tailscale

Commit Graph

Author	SHA1	Message	Date
Aaron Klotz	21e9f98fc1	ipn, paths: unconditionally attempt to set state dir perms, but only if the state dir is ours We unconditionally set appropriate perms on the statefile dir. We look at the basename of the statefile dir, and if it is "tailscale", then we set perms as appropriate. Fixes #2925 Updates #2856 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	efb84ca60d	ipn/localapi, cmd/tailscale: add CPU & memory profile support, debug command This was already possible on Linux if you ran tailscaled with --debug (which runs net/http/pprof), but it requires the user have the Go toolchain around. Also, it wasn't possible on macOS, as there's no way to run the IPNExtension with a debug server (it doesn't run tailscaled). And on Windows it's super tedious: beyond what users want to do or what we want to explain. Instead, put it in "tailscale debug" so it works and works the same on all platforms. Then we can ask users to run it when we're debugging something and they can email us the output files. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	1eabb5b2d9	ipn: don't log IPN messages that may contain an authkey. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Aaron Klotz	9ebb5d4205	ipn, paths: ensure that the state directory for Windows has the correct perms ProgramData has a permissive ACL. For us to safely store machine-wide state information, we must set a more restrictive ACL on our state directory. We set the ACL so that only talescaled's user (ie, LocalSystem) and the Administrators group may access our directory. We must include Administrators to ensure that logs continue to be easily accessible; omitting that group would force users to use special tools to log in interactively as LocalSystem, which is not ideal. (Note that the ACL we apply matches the ACL that was used for LocalSystem's AppData\Local). There are two cases where we need to reset perms: One is during migration from the old location to the new. The second case is for clean installations where we are creating the file store for the first time. Updates #2856 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	7d8227e7a6	logpolicy: don't use C:\ProgramData use for tailscale-ipn GUI's log dir tailscale-ipn.exe (the GUI) shouldn't use C:\ProgramData. Also, migrate the earlier misnamed wg32/wg64 conf files if they're present. (That was stopped in `2db877caa3`, but the files exist from fresh 1.14 installs) Updates #2856 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	280c84e46a	ipn/ipnserver, paths, logpolicy: move Window config files out of %LocalAppData% C:\WINDOWS\system32\config\systemprofile\AppData\Local\ is frequently cleared for almost any reason: Windows updates, System Restore, even various System Cleaner utilities. The server-state.conf file in AppData\Local could be deleted at any time, which would break login until the node is removed from the Admin Panel allowing it to create a new key. Carefully copy any AppData state to ProgramData at startup. If copying the state fails, continue to use AppData so at least there will be connectivity. If there is no state, use ProgramData. We also migrate the log.conf file. Very old versions of Tailscale named the EXE tailscale-ipn, so the log conf was tailscale-ipn.log.conf and more recent versions preserved this filename and cmdName in logs. In this migration we always update the filename to c:\ProgramData\Tailscale\tailscaled.log.conf Updates https://github.com/tailscale/tailscale/issues/2856 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	aae622314e	tailcfg, health: add way for control plane to add problems to health check So if the control plane knows that something's broken about the node, it can include problem(s) in MapResponse and "tailscale status" will show it. (and GUIs in the future, as it's in ipnstate.Status/JSON) This also bumps the MapRequest.Version, though it's not strictly required. Doesn't hurt. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	d5ab18b2e6	cmd/cloner: add Clone context to regen struct assignments Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	07c09f470d	ipn/ipnlocal: do not shut down the backend halfway through TestStateMachine LocalBackend.Shutdown's docs say: > The backend can no longer be used after Shutdown returns. Nevertheless, TestStateMachine blithely calls Shutdown, talks some smack, and continues on, expecting things to work. Other uses of Shutdown in the codebase are as intended. Things mostly kinda work anyway, except that the wgengine.Engine has been shut down, so calls to Reconfig fail. Those get logged: > local.go:603: wgengine status error: engine closing; no status but otherwise ignored. However, the Reconfig failure caused one fewer call to pause/unpause than normal. Now the assertCalls lines match the equivalent ones earlier in the test. I don't see an obvious correct replacement for Shutdown in the context of this test; I'm not sure entirely what it is trying to accomplish. It is possible that many of the tests remaining after the prior call to Shutdown are now extraneous. They don't harm anything, though, so err on the side of safety and leave them for now. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	f834a4ade5	ipn/ipnlocal: fix minor typo in comment Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	221cc5f8f2	ipn/ipnlocal: reduce line noise in tests Use helpers and variadic functions to make the call sites a lot easier to read, since they occur a lot. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	45d3174c0d	ipn/ipnlocal: add LocalBackend.broadcastStatusChanged To reduce repetition. Also, document why we acquire the lock. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	b7ede14396	Revert "ipn/ipnlocal: remove locks around sync.Cond.Broadcast call" Reason for revert: Causes ipnlocal tests to deadlock intermittently. This reverts commit `1b15349e01`. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	3ea8cf9c62	ipn/ipnlocal: use quicktest.IsNotNil in tests This didn't exist when the test was written. Now it does (frankban/quicktest#94); use it. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	1b15349e01	ipn/ipnlocal: remove locks around sync.Cond.Broadcast call They are unnecessary. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	3b58c118dd	ipn/ipnlocal: inline LocalBackend.getEngineStatus For uniformity. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	0f4c0e558b	ipn/ipnlocal: use a switch statement instead of an else-if chain For clarity. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	7421ba91ec	ipn/ipnlocal: only call UpdateEndpoints when the endpoints change Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	b681edc572	ipn/ipnlocal: add failing test Concurrent calls to LocalBackend.setWgengineStatus could result in some of the status updates being dropped. This was exacerbated by `92077ae78c`, which increases the probability of concurrent status updates, causing test failures (tailscale/corp#2579). It's going to take a bit of work to fix this test. The ipnlocal state machine is difficult to reason about, particularly in the face of concurrency. We could fix the test trivially by throwing a new mutex around setWgengineStatus to serialize calls to it, but I'd like to at least try to do better than cosmetics. In the meantime, commit the test. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	7693d36aed	all: close fake userspace engines when tests complete We were leaking FDs. In a few places, switch from defer to t.Cleanup. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	4bbf5a8636	cmd/cloner: reduce diff noise when changing command Spelling out the command to run for every type means that changing the command makes for a large, repetitive diff. Stop doing that. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	640134421e	all: update tests to use tstest.MemLogger And give MemLogger a mutex, as one caller had, which does match the logf contract better. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	48933b0382	ipn/ipnlocal: flesh out the dnsConfigForNetmap tests Follow-up to #2805 and #2806 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7fe6ecf165	ipn/ipnlocal: add MagicDNS records for IPv6-only nodes Updates #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	90b0cd0c51	ipn/ipnlocal: start adding some netmap to DNS config tests Follow-up to #2805 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	30a614f9b9	ipn/ipnlocal: return early, outdent a bunch in dnsConfigForNetmap Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2bb0eb5f7e	ipn/ipnlocal: pull out dns.Config construction to its own func In prep for other bug fixes & tests. It's hard to test when it was intermingled into LocalBackend.authReconfig. Now it's a pure function. And rename variable 'uc' (user config?) to the since idiomatic 'prefs'. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	9502b515f1	net/dns: replace resolver IPs with type for DoH We currently plumb full URLs for DNS resolvers from the control server down to the client. But when we pass the values into the net/dns package, we throw away any URL that isn't a bare IP. This commit continues the plumbing, and gets the URL all the way to the built in forwarder. (It stops before plumbing URLs into the OS configurations that can handle them.) For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	7bfd4f521d	cmd/tailscale: fix "tailscale ip $self-host-hostname" And in the process, fix the related confusing error messages from pinging your own IP or hostname. Fixes #2803 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Dave Anderson	980acc38ba	types/key: add a special key with custom serialization for control private keys (#2792 ) * Revert "Revert "types/key: add MachinePrivate and MachinePublic."" This reverts commit `61c3b98a24`. Signed-off-by: David Anderson <danderson@tailscale.com> * types/key: add ControlPrivate, with custom serialization. ControlPrivate is just a MachinePrivate that serializes differently in JSON, to be compatible with how the Tailscale control plane historically serialized its private key. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	61c3b98a24	Revert "types/key: add MachinePrivate and MachinePublic." Broke the tailscale control plane due to surprise different serialization. This reverts commit `4fdb88efe1`.	3 years ago
David Anderson	4fdb88efe1	types/key: add MachinePrivate and MachinePublic. Plumb throughout the codebase as a replacement for the mixed use of tailcfg.MachineKey and wgkey.Private/Public. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	5bacbf3744	wgengine/magicsock, health, ipn/ipnstate: track DERP-advertised health And add health check errors to ipnstate.Status (tailscale status --json). Updates #2746 Updates #2775 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	0842e2f45b	ipn/store: add ability to store data as k8s secrets. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	88bd796622	tailcfg,ipn/ipnlocal: support DNSConfig.Routes with empty values [mapver 23] Fixes #2706 Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Matt Drollette	c1aa5a2e33	ipn/ipnlocal: update requested tags in host info Fixes #2641 Signed-off-by: Matt Drollette <matt@drollette.com>	3 years ago
Brad Fitzpatrick	47045265b9	hostinfo: add SetDeviceModel setter, move remaining code from controlclient Updates tailscale/corp#1959 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	faa891c1f2	client/tailscale,ipn/localapi: warn on tailscale/tailscaled version skew Fixes #1905 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	56db3e2548	ipn/localapi: refresh ACME certs in background two weeks in advance Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Simeng He	e199e407d2	tailcfg: add IP and Types field to PingRequest Signed-off-by: Simeng He <simeng@tailscale.com>	3 years ago
Brad Fitzpatrick	57b794c338	ipn/localapi: move cert fetching code to localapi, cache, add cert subcommand Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	a666b546fb	ipn/ipnlocal: log number of packet filters rather than entire filter The number of packet filters can grow very large, so this log entry can be very large. We can get the packet filter server-side, so reduce verbosity here to just the number of filters present. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	a24cee0d67	all: simplify ts_macext build tags Now that we have the easier-to-parse go:build build tags, it is straightforward to simplify them. Yay. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Crawshaw	360223fccb	types/dnstype: introduce new package for Resolver So the type can be used in net/dns without introducing a tailcfg dependency. For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Josh Bleecher Snyder	a5da4ed981	all: gofmt with Go 1.17 This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	f3c96df162	ipn/ipnstate: move tailscale status "active" determination to tailscaled Fixes #2579 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	0554b64452	ipnlocal: allow access to guest VMs/containers while using an exit node Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Josh Bleecher Snyder	8a3d52e882	wgengine/magicsock: use mono.Time magicsock makes multiple calls to Now per packet. Move to mono.Now. Changing some of the calls to use package mono has a cascading effect, causing non-per-packet call sites to also switch. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	690ade4ee1	ipn/ipnlocal: add URL to IP forwarding error message Updates #606 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7428ecfebd	ipn/ipnlocal: populate Hostinfo.Package on Android Fixes tailscale/corp#2266 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago

1 2 3 4 5 ...

490 Commits (21e9f98fc12d767c2408195da19d9893f9de9224)