tailscale

Commit Graph

Author	SHA1	Message	Date
David Crawshaw	805d5d3cde	ipnlocal: move log line inside if statement Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	700badd8f8	util/deephash: move internal/deephash to util/deephash No code changes. Just a minor package doc addition about lack of API stability.	3 years ago
Josh Bleecher Snyder	f11a8928a6	ipn/ipnlocal: fix data race We can't access b.netMap without holding b.mu. We already grabbed it earlier in the function with the lock held. Introduced in Nov 2020 in `7ea809897d`. Discovered during stress testing. Apparently it's a pretty rare? Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Maisem Ali	ec52760a3d	wgengine/router_windows: support toggling local lan access when using exit nodes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
julianknodt	506c2fe8e2	cmd/tailscale: make netcheck use active DERP map, delete static copy After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	45e64f2e1a	net/dns{,/resolver}: refactor DNS forwarder, send out of right link on macOS/iOS Fixes #2224 Fixes tailscale/corp#2045 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	4ce15505cb	wgengine: randomize client port if netmap says to For testing out #2187 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	297b3d6fa4	staticcheck.conf: turn off noisy lint errors Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	0debb99f08	tailcfg: add DNSConfig.ExtraRecords Updates #1748 Updates #1235 Updates #2055 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	f482321f67	ipn/ipnlocal: support exit node local access switching on darwin. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	cd282ec00f	tailcfg: add DNSConfig.CertDomains Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cc6ab0a70f	ipn/ipnlocal: retry peerapi listen on Android, like we do on Windows Updates #1960 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e29cec759a	ipn/{ipnlocal,localapi}, control/controlclient: add SetDNS localapi Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ecfb2639cc	ipn/ipnlocal: avoid initPeerAPIListener crash on certain concurrent actions We were crashing on in initPeerAPIListener when called from authReconfig when b.netMap is nil. But authReconfig already returns before the call to initPeerAPIListener when b.netMap is nil, but it releases the b.mu mutex before calling initPeerAPIListener which reacquires it and assumes it's still nil. The only thing that can be setting it to nil is setNetMapLocked, which is called by ResetForClientDisconnect, Logout/logout, or Start, all of which can happen during an authReconfig. So be more defensive. Fixes #1996 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	713c5c9ab1	net/{interfaces,netns}: change which build tag means mac/ios Network/System Extension We used to use "redo" for that, but it was pretty vague. Also, fix the build tags broken in interfaces_default_route_test.go from `a9745a0b68`, moving those Linux-specific tests to interfaces_linux_test.go. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a321c24667	go.mod: update netaddr Involves minor IPSetBuilder.Set API change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Avery Pennarun	eaa6507cc9	ipnlocal: in Start() fast path, don't forget to send Prefs. The resulting empty Prefs had AllowSingleHosts=false and Routeall=false, so that on iOS if you did these steps: - Login and leave running - Terminate the frontend - Restart the frontend (fast path restart, missing prefs) - Set WantRunning=false - Set WantRunning=true ...then you would have Tailscale running, but with no routes. You would also accidentally disable the ExitNodeID/IP prefs (symptom: the current exit node setting didn't appear in the UI), but since nothing else worked either, you probably didn't notice. The fix was easy enough. It turns out we already knew about the problem, so this also fixes one of the BUG entries in state_test. Fixes: #1918 (BUG-1) and some as-yet-unreported bugs with exit nodes. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	8a7d35594d	ipnlocal: don't assume NeedsLogin immediately after StartLogout(). Previously, there was no server round trip required to log out, so when you asked ipnlocal to Logout(), it could clear the netmap immediately and switch to NeedsLogin state. In v1.8, we added a true Logout operation. ipn.Logout() would trigger an async cc.StartLogout() and also immediately switch to NeedsLogin. Unfortunately, some frontends would see NeedsLogin and immediately trigger a new StartInteractiveLogin() operation, before the controlclient auth state machine actually acted on the Logout command, thus accidentally invalidating the entire logout operation, retaining the netmap, and violating the user's expectations. Instead, add a new LogoutFinished signal from controlclient (paralleling LoginFinished) and, upon starting a logout, don't update the ipn state machine until it's received. Updates: #1918 (BUG-2) Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Brad Fitzpatrick	a04801e037	ipn/ipnlocal: ignore NetfilterMode pref on Synology On clean installs we didn't set use iptables, but during upgrades it looks like we could use old prefs that directed us to go into the iptables paths that might fail on Synology. Updates #1995 Fixes tailscale/tailscale-synology#57 (I think) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Elias Naur	adfe8cf41d	paths: generalize IOSSharedDir to cover Android Also fix an error message while here. Signed-off-by: Elias Naur <mail@eliasnaur.com>	4 years ago
David Anderson	df350e2069	ipn/ipnlocal: initialize DNS config maps unconditionally. Fixes #1963. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	e2dcf63420	net/dns: replace AuthoritativeSuffixes with nil Route entries. This leads to a cleaner separation of intent vs. implementation (Routes is now the only place specifying who handles DNS requests), and allows for cleaner expression of a configuration that creates MagicDNS records without serving them to the OS. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6690f86ef4	net/dns: always offer MagicDNS records at 100.100.100.100. Fixes #1886. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w(.)\.Port = (.) -> $1 = $1.WithPort($2) \w(.)\.IP = (.) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Avery Pennarun	6fd4e8d244	ipnlocal: fix switching users while logged in + Stopped. This code path is very tricky since it was originally designed for the "re-authenticate to refresh my keys" use case, which didn't want to lose the original session even if the refresh cycle failed. This is why it acts differently from the Logout(); Login(); case. Maybe that's too fancy, considering that it probably never quite worked at all, for switching between users without logging out first. But it works now. This was more invasive than I hoped, but the necessary fixes actually removed several other suspicious BUG: lines from state_test.go, so I'm pretty confident this is a significant net improvement. Fixes tailscale/corp#1756. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	285d0e3b4d	ipnlocal: fix deadlock in RequestEngineStatusAndWait() error path. If the engine was shutting down from a previous session (e.closing=true), it would return an error code when trying to get status. In that case, ipnlocal would never unblock any callers that were waiting on the status. Not sure if this ever happened in real life, but I accidentally triggered it while writing a test. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Brad Fitzpatrick	36a26e6a71	internal/deephash: rename from deepprint Yes, it printed, but that was an implementation detail for hashing. And coming optimization will make it print even less. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e72ed3fcc2	ipn/{ipnlocal,ipnstate}: add PeerStatus.ID stable ID to status --json output Needed for the "up checker" to map back from exit node stable IDs (the ipn.Prefs.ExitNodeID) back to an IP address in error messages. But also previously requested so people can use it to then make API calls. The upcoming "tailscale admin" subcommand will probably need it too. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	78d4c561b5	types/logger: add key grinder stats lines to rate-limiting exemption list Updates #1749 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Avery Pennarun	6d10655dc3	ipnlocal: accept a new opts.UpdatePrefs field. This is needed because the original opts.Prefs field was at some point subverted for use in frontend->backend state migration for backward compatibility on some platforms. We still need that feature, but we also need the feature of providing the full set of prefs from `tailscale up`, not including overwriting the prefs.Persist keys, so we can't use the original field from `tailscale up`. `tailscale up` had attempted to compensate for that by doing SetPrefs() before Start(), but that violates the ipn.Backend contract, which says you should call Start() before anything else (that's why it's called Start()). As a result, doing SetPrefs({ControlURL=..., WantRunning=true}) would cause a connection to the previous control server (because WantRunning=true), and then connect to the new control server only after running Start(). This problem may have been avoided before, but only by pure luck. It turned out to be relatively harmless since the connection to the old control server was immediately closed and replaced anyway, but it created a race condition that could have caused spurious notifications or rejected keys if the server responded quickly. As already covered by existing TODOs, a better fix would be to have Start() get out of the business of state migration altogether. But we're approaching a release so I want to make the minimum possible fix. Fixes #1840. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Brad Fitzpatrick	4066c606df	ipn/ipnlocal: update peerapi logging of received PUTs Clarify direction and add duration. (per chat with Avery) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f5bccc0746	ipn/ipnlocal: redact more errors Updates tailscale/corp#1636 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	96ef8d34ef	ipn/ipnlocal: switch from testify to quicktest Per discussion, we want to have only one test assertion library, and we want to start by exploring quicktest. This was a mostly mechanical translation. I think we could make this nicer by defining a few helper closures at the beginning of the test. Later. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Brad Fitzpatrick	544d8d0ab8	ipn/ipnlocal: remove NewLocalBackendWithClientGen This removes the NewLocalBackendWithClientGen constructor added in `b4d04a065f` and instead adds LocalBackend.SetControlClientGetterForTesting, mirroring LocalBackend.SetHTTPTestClient. NewLocalBackendWithClientGen was weird in being exported but taking an unexported type. This was noted during code review: https://github.com/tailscale/tailscale/pull/1818#discussion_r623155669 which ended in: "I'll leave it for y'all to clean up if you find some way to do it elegantly." This is more idiomatic. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Avery Pennarun	0181a4d0ac	ipnlocal: don't pause the controlclient until we get at least one netmap. Without this, macOS would fail to display its menu state correctly if you started it while !WantRunning. It relies on the netmap in order to show the logged-in username. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	4ef207833b	ipn: !WantRunning + !LoggedOut should not be idle on startup. There was logic that would make a "down" tailscale backend (ie. !WantRunning) refuse to do any network activity. Unfortunately, this makes the macOS and iOS UI unable to render correctly if they start while !WantRunning. Now that we have Prefs.LoggedOut, use that instead. So `tailscale down` will still allow the controlclient to connect its authroutine, but pause the maproutine. `tailscale logout` will entirely stop all activity. This new behaviour is not obviously correct; it's a bit annoying that `tailsale down` doesn't terminate all activity like you might expect. Maybe we should redesign the UI code to render differently when disconnected, and then revert this change. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	4f3315f3da	ipnlocal: setting WantRunning with EditPrefs was special. EditPrefs should be just a wrapper around the action of changing prefs, but someone had added a side effect of calling Login() sometimes. The side effect happened after running the state machine, which would sometimes result in us going into NeedsLogin immediately before calling cc.Login(). This manifested as the macOS app not being able to Connect if you launched it with LoggedOut=false and WantRunning=false. Trying to Connect() would sent us to the NeedsLogin state instead. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	2a4d1cf9e2	Add prefs.LoggedOut to fix several state machine bugs. Fixes: tailscale/corp#1660 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	b0382ca167	ipn/ipnlocal: some state_test cleanups. This doesn't change the actual functionality. Just some additional comments and fine tuning. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	ac9cd48c80	ipnlocal: fix deadlock when calling Shutdown() from Start(). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	ecdba913d0	Revert "ipn/ipnlocal: be authoritative for the entire MagicDNS record tree." Unfortunately this broke MagicDNS almost entirely. Updates: tailscale/corp#1706 This reverts commit `1d7e7b49eb`.	4 years ago
Avery Pennarun	b7e31ab1a4	ipn: mock controlclient.Client; big ipn.Backend state machine test. A very long unit test that verifies the way the controlclient and ipn.Backend interact. This is a giant sequential test of the state machine. The test passes, but only because it's asserting all the wrong behaviour. I marked all the behaviour I think is wrong with BUG comments, and several additional test opportunities with TODO. Note: the new test supercedes TestStartsInNeedsLoginState, which was checking for incorrect behaviour (although the new test still checks for the same incorrect behaviour) and assumed .Start() would converge before returning, which it happens to do, but only for this very specific case, for the current implementation. You're supposed to wait for the notifications. Updates: tailscale/corp#1660 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	b4d04a065f	controlclient: extract a Client interface and rename Client->Auto. This will let us create a mock or fake Client implementation for use with ipn.Backend. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
David Anderson	1d7e7b49eb	ipn/ipnlocal: be authoritative for the entire MagicDNS record tree. With this change, shared node names resolve correctly on split DNS-supporting operating systems. Fixes tailscale/corp#1706 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	b7a497a30b	ipn/ipnlocal: make FileTargets check IPN state first Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4bf6939ee0	ipn/ipnlocal: remove t.Parallel from recently added test The test modifies a global; it shouldn't be parallel. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a48c8991f1	ipn/ipnlocal: add a test for earlier lazy machine key generation change Updates #1573 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	306a094d4b	ipn/ipnlocal: remove IPv6 records from MagicDNS. Fixes #1813. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	3bdc9e9cb2	ipn/ipnlocal: prevent a now-expected [unexpected] log message on Windows Updates #1620 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	138921ae40	ipn/ipnlocal: always write files to partial files, even in buffered mode The intention was always that files only get written to .partial files and renamed at the end once fully received, but somewhere in the process that got lost in buffered mode and .partial files were only being used in direct receive mode. This fix prevents WaitingFiles from returning files that are still being transferred. Updates tailscale/corp#1626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago

1 2 3 4

163 Commits (440566c5d27eef67b402830a01034e57704f37cf)