tailscale

Commit Graph

Author	SHA1	Message	Date
David Anderson	d79a2f3809	wgengine/filter: only log packets to/from non-default routes. Fixes tailscale/corp#1429. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	b83c273737	wgengine/filter: use IPSet for localNets instead of prefixes. Part of #1177, preparing for doing fancier set operations on the allowed local nets. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	d98ef5699d	wgengine/filter: remove redundant code no generated code change.	3 years ago
David Anderson	9f7cbf6cf1	wgengine/filter: add a Clone method. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	e7bf144c3f	ipn, wgengine/filter: fix Shields Up recent regression and old bug Fixes #1192 (regression) Fixes #1193 (old bug)	3 years ago
Brad Fitzpatrick	b560386c1a	net/packet, wgengine, tstun: add inter-node TSMP protocol for connect errors This adds a new IP Protocol type, TSMP on protocol number 99 for sending inter-tailscale messages over WireGuard, currently just for why a peer rejects TCP SYNs (ACL rejection, shields up, and in the future: nothing listening, something listening on that port but wrong interface, etc) Updates #1094 Updates tailscale/corp#1185 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5eeaea9ef9	net/packet: add TCPFlag type and some more constants Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4d15e954bd	net/flowtrack: add new package to specialize groupcache/lru key type Reduces allocs. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	cb96b14bf4	net/packet: remove the custom IP4/IP6 types in favor of netaddr.IP. Upstream netaddr has a change that makes it alloc-free, so it's safe to use in hot codepaths. This gets rid of one of the many IP types in our codebase. Performance is currently worse across the board. This is likely due in part to netaddr.IP being a larger value type (4b -> 24b for IPv4, 16b -> 24b for IPv6), and in other part due to missing low-hanging fruit optimizations in netaddr. However, the regression is less bad than it looks at first glance, because we'd micro-optimized packet.IP* in the past few weeks. This change drops us back to roughly where we were at the 1.2 release, but with the benefit of a significant code and architectural simplification. name old time/op new time/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 12.2ns ± 5% 29.7ns ± 2% +142.32% (p=0.008 n=5+5) Decode/tcp6-8 12.6ns ± 3% 65.1ns ± 2% +418.47% (p=0.008 n=5+5) Decode/udp4-8 11.8ns ± 3% 30.5ns ± 2% +157.94% (p=0.008 n=5+5) Decode/udp6-8 27.1ns ± 1% 65.7ns ± 2% +142.36% (p=0.016 n=4+5) Decode/icmp4-8 24.6ns ± 2% 30.5ns ± 2% +23.65% (p=0.016 n=4+5) Decode/icmp6-8 22.9ns ±51% 65.5ns ± 2% +186.19% (p=0.008 n=5+5) Decode/igmp-8 18.1ns ±44% 30.2ns ± 1% +66.89% (p=0.008 n=5+5) Decode/unknown-8 20.8ns ± 1% 10.6ns ± 9% -49.11% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 30.5ns ± 1% 77.9ns ± 3% +155.01% (p=0.008 n=5+5) Filter/tcp4_syn_in-8 43.7ns ± 3% 123.0ns ± 3% +181.72% (p=0.008 n=5+5) Filter/tcp4_syn_out-8 24.5ns ± 2% 45.7ns ± 6% +86.22% (p=0.008 n=5+5) Filter/udp4_in-8 64.8ns ± 1% 210.0ns ± 2% +223.87% (p=0.008 n=5+5) Filter/udp4_out-8 119ns ± 0% 278ns ± 0% +133.78% (p=0.016 n=4+5) Filter/icmp6-8 40.3ns ± 2% 204.4ns ± 4% +407.70% (p=0.008 n=5+5) Filter/tcp6_syn_in-8 35.3ns ± 3% 199.2ns ± 2% +464.95% (p=0.008 n=5+5) Filter/tcp6_syn_out-8 32.8ns ± 2% 81.0ns ± 2% +147.10% (p=0.008 n=5+5) Filter/udp6_in-8 106ns ± 2% 290ns ± 2% +174.48% (p=0.008 n=5+5) Filter/udp6_out-8 184ns ± 2% 314ns ± 3% +70.43% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/tstun goos:linux goarch:amd64 Write-8 9.02ns ± 3% 8.92ns ± 1% ~ (p=0.421 n=5+5) name old alloc/op new alloc/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00B 0.00B ~ (all equal) Decode/tcp6-8 0.00B 0.00B ~ (all equal) Decode/udp4-8 0.00B 0.00B ~ (all equal) Decode/udp6-8 0.00B 0.00B ~ (all equal) Decode/icmp4-8 0.00B 0.00B ~ (all equal) Decode/icmp6-8 0.00B 0.00B ~ (all equal) Decode/igmp-8 0.00B 0.00B ~ (all equal) Decode/unknown-8 0.00B 0.00B ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp4_in-8 0.00B 0.00B ~ (all equal) Filter/udp4_out-8 16.0B ± 0% 64.0B ± 0% +300.00% (p=0.008 n=5+5) Filter/icmp6-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp6_in-8 0.00B 0.00B ~ (all equal) Filter/udp6_out-8 48.0B ± 0% 64.0B ± 0% +33.33% (p=0.008 n=5+5) name old allocs/op new allocs/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00 0.00 ~ (all equal) Decode/tcp6-8 0.00 0.00 ~ (all equal) Decode/udp4-8 0.00 0.00 ~ (all equal) Decode/udp6-8 0.00 0.00 ~ (all equal) Decode/icmp4-8 0.00 0.00 ~ (all equal) Decode/icmp6-8 0.00 0.00 ~ (all equal) Decode/igmp-8 0.00 0.00 ~ (all equal) Decode/unknown-8 0.00 0.00 ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp4_in-8 0.00 0.00 ~ (all equal) Filter/udp4_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Filter/icmp6-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp6_in-8 0.00 0.00 ~ (all equal) Filter/udp6_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	fa412c8760	wgengine/filter, wgengine/magicsock: use new IP.BitLen to simplify some code	4 years ago
Brad Fitzpatrick	afcf134812	wgengine/filter, tailcfg: support CIDRs+ranges in PacketFilter (mapver 7) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	3c508a58cc	wgengine/filter: don't filter GCP DNS. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	2eb474dd8d	wgengine/filter: add test cases for len(dsts) > 1. While the code was correct, I broke it during a refactoring and tests didn't detect it. This fixes that glitch. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	ce45f4f3ff	wgengine/filter: inline ip6InList into match. matchIPsOnly gets 5% slower when inlining, despite significantly reduced memory ops and slightly tighter code. Part of #19. Filter/tcp6_syn_in-8 45.5ns ± 1% 42.4ns ± 2% -6.86% (p=0.000 n=10+10) Filter/udp6_in-8 107ns ± 2% 94ns ± 2% -11.50% (p=0.000 n=9+10) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	3fdae12f0c	wgengine/filter: eliminate unnecessary memory loads. Doesn't materially affect benchmarks, but shrinks match6 by 30 instructions and halves memory loads. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	47380ebcfb	wgengine/filter: twiddle bits to optimize Part of #19. name old time/op new time/op delta Filter/icmp4-8 32.2ns ± 3% 32.5ns ± 2% ~ (p=0.524 n=10+8) Filter/icmp6-8 49.7ns ± 6% 43.1ns ± 4% -13.12% (p=0.000 n=9+10) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	5062131aad	wgengine/filter: treat * as both a v4 and v6 wildcard. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	2d604b3791	net/packet: represent IP6 as two uint64s. For the operations we perform on these types (mostly net6.Contains), this encoding is much faster. Part of #19. name old time/op new time/op delta Filter/icmp4-8 27.5ns ± 1% 28.0ns ± 2% +1.89% (p=0.016 n=5+5) Filter/tcp4_syn_in-8 38.8ns ± 2% 38.3ns ± 1% -1.24% (p=0.024 n=5+5) Filter/tcp4_syn_out-8 27.6ns ±12% 24.6ns ± 1% ~ (p=0.063 n=5+5) Filter/udp4_in-8 71.5ns ± 5% 65.9ns ± 1% -7.94% (p=0.008 n=5+5) Filter/udp4_out-8 132ns ±13% 119ns ± 1% -10.29% (p=0.008 n=5+5) Filter/icmp6-8 169ns ±10% 54ns ± 1% -68.35% (p=0.008 n=5+5) Filter/tcp6_syn_in-8 149ns ± 6% 43ns ± 1% -71.11% (p=0.008 n=5+5) Filter/tcp6_syn_out-8 37.7ns ± 4% 24.3ns ± 3% -35.51% (p=0.008 n=5+5) Filter/udp6_in-8 179ns ± 5% 103ns ± 1% -42.75% (p=0.008 n=5+5) Filter/udp6_out-8 156ns ± 3% 191ns ± 1% +22.54% (p=0.008 n=5+5) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	04ff3c91ee	wgengine/filter: add full IPv6 support. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c2cc3acbaf	net/packet: remove NewIP, offer only a netaddr constructor. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	55b1221db2	net/packet: support full IPv6 decoding. The packet filter still rejects all IPv6, but decodes enough from v6 packets to do something smarter in a followup. name time/op Decode/tcp4-8 28.8ns ± 2% Decode/tcp6-8 20.6ns ± 1% Decode/udp4-8 28.2ns ± 1% Decode/udp6-8 20.0ns ± 6% Decode/icmp4-8 21.7ns ± 2% Decode/icmp6-8 14.1ns ± 2% Decode/unknown-8 9.43ns ± 2% Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	89894c6930	net/packet: add IPv6 source and destination IPs to Parsed. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	093431f5dd	net/packet: s/ParsedPacket/Parsed/ to avoid package stuttering. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c48253e63b	wgengine/filter: add a method to run the packet filter without a packet. The goal is to move some of the shenanigans we have elsewhere into the filter package, so that all the weird things to do with poking at the filter is in a single place, behind clean APIs. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7a54910990	wgengine/filter: remove helper vars, mark NewAllowAll test-only. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	76d99cf01a	wgengine/filter: remove the Matches type. It only served to obscure the underlying slice type without adding much value. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b950bd60bf	wgengine/filter: add and clean up documentation. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	a8589636a8	wgengine/filter: remove unused Clone methods. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b3634f020d	wgengine/filter: use netaddr types in public API. We still use the packet.* alloc-free types in the data path, but the compilation from netaddr to packet happens within the filter package. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	427bf2134f	net/packet: rename from wgengine/packet. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	19df6a2ee2	wgengine/packet: rename types to reflect their v4-only-ness, document. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	73cc2d8f89	wgengine/filter: also silently drop link-local unicast traffic Updates #629	4 years ago
Brad Fitzpatrick	5f807c389e	wgengine/filter: drop multicast packets out, don't log about them Eventually we'll probably support multicast. For now it's just log spam. Fixes #629	4 years ago
chungdaniel	4d56d19b46	control/controlclient, wgengine/filter: extract parsePacketFilter to … (#696 ) control/controlclient, wgengine/filter: extract parsePacketFilter to new constructor in wgengine/filter Signed-off-by: chungdaniel <daniel@tailscale.com>	4 years ago
Brad Fitzpatrick	da3b50ad88	wgengine/filter: omit logging for all v6 multicast, remove debug panic :(	4 years ago
Brad Fitzpatrick	7cc8fcb784	wgengine/filter: remove leftover debug knob that staticcheck doesn't like	4 years ago
Brad Fitzpatrick	b4d97d2532	wgengine/filter: fix IPv4 IGMP spam omission, also omit ff02::16 spam And add tests. Fixes #618 Updates #402	4 years ago
Brad Fitzpatrick	d96d26c22a	wgengine/filter: don't spam logs on dropped outgoing IPv6 ICMP or IPv4 IGMP The OS (tries) to send these but we drop them. No need to worry the user with spam that we're dropping it. Fixes #402 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	3e3c24b8f6	wgengine/packet: add IPVersion field, don't use IPProto to note version As prep for IPv6 log spam fixes in a future change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Dmytro Shynkevych	511840b1f6	tsdns: initial implementation of a Tailscale DNS resolver (#396 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	059b1d10bb	wgengine/packet: refactor and expose UDP header marshaling (#408 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	73c40c77b0	filter: prevent escape of QDecode to the heap (#417 ) Performance impact: name old time/op new time/op delta Filter/tcp_in-4 70.7ns ± 1% 30.9ns ± 1% -56.30% (p=0.008 n=5+5) Filter/tcp_out-4 58.6ns ± 0% 19.4ns ± 0% -66.87% (p=0.000 n=5+4) Filter/udp_in-4 96.8ns ± 2% 55.5ns ± 0% -42.64% (p=0.016 n=5+4) Filter/udp_out-4 120ns ± 1% 79ns ± 1% -33.87% (p=0.008 n=5+5) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
David Anderson	e8b3a5e7a1	wgengine/filter: implement a destination IP pre-filter. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Avery Pennarun	08acb502e5	Add tstest.PanicOnLog(), and fix various problems detected by this. If a test calls log.Printf, 'go test' horrifyingly rearranges the output to no longer be in chronological order, which makes debugging virtually impossible. Let's stop that from happening by making log.Printf panic if called from any module, no matter how deep, during tests. This required us to change the default error handler in at least one http.Server, as well as plumbing a bunch of logf functions around, especially in magicsock and wgengine, but also in logtail and backoff. To add insult to injury, 'go test' also rearranges the output when a parent test has multiple sub-tests (all the sub-test's t.Logf is always printed after all the parent tests t.Logf), so we need to screw around with a special Logf that can point at the "current" t (current_t.Logf) in some places. Probably our entire way of using subtests is wrong, since 'go test' would probably like to run them all in parallel if you called t.Parallel(), but it definitely can't because the're all manipulating the shared state created by the parent test. They should probably all be separate toplevel tests instead, with common setup/teardown logic. But that's a job for another time. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Brad Fitzpatrick	8a3e77fc43	ipn, wgengine/filter: remove exported type aliases	4 years ago
Wendi Yu	499c8fcbb3	Replace our ratelimiter with standard rate package (#359 ) * Replace our ratelimiter with standard rate package Signed-off-by: Wendi Yu <wendi.yu@yahoo.ca>	4 years ago
Avery Pennarun	ee3395e63a	wgengine/filter: fix linter warning. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	65fbb9c303	wgengine/filter: support subnet mask rules, not just /32 IPs. This depends on improved support from the control server, to send the new subnet width (Bits) fields. If these are missing, we fall back to assuming their value is /32. Conversely, if the server sends Bits fields to an older client, it will interpret them as /32 addresses. Since the only rules we allow are "accept" rules, this will be narrower or equal to the intended rule, so older clients will simply reject hosts on the wider subnet (fail closed). With this change, the internal filter.Matches format has diverged from the wire format used by controlclient, so move the wire format into tailcfg and convert it to filter.Matches in controlclient. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	85e675940d	wgengine/filter: allow ICMP response packets. Longer term, we should probably update the packet filter to be fully stateful, for both TCP and ICMP. That is, only ICMP packets related to a session we initiated should be allowed back in. But this is reasonably secure for now, since wireguard is already trimming most traffic. The current code would not protect against eg. Ping-of-Death style attacks from VPN nodes. Fixes tailscale/tailscale#290. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Brad Fitzpatrick	2e420ad8b6	wgengine, wgengine/filter: minor doc, style, performance, locking changes Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago

1 2

53 Commits (32562a82a9ae8df72fad8144111a048419ee9000)