550 Commits (0842e2f45b7384fff1991f0782bf0816f0578fda)

Author	SHA1	Message	Date
julianknodt	1bb6abc604	net/portmapper: add upnp port mapping ... Add in UPnP portmapping, using goupnp library in order to get the UPnP client and run the portmapping functions. This rips out anywhere where UPnP used to be in portmapping, and has a flow separate from PMP and PCP. RELNOTE=portmapper now supports UPnP mappings Fixes #682 Updates #2109 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Aaditya Chaudhary	4f89fe17a2	Implemented Commandline Download Speedtest (#2064) ... Added the net/speedtest package that contains code for starting up a speedtest server and a client. The speedtest command for starting a client takes in a duration for the speedtest as well as the host and port of the speedtest server to connect to. The speedtest command for starting a server takes in a host:port pair to listen on. Signed-off-by: Aaditya Chaudhary <32117362+AadityaChaudhary@users.noreply.github.com>	3 years ago
julianknodt	b67a3007d5	cmd/derper: remove default for non-root users ... Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	9d4eddcef8	cmd/derper: add default -c arguments ... This adds some convenient defaults for -c, so that user-provided DERPs require less command line flags. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	ee71c966fd	cmd/derpprobe: bound node pair probe duration ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	e28bc49e5f	netns_linux: remove special handling for tests. ... With netns handling localhost now, existing tests no longer need special handling. The tests set up their connections to localhost, and the connections work without fuss. Remove the special handling for tests. Also remove the hostinfo.TestCase support, since this was the only use of it. It can be added back later if really needed, but it would be better to try to make tests work without special cases. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	d2480fd508	net/netns: support !CAP_NET_ADMIN ... netns_linux checked whether "ip rule" could run to determine whether to use SO_MARK for network namespacing. However in Linux environments which lack CAP_NET_ADMIN, such as various container runtimes, the "ip rule" command succeeds but SO_MARK fails due to lack of permission. SO_BINDTODEVICE would work in these environments, but isn't tried. In addition to running "ip rule" check directly whether SO_MARK works or not. Among others, this allows Microsoft Azure App Service and AWS App Runner to work. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Dan Bond	ceb8c2b34e	cmd/tailscale: update web server test copyright ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Dan Bond	52972679e6	cmd/tailscale: improve web server test structure ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Dan Bond	4c684fcf8c	cmd/tailscale: test web server url func ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Dan Bond	652bbc9aa0	cmd/tailscale: log web listen addr ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Brad Fitzpatrick	1cedd944cf	cmd/tailscale/cli: diagnose missing tailscaled on 'up' ... Fixes #2029 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	61e8fd4698	cmd/derpprobe: move from cmd/derper/derpprobe ... Because our corp build system is confused by nested binaries. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	05da2691a5	cmd/derper/derpprobe: add derp prober ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	87481282eb	ipn: another controlplane synonym ... This one doesn't bother me so much, as long term we want a synonym here. Fixes #2384 Fixes #2386 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	c84d7baf98	cmd/tailscale/cli: factor out more up code for testing ... In theory, some of the other table-driven tests could be moved into this form now but I didn't want to disturb too much good test code. Includes a commented-out test for #2384 that is currently failing. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	92077ae78c	wgengine/magicsock: make portmapping async ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Christine Dodrill	a19eea965f	tstest/integration/vms: use an in-process logcatcher (#2360) ... This adapts the existing in-process logcatcher from tstest/integration into a public type and uses it on the side of testcontrol. This also fixes a bug in the Alpine Linux OpenRC unit that makes every value in `/etc/default/tailscaled` exported into tailscaled's environment, a-la systemd [Service].EnviromentFile. Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Brad Fitzpatrick	a9fc583211	cmd/tailscale/cli: document the web subcommand a bit more ... Fixes #2326 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	700badd8f8	util/deephash: move internal/deephash to util/deephash ... No code changes. Just a minor package doc addition about lack of API stability.	3 years ago
Maisem Ali	ec52760a3d	wgengine/router_windows: support toggling local lan access when using ... exit nodes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Crawshaw	c37713b927	cmd/tailscale/cli: accept login server synonym ... Fixes #2272 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
julianknodt	e68d4d5805	cmd/tailscale: add debug flag to dump derp map ... This adds a flag in tailscale debug for dumping the derp map to stdout. Fixes #2249. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	506c2fe8e2	cmd/tailscale: make netcheck use active DERP map, delete static copy ... After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	3910c1edaf	net/socks5/tssocks: add new package, move SOCKS5 glue out of tailscaled ... Prep for #1970, #2264, #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	82e15d3450	cmd/tailscaled: log SOCKS5 port when port 0 requested ... Part of #2158 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	10d7c2583c	net/dnsfallback: don't depend on derpmap.Prod ... Move derpmap.Prod to a static JSON file (go:generate'd) instead, to make its role explicit. And add a TODO about making dnsfallback use an update-over-time DERP map file instead of a baked-in one. Updates #1264 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	148602a89a	derp,cmd/derper: allow server to verify clients ... This adds a flag to the DERP server which specifies to verify clients through a local tailscaled. It is opt-in, so should not affect existing clients, and is mainly intended for users who want to run their own DERP servers. It assumes there is a local tailscaled running and will attempt to hit it for peer status information. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	0f18801716	cmd/cloner: support maps with clone ptrs ... In order to clone DERPMaps, it was necessary to extend the cloner so that it supports nested pointers inside of maps which are also cloneable. This also adds cloning for DERPRegions and DERPNodes because they are on DERPMap's maps. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	38be964c2b	go.mod: update netstack ... Fixes a atomic alignment crash on 32-bit machines. Fixes #2129 Fixes tailscale/tailscale-synology#66 (same) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	ad288baaea	net/interfaces: use IPv4 link local if nothing better ... The only connectivity an AWS Lambda container has is an IPv4 link-local 169.254.x.x address using NAT: 12: vtarget_1@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 7e:1c:3f:00:00:00 brd ff:ff:ff:ff:ff:ff link-netnsid 1 inet 169.254.79.1/32 scope global vtarget_1 valid_lft forever preferred_lft forever If there are no other IPv4/v6 addresses available, and we are running in AWS Lambda, allow IPv4 169.254.x.x addresses to be used. ---- Similarly, a Google Cloud Run container's only connectivity is a Unique Local Address fddf:3978:feb1:d745::c001/128. If there are no other addresses available then allow IPv6 Unique Local Addresses to be used. We actually did this in an earlier release, but now refactor it to work the same way as the IPv4 link-local support is being done. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
David Crawshaw	297b3d6fa4	staticcheck.conf: turn off noisy lint errors ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
julianknodt	3728634af9	derp: add debug traffic handler ... This adds a handler on the DERP server for logging bytes send and received by clients of the server, by holding open a connection and recording if there is a difference between the number of bytes sent and received. It sends a JSON marshalled object if there is an increase in the number of bytes. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	03311bb0d6	hostinfo: add hostinfo package, move stuff out of controlclient ... And make it cheaper, so other parts of the code can check the environment. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	0022c3d2e2	tsweb: replace NewMux with a more flexible DebugHandler. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	48c25fa36f	tsweb: fold StdHandlerOpts and StdHandler200s with StdHandler. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	ac07ff43bf	cmd/tailscaled: start after NetworkManager and systemd-resolved. ... The dependency is a "soft" ordering dependency only, meaning that tailscaled will start after those services if those services were going to be run anyway, but doesn't force either of them to run. That's why it's safe to specify this dependency unconditionally, even for systems that don't run those services. Updates #2127. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	80a4052593	cmd/tailscale, wgengine, tailcfg: don't assume LastSeen is present [mapver 20] ... Updates #2107 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Christine Dodrill	8b2b899989	tstest/integration: test Alpine Linux (#2098) ... Alpine Linux[1] is a minimal Linux distribution built around musl libc. It boots very quickly, requires very little ram and is as close as you can get to an ideal citizen for testing Tailscale on musl. Alpine has a Tailscale package already[2], but this patch also makes it easier for us to provide an Alpine Linux package off of pkgs in the future. Alpine only offers Tailscale on the rolling-release edge branch. [1]: https://alpinelinux.org/ [2]: https://pkgs.alpinelinux.org/packages?name=tailscale&branch=edge Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Maisem Ali	f944614c5c	cmd/tailscale/web: add support for QNAP ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Matt Layher	6956645ec8	go.mod: bump github.com/mdlayher/netlink to v1.4.1 ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	3 years ago
David Anderson	1c6946f971	cmd/mkpkg: allow zero files in a package. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maisem Ali	95e296fd96	cmd/tailscale/web: restrict web access to synology admins. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Adrian Dewhurst	6d6cf88d82	control/controlclient: use our fork of certstore ... The cyolosecurity fork of certstore did not update its module name and thus can only be used with a replace directive. This interferes with installing using `go install` so I created a tailscale fork with an updated module name. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
David Crawshaw	82b217f82e	cmd/tailscale: have web POST wait for authURL ... Fixes #1939 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	50c976d3f1	cmd/tailscale: show web 'login' error message ... For #1939 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	d2c4e75099	cmd/tailscale/cli: update URL in error message for Synology unsupported feature ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cdd231cb7d	cmd/tailscale/cli: don't warn about iptables=off on Synology ... We don't use iptables on Synology, so don't scare the user. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	1ece91cede	go.mod: upgrade wireguard-windows, de-fork wireguard-go ... Pull in the latest version of wireguard-windows. Switch to upstream wireguard-go. This requires reverting all of our import paths. Unfortunately, this has to happen at the same time. The wireguard-go change is very low risk, as that commit matches our fork almost exactly. (The only changes are import paths, CI files, and a go.mod entry.) So if there are issues as a result of this commit, the first place to look is wireguard-windows changes. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	a86a0361a7	go.mod: upgrade all deps ... At the start of a dev cycle we'll upgrade all dependencies. Done with: $ for Dep in $(cat go.mod | perl -ne '/(\S+) v/ and print "$1\n"'); do go get $Dep@upgrade; done Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	5666663370	net/packet: use netaddr AppendTo methods ... This lets us remote the types/strbuilder package, which had only a single user. And it's faster. name old time/op new time/op delta String/tcp4-8 175ns ± 0% 58ns ± 1% -66.95% (p=0.000 n=10+9) String/tcp6-8 226ns ± 1% 136ns ± 1% -39.85% (p=0.000 n=10+10) String/udp4-8 175ns ± 1% 58ns ± 1% -67.01% (p=0.000 n=10+9) String/udp6-8 230ns ± 1% 140ns ± 0% -39.32% (p=0.000 n=10+9) String/icmp4-8 164ns ± 0% 50ns ± 1% -69.89% (p=0.000 n=10+10) String/icmp6-8 217ns ± 1% 129ns ± 0% -40.46% (p=0.000 n=10+10) String/igmp-8 196ns ± 0% 56ns ± 1% -71.32% (p=0.000 n=10+10) String/unknown-8 2.06ns ± 1% 2.06ns ± 2% ~ (p=0.985 n=10+10) name old alloc/op new alloc/op delta String/tcp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/tcp6-8 168B ± 0% 96B ± 0% -42.86% (p=0.000 n=10+10) String/udp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/udp6-8 168B ± 0% 96B ± 0% -42.86% (p=0.000 n=10+10) String/icmp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/icmp6-8 104B ± 0% 64B ± 0% -38.46% (p=0.000 n=10+10) String/igmp-8 48.0B ± 0% 48.0B ± 0% ~ (all equal) String/unknown-8 0.00B 0.00B ~ (all equal) name old allocs/op new allocs/op delta String/tcp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/tcp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/udp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/udp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/icmp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/icmp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/igmp-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/unknown-8 0.00 0.00 ~ (all equal) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Maisem Ali	234cc87f48	cmd/tailscaled: use the wf package instead of wireguard-windows/firewall ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types ... This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	6f62bbae79	cmd/tailscale: make ping --until-direct require direct connection to exit 0 ... If --until-direct is set, the goal is to make a direct connection. If we failed at that, say so, and exit with an error. RELNOTE=tailscale ping --until-direct (the default) now exits with a non-zero exit code if no direct connection was established. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	36a26e6a71	internal/deephash: rename from deepprint ... Yes, it printed, but that was an implementation detail for hashing. And coming optimization will make it print even less. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	7027fa06c3	wf: implement windows firewall using inet.af/wf. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	5190435d6e	cmd/tailscale: rewrite the "up" checker, fix bugs ... The old way was way too fragile and had felt like it had more special cases than normal cases. (see #1874, #1860, #1834, etc) It became very obvious the old algorithm didn't work when we made the output be pretty and try to show the user the command they need to run in 5ecc7c7200 for #1746) The new algorithm is to map the prefs (current and new) back to flags and then compare flags. This nicely handles the OS-specific flags and the n:1 and 1:n flag:pref cases. No change in the existing already-massive test suite, except some ordering differences (the missing items are now sorted), but some new tests are added for behavior that was broken before. In particular, it now: * preserves non-pref boolean flags set to false, and preserves exit node IPs (mapping them back from the ExitNodeID pref, as well as ExitNodeIP), * doesn't ignore --advertise-exit-node when doing an EditPrefs call (#1880) * doesn't lose the --operator on the non-EditPrefs paths (e.g. with --force-reauth, or when the backend was not in state Running). Fixes #1880 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e78e26b6fb	cmd/tailscale: fix another up warning with exit nodes ... The --advertise-routes and --advertise-exit-node flags both mutating one pref is the gift that keeps on giving. I need to rewrite the this up warning code to first map prefs back to flag values and then just compare flags instead of comparing prefs, but this is the minimal fix for now. This also includes work on the tests, to make them easier to write (and more accurate), by letting you write the flag args directly and have that parse into the upArgs/MaskedPrefs directly, the same as the code, rather than them being possibly out of sync being written by hand. Fixes https://twitter.com/EXPbits/status/1390418145047887877 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2585edfaeb	cmd/tailscale: fix tailscale up --advertise-exit-node validation ... Fixes #1859 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	52e1031428	cmd/tailscale: gofmt ... From 6d10655dc3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Avery Pennarun	6d10655dc3	ipnlocal: accept a new opts.UpdatePrefs field. ... This is needed because the original opts.Prefs field was at some point subverted for use in frontend->backend state migration for backward compatibility on some platforms. We still need that feature, but we also need the feature of providing the full set of prefs from `tailscale up`, *not* including overwriting the prefs.Persist keys, so we can't use the original field from `tailscale up`. `tailscale up` had attempted to compensate for that by doing SetPrefs() before Start(), but that violates the ipn.Backend contract, which says you should call Start() before anything else (that's why it's called Start()). As a result, doing SetPrefs({ControlURL=..., WantRunning=true}) would cause a connection to the *previous* control server (because WantRunning=true), and then connect to the *new* control server only after running Start(). This problem may have been avoided before, but only by pure luck. It turned out to be relatively harmless since the connection to the old control server was immediately closed and replaced anyway, but it created a race condition that could have caused spurious notifications or rejected keys if the server responded quickly. As already covered by existing TODOs, a better fix would be to have Start() get out of the business of state migration altogether. But we're approaching a release so I want to make the minimum possible fix. Fixes #1840. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Josh Bleecher Snyder	7dbbe0c7c7	cmd/tailscale/cli: fix running from Xcode ... We were over-eager in running tailscale in GUI mode. f42ded7acf fixed that by checking for a variety of shell-ish env vars and using those to force us into CLI mode. However, for reasons I don't understand, those shell env vars are present when Xcode runs Tailscale.app on my machine. (I've changed no configs, modified nothing on a brand new machine.) Work around that by adding an additional "only in GUI mode" check. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	3 years ago
Josh Bleecher Snyder	9360f36ebd	all: use lower-case letters at the start of error message ... Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	3 years ago
Brad Fitzpatrick	962bf74875	cmd/tailscale: fail if tailscaled closes the IPN connection ... I was going to write a test for this using the tstest/integration test stuff, but the testcontrol implementation isn't quite there yet (it always registers nodes and doesn't provide AuthURLs). So, manually tested for now. Fixes #1843 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	1f48d3556f	cmd/tailscale/cli: don't report outdated auth URL to web UI ... This brings the web 'up' logic into line with 'tailscale up'. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	1336ed8d9e	cmd/tailscale/cli: skip new tab on web login ... It doesn't work properly. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	ca65c6cbdb	cmd/tailscale: make 'file cp' have better error messages on bad targets ... Say when target isn't owned by current user, and when target doesn't exist in netmap. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	90002be6c0	cmd/tailscale: make pref-revert checks ignore OS-irrelevant prefs ... This fixes #1833 in two ways: * stop setting NoSNAT on non-Linux. It only matters on Linux and the flag is hidden on non-Linux, but the code was still setting it. Because of that, the new pref-reverting safety checks were failing when it was changing. * Ignore the two Linux-only prefs changing on non-Linux. Fixes #1833 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fb67d8311c	cmd/tailscale: pull out, parameterize up FlagSet creation for tests ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f6e3240dee	cmd/tailscale/cli: add test to catch ipn.Pref additions	3 years ago
Avery Pennarun	6caa02428e	cmd/tailscale/cli/up: "LoggedOut" pref is implicit. ... There's no need to warn that it was not provided on the command line after doing a sequence of up; logout; up --args. If you're asking for tailscale to be up, you always mean that you prefer LoggedOut to become false. Fixes #1828 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	19c3e6cc9e	types/logger: rate limited: more hysteresis, better messages. ... - Switch to our own simpler token bucket, since x/time/rate is missing necessary stuff (can't provide your own time func; can't check the current bucket contents) and it's overkill anyway. - Add tests that actually include advancing time. - Don't remove the rate limit on a message until there's enough room to print at least two more of them. When we do, we'll also print how many we dropped, as a contextual reminder that some were previously lost. (This is more like how the Linux kernel does it.) - Reformat the [RATE LIMITED] messages to be shorter, and to not corrupt original message. Instead, we print the message, then print its format string. - Use %q instead of \"%s\", for more accurate parsing later, if the format string contained quotes. Fixes #1772 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Josh Bleecher Snyder	20e04418ff	net/dns: add GOOS build tags ... Fixes #1786 Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	3 years ago
David Anderson	72b6d98298	net/interfaces: return all Tailscale addresses from Tailscale(). ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	3c543c103a	wgengine/magicsock: unify initial bind and rebind ... We had two separate code paths for the initial UDP listener bind and any subsequent rebinds. IPv6 got left out of the rebind code. Rather than duplicate it there, unify the two code paths. Then improve the resulting code: * Rebind had nested listen attempts to try the user-specified port first, and then fall back to :0 if that failed. Convert that into a loop. * Initial bind tried only the user-specified port. Rebind tried the user-specified port and 0. But there are actually three ports of interest: The one the user specified, the most recent port in use, and 0. We now try all three in order, as appropriate. * In the extremely rare case in which binding to port 0 fails, use a dummy net.PacketConn whose reads block until close. This will keep the wireguard-go receive func goroutine alive. As a pleasant side-effect of this, if we decide that we need to resuscitate #1796, it will now be much easier. Fixes #1799 Co-authored-by: David Anderson <danderson@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	3 years ago
Josh Bleecher Snyder	8fb66e20a4	wgengine/magicsock: remove DefaultPort const ... Assume it'll stay at 0 forever, so hard-code it and delete code conditional on it being non-0. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	3 years ago
Brad Fitzpatrick	1e6d512bf0	cmd/tailscale: improve file cp error message in macOS GUI version ... Fixes tailscale/corp#1684 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8554694616	cmd/tailscale: add 'tailscale file get' subcommand ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cafa037de0	cmd/tailscale/cli: rename 'tailscale push' to 'tailscale file cp' ... And reverse order, require final colon, and support multiple files. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Ross Zurowski	b062ac5e86	cmd/tailscale: fix typo in error message (#1807) ... Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	3 years ago
Brad Fitzpatrick	5ecc7c7200	cmd/tailscale: make the new 'up' errors prettier and more helpful ... Fixes #1746 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ffe6c8e335	cmd/tailscale/cli: don't do a simple up when in state NeedsLogin ... Fixes #1780 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	25ce9885a2	net/dns: don't use NM+resolved for NM >=1.26.6. ... NetworkManager fixed the bug that forced us to use NetworkManager if it's programming systemd-resolved, and in the same release also made NetworkManager ignore DNS settings provided for unmanaged interfaces... Which breaks what we used to do. So, with versions 1.26.6 and above, we MUST NOT use NetworkManager to indirectly program systemd-resolved, but thankfully we can talk to resolved directly and get the right outcome. Fixes #1788 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Aleksandar Pesic	7c985e4944	ipn/ipnlocal: add file sharing to windows shell ... Updates: tailscale/winmin#33 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	3 years ago
Brad Fitzpatrick	d94ed7310b	cmd/tailscale/cli: add test for already-submitted #1777 ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	30629c430a	cmd/tailscale/cli: don't force an interactive login on --reset. ... Fixes #1778 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	67ba6aa9fd	cmd/tailscale/cli: fix typo in ExitNodeID mapping. ... Prevented turning off exit nodes. Fixes #1777 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	11780a4503	cmd/tailscale: only send file basename in push ... Fixes #1640 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	820952daba	cmd/tailscale: don't print out old authURL on up --force-reauth ... Fixes #1671 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c91a22c82e	cmd/tailscale: don't print auth URL when using a --authkey ... Fixes #1755 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e40e5429c2	cmd/tailscale/cli: make 'tailscale up' protect --advertise-exit-node removal ... The new "tailscale up" checks previously didn't protect against --advertise-exit-node being omitted in the case that --advertise-routes was also provided. It wasn't done before because there is no corresponding pref for "--advertise-exit-node"; it's a helper flag that augments --advertise-routes. But that's an implementation detail and we can still help users. We just have to special case that pref and look whether the current routes include both the v4 and v6 /0 routes. Fixes #1767 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a16eb6ac41	cmd/tailscale/cli: show online/offline status in push --file-targets ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	dedbd483ea	cmd/tailscale/cli: don't require explicit --operator if it matches $USER ... This doesn't make --operator implicit (which we might do in the future), but it at least doesn't require repeating it in the future when it already matches $USER. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	91c9c33036	cmd/tailscaled: don't block ipnserver startup behind engine init on Windows ... With this change, the ipnserver's safesocket.Listen (the localhost tcp.Listen) happens right away, before any synchronous TUN/DNS/Engine/etc setup work, which might be slow, especially on early boot on Windows. Because the safesocket.Listen starts up early, that means localhost TCP dials (the safesocket.Connect from the GUI) complete successfully and thus the GUI avoids the MessageBox error. (I verified that pacifies it, even without a Listener.Accept; I'd feared that Windows localhost was maybe special and avoided the normal listener backlog). Once the GUI can then connect immediately without errors, the various timeouts then matter less, because the backend is no longer trying to race against the GUI's timeout. So keep retrying on errors for a minute, or 10 minutes if the system just booted in the past 10 minutes. This should fix the problem with Windows 10 desktops auto-logging in and starting the Tailscale frontend which was then showing a MessageBox error about failing to connect to tailscaled, which was slow coming up because the Windows networking stack wasn't up yet. Fingers crossed. Fixes #1313 (previously #1187, etc) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Alex Brainman	7689213aaa	cmd/tailscaled: add subcommands to install and remove tailscaled Windows service ... This change implements Windows version of install-system-daemon and uninstall-system-daemon subcommands. When running the commands the user will install or remove Tailscale Windows service. Updates #1232 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	3 years ago
Brad Fitzpatrick	f99e63bb17	ipn: don't Logout when Windows GUI disconnects ... Logout used to be a no-op, so the ipnserver previously synthensized a Logout on disconnect. Now that Logout actually invalidates the node key that was forcing all GUI closes to log people out. Instead, add a method to LocalBackend to specifically mean "the Windows GUI closed, please forget all the state". Fixes tailscale/corp#1591 (ignoring the notification issues, tracked elsewhere) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f42ded7acf	cmd/tailscale/cli: relax & improve the running-as-CLI check for macOS ... On macOS, we link the CLI into the GUI executable so it can be included in the Mac App Store build. You then need to run it like: /Applications/Tailscale.app/Contents/MacOS/Tailscale <command> But our old detection of whether you're running that Tailscale binary in CLI mode wasn't accurate and often bit people. For instance, when they made a typo, it then launched in GUI mode and broke their existing GUI connection (starting a new IPNExtension) and took down their network. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8f3e453356	ipn, cmd/tailscale/cli: add pref to configure sudo-free operator user ... From discussion with @danderson. Fixes #1684 (in a different way) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	49808ae6ea	ipn{,/ipnlocal}, cmd/tailscale/cli: don't check pref reverts on initial up ... The ipn.NewPrefs func returns a populated ipn.Prefs for historical reasons. It's not used or as important as it once was, but it hasn't yet been removed. Meanwhile, it contains some default values that are used on some platforms. Notably, for this bug (#1725), Windows/Mac use its Prefs.RouteAll true value (to accept subnets), but Linux users have always gotten a "false" value for that, because that's what cmd/tailscale's CLI default flag is _for all operating systems_. That meant that "tailscale up" was rightfully reporting that the user was changing an implicit setting: RouteAll was changing from true with false with the user explicitly saying so. An obvious fix might be to change ipn.NewPrefs to return Prefs.RouteAll == false on some platforms, but the logic is complicated by darwin: we want RouteAll true on windows, android, ios, and the GUI mac app, but not the CLI tailscaled-on-macOS mode. But even if we used build tags (e.g. the "redo" build tag) to determine what the default is, that then means we have duplicated and differing "defaults" between both the CLI up flags and ipn.NewPrefs. Furthering that complication didn't seem like a good idea. So, changing the NewPrefs defaults is too invasive at this stage of the release, as is removing the NewPrefs func entirely. Instead, tweak slightly the semantics of the ipn.Prefs.ControlURL field. This now defines that a ControlURL of the empty string means both "we're uninitialized" and also "just use the default". Then, once we have the "empty-string-means-unintialized" semantics, use that to suppress "tailscale up"'s recent implicit-setting-revert checking safety net, if we've never initialized Tailscale yet. And update/add tests. Fixes #1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4df6e62fbc	ipn: add DefaultControlURL const, replace few literals with it ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago