235 Commits (0a655309c6fccaf7f141d3f5293a31a1c4eab479)

Author	SHA1	Message	Date
Avery Pennarun	8a7d35594d	ipnlocal: don't assume NeedsLogin immediately after StartLogout(). ... Previously, there was no server round trip required to log out, so when you asked ipnlocal to Logout(), it could clear the netmap immediately and switch to NeedsLogin state. In v1.8, we added a true Logout operation. ipn.Logout() would trigger an async cc.StartLogout() and *also* immediately switch to NeedsLogin. Unfortunately, some frontends would see NeedsLogin and immediately trigger a new StartInteractiveLogin() operation, before the controlclient auth state machine actually acted on the Logout command, thus accidentally invalidating the entire logout operation, retaining the netmap, and violating the user's expectations. Instead, add a new LogoutFinished signal from controlclient (paralleling LoginFinished) and, upon starting a logout, don't update the ipn state machine until it's received. Updates: #1918 (BUG-2) Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Adrian Dewhurst	6d6cf88d82	control/controlclient: use our fork of certstore ... The cyolosecurity fork of certstore did not update its module name and thus can only be used with a replace directive. This interferes with installing using `go install` so I created a tailscale fork with an updated module name. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types ... This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Avery Pennarun	6307a9285d	controlclient: update Persist.LoginName when it changes. ... Well, that was anticlimactic. Fixes tailscale/corp#461. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	0181a4d0ac	ipnlocal: don't pause the controlclient until we get at least one netmap. ... Without this, macOS would fail to display its menu state correctly if you started it while !WantRunning. It relies on the netmap in order to show the logged-in username. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	b4d04a065f	controlclient: extract a Client interface and rename Client->Auto. ... This will let us create a mock or fake Client implementation for use with ipn.Backend. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	cc3119e27e	controlclient: extract State and Status stuff into its own file. ... No changes other than moving stuff around. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Brad Fitzpatrick	3411bb959a	control/controlclient: fix signRegisterRequest log suppression check on Windows ... Fixes #1774 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6f52fa02a3	control/controlclient, tailcfg: add Debug.SleepSeconds (mapver 19) ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	09891b9868	ipn/ipnlocal: on fresh lazy-connecting install, start in state NeedsLogin ... Fixes #1759 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e9d24341e0	tailcfg, control/controlclient: accept nil MapResponse.Node (mapver 18) ... All MapResponse fields can not be omitted and are tagged "omitempty". Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3739cf22b0	tailcfg, control/controlclient: allow empty MapResponse.Domain (mapver17) ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5092cffd1f	control/controlclient: add start of some MapResponse->NetworkMap tests ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	aef3c0350c	control/controlclient: break direct.go into map.go (+tests), add mapSession ... So the NetworkMap-from-incremental-MapResponses can be tested easily. And because direct.go was getting too big. No change in behavior at this point. Just movement. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b993d9802a	ipn/ipnlocal, etc: require file sharing capability to send/recv files ... tailscale/corp#1582 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	670838c45f	tailcfg, control/controlclient: (mapver 16) add Node.Online, MapResponse.OnlineChange ... And fix PeerSeenChange bug where it was ignored unless there were other peer changes. Updates tailscale/corp#1574 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	7055f870f8	control/controlclient: only use a single DNS label as the hostname. ... Fixes #971 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	34d2f5a3d9	tailcfg: add Endpoint, EndpointType, MapRequest.EndpointType ... Track endpoints internally with a new tailcfg.Endpoint type that includes a typed netaddr.IPPort (instead of just a string) and includes a type for how that endpoint was discovered (STUN, local, etc). Use []tailcfg.Endpoint instead of []string internally. At the last second, send it to the control server as the existing []string for endpoints, but also include a new parallel MapRequest.EndpointType []tailcfg.EndpointType, so the control server can start filtering out less-important endpoint changes from new-enough clients. Notably, STUN-discovered endpoints can be filtered out from 1.6+ clients, as they can discover them amongst each other via CallMeMaybe disco exchanges started over DERP. And STUN endpoints change a lot, causing a lot of MapResposne updates. But portmapped endpoints are worth keeping for now, as they they work right away without requiring the firewall traversal extra RTT dance. End result will be less control->client bandwidth. (despite negligible increase in client->control bandwidth) Updates tailscale/corp#1543 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ccb322db04	tailcfg, control/controlclient: make nil MapResponse.DNSConfig mean unchanged (mapver15) ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Simon Kirillov	a64b57e2fb	control/controlclient: create tls client config with server hostname instead of serverURL.Host ... Signed-off-by: Simon Kirillov <svkirillov3@gmail.com>	3 years ago
Brad Fitzpatrick	3167e55ddf	ipn/{ipnlocal,localapi}, cmd/tailscale: add logout command ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	597c19ff4e	control/controlclient: refactor some internals ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	3f456ba2e7	control/controlclient: return correct certificate ... When searching for the matching client identity, the returned certificate chain was accidentally set to that of the last identity returned by the certificate store instead of the one corresponding to the selected identity. Also, add some extra error checking for invalid certificate chains, just in case. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Denton Gentry	224e60cef2	hostifo: update LXC, add Cloud Run. ... Recent LXC support no longer has "lxc" in /proc/1/cgroup: # cat /proc/1/cgroup 12:freezer:/ 11:rdma:/ 10:cpuset:/ 9:pids:/ 8:blkio:/ 7:devices:/ 6:perf_event:/ 5:net_cls,net_prio:/ 4:memory:/ 3:hugetlb:/ 2:cpu,cpuacct:/ 1:name=systemd:/init.scope 0::/init.scope Look for fuse.lxcfs in /proc.mounts in addition: # grep lxc /proc/mounts lxcfs /proc/cpuinfo fuse.lxcfs ... lxcfs /proc/diskstats fuse.lxcfs ... lxcfs /proc/loadavg fuse.lxcfs ... lxcfs /proc/meminfo fuse.lxcfs ... lxcfs /proc/stat fuse.lxcfs ... lxcfs /proc/swaps fuse.lxcfs ... lxcfs /proc/uptime fuse.lxcfs ... lxcfs /sys/devices/system/cpu/online fuse.lxcfs ... Add Knative detection by looking for the environment variables which are part of its container contract. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	1bd14a072c	cmd/tailscale, ipn/localapi: move IP forwarding check to tailscaled, API ... Instead of having the CLI check whether IP forwarding is enabled, ask tailscaled. It has a better idea. If it's netstack, for instance, the sysctl values don't matter. And it's possible that only the daemon has permission to know. Fixes #1626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a998fe7c3d	control/controlclient: support lazy machine key generation ... It's not done in the caller yet, but the controlclient does it now. Updates #1573 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ddaacf0a57	control/controlclient: document a few things ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	12ae2d73b3	control/controlclient: fix TS_DEBUG_MAP on requests ... The concrete type being encoded changed from a value to pointer earlier and this was never adjusted. (People don't frequently use TS_DEBUG_MAP to see requests, so it went unnoticed until now.) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	04dd6d1dae	control/controlclient: sign RegisterRequest (#1549) ... control/controlclient: sign RegisterRequest Some customers wish to verify eligibility for devices to join their tailnets using machine identity certificates. TLS client certs could potentially fulfill this role but the initial customer for this feature has technical requirements that prevent their use. Instead, the certificate is loaded from the Windows local machine certificate store and uses its RSA public key to sign the RegisterRequest message. There is room to improve the flexibility of this feature in future and it is currently only tested on Windows (although Darwin theoretically works too), but this offers a reasonable starting place for now. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Brad Fitzpatrick	0a02aaf813	control, ipn, tailcfg: remove golang.org/x/oauth2 dep, add tailcfg.Oauth2Token ... golang.org/x/oauth2 pulls in App Engine and grpc module dependencies, screwing up builds that depend on this module. Some background on the problem: https://go.googlesource.com/proposal/+/master/design/36460-lazy-module-loading.md Fixes tailscale/corp#1471 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cc508be603	control/controlclient: remove redundant Hostinfo log ... The direct client already logs it in JSON form. Then it's immediately logged again in an unformatted dump, so this removes that unformatted one. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9eb65601ef	health, ipn/ipnlocal: track, log overall health ... Updates #1505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6fbc9b3a98	control/controlclient: cache Windows version ... To atone for 1d7f9d5b4a, the revert of 4224b3f731. At least it's fast again, even if it's shelling out to cmd.exe (once now). Updates #1478 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1d7f9d5b4a	Revert "control/controlclient: use API to get Windows version number" ... This reverts commit 4224b3f731. From https://github.com/tailscale/tailscale/pull/1494#discussion_r594852889 ... > Actually, I want all four numbers back. I spent the evening > debugging an issue for a user running an old version of Windows > and then going to to > https://en.wikipedia.org/wiki/Windows_10_version_history_(version_1809) > and reading all the revision notes in the footnotes of that wikipedia > page. > > I'm going to revert this for now for Tailscale 1.6. We can land it > again later when we figure out how to get the fourth numbers. Updates #1478	3 years ago
Brad Fitzpatrick	232cfda280	wgengine/router: report to control when setPrivateNetwork fails ... Fixes #1503 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ba8c6d0775	health, controlclient, ipn, magicsock: tell health package state of things ... Not yet checking anything. Just plumbing states into the health package. Updates #1505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aleksandar Pesic	4224b3f731	control/controlclient: use API to get Windows version number ... Fixes #1478 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	3 years ago
David Anderson	1bc3c03562	control/controlclient: allow for an unset linkMon. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	0b66cfe1e0	control/controlclient: report broken IP forwarding more precisely. ... IP forwarding is not required when advertising a machine's local IPs over Tailscale. Fixes #1435. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	f45a9e291b	tailcfg, control/controlclient: add MapResponse.PingRequest ... So the control server can test whether a client's actually present. Most clients are over HTTP/2, so these pings (to the same host) are super cheap. This mimics the earlier goroutine dump mechanism. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	affd859121	ipn/ipnlocal, control/controlclient: propagate link monitor to controlclient ... Don't use it yet, but get it down there. Updates #1455 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	92cdb30b26	tailcfg, control/controlclient: add goroutine dump debug feature ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9df4185c94	control/controlclient, net/{dnscache,dnsfallback}: add DNS fallback mechanism ... Updates #1405 Updates #1403 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fd8e070d01	health, control/controlclient, wgengine: report when router unhealthy ... Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4ec01323c1	control/controlclient: note package type in Hostinfo ... Fixes tailscale/corp#440 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1e7a35b225	types/netmap: split controlclient.NetworkMap off into its own leaf package ... Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ddfcc4326c	types/persist: split controlclient.Persist into a small leaf package ... This one alone doesn't modify the global dependency map much (depaware.txt if anything looks slightly worse), but it leave controlclient as only containing NetworkMap: bradfitz@tsdev:~/src/tailscale.com/ipn$ grep -F "controlclient." *.go backend.go: NetMap *controlclient.NetworkMap // new netmap received fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) handle.go: netmapCache *controlclient.NetworkMap handle.go:func (h *Handle) NetMap() *controlclient.NetworkMap { Once that goes into a leaf package, then ipn doesn't depend on controlclient at all, and then the client gets smaller. Updates #1278	3 years ago
Brad Fitzpatrick	6064b6ff47	wgengine/wgcfg/nmcfg: split control/controlclient/netmap.go into own package ... It couldn't move to ipnlocal due to test dependency cycles. Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	b9c2231fdf	ipn: program exit node into the data plane according to user pref. ... Part of #1153, #1154. Fixes #1224. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	e8d4afedd1	control/controlclient: don't call lite endpoint update path when logged out ... This was the other half of the #1271 problem. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago