tailscale

Commit Graph

Author	SHA1	Message	Date
nicksherron	f01ff18b6f	all: fix spelling mistakes Signed-off-by: nicksherron <nsherron90@gmail.com>	4 years ago
Avery Pennarun	0d4a0bf60e	magicsock: if STUN failed to send before, rebind before STUNning again. On iOS (and possibly other platforms), sometimes our UDP socket would get stuck in a state where it was bound to an invalid interface (or no interface) after a network reconfiguration. We can detect this by actually checking the error codes from sending our STUN packets. If we completely fail to send any STUN packets, we know something is very broken. So on the next STUN attempt, let's rebind the UDP socket to try to correct any problems. This fixes a problem where iOS would sometimes get stuck using DERP instead of direct connections until the backend was restarted. Fixes #2994 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
David Anderson	830f641c6b	wgengine/magicsock: update discokeys on netmap change. Fixes #3008. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	29a8fb45d3	wgengine/netstack: include DNS.ExtraRecords in DNSMap So SOCKS5 dialer can dial HTTPS cert names, for instance. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	52737c14ac	wgengine/monitor: ignore ipsec link monitor events on iOS/macOS Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Denton Gentry	93c2882a2f	wgengine: flush DNS cache after major link change. Windows has a public dns.Flush used in router_windows.go. However that won't work for platforms like Linux, where we need a different flush mechanism for resolved versus other implementations. We're instead adding a FlushCaches method to the dns Manager, which can be made to work on all platforms as needed. Fixes https://github.com/tailscale/tailscale/issues/2132 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Josh Bleecher Snyder	d5ab18b2e6	cmd/cloner: add Clone context to regen struct assignments Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	a722e48cef	wgengine/magicsock: skip alloc test with -race Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	7693d36aed	all: close fake userspace engines when tests complete We were leaking FDs. In a few places, switch from defer to t.Cleanup. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	4bbf5a8636	cmd/cloner: reduce diff noise when changing command Spelling out the command to run for every type means that changing the command makes for a large, repetitive diff. Stop doing that. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	dabeda21e0	net/tstun: block looped disco traffic Updates #1526 (maybe fixes? time will tell) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	31c1331415	wgengine/magicsock: deflake TestReceiveFromAllocs 100 iterations isn't enough with background allocs happening apparently. 1000 seems to be reliable. Fixes #2826 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	2238814b99	wgengine/magicsock: fix crash introduced in recent cleanups Fixes #2801 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	640134421e	all: update tests to use tstest.MemLogger And give MemLogger a mutex, as one caller had, which does match the logf contract better. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4c68b7df7c	tstest: add MemLogger bytes.Buffer wrapper with Logf method We use it tons of places. Updated three at least in this PR. Another use in next commit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Crawshaw	9502b515f1	net/dns: replace resolver IPs with type for DoH We currently plumb full URLs for DNS resolvers from the control server down to the client. But when we pass the values into the net/dns package, we throw away any URL that isn't a bare IP. This commit continues the plumbing, and gets the URL all the way to the built in forwarder. (It stops before plumbing URLs into the OS configurations that can handle them.) For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Brad Fitzpatrick	7bfd4f521d	cmd/tailscale: fix "tailscale ip $self-host-hostname" And in the process, fix the related confusing error messages from pinging your own IP or hostname. Fixes #2803 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	efe8020dfa	wgengine/magicsock: fix race condition in tests. AFAICT this was always present, the log read mid-execution was never safe. But it seems like the recent magicsock refactoring made the race much more likely. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Evan Anderson	000f90d4d7	wgengine/wglog: Fix docstring on wireguardGoString to match args @danderson linked this on Twitter and I noticed the mismatch. Signed-off-by: Evan Anderson <evan.k.anderson@gmail.com>	4 years ago
Brad Fitzpatrick	5bacbf3744	wgengine/magicsock, health, ipn/ipnstate: track DERP-advertised health And add health check errors to ipnstate.Status (tailscale status --json). Updates #2746 Updates #2775 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	daf54d1253	control/controlclient: remove TS_DEBUG_USE_DISCO=only. It was useful early in development when disco clients were the exception and tailscale logs were noisier than today, but now non-disco is the exception. Updates #2752 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	954064bdfe	wgengine/wgcfg/nmcfg: don't configure peers who can't DERP or disco. Fixes #2770 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f90ac11bd8	wgengine: remove unnecessary magicConnStarted channel. Having removed magicconn.Start, there's no need to synchronize startup of other things to it any more. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	bb10443edf	wgengine/wgcfg: use just the hexlified node key as the WireGuard endpoint. The node key is all magicsock needs to find the endpoint that WireGuard needs. Updates #2752 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d00341360f	wgengine/magicsock: remove unused debug knob. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	dfd978f0f2	wgengine/magicsock: use NodeKey, not DiscoKey, as the trigger for lazy reconfig. Updates #2752 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4c27e2fa22	wgengine/magicsock: remove Start method from Conn. Over time, other magicsock refactors have made Start effectively a no-op, except that some other functions choose to panic if called before Start. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1a899344bd	wgengine/magicsock: don't store tailcfg.Nodes alongside endpoints. Updates #2752 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b2181608b5	wgengine/magicsock: eagerly create endpoints in SetNetworkMap. Updates #2752 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Emmanuel T Odeke	0daa32943e	all: add (*testing.B).ReportAllocs() to every benchmark This ensures that we can properly track and catch allocation slippages that could otherwise have been missed. Fixes #2748	4 years ago
David Anderson	44d71d1e42	wgengine/magicsock: fix race in test shutdown, again. We were returning an error almost, but not quite like errConnClosed in a single codepath, which could still trip the panic on reconfig in the test logic. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f09ede9243	wgengine/magicsock: don't configure eager WireGuard handshaking in tests. Our prod code doesn't eagerly handshake, because our disco layer enables on-demand handshaking. Configuring both peers to eagerly handshake leads to WireGuard handshake races that make TestTwoDevicePing flaky. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	86d1c4eceb	wgengine/magicsock: ignore close races even harder. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	8bacfe6a37	wgengine/magicsock: remove unused sendLogLimit limiter. Magicsock these days gets its logs limited by the global log limiter. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	e151b74f93	wgengine/magicsock: remove opts.SimulatedNetwork. It only existed to override one test-only behavior with a different test-only behavior, in both cases working around an annoying feature of our CI environments. Instead, handle that weirdness entirely in the test code, with a tweaked TestOnlyPacketListener that gets injected. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	58c1f7d51a	wgengine/magicsock: rename opts.PacketListener to TestOnlyPacketListener. The docstring said it was meant for use in tests, but it's specifically a special codepath that is _only_ used in tests, so make the claim stronger. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	8049063d35	wgengine/magicsock: rename discoEndpoint to just endpoint. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f2d949e2db	wgengine/magicsock: fold findEndpoint into its only remaining caller. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	fe2f89deab	wgengine/magicsock: fix rare shutdown race in test. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	97693f2e42	wgengine/magicsock: delete legacy AddrSet endpoints. Instead of using the legacy codepath, teach discoEndpoint to handle peers that have a home DERP, but no disco key. We can still communicate with them, but only over DERP. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	61c62f48d9	wgengine/bench: disable unused benchmark that relies on legacy magicsock. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Maisem Ali	fd4838dc57	wgengine/userspace: add support to automatically enable/disable the tailscale protocol in BIRD, when the node is a primary subnet router as determined by control. Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	7fcf86a14a	wgengine: fix link monitor / magicsock Start race Fixes #2733 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	83906abc5e	wgengine/netstack: clarify a comment Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1925fb584e	wgengine/netstack: fix crash in userspace netstack TCP forwarding Fixes #2658 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
slowy07	ac0353e982	fix: typo spelling grammar Signed-off-by: slowy07 <slowy.arfy@gmail.com>	4 years ago
Brad Fitzpatrick	37053801bb	wgengine/magicsock: restore a bit of logging on node becoming active Fixes #2695 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Denton Gentry	6731f934a6	Revert "wgengine: actively log FlushDNS." This log is quite verbose, it was only to be left in for one unstable build to help debug a user issue. This reverts commit `1dd2552032`. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Denton Gentry	1dd2552032	wgengine: actively log FlushDNS. Intended to help in resolving customer issue with DNS caching. We currently exec `ipconfig /flushdns` from two places: - SetDNS(), which logs before invoking - here in router_windows, which doesn't We'd like to see a positive indication in logs that flushdns is being run. As this log is expected to be spammy, it is proposed to leave this in just long enough to do an unstable 1.13.x build and then revert it. They won't run an unsigned image that I build. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Josh Bleecher Snyder	6ef734e493	wgengine: predict min.Peers length across calls The number of peers we have will be pretty stable across time. Allocate roughly the right slice size. This reduces memory usage when there are many peers. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	adf696172d	wgengine/userspace: reduce allocations in getStatus Two optimizations. Use values instead of pointers. We were using pointers to make track the "peer in progress" easier. It's not too hard to do it manually, though. Make two passes through the data, so that we can size our return value accurately from the beginning. This is cheap enough compared to the allocation, which grows linearly in the number of peers, that it is worth doing. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Maisem Ali	5c383bdf5d	wgengine/router: pass in AmbientCaps when calling `ip rule` Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	39610aeb09	wgengine/magicsock: move debug knobs to their own file, compile out on iOS No need for these knobs on iOS where you can set the environment variables anyway. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	a5da4ed981	all: gofmt with Go 1.17 This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	a729070252	net/tstun: add start of Linux TAP support, with DHCP+ARP server Still very much a prototype (hard-coded IPs, etc) but should be non-invasive enough to submit at this point and iterate from here. Updates #2589 Co-Author: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f3c96df162	ipn/ipnstate: move tailscale status "active" determination to tailscaled Fixes #2579 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b622c60ed0	derp,wgengine/magicsock: don't assume stringer is in $PATH for go:generate Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	9da4181606	tstime/rate: new package This is a simplified rate limiter geared for exactly our needs: A fast, mono.Time-based rate limiter for use in tstun. It was generated by stripping down the x/time/rate rate limiter to just our needs and switching it to use mono.Time. It removes one time.Now call per packet. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	f6e833748b	wgengine: use mono.Time Migrate wgengine to mono.Time for performance-sensitive call sites. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	8a3d52e882	wgengine/magicsock: use mono.Time magicsock makes multiple calls to Now per packet. Move to mono.Now. Changing some of the calls to use package mono has a cascading effect, causing non-per-packet call sites to also switch. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	5c266bdb73	wgengine: re-set DNS config on Linux after a major link change Updates #2458 (maybe fixes it) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	95a9adbb97	wgengine/netstack: implement UDP relaying to advertised subnets TCP was done in `662fbd4a09`. This does the same for UDP. Tested by hand. Integration tests will have to come later. I'd wanted to do it in this commit, but the SOCKS5 server needed for interop testing between two userspace nodes doesn't yet support UDP and I didn't want to invent some whole new userspace packet injection interface at this point, as SOCKS seems like a better route, but that's its own bug. Fixes #2302 RELNOTE=netstack mode can now UDP relay to subnets Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ecac74bb65	wgengine/netstack: fix doc comment Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e4fecfe31d	wgengine/{monitor,router}: restore Linux ip rules when systemd deletes them Thanks. Fixes #1591 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ed8587f90d	wgengine/router: take a link monitor Prep for #1591 which will need to make Linux's router react to changes that the link monitor observes. The router package already depended on the monitor package transitively. Now it's explicit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Joe Tsai	9a0c8bdd20	util/deephash: make hash type opaque The fact that Hash returns a [sha256.Size]byte leaks details about the underlying hash implementation. This could very well be any other hashing algorithm with a possible different block size. Abstract this implementation detail away by declaring an opaque type that is comparable. While we are changing the signature of UpdateHash, rename it to just Update to reduce stutter (e.g., deephash.Update). Signed-off-by: Joe Tsai <joetsai@digital-static.net>	4 years ago
Josh Bleecher Snyder	4dbbd0aa4a	cmd/addlicense: add command to add licenseheaders to generated code And use it to make our stringer invocations match the existing code. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	c179580599	wgengine/magicsock: add debug envvar to force all traffic over DERP This would have been useful during debugging DERP issues recently. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	e41193ec4d	wgengine/monitor: don't spam about Linux RTM_NEWRULE events The earlier `2ba36c294b` started listening for ip rule changes and only cared about DELRULE events, buts its subscription included all rule events, including new ones, which meant we were then catching our own ip rule creations and logging about how they were unknown. Stop that log spam. Updates #1591 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	2ba36c294b	wgengine/monitor: subscribe to Linux ip rule events, log on rule deletes For debugging & working on #1591 where certain versions of systemd-networkd delete Tailscale's ip rule entries. Updates #1591 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	4f4dae32dd	wgengine/magicsock: fix latent data race in test logBufWriter had no serialization. It just so happens that none of its users currently ever log concurrently. Make it safe for concurrent use. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
julianknodt	fb06ad19e7	wgcfg: Switch to using mem.RO As Brad suggested, mem.RO allows for a lot of easy perf gains. There were also some smaller changes outside of mem.RO, such as using hex.Decode instead of hex.DecodeString. ``` name old time/op new time/op delta FromUAPI-8 14.7µs ± 3% 12.3µs ± 4% -16.58% (p=0.008 n=5+5) name old alloc/op new alloc/op delta FromUAPI-8 9.52kB ± 0% 7.04kB ± 0% -26.05% (p=0.008 n=5+5) name old allocs/op new allocs/op delta FromUAPI-8 77.0 ± 0% 29.0 ± 0% -62.34% (p=0.008 n=5+5) ``` Signed-off-by: julianknodt <julianknodt@gmail.com>	4 years ago
julianknodt	d349a3231e	wgcfg: use string cut instead of string split Signed-off-by: julianknodt <julianknodt@gmail.com>	4 years ago
julianknodt	664edbe566	wgcfg: add benchmark for FromUAPI Adds a benchmark for FromUAPI in wgcfg. It appears that it's not actually that slow, the main allocations are from the scanner and new config. Updates #1912. Signed-off-by: julianknodt <julianknodt@gmail.com>	4 years ago
Brad Fitzpatrick	7e7c4c1bbe	tailcfg: break DERPNode.DERPTestPort into DERPPort & InsecureForTests The DERPTestPort int meant two things before: which port to use, and whether to disable TLS verification. Users would like to set the port without disabling TLS, so break it into two options. Updates #1264 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	92077ae78c	wgengine/magicsock: make portmapping async Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	700badd8f8	util/deephash: move internal/deephash to util/deephash No code changes. Just a minor package doc addition about lack of API stability.	4 years ago
Maisem Ali	ec52760a3d	wgengine/router_windows: support toggling local lan access when using exit nodes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 years ago
Brad Fitzpatrick	722859b476	wgengine/netstack: make SOCKS5 resolve names to IPv6 if self node when no IPv4 For instance, ephemeral nodes with only IPv6 addresses can now SOCKS5-dial out to names like "foo" and resolve foo's IPv6 address rather than foo's IPv4 address and get a "no route" (*tcpip.ErrNoRoute) error from netstack's dialer. Per https://github.com/tailscale/tailscale/issues/2268#issuecomment-870027626 which is only part of the isuse. Updates #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
julianknodt	506c2fe8e2	cmd/tailscale: make netcheck use active DERP map, delete static copy After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	5 years ago
Christine Dodrill	59e9b44f53	wgengine/filter: add a debug flag for filter logs (#2241 ) This uses a debug envvar to optionally disable filter logging rate limits by setting the environment variable TS_DEBUG_FILTER_RATE_LIMIT_LOGS to "all", and if it matches, the code will effectively disable the limits on the log rate by setting the limit to 1 millisecond. This should make sure that all filter logs will be captured. Signed-off-by: Christine Dodrill <xe@tailscale.com>	5 years ago
Brad Fitzpatrick	c45bfd4180	wgengine: make dnsIPsOverTailscale also consider DefaultResolvers Found during a failed experiment debugging something on Android. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	b92e2ebd24	wgengine/netstack: add Impl.DialContextUDP Unused so far, but eventually we'll want this for SOCKS5 UDP binds (we currently only do TCP with SOCKS5), and also for #2102 for forwarding MagicDNS upstream to Tailscale IPs over netstack. Updates #2102 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	45e64f2e1a	net/dns{,/resolver}: refactor DNS forwarder, send out of right link on macOS/iOS Fixes #2224 Fixes tailscale/corp#2045 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Crawshaw	4ce15505cb	wgengine: randomize client port if netmap says to For testing out #2187 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
David Crawshaw	5f8ffbe166	magicsock: add SetPreferredPort method Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	80a4052593	cmd/tailscale, wgengine, tailcfg: don't assume LastSeen is present [mapver 20] Updates #2107 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Fletcher Nichol	a49df5cfda	wgenine/router: fix OpenBSD route creation The route creation for the `tun` device was augmented in #1469 but didn't account for adding IPv4 vs. IPv6 routes. There are 2 primary changes as a result: * Ensure that either `-inet` or `-inet6` was used in the [`route(8)`](https://man.openbsd.org/route) command * Use either the `localAddr4` or `localAddr6` for the gateway argument depending which destination network is being added The basis for the approach is based on the implementation from `router_userspace_bsd.go`, including the `inet()` helper function. Fixes #2048 References #1469 Signed-off-by: Fletcher Nichol <fnichol@nichol.ca>	5 years ago
Josh Bleecher Snyder	e92fd19484	wgengine/wglog: match upstream wireguard-go's code for wireguardGoString It is a bit faster. But more importantly, it matches upstream byte-for-byte, which ensures there'll be no corner cases in which we disagree. name old time/op new time/op delta SetPeers-8 3.58µs ± 0% 3.16µs ± 2% -11.74% (p=0.016 n=4+5) name old alloc/op new alloc/op delta SetPeers-8 2.53kB ± 0% 2.53kB ± 0% ~ (all equal) name old allocs/op new allocs/op delta SetPeers-8 99.0 ± 0% 99.0 ± 0% ~ (all equal) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	a321c24667	go.mod: update netaddr Involves minor IPSetBuilder.Set API change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	ddf6c8c729	wgengine/magicsock: delete dead code Co-authored-by: Adrian Dewhurst <adrian@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	1ece91cede	go.mod: upgrade wireguard-windows, de-fork wireguard-go Pull in the latest version of wireguard-windows. Switch to upstream wireguard-go. This requires reverting all of our import paths. Unfortunately, this has to happen at the same time. The wireguard-go change is very low risk, as that commit matches our fork almost exactly. (The only changes are import paths, CI files, and a go.mod entry.) So if there are issues as a result of this commit, the first place to look is wireguard-windows changes. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	ceaaa23962	wgengine/wglog: cache strings We repeat many peers each time we call SetPeers. Instead of constructing strings for them from scratch every time, keep strings alive across iterations. name old time/op new time/op delta SetPeers-8 3.58µs ± 1% 2.41µs ± 1% -32.60% (p=0.000 n=9+10) name old alloc/op new alloc/op delta SetPeers-8 2.53kB ± 0% 1.30kB ± 0% -48.73% (p=0.000 n=10+10) name old allocs/op new allocs/op delta SetPeers-8 99.0 ± 0% 16.0 ± 0% -83.84% (p=0.000 n=10+10) We could reduce alloc/op 12% and allocs/op 23% if strs had type map[string]strCache instead of map[string]*strCache, but that wipes out the execution time impact. Given that re-use is the most common scenario, let's optimize for it. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	73adbb7a78	wgengine: pass an addressable value to deephash.UpdateHash This makes deephash more efficient. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	8bf2a38f29	go.mod: update wireguard-go, taking control over iOS memory usage from our fork Our wireguard-go fork used different values from upstream for package device's memory limits on iOS. This was the last blocker to removing our fork. These values are now vars rather than consts for iOS. `c27ff9b9f6` Adjust them on startup to our preferred values. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w(.)\.Port = (.) -> $1 = $1.WithPort($2) \w(.)\.IP = (.) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	5b52b64094	tsnet: add Tailscale-as-a-library package Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	ebcd7ab890	wgengine: remove wireguard-go DeviceOptions We no longer need them. This also removes the 32 bytes of prefix junk before endpoints. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	aacb2107ae	all: add extra information to serialized endpoints magicsock.Conn.ParseEndpoint requires a peer's public key, disco key, and legacy ip/ports in order to do its job. We currently accomplish that by: * adding the public key in our wireguard-go fork * encoding the disco key as magic hostname * using a bespoke comma-separated encoding It's a bit messy. Instead, switch to something simpler: use a json-encoded struct containing exactly the information we need, in the form we use it. Our wireguard-go fork still adds the public key to the address when it passes it to ParseEndpoint, but now the code compensating for that is just a couple of simple, well-commented lines. Once this commit is in, we can remove that part of the fork and remove the compensating code. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	98cae48e70	wgengine/wglog: optimize wireguardGoString The new code is ugly, but much faster and leaner. name old time/op new time/op delta SetPeers-8 7.81µs ± 1% 3.59µs ± 1% -54.04% (p=0.000 n=9+10) name old alloc/op new alloc/op delta SetPeers-8 7.68kB ± 0% 2.53kB ± 0% -67.08% (p=0.000 n=10+10) name old allocs/op new allocs/op delta SetPeers-8 237 ± 0% 99 ± 0% -58.23% (p=0.000 n=10+10) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	9356912053	wgengine/wglog: add BenchmarkSetPeer Because it showed up on hello profiles. Cycle through some moderate-sized sets of peers. This should cover the "small tweaks to netmap" and the "up/down cycle" cases. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	36a26e6a71	internal/deephash: rename from deepprint Yes, it printed, but that was an implementation detail for hashing. And coming optimization will make it print even less. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	773fcfd007	Revert "wgengine/bench: skip flaky test" This reverts commit `d707e2f7e5`. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	68911f6778	wgengine/bench: ignore "engine closing" errors On benchmark completion, we shut down the wgengine. If we happen to poll for status during shutdown, we get an "engine closing" error. It doesn't hurt anything; ignore it. Fixes tailscale/corp#1776 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	d707e2f7e5	wgengine/bench: skip flaky test Updates tailscale/corp#1776 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	8d2a90529e	wgengine/bench: hold lock in TrafficGen.GotPacket while calling first packet callback Without any synchronization here, the "first packet" callback can be delayed indefinitely, while other work continues. Since the callback starts the benchmark timer, this could skew results. Worse, if the benchmark manages to complete before the benchmark timer begins, it'll cause a data race with the benchmark shutdown performed by package testing. That is what is reported in #1881. This is a bit unfortunate, in that it means that users of TrafficGen have to be careful to keep this callback speedy and lightweight and to avoid deadlocks. Fixes #1881 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	a72fb7ac0b	wgengine/bench: handle multiple Engine status callbacks It is possible to get multiple status callbacks from an Engine. We need to wait for at least one from each Engine. Without limiting to one per Engine, wait.Wait can exit early or can panic due to a negative counter. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	6618e82ba2	wgengine/bench: close Engines on benchmark completion This reduces the speed with which these benchmarks exhaust their supply fds. Not to zero unfortunately, but it's still helpful when doing long runs. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	ddd85b9d91	wgengine/magicsock: rename discoEndpoint.wgEndpointHostPort to wgEndpoint Fields rename only. Part of the general effort to make our code agnostic about endpoint formatting. It's just a name, but it will soon be a misleading one; be more generic. Do this as a separate commit because it generates a lot of whitespace changes. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	e0bd3cc70c	wgengine/magicsock: use netaddr.MustParseIPPrefix Delete our bespoke helper. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	bc68e22c5b	all: s/CreateEndpoint/ParseEndpoint/ in docs Upstream wireguard-go renamed the interface method from CreateEndpoint to ParseEndpoint. I missed some comments. Fix them. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	9bce1b7fc1	wgengine/wgcfg: make device test endpoint-format-agnostic By using conn.NewDefaultBind, this test requires that our endpoints be comprehensible to wireguard-go. Instead, use a no-op bind that treats endpoints as opaque strings. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	73ad1f804b	wgengine/wgcfg: use autogenerated Clone methods Delete the manually written ones named Copy. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	a0dacba877	wgengine/magicsock: simplify legacy endpoint DstToString Legacy endpoints (addrSet) currently reconstruct their dst string when requested. Instead, store the dst string we were given to begin with. In addition to being simpler and cheaper, this makes less code aware of how to interpret endpoint strings. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	777c816b34	wgengine/wgcfg: return better errors from DeviceConfig, ReconfigDevice Prefer the error from the actual wireguard-go device method call, not {To,From}UAPI, as those tend to be less interesting I/O errors. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	1f6c4ba7c3	wgengine/wgcfg: prevent ReconfigDevice from hanging on error When wireguard-go's UAPI interface fails with an error, ReconfigDevice hangs. Fix that by buffering the channel and closing the writer after the call. The code now matches the corresponding code in DeviceConfig, where I got it right. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	ed63a041bf	wgengine/userspace: delete HandshakeDone It is unused, and has been since early Feb 2021 (Tailscale 1.6). We can't get delete the DeviceOptions entirely yet; first #1831 and #1839 need to go in, along with some wireguard-go changes. Deleting this chunk of code now will make the later commits more clearly correct. Pingers can now go too. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	b8fb8264a5	wgengine/netstack: avoid delivering incoming packets to both netstack + host The earlier `eb06ec172f` fixed the flaky SSH issue (tailscale/corp#1725) by making sure that packets addressed to Tailscale IPs in hybrid netstack mode weren't delivered to netstack, but another issue remained: All traffic handled by netstack was also potentially being handled by the host networking stack, as the filter hook returned "Accept", which made it keep processing. This could lead to various random racey chaos as a function of OS/firewalls/routes/etc. Instead, once we inject into netstack, stop our caller's packet processing. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	1a1123d461	wgengine: fix pendopen debug to not track SYN+ACKs, show Node.Online state Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	eb06ec172f	wgengine/netstack: don't pass non-subnet traffic to netstack in hybrid mode Fixes tailscale/corp#1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	7629cd6120	net/tsaddr: add NewContainsIPFunc (move from wgengine) I want to use this from netstack but it's not exported. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	47ebd1e9a2	wgengine/router: use net.IP.Equal instead of bytes.Equal to compare IPs Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	f91c2dfaca	wgengine/router: remove unused field Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	9360f36ebd	all: use lower-case letters at the start of error message Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	64047815b0	wgenengine/magicsock: delete cursed tests Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	59026a291d	wgengine/wglog: improve wireguard-go logging rate limiting Prior to wireguard-go using printf-style logging, all wireguard-go logging occurred using format string "%s". We fixed that but continued to use %s when we rewrote peer identifiers into Tailscale style. This commit removes that %sl, which makes rate limiting work correctly. As a happy side-benefit, it should generate less garbage. Instead of replacing all wireguard-go peer identifiers that might occur anywhere in a fully formatted log string, assume that they only come from args. Check all args for things that look like *device.Peers and replace them with appropriately reformatted strings. There is a variety of ways that this could go wrong (unusual format verbs or modifiers, peer identifiers occurring as part of a larger printed object, future API changes), but none of them occur now, are likely to be added, or would be hard to work around if they did. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	1f94d43b50	wgengine/wglog: delay formatting The "stop phrases" we use all occur in wireguard-go in the format string. We can avoid doing a bunch of fmt.Sprintf work when they appear. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	20e04418ff	net/dns: add GOOS build tags Fixes #1786 Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	7ee891f5fd	all: delete wgcfg.Key and wgcfg.PrivateKey For historical reasons, we ended up with two near-duplicate copies of curve25519 key types, one in the wireguard-go module (wgcfg) and one in the tailscale module (types/wgkey). Then we moved wgcfg to the tailscale module. We can now remove the wgcfg key type in favor of wgkey. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	9d542e08e2	wgengine/magicsock: always run ReceiveIPv6 One of the consequences of the bind refactoring in `6f23087175` is that attempting to bind an IPv6 socket will always result in c.pconn6.pconn being non-nil. If the bind fails, it'll be set to a placeholder packet conn that blocks forever. As a result, we can always run ReceiveIPv6 and health check it. This removes IPv4/IPv6 asymmetry and also will allow health checks to detect any IPv6 receive func failures. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	fe50ded95c	health: track whether we have a functional udp4 bind Suggested-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	7dc7078d96	wgengine/magicsock: use netaddr.IP in listenPacket It must be an IP address; enforce that at the type level. Suggested-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	3c543c103a	wgengine/magicsock: unify initial bind and rebind We had two separate code paths for the initial UDP listener bind and any subsequent rebinds. IPv6 got left out of the rebind code. Rather than duplicate it there, unify the two code paths. Then improve the resulting code: * Rebind had nested listen attempts to try the user-specified port first, and then fall back to :0 if that failed. Convert that into a loop. * Initial bind tried only the user-specified port. Rebind tried the user-specified port and 0. But there are actually three ports of interest: The one the user specified, the most recent port in use, and 0. We now try all three in order, as appropriate. * In the extremely rare case in which binding to port 0 fails, use a dummy net.PacketConn whose reads block until close. This will keep the wireguard-go receive func goroutine alive. As a pleasant side-effect of this, if we decide that we need to resuscitate #1796, it will now be much easier. Fixes #1799 Co-authored-by: David Anderson <danderson@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	8fb66e20a4	wgengine/magicsock: remove DefaultPort const Assume it'll stay at 0 forever, so hard-code it and delete code conditional on it being non-0. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	a8f61969b9	wgengine/magicsock: remove context arg from listenPacket It was set to context.Background by all callers, for the same reasons. Set it locally instead, to simplify call sites. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Brad Fitzpatrick	bb2141e0cf	wgengine: periodically poll engine status for logging side effect Fixes tailscale/corp#1560 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	3c9dea85e6	wgengine: update a log line from 'weird' to conventional 'unexpected' Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	744de615f1	health, wgenegine: fix receive func health checks for the fourth time The old implementation knew too much about how wireguard-go worked. As a result, it missed genuine problems that occurred due to unrelated bugs. This fourth attempt to fix the health checks takes a black box approach. A receive func is healthy if one (or both) of these conditions holds: * It is currently running and blocked. * It has been executed recently. The second condition is required because receive functions are not continuously executing. wireguard-go calls them and then processes their results before calling them again. There is a theoretical false positive if wireguard-go go takes longer than one minute to process the results of a receive func execution. If that happens, we have other problems. Updates #1790 Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	0d4c8cb2e1	health: delete ReceiveFunc health checks They were not doing their job. They need yet another conceptual re-think. Start by clearing the decks. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	99705aa6b7	net/tstun: split TUN events channel into up/down and MTU We had a long-standing bug in which our TUN events channel was being received from simultaneously in two places. The first is wireguard-go. At wgengine/userspace.go:366, we pass e.tundev to wireguard-go, which starts a goroutine (RoutineTUNEventReader) that receives from that channel and uses events to adjust the MTU and bring the device up/down. At wgengine/userspace.go:374, we launch a goroutine that receives from e.tundev, logs MTU changes, and triggers state updates when up/down changes occur. Events were getting delivered haphazardly between the two of them. We don't really want wireguard-go to receive the up/down events; we control the state of the device explicitly by calling device.Up. And the userspace.go loop MTU logging duplicates logging that wireguard-go does when it received MTU updates. So this change splits the single TUN events channel into up/down and other (aka MTU), and sends them to the parties that ought to receive them. I'm actually a bit surprised that this hasn't caused more visible trouble. If a down event went to wireguard-go but the subsequent up event went to userspace.go, we could end up with the wireguard-go device disappearing. I believe that this may also (somewhat accidentally) be a fix for #1790. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Avery Pennarun	a7fe1d7c46	wgengine/bench: improved rate selection. The old decay-based one took a while to converge. This new one (based very loosely on TCP BBR) seems to converge quickly on what seems to be the best speed. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	a92b9647c5	wgengine/bench: speed test for channels, sockets, and wireguard-go. This tries to generate traffic at a rate that will saturate the receiver, without overdoing it, even in the event of packet loss. It's unrealistically more aggressive than TCP (which will back off quickly in case of packet loss) but less silly than a blind test that just generates packets as fast as it can (which can cause all the CPU to be absorbed by the transmitter, giving an incorrect impression of how much capacity the total system has). Initial indications are that a syscall about every 10 packets (TCP bulk delivery) is roughly the same speed as sending every packet through a channel. A syscall per packet is about 5x-10x slower than that. The whole tailscale wireguard-go + magicsock + packet filter combination is about 4x slower again, which is better than I thought we'd do, but probably has room for improvement. Note that in "full" tailscale, there is also a tundev read/write for every packet, effectively doubling the syscall overhead per packet. Given these numbers, it seems like read/write syscalls are only 25-40% of the total CPU time used in tailscale proper, so we do have significant non-syscall optimization work to do too. Sample output: $ GOMAXPROCS=2 go test -bench . -benchtime 5s ./cmd/tailbench goos: linux goarch: amd64 pkg: tailscale.com/cmd/tailbench cpu: Intel(R) Core(TM) i7-4785T CPU @ 2.20GHz BenchmarkTrivialNoAlloc/32-2 56340248 93.85 ns/op 340.98 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivialNoAlloc/124-2 57527490 99.27 ns/op 1249.10 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivialNoAlloc/1024-2 52537773 111.3 ns/op 9200.39 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivial/32-2 41878063 135.6 ns/op 236.04 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivial/124-2 41270439 138.4 ns/op 896.02 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivial/1024-2 36337252 154.3 ns/op 6635.30 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkBlockingChannel/32-2 12171654 494.3 ns/op 64.74 MB/s 0 %lost 1791 B/op 0 allocs/op BenchmarkBlockingChannel/124-2 12149956 507.8 ns/op 244.17 MB/s 0 %lost 1792 B/op 1 allocs/op BenchmarkBlockingChannel/1024-2 11034754 528.8 ns/op 1936.42 MB/s 0 %lost 1792 B/op 1 allocs/op BenchmarkNonlockingChannel/32-2 8960622 2195 ns/op 14.58 MB/s 8.825 %lost 1792 B/op 1 allocs/op BenchmarkNonlockingChannel/124-2 3014614 2224 ns/op 55.75 MB/s 11.18 %lost 1792 B/op 1 allocs/op BenchmarkNonlockingChannel/1024-2 3234915 1688 ns/op 606.53 MB/s 3.765 %lost 1792 B/op 1 allocs/op BenchmarkDoubleChannel/32-2 8457559 764.1 ns/op 41.88 MB/s 5.945 %lost 1792 B/op 1 allocs/op BenchmarkDoubleChannel/124-2 5497726 1030 ns/op 120.38 MB/s 12.14 %lost 1792 B/op 1 allocs/op BenchmarkDoubleChannel/1024-2 7985656 1360 ns/op 752.86 MB/s 13.57 %lost 1792 B/op 1 allocs/op BenchmarkUDP/32-2 1652134 3695 ns/op 8.66 MB/s 0 %lost 176 B/op 3 allocs/op BenchmarkUDP/124-2 1621024 3765 ns/op 32.94 MB/s 0 %lost 176 B/op 3 allocs/op BenchmarkUDP/1024-2 1553750 3825 ns/op 267.72 MB/s 0 %lost 176 B/op 3 allocs/op BenchmarkTCP/32-2 11056336 503.2 ns/op 63.60 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTCP/124-2 11074869 533.7 ns/op 232.32 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTCP/1024-2 8934968 671.4 ns/op 1525.20 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkWireGuardTest/32-2 1403702 4547 ns/op 7.04 MB/s 14.37 %lost 467 B/op 3 allocs/op BenchmarkWireGuardTest/124-2 780645 7927 ns/op 15.64 MB/s 1.537 %lost 420 B/op 3 allocs/op BenchmarkWireGuardTest/1024-2 512671 11791 ns/op 86.85 MB/s 0.5206 %lost 411 B/op 3 allocs/op PASS ok tailscale.com/wgengine/bench 195.724s Updates #414. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Maisem Ali	590792915a	wgengine/router{win}: ignore broadcast routes added by Windows when removing routes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 years ago
Josh Bleecher Snyder	8d7f7fc7ce	health, wgenegine: fix receive func health checks yet again The existing implementation was completely, embarrassingly conceptually broken. We aren't able to see whether wireguard-go's receive function goroutines are running or not. All we can do is model that based on what we have done. This commit fixes that model. Fixes #1781 Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	5835a3f553	health, wgengine/magicsock: avoid receive function false positives Avery reported a sub-ms health transition from "receiveIPv4 not running" to "ok". To avoid these transient false-positives, be more precise about the expected lifetime of receive funcs. The problematic case is one in which they were started but exited prior to a call to connBind.Close. Explicitly represent started vs running state, taking care with the order of updates. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	f845aae761	health: track whether magicsock receive functions are running Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Brad Fitzpatrick	12b4672add	wgengine: quiet connection failure diagnostics for exit nodes The connection failure diagnostic code was never updated enough for exit nodes, so disable its misleading output when the node it picks (incorrectly) to diagnose is only an exit node. Fixes #1754 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	a29b0cf55f	wgengine/wglog: allow wireguard-go receive routines to log I've spent two days searching for a theoretical wireguard-go bug around receive functions exiting early. I've found many bugs, but none of the flavor we're looking for. Restore wireguard-go's logging around starting and stopping receive functions, so that we can definitively rule in or out this particular theory. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	eb2a9d4ce3	wgengine/netstack: log error when acceptUDP fails I see a bunch of these in some logs I'm looking at, separated only by a few seconds. Log the error so we can tell what's going on here. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Naman Sood	4a90a91d29	wgengine/netstack: log ForwarderRequest in readable form, only in debug mode (#1758 ) * wgengine/netstack: log ForwarderRequest in readable form, only in debug mode Fixes #1757 Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Josh Bleecher Snyder	07c95a0219	wgengine/wgcfg/nmcfg: consolidate exit node log lines These were getting rate-limited for nodes with many peers. Consolate the output into single lines, which are nicer anyway. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	48e30bb8de	wgengine/magicsock: remove named return Doesn't add anything. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	a2a2c0ce1c	wgengine/magicsock: fix two comments Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	b1e624ef04	wgengine/magicsock: remove unnecessary type assertions Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	98714e784b	wgengine/magicsock: improve Rebind logging We were accidentally logging oldPort -> oldPort. Log oldPort as well as c.port; if we failed to get the preferred port in a previous rebind, oldPort might differ from c.port. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Josh Bleecher Snyder	15ceacc4c5	wgengine/magicsock: accept a host and port instead of an addr in listenPacket This simplifies call sites and prevents accidental failure to use net.JoinHostPort. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	5 years ago
Brad Fitzpatrick	b993d9802a	ipn/ipnlocal, etc: require file sharing capability to send/recv files tailscale/corp#1582 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Maisem Ali	4f3203556d	wgengine/router: add the Tailscale ULA route on darwin. Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 years ago
Brad Fitzpatrick	762180595d	ipn/ipnstate: add PeerStatus.TailscaleIPs slice, deprecate TailAddr Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	34d2f5a3d9	tailcfg: add Endpoint, EndpointType, MapRequest.EndpointType Track endpoints internally with a new tailcfg.Endpoint type that includes a typed netaddr.IPPort (instead of just a string) and includes a type for how that endpoint was discovered (STUN, local, etc). Use []tailcfg.Endpoint instead of []string internally. At the last second, send it to the control server as the existing []string for endpoints, but also include a new parallel MapRequest.EndpointType []tailcfg.EndpointType, so the control server can start filtering out less-important endpoint changes from new-enough clients. Notably, STUN-discovered endpoints can be filtered out from 1.6+ clients, as they can discover them amongst each other via CallMeMaybe disco exchanges started over DERP. And STUN endpoints change a lot, causing a lot of MapResposne updates. But portmapped endpoints are worth keeping for now, as they they work right away without requiring the firewall traversal extra RTT dance. End result will be less control->client bandwidth. (despite negligible increase in client->control bandwidth) Updates tailscale/corp#1543 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Maisem Ali	1b9d8771dc	ipn/ipnlocal,wgengine/router,cmd/tailscale: add flag to allow local lan access when routing traffic via an exit node. For #1527 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 years ago
David Anderson	854d5d36a1	net/dns: return error from NewOSManager, use it to initialize NM. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	d5d70ae9ea	wgengine/monitor: reduce Linux log spam on down Fixes #1689 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	84430cdfa1	net/dns: improve NetworkManager detection, using more DBus. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	19eca34f47	wgengine/router: fix FreeBSD configuration failure on the v6 /48. On FreeBSD, we add the interface IP as a /48 to work around a kernel bug, so we mustn't then try to add a /48 route to the Tailscale ULA, since that will fail as a dupe. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	4a64d2a603	net/dns: some post-review cleanups. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	68f76e9aa1	net/dns: add GetBaseConfig to OSConfigurator interface. Part of #953, required to make split DNS work on more basic platforms. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	d488678fdc	cmd/tailscaled, wgengine{,/netstack}: add netstack hybrid mode, add to Windows For #707 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Denton Gentry	3089081349	monitor/polling: reduce Cloud Run polling interval. Cloud Run's routes never change at runtime. Don't poll it for route changes very often. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
David Anderson	de6dc4c510	net/dns: add a Primary field to OSConfig. Currently ignored. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	7d84ee6c98	net/dns: unify the OS manager and internal resolver. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	1bf91c8123	net/dns/resolver: remove unused err return value. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	f007a9dd6b	health: add DNS subsystem and plumb errors in. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	4c61ebacf4	wgengine: move DNS configuration out of wgengine/router. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	ba72126b72	wgengine/magicsock: remove RebindingUDPConn.FakeClosed It existed to work around the frequent opening and closing of the conn.Bind done by wireguard-go. The preceding commit removed that behavior, so we can simply close the connections when we are done with them. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	69cdc30c6d	wgengine/wgcfg: remove Config.ListenPort We don't use the port that wireguard-go passes to us (via magicsock.connBind.Open). We ignore it entirely and use the port we selected. When we tell wireguard-go that we're changing the listen_port, it calls connBind.Close and then connBind.Open. And in the meantime, it stops calling the receive functions, which means that we stop receiving and processing UDP and DERP packets. And that is Very Bad. That was never a problem prior to `b3ceca1dd7`, because we passed the SkipBindUpdate flag to our wireguard-go fork, which told wireguard-go not to re-bind on listen_port changes. That commit eliminated the SkipBindUpdate flag. We could write a bunch of code to work around the gap. We could add background readers that process UDP and DERP packets when wireguard-go isn't. But it's simpler to never create the conditions in which wireguard-go rebinds. The other scenario in which wireguard-go re-binds is device.Down. Conveniently, we never call device.Down. We go from device.Up to device.Close, and the latter only when we're shutting down a magicsock.Conn completely. Rubber-ducked-by: Avery Pennarun <apenwarr@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
David Anderson	27a1a2976a	wgengine/router: add a CallbackRouter shim. The shim implements both network and DNS configurators, and feeds both into a single callback that receives both configs. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	b3ceca1dd7	wgengine/...: split into multiple receive functions Upstream wireguard-go has changed its receive model. NewDevice now accepts a conn.Bind interface. The conn.Bind is stateless; magicsock.Conns are stateful. To work around this, we add a connBind type that supports cheap teardown and bring-up, backed by a Conn. The new conn.Bind allows us to specify a set of receive functions, rather than having to shoehorn everything into ReceiveIPv4 and ReceiveIPv6. This lets us plumbing DERP messages directly into wireguard-go, instead of having to mux them via ReceiveIPv4. One consequence of the new conn.Bind layer is that closing the wireguard-go device is now indistinguishable from the routine bring-up and tear-down normally experienced by a conn.Bind. We thus have to explicitly close the magicsock.Conn when the close the wireguard-go device. One downside of this change is that we are reliant on wireguard-go to call receiveDERP to process DERP messages. This is fine for now, but is perhaps something we should fix in the future. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
David Anderson	6ad44f9fdf	wgengine: take in dns.Config, split out to resolver.Config and dns.OSConfig. Stepping stone towards having the DNS package handle the config splitting. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	8af9d770cf	net/dns: rename Config to OSConfig. Making way for a new higher level config struct. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	fcfc0d3a08	net/dns: remove ManagerConfig, pass relevant args directly. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	f77ba75d6c	wgengine/router: move DNS cleanup into the DNS package. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	15875ccc63	wgengine/router: don't store unused tunname on windows.	5 years ago
Josh Bleecher Snyder	34d4943357	all: gofmt -s The code is not obviously better or worse, but this makes the little warning triangle in my editor go away, and the distraction removal is worth it. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	1df162b05b	wgengine/magicsock: adapt CreateEndpoint signature to match wireguard-go Part of a temporary change to make merging wireguard-go easier. See https://github.com/tailscale/wireguard-go/pull/45. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	e64383a80e	wgengine/router: document some fields a bit more Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Denton Gentry	35ab4020c7	wgengine/monitor: Linux fall back to polling Google Cloud Run does not implement NETLINK_ROUTE RTMGRP. If initialization of the netlink socket or group membership fails, fall back to a polling implementation. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
David Anderson	90f82b6946	net/dns/resolver: add live reconfig, plumb through to ipnlocal. The resolver still only supports a single upstream config, and ipn/wgengine still have to split up the DNS config, but this moves closer to unifying the DNS configs. As a handy side-effect of the refactor, IPv6 MagicDNS records exist now. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	f185d62dc8	net/dns/resolver: unexport Packet, only use it internally. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	5fb9e00ecf	net/dns/resolver: remove Start method, fully spin up in New instead. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	075fb93e69	net/dns/resolver: remove the Config struct. In preparation for reintroducing a runtime reconfig Config struct. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	bc81dd4690	net/dns/resolver: rename ResolverConfig to just Config. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	d99f5b1596	net/dns/resolver: factor the resolver out into a sub-package. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Naman Sood	31c7745631	wgengine/netstack: stop re-adding IPs registered by active TCP connections (#1629 ) Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Brad Fitzpatrick	7f03c0f8fe	wgengine/wgcfg/nmcfg: reduce some logging when a /0 route skipped Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	7b907615d5	wgengine/wgcfg/nmcfg: remove dead code The call to appendEndpoint updates cpeer.Endpoints. Then it is overwritten in the next line. The only errors from appendEndpoint occur when the host/port pair is malformed, but that cannot happen. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	36a85e1760	wgengine/magicsock: don't call t.Fatal in magicStack.IP It can end up executing an a new goroutine, at which point instead of immediately stopping test execution, it hangs. Since this is unexpected anyway, panic instead. As a bonus, it makes call sites nicer and removes a kludge comment. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	4c83bbf850	wgengine: add IsNetstack func and test So we have a documented & tested way to check whether we're in netstack mode. To be used by future commits. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	91bc723817	wgengine: add temp workaround for netstack WhoIs registration race Updates #1616 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	41e4e02e57	net/{packet,tstun}: send peerapi port in TSMP pongs For discovery when an explicit hostname/IP is known. We'll still also send it via control for finding peers by a list. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Naman Sood	662fbd4a09	wgengine/netstack: Allow userspace networking mode to expose subnets (#1588 ) wgengine/netstack: Allow userspace networking mode to expose subnets Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Brad Fitzpatrick	a4c679e646	wgengine/monitor: on wall time jump, synthesize network change event ... to force rebinds of TCP connections Fixes #1555 Updates tailscale/felicity#4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	07bf4eb685	wgengine: rename Fake to RespondToPing. "Fake" doesn't mean a lot any more, given that many components of the engine can be faked out, including in valid production configurations like userspace-networking. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	0fb738760f	wgengine: make Tun optional again, default to fake. This makes setup more explicit in prod codepaths, without requiring a bunch of arguments or helpers for tests and userspace mode. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	e18c3a7d84	wgengine: optimize isLocalAddr a bit On macOS/iOS, this removes a map lookup per outgoing packet. Noticed it while reading code, not from profiles, but can't hurt. BenchmarkGenLocalAddrFunc BenchmarkGenLocalAddrFunc/map1 BenchmarkGenLocalAddrFunc/map1-4 16184868 69.78 ns/op BenchmarkGenLocalAddrFunc/map2 BenchmarkGenLocalAddrFunc/map2-4 16878140 70.73 ns/op BenchmarkGenLocalAddrFunc/or1 BenchmarkGenLocalAddrFunc/or1-4 623055721 1.950 ns/op BenchmarkGenLocalAddrFunc/or2 BenchmarkGenLocalAddrFunc/or2-4 472493098 2.589 ns/op Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	93a4aa697c	wgengine: default Router to a no-op router. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	440effb21a	wgengine: remove Config.TUN argument.	5 years ago
Josh Bleecher Snyder	4954fbfda6	wgengine: extend TestWatchdog timeout on macOS This works around the close syscall being slow. We can revert this if we find a fix or if Apple makes close fast again. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
David Anderson	2df8adef9d	wgengine: make the tun.Device required at construction. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	016de16b2e	net/tstun: rename TUN to Wrapper. The tstun packagen contains both constructors for generic tun Devices, and a wrapper that provides additional functionality. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	82ab7972f4	net/tstun: rename NewFakeTUN to NewFake. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	588b70f468	net/tstun: merge in wgengine/tstun. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	2b4bfeda1a	wgengine: pass in an explicit router.Router, rather than a generator. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	44d9929208	wgengine: remove Config.TUNName, require caller to create device. Also factors out device creation and associated OS workarounds to net/tun. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	0a84aaca0a	wgengine/router: remove unused wireguard *Device argument. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	bcf571ec97	wgengine/monitor: fix OpenBSD build Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	7f174e84e6	net/interfaces: remove mutating methods, add EqualFiltered instead Now callers (wgengine/monitor) don't need to mutate the state to remove boring interfaces before calling State.Equal. Instead, the methods to remove boring interfaces from the State are removed, as is the reflect-using Equal method itself, and in their place is a new EqualFiltered method that takes a func predicate to match interfaces to compare. And then the FilterInteresting predicate is added for use with EqualFiltered to do the job that that wgengine/monitor previously wanted. Now wgengine/monitor can keep the full interface state around, including the "boring" interfaces, which we'll need for peerapi on macOS/iOS to bind to the interface index of the utunN device. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	672731ac6f	many: gofmt. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	6521f02ff6	Move DNS flush logic to net/dns. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	9f7f2af008	wgengine/router/dns: move to net/dns. Preparation for merging the APIs and whatnot. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	8432999835	Move wgengine/tsdns to net/dns. Straight move+fixup, no other changes. In prep for merging with wgengine/router/dns. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	81143b6d9a	ipn/ipnlocal: start of peerapi between nodes Also some necessary refactoring of the ipn/ipnstate too. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	28af46fb3b	wgengine: pass logger as a separate arg to device.NewDevice Adapt to minor API changes in wireguard-go. And factor out device.DeviceOptions variables. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	2384c112c9	net/packet, wgengine/{filter,tstun}: add TSMP ping Fixes #1467 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	4b77eca2de	wgengine/magicsock: check returned error in addTestEndpoint Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	c99f260e40	wgengine/magicsock: prefer IPv6 transport if roughly equivalent latency Fixes #1566 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	e2b3d9aa5f	all: s/Magic DNS/MagicDNS/ for consistency Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	9643d8b34d	wgengine/magicsock: add an addrLatency type to combine an IPPort+time.Duration Updates #1566 (but no behavior changes as of this change) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	96dfeb2d7f	wgengine: log tailscale pings Fixes #1561 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	85138d3183	health: track whether any network interface is up Fixes #1562 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	0994a9f7c4	wgengine{,/magicsock}: fix, improve "tailscale ping" to default routes and subnets e.g. $ tailscale ping 1.1.1.1 exit node found but not enabled $ tailscale ping 10.2.200.2 node "tsbfvlan2" found, but not using its 10.2.200.0/24 route $ sudo tailscale up --accept-routes $ tailscale ping 10.2.200.2 pong from tsbfvlan2 (100.124.196.94) via 10.2.200.34:41641 in 1ms $ tailscale ping mon.ts.tailscale.com pong from monitoring (100.88.178.64) via DERP(sfo) in 83ms pong from monitoring (100.88.178.64) via DERP(sfo) in 21ms pong from monitoring (100.88.178.64) via [2604:a880:4:d1::37:d001]:41641 in 22ms This necessarily moves code up from magicsock to wgengine, so we can look at the actual wireguard config. Fixes #1564 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	7e0d12e7cc	wgengine/magicsock: don't update control if only endpoint order changes Updates #1559 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	1eb95c7e32	net/packet, wgengine{,/filter}: remove net/packet IPProto forwarding consts Only use the ones in types/ipproto now. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	01b90df2fa	net/packet, wgengine/filter: support SCTP Add proto to flowtrack.Tuple. Add types/ipproto leaf package to break a cycle. Server-side ACL work remains. Updates #1516 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	90a6fb7ffe	tailcfg: add FilterRule.IPProto Updates #1516 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	32562a82a9	wgengine/magicsock: annotate a few more disco logs as verbose Fixes #1540 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	c19ed37b0f	wgengine/magicsock: mark some legacy debug log output as verbose Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	aa79a57f63	wgengine/netstack: use inet.af/netstack, remove 64-bit only limitation This reverts the revert commit `84aba349d9`. And changes us to use inet.af/netstack. Updates #1518 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	84aba349d9	Revert "wgengine/netstack: update gvisor to remove 64-bit only limitation" Breaks our corp repo due to gRPC dependency hell. This reverts commit `d42f8b7f9a`.	5 years ago
Brad Fitzpatrick	e0f2796b43	wgengine: don't diagnose iOS NWPathMonitor connection probe timeouts Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	0f90586da8	wgengine/monitor: skip more route messages on darwin Should help iOS battery life on NEProvider.wake/skip events with useless route updates that shouldn't cause re-STUNs. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d42f8b7f9a	wgengine/netstack: update gvisor to remove 64-bit only limitation gVisor fixed their google/gvisor#1446 so we can include gVisor mode on 32-bit machines. A few minor upstream API changes, as normal. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	232cfda280	wgengine/router: report to control when setPrivateNetwork fails Fixes #1503 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	ba8c6d0775	health, controlclient, ipn, magicsock: tell health package state of things Not yet checking anything. Just plumbing states into the health package. Updates #1505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Naman Sood	770aa71ffb	client, cmd/hello, ipn, wgengine: fix whois for netstack-forwarded connections Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Brad Fitzpatrick	44ab0acbdb	net/portmapper, wgengine/monitor: cache gateway IP info until link changes Cuts down allocs & CPU in steady state (on regular STUN probes) when network is unchanging. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d580b3f09e	wgengine/router: fix go vet failure on BSDs Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Aleksandar Pesic	25d2dd868b	wgengine/router: flushdns in windows when router config changes Fixes: https://github.com/tailscale/tailscale/issues/1430 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	5 years ago
Brad Fitzpatrick	c81814e4f8	derp{,/derphttp},magicsock: tell DERP server when ping acks can be expected Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	f9f3b67f3a	wgengine{,tsdns}: rebind MagicDNS forwarders on link change Fixes #1480 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	fa6110e47b	wgengine/router: don't touch interface routes Developed by a cast of dozens. Fixes #1448 Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	c576fea60e	wgengine/magicsock: delete unused WhoIs method that was moved elsewhere Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	0430c2dd12	wgengine/tsdns: truncate Map.PrettyDiffFrom string at 1KB Hello's were painful. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	d79a2f3809	wgengine/filter: only log packets to/from non-default routes. Fixes tailscale/corp#1429. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	ef7bac2895	tailcfg, net/portmapper, wgengine/magicsock: add NetInfo.HavePortMap Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	79d8288f0a	wgengine/magicsock, derp, derp/derphttp: respond to DERP server->client pings No server support yet, but we want Tailscale 1.6 clients to be able to respond to them when the server can do it. Updates #1310 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	387e83c8fe	wgengine/magicsock: fix Conn.Rebind race that let ErrClosed errors be read There was a logical race where Conn.Rebind could acquire the RebindingUDPConn mutex, close the connection, fail to rebind, release the mutex, and then because the mutex was no longer held, ReceiveIPv4 wouldn't retry reads that failed with net.ErrClosed, letting that error back to wireguard-go, which would then stop running that receive IP goroutine. Instead, keep the RebindingUDPConn mutex held for the entirety of the replacement in all cases. Updates tailscale/corp#1289 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	fee74e7ea7	net/interfaces, wgengine/monitor: fix false positives link changes interfaces.State.String tries to print a concise summary of the network state, removing any interfaces that don't have any or any interesting IP addresses. On macOS and iOS, for instance, there are a ton of misc things. But the link monitor based its are-there-changes decision on interfaces.State.Equal, which just used reflect.DeepEqual, including comparing all the boring interfaces. On macOS, when turning wifi on or off, there are a ton of misc boring interface changes, resulting in hitting an earlier check I'd added on suspicion this was happening: [unexpected] network state changed, but stringification didn't This fixes that by instead adding a new interfaces.State.RemoveUninterestingInterfacesAndAddresses method that does, uh, that. Then use that in the monitor. So then when Equal is used later, it's DeepEqualing the already-cleaned version with only interesting interfaces. This makes cmd/tailscaled debug --monitor much less noisy. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Denton Gentry	04e72f95cc	wgengine/router: add OpenBSD IPv6 support. Similar to FreeBSD in https://github.com/tailscale/tailscale/issues/1307, add IPv6 addresses with a prefix length of 48. Fixes https://github.com/tailscale/tailscale/issues/1372 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
Brad Fitzpatrick	c445e3d327	wgengine/magicsock: fix typo in comment	5 years ago
Aleksandar Pesic	258d0e8d9a	wgengine/monitor: simplify the Windows monitor to make it more reliable Updates tailscale/tailscale#1414 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	5 years ago
Naman Sood	4c80344e27	wgengine/netstack: stop UDP forwarding when one side dies Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Naman Sood	7325b5a7ba	wgengine/netstack: add support for incoming UDP connections Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Denton Gentry	bcea88da46	wgengine: support FreeBSD with IPv6. Fixes https://github.com/tailscale/tailscale/issues/1307 for keepsies. We cannot set the tun interface address as a /128 on FreeBSD, due to https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=218508 Instead we set the interface address as a /48, which is enabled by commit `82edf94df7`. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
Denton Gentry	c8af6bc009	Revert "freebsd: ignore IPv6 for now" This reverts commit `061422affc`. We have a way to support IPv6 on FreeBSD now. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
Brad Fitzpatrick	602f92ec30	wgengine/monitor: log warning if state changes but stringification doesn't Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a6d098c750	wgengine/magicsock: log when DERP connection succeeds Updates #1310	5 years ago
Brad Fitzpatrick	829eb8363a	net/interfaces: sort returned addresses from LocalAddresses Also change the type to netaddr.IP while here, because it made sorting easier. Updates tailscale/corp#1397 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	ffa70a617d	wgengine{,/monitor}: restore Engine.LinkChange, add Mon.InjectEvent The Engine.LinkChange method was recently removed in `e3df29d488` while misremembering how Android's link state mechanism worked. Rather than do some last minute rearchitecting of link state on Android before Tailscale 1.6, restore the old Engine.LinkChange hook for now so the Android client doesn't need any changes. But change how it's implemented to instead inject an event into the link monitor. Fixes #1427 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Denton Gentry	061422affc	freebsd: ignore IPv6 for now FreeBSD tun devices don't work with the way we implement IPv6 https://github.com/tailscale/tailscale/issues/1307 At least for now, remove any IPv6 addresses from the netmap. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
David Anderson	1cb0ffc3ff	wgengine/router: make windows gracefully handle disabled IPv4 or IPv6. This is necessary because either protocol can be disabled globally by a Windows registry policy, at which point trying to touch that address family results in "Element not found" errors. This change skips programming address families that Windows tell us are unavailable. Fixes #1396. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	f858b0d25f	wgengine/netstack: remove some v2 logging by default Even with [v2], it still logtails and takes time to format. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Naman Sood	d01c60dad5	wgengine/netstack: use system dialer to contact servers on localhost Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Brad Fitzpatrick	7461dded88	wgengine/monitor: on unsupported platforms, use a polling implementation Not great, but lets people working on new ports get going more quickly without having to do everything up front. As the link monitor is getting used more, I felt bad having a useless implementation. Updates #815 Updates #1427 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	8d77dfdacb	wgengine/router: add a dummy IPv6 address if needed for default routing. Fixes #1339 Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	c3e5903b91	wgengine/magicsock: remove leftover portmapper debug logging It's already logged at the right time in logEndpointChange. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Naman Sood	95c03d1ead	wgengine/netstack: forward incoming connections to localhost Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Brad Fitzpatrick	471f0c470a	wgengine/monitor: skip some macOS route updates, fix debounce regression Debound was broken way back in `5c1e443d34` and we never noticed. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	f304a45481	wgengine/monitor: add skipped failing test for Darwin route message bug Updates #1416 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	31721759f3	wgengine/monitor: don't return nil, nil in darwin monitor We used to allow that, but now it just crashes. Separately I need to figure out why it got into this path at all, which is #1416. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Christine Dodrill	b89c757817	wgengine/tsdns: explicitly reject .onion lookups Tor has a location-hidden service feature that enables users to host services from inside the Tor network. Each of these gets a unique DNS name that ends with .onion. As it stands now, if a misbehaving application somehow manages to make a .onion DNS request to our DNS server, we will forward that to the DNS server, which could leak that to malicious third parties. See the recent bug Brave had with this[1] for more context. RFC 7686 suggests that name resolution APIs and libraries MUST respond with NXDOMAIN unless they can actually handle Tor lookups. We can't handle .onion lookups, so we reject them. [1]: https://twitter.com/albinowax/status/1362737949872431108 Fixes tailscale/corp#1351 Signed-off-by: Christine Dodrill <xe@tailscale.com>	5 years ago
Brad Fitzpatrick	24fa616e73	wgengine/monitor: make Darwin monitor shut down cleanly, add test Don't use os.NewFile or (*os.File).Close on the AF_ROUTE socket. It apparently does weird things to the fd and at least doesn't seem to close it. Just use the unix package. The test doesn't actually fail reliably before the fix, though. It was an attempt. But this fixes the integration tests. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	487c520109	wgengine: fix bug from earlier commit Commit `e3df29d488` introduced this bug where the interfaces-were-changed-or-not bit got lost. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	793cb131f0	wgengine/router: toggle killswitch when using default routes on windows. Fixes #1398. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	e3df29d488	wgengine{,/monitor}: move interface state fetching/comparing to monitor Gets it out of wgengine so the Engine isn't responsible for being a callback registration hub for it. This also removes the Engine.LinkChange method, as it's no longer necessary. The monitor tells us about changes; it doesn't seem to need any help. (Currently it was only used by Swift, but as of `14dc790137` we just do the same from Go) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a038e8690c	wgengine/netstack: fix 32-bit build broken from prior commit Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	38dc6fe758	cmd/tailscaled, wgengine: remove --fake, replace with netstack And add a --socks5-server flag. And fix a race in SOCKS5 replies where the response header was written concurrently with the copy from the backend. Co-authored with Naman Sood. Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d74cddcc56	wgengine/netstack: add Magic DNS + DNS resolution to SOCKS5 dialing Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	34188d93d4	wgengine/monitor: start moving interface state accessor into monitor Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	14dc790137	wgengine/monitor: make the darwin link monitor work in the sandbox too Previously tailscaled on macOS was running "/sbin/route monitor" as a child process, but child processes aren't allowed in the Network Extension / App Store sandbox. Instead, just do what "/sbin/route monitor" itself does: unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, 0) and read that. We also parse it now, but don't do anything with the parsed results yet. We will over time, as we have with Linux netlink messages over time. Currently any message is considered a signal to poll and see what changed. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a55a03d5ff	wgengine: let LinkMonitor be passed in to NewUserspaceEngine Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	ee6475a44d	wgengine: unify NewUserspaceEngine, NewUserspaceEngineAdvanced Also rename EngineConfig to Config to avoid wgengine.EngineConfig stutter. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	dda03a911e	wgengine/monitor: change API to permit multiple independent callbakcks Currently it assumes exactly 1 registered callback. This changes it to support 0, 1, or more than 1. This is a step towards plumbing wgengine/monitor into more places (and moving some of wgengine's interface state fetching into monitor in a later step) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	0eea490724	wgengine: also close link monitor on NewUserspaceEngineAdvanced error Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Naman Sood	fec9dcbda1	wgengine/netstack: start SOCKS5 server in netstack mode Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Naman Sood	517c90d7e5	wgengine, cmd/tailscaled: refactor netstack, forward TCP to hello as demo (#1301 ) Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Aleksandar Pesic	daf6de4f14	wgengine: make NewUserspaceEngine wait for TUN interface to be up on Windows Updates #474 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	5 years ago
Brad Fitzpatrick	ea3715e3ce	wgengine/magicsock: remove TODO about endpoints-over-DERP It was done in Tailscale 1.4 with CallMeMaybe disco messages containing endpoints. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	54d7070121	wgengine/router: correctly read IPv6 routes when diffing. Fixes #1185. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	2404c0ffad	ipn/ipnlocal: only filter out default routes when computing the local wg config. UIs need to see the full unedited netmap in order to know what exit nodes they can offer to the user. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	e9e4f1063d	wgengine/magicsock: fix discoEndpoint caching bug when a node key changes Fixes #1391 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	c64bd587ae	net/portmapper: add NAT-PMP client, move port mapping service probing * move probing out of netcheck into new net/portmapper package * use PCP ANNOUNCE op codes for PCP discovery, rather than causing short-lived (sub-second) side effects with a 1-second-expiring map + delete. * track when we heard things from the router so we can be less wasteful in querying the router's port mapping services in the future * use portmapper from magicsock to map a public port Fixes #1298 Fixes #1080 Fixes #1001 Updates #864 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	d038a5295d	wgengine/wglog: drop 1/s "interface is up" messages. Fixes #1388. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	188bb14269	wgengine: consistently close things when NewUserspaceEngineAdvanced errors Fixes #1363 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	6e42430ad8	wgengine/monitor: don't log any single-IP routes added to the tailscale table. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	df5adb2e23	wgengine/monitor: on linux, also monitor for IPv6 changes. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	b83c273737	wgengine/filter: use IPSet for localNets instead of prefixes. Part of #1177, preparing for doing fancier set operations on the allowed local nets. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	fd8e070d01	health, control/controlclient, wgengine: report when router unhealthy Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	2d96215d97	wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	96a488e37e	wgengine/router: simplify func normalizeCIDR using netaddr method	5 years ago
Brad Fitzpatrick	d98ef5699d	wgengine/filter: remove redundant code no generated code change.	5 years ago
Brad Fitzpatrick	65815cc1ac	wgengine/tsdns: skip test that requires local IPv6 when IPv6 unavailable Fixes #1292 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	36189e2704	wgengine/monitor: prevent shutdown hang in darwin link monitor	5 years ago
Brad Fitzpatrick	bbb4631e04	safesocket, wgengine: add some darwin failure diagnostic hints	5 years ago
Brad Fitzpatrick	4f7d60ad42	wgengine/monitor: add a darwin implementation for tailscaled mode Tangentially related to #987, #177, #594, #925, #505 Motivated by rebooting a launchd-controlled tailscaled and it going into SetNetworkUp(false) mode immediately because there really is no network up at system boot, but then it got stuck in that paused state forever, without a monitor implementation.	5 years ago
Josh Bleecher Snyder	c7e5ab8094	wgengine/magicsock: retry and re-send packets in TestTwoDevicePing When a handshake race occurs, a queued data packet can get lost. TestTwoDevicePing expected that the very first data packet would arrive. This caused occasional flakes. Change TestTwoDevicePing to repeatedly re-send packets and succeed when one of them makes it through. This is acceptable (vs making WireGuard not drop the packets) because this only affects communication with extremely old clients. And those extremely old clients will eventually connect, because the kernel will retry sends on timeout. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	1632f9fd6b	wgengine/magicsock: reduce log spam during tests Only do the type assertion to *net.UDPAddr when addr is non-nil. This prevents a bunch of log spam during tests.	5 years ago
Josh Bleecher Snyder	88586ec4a4	wgengine/magicsock: remove an alloc from ReceiveIPvN We modified the standard net package to not allocate a net.UDPAddr during a call to (net.UDPConn).ReadFromUDP if the caller's use of the net.UDPAddr does not cause it to escape. That is https://golang.org/cl/291390. This is the companion change to magicsock. There are two changes required. First, call ReadFromUDP instead of ReadFrom, if possible. ReadFrom returns a net.Addr, which is an interface, which always allocates. Second, reduce the lifetime of the returned net.UDPAddr. We do this by immediately converting it into a netaddr.IPPort. We left the existing RebindingUDPConn.ReadFrom method in place, as it is required to satisfy the net.PacketConn interface. With the upstream change and both of these fixes in place, we have removed one large allocation per packet received. name old time/op new time/op delta ReceiveFrom-8 16.7µs ± 5% 16.4µs ± 8% ~ (p=0.310 n=5+5) name old alloc/op new alloc/op delta ReceiveFrom-8 112B ± 0% 64B ± 0% -42.86% (p=0.008 n=5+5) name old allocs/op new allocs/op delta ReceiveFrom-8 3.00 ± 0% 2.00 ± 0% -33.33% (p=0.008 n=5+5) Co-authored-by: Sonia Appasamy <sonia@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	0c673c1344	wgengine/magicsock: unify on netaddr types in addrSet addrSet maintained duplicate lists of netaddr.IPPorts and net.UDPAddrs. Unify to use the netaddr type only. This makes (*Conn).ReceiveIPvN a bit uglier, but that'll be cleaned up in a subsequent commit. This is preparatory work to remove an allocation from ReceiveIPv4. Co-authored-by: Sonia Appasamy <sonia@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	4cd9218351	wgengine/magicsock: prevent logging while running benchmarks Co-authored-by: Sonia Appasamy <sonia@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	88ab0173a7	wgengine/router: fix BSD router to support multiple local addrs, IPv6 Fixes #1201	5 years ago
Brad Fitzpatrick	917307a90c	wgengine/tstun: reply to MagicDNS pings Fixes #849 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	635e4c7435	wgengine/magicsock: increase legacy ping timeout again I based my estimation of the required timeout based on locally observed behavior. But CI machines are worse than my local machine. 16s was enough to reduce flakiness but not eliminate it. Bump it up again. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	1ec64bc94d	wgengine/router: add another Windows firewall rule to allow incoming UDP Based on @sailorfrag's research. Fixes #1312 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	7e201806b1	wgengine/magicsock: reconnect to DERP home after network comes back up Updates #1310	5 years ago
Brad Fitzpatrick	cbd6224ca4	wgengine/winnet: don't build on non-windows It only affects 'go install ./...', etc, and only on darwin/arm64 (M1 Macs) where the go-ole package doesn't compile. No need to build it. Updates #943	5 years ago
Brad Fitzpatrick	9b4e50cec0	wgengine/magicsock: fix typo in comment	5 years ago
Naman Sood	07c3df13c6	wgengine/tstun: inform userspaceEngine about injected outbound packets in tundev Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Josh Bleecher Snyder	e7caad61fb	wgengine: remove IpcGetOperation filter This was in place because retrieved allowed_ips was very expensive. Upstream changed the data structure to make them cheaper to compute. This commit is an experiment to find out whether they're now cheap enough. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	6b365b0239	wgengine/magicsock: fix DERP reader hang regression during concurrent reads Fixes #1282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	e1f773ebba	wgengine/magicsock: allow more time for pings to transit We removed the "fast retry" code from our wireguard-go fork. As a result, pings can take longer to transit when retries are required. Allow that. Fixes #1277 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	6d2b8df06d	wgengine/magicsock: add disabled failing (deadlocking) test for #1282 The fix can make this test run unconditionally. This moves code from `5c619882bc` for testability but doesn't fix it yet. The #1282 problem remains (when I wrote its wake-up mechanism, I forgot there were N DERP readers funneling into 1 UDP reader, and the code just isn't correct at all for that case). Also factor out some test helper code from BenchmarkReceiveFrom. The refactoring in magicsock.go for testability should have no behavior change.	5 years ago
Brad Fitzpatrick	1e7a35b225	types/netmap: split controlclient.NetworkMap off into its own leaf package Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	6064b6ff47	wgengine/wgcfg/nmcfg: split control/controlclient/netmap.go into own package It couldn't move to ipnlocal due to test dependency cycles. Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	ace57d7627	wgengine/magicsock: set a dummy private key in benchmark. Magicsock started dropping all traffic internally when Tailscale is shut down, to avoid spurious wireguard logspam. This made the benchmark not receive anything. Setting a dummy private key is sufficient to get magicsock to pass traffic for benchmarking purposes. Fixes #1270. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	aa6856a9eb	wgengine: adapt to wireguard-go changes Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	d76334d2f0	ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	70eb05fd47	wgengine: access flow pending problem with lock held Missed review feedback from just-submitted `d37058af72`.	5 years ago
Brad Fitzpatrick	d37058af72	net/packet: add some more TSMP packet reject reasons and MaybeBroken bit Unused for now, but I want to backport this commit to 1.4 so 1.6 can start sending these and then at least 1.4 logs will stringify nicely. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	f7eed25bb9	wgengine/magicsock: filter disco packets and packets when stopped from wireguard Fixes #1167 Fixes tailscale/corp#219 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	e8cd7bb66f	tstest: simplify goroutine leak tests Use tb.Cleanup to simplify both the API and the implementation. One behavior change: When the number of goroutines shrinks, don't log. I've never found these logs to be useful, and they frequently add noise. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	a2aa6cd2ed	wgengine/router: clarify disabled IPv6 message on Linux	5 years ago
David Anderson	267531e4f8	wgengine/router: probe better for v6 policy routing support. Previously we disabled v6 support if the disable_policy knob was missing in /proc, but some kernels support policy routing without exposing the toggle. So instead, treat disable_policy absence as a "maybe", and make the direct `ip -6 rule` probing a bit more elaborate to compensate. Fixes #1241. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	717c715c96	wgengine/wglog: don't log failure to send data packets Fixes #1239	5 years ago
Josh Bleecher Snyder	dd10babaed	wgenginer/magicsock: remove Addrs methods They are now unused. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	761188e5d2	wgengine/wgcfg: fix validateEndpoints of empty string Updates tailscale/corp#1238	5 years ago
Josh Bleecher Snyder	fe7c3e9c17	all: move wgcfg from wireguard-go This is mostly code movement from the wireguard-go repo. Most of the new wgcfg package corresponds to the wireguard-go wgcfg package. wgengine/wgcfg/device{_test}.go was device/config{_test}.go. There were substantive but simple changes to device_test.go to remove internal package device references. The API of device.Config (now wgcfg.DeviceConfig) grew an error return; we previously logged the error and threw it away. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	c7fc4a06da	wgengine/router: don't configure IPv6 on Linux when IPv6 is unavailable Fixes #1214 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	4d943536f1	wgengine: don't leak TUN device in NewUserspaceEngine error path Updates #1187 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	9f5b0d058f	wgengine: fix bugs from earlier fix Fixes a regression from `e970ed0995` that wasn't covered by tests in this repo. (Our end-to-end tests in another repo caught this.) Updates #1204	5 years ago
Brad Fitzpatrick	e970ed0995	wgengine: fix crash reading long UAPI lines from legacy peers Also don't log.Fatalf in a function returning an error. Fixes #1204 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	4fea604979	wgengine/router: stop setPrivateNetwork goroutine on configureInterface failure On Windows, configureInterface starts a goroutine reconfiguring the Windows firewall. But if configureInterface fails later, that goroutine kept running and likely failing forever, spamming logs. Make it stop quietly if its launching goroutine filed.	5 years ago
David Anderson	9f7cbf6cf1	wgengine/filter: add a Clone method. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	e7bf144c3f	ipn, wgengine/filter: fix Shields Up recent regression and old bug Fixes #1192 (regression) Fixes #1193 (old bug)	5 years ago
Brad Fitzpatrick	97496a83af	wgengine/tstun: also support DropSilently on PostFilterIn Not a problem (yet). But should be consistent with other places that support both types of drops.	5 years ago
Josh Bleecher Snyder	d5baeeed5c	wgengine: use Tailscale-style peer identifiers in logs Rewrite log lines on the fly, based on the set of known peers. This enables us to use upstream wireguard-go logging, but maintain the Tailscale-style peer public key identifiers that the rest of our systems (and people) expect. Fixes #1183 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	9541886856	wgengine/magicsock: disable regular STUNs for all platforms by default Reduces background CPU & network. Updates #1034 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	c55d26967b	wgengine/magicsock: log more details of endpoints learned over disco Also, don't try to use IPv6 LinkLocalUnicast addresses for now. Like endpoints exchanged with control, we share them but don't yet use them. Updates #1172	5 years ago
Brad Fitzpatrick	359055d3fa	wgengine/magicsock: fix logging regression `c8c493f3d9` made it always say `created=false` which scared me when I saw it, as that would've implied things were broken much worse. Fortunately the logging was just wrong.	5 years ago
Brad Fitzpatrick	edf64e0901	wgengine/magicsock: send, use endpoints in CallMeMaybe messages Fixes #1172 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	b5b4992eff	disco: support parsing/encoding endpoints in call-me-maybe frames Updates #1172 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	d3dd7c6270	wgengine/magicsock: make legacy DstToString match Addrs DstToString is used in two places in wireguard-go: Logging and uapi. We are switching to use uapi for wireguard-go config. To preserve existing behavior, we need the full set of addrs. And for logging, having the full set of addrs seems useful. (The Addrs method itself is slated for removal. When that happens, the implementation will move to DstToString.) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	187e22a756	wgengine/magicsock: don't run the DERP cleanup so often To save CPU and wakeups, don't run the DERP cleanup timer regularly unless there is a non-home DERP connection open. Also eliminates the goroutine, moving to a time.AfterFunc. Updates #1034 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	5fe5402fcd	Revert "wgengine/magicsock: shortcircuit discoEndpoint.heartbeat when its connection is closed" This reverts commit `08baa17d9a`. It caused deadlocks due to lock ordering violations. It was not the right fix, and thus should simply be reverted while we look for the right fix (if we haven't already found it in the interim; we've fixed other logging-after-test issues). Fixes #1161	5 years ago
Josh Bleecher Snyder	e4c075cd95	wgengine/magicsock: prevent log-after-test in TestTwoDevicePing	5 years ago
Brad Fitzpatrick	edce91a8a6	wgengine/magicsock: fix a naked return bug/crash where we returned (nil, true) The 'ok' from 'ipp, ok :=' above was the result parameter ok. Whoops.	5 years ago
Brad Fitzpatrick	51bd1feae4	wgengine/magicsock: add single element IPPort->endpoint cache in receive path name old time/op new time/op delta ReceiveFrom-4 21.8µs ± 2% 20.9µs ± 2% -4.27% (p=0.000 n=10+10) Updates #414 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	5c619882bc	wgengine/magicsock: simplify ReceiveIPv4+DERP path name old time/op new time/op delta ReceiveFrom-4 35.8µs ± 3% 21.9µs ± 5% -38.92% (p=0.008 n=5+5) Fixes #1145 Updates #414 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	9936cffc1a	wgengine: correctly track all node IPs in lazy config. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	3fa86a8b23	wgengine/magicsock: use relatively new netaddr.IPPort.IsZero method	5 years ago
Brad Fitzpatrick	4811236189	wgengine/magicsock: speed up BenchmarkReceiveFrom, store context.Done chan context.cancelCtx.Done involves a mutex and isn't as cheap as I previously assumed. Convert the donec method into a struct field and store the channel value once. Our one magicsock.Conn gets one pointer larger, but it cuts ~1% of the CPU time of the ReceiveFrom benchmark and removes a bubble from the --svg output :)	5 years ago
Denton Gentry	8578b0445d	tstun: add test to send a packet after Close() This test serves two purposes: + check that Write() returns an error if the tstun has been closed. + ensure that the close-related code in tstun is exercised in a test case. We were getting spurious code coverage adds/drops based on timing of when the test case finished. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
Josh Bleecher Snyder	ed2169ae99	wgengine/magicsock: prevent logging after TestActiveDiscovery completes	5 years ago
Josh Bleecher Snyder	63af950d8c	wgengine/magicsock: adapt to wireguard-go without UpdateDst `22507adf54` stopped relying on our fork of wireguard-go's UpdateDst callback. As a result, we can unwind that code, and the extra return value of ReceiveIPv{4,6}. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Denton Gentry	23c2dc2165	magicksock: remove TestConnClosing. (#1140 ) Test is flakey, remove it and figure out what to do differently later. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
David Anderson	e23b4191c4	wgengine/magicsock: disable legacy networking everywhere except TwoDevicePing. TwoDevicePing is explicitly testing the behavior of the legacy codepath, everything else is happy to assume that code no longer exists. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	0733c5d2e0	wgengine/magicsock: disable legacy behavior in a few more tests. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	57d95dd005	wgengine/magicsock: default legacy networking to off for some tests. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	a2463e8948	wgengine/magicsock: add an option to disable legacy peer handling. Used in tests to ensure we're not relying on behavior we're going to remove eventually. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	d456bfdc6d	wgengine/magicsock: fix BenchmarkReceiveFrom. Previously, this benchmark relied on behavior of the legacy receive codepath, which I changed in `22507adf`. With this change, the benchmark instead relies on the new active discovery path. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	2d837f79dc	wgengine/magicsock: close test loggers once we're done with them This is a big hammer approach to helping with #1132. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	08baa17d9a	wgengine/magicsock: shortcircuit discoEndpoint.heartbeat when its connection is closed This prevents us from continuing to do unnecessary work (including logging) after the connection has closed. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	7c76435bf7	wgengine/magicsock: simplify Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	d2529affa2	wgengine/magicsock: quiet wireguard-go logging in tests We already do this in newUserspaceEngineAdvanced. Apply it to newMagicStack as well. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	3ad7c2133a	wgengine/userspace: make wireguard-go log silencing include peer routines Also suppress log lines like: peer(Kksd…ySmc) - Routine: sequential sender - stopped Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	b560386c1a	net/packet, wgengine, tstun: add inter-node TSMP protocol for connect errors This adds a new IP Protocol type, TSMP on protocol number 99 for sending inter-tailscale messages over WireGuard, currently just for why a peer rejects TCP SYNs (ACL rejection, shields up, and in the future: nothing listening, something listening on that port but wrong interface, etc) Updates #1094 Updates tailscale/corp#1185 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Naman Sood	420c7a35e2	wgengine/netstack: use tailscale IPs instead of a hardcoded one (#1131 ) Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
Brad Fitzpatrick	a4b39022e0	wgengine/tsdns: fix MagicDNS lookups of shared nodes Fixes tailscale/corp#1184	5 years ago
Alex Brainman	6e4231c03c	wgengine/router/dns: remove unused code Commit 68ddf1 removed code that reads `SOFTWARE\Tailscale IPN\SearchList` registry value. But the commit left code that writes that value. So now this package writes and never reads the value. Remove the code to stop pointless work. Updates #853 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	5 years ago
Josh Bleecher Snyder	654b5f1570	all: convert from []wgcfg.Endpoint to string This eliminates a dependency on wgcfg.Endpoint, as part of the effort to eliminate our wireguard-go fork. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
David Anderson	9abcb18061	wgengine/magicsock: import more of wireguard-go, update docstrings. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	22507adf54	wgengine/magicsock: stop depending on UpdateDst in legacy codepaths. This makes connectivity between ancient and new tailscale nodes slightly worse in some cases, but only in cases where the ancient version would likely have failed to get connectivity anyway. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	020084e84d	wgengine: adapt to removal of wgcfg.Key in wireguard-go	5 years ago
Smitty	b2a08ddacd	wgengine/tsdns: return NOERROR instead of NOTIMP for most records This is what every other DNS resolver I could find does, so tsdns should do it to. This also helps avoid weird error messages about non-existent records being unimplemented, and thus fixes #848. Signed-off-by: Smitty <me@smitop.com>	5 years ago
Denton Gentry	8349e10907	magicsock: add description of testClosingContext Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
Denton Gentry	2e9728023b	magicsock: test error case in sendDiscoMessage In sendDiscoMessage there is a check of whether the connection is closed, which is not being reliably exercised by other tests. This shows up in code coverage reports, the lines of code in sendDiscoMessage are alternately added and subtracted from code coverage. Add a test to specifically exercise and verify this code path. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
Denton Gentry	0aa55bffce	magicsock: test error case in derpWriteChanOfAddr In derpWriteChanOfAddr when we call derphttp.NewRegionClient(), there is a check of whether the connection is already errored and if so it returns before grabbing the lock. The lock might already be held and would be a deadlock. This corner case is not being reliably exercised by other tests. This shows up in code coverage reports, the lines of code in derpWriteChanOfAddr are alternately added and subtracted from code coverage. Add a test to specifically exercise this code path, and verify that it doesn't deadlock. This is the best tradeoff I could come up with: + the moment code calls Err() to check if there is an error, we grab the lock to make sure it would deadlock if it tries to grab the lock itself. + if a new call to Err() is added in this code path, only the first one will be covered and the rest will not be tested. + this test doesn't verify whether code is checking for Err() in the right place, which ideally I guess it would. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
Brad Fitzpatrick	85e54af0d7	wgengine: on TCP connect fail/timeout, log some clues about why it failed So users can see why things aren't working. A start. More diagnostics coming. Updates #1094	5 years ago
Brad Fitzpatrick	5eeaea9ef9	net/packet: add TCPFlag type and some more constants Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	f85769b1ed	wgengine/magicsock: drop netaddr.IPPort cache netaddr.IP no longer allocates, so don't need a cache or all its associated code/complexity. This totally removes groupcache/lru from the deps. Also go mod tidy.	5 years ago

... 6 7 8 9 10 ...

1283 Commits (22680a11ae2a3061c57123bc6afac2f11b7b51a7)