752 Commits (1410682fb68e650786940811784c835ddb786e5a)

Author	SHA1	Message	Date
Mihai Parparita	9cb332f0e2	sockstats: instrument networking code paths ... Uses the hooks added by tailscale/go#45 to instrument the reads and writes on the major code paths that do network I/O in the client. The convention is to use "<package>.<type>:<label>" as the annotation for the responsible code path. Enabled on iOS, macOS and Android only, since mobile platforms are the ones we're most interested in, and we are less sensitive to any throughput degradation due to the per-I/O callback overhead (macOS is also enabled for ease of testing during development). For now just exposed as counters on a /v0/sockstats PeerAPI endpoint. We also keep track of the current interface so that we can break out the stats by interface. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Mihai Parparita	780c56e119	ipn/ipnlocal: add delegated interface information to /interfaces PeerAPI handler ... Exposes the delegated interface data added by #7248 in the debug endpoint. I would have found it useful when working on that PR, and it may be handy in the future as well. Also makes the interfaces table slightly easier to parse by adding borders to it. To make then nicer-looking, the CSP was relaxed to allow inline styles. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
David Anderson	8b2ae47c31	version: unexport all vars, turn Short/Long into funcs ... The other formerly exported values aren't used outside the package, so just unexport them. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Mihai Parparita	fa932fefe7	net/interfaces: redo how we get the default interface on macOS and iOS ... With #6566 we added an external mechanism for getting the default interface, and used it on macOS and iOS (see tailscale/corp#8201). The goal was to be able to get the default physical interface even when using an exit node (in which case the routing table would say that the Tailscale utun* interface is the default). However, the external mechanism turns out to be unreliable in some cases, e.g. when multiple cellular interfaces are present/toggled (I have occasionally gotten my phone into a state where it reports the pdp_ip1 interface as the default, even though it can't actually route traffic). It was observed that `ifconfig -v` on macOS reports an "effective interface" for the Tailscale utn* interface, which seems promising. By examining the ifconfig source code, it turns out that this is done via a SIOCGIFDELEGATE ioctl syscall. Though this is a private API, it appears to have been around for a long time (e.g. it's in the 10.13 xnu release at https://opensource.apple.com/source/xnu/xnu-4570.41.2/bsd/net/if_types.h.auto.html) and thus is unlikely to go away. We can thus use this ioctl if the routing table says that a utun* interface is the default, and go back to the simpler mechanism that we had before #6566. Updates #7184 Updates #7188 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Mihai Parparita	21fda7f670	net/routetable: include unknown flags in the routetable doctor output ... As part of the work on #7248 I wanted to know all of the flags on the RouteMessage struct that we get back from macOS. Though it doesn't turn out to be useful (when using an exit node/Tailscale is the default route, the flags for the physical interface routes are the same), it still seems useful from a debugging/comprehensiveness perspective. Adds additional Darwin flags that were output once I enabled this mode. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Tom DNetto	2ca6dd1f1d	wgengine: start logging DISCO frames to pcap stream ... Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Colin Adler	3c107ff301	net/connstats: fix ticker in NewStatistics (#7225) ... `:=` was accidentally used, so `maxPeriod` never worked. Signed-off-by: Colin Adler <colin1adler@gmail.com>	1 year ago
Mihai Parparita	62f4df3257	net/interfaces, net/netns: add node attributes to control default interface getting and binding ... With #6566 we started to more aggressively bind to the default interface on Darwin. We are seeing some reports of the wrong cellular interface being chosen on iOS. To help with the investigation, this adds to knobs to control the behavior changes: - CapabilityDebugDisableAlternateDefaultRouteInterface disables the alternate function that we use to get the default interface on macOS and iOS (implemented in tailscale/corp#8201). We still log what it would have returned so we can see if it gets things wrong. - CapabilityDebugDisableBindConnToInterface is a bigger hammer that disables binding of connections to the default interface altogether. Updates #7184 Updates #7188 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Brad Fitzpatrick	2477fc4952	net/netutil: only check Linux sysctls w/ procfs, assume absent means false ... Fixes #7217 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Tom DNetto	99b9d7a621	all: implement pcap streaming for datapath debugging ... Updates: tailscale/corp#8470 Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Mihai Parparita	0e3fb91a39	net/dns/resolver: remove maxDoHInFlight ... It was originally added to control memory use on iOS (#2490), but then was relaxed conditionally when running on iOS 15 (#3098). Now that we require iOS 15, there's no need for the limit at all, so simplify back to the original state. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Mihai Parparita	b6908181ff	net/tshttpproxy: more directly use Transport proxy CONNECT hooks ... GetProxyConnectHeader (golang/go#41048) was upstreamed in Go 1.16 and OnProxyConnectResponse (golang/go#54299) in Go 1.20, thus we no longer need to guard their use by the tailscale_go build tag. Updates #7123 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Andrew Dunham	880a41bfcc	net/dns/resolver: add envknob to debug exit node DNS queries on on Windows ... Add the envknob TS_DEBUG_EXIT_NODE_DNS_NET_PKG, which enables more verbose debug logging when calling the handleExitNodeDNSQueryWithNetPkg function. This function is currently only called on Windows and Android. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ieb3ca7b98837d7dc69cd9ca47609c1c52e3afd7b	1 year ago
Brad Fitzpatrick	03645f0c27	net/{netns,netstat}: use new x/sys/cpu.IsBigEndian ... See golang/go#57237 Change-Id: If47ab6de7c1610998a5808e945c4177c561eab45 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Andrew Dunham	2755f3843c	health, net/tlsdial: add healthcheck for self-signed cert ... When we make a connection to a server, we previously would verify with the system roots, and then fall back to verifying with our baked-in Let's Encrypt root if the system root cert verification failed. We now explicitly check for, and log a health error on, self-signed certificates. Additionally, we now always verify against our baked-in Let's Encrypt root certificate and log an error if that isn't successful. We don't consider this a health failure, since if we ever change our server certificate issuer in the future older non-updated versions of Tailscale will no longer be healthy despite being able to connect. Updates #3198 Change-Id: I00be5ceb8afee544ee795e3c7a2815476abc4abf Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	1 year ago
Brad Fitzpatrick	cf8dd7aa09	all: use Go 1.20's bytes.Clone ... Updates #7123 Updates #6257 (more to do in other repos) Change-Id: I073e2a6d81a5d7fbecc29caddb7e057ff65239d0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	b1248442c3	all: update to Go 1.20, use strings.CutPrefix/Suffix instead of our fork ... Updates #7123 Updates #5309 Change-Id: I90bcd87a2fb85a91834a0dd4be6e03db08438672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	5bba65e978	net/memnet: rename from net/nettest ... This is just #cleanup to resolve a TODO Also add a package doc. Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Will Norris	947c14793a	all: update tools that manage copyright headers ... Update all code generation tools, and those that check for license headers to use the new standard header. Also update copyright statement in LICENSE file. Fixes #6865 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Will Norris	71029cea2d	all: update copyright and license headers ... This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Andrew Dunham	50da265608	net/netns: add post-review comments ... Follow-up to #7065 with some comments from Brad's review. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia1219f4fa25479b2dada38ffe421065b408c5954	1 year ago
Brad Fitzpatrick	2fc8de485c	net/netstat: document the Windows netstat code a bit more ... And defensively bound allocation. Updates tailscale/corp#8878 Change-Id: Iaa07479ea2ea28ee1ac3326ab025046d6d785b00 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Aaron Klotz	4a869048bf	net/netstat: add nil checks to Windows OSMetadata implementation ... The API documentation does claim to output empty strings under certain conditions, but we're sometimes seeing nil pointers in the wild, not empty strings. Fixes https://github.com/tailscale/corp/issues/8878 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	1 year ago
Andrew Dunham	2703d6916f	net/netns: add functionality to bind outgoing sockets based on route table ... When turned on via environment variable (off by default), this will use the BSD routing APIs to query what interface index a socket should be bound to, rather than binding to the default interface in all cases. Updates #5719 Updates #5940 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib4c919471f377b7a08cd3413f8e8caacb29fee0b	1 year ago
Andrew Dunham	44d73ce932	ipn/ipnlocal, net/dnscache: allow configuring dnscache logging via capability ... This allows users to temporarily enable/disable dnscache logging via a new node capability, to aid in debugging strange connectivity issues. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I46cf2596a8ae4c1913880a78d0033f8b668edc08	1 year ago
Brad Fitzpatrick	d5100e0910	net/connstats: mark TestConcurrent as flaky ... Updates #7030 Change-Id: Ic46da5e5690b90b95028a68a3cf967ad86881e28 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	3addcacfe9	net/dns: fix recently added URL scheme from http to https ... I typoed/brainoed in the earlier 3582628691 Change-Id: Ic198a6f9911f195d9da9fc5259b5784a4b15e5e3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
andig	5f96d6211a	Remove redundant type declaration ... Signed-off-by: andig <cpuidle@gmx.de>	1 year ago
Brad Fitzpatrick	3582628691	net/dns/resolvconffile: link to FAQ about resolv.conf being overwritten ... Add link to new http://tailscale.com/s/resolvconf-overwrite page, added in tailscale/tailscale-www#2243 Change-Id: I9718399487f2ed18bf1a112581fd168aea30f232 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	6d85a94767	net/{packet,tstun}: fix typo in test helper docs ... Change-Id: Ifc1684fe77c7d2585e049e0dfd7340910c47a67a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	c1a2e2c380	net/{packet,tstun},wgengine/filter: fix unknown IP protocol handling ... 01b90df2fa added SCTP support before (with explicit parsing for ports) and 69de3bf7bf tried to add support for arbitrary IP protocols (as long as the ACL permited a port of "*", since we might not know how to find ports from an arbitrary IP protocol, if it even has such a concept). But apparently that latter commit wasn't tested end-to-end enough. It had a lot of tests, but the tests made assumptions about layering that either weren't true, or regressed since 1.20. Notably, it didn't remove the (*Filter).pre bidirectional filter that dropped all "unknown" protocol packets both leaving and entering, even if there were explicit protocol matches allowing them in. Also, don't map all unknown protocols to 0. Keep their IP protocol number parsed so it's matchable by later layers. Only reject illegal things. Fixes #6423 Updates #2162 Updates #2163 Change-Id: I9659b3ece86f4db51d644f9b34df78821758842c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jordan Whited	25a0091f69	net/portmapper: relax handling of UPnP resp (#6946) ... Gateway devices operating as an HA pair w/VRRP or CARP may send UPnP replies from static addresses rather than the floating gateway address. This commit relaxes our source address verification such that we parse responses from non-gateway IPs, and re-point the UPnP root desc URL to the gateway IP. This ensures we are still interfacing with the gateway device (assuming L2 security intact), even though we got a root desc from a non-gateway address. This relaxed handling is required for ANY port mapping to work on certain OPNsense/pfsense distributions using CARP at the time of writing, as miniupnpd may only listen on the static, non-gateway interface address for PCP and PMP. Fixes #5502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Tom DNetto	2ac5474be1	net/flowtrack,wgengine/filter: refactor Cache to use generics ... Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Tom DNetto	673b3d8dbd	net/dns,userspace: remove unused DNS paths, normalize query limit on iOS ... With a42a594bb3, iOS uses netstack and hence there are no longer any platforms which use the legacy MagicDNS path. As such, we remove it. We also normalize the limit for max in-flight DNS queries on iOS (it was 64, now its 256 as per other platforms). It was 64 for the sake of being cautious about memory, but now we have 50Mb (iOS-15 and greater) instead of 15Mb so we have the spare headroom. Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
James Tucker	b2c55e62c8	net/tlsdial,tstest,version: use go command from $PATH ... Go now includes the GOROOT bin directory in $PATH while running tests and generate, so it is no longer necessary to construct a path using runtime.GOROOT(). Fixes #6689 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Brad Fitzpatrick	ea70aa3d98	net/dns/resolvconffile: fix handling of multiple search domains ... Fixes #6875 Change-Id: I57eb9312c9a1c81792ce2b5a0a0f254213b05df2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
andig	14e8afe444	go.mod, etc: bump gvisor ... Fixes #6554 Change-Id: Ia04ae37a47b67fa57091c9bfe1d45a1842589aa8 Signed-off-by: andig <cpuidle@gmx.de>	1 year ago
Andrew Dunham	0372e14d79	net/dns: bump DNS-over-TCP size limit to 4k ... We saw a few cases where we hit this limit; bumping to 4k seems relatively uncontroversial. Change-Id: I218fee3bc0d2fa5fde16eddc36497a73ebd7cbda Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	1 year ago
Aaron Klotz	296f53524c	netstat, portlist: update Windows implementation to disambiguate svchost processes ... We change our invocations of GetExtendedTcpTable to request additional information about the "module" responsible for the port. In addition to pid, this output also includes sufficient metadata to enable Windows to resolve process names and disambiguate svchost processes. We store the OS-specific output in an OSMetadata field in netstat.Entry, which portlist may then use as necessary to actually resolve the process/module name. Signed-off-by: Aaron Klotz <aaron@tailscale.com>	1 year ago
Joe Tsai	d9df023e6f	net/connstats: enforce maximum number of connections (#6760) ... The Tailscale logging service has a hard limit on the maximum log message size that can be accepted. We want to ensure that netlog messages never exceed this limit otherwise a client cannot transmit logs. Move the goroutine for periodically dumping netlog messages from wgengine/netlog to net/connstats. This allows net/connstats to manage when it dumps messages, either based on time or by size. Updates tailscale/corp#8427 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	1 year ago
Jordan Whited	55b24009f7	net/tstun: don't return early from a partial tun.Read() (#6745) ... Fixes #6730 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Andrew Dunham	3f4d51c588	net/dns: don't send on closed channel when message too large ... Previously, if a DNS-over-TCP message was received while there were existing queries in-flight, and it was over the size limit, we'd close the 'responses' channel. This would cause those in-flight queries to send on the closed channel and panic. Instead, don't close the channel at all and rely on s.ctx being canceled, which will ensure that in-flight queries don't hang. Fixes #6725 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8267728ac37ed7ae38ddd09ce2633a5824320097	1 year ago
Brad Fitzpatrick	ca08e316af	util/endian: delete package; use updated josharian/native instead ... See josharian/native#3 Updates golang/go#57237 Change-Id: I238c04c6654e5b9e7d9cfb81a7bbc5e1043a84a2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jordan Whited	ea5ee6f87c	all: update golang.zx2c4.com/wireguard to github.com/tailscale/wireguard-go (#6692) ... This is temporary while we work to upstream performance work in https://github.com/WireGuard/wireguard-go/pull/64. A replace directive is less ideal as it breaks dependent code without duplication of the directive. Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Maisem Ali	eb1adf629f	net/tstun: reuse buffered packet from pool ... We would call parsedPacketPool.Get() for all packets received in Read/Write. This was wasteful and not necessary, fetch a single *packet.Parsed for all packets. Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Jordan Whited	76389d8baf	net/tstun, wgengine/magicsock: enable vectorized I/O on Linux (#6663) ... This commit updates the wireguard-go dependency and implements the necessary changes to the tun.Device and conn.Bind implementations to support passing vectors of packets in tailscaled. This significantly improves throughput performance on Linux. Updates #414 Signed-off-by: Jordan Whited <jordan@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com> Co-authored-by: James Tucker <james@tailscale.com>	1 year ago
Brad Fitzpatrick	1598cd0361	net/tsaddr: remove ContainsFunc helpers (they're now in x/exp/slices) ... x/exp/slices now has ContainsFunc (golang/go#53983) so we can delete our versions. Change-Id: I5157a403bfc1b30e243bf31c8b611da25e995078 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Mihai Parparita	79f3a5d753	net/netns, net/interfaces: explicitly bind sockets to the default interface on all Darwin variants ... We were previously only doing this for tailscaled-on-Darwin, but it also appears to help on iOS. Otherwise, when we rebind magicsock UDP connections after a cellular -> WiFi interface change they still keep using cellular one. To do this correctly when using exit nodes, we need to exclude the Tailscale interface when getting the default route, otherwise packets cannot leave the tunnel. There are native macOS/iOS APIs that we can use to do this, so we allow those clients to override the implementation of DefaultRouteInterfaceIndex. Updates #6565, may also help with #5156 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Maisem Ali	99aa335923	net/dns: [linux] log and add metric for dnsMode ... I couldn't find any logs that indicated which mode it was running in so adding that. Also added a gauge metric for dnsMode. Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Joe Tsai	2e5d08ec4f	net/connstats: invert network logging data flow (#6272) ... Previously, tstun.Wrapper and magicsock.Conn managed their own statistics data structure and relied on an external call to Extract to extract (and reset) the statistics. This makes it difficult to ensure a maximum size on the statistics as the caller has no introspection into whether the number of unique connections is getting too large. Invert the control flow such that a *connstats.Statistics is registered with tstun.Wrapper and magicsock.Conn. Methods on non-nil *connstats.Statistics are called for every packet. This allows the implementation of connstats.Statistics (in the future) to better control when it needs to flush to ensure bounds on maximum sizes. The value registered into tstun.Wrapper and magicsock.Conn could be an interface, but that has two performance detriments: 1. Method calls on interface values are more expensive since they must go through a virtual method dispatch. 2. The implementation would need a sync.Mutex to protect the statistics value instead of using an atomic.Pointer. Given that methods on constats.Statistics are called for every packet, we want reduce the CPU cost on this hot path. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	1 year ago