146 Commits (36b1b4af2fc338806a517fc2bd91b207192ec1b3)

Author	SHA1	Message	Date
Claire Wang	a45c9f982a	wgengine/netstack: change netstack API to require LocalBackend ... The macOS client was forgetting to call netstack.Impl.SetLocalBackend. Change the API so that it can't be started without one, eliminating this class of bug. Then update all the callers. Updates #6764 Change-Id: I2b3a4f31fdfd9fdbbbbfe25a42db0c505373562f Signed-off-by: Claire Wang <claire@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	caa2fe394f	wgengine/netstack: delete some dead code, old comment, use atomic int types ... Noticed while looking at something else; #cleanup. Change-Id: Icde7749363014eab9bebe1dd80708f5491f933d1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
andig	14e8afe444	go.mod, etc: bump gvisor ... Fixes #6554 Change-Id: Ia04ae37a47b67fa57091c9bfe1d45a1842589aa8 Signed-off-by: andig <cpuidle@gmx.de>	2 years ago
Brad Fitzpatrick	b683921b87	ipn/ipnlocal: add start of handling TCP proxying ... Updates tailscale/corp#7515 Change-Id: I82d19b5864674b2169f25ec8e429f60a543e0c57 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	79472a4a6e	wgengine/netstack: optimize shouldProcessInbound, avoiding 4via6 lookups ... All IPv6 packets for the self address were doing netip.Prefix.Contains lookups. If if we know they're for a self address (which we already previously computed and have sitting in a bool), then they can't be for a 4via6 range. Change-Id: Iaaaf1248cb3fecec229935a80548ead0eb4cb892 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	2daf0f146c	ipn/ipnlocal, wgengine/netstack: start handling ports for future serving ... Updates tailscale/corp#7515 Change-Id: I966e936e72a2ee99be8d0f5f16872b48cc150258 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	abfdcd0f70	wgengine/netstack: fix shouldProcessInbound peerapi non-SYN handling ... It was eating TCP packets to peerapi ports to subnet routers. Some of the TCP flow's packets went onward, some got eaten. So some TCP flows to subnet routers, if they used an unfortunate TCP port number, got broken. Change-Id: Ifea036119ccfb081f4dfa18b892373416a5239f8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3367136d9e	wgengine/netstack: remove old unused handleSSH hook ... It's leftover from an earlier Tailscale SSH wiring and I forgot to delete it apparently. Change-Id: I14f071f450e272b98d90080a71ce68ba459168d1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	42f7ef631e	wgengine/netstack: use 72h as the KeepAlive Idle time for Tailscale SSH ... Setting TCP KeepAlives for Tailscale SSH connections results in them unnecessarily disconnecting. However, we can't turn them off completely as that would mean we start leaking sessions waiting for a peer to come back which may have gone away forever (e.g. if the node was deleted from the tailnet during a session). Updates #5021 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Jordan Whited	a471681e28	wgengine/netstack: enable TCP SACK (#6066) ... TCP selective acknowledgement can improve throughput by an order of magnitude in the presence of loss. Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
Emmanuel T Odeke	f981b1d9da	all: fix resource leaks with missing .Close() calls ... Fixes #5706 Signed-off-by: Emmanuel T Odeke <emmanuel@orijtech.com>	2 years ago
Andrew Dunham	0607832397	wgengine/netstack: always respond to 4via6 echo requests (#5712) ... As the comment in the code says, netstack should always respond to ICMP echo requests to a 4via6 address, even if the netstack instance isn't normally processing subnet traffic. Follow-up to #5709 Change-Id: I504d0776c5824071b2a2e0e687bc33e24f6c4746 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Andrew Dunham	b9b0bf65a0	wgengine/netstack: handle 4via6 packets when pinging (#5709) ... Change-Id: Ib6ebbaa11219fb91b550ed7fc6ede61f83262e89 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Brad Fitzpatrick	74674b110d	envknob: support changing envknobs post-init ... Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	9240f5c1e2	wgengine/netstack: only accept connection after dialing (#5503) ... If we accept a forwarded TCP connection before dialing, we can erroneously signal to a client that we support IPv6 (or IPv4) without that actually being possible. Instead, we only complete the client's TCP handshake after we've dialed the outbound connection; if that fails, we respond with a RST. Updates #5425 (maybe fixes!) Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Maisem Ali	a9f6cd41fd	all: use syncs.AtomicValue ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	5f6abcfa6f	all: migrate code from netaddr.FromStdAddr to Go 1.18 ... With caveat https://github.com/golang/go/issues/53607#issuecomment-1203466984 that then requires a new wrapper. But a simpler one at least. Updates #5162 Change-Id: I0a5265065bfcd7f21e8dd65b2bd74cae90d76090 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	8725b14056	all: migrate more code code to net/netip directly ... Instead of going through the tailscale.com/net/netaddr transitional wrappers. Updates #5162 Change-Id: I3dafd1c2effa1a6caa9b7151ecf6edd1a3fda3dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a12aad6b47	all: convert more code to use net/netip directly ... perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7eaf5e509f	net/netaddr: start migrating to net/netip via new netaddr adapter package ... Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	9514ed33d2	go.mod: bump gvisor.dev/gvisor ... Pick up https://github.com/google/gvisor/pull/7787 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
kylecarbs	9280d39678	wgengine/netstack: close ipstack when netstack.Impl is closed ... Fixes netstack.Impl leaking goroutines after shutdown. Signed-off-by: kylecarbs <kyle@carberry.com>	2 years ago
Brad Fitzpatrick	69b535c01f	wgengine/netstack: replace a 1500 with a const + doc ... Per post-submit code review feedback of 1336fb740b from @maisem. Change-Id: Ic5c16306cbdee1029518448642304981f77ea1fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	1336fb740b	wgengine/netstack: make netstack MTU be 1280 also ... Updates #3878 Change-Id: I1850085b32c8a40d85607b4ad433622c97d96a8d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom	fc5839864b	wgengine/netstack: handle multiple magicDNS queries per UDP socket (#4708) ... Fixes: #4686 Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	35111061e9	wgengine/netstack, ipn/ipnlocal: serve http://100.100.100.100/ ... For future stuff. Change-Id: I64615b8b2ab50b57e4eef1ca66fa72e3458cb4a9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Tom	d1d6ab068e	net/dns, wgengine: implement DNS over TCP (#4598) ... * net/dns, wgengine: implement DNS over TCP Signed-off-by: Tom DNetto <tom@tailscale.com> * wgengine/netstack: intercept only relevant port/protocols to quad-100 Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
James Tucker	f9e86e64b7	*: use WireGuard where logged, printed or named ... Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Tom DNetto	9e77660931	net/tstun,wgengine/{.,netstack}: handle UDP magicDNS traffic in netstack ... This change wires netstack with a hook for traffic coming from the host into the tun, allowing interception and handling of traffic to quad-100. With this hook wired, magicDNS queries over UDP are now handled within netstack. The existing logic in wgengine to handle magicDNS remains for now, but its hook operates after the netstack hook so the netstack implementation takes precedence. This is done in case we need to support platforms with netstack longer than expected. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Tom DNetto	9dee6adfab	cmd/tailscaled,ipn/ipnlocal,wgengine/...: pass dns.Manager into netstack ... Needed for a following commit which moves magicDNS handling into netstack. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
James Tucker	1aa75b1c9e	wgengine/netstack: always set TCP keepalive ... Setting keepalive ensures that idle connections will eventually be closed. In userspace mode, any application configured TCP keepalive is effectively swallowed by the host kernel, and is not easy to detect. Failure to close connections when a peer tailscaled goes offline or restarts may result in an otherwise indefinite connection for any protocol endpoint that does not initiate new traffic. This patch does not take any new opinion on a sensible default for the keepalive timers, though as noted in the TODO, doing so likely deserves further consideration. Update #4522 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	8ee044ea4a	ssh/tailssh: make the SSH server a singleton, register with LocalBackend ... Remove the weird netstack -> tailssh dependency and instead have tailssh register itself with ipnlocal when linked. This makes tailssh.server a singleton, so we can have a global map of all sessions. Updates #3802 Change-Id: Iad5caec3a26a33011796878ab66b8e7b49339f29 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	da14e024a8	tailcfg, ssh/tailssh: optionally support SSH public keys in wire policy ... And clean up logging. Updates #3802 Change-Id: I756dc2d579a16757537142283d791f1d0319f4f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3ae701f0eb	net/tsaddr, wgengine/netstack: add IPv6 range that forwards to site-relative IPv4 ... This defines a new magic IPv6 prefix, fd7a:115c:a1e0:b1a::/64, a subset of our existing /48, where the final 32 bits are an IPv4 address, and the middle 32 bits are a user-chosen "site ID". (which must currently be 0000:00xx; the top 3 bytes must be zero for now) e.g., I can say my home LAN's "site ID" is "0000:00bb" and then advertise its 10.2.0.0/16 IPv4 range via IPv6, like: tailscale up --advertise-routes=fd7a:115c:a1e0:b1a::bb:10.2.0.0/112 (112 being /128 minuse the /96 v6 prefix length) Then people in my tailnet can: $ curl '[fd7a:115c:a1e0:b1a::bb:10.2.0.230]' <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" .... Updates #3616, etc RELNOTE=initial support for TS IPv6 addresses to route v4 "via" specific nodes Change-Id: I9b49b6ad10410a24b5866b9fbc69d3cae1f600ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	c6ac29bcc4	wgengine/netstack: disable refsvfs2 leak tracking (#4378) ... In addition an envknob (TS_DEBUG_NETSTACK_LEAK_MODE) now provides access to set leak tracking to more useful values. Fixes #4309 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	e4d8d5e78b	net/packet, wgengine/netstack: remove workaround for old gvisor ECN bug ... Fixes #2642 Change-Id: Ic02251d24a4109679645d1c8336e0f961d0cce13 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	445c04c938	wgengine: inject packetbuffers rather than bytes (#4220) ... Plumb the outbound injection path to allow passing netstack PacketBuffers down to the tun Read, where they are decref'd to enable buffer re-use. This removes one packet alloc & copy, and reduces GC pressure by pooling outbound injected packets. Fixes #2741 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	1b87e025e9	ssh/tailssh: move SSH code from wgengine/netstack to this new package ... Still largely incomplete, but in a better home now. Updates #3802 Change-Id: I46c5ffdeb12e306879af801b06266839157bc624 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	bd90781b34	ipn/ipnlocal, wgengine/netstack: use netstack for peerapi server ... We're finding a bunch of host operating systems/firewalls interact poorly with peerapi. We either get ICMP errors from the host or users need to run commands to allow the peerapi port: https://github.com/tailscale/tailscale/issues/3842#issuecomment-1025133727 ... even though the peerapi should be an internal implementation detail. Rather than fight the host OS & firewalls, this change handles the server side of peerapi entirely in netstack (except on iOS), so it never makes its way to the host OS where it might be messed with. Two main downsides are: 1) netstack isn't as fast, but we don't really need speed for peerapi. And actually, with fewer trips to/from the kernel, we might actually make up for some of the netstack performance loss by staying in userspace. 2) tcpdump / Wireshark etc packet captures will no longer see the peerapi traffic. Oh well. Crawshaw's been wanting to add packet capture server support to tailscaled, so we'll probably do that sooner now. A future change might also then use peerapi for the client-side (except on iOS). Updates #3842 (probably fixes, as well as many exit node issues I bet) Change-Id: Ibc25edbb895dc083d1f07bd3cab614134705aa39 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1af26222b6	go.mod: bump netstack, switch to upstream netstack ... Now that Go 1.17 has module graph pruning (https://go.dev/doc/go1.17#go-command), we should be able to use upstream netstack without breaking our private repo's build that then depends on the tailscale.com Go module. This is that experiment. Updates #1518 (the original bug to break out netstack to own module) Updates #2642 (this updates netstack, but doesn't remove workaround) Change-Id: I27a252c74a517053462e5250db09f379de8ac8ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f3c0023add	wgengine/netstack: add an SSH server experiment ... Disabled by default. To use, run tailscaled with: TS_SSH_ALLOW_LOGIN=you@bar.com And enable with: $ TAILSCALE_USE_WIP_CODE=true tailscale up --ssh=true Then ssh [any-user]@[your-tailscale-ip] for a root bash shell. (both the "root" and "bash" part are temporary) Updates #3802 Change-Id: I268f8c3c95c8eed5f3231d712a5dc89615a406f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) ... A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c64af5e676	wgengine/netstack: clear TCP ECN bits before giving to gvisor ... Updates #2642 Change-Id: Ic219442a2656dd9dc99ae1dd91e907fd3d924987 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	185825df11	wgengine/netstack: add a missing refcount decrement after packet injection ... Fixes #3762 Updates #3745 (probably fixes?) Change-Id: I1d3f0590fd5b8adfbc9110bc45ff717bb9e79aae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	790e41645b	wgengine/netstack: add an Impl.Close method for tests ... Change-Id: Idbb3fd6d749d3e4effdf96de77a1106584822fef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	166fe3fb12	wgengine/netstack: add missing error logging in a RST case ... Updates #2642 Change-Id: I9f2f8fd28fc980208b0739eb9caf9db7b0977c09 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6be48dfcc6	wgengine/netstack: fix netstack ping timeout on darwin ... -W is milliseconds on darwin, not seconds, and empirically it's milliseconds after a 1 second base. Change-Id: I2520619e6699d9c505d9645ce4dfee4973555227 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a93937abc3	wgengine/netstack: make userspace ping work when tailscaled has CAP_NET_RAW ... Updates #3710 Change-Id: Ief56c7ac20f5f09a2f940a1906b9efbf1b0d6932 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1a4e8da084	wgengine/netstack: fake pings through netstack on Android too ... Every OS ping binary is slightly different. Adjust for Android's. Updates #1738 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1b426cc232	wgengine/netstack: add env knob to turn on netstack debug logs ... Except for the super verbose packet-level dumps. Keep those disabled by default with a const. Updates #2642 Change-Id: Ia9eae1677e8b3fe6f457a59e44896a335d95d547 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5a9914a92f	wgengine/netstack: don't remove 255.255.255.255/32 from netstack ... The intent of the updateIPs code is to add & remove IP addresses to netstack based on what we get from the netmap. But netstack itself adds 255.255.255.255/32 apparently and we always fight it (and it adds it back?). So stop fighting it. Updates #2642 (maybe fixes? maybe.) Change-Id: I37cb23f8e3f07a42a1a55a585689ca51c2be7c60 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	93ae11105d	ipn/ipnlocal: clear magicsock's netmap on logout ... magicsock was hanging onto its netmap on logout, which caused tailscale status to display partial information about a bunch of zombie peers. After logout, there should be no peers. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	6590fc3a94	wgengine/netstack: remove some logging on forwarding connections ... Change-Id: Ib1165b918cd5da38583f8e7d4be8cda54af3c81d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b59e7669c1	wgengine/netstack: in netstack/hybrid mode, fake ICMP using ping command ... Change-Id: I42cb4b9b326337f4090d9cea532230e36944b6cb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9c5c9d0a50	ipn/ipnlocal, net/tsdial: make SOCKS/HTTP dials use ExitDNS ... And simplify, unexport some tsdial/netstack stuff in the the process. Fixes #3475 Change-Id: I186a5a5cbd8958e25c075b4676f7f6e70f3ff76e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	adc5997592	net/tsdial: give netstack a Dialer, start refactoring name resolution ... This starts to refactor tsdial.Dialer's name resolution to have different stages: in-memory MagicDNS vs system resolution. A future change will plug in ExitDNS resolution. This also plumbs a Dialer into netstack and unexports the dnsMap internals. And it removes some of the async AddNetworkMapCallback usage and replaces it with synchronous updates of the Dialer's netmap from LocalBackend, since the LocalBackend has the Dialer too. Updates #3475 Change-Id: Idcb7b1169878c74f0522f5151031ccbc49fe4cb4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d5405c66b7	net/tsdial: start of new package to unify all outbound dialing complexity ... For now this just deletes the net/socks5/tssocks implementation (and the DNSMap stuff from wgengine/netstack) and moves it into net/tsdial. Then initialize a Dialer early in tailscaled, currently only use for the outbound and SOCKS5 proxies. It will be plumbed more later. Notably, it needs to get down into the DNS forwarder for exit node DNS forwading in netstack mode. But it will also absorb all the peerapi setsockopt and netns Dial and tlsdial complexity too. Updates #1713 Change-Id: Ibc6d56ae21a22655b2fa1002d8fc3f2b2ae8b6df Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2ea765e5d8	go.mod: bump inet.af/netstack ... Updates #2642 (I'd hoped, but doesn't seem to fix it) Change-Id: Id54af7c90a1206bc7018215957e20e954782b911 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5dc5bd8d20	cmd/tailscaled, wgengine/netstack: always wire up netstack ... Even if not in use. We plan to use it for more stuff later. (not for iOS or macOS-GUIs yet; only tailscaled) Change-Id: Idaef719d2a009be6a39f158fd8f57f8cca68e0ee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	29a8fb45d3	wgengine/netstack: include DNS.ExtraRecords in DNSMap ... So SOCKS5 dialer can dial HTTPS cert names, for instance. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	83906abc5e	wgengine/netstack: clarify a comment ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1925fb584e	wgengine/netstack: fix crash in userspace netstack TCP forwarding ... Fixes #2658 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	95a9adbb97	wgengine/netstack: implement UDP relaying to advertised subnets ... TCP was done in 662fbd4a09. This does the same for UDP. Tested by hand. Integration tests will have to come later. I'd wanted to do it in this commit, but the SOCKS5 server needed for interop testing between two userspace nodes doesn't yet support UDP and I didn't want to invent some whole new userspace packet injection interface at this point, as SOCKS seems like a better route, but that's its own bug. Fixes #2302 RELNOTE=netstack mode can now UDP relay to subnets Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ecac74bb65	wgengine/netstack: fix doc comment ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	722859b476	wgengine/netstack: make SOCKS5 resolve names to IPv6 if self node when no IPv4 ... For instance, ephemeral nodes with only IPv6 addresses can now SOCKS5-dial out to names like "foo" and resolve foo's IPv6 address rather than foo's IPv4 address and get a "no route" (*tcpip.ErrNoRoute) error from netstack's dialer. Per https://github.com/tailscale/tailscale/issues/2268#issuecomment-870027626 which is only part of the isuse. Updates #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b92e2ebd24	wgengine/netstack: add Impl.DialContextUDP ... Unused so far, but eventually we'll want this for SOCKS5 UDP binds (we currently only do TCP with SOCKS5), and also for #2102 for forwarding MagicDNS upstream to Tailscale IPs over netstack. Updates #2102 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types ... This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	5b52b64094	tsnet: add Tailscale-as-a-library package ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b8fb8264a5	wgengine/netstack: avoid delivering incoming packets to both netstack + host ... The earlier eb06ec172f fixed the flaky SSH issue (tailscale/corp#1725) by making sure that packets addressed to Tailscale IPs in hybrid netstack mode weren't delivered to netstack, but another issue remained: All traffic handled by netstack was also potentially being handled by the host networking stack, as the filter hook returned "Accept", which made it keep processing. This could lead to various random racey chaos as a function of OS/firewalls/routes/etc. Instead, once we inject into netstack, stop our caller's packet processing. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	eb06ec172f	wgengine/netstack: don't pass non-subnet traffic to netstack in hybrid mode ... Fixes tailscale/corp#1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	eb2a9d4ce3	wgengine/netstack: log error when acceptUDP fails ... I see a bunch of these in some logs I'm looking at, separated only by a few seconds. Log the error so we can tell what's going on here. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Naman Sood	4a90a91d29	wgengine/netstack: log ForwarderRequest in readable form, only in debug mode (#1758) ... * wgengine/netstack: log ForwarderRequest in readable form, only in debug mode Fixes #1757 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	d488678fdc	cmd/tailscaled, wgengine{,/netstack}: add netstack hybrid mode, add to Windows ... For #707 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	31c7745631	wgengine/netstack: stop re-adding IPs registered by active TCP connections (#1629) ... Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Naman Sood	662fbd4a09	wgengine/netstack: Allow userspace networking mode to expose subnets (#1588) ... wgengine/netstack: Allow userspace networking mode to expose subnets Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
David Anderson	016de16b2e	net/tstun: rename TUN to Wrapper. ... The tstun packagen contains both constructors for generic tun Devices, and a wrapper that provides additional functionality. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	588b70f468	net/tstun: merge in wgengine/tstun. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	e2b3d9aa5f	all: s/Magic DNS/MagicDNS/ for consistency ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	aa79a57f63	wgengine/netstack: use inet.af/netstack, remove 64-bit only limitation ... This reverts the revert commit 84aba349d9. And changes us to use inet.af/netstack. Updates #1518 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	84aba349d9	Revert "wgengine/netstack: update gvisor to remove 64-bit only limitation" ... Breaks our corp repo due to gRPC dependency hell. This reverts commit d42f8b7f9a.	4 years ago
Brad Fitzpatrick	d42f8b7f9a	wgengine/netstack: update gvisor to remove 64-bit only limitation ... gVisor fixed their google/gvisor#1446 so we can include gVisor mode on 32-bit machines. A few minor upstream API changes, as normal. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	770aa71ffb	client, cmd/hello, ipn, wgengine: fix whois for netstack-forwarded connections ... Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Naman Sood	4c80344e27	wgengine/netstack: stop UDP forwarding when one side dies ... Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Naman Sood	7325b5a7ba	wgengine/netstack: add support for incoming UDP connections ... Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	f858b0d25f	wgengine/netstack: remove some v2 logging by default ... Even with [v2], it still logtails and takes time to format. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	d01c60dad5	wgengine/netstack: use system dialer to contact servers on localhost ... Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Naman Sood	95c03d1ead	wgengine/netstack: forward incoming connections to localhost ... Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	38dc6fe758	cmd/tailscaled, wgengine: remove --fake, replace with netstack ... And add a --socks5-server flag. And fix a race in SOCKS5 replies where the response header was written concurrently with the copy from the backend. Co-authored with Naman Sood. Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d74cddcc56	wgengine/netstack: add Magic DNS + DNS resolution to SOCKS5 dialing ... Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	fec9dcbda1	wgengine/netstack: start SOCKS5 server in netstack mode ... Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Naman Sood	517c90d7e5	wgengine, cmd/tailscaled: refactor netstack, forward TCP to hello as demo (#1301) ... Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	1e7a35b225	types/netmap: split controlclient.NetworkMap off into its own leaf package ... Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	420c7a35e2	wgengine/netstack: use tailscale IPs instead of a hardcoded one (#1131) ... Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Naman Sood	f69e46175d	wengine/netstack: bump gvisor to latest version ... * wengine/netstack: bump gvisor to latest version Signed-off-by: Naman Sood <naman@tailscale.com> * update dependencies Signed-off-by: Naman Sood <naman@tailscale.com> * Don't change hardcoded IP Signed-off-by: Naman Sood <naman@tailscale.com>	4 years ago
Brad Fitzpatrick	8b0112649a	wgengine/netstack: don't build netstack on 32-bit platforms ... See google/gvisor#5241	4 years ago
Brad Fitzpatrick	5aa5db89d6	cmd/tailscaled, wgengine/netstack: add start of gvisor userspace netstack work ... Not usefully functional yet (mostly a proof of concept), but getting it submitted for some work @namansood is going to do atop this. Updates #707 Updates #634 Updates #48 Updates #835	4 years ago