586 Commits (3386a86fe557e9a021996be71a7f2287e4d1144e)

Author	SHA1	Message	Date
Brad Fitzpatrick	b7ae529ecc	client/tailscale: make GetCertificate guess cert if SNI lacks dots ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d5e1abd0c4	cmd/tailscale/cli: only write cert file if it changed ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	57b794c338	ipn/localapi: move cert fetching code to localapi, cache, add cert subcommand ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Matt Layher	8ab44b339e	net/tstun: use unix.Ifreq type for Linux TAP interface configuration ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	3 years ago
Josh Bleecher Snyder	d2aa144dcc	syncs: bump known good version to include Go 1.17 ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	25e060a841	cmd/tailscale/cli: fix cert fetch WaitOrder retry loop, misc cleanups ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b2eea1ee00	cmd/tailscale/cli: make cert fetch registration automatic, show valid domains ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	3e7ff5ff98	cmd/tailscaled: enable hybrid netstack mode for FreeBSD. ... Allows FreeBSD to function as an exit node in the same way that Windows and Tailscaled-on-MacOS do. RELNOTE=FreeBSD can now function as an exit node. Fixes https://github.com/tailscale/tailscale/issues/2498 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	ec9f3f4cc0	cmd/tailscale: update depaware ... Missing from prior commit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c68a12afe9	cmd/tailscale: add temporary debug command for getting DNS-01 LetsEncrypt cert ... Not even close to usable or well integrated yet, but submitting this before it bitrots or I lose it. Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	d2d55bd63c	cmd/microproxy: delete. ... Thank goodness. Fixes #2635 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	a4e19f2233	version: remove rsc.io/goversion dependency ... rsc.io/goversion is really expensive. Running version.ReadExe on tailscaled on darwin allocates 47k objects, almost 11mb. All we want is the module info. For that, all we need to do is scan through the binary looking for the magic start/end strings and then grab the bytes in between them. We can do that easily and quickly with nothing but a 64k buffer. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Crawshaw	360223fccb	types/dnstype: introduce new package for Resolver ... So the type can be used in net/dns without introducing a tailcfg dependency. For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Josh Bleecher Snyder	eee6b85b9b	cmd/tailscaled: don't require root for --cleanup ... Without this, the integration tests fail locally for me: --- FAIL: TestCollectPanic (7.61s) integration.go:74: built [tailscale.com/cmd/tailscaled tailscale.com/cmd/tailscale] in 1.59s integration_test.go:102: initial run: tailscaled requires root; use sudo tailscaled (or use --tun=userspace-networking) integration_test.go:108: cleanup failed: exit status 1: "tailscaled requires root; use sudo tailscaled (or use --tun=userspace-networking)\n" stuntest.go:64: STUN server shutdown FAIL FAIL tailscale.com/tstest/integration 9.678s FAIL Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	a5da4ed981	all: gofmt with Go 1.17 ... This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	a729070252	net/tstun: add start of Linux TAP support, with DHCP+ARP server ... Still very much a prototype (hard-coded IPs, etc) but should be non-invasive enough to submit at this point and iterate from here. Updates #2589 Co-Author: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fd7b738e5b	derp: use pad32 package for padding, reduce duplication ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fdc081c291	net/portmapper: fix UPnP probing, work against all ports ... Prior to Tailscale 1.12 it detected UPnP on any port. Starting with Tailscale 1.11.x, it stopped detecting UPnP on all ports. Then start plumbing its discovered Location header port number to the code that was assuming port 5000. Fixes #2109 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f3c96df162	ipn/ipnstate: move tailscale status "active" determination to tailscaled ... Fixes #2579 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1db9032ff5	cmd/tailscaled: let portmap debug mode have an gateway/IP override knob ... For testing pfSense clients "behind" pfSense on Digital Ocean where the main interface still exists. This is easier for debugging. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	31ea073a73	cmd/tailscaled: add debug -portmap mode ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	3e039daf95	logpolicy: actually collect panics ... (Written with Josh) For #2544 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	d37451bac6	cmd/derper: dial VPC address with right context ... Fix bug from just-submitted e422e9f4c9. Updates #2414 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e422e9f4c9	cmd/derper: mesh over VPC network ... Updates #2414 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	9da4181606	tstime/rate: new package ... This is a simplified rate limiter geared for exactly our needs: A fast, mono.Time-based rate limiter for use in tstun. It was generated by stripping down the x/time/rate rate limiter to just our needs and switching it to use mono.Time. It removes one time.Now call per packet. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	8a3d52e882	wgengine/magicsock: use mono.Time ... magicsock makes multiple calls to Now per packet. Move to mono.Now. Changing some of the calls to use package mono has a cascading effect, causing non-per-packet call sites to also switch. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	c2202cc27c	net/tstun: use mono.Time ... There's a call to Now once per packet. Move to mono.Now. Though the current implementation provides high precision, we document it to be coarse, to preserve the ability to switch to a coarse monotonic time later. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Aaron Bieber	c179b9b535	cmd/tsshd: switch from github.com/kr/pty to github.com/creack/pty ... The kr/pty module moved to creack/pty per the kr/pty README[1]. creack/pty brings in support for a number of OS/arch combos that are lacking in kr/pty. Run `go mod tidy` while here. [1] https://github.com/kr/pty/blob/master/README.md Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>	3 years ago
Brad Fitzpatrick	7b9f02fcb1	cmd/tailscale/cli: document that empty string disable exit nodes, routes ... Updates #2529 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Joe Tsai	d145c594ad	util/deephash: improve cycle detection (#2470) ... The previous algorithm used a map of all visited pointers. The strength of this approach is that it quickly prunes any nodes that we have ever visited before. The detriment of the approach is that pruning is heavily dependent on the order that pointers were visited. This is especially relevant for hashing a map where map entries are visited in a non-deterministic manner, which would cause the map hash to be non-deterministic (which defeats the point of a hash). This new algorithm uses a stack of all visited pointers, similar to how github.com/google/go-cmp performs cycle detection. When we visit a pointer, we push it onto the stack, and when we leave a pointer, we pop it from the stack. Before visiting a pointer, we first check whether the pointer exists anywhere in the stack. If yes, then we prune the node. The detriment of this approach is that we may hash a node more often than before since we do not prune as aggressively. The set of visited pointers up until any node is only the path of nodes up to that node and not any other pointers that may have been visited elsewhere. This provides us deterministic hashing regardless of visit order. We can now delete hashMapFallback and associated complexity, which only exists because the previous approach was non-deterministic in the presence of cycles. This fixes a failure of the old algorithm where obviously different values are treated as equal because the pruning was too aggresive. See https://github.com/tailscale/tailscale/issues/2443#issuecomment-883653534 The new algorithm is slightly slower since it prunes less aggresively: name old time/op new time/op delta Hash-8 66.1µs ± 1% 68.8µs ± 1% +4.09% (p=0.000 n=19+19) HashMapAcyclic-8 63.0µs ± 1% 62.5µs ± 1% -0.76% (p=0.000 n=18+19) TailcfgNode-8 9.79µs ± 2% 9.88µs ± 1% +0.95% (p=0.000 n=19+17) HashArray-8 643ns ± 1% 653ns ± 1% +1.64% (p=0.000 n=19+19) However, a slower but more correct algorithm seems more favorable than a faster but incorrect algorithm. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Brad Fitzpatrick	ed8587f90d	wgengine/router: take a link monitor ... Prep for #1591 which will need to make Linux's router react to changes that the link monitor observes. The router package already depended on the monitor package transitively. Now it's explicit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7f7a81e5ae	cmd/tailscaled: add func to create ipnserver.Opts ... To unify the Windows service and non-service/non-Windows paths a bit. And provides a way to make Linux act like Windows for testing. (notably, for testing the fix to #2137) One perhaps visible change of this is that tailscaled.exe when run in cmd.exe/powershell (not as a Windows Service) no longer uses the "_daemon" autostart key. But in addition to being naturally what falls out of this change, that's also what Windows users would likely want, as otherwise the unattended mode user is ignored when the "_daemon" autostart key is specified. Notably, this would let people debug what their normally-run-as-a-service tailscaled is doing, even when they're running in Unattended Mode. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	87244eda3f	cmd/tailscale/cli: allow effective GOOS to be changed for integration tests ... Adds TS_DEBUG_UP_FLAG_GOOS for integration tests to make "tailscale up" act like other OSes. For an upcoming change to test #2137. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	4dbbd0aa4a	cmd/addlicense: add command to add licenseheaders to generated code ... And use it to make our stringer invocations match the existing code. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	ec4d721572	cmd/tailscaled: use state key constant from ipn package ... Rather than redefining it again. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e2eaae8224	cmd/derpprobe: add in a delay to wait for mesh info to sync	3 years ago
julianknodt	1bb6abc604	net/portmapper: add upnp port mapping ... Add in UPnP portmapping, using goupnp library in order to get the UPnP client and run the portmapping functions. This rips out anywhere where UPnP used to be in portmapping, and has a flow separate from PMP and PCP. RELNOTE=portmapper now supports UPnP mappings Fixes #682 Updates #2109 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Aaditya Chaudhary	4f89fe17a2	Implemented Commandline Download Speedtest (#2064) ... Added the net/speedtest package that contains code for starting up a speedtest server and a client. The speedtest command for starting a client takes in a duration for the speedtest as well as the host and port of the speedtest server to connect to. The speedtest command for starting a server takes in a host:port pair to listen on. Signed-off-by: Aaditya Chaudhary <32117362+AadityaChaudhary@users.noreply.github.com>	3 years ago
julianknodt	b67a3007d5	cmd/derper: remove default for non-root users ... Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	9d4eddcef8	cmd/derper: add default -c arguments ... This adds some convenient defaults for -c, so that user-provided DERPs require less command line flags. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	ee71c966fd	cmd/derpprobe: bound node pair probe duration ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	e28bc49e5f	netns_linux: remove special handling for tests. ... With netns handling localhost now, existing tests no longer need special handling. The tests set up their connections to localhost, and the connections work without fuss. Remove the special handling for tests. Also remove the hostinfo.TestCase support, since this was the only use of it. It can be added back later if really needed, but it would be better to try to make tests work without special cases. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	d2480fd508	net/netns: support !CAP_NET_ADMIN ... netns_linux checked whether "ip rule" could run to determine whether to use SO_MARK for network namespacing. However in Linux environments which lack CAP_NET_ADMIN, such as various container runtimes, the "ip rule" command succeeds but SO_MARK fails due to lack of permission. SO_BINDTODEVICE would work in these environments, but isn't tried. In addition to running "ip rule" check directly whether SO_MARK works or not. Among others, this allows Microsoft Azure App Service and AWS App Runner to work. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Dan Bond	ceb8c2b34e	cmd/tailscale: update web server test copyright ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Dan Bond	52972679e6	cmd/tailscale: improve web server test structure ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Dan Bond	4c684fcf8c	cmd/tailscale: test web server url func ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Dan Bond	652bbc9aa0	cmd/tailscale: log web listen addr ... Signed-off-by: Dan Bond <danbond@protonmail.com>	3 years ago
Brad Fitzpatrick	1cedd944cf	cmd/tailscale/cli: diagnose missing tailscaled on 'up' ... Fixes #2029 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	61e8fd4698	cmd/derpprobe: move from cmd/derper/derpprobe ... Because our corp build system is confused by nested binaries. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	05da2691a5	cmd/derper/derpprobe: add derp prober ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	87481282eb	ipn: another controlplane synonym ... This one doesn't bother me so much, as long term we want a synonym here. Fixes #2384 Fixes #2386 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	c84d7baf98	cmd/tailscale/cli: factor out more up code for testing ... In theory, some of the other table-driven tests could be moved into this form now but I didn't want to disturb too much good test code. Includes a commented-out test for #2384 that is currently failing. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	92077ae78c	wgengine/magicsock: make portmapping async ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Christine Dodrill	a19eea965f	tstest/integration/vms: use an in-process logcatcher (#2360) ... This adapts the existing in-process logcatcher from tstest/integration into a public type and uses it on the side of testcontrol. This also fixes a bug in the Alpine Linux OpenRC unit that makes every value in `/etc/default/tailscaled` exported into tailscaled's environment, a-la systemd [Service].EnviromentFile. Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Brad Fitzpatrick	a9fc583211	cmd/tailscale/cli: document the web subcommand a bit more ... Fixes #2326 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	700badd8f8	util/deephash: move internal/deephash to util/deephash ... No code changes. Just a minor package doc addition about lack of API stability.	3 years ago
Maisem Ali	ec52760a3d	wgengine/router_windows: support toggling local lan access when using ... exit nodes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Crawshaw	c37713b927	cmd/tailscale/cli: accept login server synonym ... Fixes #2272 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
julianknodt	e68d4d5805	cmd/tailscale: add debug flag to dump derp map ... This adds a flag in tailscale debug for dumping the derp map to stdout. Fixes #2249. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	506c2fe8e2	cmd/tailscale: make netcheck use active DERP map, delete static copy ... After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	3910c1edaf	net/socks5/tssocks: add new package, move SOCKS5 glue out of tailscaled ... Prep for #1970, #2264, #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	82e15d3450	cmd/tailscaled: log SOCKS5 port when port 0 requested ... Part of #2158 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	10d7c2583c	net/dnsfallback: don't depend on derpmap.Prod ... Move derpmap.Prod to a static JSON file (go:generate'd) instead, to make its role explicit. And add a TODO about making dnsfallback use an update-over-time DERP map file instead of a baked-in one. Updates #1264 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	148602a89a	derp,cmd/derper: allow server to verify clients ... This adds a flag to the DERP server which specifies to verify clients through a local tailscaled. It is opt-in, so should not affect existing clients, and is mainly intended for users who want to run their own DERP servers. It assumes there is a local tailscaled running and will attempt to hit it for peer status information. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	0f18801716	cmd/cloner: support maps with clone ptrs ... In order to clone DERPMaps, it was necessary to extend the cloner so that it supports nested pointers inside of maps which are also cloneable. This also adds cloning for DERPRegions and DERPNodes because they are on DERPMap's maps. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	38be964c2b	go.mod: update netstack ... Fixes a atomic alignment crash on 32-bit machines. Fixes #2129 Fixes tailscale/tailscale-synology#66 (same) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	ad288baaea	net/interfaces: use IPv4 link local if nothing better ... The only connectivity an AWS Lambda container has is an IPv4 link-local 169.254.x.x address using NAT: 12: vtarget_1@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 7e:1c:3f:00:00:00 brd ff:ff:ff:ff:ff:ff link-netnsid 1 inet 169.254.79.1/32 scope global vtarget_1 valid_lft forever preferred_lft forever If there are no other IPv4/v6 addresses available, and we are running in AWS Lambda, allow IPv4 169.254.x.x addresses to be used. ---- Similarly, a Google Cloud Run container's only connectivity is a Unique Local Address fddf:3978:feb1:d745::c001/128. If there are no other addresses available then allow IPv6 Unique Local Addresses to be used. We actually did this in an earlier release, but now refactor it to work the same way as the IPv4 link-local support is being done. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
David Crawshaw	297b3d6fa4	staticcheck.conf: turn off noisy lint errors ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
julianknodt	3728634af9	derp: add debug traffic handler ... This adds a handler on the DERP server for logging bytes send and received by clients of the server, by holding open a connection and recording if there is a difference between the number of bytes sent and received. It sends a JSON marshalled object if there is an increase in the number of bytes. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	03311bb0d6	hostinfo: add hostinfo package, move stuff out of controlclient ... And make it cheaper, so other parts of the code can check the environment. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	0022c3d2e2	tsweb: replace NewMux with a more flexible DebugHandler. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	48c25fa36f	tsweb: fold StdHandlerOpts and StdHandler200s with StdHandler. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	ac07ff43bf	cmd/tailscaled: start after NetworkManager and systemd-resolved. ... The dependency is a "soft" ordering dependency only, meaning that tailscaled will start after those services if those services were going to be run anyway, but doesn't force either of them to run. That's why it's safe to specify this dependency unconditionally, even for systems that don't run those services. Updates #2127. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	80a4052593	cmd/tailscale, wgengine, tailcfg: don't assume LastSeen is present [mapver 20] ... Updates #2107 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	8b2b899989	tstest/integration: test Alpine Linux (#2098) ... Alpine Linux[1] is a minimal Linux distribution built around musl libc. It boots very quickly, requires very little ram and is as close as you can get to an ideal citizen for testing Tailscale on musl. Alpine has a Tailscale package already[2], but this patch also makes it easier for us to provide an Alpine Linux package off of pkgs in the future. Alpine only offers Tailscale on the rolling-release edge branch. [1]: https://alpinelinux.org/ [2]: https://pkgs.alpinelinux.org/packages?name=tailscale&branch=edge Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>	4 years ago
Maisem Ali	f944614c5c	cmd/tailscale/web: add support for QNAP ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Matt Layher	6956645ec8	go.mod: bump github.com/mdlayher/netlink to v1.4.1 ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
David Anderson	1c6946f971	cmd/mkpkg: allow zero files in a package. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Maisem Ali	95e296fd96	cmd/tailscale/web: restrict web access to synology admins. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Adrian Dewhurst	6d6cf88d82	control/controlclient: use our fork of certstore ... The cyolosecurity fork of certstore did not update its module name and thus can only be used with a replace directive. This interferes with installing using `go install` so I created a tailscale fork with an updated module name. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago
David Crawshaw	82b217f82e	cmd/tailscale: have web POST wait for authURL ... Fixes #1939 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
David Crawshaw	50c976d3f1	cmd/tailscale: show web 'login' error message ... For #1939 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Brad Fitzpatrick	d2c4e75099	cmd/tailscale/cli: update URL in error message for Synology unsupported feature ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	cdd231cb7d	cmd/tailscale/cli: don't warn about iptables=off on Synology ... We don't use iptables on Synology, so don't scare the user. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	1ece91cede	go.mod: upgrade wireguard-windows, de-fork wireguard-go ... Pull in the latest version of wireguard-windows. Switch to upstream wireguard-go. This requires reverting all of our import paths. Unfortunately, this has to happen at the same time. The wireguard-go change is very low risk, as that commit matches our fork almost exactly. (The only changes are import paths, CI files, and a go.mod entry.) So if there are issues as a result of this commit, the first place to look is wireguard-windows changes. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	a86a0361a7	go.mod: upgrade all deps ... At the start of a dev cycle we'll upgrade all dependencies. Done with: $ for Dep in $(cat go.mod | perl -ne '/(\S+) v/ and print "$1\n"'); do go get $Dep@upgrade; done Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	5666663370	net/packet: use netaddr AppendTo methods ... This lets us remote the types/strbuilder package, which had only a single user. And it's faster. name old time/op new time/op delta String/tcp4-8 175ns ± 0% 58ns ± 1% -66.95% (p=0.000 n=10+9) String/tcp6-8 226ns ± 1% 136ns ± 1% -39.85% (p=0.000 n=10+10) String/udp4-8 175ns ± 1% 58ns ± 1% -67.01% (p=0.000 n=10+9) String/udp6-8 230ns ± 1% 140ns ± 0% -39.32% (p=0.000 n=10+9) String/icmp4-8 164ns ± 0% 50ns ± 1% -69.89% (p=0.000 n=10+10) String/icmp6-8 217ns ± 1% 129ns ± 0% -40.46% (p=0.000 n=10+10) String/igmp-8 196ns ± 0% 56ns ± 1% -71.32% (p=0.000 n=10+10) String/unknown-8 2.06ns ± 1% 2.06ns ± 2% ~ (p=0.985 n=10+10) name old alloc/op new alloc/op delta String/tcp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/tcp6-8 168B ± 0% 96B ± 0% -42.86% (p=0.000 n=10+10) String/udp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/udp6-8 168B ± 0% 96B ± 0% -42.86% (p=0.000 n=10+10) String/icmp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/icmp6-8 104B ± 0% 64B ± 0% -38.46% (p=0.000 n=10+10) String/igmp-8 48.0B ± 0% 48.0B ± 0% ~ (all equal) String/unknown-8 0.00B 0.00B ~ (all equal) name old allocs/op new allocs/op delta String/tcp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/tcp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/udp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/udp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/icmp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/icmp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/igmp-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/unknown-8 0.00 0.00 ~ (all equal) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Maisem Ali	234cc87f48	cmd/tailscaled: use the wf package instead of wireguard-windows/firewall ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types ... This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	6f62bbae79	cmd/tailscale: make ping --until-direct require direct connection to exit 0 ... If --until-direct is set, the goal is to make a direct connection. If we failed at that, say so, and exit with an error. RELNOTE=tailscale ping --until-direct (the default) now exits with a non-zero exit code if no direct connection was established. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	36a26e6a71	internal/deephash: rename from deepprint ... Yes, it printed, but that was an implementation detail for hashing. And coming optimization will make it print even less. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	7027fa06c3	wf: implement windows firewall using inet.af/wf. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	5190435d6e	cmd/tailscale: rewrite the "up" checker, fix bugs ... The old way was way too fragile and had felt like it had more special cases than normal cases. (see #1874, #1860, #1834, etc) It became very obvious the old algorithm didn't work when we made the output be pretty and try to show the user the command they need to run in 5ecc7c7200 for #1746) The new algorithm is to map the prefs (current and new) back to flags and then compare flags. This nicely handles the OS-specific flags and the n:1 and 1:n flag:pref cases. No change in the existing already-massive test suite, except some ordering differences (the missing items are now sorted), but some new tests are added for behavior that was broken before. In particular, it now: * preserves non-pref boolean flags set to false, and preserves exit node IPs (mapping them back from the ExitNodeID pref, as well as ExitNodeIP), * doesn't ignore --advertise-exit-node when doing an EditPrefs call (#1880) * doesn't lose the --operator on the non-EditPrefs paths (e.g. with --force-reauth, or when the backend was not in state Running). Fixes #1880 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e78e26b6fb	cmd/tailscale: fix another up warning with exit nodes ... The --advertise-routes and --advertise-exit-node flags both mutating one pref is the gift that keeps on giving. I need to rewrite the this up warning code to first map prefs back to flag values and then just compare flags instead of comparing prefs, but this is the minimal fix for now. This also includes work on the tests, to make them easier to write (and more accurate), by letting you write the flag args directly and have that parse into the upArgs/MaskedPrefs directly, the same as the code, rather than them being possibly out of sync being written by hand. Fixes https://twitter.com/EXPbits/status/1390418145047887877 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	2585edfaeb	cmd/tailscale: fix tailscale up --advertise-exit-node validation ... Fixes #1859 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	52e1031428	cmd/tailscale: gofmt ... From 6d10655dc3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Avery Pennarun	6d10655dc3	ipnlocal: accept a new opts.UpdatePrefs field. ... This is needed because the original opts.Prefs field was at some point subverted for use in frontend->backend state migration for backward compatibility on some platforms. We still need that feature, but we also need the feature of providing the full set of prefs from `tailscale up`, *not* including overwriting the prefs.Persist keys, so we can't use the original field from `tailscale up`. `tailscale up` had attempted to compensate for that by doing SetPrefs() before Start(), but that violates the ipn.Backend contract, which says you should call Start() before anything else (that's why it's called Start()). As a result, doing SetPrefs({ControlURL=..., WantRunning=true}) would cause a connection to the *previous* control server (because WantRunning=true), and then connect to the *new* control server only after running Start(). This problem may have been avoided before, but only by pure luck. It turned out to be relatively harmless since the connection to the old control server was immediately closed and replaced anyway, but it created a race condition that could have caused spurious notifications or rejected keys if the server responded quickly. As already covered by existing TODOs, a better fix would be to have Start() get out of the business of state migration altogether. But we're approaching a release so I want to make the minimum possible fix. Fixes #1840. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Josh Bleecher Snyder	7dbbe0c7c7	cmd/tailscale/cli: fix running from Xcode ... We were over-eager in running tailscale in GUI mode. f42ded7acf fixed that by checking for a variety of shell-ish env vars and using those to force us into CLI mode. However, for reasons I don't understand, those shell env vars are present when Xcode runs Tailscale.app on my machine. (I've changed no configs, modified nothing on a brand new machine.) Work around that by adding an additional "only in GUI mode" check. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Josh Bleecher Snyder	9360f36ebd	all: use lower-case letters at the start of error message ... Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Brad Fitzpatrick	962bf74875	cmd/tailscale: fail if tailscaled closes the IPN connection ... I was going to write a test for this using the tstest/integration test stuff, but the testcontrol implementation isn't quite there yet (it always registers nodes and doesn't provide AuthURLs). So, manually tested for now. Fixes #1843 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago