use by net/udprelay.Server. Updates tailscale/corp#31164 Signed-off-by: Jordan Whited <jordan@tailscale.com>	4 months ago
Claus Lensbøl	5bb42e3018	wgengine/router: rely on events for deleted IP rules (#16744) ... Adds the eventbus to the router subsystem. The event is currently only used on linux. Also includes facilities to inject events into the bus. Updates #15160 Signed-off-by: Claus Lensbøl <claus@tailscale.com>	4 months ago
jishudashu	23a0398136	ipn/ipnlocal, net/dns: use slices.Equal to simplify code (#16641) ... Signed-off-by: jishudashu <979260390@qq.com>	4 months ago
M. J. Fromberger	b34cdc9710	ipn,net,tsnet,wgengine: make an eventbus mandatory where it is used (#16594) ... In the components where an event bus is already plumbed through, remove the exceptions that allow it to be omitted, and update all the tests that relied on those workarounds execute properly. This change applies only to the places where we're already using the bus; it does not enforce the existence of a bus in other components (yet), Updates #15160 Change-Id: Iebb92243caba82b5eb420c49fc3e089a77454f65 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	4 months ago
M. J. Fromberger	5ce3845a02	net/portmapper: avert a panic when a mapping is not available (#16686) ... Ideally when we attempt to create a new port mapping, we should not return without error when no mapping is available. We already log these cases as unexpected, so this change is just to avoiding panicking dispatch on the invalid result in those cases. We still separately need to fix the underlying control flow. Updates #16662 Change-Id: I51e8a116b922b49eda45e31cd27f6b89dd51abc8 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	4 months ago
Jordan Whited	1677fb1905	wgengine/magicsock,all: allocate peer relay over disco instead of PeerAPI (#16603) ... Updates tailscale/corp#30583 Updates tailscale/corp#30534 Updates tailscale/corp#30557 Signed-off-by: Dylan Bargatze <dylan@tailscale.com> Signed-off-by: Jordan Whited <jordan@tailscale.com> Co-authored-by: Dylan Bargatze <dylan@tailscale.com>	5 months ago
Brad Fitzpatrick	5d4e67fd93	net/dns/recursive: set EDNS on queries ... Updates tailscale/corp#30631 Change-Id: Ib88ea1bb51dd917c04f8d41bcaa6d59b9abd4f73 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Jordan Whited	cb7a0b1dca	net/udprelay: log socket read errors (#16573) ... Socket read errors currently close the server, so we need to understand when and why they occur. Updates tailscale/corp#27502 Updates tailscale/corp#30118 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Jordan Whited	24062e33d1	net/udprelay: fix peer relay server deadlock (#16542) ... Fixes tailscale/corp#30381 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Brad Fitzpatrick	fbc6a9ec5a	all: detect JetKVM and specialize a handful of things for it ... Updates #16524 Change-Id: I183428de8c65d7155d82979d2d33f031c22e3331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Jordan Whited	47f431b656	net/udprelay: fix relaying between mixed address family sockets (#16485) ... We can't relay a packet received over the IPv4 socket back out the same socket if destined to an IPv6 address, and vice versa. Updates tailscale/corp#30206 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Jordan Whited	3a4b439c62	feature/relayserver,net/udprelay: add IPv6 support (#16442) ... Updates tailscale/corp#27502 Updates tailscale/corp#30043 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Jordan Whited	b32a01b2dc	disco,net/udprelay,wgengine/magicsock: support relay re-binding (#16388) ... Relay handshakes may now occur multiple times over the lifetime of a relay server endpoint. Handshake messages now include a handshake generation, which is client specified, as a means to trigger safe challenge reset server-side. Relay servers continue to enforce challenge values as single use. They will only send a given value once, in reply to the first arriving bind message for a handshake generation. VNI has been added to the handshake messages, and we expect the outer Geneve header value to match the sealed value upon reception. Remote peer disco pub key is now also included in handshake messages, and it must match the receiver's expectation for the remote, participating party. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Claus Lensbøl	37eca1785c	net/netmon: add tests for the events over the eventbus (#16382) ... Updates #15160 Signed-off-by: Claus Lensbøl <claus@tailscale.com>	5 months ago
Claus Lensbøl	f2f1236ad4	util/eventbus: add test helpers to simplify testing events (#16294) ... Instead of every module having to come up with a set of test methods for the event bus, this handful of test helpers hides a lot of the needed setup for the testing of the event bus. The tests in portmapper is also ported over to the new helpers. Updates #15160 Signed-off-by: Claus Lensbøl <claus@tailscale.com>	5 months ago
Jordan Whited	a589863d61	feature/relayserver,net/udprelay,wgengine/magicsock: implement retry (#16347) ... udprelay.Server is lazily initialized when the first request is received over peerAPI. These early requests have a high chance of failure until the first address discovery cycle has completed. Return an ErrServerNotReady error until the first address discovery cycle has completed, and plumb retry handling for this error all the way back to the client in relayManager. relayManager can now retry after a few seconds instead of waiting for the next path discovery cycle, which could take another minute or longer. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Brad Fitzpatrick	a64ca7a5b4	tstest/tlstest: simplify, don't even bake in any keys ... I earlier thought this saved a second of CPU even on a fast machine, but I think when I was previously measuring, I still had a 4096 bit RSA key being generated in the code I was measuring. Measuring again for this, it's plenty fast. Prep for using this package more, for derp, etc. Updates #16315 Change-Id: I4c9008efa9aa88a3d65409d6ffd7b3807f4d75e9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Brad Fitzpatrick	e92eb6b17b	net/tlsdial: fix TLS cert validation of HTTPS proxies ... If you had HTTPS_PROXY=https://some-valid-cert.example.com running a CONNECT proxy, we should've been able to do a TLS CONNECT request to e.g. controlplane.tailscale.com:443 through that, and I'm pretty sure it used to work, but refactorings and lack of integration tests made it regress. It probably regressed when we added the baked-in LetsEncrypt root cert validation fallback code, which was testing against the wrong hostname (the ultimate one, not the one which we were being asked to validate) Fixes #16222 Change-Id: If014e395f830e2f87f056f588edacad5c15e91bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Brad Fitzpatrick	ad0dfcb185	net/*: remove Windows exceptions for when Resolver.PreferGo didn't work ... Resolver.PreferGo didn't used to work on Windows. It was fixed in 2022, though. (https://github.com/golang/go/issues/33097) Updates #5161 Change-Id: I4e1aeff220ebd6adc8a14f781664fa6a2068b48c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Brad Fitzpatrick	259bab9bff	scripts/check_license_headers.sh: delete, rewrite as a Go test ... Updates tailscale/corp#29650 Change-Id: Iad4e4ccd9d68ebb1d1a12f335cc5295d0bd05b60 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
James Tucker	9206e766ed	net/packet: cleanup IPv4 fragment guards ... The first packet fragment guard had an additional guard clause that was incorrectly comparing a length in bytes to a length in octets, and was also comparing what should have been an entire IPv4 through transport header length to a subprotocol payload length. The subprotocol header size guards were otherwise protecting against short transport headers, as is the conservative non-first fragment minimum offset size. Add an explicit disallowing of fragmentation for TSMP for the avoidance of doubt. Updates #cleanup Updates #5727 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
James Tucker	b0f7b23efe	net/netcheck: preserve live home DERP through packet loss ... During a short period of packet loss, a TCP connection to the home DERP may be maintained. If no other regions emerge as winners, such as when all regions but one are avoided/disallowed as candidates, ensure that the current home region, if still active, is not dropped as the preferred region until it has failed two keepalives. Relatedly apply avoid and no measure no home to ICMP and HTTP checks as intended. Updates tailscale/corp#12894 Updates tailscale/corp#29491 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
Jordan Whited	3ed76ceed3	feature/relayserver,net/{netcheck,udprelay}: implement addr discovery (#16253) ... The relay server now fetches IPs from local interfaces and external perspective IP:port's via netcheck (STUN). Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Jordan Whited	75a7d28b07	net/packet: fix Parsed docs (#16200) ... Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Nick Khyl	191afd3390	net/tshttpproxy: fix WDAP/PAC proxy detection on Win10 1607 and earlier ... Using WINHTTP_AUTOPROXY_ALLOW_AUTOCONFIG on Windows versions older than Windows 10 1703 (build 15063) is not supported and causes WinHttpGetProxyForUrl to fail with ERROR_INVALID_PARAMETER. This results in failures reaching the control on environments where a proxy is required. We use wingoes version detection to conditionally set the WINHTTP_AUTOPROXY_ALLOW_AUTOCONFIG flag on Windows builds greater than 15063. While there, we also update proxy detection to use WINHTTP_AUTO_DETECT_TYPE_DNS_A, as DNS-based proxy discovery might be required with Active Directory and in certain other environments. Updates tailscale/corp#29168 Fixes #879 Signed-off-by: Nick Khyl <nickk@tailscale.com>	6 months ago
Jonathan Nobels	5e54819cee	net/dns: cache dns.Config for reuse when compileConfig fails (#16059) ... fixes tailscale/corp#25612 We now keep track of any dns configurations which we could not compile. This gives RecompileDNSConfig a configuration to attempt to recompile and apply when the OS pokes us to indicate that the interface dns servers have changed/updated. The manager config will remain unset until we have the required information to compile it correctly which should eliminate the problematic SERVFAIL responses (especially on macOS 15). This also removes the missingUpstreamRecovery func in the forwarder which is no longer required now that we have proper error handling and recovery manager and the client. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	6 months ago
Brad Fitzpatrick	8009ad74a3	cmd/derper, net/tlsdial: fix client's self-signed cert validation ... This fixes the implementation and test from #15208 which apparently never worked. Ignore the metacert when counting the number of expected certs presented. And fix the test, pulling out the TLSConfig setup code into something shared between the real cmd/derper and the test. Fixes #15579 Change-Id: I90526e38e59f89b480629b415f00587b107de10a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Nick Khyl	fb188c5b53	net/dns,docs/windows/policy,util/syspolicy: register Tailscale IP addresses in AD DNS if required by policy ... In this PR, we make DNS registration behavior configurable via the EnableDNSRegistration policy setting. We keep the default behavior unchanged, but allow admins to either enforce DNS registration and dynamic DNS updates for the Tailscale interface, or prevent Tailscale from modifying the settings configured in the network adapter's properties or by other means. Updates #14917 Signed-off-by: Nick Khyl <nickk@tailscale.com>	7 months ago
Jordan Whited	d6dd74fe0e	net/udprelay{/endpoint}: move ServerEndpoint tests (#15949) ... Commit 0841477 moved ServerEndpoint to an independent package. Move its tests over as well. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	7 months ago
Nick Khyl	cffb809569	net/tsdial: update (*Dialer).SetRoutes() to log the size of the resulting bart.Table ... Updates #12027 Signed-off-by: Nick Khyl <nickk@tailscale.com>	7 months ago
Nick Khyl	a9be049c19	ipn/ipnlocal,net/dns/resolver: use the user dialer and routes for DNS forwarding by default, except on iOS and Android ... In this PR, we make the "user-dial-routes" behavior default on all platforms except for iOS and Android. It can be disabled by setting the TS_DNS_FORWARD_USE_ROUTES envknob to 0 or false. Updates #12027 Updates #13837 Signed-off-by: Nick Khyl <nickk@tailscale.com>	7 months ago
Jordan Whited	0841477743	net/udprelay{/endpoint}, all: move ServerEndpoint to independent pkg (#15934) ... ServerEndpoint will be used within magicsock and potentially elsewhere, which should be possible without needing to import the server implementation itself. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	7 months ago
Brad Fitzpatrick	5be6ff9b62	all: remove non-applicable "linux" deps on Android ... Updates #12614 Change-Id: I0e2a18eca3515d3d6206c059110556d2bbbb0c5c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	02f68e5d9f	net/dns: don't link dbus, gonotify on Android ... Android is Linux, but doesn't use Linux DNS managers (or D-Bus). Updates #12614 Change-Id: I487802ac74a259cd5d2480ac26f7faa17ca8d1c3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	189e03e741	net/portmapper: fix test flakes from logging after test done ... Fixes #15794 Change-Id: Ic22aa99acb10fdb6dc5f0b6482e722e48237703c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Jordan Whited	f701d39ba4	net/udprelay: change Server.AllocateEndpoint existing alloc strategy (#15792) ... The previous strategy assumed clients maintained adequate state to understand the relationship between endpoint allocation and the server it was allocated on. magicsock will not have awareness of the server's disco key pre-allocation, it only understands peerAPI address at this point. The second client to allocate on the same server could trigger re-allocation, breaking a functional relay server endpoint. If magicsock needs to force reallocation we can add opt-in behaviors for this later. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	7 months ago
Nick Khyl	c41a2d5c83	net/portmapper: fix nil pointer dereference in Client.createMapping ... The EventBus in net/portmapper.Config is still optional and Client.updates can be nil. Updates #15772 Signed-off-by: Nick Khyl <nickk@tailscale.com>	7 months ago
Jordan Whited	3a8a174308	net/udprelay: change ServerEndpoint time.Duration fields to tstime.GoDuration (#15725) ... tstime.GoDuration JSON serializes with time.Duration.String(), which is more human-friendly than nanoseconds. ServerEndpoint is currently experimental, therefore breaking changes are tolerable. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	8 months ago
David Anderson	5399fa159a	net/netmon: publish events to event bus ... Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>	8 months ago
M. J. Fromberger	2731171c5e	net/portmapper: fire an event when a port mapping is updated (#15371) ... When an event bus is configured publish an event each time a new port mapping is updated. Publication is unconditional and occurs prior to calling any callback that is registered. For now, the callback is still fired in a separate goroutine as before -- later, those callbacks should become subscriptions to the published event. For now, the event type is defined as a new type here in the package. We will want to move it to a more central package when there are subscribers. The event wrapper is effectively a subset of the data exported by the internal mapping interface, but on a concrete struct so the bus plumbing can inspect it. Updates #15160 Change-Id: I951f212429ac791223af8d75b6eb39a0d2a0053a Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	8 months ago
M. J. Fromberger	baead61e44	{wgengine,util/portmapper}: add and plumb an event bus (#15359) ... Updates #15160 Change-Id: I2510fb4a8905fb0abe8a8e0c5b81adb15d50a6f8 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	8 months ago
M. J. Fromberger	418e19fb5e	portmapper: update NewClient to use a Config argument ... In preparation for adding more parameters (and later, moving some away), rework the portmapper constructor to accept its arguments on a Config struct rather than positionally. This is a breaking change to the function signature, but one that is very easy to update, and a search of GitHub reveals only six instances of usage outside clones and forks of Tailscale itself, that are not direct copies of the code fixed up here. While we could stub in another constructor, I think it is safe to let those folks do the update in-place, since their usage is already affected by other changes we can't test for anyway. Updates #15160 Change-Id: I9f8a5e12b38885074c98894b7376039261b43f43 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	8 months ago
Brad Fitzpatrick	fb96137d79	net/{netx,memnet},all: add netx.DialFunc, move memnet Network impl ... This adds netx.DialFunc, unifying a type we have a bazillion other places, giving it now a nice short name that's clickable in editors, etc. That highlighted that my earlier move (03b47a55c7) of stuff from nettest into netx moved too much: it also dragged along the memnet impl, meaning all users of netx.DialFunc who just wanted netx for the type definition were instead also pulling in all of memnet. So move the memnet implementation netx.Network into memnet, a package we already had. Then use netx.DialFunc in a bunch of places. I'm sure I missed some. And plenty remain in other repos, to be updated later. Updates tailscale/corp#27636 Change-Id: I7296cd4591218e8624e214f8c70dab05fb884e95 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	03b47a55c7	tstest/nettest: pull the non-test Network abstraction out to netx package ... We want to be able to use the netx.Network (and RealNetwork implemementation) outside of tests, without linking "testing". So split out the non-test stuff of nettest into its own package. We tend to use "foox" as the convention for things we wish were in the standard library's foo package, so "netx" seems consistent. Updates tailscale/corp#27636 Change-Id: I1911d361f4fbdf189837bf629a20f2ebfa863c44 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	c76d075472	nettest, *: add option to run HTTP tests with in-memory network ... To avoid ephemeral port / TIME_WAIT exhaustion with high --count values, and to eventually detect leaked connections in tests. (Later the memory network will register a Cleanup on the TB to verify that everything's been shut down) Updates tailscale/corp#27636 Change-Id: Id06f1ae750d8719c5a75d871654574a8226d2733 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
David Anderson	5e4fae0828	net/tstun: don't try to set link attributes on android ... Android >= 14 forbids the use of netlink sockets. Fixes #9836 Signed-off-by: David Anderson <dave@tailscale.com>	8 months ago
David Anderson	7a922c3f1f	net/routetable: don't try to fetch the route table on android ... Android >=14 forbids the use of netlink sockets, and in some configurations can kill apps that try. Fixes #9836 Signed-off-by: David Anderson <dave@tailscale.com>	8 months ago
Brad Fitzpatrick	65c7a37bc6	all: use network less when running in v86 emulator ... Updates #5794 Change-Id: I1d8b005a1696835c9062545f87b7bab643cfc44d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	84c82ac4be	net/dns: add Plan 9 support ... This requires the rsc/plan9 ndb DNS changes for now: https://9fans.topicbox.com/groups/9fans/T9c9d81b5801a0820/ndb-suffix-specific-dns-changes e8c148ff09 1d0642ae49 Updates #5794 Change-Id: I0e242c1fe7bb4404e23604e03a31f89f0d18e70d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	6f75647c0e	net/netcheck: avoid ICMP unimplemented log spam on Plan 9 ... Updates #5794 Change-Id: Ia6b2429d57b79770e4c278f011504f726136db5b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	5df06612aa	net/tsdial: tolerate empty default route on Plan 9 ... Otherwise this was repeated closing control/derp connections all the time on netmon changes. Arguably we should do this on all platforms? Updates #5794 Change-Id: If6bbeff554235f188bab2a40ab75e08dd14746b2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	7426a36371	net/netmon: disable time jump monitoring on Plan 9 ... Updates #5794 Change-Id: I0f96383dea2ad017988d300df723ce906debb007 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	60847128df	net/tstun: add Plan 9 'tun' support ... Updates #5794 Change-Id: I8c466cae25ae79be1097450a63e8c25c7b519331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Jordan Whited	886ab4fad4	net/udprelay: start of UDP relay server implementation (#15480) ... This commit implements an experimental UDP relay server. The UDP relay server leverages the Disco protocol for a 3-way handshake between client and server, along with 3 new Disco message types for said handshake. These new Disco message types are also considered experimental, and are not yet tied to a capver. The server expects, and imposes, a Geneve (Generic Network Virtualization Encapsulation) header immediately following the underlay UDP header. Geneve protocol field values have been defined for Disco and WireGuard. The Geneve control bit must be set for the handshake between client and server, and unset for messages relayed between clients through the server. Updates tailscale/corp#27101 Signed-off-by: Jordan Whited <jordan@tailscale.com>	8 months ago
Brad Fitzpatrick	96fe8a6db6	net/netmon: always remember ifState as old state, even on minor changes ... Otherwise you can get stuck finding minor ones nonstop. Fixes #15484 Change-Id: I7f98ac338c0b32ec1b9fdc47d053207b5fc1bf23 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	e720b9824e	net/netcheck: use NoMeasureNoHome in another spot ... It only affected js/wasm and tamago. Updates tailscale/corp#24697 Change-Id: I8fd29323ed9b663fe3fd8d4a86f26ff584a3e134 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	a3bc0bcb0a	net/dns: add debug envknob to enable dual stack MagicDNS ... Updates #15404 Change-Id: Ic754cc54113b1660b7071b40babb9d3c0e25b2e1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	14db99241f	net/netmon: use Monitor's tsIfName if set by SetTailscaleInterfaceName ... Currently nobody calls SetTailscaleInterfaceName yet, so this is a no-op. I checked oss, android, and the macOS/iOS client. Nobody calls this, or ever did. But I want to in the future. Updates #15408 Updates #9040 Change-Id: I05dfabe505174f9067b929e91c6e0d8bc42628d7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	156cd53e77	net/netmon: unexport GetState ... Baby step towards #15408. Updates #15408 Change-Id: I11fca6e677af2ad2f065d83aa0d83550143bff29 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Jonathan Nobels	25d5f78c6e	net/dns: expose a function for recompiling the DNS configuration (#15346) ... updates tailscale/corp#27145 We require a means to trigger a recompilation of the DNS configuration to pick up new nameservers for platforms where we blend the interface nameservers from the OS into our DNS config. Notably, on Darwin, the only API we have at our disposal will, in rare instances, return a transient error when querying the interface nameservers on a link change if they have not been set when we get the AF_ROUTE messages for the link update. There's a corresponding change in corp for Darwin clients, to track the interface namservers during NEPathMonitor events, and call this when the nameservers change. This will also fix the slightly more obscure bug of changing nameservers while tailscaled is running. That change can now be reflected in magicDNS without having to stop the client. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	9 months ago
Jordan Whited	8b1e7f646e	net/packet: implement Geneve header serialization (#15301) ... Updates tailscale/corp#27100 Signed-off-by: Jordan Whited <jordan@tailscale.com>	9 months ago
Andrew Dunham	640b2fa3ae	net/netmon, wgengine/magicsock: be quieter with portmapper logs ... This adds a new helper to the netmon package that allows us to rate-limit log messages, so that they only print once per (major) LinkChange event. We then use this when constructing the portmapper, so that we don't keep spamming logs forever on the same network. Updates #13145 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6e7162509148abea674f96efd76be9dffb373ae4	9 months ago
Brad Fitzpatrick	eb3313e825	tailcfg: add DERPRegion.NoMeasureNoHome, deprecate+document Avoid [cap 115] ... Fixes tailscale/corp#24697 Change-Id: Ib81994b5ded3dc87a1eef079eb268906a2acb3f8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Andrew Dunham	5177fd2ccb	net/portmapper: retry UPnP when we get an "Invalid Args" ... We previously retried getting a UPnP mapping when the device returned error code 725, "OnlyPermanentLeasesSupported". However, we've seen devices in the wild also return 402, "Invalid Args", when given a lease duration. Fall back to the no-duration mapping method in these cases. Updates #15223 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6a25007c9eeac0dac83750dd3ae9bfcc287c8fcf	9 months ago
Brad Fitzpatrick	7fac0175c0	cmd/derper, derp/derphttp: support, generate self-signed IP address certs ... For people who can't use LetsEncrypt because it's banned. Per https://github.com/tailscale/tailscale/issues/11776#issuecomment-2520955317 This does two things: 1) if you run derper with --certmode=manual and --hostname=$IP_ADDRESS we previously permitted, but now we also: * auto-generate the self-signed cert for you if it doesn't yet exist on disk * print out the derpmap configuration you need to use that self-signed cert 2) teaches derp/derphttp's derp dialer to verify the signature of self-signed TLS certs, if so declared in the existing DERPNode.CertName field, which previously existed for domain fronting, separating out the dial hostname from how certs are validates, so it's not overloaded much; that's what it was meant for. Fixes #11776 Change-Id: Ie72d12f209416bb7e8325fe0838cd2c66342c5cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Andrew Lytvynov	323747c3e0	various: disable MPTCP when setting TCP_USER_TIMEOUT sockopt (#15063) ... There's nothing about it on https://github.com/multipath-tcp/mptcp_net-next/issues/ but empirically MPTCP doesn't support this option on awly's kernel 6.13.2 and in GitHub actions. Updates #15015 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	10 months ago
James Tucker	606f7ef2c6	net/netcheck: remove unnecessary custom map clone function ... Updates #8419 Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
Anton	f35c49d211	net/dns: update to illarion/gonotify/v3 to fix a panic ... Fixes #14699 Signed-off-by: Anton <anton@tailscale.com>	10 months ago
Anton	c4984632ca	net/dns: add a simple test for resolv.conf inotify watcher ... Updates #14699 Signed-off-by: Anton <anton@tailscale.com>	10 months ago
James Tucker	80a100b3cb	net/netmon: add extra panic guard around ParseRIB ... We once again have a report of a panic from ParseRIB. This panic guard should probably remain permanent. Updates #14201 This reverts commit de9d4b2f88. Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
James Tucker	10fe10ea10	derp/derphttp,ipn/localapi,net/captivedetection: add cache resistance to captive portal detection ... Observed on some airlines (British Airways, WestJet), Squid is configured to cache and transform these results, which is disruptive. The server and client should both actively request that this is not done by setting Cache-Control headers. Send a timestamp parameter to further work against caches that do not respect the cache-control headers. Updates #14856 Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
Brad Fitzpatrick	68a66ee81b	feature/capture: move packet capture to feature/*, out of iOS + CLI ... We had the debug packet capture code + Lua dissector in the CLI + the iOS app. Now we don't, with tests to lock it in. As a bonus, tailscale.com/net/packet and tailscale.com/net/flowtrack no longer appear in the CLI's binary either. A new build tag ts_omit_capture disables the packet capture code and was added to build_dist.sh's --extra-small mode. Updates #12614 Change-Id: I79b0628c0d59911bd4d510c732284d97b0160f10 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Kristoffer Dalby	f39ee8e520	net/tstun: add back outgoing drop metric ... Using new labels returned from the filter Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	10 months ago
Brad Fitzpatrick	d6abbc2e61	net/tstun: move TAP support out to separate package feature/tap ... Still behind the same ts_omit_tap build tag. See #14738 for background on the pattern. Updates #12614 Change-Id: I03fb3d2bf137111e727415bd8e713d8568156ecc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	042ed6bf69	net/bakedroots: add LetsEncrypt ISRG Root X2 ... Updates #14690 Change-Id: Ib85e318d48450fc6534f7b0c1d4cc4335de7c0ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Brad Fitzpatrick	150cd30b1d	ipn/ipnlocal: also use LetsEncrypt-baked-in roots for cert validation ... We previously baked in the LetsEncrypt x509 root CA for our tlsdial package. This moves that out into a new "bakedroots" package and is now also shared by ipn/ipnlocal's cert validation code (validCertPEM) that decides whether it's time to fetch a new cert. Otherwise, a machine without LetsEncrypt roots locally in its system roots is unable to use tailscale cert/serve and fetch certs. Fixes #14690 Change-Id: Ic88b3bdaabe25d56b9ff07ada56a27e3f11d7159 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Brad Fitzpatrick	d912a49be6	net/tstun: add logging to aid developers missing Start calls ... Since 5297bd2cff, tstun.Wrapper has required its Start method to be called for it to function. Failure to do so just results in weird hangs and I've wasted too much time multiple times now debugging. Hopefully this prevents more lost time. Updates tailscale/corp#24454 Change-Id: I87f4539f7be7dc154627f8835a37a8db88c31be0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Aaron Klotz	7d73a38b40	net/dns: only populate OSConfig.Hosts when MagicDNS is enabled ... Previously we were doing this unconditionally. Updates #14428 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	11 months ago
James Tucker	6364b5f1e0	net/netmon: trim IPv6 endpoints in already routable subnets ... We have observed some clients with extremely large lists of IPv6 endpoints, in some cases from subnets where the machine also has the zero address for a whole /48 with then arbitrary addresses additionally assigned within that /48. It is in general unnecessary for reachability to report all of these addresses, typically only one will be necessary for reachability. We report two, to cover some other common cases such as some styles of IPv6 private address rotations. Updates tailscale/corp#25850 Signed-off-by: James Tucker <james@tailscale.com>	11 months ago
Aaron Klotz	d818a58a77	net/dns: ensure the Windows configurator does not touch the hosts file unless the configuration actually changed ... We build up maps of both the existing MagicDNS configuration in hosts and the desired MagicDNS configuration, compare the two, and only write out a new one if there are changes. The comparison doesn't need to be perfect, as the occasional false-positive is fine, but this should greatly reduce rewrites of the hosts file. I also changed the hosts updating code to remove the CRLF/LF conversion stuff, and use Fprintf instead of Frintln to let us write those inline. Updates #14428 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	11 months ago
Brad Fitzpatrick	60d19fa00d	all: use Go 1.21's binary.NativeEndian ... We still use josharian/native (hi @josharian!) via netlink, but I also sent https://github.com/mdlayher/netlink/pull/220 Updates #8632 Change-Id: I2eedcb7facb36ec894aee7f152c8a1f56d7fc8ba Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Nahum Shalman	9373a1b902	all: illumos/solaris userspace only support ... Updates #14565 Change-Id: I743148144938794db0a224873ce76c10dbe6fa5f Signed-off-by: Nahum Shalman <nahamu@gmail.com>	11 months ago
Will Norris	60daa2adb8	all: fix golangci-lint errors ... These erroneously blocked a recent PR, which I fixed by simply re-running CI. But we might as well fix them anyway. These are mostly `printf` to `print` and a couple of `!=` to `!Equal()` Updates #cleanup Signed-off-by: Will Norris <will@tailscale.com>	11 months ago
James Tucker	de9d4b2f88	net/netmon: remove extra panic guard around ParseRIB ... This was an extra defense added for #14201 that is no longer required. Fixes #14201 Signed-off-by: James Tucker <james@tailscale.com>	11 months ago
Brad Fitzpatrick	1e2e319e7d	util/slicesx: add MapKeys and MapValues from golang.org/x/exp/maps ... Importing the ~deprecated golang.org/x/exp/maps as "xmaps" to not shadow the std "maps" was getting ugly. And using slices.Collect on an iterator is verbose & allocates more. So copy (x)maps.Keys+Values into our slicesx package instead. Updates #cleanup Updates #12912 Updates #14514 (pulled out of that change) Change-Id: I5e68d12729934de93cf4a9cd87c367645f86123a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Joe Tsai	b62a013ecb	Switch logging service from log.tailscale.io to log.tailscale.com (#14398) ... Updates tailscale/corp#23617 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	12 months ago
James Tucker	aa04f61d5e	net/netcheck: adjust HTTPS latency check to connection time and avoid data race ... The go-httpstat package has a data race when used with connections that are performing happy-eyeballs connection setups as we are in the DERP client. There is a long-stale PR upstream to address this, however revisiting the purpose of this code suggests we don't really need httpstat here. The code populates a latency table that may be used to compare to STUN latency, which is a lightweight RTT check. Switching out the reported timing here to simply the request HTTP request RTT avoids the problematic package. Fixes tailscale/corp#25095 Signed-off-by: James Tucker <james@tailscale.com>	12 months ago
Irbe Krumina	614c612643	net/netcheck: preserve STUN port defaulting to 3478 (#14289) ... Updates tailscale/tailscale#14287 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	1 year ago
James Tucker	7f9ebc0a83	cmd/tailscale,net/netcheck: add debug feature to force preferred DERP ... This provides an interface for a user to force a preferred DERP outcome for all future netchecks that will take precedence unless the forced region is unreachable. The option does not persist and will be lost when the daemon restarts. Updates tailscale/corp#18997 Updates tailscale/corp#24755 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Brad Fitzpatrick	74069774be	net/tstun: remove tailscaled_outbound_dropped_packets_total reason=acl metric for now ... Updates #14280 Change-Id: Idff102b3d7650fc9dfbe0c340168806bdf542d76 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	8d0c690f89	net/netcheck: clean up ICMP probe AddrPort lookup ... Fixes #14200 Change-Id: Ib086814cf63dda5de021403fe1db4fb2a798eaae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
James Tucker	4d33f30f91	net/netmon: improve panic reporting from #14202 ... I was hoping we'd catch an example input quickly, but the reporter had rebooted their machine and it is no longer exhibiting the behavior. As such this code may be sticking around quite a bit longer and we might encounter other errors, so include the panic in the log entry. Updates #14201 Updates #14202 Updates golang/go#70528 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
James Tucker	f6431185b0	net/netmon: catch ParseRIB panic to gather buffer data ... Updates #14201 Updates golang/go#70528 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago