436 Commits (32e0ba5e686a3db4b3a5acceb1e09e9de3f9a2ae)

Author	SHA1	Message	Date
Andrew Dunham	42fd964090	control/controlclient: use dnscache.Resolver for Noise client ... This passes the *dnscache.Resolver down from the Direct client into the Noise client and from there into the controlhttp client. This retains the Resolver so that it can share state across calls instead of creating a new resolver. Updates #4845 Updates #6110 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia5d6af1870f3b5b5d7dd5685d775dcf300aec7af	2 years ago
Mihai Parparita	7330aa593e	all: avoid repeated default interface lookups ... On some platforms (notably macOS and iOS) we look up the default interface to bind outgoing connections to. This is both duplicated work and results in logspam when the default interface is not available (i.e. when a phone has no connectivity, we log an error and thus cause more things that we will try to upload and fail). Fixed by passing around a netmon.Monitor to more places, so that we can use its cached interface state. Fixes #7850 Updates #7621 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	4722f7e322	all: move network monitoring from wgengine/monitor to net/netmon ... We're using it in more and more places, and it's not really specific to our use of Wireguard (and does more just link/interface monitoring). Also removes the separate interface we had for it in sockstats -- it's a small enough package (we already pull in all of its dependencies via other paths) that it's not worth the extra complexity. Updates #7621 Updates #7850 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Andrew Dunham	280255acae	various: add golangci-lint, fix issues (#7905) ... This adds an initial and intentionally minimal configuration for golang-ci, fixes the issues reported, and adds a GitHub Action to check new pull requests against this linter configuration. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8f38fbc315836a19a094d0d3e986758b9313f163	2 years ago
Mihai Parparita	9a655a1d58	net/dnsfallback: more explicitly pass through logf function ... Redoes the approach from #5550 and #7539 to explicitly pass in the logf function, instead of having global state that can be overridden. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	edb02b63f8	net/sockstats: pass in logger to sockstats.WithSockStats ... Using log.Printf may end up being printed out to the console, which is not desirable. I noticed this when I was investigating some client logs with `sockstats: trace "NetcheckClient" was overwritten by another`. That turns to be harmless/expected (the netcheck client will fall back to the DERP client in some cases, which does its own sockstats trace). However, the log output could be visible to users if running the `tailscale netcheck` CLI command, which would be needlessly confusing. Updates tailscale/corp#9230 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Kurnia D Win	9526858b1e	control/controlclient: fix accidental backoff reset ... Signed-off-by: Kurnia D Win <kurnia.d.win@gmail.com>	2 years ago
Andrew Dunham	83fa17d26c	various: pass logger.Logf through to more places ... Updates #7537 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id89acab70ea678c8c7ff0f44792d54c7223337c6	2 years ago
Maisem Ali	be027a9899	control/controlclient: improve handling of concurrent lite map requests ... This reverts commit 6eca47b16c and fixes forward. Previously the first ever streaming MapRequest that a client sent would also set ReadOnly to true as it didn't have any endpoints and expected/relied on the map poll to restart as soon as it got endpoints. However with 48f6c1eba4, we would no longer restart MapRequests as frequently as we used to, so control would only ever get the first streaming MapRequest which had ReadOnly=true. Control would treat this as an uninteresting request and would not send it any further netmaps, while the client would happily stay in the map poll forever while litemap updates happened in parallel. This makes it so that we never set `ReadOnly=true` when we are doing a streaming MapRequest. This is no longer necessary either as most endpoint discovery happens over disco anyway. Co-authored-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	ce99474317	all: implement preauth-key support with tailnet lock ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	6eca47b16c	Revert "control/controlclient: improve handling of concurrent lite map requests" ... This reverts commit 48f6c1eba4. It unfortunately breaks mapresponse wakeups. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	48f6c1eba4	control/controlclient: improve handling of concurrent lite map requests ... Prior to this change, if we were in the middle of a lite map update we'd tear down the entire map session and restart it. With this change, we'll cancel an in-flight lite map request up to 10 times and restart before we tear down the streaming map request. We tear down everything after 10 retries to ensure that a steady stream of calls to sendNewMapRequest doesn't fail to make progress by repeatedly canceling and restarting. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Co-authored-by: Maisem Ali <maisem@tailscale.com> Change-Id: I9392bf8cf674e7a58ccd1e476039300a359ef3b1	2 years ago
Mihai Parparita	6ac6ddbb47	sockstats: switch label to enum ... Makes it cheaper/simpler to persist values, and encourages reuse of labels as opposed to generating an arbitrary number. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	1a30b2d73f	all: use tstest.Replace more ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	9cb332f0e2	sockstats: instrument networking code paths ... Uses the hooks added by tailscale/go#45 to instrument the reads and writes on the major code paths that do network I/O in the client. The convention is to use "<package>.<type>:<label>" as the annotation for the responsible code path. Enabled on iOS, macOS and Android only, since mobile platforms are the ones we're most interested in, and we are less sensitive to any throughput degradation due to the per-I/O callback overhead (macOS is also enabled for ease of testing during development). For now just exposed as counters on a /v0/sockstats PeerAPI endpoint. We also keep track of the current interface so that we can break out the stats by interface. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	fb84ccd82d	control/controlhttp: don't require valid TLS cert for Noise connection ... We don't require any cert at all for Noise-over-plaintext-port-80-HTTP, so why require a valid cert chain for Noise-over-HTTPS? The reason we use HTTPS at all is to get through firewalls that allow tcp/443 but not tcp/80, not because we need the security properties of TLS. Updates #3198 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	5bba65e978	net/memnet: rename from net/nettest ... This is just #cleanup to resolve a TODO Also add a package doc. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Will Norris	71029cea2d	all: update copyright and license headers ... This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Brad Fitzpatrick	6edf357b96	all: start groundwork for using capver for localapi & peerapi ... Updates #7015 Change-Id: I3d4c11b42a727a62eaac3262a879f29bb4ce82dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3eb986fe05	control/controlhttp: add TS_FORCE_NOISE_443, TS_DEBUG_NOISE_DIAL envknobs ... Updates tailscale/docker-extension#49 Change-Id: I99a154c16c92228bfdf4d2cf6c58cda00e22d72f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	3a018e51bb	ipn/ipnlocal: move handling of expired nodes to LocalBackend ... In order to be able to synthesize a new NetMap when a node expires, have LocalBackend start a timer when receiving a new NetMap that fires slightly after the next node expires. Additionally, move the logic that updates expired nodes into LocalBackend so it runs on every netmap (whether received from controlclient or self-triggered). Updates #6932 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I833390e16ad188983eac29eb34cc7574f555f2f3	2 years ago
Matthias Gabriel	355c3b2be7	control/controlhttp: fix header case-sensitivity ... Change-Id: I49269bc969a80382997ec5c9de33c4f56d9dc787 Signed-off-by: Matthias Gabriel <matthias.gabriel@etit.tu-chemnitz.de>	2 years ago
Andrew Dunham	1e67947cfa	control/controlclient, tailcfg: add Node.Expired field, set for expired nodes ... Nodes that are expired, taking into account the time delta calculated from MapResponse.ControlTime have the newly-added Expired boolean set. For additional defense-in-depth, also replicate what control does and clear the Endpoints and DERP fields, and additionally set the node key to a bogus value. Updates #6932 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia2bd6b56064416feee28aef5699ca7090940662a	2 years ago
Brad Fitzpatrick	eafbf8886d	ipn/localapi: add localapi debug endpoints for packet filter/matches ... For debugging #6423. This is easier than TS_DEBUG_MAP, as this means I can pipe things into jq, etc. Updates #6423 Change-Id: Ib3e7496b2eb3f47d4bed42e9b8045a441424b23c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	197a4f1ae8	types/ptr: move all the ptrTo funcs to one new package's ptr.To ... Change-Id: Ia0b820ffe7aa72897515f19bd415204b6fe743c7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	20b27df4d0	tailcfg, ipn, controlclient: add MapResponse.ClientVersion, plumb to IPN bus ... Updates #6480 Change-Id: I6321071425cd091148d8140d1eb24dd536bb7984 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	513780f4f8	ipn/ipnlocal: move URL validation to LocalBackend ... Updates tailscale/corp#7948 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	97319a1970	control/controlclient: filter PopBrowserURL values to https schemes ... No need for http://, etc. In case a control server sends a bogus value and GUIs don't also validate. Updates tailscale/corp#7948 Change-Id: I0b7dd86aa396bdabd88f0c4fe51831fb2ec4175a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	235309adc4	all: store NL keys per profile ... This moves the NetworkLock key from a dedicated StateKey to be part of the persist.Persist struct. This struct is stored as part for ipn.Prefs and is also the place where we store the NodeKey. It also moves the ChonkDir from "/tka" to "/tka-profile/<profile-id>". The rename was intentional to be able to delete the "/tka" dir if it exists. This means that we will have a unique key per profile, and a unique directory per profile. Note: `tailscale logout` will delete the entire profile, including any keys. It currently does not delete the ChonkDir. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	3f8e185003	health: add Warnable, move ownership of warnable items to callers ... The health package was turning into a rando dumping ground. Make a new Warnable type instead that callers can request an instance of, and then Set it locally in their code without the health package being aware of all the things that are warnable. (For plenty of things the health package will want to know details of how Tailscale works so it can better prioritize/suppress errors, but lots of the warnings are pretty leaf-y and unrelated) This just moves two of the health warnings. Can probably move more later. Change-Id: I51e50e46eb633f4e96ced503d3b18a1891de1452 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	f00a49667d	control/controlclient: make Status.Persist a PersistView ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	4d330bac14	ipn/ipnlocal: add support for multiple user profiles ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	da8def8e13	all: remove old +build tags ... The //go:build syntax was introduced in Go 1.17: https://go.dev/doc/go1.17#build-lines gofmt has kept the +build and go:build lines in sync since then, but enough time has passed. Time to remove them. Done with: perl -i -npe 's,^// \+build.*\n,,' $(git grep -l -F '+build') Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	a413fa4f85	control/controlclient: export NoiseClient ... This allows reusing the NoiseClient in other repos without having to reimplement the earlyPayload logic. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	910db02652	client/tailscale, tsnet, ipn/ipnlocal: prove nodekey ownership over noise ... Fixes #5972 Change-Id: Ic33a93d3613ac5dbf172d6a8a459ca06a7f9e547 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	988c1f0ac7	control/controlclient, tailcfg: add support for EarlyNoise payload before http/2 ... Not yet used, but skipped over, parsed, and tested. Updates #5972 Change-Id: Icd00196959ce266ae16a6c9244bd5e458e2c2947 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	d98305c537	cmd,ipn/ipnlocal,tailcfg: implement TKA disablement ... * Plumb disablement values through some of the internals of TKA enablement. * Transmit the node's TKA hash at the end of sync so the control plane understands each node's head. * Implement /machine/tka/disable RPC to actuate disablement on the control plane. There is a partner PR for the control server I'll send shortly. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	231b88cc51	control/controlclient: add start of noise+http2 upgrade test ... Basic HTTP/2-over-noise client test. To be fleshed out in subsequent commits that add more functionality to the noise client. Updates #5972 Change-Id: I0178343523ef4ae8e8fc87bae53cbc81f4e32fde Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	120bfc97ce	control/controlclient: refactor noiseClient, connections, http2 ... In prep for stateful http2 noise connections. Updates #5972 Change-Id: I9ebecc3b2d5d193621b87d39b506f231d6c82145 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	dfe67afb4a	control/controlhttp: remove ClientConn.UntrustedUpgradeHeaders ... It was just added and unreleased but we've decided to go a different route. Details are in 5e9e57ecf5. Updates #5972 Change-Id: I49016af469225f58535f63a9b0fbe5ab6a5bf304 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	5e9e57ecf5	control/controlhttp: add AcceptHTTP hook to add coalesced Server->Client write ... New plan for #5972. Instead of sending the public key in the clear (from earlier unreleased 246274b8e9) where the client might have to worry about it being dropped or tampered with and retrying, we'll instead send it post-Noise handshake but before the HTTP/2 connection begins. This replaces the earlier extraHeaders hook with a different sort of hook that allows us to combine two writes on the wire in one packet. Updates #5972 Change-Id: I42cdf7c1859b53ca4dfa5610bd1b840c6986e09c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	a2d15924fb	types/persist: add PublicNodeKey helper ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	9d04ffc782	net/wsconn: add back custom wrapper for turning a websocket.Conn into a net.Conn ... We removed it in #4806 in favor of the built-in functionality from the nhooyr.io/websocket package. However, it has an issue with deadlines that has not been fixed yet (see nhooyr/websocket#350). Temporarily go back to using a custom wrapper (using the fix from our fork) so that derpers will stop closing connections too aggressively. Updates #5921 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	246274b8e9	control/controlhttp: allow setting, getting Upgrade headers in Noise upgrade ... Not currently used, but will allow us to usually remove a round-trip for a future feature. Updates #5972 Change-Id: I2770ea28e3e6ec9626d1cbb505a38ba51df7fba2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	a4e707bcf0	control/controlhttp: try to avoid flakes in TestDialPlan ... Updates tailscale/corp#7446 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ifcf3b5176f065c2e67cbb8943f6356dea720a9c5	2 years ago
Tom DNetto	227777154a	control/controlclient,ipn/ipnlocal,tailcfg: rotate node-key signature on register ... CAPVER 47 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Emmanuel T Odeke	680f8d9793	all: fix more resource leaks found by staticmajor ... Updates #5706 Signed-off-by: Emmanuel T Odeke <emmanuel@orijtech.com>	2 years ago
Joe Tsai	82f5f438e0	wgengine/wgcfg: plumb down audit log IDs (#5855) ... The node and domain audit log IDs are provided in the map response, but are ultimately going to be used in wgengine since that's the layer that manages the tstun.Wrapper. Do the plumbing work to get this field passed down the stack. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Josh Soref	d4811f11a0	all: fix spelling mistakes ... Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>	2 years ago
Mihai Parparita	e97d5634bf	control/controlhttp: use custom port for non-localhost JS noise client connections ... Control may not be bound to (just) localhost when sharing dev servers, allow the Wasm client to connect to it in that case too. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago