tailscale

Commit Graph

Author	SHA1	Message	Date
David Anderson	c2cc3acbaf	net/packet: remove NewIP, offer only a netaddr constructor. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	55b1221db2	net/packet: support full IPv6 decoding. The packet filter still rejects all IPv6, but decodes enough from v6 packets to do something smarter in a followup. name time/op Decode/tcp4-8 28.8ns ± 2% Decode/tcp6-8 20.6ns ± 1% Decode/udp4-8 28.2ns ± 1% Decode/udp6-8 20.0ns ± 6% Decode/icmp4-8 21.7ns ± 2% Decode/icmp6-8 14.1ns ± 2% Decode/unknown-8 9.43ns ± 2% Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	89894c6930	net/packet: add IPv6 source and destination IPs to Parsed. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	450cfedeba	wgengine/magicsock: quiet an IPv6 warning in tests In tests, we force binding to localhost to avoid OS firewall warning dialogs. But for IPv6, we were trying (and failing) to bind to 127.0.0.1. You'd think we'd just say "localhost", but that's apparently ill defined. See https://tools.ietf.org/html/draft-ietf-dnsop-let-localhost-be-localhost and golang/go#22826. (It's bitten me in the past, but I can't remember specific bugs.) So use "::1" explicitly for "udp6", which makes the test quieter.	4 years ago
David Anderson	093431f5dd	net/packet: s/ParsedPacket/Parsed/ to avoid package stuttering. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c48253e63b	wgengine/filter: add a method to run the packet filter without a packet. The goal is to move some of the shenanigans we have elsewhere into the filter package, so that all the weird things to do with poking at the filter is in a single place, behind clean APIs. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7a54910990	wgengine/filter: remove helper vars, mark NewAllowAll test-only. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	76d99cf01a	wgengine/filter: remove the Matches type. It only served to obscure the underlying slice type without adding much value. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b950bd60bf	wgengine/filter: add and clean up documentation. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	a8589636a8	wgengine/filter: remove unused Clone methods. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b3634f020d	wgengine/filter: use netaddr types in public API. We still use the packet.* alloc-free types in the data path, but the compilation from netaddr to packet happens within the filter package. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	427bf2134f	net/packet: rename from wgengine/packet. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	19df6a2ee2	wgengine/packet: rename types to reflect their v4-only-ness, document. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	ebd96bf4a9	wgengine/router/dns: use OpenKeyWait to set DNS configuration. Fixes tailscale/corp#839. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	119101962c	wgengine/router: don't double-prefix dns log messages [Windows]	4 years ago
Brad Fitzpatrick	28f6552646	wgengine/router/dns: run ipconfig /registerdns async, log timing Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	01ee638cca	Change some os.IsNotExist to errors.Is(err, os.ErrNotExist) for non-os errors. os.IsNotExist doesn't unwrap errors. errors.Is does. The ioutil.ReadFile ones happened to be fine but I changed them so we're consistent with the rule: if the error comes from os, you can use os.IsNotExist, but from any other package, use errors.Is. (errors.Is always would also work, but not worth updating all the code) The motivation here was that we were logging about failure to migrate legacy relay node prefs file on startup, even though the code tried to avoid that. See golang/go#41122	4 years ago
David Anderson	68ddf134d7	wgengine/router/dns: issue ipconfig /registerdns when applying DNS settings. Amazingly, there doesn't seem to be a documented way of updating network configuration programmatically in a way that Windows takes notice of. The naturopathic remedy for this is to invoke ipconfig /registerdns, which does a variety of harmless things and also invokes the private API that tells windows to notice new adapter settings. This makes our DNS config changes stick within a few seconds of us setting them. If we're invoking a shell command anyway, why futz with the registry at all? Because netsh has no command for changing the DNS suffix list, and its commands for setting resolvers requires parsing its output and keeping track of which server is in what index. Amazingly, twiddling the registry directly is the less painful option. Fixes #853. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	508f5c3ae0	wgengine/router: fix bug where getInterfaceRoutes always returned an empty list Regression from `f2ce64f0c6 (r43710860)` Fixes #870	4 years ago
Brad Fitzpatrick	38bde61b3d	wgengine/router: make Windows firewall configuration async Updating the Windows firewall is usually reasonably fast, but sometimes blocks for 20 seconds, 4 minutes, etc. Not sure why. Until we understand that's happening, configure it in the background without blocking the normal control flow. Updates #785 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	fd2a30cd32	wgengine/magicsock: make test pass on Windows and without firewall dialog box Updates #50	4 years ago
Brad Fitzpatrick	ac866054c7	wgengine/magicsock: add a backoff on DERP reconnects Fixes #808	4 years ago
Brad Fitzpatrick	86c271caba	types/logger: move RusagePrefixLog to logger package, disable by default The RusagePrefixLog is rarely useful, hasn't been useful in a long time, is rarely the measurement we need, and is pretty spammy (and syscall-heavy). Disable it by default. We can enable it when we're debugging memory.	4 years ago
David Anderson	ff0cf6340a	wgengine/router: fix configuration of loopback netfilter rules for v6. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	105a820622	wgengine/magicsock: skip an endpoint update at start-up At startup the client doesn't yet have the DERP map so can't do STUN queries against DERP servers, so it only knows it local interface addresses, not its STUN-mapped addresses. We were reporting the interface-local addresses to control, getting the DERP map, and then immediately reporting the full set of updates. That was an extra HTTP request to control, but worse: it was an extra broadcast from control out to all the peers in the network. Now, skip the initial update if there are no stun results and we don't have a DERP map. More work remains optimizing start-up requests/map updates, but this is a start. Updates tailscale/corp#557	4 years ago
Brad Fitzpatrick	746f03669c	wgengine: fix lazy wireguard config bug when disco keys change There was a bug with the lazy wireguard config code where, if the minimum set of peers to tell wireguard didn't change, we skipped calling userspaceEngine.updateActivityMapsLocked which updated the various data structures that matched incoming traffic to later reconfigure the minimum config. That meant if an idle peer restarted and changed discovery keys, we skipped updating our maps of disco keys/IPs that would caused us to lazily inflate the config for that peer later if/when it did send traffic.	4 years ago
Brad Fitzpatrick	2076a50862	wgengine/magicsock: finish a comment sentence that ended prematurely	4 years ago
Alex Brainman	f2ce64f0c6	wgengine/router: unfork winipcfg-go package, use upstream Use golang.zx2c4.com/wireguard/windows/tunnel/winipcfg instead of github.com/tailscale/winipcfg-go package. Updates #760 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	4 years ago
Brad Fitzpatrick	22c462bd91	wgengine/monitor: fix copy/paste-o to actually monitor route changes Due to a copy/paste-o, we were monitoring address changes twice, and not monitoring route changes at all. Verified with 'tailscale debug --monitor' that this actually works now (while running 'route add 10.3.0.0 mask 255.255.0.0 10.0.0.1' and 'route delete (same)' back and forth in cmd.exe) In practice route changes are accompanied by address changes and this doesn't fix any known issues. I just noticed this while reading this code again. But at least the code does what it was trying to do now.	4 years ago
Avery Pennarun	0e5f2b90a5	echoRespondToAll: filter.Accept rather than filter.Drop on a match. This function is only called in fake mode, which won't do anything more with the packet after we respond to it anyway, so dropping it in the prefilter is not necessary. And it's kinda semantically wrong: we did not reject it, so telling the upper layer that it was rejected produces an ugly error message. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	5041800ac6	wgengine/tstun/faketun: it's a null tunnel, not a loopback. At some point faketun got implemented as a loopback (put a packet in from wireguard, the same packet goes back to wireguard) which is not useful. It's supposed to be an interface that just sinks all packets, and then wgengine adds only and ICMP Echo responder as a layer on top. This caused extremely odd bugs on darwin, where the special case that reinjects packets from local->local was filling the loopback channel and creating an infinite loop (which became jammed since the reader and writer were in the same goroutine). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Brad Fitzpatrick	3e4c46259d	wgengine/magicsock: don't do netchecks either when network is down A continuation of `6ee219a25d` Updates #640	4 years ago
Brad Fitzpatrick	6ee219a25d	ipn, wgengine, magicsock, tsdns: be quieter and less aggressive when offline If no interfaces are up, calm down and stop spamming so much. It was noticed as especially bad on Windows, but probably was bad everywhere. I just have the best network conditions testing on a Windows VM. Updates #604	4 years ago
Brad Fitzpatrick	587bdc4280	ipn, wgengine: disable subnet routes if network has PAC configuration Not configurable yet. Updates tailscale/corp#653 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	c493e5804f	wgengine/router: make v6-ness configurable in test, for consistent results. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	c86761cfd1	Remove tuntap references. We only use TUN.	4 years ago
Brad Fitzpatrick	01098f41d0	wgengine/tstun: fix typo in comment	4 years ago
Brad Fitzpatrick	73cc2d8f89	wgengine/filter: also silently drop link-local unicast traffic Updates #629	4 years ago
Brad Fitzpatrick	5f807c389e	wgengine/filter: drop multicast packets out, don't log about them Eventually we'll probably support multicast. For now it's just log spam. Fixes #629	4 years ago
Brad Fitzpatrick	bbb56f2303	wgengine/router: fix tests on Debian Buster as regular user on machine with IPv6	4 years ago
David Anderson	fddbcb0c7b	wgengine/router: support various degrees of broken IPv6. Gracefully skips touching the v6 NAT table on systems that don't have it, and doesn't configure IPv6 at all if IPv6 is globally disabled. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0d80904fc2	wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	f0ef561049	wgengine/tsdns: use netns to obtain a socket Fixes #789 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	6e8328cba5	wgengine/tsdns: replace connections when net link changes (macOS) When the network link changes, existing UDP sockets fail immediately and permanently on macOS. The forwarder set up a single UDP conn and never changed it. As a result, any time there was a network link change, all forwarded DNS queries failed. To fix this, create a new connection when send requests fail because of network unreachability. This change is darwin-only, although extended it to other platforms should be straightforward. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1fd10061fd	wgengine/tsdns: delegate bonjour service rdns requests While we're here, parseQuery into a plain function. This is helpful for fuzzing. (Which I did a bit of. Didn't find anything.) And clean up a few minor things. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	2d0ed99672	wgengine, wgengine/router: add a bunch of (temporary?) engine creation logging Trying to debug what's slow on a user's machine. Updates #785	4 years ago
Brad Fitzpatrick	7c11f71ac5	wgengine/router: ignore errors deleting 169.254.255.255/32 route on Windows Updates #785	4 years ago
David Anderson	b7e0ff598a	wgengine: don't close tundev in NewUserspaceEngine. newUserspaceEngineAdvanced closes the tun device on error already. Fixes #783. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	5d8b88be88	control/controlclient, version/distro, wgengine: recognize OpenWrt And help out with missing packages. Thanks to @willangley for tips. Updates #724	4 years ago
Brad Fitzpatrick	3528d28ed1	wgengine/router: move Tailscale's winipcfg additions into wgengine/router Part of unforking our winipcfg-go and using upstream (#760), move our additions into our repo. (We might upstream them later if upstream has interest) Originally these were: @apenwarr: "Add ifc.SyncAddresses() and SyncRoutes()." `609dcf2df5` @bradfitz: "winipcfg: make Interface.AddRoutes do as much as possible, return combined error" `e9f93d53f3` @bradfitz: "prevent unnecessary Interface.SyncAddresses work; normalize IPNets in deltaNets" `decb9ee8e1`	4 years ago

1 2 3 4 5 ...

475 Commits (258b680bc561a2ec4e29b9afbf511b0d0d65a902)