tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	d413850bd7	cmd/tailscale: add "debug via" subcommand to do CIDR math for via ranges $ tailscale debug via 0xb 10.2.0.0/16 fd7a:115c:a1e0:b1a:0🅱️a02:0/112 $ tailscale debug via fd7a:115c:a1e0:b1a:0🅱️a02:0/112 site 11 (0xb), 10.2.0.0/16 Previously: `3ae701f0eb` This adds a little debug tool to do CIDR math to make converting between those ranges easier for now. Updates #3616 Change-Id: I98302e95d17765bfaced3ecbb71cbd43e84bff46 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Tom DNetto	c8f4dfc8c0	derp/derphttp,net/netcheck: improve netcheck behavior under MITM proxies In cases where tailscale is operating behind a MITM proxy, we need to consider that a lot more of the internals of our HTTP requests are visible and may be used as part of authorization checks. As such, we need to 'behave' as closely as possible to ideal. - Some proxies do authorization or consistency checks based the on Host header or HTTP URI, instead of just the IP/hostname/SNI. As such, we need to construct a `*http.Request` with a valid URI everytime HTTP is going to be used on the wire, even if its over TLS. Aside from the singular instance in net/netcheck, I couldn't find anywhere else a http.Request was constructed incorrectly. - Some proxies may deny requests, typically by returning a 403 status code. We should not consider these requests as a valid latency check, so netcheck semantics have been updated to consider >299 status codes as a failed probe. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	cc575fe4d6	net/dns: schedule DoH upgrade explicitly, fix Resolver.Addr confusion Two changes in one: * make DoH upgrades an explicitly scheduled send earlier, when we come up with the resolvers-and-delay send plan. Previously we were getting e.g. four Google DNS IPs and then spreading them out in time (for back when we only did UDP) but then later we added DoH upgrading at the UDP packet layer, which resulted in sometimes multiple DoH queries to the same provider running (each doing happy eyeballs dialing to 4x IPs themselves) for each of the 4 source IPs. Instead, take those 4 Google/Cloudflare IPs and schedule 5 things: first the DoH query (which can use all 4 IPs), and then each of the 4 IPs as UDP later. * clean up the dnstype.Resolver.Addr confusion; half the code was using it as an IP string (as documented) as half was using it as an IP:port (from some prior type we used), primarily for tests. Instead, document it was being primarily an IP string but also accepting an IP:port for tests, then add an accessor method on it to get the IPPort and use that consistently everywhere. Change-Id: Ifdd72b9e45433a5b9c029194d50db2b9f9217b53 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e3a4952527	net/dns/resolver: count errors when racing DNS queries, fail earlier If all N queries failed, we waited until context timeout (in 5 seconds) to return. This makes (*forwarder).forward fail fast when the network's unavailable. Change-Id: Ibbb3efea7ed34acd3f3b29b5fee00ba8c7492569 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d9efbd97cb	net/dns: remove an unused function Change-Id: I7c920c76223ffac37954ef2a18754afc52177598 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ecea6cb994	net/dns/resolver: make DoH dialer use existing dnscache happy eyeball dialer Simplify the ability to reason about the DoH dialing code by reusing the dnscache's dialer we already have. Also, reduce the scope of the "ip" variable we don't want to close over. This necessarily adds a new field to dnscache.Resolver: SingleHostStaticResult, for when the caller already knows the IPs to be returned. Change-Id: I9f2aef7926f649137a5a3e63eebad6a3fffa48c0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f4f76eb275	net/dnsfallback: update from 'go generate' Change-Id: I93e0e6d9a4a471953c1ffef07f32605c5724aed8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
phirework	52d32c94d8	net/dns/publicdns: add missing call to sync.Once.Do (#4410 ) Signed-off-by: Jenny Zhang <jz@tailscale.com>	3 years ago
phirework	83c734a6e0	net/dns, util/publicdns: extract public DNS mapping into own package (#4405 ) This extracts DOH mapping of known public DNS providers in forwarder.go into its own package, to be consumed by other repos Signed-off-by: Jenny Zhang <jz@tailscale.com>	3 years ago
Brad Fitzpatrick	a49d8d5200	Revert ".github/workflows: work around golang/go#51629" This reverts commit `2a412ac9ee`. Updates #4194 Change-Id: I0098b66b71d20bea301ca79058c1cdd201237dd0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3ae701f0eb	net/tsaddr, wgengine/netstack: add IPv6 range that forwards to site-relative IPv4 This defines a new magic IPv6 prefix, fd7a:115c:a1e0:b1a::/64, a subset of our existing /48, where the final 32 bits are an IPv4 address, and the middle 32 bits are a user-chosen "site ID". (which must currently be 0000:00xx; the top 3 bytes must be zero for now) e.g., I can say my home LAN's "site ID" is "0000:00bb" and then advertise its 10.2.0.0/16 IPv4 range via IPv6, like: tailscale up --advertise-routes=fd7a:115c:a1e0:b1a::bb:10.2.0.0/112 (112 being /128 minuse the /96 v6 prefix length) Then people in my tailnet can: $ curl '[fd7a:115c:a1e0:b1a::bb:10.2.0.230]' <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" .... Updates #3616, etc RELNOTE=initial support for TS IPv6 addresses to route v4 "via" specific nodes Change-Id: I9b49b6ad10410a24b5866b9fbc69d3cae1f600ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Tom	24bdcbe5c7	net/dns, net/dns/resolver, wgengine: refactor DNS request path (#4364 ) * net/dns, net/dns/resolver, wgengine: refactor DNS request path Previously, method calls into the DNS manager/resolver types handled DNS requests rather than DNS packets. This is fine for UDP as one packet corresponds to one request or response, however will not suit an implementation that supports DNS over TCP. To support PRs implementing this in the future, wgengine delegates all handling/construction of packets to the magic DNS endpoint, to the DNS types themselves. Handling IP packets at this level enables future support for both UDP and TCP. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Tom	6be7931eb4	net/dns/resolver: return symbolic PTR records for TS service IPs (#4361 ) Fixes #1233 Signed-off-by: Tom DNetto <tom@tailscale.com> Co-authored-by: Tom DNetto <tom@tailscale.com>	3 years ago
Maisem Ali	309ddef852	net/netutil: add CheckIPForwardingLinux (#4301 ) Combine the code between `LocalBackend.CheckIPForwarding` and `controlclient.ipForwardingBroken`. Fixes #4300 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	e4d8d5e78b	net/packet, wgengine/netstack: remove workaround for old gvisor ECN bug Fixes #2642 Change-Id: Ic02251d24a4109679645d1c8336e0f961d0cce13 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	753f1bfad4	cmd/tailscale: write fewer known_hosts, resolve ssh host to FQDN early Updates #3802 Change-Id: Ic44fa2e6661a9c046e725c04fa6b8213d3d4d2b2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	b2f269d5b7	net/dnsfallback: do not attempt lookups of IPs. Currently if the passed in host is an IP, Lookup still attempts to resolve it with a dns server. This makes it just return the IP directly. Updates tailscale/corp#4475 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	b45bb577a0	net/dnscache: do not call LookupIPFallback if the context was canceled. When the context is canceled, dc.dialOne returns an error from line 345. This causes the defer on line 312 to try to resolve the host again, which triggers a dns lookup of "127.0.0.1" from derp. Updates tailscale/corp#4475 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	b647977b33	net/netutil: move some net utils from control/controlhttp to netutil In prep for reuse elsewhere. Change-Id: I1b804edf76ac66b9108e6f434e77eab7a7472d69 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	445c04c938	wgengine: inject packetbuffers rather than bytes (#4220 ) Plumb the outbound injection path to allow passing netstack PacketBuffers down to the tun Read, where they are decref'd to enable buffer re-use. This removes one packet alloc & copy, and reduces GC pressure by pooling outbound injected packets. Fixes #2741 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	f2041c9088	all: use strings.Cut even more Change-Id: I943ce72c6f339589235bddbe10d07799c4e37979 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Klotz	6e91f872af	net/tshttpproxy: ensure we pass the correct flags to WinHttpOpen on Win7 and Win8.0 The best flag to use on Win7 and Win8.0 is deprecated in Win8.1, so we resolve the flag depending on OS version info. Fixes https://github.com/tailscale/tailscale/issues/4201 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
David Anderson	2a412ac9ee	.github/workflows: work around golang/go#51629 Incidentally, simplify the go generate CI workflow, by marking the dnsfallback update non-hermetic (so CI will skip it) rather than manually filter it out of `go list`. Updates #4194 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	0868329936	all: use any instead of interface{} My favorite part of generics. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	61ee72940c	all: use Go 1.18's strings.Cut More remain. Change-Id: I6ec562cc1f687600758deae1c9d7dbd0d04004cb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	0ef74f37a5	net/dns/resolver: remove closure allocation explanation As of Go 1.18, the register ABI list includes arm64, amd64, ppc64, and ppc64le. This is a large enough percentage of the architectures that it's not worth explaining. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	61cdcf4082	net/interfaces: add FreeBSD default route lookup (portmapping, etc) Updates #4101 (probably fixes) Change-Id: I2b75ee3ced276fb7b211f17c382621cf1ef882fa Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	2fb087891b	net/socks5: always close client connections after serving Customer reported an issue where the connections were not closing, and would instead just stay open. This commit makes it so that we close out the connection regardless of what error we see. I've verified locally that it fixes the issue, we should add a test for this. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	b493ef5b71	net/tsaddr: add func ContainsExitRoutes Change-Id: I772441a406083e2fe0f9374b2b23d89aac18928f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	55095df644	net/interfaces: get Linux default route from netlink as fallback If it's in a non-standard table, as it is on Unifi UDM Pro, apparently. Updates #4038 (probably fixes, but don't have hardware to verify) Change-Id: I2cb9a098d8bb07d1a97a6045b686aca31763a937 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Dmytro Shynkevych	d9a7205be5	net/tstun: set link speed to SPEED_UNKNOWN Fixes #3933. Signed-off-by: Dmytro Shynkevych <dm.shynk@gmail.com>	3 years ago
Brad Fitzpatrick	7d897229d9	net/dns: ignore permission errors on Synology DSM7 for now Updates #4017 Change-Id: Ia7fd4df47588c010dea8e63d88f397cc8eb748e5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	bb94561c96	net/netutil: fix regression where peerapi would get closed after 1st req I introduced a bug in `8fe503057d` when unifying oneConnListener implementations. The NewOneConnListenerFrom API was easy to misuse (its Close method closes the underlying Listener), and we did (via http.Serve, which closes the listener after use, which meant we were close the peerapi's listener, even though we only wanted its Addr) Instead, combine those two constructors into one and pass in the Addr explicitly, without delegating through to any Listener. Change-Id: I061d7e5f842e0cada416e7b2dd62100d4f987125 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2ff481ff10	net/dns: add health check for particular broken-ish Linux DNS config Updates #3937 (need to write docs before closing) Change-Id: I1df7244cfbb0303481e2621ee750d21358bd67c6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c988bd6ed1	net/dns/resolvconffile: unify three /etc/resolv.conf parsers into new package Change-Id: I2120893ca802d12f1bd0407d49077d3672627d33 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8d6cf14456	net/dnscache: don't do bootstrap DNS lookup after most failed dials If we've already connected to a certain name's IP in the past, don't assume the problem was DNS related. That just puts unnecessarily load on our bootstrap DNS servers during regular restarts of Tailscale infrastructure components. Also, if we do do a bootstrap DNS lookup and it gives the same IP(s) that we already tried, don't try them again. Change-Id: I743e8991a7f957381b8e4c1508b8e9d0df1782fe Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	903988b392	net/dnscache: refactor from func-y closure-y state to types & methods No behavior changes (intended, at least). This is in prep for future changes to this package, which would get too complicated in the current style. Change-Id: Ic260f8e34ae2f64f34819d4a56e38bee8d8ac5ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8267ea0f80	net/tstun: remove TODO that's done This TODO was both added and fixed in `506c727e3`. As I recall, I wasn't originally going to do it because it seemed annoying, so I wrote the TODO, but then I felt bad about it and just did it, but forgot to remove the TODO. Change-Id: I8f3514809ad69b447c62bfeb0a703678c1aec9a3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8fe503057d	net/netutil: unify two oneConnListeners into a new package I was about to add a third copy, so unify them now instead. Change-Id: I3b93896aa1249b1250a6b1df4829d57717f2311a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	21358cf2f5	net/dns: slightly optimize dbusPing for non-dbus case [Linux] Avoid some work when D-Bus isn't running. Change-Id: I6f89bb75fdb24c13f61be9b400610772756db1ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	37e7a387ff	net/dns: remove some unused code for detecting systemd-resolved [Linux] Change-Id: I19c5fd2cdacfb9e5b688ccd9b4336ae4edffc445 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	15599323a1	net/dns: fix systemd-resolved detection race at boot If systemd-resolved is enabled but not running (or not yet running, such as early boot) and resolv.conf is old/dangling, we weren't detecting systemd-resolved. This moves its ping earlier, which will trigger it to start up and write its file. Updates #3362 (likely fixes) Updates #3531 (likely fixes) Change-Id: I6392944ac59f600571c43b8f7a677df224f2beed Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	dbea8217ac	net/dns: add NetworkManager regression test Use the exact /etc/resolv.conf file from a user report. Updates https://github.com/tailscale/tailscale/issues/3531 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	2a67beaacf	net/interfaces: bound Linux /proc/net/route parsing tailscaled was using 100% CPU on a machine with ~1M lines, 100MB+ of /proc/net/route data. Two problems: in likelyHomeRouterIPLinux, we didn't stop reading the file once we found the default route (which is on the first non-header line when present). Which meant it was finding the answer and then parsing 100MB over 1M lines unnecessarily. Second was that if the default route isn't present, it'd read to the end of the file looking for it. If it's not in the first 1,000 lines, it ain't coming, or at least isn't worth having. (it's only used for discovering a potential UPnP/PMP/PCP server, which is very unlikely to be present in the environment of a machine with a ton of routes) Change-Id: I2c4a291ab7f26aedc13885d79237b8f05c2fd8e4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Bieber	e5cd765e00	net/dns/resolvd: properly handle not having "search" entries This prevents adding an empty "search" line when no search domains are set. Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>	3 years ago
Brad Fitzpatrick	1af26222b6	go.mod: bump netstack, switch to upstream netstack Now that Go 1.17 has module graph pruning (https://go.dev/doc/go1.17#go-command), we should be able to use upstream netstack without breaking our private repo's build that then depends on the tailscale.com Go module. This is that experiment. Updates #1518 (the original bug to break out netstack to own module) Updates #2642 (this updates netstack, but doesn't remove workaround) Change-Id: I27a252c74a517053462e5250db09f379de8ac8ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6feb8f4c51	net/dns: log why resolved does not look like it's on use [Linux] Updates #3742 Updates #3531 Change-Id: I9fc7fa0f4bcab1cf8001ba92408c660a5b25f105 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Bieber	411c6c316c	net/dns/resolvd: store nameservers Currently only search domains are stored. This was an oversight (under?) on my part. As things are now, when MagicDNS is on and "Override local DNS" is off, the dns forwarder has to timeout before names resolve. This introduces a pretty annoying lang that makes everything feel extremely slow. You will also see an error: "upstream nameservers not set". I tested with "Override local DNS" on and off. In both situations things seem to function as expected (and quickly). Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>	3 years ago
Brad Fitzpatrick	c64af5e676	wgengine/netstack: clear TCP ECN bits before giving to gvisor Updates #2642 Change-Id: Ic219442a2656dd9dc99ae1dd91e907fd3d924987 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	390490e7b1	net/packet: fix typo in comment Change-Id: Ia666609fde18db44bf38d4e656f490fc372ac3b6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	463b3e8f62	net/dnscache: use tls.Conn.HandshakeContext. Go 1.17 added a HandshakeContext func to take care of timeouts during TLS handshaking, so switch from our homegrown goroutine implementation to the standard way. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	a9da6b73a8	net/dnscache: don't cancel the TLS context before writing to the result channel. Cancelling the context makes the timeout goroutine race with the write that reports a successful TLS handshake, so you can end up with a successful TLS handshake that mysteriously reports that it timed out after ~0s in flight. The context is always canceled and cleaned up as the function exits, which happens mere microseconds later, so just let function exit clean up and thereby avoid races. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	24a04d07d1	net/dns/resolver: handle tabs as whitespace when ExitDNS parses resolv.conf On Synology, the /etc/resolv.conf has tabs in it, which this resolv.conf parser (we have two, sigh) didn't handle. Updates #3710 Change-Id: I86f8e09ad1867ee32fa211e85c382a27191418ea Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	51bc9a6d9d	net/netns: remove a useless probe of the "ip" command We stopped using it in 1.18. Change-Id: If5adf1d99275286a89e2a05f0bce5193d9f6e5e3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8df3fa4638	net/dns: make WSL network configuration opt-in for now Tailscale seems to be breaking WSL configurations lately. Until we understand what changed, turn off Tailscale's involvement by default and make it opt-in. Updates #2815 Change-Id: I9977801f8debec7d489d97761f74000a4a33f71b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Bieber	189f359609	net/dns: teach OpenBSD's manager to talk to resolvd(8). (#2789 ) OpenBSD 6.9 and up has a daemon which handles nameserver configuration. This PR teaches the OpenBSD dns manager to check if resolvd is being used. If it is, it will use the route(8) command to tell resolvd to add the Tailscale dns entries to resolv.conf Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>	3 years ago
Brad Fitzpatrick	8d0ed1c9ba	net/dns/resolver: on Android, make ExitDNS use net package for DNS Like Windows. Updates #1738 Change-Id: I9f26bc58ce7e760c749786fbe5d9952c99eeb91c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	506c727e30	ipnlocal, net/{dns,tsaddr,tstun}, wgengine: support MagicDNS on IPv6 Fixes #3660 RELNOTE=MagicDNS now works over IPv6 when CGNAT IPv4 is disabled. Change-Id: I001e983df5feeb65289abe5012dedd177b841b45 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2513d2d728	net/{neterror,dns/resolver}: move PacketWasTruncated to neterror from DNS code And delete the unused code in net/dns/resolver/neterr_*.go. Change-Id: Ibe62c486bacce2733eb9968c96a98cbbdb2758bd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7d9b1de3aa	netcheck,portmapper,magicsock: ignore some UDP write errors on Linux Treat UDP send EPERM errors as a lost UDP packet, not something super fatal. That's just the Linux firewall preventing it from going out. And add a leaf package net/neterror for that (and future) policy that all three packages can share, with tests. Updates #3619 Change-Id: Ibdb838c43ee9efe70f4f25f7fc7fdf4607ba9c1d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2c94e3c4ad	wgengine/magicsock: don't unconditionally close DERP connections on rebind Only if the source address isn't on the currently active interface or a ping of the DERP server fails. Updates #3619 Change-Id: I6bf06503cff4d781f518b437c8744ac29577acc8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	04c2c5bd80	net/interfaces: define DefaultRouteInterface and State.DefaultRouteInterface It was pretty ill-defined before and mostly for logging. But I wanted to start depending on it, so define what it is and make Windows match the other operating systems, without losing the log output we had before. (and add tests for that) Change-Id: I0fbbba1cfc67a265d09dd6cb738b73f0f6005247 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	eb26c081b1	net/dns: bound time we wait on restarting systemd-resolved in another place Fixes #3629 Updates #3537 Change-Id: I5d4b6acfcfdf0e3efcf6eb49c5e6cf4521e4baed Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0aa4c6f147	net/dns/resolver: add debug HTML handler to see what DNS traffic was forwarded Change-Id: I6b790e92dcc608515ac8b178f2271adc9fd98f78 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0848b36dd2	net/dns/resolver: add metrics to PTR lookup misses Updates tailscale/corp#3326 Change-Id: I58077d889a3b58ef0633267c92ffb265686ce152 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	39f22a357d	net/dns/resolver: send NXDOMAIN to iOS DNS-SD/Bonjour queries Don't just ignore them. See if this makes them calm down. Updates #3363 Change-Id: Id1d66308e26660d26719b2538b577522a1e36b63 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	394c9de02b	net/dns/resolver: add nameFromQuery benchmark To convince me it's not as alloc-y as it looks. Change-Id: I503a0cc267268a23d2973dfde9833c420be4e868 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c7052154d5	net/dns/resolver: fix the subject in a func comment Change-Id: I519268c20dbd2c2da92da565839d3c1c84612dcc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	486059589b	all: gofmt -w -s (simplify) tests And it updates the build tag style on a couple files. Change-Id: I84478d822c8de3f84b56fa1176c99d2ea5083237 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cced414c7d	net/dns/resolver: add Windows ExitDNS service support, using net package Updates #1713 Updates #835 Change-Id: Ia71e96d0632c2d617b401695ad68301b07c1c2ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cab5c46481	net/dns: bound how long we block looking for, restarting systemd-resolved Fixes #3537 Change-Id: Iba6a3cde75983490d4072b5341f48dbfa2f997c0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	39ffa16853	net/dnscache, net/tsdial: add DNS caching to tsdial UserDial This is enough to handle the DNS queries as generated by Go's net package (which our HTTP/SOCKS client uses), and the responses generated by the ExitDNS DoH server. This isn't yet suitable for putting on 100.100.100.100 where a number of different DNS clients would hit it, as this doesn't yet do EDNS0. It might work, but it's untested and likely incomplete. Likewise, this doesn't handle anything about truncation, as the exchanges are entirely in memory between Go or DoH. That would also need to be handled later, if/when it's hooked up to 100.100.100.100. Updates #3507 Change-Id: I1736b0ad31eea85ea853b310c52c5e6bf65c6e2a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	21741e111b	net/packet: add ICMP6Header, like ICMP4Header So we can generate IPv6 ping replies. Change-Id: I79a9a38d8aa242e5dfca4cd15dfaffaea6cb1aee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	affc4530a2	net/packet: don't make IP6Header.marshalPseudo assume UDP It will be used for ICMPv6 next, so pass in the proto. Also, use the ipproto constants rather than hardcoding the mysterious number. Change-Id: I57b68bdd2d39fff75f82affe955aff9245de246b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	485bcdc951	net/packet: fix doc copy/paste-o Change-Id: I0aca490b3ccb0c124192afb362a10b19a15a3e2b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9c5c9d0a50	ipn/ipnlocal, net/tsdial: make SOCKS/HTTP dials use ExitDNS And simplify, unexport some tsdial/netstack stuff in the the process. Fixes #3475 Change-Id: I186a5a5cbd8958e25c075b4676f7f6e70f3ff76e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	adc5997592	net/tsdial: give netstack a Dialer, start refactoring name resolution This starts to refactor tsdial.Dialer's name resolution to have different stages: in-memory MagicDNS vs system resolution. A future change will plug in ExitDNS resolution. This also plumbs a Dialer into netstack and unexports the dnsMap internals. And it removes some of the async AddNetworkMapCallback usage and replaces it with synchronous updates of the Dialer's netmap from LocalBackend, since the LocalBackend has the Dialer too. Updates #3475 Change-Id: Idcb7b1169878c74f0522f5151031ccbc49fe4cb4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8775c646be	net/tsdial: make dialing to peerapi work in netstack mode With this, I'm able to send a Taildrop file (using "tailscale file cp") from a Linux machine running --tun=userspace-networking. Updates #2179 Change-Id: I4e7a4fb0fbda393e4fb483adb06b74054a02cfd0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ad3d6e31f0	net/tsdial: move macOS/iOS peerapi sockopt logic from LocalBackend Change-Id: I812cae027c40c70cdc701427b1a1850cd9bcd60c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c7fb26acdb	net/tsdial: also plumb TUN name and monitor into tsdial.Dialer In prep for moving stuff out of LocalBackend. Change-Id: I9725aa9c3ebc7275f8c40e040b326483c0340127 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c37af58ea4	net/tsdial: move more weirdo dialing into new tsdial package, plumb Not done yet, but this move more of the outbound dial special casing from random packages into tsdial, which aspires to be the one unified place for all outbound dialing shenanigans. Then this plumbs it all around, so everybody is ultimately holding on to the same dialer. As of this commit, macOS/iOS using an exit node should be able to reach to the exit node's DoH DNS proxy over peerapi, doing the sockopt to stay within the Network Extension. A number of steps remain, including but limited to: * move a bunch more random dialing stuff * make netstack-mode tailscaled be able to use exit node's DNS proxy, teaching tsdial's resolver to use it when an exit node is in use. Updates #1713 Change-Id: I1e8ee378f125421c2b816f47bc2c6d913ddcd2f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	2075c39fd7	net/portmapper: deflake TestPCPIntegration Logging in goroutines after the test completed caused data races and panics. Prevent that. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	d5405c66b7	net/tsdial: start of new package to unify all outbound dialing complexity For now this just deletes the net/socks5/tssocks implementation (and the DNSMap stuff from wgengine/netstack) and moves it into net/tsdial. Then initialize a Dialer early in tailscaled, currently only use for the outbound and SOCKS5 proxies. It will be plumbed more later. Notably, it needs to get down into the DNS forwarder for exit node DNS forwading in netstack mode. But it will also absorb all the peerapi setsockopt and netns Dial and tlsdial complexity too. Updates #1713 Change-Id: Ibc6d56ae21a22655b2fa1002d8fc3f2b2ae8b6df Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3ae6f898cf	ipn/ipnlocal, net/dns/resolver: use exit node's DoH proxy when available Updates #1713 Change-Id: I3695a40ec12d2b4e6dac41cf4559daca6dddd68e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Klotz	f93cf6fa03	net/dns: fix checking for wrapped error when attempting to read wsl.conf for Windows WSL2 Fixes https://github.com/tailscale/tailscale/issues/3437 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
David Anderson	124363e0ca	net/dns: detect and decode UTF-16 from wsl.exe earlier. Fixes #3170 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	e16cb523aa	net/nettest: deflake TestPipeTimeout The block-write and block-read tests are both flaky, because each assumes it can get a normal read/write completed within 10ms. This isn’t always true. We can’t increase the timeouts, because that slows down the test. However, we don’t need to issue a regular read/write for this test. The immediately preceding tests already test this code, using a far more generous timeout. Remove the extraneous read/write. This drops the failure rate from 1 per 20,000 to undetectable on my machine. While we’re here, fix a typo in a debug print statement. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	a8cc519c70	net/portmapper: improve handling of UPnP parse errors Without the continue, we might overwrite our current meta with a zero meta. Log the error, so that we can check for anything unexpected. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	fddf43f3d1	net/portmapper: fill out PCP/PMP client metrics Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	9787ec6f4a	net/portmapper: add UPnP client metrics Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	40f11c50a1	net/portmapper: make PCP/PMP result codes stringers Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	38d90fa330	net/portmapper: add clientmetrics for PCP/PMP responses Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	999814e9e1	net/portmapper: handle pcp ADDRESS_MISMATCH response These show up a fair amount in our logs. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	bb91cfeae7	net/socks5/tssocks, wgengine: permit SOCKS through subnet routers/exit nodes Fixes #1970 Change-Id: Ibef45e8796e1d9625716d72539c96d1dbf7b1f76 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	a54d13294f	net/proxymux: add a listener mux that can run SOCKS and HTTP on a single socket. Updates #3248 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	135580a5a8	tailcfg, ipn/ipnlocal, net/dns: forward exit node DNS on Unix to system DNS Updates #1713 Change-Id: I4c073fec0992d9e01a9a4ce97087d5af0efdc68d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	78b0bd2957	net/dns/resolver: add clientmetrics for DNS Fixes tailscale/corp#1811 Change-Id: I864d11e0332a177e8c5ff403591bff6fec548f5a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	25525b7754	net/dns/resolver, ipn/ipnlocal: wire up peerapi DoH server to DNS forwarder Updates #1713 Change-Id: Ia4ed9d8c9cef0e70aa6d30f2852eaab80f5f695a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	d10cefdb9b	net/dns: require space after nameserver/search parsing resolv.conf Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	9f00510833	net/dns: handle comments in resolv.conf Currently, comments in resolv.conf cause our parser to fail, with error messages like: ParseIP("192.168.0.100 # comment"): unexpected character (at " # comment") Fix that. Noticed while looking through logs. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	73beaaf360	net/tstun: rate limit "self disco out packet" logging When this happens, it is incredibly noisy in the logs. It accounts for about a third of all remaining "unexpected" log lines from a recent investigation. It's not clear that we know how to fix this, we have a functioning workaround, and we now have a (cheap and efficient) metric for this that we can use for measurements. So reduce the logging to approximately once per minute. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	283ae702c1	ipn/ipnlocal: start adding DoH DNS server to peerapi when exit node Updates #1713 Change-Id: I8d9c488f779e7acc811a9bc18166a2726198a429 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	ad5e04249b	wgengine/monitor: ignore adding/removing uninteresting IPs One of the most common "unexpected" log lines is: "network state changed, but stringification didn't" One way that this can occur is if an interesting interface (non-Tailscale, has interesting IP address) gains or loses an uninteresting IP address (link local or loopback). The fact that the interface is interesting is enough for EqualFiltered to inspect it. The fact that an IP address changed is enough for EqualFiltered to declare that the interfaces are not equal. But the State.String method reasonably declines to print any uninteresting IP addresses. As a result, the network state appears to have changed, but the stringification did not. The String method is correct; nothing interesting happened. This change fixes this by adding an IP address filter to EqualFiltered in addition to the interface filter. This lets the network monitor ignore the addition/removal of uninteresting IP addresses. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	ca1b3fe235	net/tshttpproxy: use correct size for Windows BOOL argument The Windows BOOL type is an int32. We were using a bool, which is a one byte wide. This could be responsible for the ERROR_INVALID_PARAMETER errors we were seeing for calls to WinHttpGetProxyForUrl. We manually checked all other existing Windows syscalls for similar mistakes and did not find any. Updates #879 Co-authored-by: Aaron Klotz <aaron@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	1a629a4715	net/portmapper: mark fewer PMP probe failures as unexpected There are lots of lines in the logs of the form: portmapper: unexpected PMP probe response: {OpCode:128 ResultCode:3 SecondsSinceEpoch:NNN MappingValidSeconds:0 InternalPort:0 ExternalPort:0 PublicAddr:0.0.0.0} ResultCode 3 here means a network failure, e.g. the NAT box itself has not obtained a DHCP lease. This is not an indication that something is wrong in the Tailscale client, so use different wording here to reflect that. Keep logging, so that we can analyze and debug the reasons that PMP probes fail. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Anderson	88b8a09d37	net/dns: make constants for the various DBus strings. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	6c82cebe57	health: add a health state for net/dns.OSConfigurator. Lets the systemd-resolved OSConfigurator report health changes for out of band config resyncs. Updates #3327 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	4ef3fed100	net/dns: resync config to systemd-resolved when it restarts. Fixes #3327 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	cf9169e4be	net/dns: remove unused Config struct element. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	758c37b83d	net/netns: thread logf into control functions So that darwin can log there without panicking during tests. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	cf06f9df37	net/tstun, wgengine: add packet-level and drop metrics Primarily tstun work, but some MagicDNS stuff spread into wgengine. No wireguard reconfig metrics (yet). Updates #3307 Change-Id: Ide768848d7b7d0591e558f118b553013d1ec94ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	400ed799e6	net/dns: work around old systemd-resolved setLinkDomain length limit Don't set all the *.arpa. reverse DNS lookup domains if systemd-resolved is old and can't handle them. Fixes #3188 Change-Id: I283f8ce174daa8f0a972ac7bfafb6ff393dde41d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	24ea365d48	netcheck, controlclient, magicsock: add more metrics Updates #3307 Change-Id: Ibb33425764a75bde49230632f1b472f923551126 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	c5d572f371	net/dns: correctly handle NetworkManager-managed DNS that points to resolved. Fixes #3304 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maisem Ali	eccc2ac6ee	net/interfaces/windows: update Tailscale interface detection logic to account for new wintun naming. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Anderson	0532eb30db	all: replace tailcfg.DiscoKey with key.DiscoPublic. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	94fb42d4b2	all: use testingutil.MinAllocsPerRun There are a few remaining uses of testing.AllocsPerRun: Two in which we only log the number of allocations, and one in which dynamically calculate the allocations target based on a different AllocsPerRun run. This also allows us to tighten the "no allocs" test in wgengine/filter. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Denton Gentry	5302e4be96	net/portmapper: only print PCP/PMP if VerboseLogs Make UPnP, NAT-PMP, and PCP packet reception logs be [v1] so they will never appear on stdout and instead only go to logtail. ``` $ tailscale netcheck 2021/10/15 22:50:31 portmap: Got PMP response; IP: w.x.y.z, epoch: 1012707 2021/10/15 22:50:31 portmap: Got PCP response: epoch: 1012707 Report: * UDP: true * IPv4: yes, w.x.y.z:1511 * IPv6: no * MappingVariesByDestIP: true * HairPinning: false * PortMapping: NAT-PMP, PCP * Nearest DERP: San Francisco * DERP latency: - sfo: 5.9ms (San Francisco) - sea: 24ms (Seattle) - dfw: 45ms (Dallas) - ord: 53.7ms (Chicago) - nyc: 74.1ms (New York City) - tok: 111.1ms (Tokyo) - lhr: 139.4ms (London) - syd: 152.7ms (Sydney) - fra: 153.1ms (Frankfurt) - sin: 182.1ms (Singapore) - sao: 190.1ms (S_o Paulo) - blr: 218.6ms (Bangalore) ``` Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
David Anderson	060ba86baa	net/portmapper: ignore IGD SSDP responses from !defaultgw Now that we multicast the SSDP query, we can get IGD offers from devices other than the current device's default gateway. We don't want to accidentally bind ourselves to those. Updates #3197 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	4a65b07e34	net/portmapper: also send UPnP SSDP query to the SSDP multicast address. Fixes #3197 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	b0b0a80318	net/netcheck: implement netcheck for js/wasm clients And the derper change to add a CORS endpoint for latency measurement. And a little magicsock change to cut down some log spam on js/wasm. Updates #3157 Change-Id: I5fd9e6f5098c815116ddc8ac90cbcd0602098a48 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	139a6c4c9c	net/dns: detect when resolvconf points to systemd-resolved. There are /etc/resolv.conf files out there where resolvconf wrote the file but pointed to systemd-resolved as the nameserver. We're better off handling those as systemd-resolved. > # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) > # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN > # 127.0.0.53 is the systemd-resolved stub resolver. > # run "systemd-resolve --status" to see details about the actual nameservers. Fixes https://github.com/tailscale/tailscale/issues/3026 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
David Anderson	a320d70614	net/dns: fall back to copy+delete/truncate if moving to/from /etc/resolv.conf fails. In some containers, /etc/resolv.conf is a bind-mount from outside the container. This prevents renaming to or from /etc/resolv.conf, because it's on a different filesystem from linux's perspective. It also prevents removing /etc/resolv.conf, because doing so would break the bind-mount. If we find ourselves within this environment, fall back to using copy+delete when renaming to /etc/resolv.conf, and copy+truncate when renaming from /etc/resolv.conf. Fixes #3000 Co-authored-by: Denton Gentry <dgentry@tailscale.com> Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	04d24d3a38	net/dns: move directManager function below directManager's definition. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	422ea4980f	net/dns: remove a tiny wrapper function that isn't contributing anything. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	a8e2cceefd	net/netcheck: hard-code preferred DERP region 900 on js/wasm for now See TODO in code. Updates #3157 Change-Id: I3a14dd2cf51d3c21336bb357af5abc362a079ff4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9b101bd6af	net/tstun: don't compile the code New constructor on js/wasm Updates #3157 Change-Id: I81603edf3e69e6f1517b0074eef6b648f2981c50 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maxim Merzhanov	9f954628e5	net/dns: ignore UnknownMethod error in SetLinkDefaultRoute for resolved manager Signed-off-by: Maxim Merzhanov <maksimmerzh@gmail.com>	3 years ago
Brad Fitzpatrick	8efc306e4f	net/interfaces: assume the network's up on js/wasm Updates #3157 Change-Id: If4acd33598ad5e8ef7fb5960964c9ac32bc8f68b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Joe Tsai	9af27ba829	cmd/cloner: mangle "go:generate" in cloner.go The "go generate" command blindly looks for "//go:generate" anywhere in the file regardless of whether it is truly a comment. Prevent this false positive in cloner.go by mangling the string to look less like "//go:generate". Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Maisem Ali	7817ab6b20	net/dns/resolver: set maxDoHInFlight to 1000 on iOS 15+. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	4a3e2842d9	net/interfaces: add List, GetList And start moving funcs to methods on List. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	77696579f5	net/dns/resolver: drop dropping log Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	676fb458c3	net/dns/resolver: make hasRDNSBonjourPrefix match shorter queries too Fixes tailscale/corp#2886 Updates tailscale/corp#2820 Updates #2442 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
nicksherron	f01ff18b6f	all: fix spelling mistakes Signed-off-by: nicksherron <nsherron90@gmail.com>	3 years ago
Aaron Klotz	1991a1ac6a	net/tstun: update tun_windows for wintun 0.14 API revisions, update wireguard-go dependency to 82d2aa87aa623cb5143a41c3345da4fb875ad85d Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Smitty	b382161fe5	tsdns: don't forward transient DNS errors When a DNS server claims to be unable or unwilling to handle a request, instead of passing that refusal along to the client, just treat it as any other error trying to connect to the DNS server. This prevents DNS requests from failing based on if a server can respond with a transient error before another server is able to give an actual response. DNS requests only failing sometimes is really hard to find the cause of (#1033). Signed-off-by: Smitty <me@smitop.com>	3 years ago
Denton Gentry	5d6198adee	netcheck: don't log ErrGatewayRange "skipping portmap; gateway range likely lacks support" is really spammy on cloud systems, and not very useful in debugging. Fixes https://github.com/tailscale/tailscale/issues/3034 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	d883747d8b	net/dns/resolver: don't forward DNS-SD on all platforms We added the initial handling only for macOS and iOS. With 1.16.0 now released, suppress forwarding DNS-SD on all platforms to test it through the 1.17.x cycle. Updates #2442 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	297d1b7cb6	net/dns/resolver: don't forward DNS-SD queries Updates #2442 Fixes tailscale/corp#2820 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	47044f3af7	net/dns/resolver: fix log prefix The passed in logf already has a "dns: " prefix so they were doubled up.	3 years ago
Brad Fitzpatrick	7634af5c6f	all: gofmt Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Avery Pennarun	0d4a0bf60e	magicsock: if STUN failed to send before, rebind before STUNning again. On iOS (and possibly other platforms), sometimes our UDP socket would get stuck in a state where it was bound to an invalid interface (or no interface) after a network reconfiguration. We can detect this by actually checking the error codes from sending our STUN packets. If we completely fail to send any STUN packets, we know something is very broken. So on the next STUN attempt, let's rebind the UDP socket to try to correct any problems. This fixes a problem where iOS would sometimes get stuck using DERP instead of direct connections until the backend was restarted. Fixes #2994 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Brad Fitzpatrick	2501a694cb	net/interfaces: add RegisterInterfaceGetter for Android Updates #2293 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	22a1a5d7cf	ipn/ipnlocal: for IPv6-only nodes, publish IPv6 MagicDNS records of peers See https://github.com/tailscale/tailscale/issues/2970#issuecomment-931885268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	09c2462ae5	net/tlsdial: add forgotten test file for go mod tidy I forgot to include this file in the earlier `7cf8ec8108` commit. This exists purely to keep "go mod tidy" happy. Updates #1609 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7cf8ec8108	net/tlsdial: bake in LetsEncrypt's ISRG Root X1 root We still try the host's x509 roots first, but if that fails (like if the host is old), we fall back to using LetsEncrypt's root and retrying with that. tlsdial was used in the three main places: logs, control, DERP. But it was missing in dnsfallback. So added it there too, so we can run fine now on a machine with no DNS config and no root CAs configured. Also, move SSLKEYLOGFILE support out of DERP. tlsdial is the logical place for that support. Fixes #1609 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Filippo Valsorda	d7ce2be5f4	net/dns/resolver: add unsecured Quad9 resolvers DNSSEC is an availability issue, as recently demonstrated by the Slack issue, with limited security advantage. DoH on the other hand is a critical security upgrade. This change adds DoH support for the non-DNSSEC endpoints of Quad9. https://www.quad9.net/service/service-addresses-and-features#unsec Signed-off-by: Filippo Valsorda <hi@filippo.io>	3 years ago
Brad Fitzpatrick	080381c79f	net/tstun: block looped disco traffic, take 17 It was in the wrong filter direction before, per CPU profiles we now have. Updates #1526 (maybe fixes? time will tell) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	173bbaa1a1	all: disable TCP keep-alives on iOS/Android Updates #2442 Updates tailscale/corp#2750 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	4cf63b8df0	net/dnsfallback: update static map for new derp11. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Denton Gentry	93c2882a2f	wgengine: flush DNS cache after major link change. Windows has a public dns.Flush used in router_windows.go. However that won't work for platforms like Linux, where we need a different flush mechanism for resolved versus other implementations. We're instead adding a FlushCaches method to the dns Manager, which can be made to work on all platforms as needed. Fixes https://github.com/tailscale/tailscale/issues/2132 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Maxim Merzhanov	d43fcd2f02	net/dns: fix error wrapping for SetLinkDefaultRoute in resolved Signed-off-by: Maxim Merzhanov <maksimmerzh@gmail.com>	3 years ago
Brad Fitzpatrick	dabeda21e0	net/tstun: block looped disco traffic Updates #1526 (maybe fixes? time will tell) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4f648e6fcc	cmd/tailscaled: disable netns earlier in userspace-networking mode The earlier `382b349c54` was too late, as engine creation itself needed to listen on things. Fixes #2827 Updates #2822 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	382b349c54	cmd/tailscaled: disable netns in userspace-networking mode Updates #2827 Updates #2822 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	12dc7c2df8	net/interfaces: remove stray C header file I meant to delete it as part of `974be2ec5c` when the darwin code was ported from C to Go. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	640134421e	all: update tests to use tstest.MemLogger And give MemLogger a mutex, as one caller had, which does match the logf contract better. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	48bdffd395	net/portmapper: remove GITHUB_ACTIONS check It's now redundant. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7fe6ecf165	ipn/ipnlocal: add MagicDNS records for IPv6-only nodes Updates #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	9502b515f1	net/dns: replace resolver IPs with type for DoH We currently plumb full URLs for DNS resolvers from the control server down to the client. But when we pass the values into the net/dns package, we throw away any URL that isn't a bare IP. This commit continues the plumbing, and gets the URL all the way to the built in forwarder. (It stops before plumbing URLs into the OS configurations that can handle them.) For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	5a58fd8933	net/dnsfallback: go generate, pick up new DERPs Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	69c897a763	net/dnsfallback: run go generate to pick up new derp9s. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	bb6fdfb243	net/dns: fix the build on freebsd (missing default case in switch) Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	b3b1c06b3a	net/dns: only restart systemd-resolved if we changed /etc/resolv.conf. Reported on IRC: in an edge case, you can end up with a directManager DNS manager and --accept-dns=false, in which case we should do nothing, but actually end up restarting resolved whenever the netmap changes, even though the user told us to not manage DNS. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	10547d989d	net/dns: exhaustively test DNS selection paths for linux. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	c071bcda33	net/dns: relax systemd-resolved detection. Reported on IRC: a resolv.conf that contained two entries for "nameserver 127.0.0.53", which defeated our "is resolved actually in charge" check. Relax that check to allow any number of nameservers, as long as they're all 127.0.0.53. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	39748e9562	net/dns/resolver: authoritatively return NXDOMAIN for reverse zones we own. Fixes #2774 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Emmanuel T Odeke	0daa32943e	all: add (*testing.B).ReportAllocs() to every benchmark This ensures that we can properly track and catch allocation slippages that could otherwise have been missed. Fixes #2748	3 years ago
Brad Fitzpatrick	065c4ffc2c	net/dns: add start of Linux newOSConfigurator tests Only one test case so far. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	09a47ea3f1	net/dns: prep for writing manager_linux tests; pull some stuff out Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3606e68721	net/interfaces: fix default route lookup on Windows It wasn't using the right metric. Apparently you're supposed to sum the route metric and interface metric. Whoops. While here, optimize a few little things too, not that this code should be too hot. Fixes #2707 (at least; probably dups but I'm failing to find) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	b49d9bc74d	net/portmapper: fix "running a test" condition. Fixes #2686. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
slowy07	ac0353e982	fix: typo spelling grammar Signed-off-by: slowy07 <slowy.arfy@gmail.com>	3 years ago
David Crawshaw	0ac2130590	net/dns: resolveConfExists reading the wrong error Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	36ffd509de	net/dns: avoid Linux PolicyKit GUI dialog during tests Fixes #2672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	1f006025c2	net/tstun: fix build on arm Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	cd426eaf4c	net/portmapper: fix t.Log-after-test-done race in tests Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Matt Layher	8ab44b339e	net/tstun: use unix.Ifreq type for Linux TAP interface configuration Signed-off-by: Matt Layher <mdlayher@gmail.com>	3 years ago
Josh Bleecher Snyder	a24cee0d67	all: simplify ts_macext build tags Now that we have the easier-to-parse go:build build tags, it is straightforward to simplify them. Yay. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	833200da6f	net/tstun: don't exec uname -r on Linux in TUN failure diagnostics Fixes https://twitter.com/zekjur/status/1425557520513486848 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e804ab29fd	net/tstun: move TUN failure diagnostics to OS-specific files Mostly so the Linux one can use Linux-specific stuff in package syscall and not use os/exec for uname for portability. But also it helps deps a tiny bit on iOS. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	b9bd7dbc5d	net/portmapper: log upnp information This logs some basic statistics for UPnP, so that tailscale can better understand what routers are being used and how to connect to them. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	26b6fe7f02	net/portmapper: add PCP integration test This adds a PCP test to the IGD test server, by hardcoding in a few observed packets from Denton's box. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	bdb93c5942	net/portmapper: actually test something in TestProbeIntegration And use dynamic port numbers in tests, as Linux on GitHub Actions and Windows in general have things running on these ports. Co-Author: Julian Knodt <julianknodt@gmail.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	8bdf878832	net/dns/resolver: use forwarded dns txid directly Previously, we hashed the question and combined it with the original txid which was useful when concurrent queries were multiplexed on a single local source port. We encountered some situations where the DNS server canonicalizes the question in the response (uppercase converted to lowercase in this case), which resulted in responses that we couldn't match to the original request due to hash mismatches. This includes a new test to cover that situation. Fixes #2597 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Brad Fitzpatrick	e6d4ab2dd6	net/portmapper: add start of self-contained portmapper integration tests Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	98d36ee18d	net/portmapper: add hook for use with prev ip PCP handles external IPs by allowing the client to specify them in the packet, which is more explicit than requiring 2 packets from PMP, so allow for future changes to add it in easily. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	85304d7392	net/portmapper: check disable flags Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	777b711d96	net/portmapper: add pcp portmapping This adds PCP portmapping, hooking into the existing PMP portmapping. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	5c98b1b8d0	net/portmapper: move pcp code to separate file This moves all the PCP code to a separate file in preparation for portmapping with PCP. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Josh Bleecher Snyder	a5da4ed981	all: gofmt with Go 1.17 This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	a729070252	net/tstun: add start of Linux TAP support, with DHCP+ARP server Still very much a prototype (hard-coded IPs, etc) but should be non-invasive enough to submit at this point and iterate from here. Updates #2589 Co-Author: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fdc081c291	net/portmapper: fix UPnP probing, work against all ports Prior to Tailscale 1.12 it detected UPnP on any port. Starting with Tailscale 1.11.x, it stopped detecting UPnP on all ports. Then start plumbing its discovered Location header port number to the code that was assuming port 5000. Fixes #2109 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	260b85458c	net/dns: correct log message. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	54e33b511a	net/dns/resolver: add test that I forgot to git add earlier This was meant to be part of `53a2f63658` earlier but I guess I failed at git. Updates #2436 Updates tailscale/corp#2250 Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	be921d1a95	net/dns/resolver: fix skipped DoH test that bitrot Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5a7ff2b231	net/dnsfallback: re-run go generate	3 years ago
Matt Layher	effee49e45	net/interfaces: explicitly check netaddr.IP.Is6 in isUsableV6 Signed-off-by: Matt Layher <mdlayher@gmail.com>	3 years ago

... 2 3 4 5 6 ...

714 Commits (243490f9322d128562d241ab32d2dcf661374314)