tailscale

Commit Graph

Author	SHA1	Message	Date
David Anderson	63a9adeb6c	portlist: collect IPv6 listening sockets on linux. This is important because some of those v6 sockets are actually dual-stacked sockets, so this is our only chance of discovering some services. Fixes #1443. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	82edf94df7	ipn/ipnlocal: make IPv6 OS routes be a single /48 for our ULA space And if we have over 10,000 CGNAT routes, just route the entire CGNAT range. (for the hello test server) Fixes #1450 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a6d098c750	wgengine/magicsock: log when DERP connection succeeds Updates #1310	4 years ago
Brad Fitzpatrick	829eb8363a	net/interfaces: sort returned addresses from LocalAddresses Also change the type to netaddr.IP while here, because it made sorting easier. Updates tailscale/corp#1397 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	ad6edf5ecd	portlist: report a better process name for .Net on linux. Fixes #1440. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	ffa70a617d	wgengine{,/monitor}: restore Engine.LinkChange, add Mon.InjectEvent The Engine.LinkChange method was recently removed in `e3df29d488` while misremembering how Android's link state mechanism worked. Rather than do some last minute rearchitecting of link state on Android before Tailscale 1.6, restore the old Engine.LinkChange hook for now so the Android client doesn't need any changes. But change how it's implemented to instead inject an event into the link monitor. Fixes #1427 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	10f48087f4	net/tshttpproxy: call winhttp calls from a fixed OS thread We often see things in logs like: 2021-03-02 17:52:45.2456258 +0800 +0800: winhttp: Open: The parameter is incorrect. 2021-03-02 17:52:45.2506261 +0800 +0800: tshttpproxy: winhttp: GetProxyForURL("https://log.tailscale.io/c/tailnode.log.tailscale.io/5037bb42f4bc330e2d6143e191a7ff7e837c6be538139231de69a439536e0d68"): ERROR_INVALID_PARAMETER [unexpected] I have a hunch that WinHTTP has thread-local state. If so, this would fix it. If not, this is pretty harmless. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Denton Gentry	061422affc	freebsd: ignore IPv6 for now FreeBSD tun devices don't work with the way we implement IPv6 https://github.com/tailscale/tailscale/issues/1307 At least for now, remove any IPv6 addresses from the netmap. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Denton Gentry	524fb2c190	safesocket: add FreeBSD to PlatformUsesPeerCreds FreeBSD is supported by peercred now. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Denton Gentry	6756f20632	go.mod: update peercred Adds FreeBSD support. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
David Anderson	2e347d1e10	tailcfg: tweak documentation for map version 11 version: bump date.	4 years ago
David Anderson	ea49b1e811	tailcfg: bump map request version for v6 + default routes. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1cb0ffc3ff	wgengine/router: make windows gracefully handle disabled IPv4 or IPv6. This is necessary because either protocol can be disabled globally by a Windows registry policy, at which point trying to touch that address family results in "Element not found" errors. This change skips programming address families that Windows tell us are unavailable. Fixes #1396. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	92cdb30b26	tailcfg, control/controlclient: add goroutine dump debug feature Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f858b0d25f	wgengine/netstack: remove some v2 logging by default Even with [v2], it still logtails and takes time to format. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	d01c60dad5	wgengine/netstack: use system dialer to contact servers on localhost Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	7461dded88	wgengine/monitor: on unsupported platforms, use a polling implementation Not great, but lets people working on new ports get going more quickly without having to do everything up front. As the link monitor is getting used more, I felt bad having a useless implementation. Updates #815 Updates #1427 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	8a55d463c8	net/interfaces: merge darwin files for DefaultRouteInterface in sandbox DefaultRouteInterface was previously guarded by build tags such that it was only accessible to tailscaled-on-macos, but there was no reason for that. It runs fine in the sandbox and gives better default info, so merge its file into interfaces_darwin.go. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	8d77dfdacb	wgengine/router: add a dummy IPv6 address if needed for default routing. Fixes #1339 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	b4cf837d8a	logtail: use link monitor to determine when to retry after upload failure Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c3e5903b91	wgengine/magicsock: remove leftover portmapper debug logging It's already logged at the right time in logEndpointChange. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	15b6969a95	ipn/ipnserver: grant client r/w access if peer uid matches tailscaled Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	63ed4dd6c9	net/portmapper: fix typo Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	95c03d1ead	wgengine/netstack: forward incoming connections to localhost Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	471f0c470a	wgengine/monitor: skip some macOS route updates, fix debounce regression Debound was broken way back in `5c1e443d34` and we never noticed. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	be779b3587	safesocket, ipn/ipnserver: unify peercred info, fix bug on FreeBSD etc FreeBSD wasn't able to run "tailscale up" since the recent peercred refactoring. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f304a45481	wgengine/monitor: add skipped failing test for Darwin route message bug Updates #1416 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	0d0ec7853c	cmd/tailscaled: don't require root on darwin with --tun=userspace-networking Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	31721759f3	wgengine/monitor: don't return nil, nil in darwin monitor We used to allow that, but now it just crashes. Separately I need to figure out why it got into this path at all, which is #1416. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	b89c757817	wgengine/tsdns: explicitly reject .onion lookups Tor has a location-hidden service feature that enables users to host services from inside the Tor network. Each of these gets a unique DNS name that ends with .onion. As it stands now, if a misbehaving application somehow manages to make a .onion DNS request to our DNS server, we will forward that to the DNS server, which could leak that to malicious third parties. See the recent bug Brave had with this[1] for more context. RFC 7686 suggests that name resolution APIs and libraries MUST respond with NXDOMAIN unless they can actually handle Tor lookups. We can't handle .onion lookups, so we reject them. [1]: https://twitter.com/albinowax/status/1362737949872431108 Fixes tailscale/corp#1351 Signed-off-by: Christine Dodrill <xe@tailscale.com>	4 years ago
Brad Fitzpatrick	c0cdca6d06	cmd/tailscaled, logtail: share link monitor from wgengine to logtail Part of overall effort to clean up, unify, use link monitoring more, and make Tailscale quieter when all networks are down. This is especially bad on macOS where we can get killed for not being polite it seems. (But we should be polite in any case) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	24fa616e73	wgengine/monitor: make Darwin monitor shut down cleanly, add test Don't use os.NewFile or (*os.File).Close on the AF_ROUTE socket. It apparently does weird things to the fd and at least doesn't seem to close it. Just use the unix package. The test doesn't actually fail reliably before the fix, though. It was an attempt. But this fixes the integration tests. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	625c413508	ipn/ipnlocal: fix another regression from link monitoring refactor Prior to `e3df29d488`, the Engine.SetLinkChangeCallback fired immediately, even if there was no change. The ipnlocal code apparently depended on that, and it broke integration tests (which live in another repo). So mimic the old behavior and call the ipnlocal callback immediately at init. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	487c520109	wgengine: fix bug from earlier commit Commit `e3df29d488` introduced this bug where the interfaces-were-changed-or-not bit got lost. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	793cb131f0	wgengine/router: toggle killswitch when using default routes on windows. Fixes #1398. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	ac3de93d5c	tempfork/wireguard-windows/firewall: add. This is a fork of wireguard-windows's firewall package, with the firewall rules adjusted to better line up with tailscale's needs. The package was taken from commit 3cc76ed5f222ec82748ef3bd8c41d4b059e28cdb in our fork of wireguard-go. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	30a37622b4	cmd/hello: break out local HTTP client into client/tailscale Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	f647e3daaf	ipn/ipnlocal: transform default routes into "all but LAN" routes. Fixes #1177. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	b46e337cdc	cmd/hello: use go:embed for the template Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	9df4185c94	control/controlclient, net/{dnscache,dnsfallback}: add DNS fallback mechanism Updates #1405 Updates #1403 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	03c344333e	cmd/tailscale: remove Windows console fixing Not needed, as we don't build this as a GUI app ever. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e3df29d488	wgengine{,/monitor}: move interface state fetching/comparing to monitor Gets it out of wgengine so the Engine isn't responsible for being a callback registration hub for it. This also removes the Engine.LinkChange method, as it's no longer necessary. The monitor tells us about changes; it doesn't seem to need any help. (Currently it was only used by Swift, but as of `14dc790137` we just do the same from Go) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a038e8690c	wgengine/netstack: fix 32-bit build broken from prior commit Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	38dc6fe758	cmd/tailscaled, wgengine: remove --fake, replace with netstack And add a --socks5-server flag. And fix a race in SOCKS5 replies where the response header was written concurrently with the copy from the backend. Co-authored with Naman Sood. Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d74cddcc56	wgengine/netstack: add Magic DNS + DNS resolution to SOCKS5 dialing Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	34188d93d4	wgengine/monitor: start moving interface state accessor into monitor Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	14dc790137	wgengine/monitor: make the darwin link monitor work in the sandbox too Previously tailscaled on macOS was running "/sbin/route monitor" as a child process, but child processes aren't allowed in the Network Extension / App Store sandbox. Instead, just do what "/sbin/route monitor" itself does: unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, 0) and read that. We also parse it now, but don't do anything with the parsed results yet. We will over time, as we have with Linux netlink messages over time. Currently any message is considered a signal to poll and see what changed. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a55a03d5ff	wgengine: let LinkMonitor be passed in to NewUserspaceEngine Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ee6475a44d	wgengine: unify NewUserspaceEngine, NewUserspaceEngineAdvanced Also rename EngineConfig to Config to avoid wgengine.EngineConfig stutter. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	dda03a911e	wgengine/monitor: change API to permit multiple independent callbakcks Currently it assumes exactly 1 registered callback. This changes it to support 0, 1, or more than 1. This is a step towards plumbing wgengine/monitor into more places (and moving some of wgengine's interface state fetching into monitor in a later step) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago

1 2 3 4 5 ...

1965 Commits (28af46fb3bf8e00afe5d3206b50f76cb2442584f) All Branches Search

1965 Commits (28af46fb3bf8e00afe5d3206b50f76cb2442584f)

All Branches