333 Commits (4451a7c3643bc7375b26f6f00952131f5fb64446)

Author	SHA1	Message	Date
Brad Fitzpatrick	aaf2df7ab1	net/{dnscache,interfaces}: use netaddr.IP.IsPrivate, delete copied code ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Christine Dodrill	798b0da470	tstest/integration/vms: codegen for top level tests (#2441) ... This moves the distribution definitions into a maintainable hujson file instead of just existing as constants in `distros.go`. Comments are maintained from the inline definitions. This uses jennifer[1] for hygenic source tree creation. This allows us to generate a unique top-level test for each VM run. This should hopefully help make the output of `go test` easier to read. This also separates each test out into its own top-level test so that we can better track the time that each distro takes. I really wish there was a way to have the `test_codegen.go` file _always_ run as a part of the compile process instead of having to rely on people remembering to run `go generate`, but I am limited by my tools. This will let us remove the `-distro-regex` flag and use `go test -run` to pick which distros are run. Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
julianknodt	1bb6abc604	net/portmapper: add upnp port mapping ... Add in UPnP portmapping, using goupnp library in order to get the UPnP client and run the portmapping functions. This rips out anywhere where UPnP used to be in portmapping, and has a flow separate from PMP and PCP. RELNOTE=portmapper now supports UPnP mappings Fixes #682 Updates #2109 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	1cedd944cf	cmd/tailscale/cli: diagnose missing tailscaled on 'up' ... Fixes #2029 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1072397375	go.mod: bump wireguard/windows to a version that still exists ... Fixes #2381 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	38be964c2b	go.mod: update netstack ... Fixes a atomic alignment crash on 32-bit machines. Fixes #2129 Fixes tailscale/tailscale-synology#66 (same) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Matt Layher	6956645ec8	go.mod: bump github.com/mdlayher/netlink to v1.4.1 ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	3 years ago
Christine Dodrill	622dc7b093	tstest/integration/vms: download images from s3 (#2035) ... This makes integration tests pull pristine VM images from Amazon S3 if they don't exist on disk. If the S3 fetch fails, it will fall back to grabbing the image from the public internet. The VM images on the public internet are known to be updated without warning and thusly change their SHA256 checksum. This is not ideal for a test that we want to be able to fire and forget, then run reliably for a very long time. This requires an AWS profile to be configured at the default path. The S3 bucket is rigged so that the requester pays. The VM images are currently about 6.9 gigabytes. Please keep this in mind when running these tests on your machine. Documentation was added to the integration test folder to aid others in running these tests on their machine. Some wording in the logs of the tests was altered. Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Brad Fitzpatrick	a321c24667	go.mod: update netaddr ... Involves minor IPSetBuilder.Set API change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Christine Dodrill	14c1113d2b	tstest/integration/vms: copy locally built binaries (#2006) ... Instead of pulling packages from pkgs.tailscale.com, we should use the tailscale binaries that are local to this git commit. This exposes a bit of the integration testing stack in order to copy the binaries correctly. This commit also bumps our version of github.com/pkg/sftp to the latest commit. If you run into trouble with yaml, be sure to check out the commented-out alpine linux image complete with instructions on how to use it. Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Adrian Dewhurst	6d6cf88d82	control/controlclient: use our fork of certstore ... The cyolosecurity fork of certstore did not update its module name and thus can only be used with a replace directive. This interferes with installing using `go install` so I created a tailscale fork with an updated module name. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago
Christine Dodrill	ba59c0391b	tstest/integration: add experimental integration test (#1966) ... This will spin up a few vms and then try and make them connect to a testcontrol server. Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>	4 years ago
Josh Bleecher Snyder	1ece91cede	go.mod: upgrade wireguard-windows, de-fork wireguard-go ... Pull in the latest version of wireguard-windows. Switch to upstream wireguard-go. This requires reverting all of our import paths. Unfortunately, this has to happen at the same time. The wireguard-go change is very low risk, as that commit matches our fork almost exactly. (The only changes are import paths, CI files, and a go.mod entry.) So if there are issues as a result of this commit, the first place to look is wireguard-windows changes. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	a86a0361a7	go.mod: upgrade all deps ... At the start of a dev cycle we'll upgrade all dependencies. Done with: $ for Dep in $(cat go.mod | perl -ne '/(\S+) v/ and print "$1\n"'); do go get $Dep@upgrade; done Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	8bf2a38f29	go.mod: update wireguard-go, taking control over iOS memory usage from our fork ... Our wireguard-go fork used different values from upstream for package device's memory limits on iOS. This was the last blocker to removing our fork. These values are now vars rather than consts for iOS. c27ff9b9f6 Adjust them on startup to our preferred values. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	eb9757a290	go.mod: upgrade netaddr to get AppendTo methods ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	85df1b0fa7	go.mod: bump wireguard-go. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types ... This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	cb97062bac	go.mod: bump inet.af/netaddr ... For IPPort.MarshalText optimizations. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	d82b28ba73	go.mod: bump wireguard-go	4 years ago
Josh Bleecher Snyder	c0a70f3a06	go.mod: pull in wintun alignment fix from upstream wireguard-go ... 6cd106ab13...030c638da3 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Maisem Ali	7027fa06c3	wf: implement windows firewall using inet.af/wf. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	3173c5a65c	net/interface: remove darwin fetchRoutingTable workaround ... Fixed upstream. Bump dep. Updates #1345 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	96ef8d34ef	ipn/ipnlocal: switch from testify to quicktest ... Per discussion, we want to have only one test assertion library, and we want to start by exploring quicktest. This was a mostly mechanical translation. I think we could make this nicer by defining a few helper closures at the beginning of the test. Later. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
David Anderson	bf5fc8edda	go.mod: update wireguard-go. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	ae36b57b71	go.mod: upgrade wireguard-go ... This should be the last bump before 1.8. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Brad Fitzpatrick	8efc7834f2	go.mod: bump wireguard-go ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	5ecc7c7200	cmd/tailscale: make the new 'up' errors prettier and more helpful ... Fixes #1746 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	f72a120016	go.mod: upgrade to latest wireguard-go ... Pull in minor upstream changes. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Josh Bleecher Snyder	7183e1f052	go.mod: update wireguard-go again ... To pick up https://go-review.googlesource.com/c/sys/+/307129. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	63c00764e1	go.mod: update to latest wireguard-go and x/sys ... To fix windows checkptr failures. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	b3ceca1dd7	wgengine/...: split into multiple receive functions ... Upstream wireguard-go has changed its receive model. NewDevice now accepts a conn.Bind interface. The conn.Bind is stateless; magicsock.Conns are stateful. To work around this, we add a connBind type that supports cheap teardown and bring-up, backed by a Conn. The new conn.Bind allows us to specify a set of receive functions, rather than having to shoehorn everything into ReceiveIPv4 and ReceiveIPv6. This lets us plumbing DERP messages directly into wireguard-go, instead of having to mux them via ReceiveIPv4. One consequence of the new conn.Bind layer is that closing the wireguard-go device is now indistinguishable from the routine bring-up and tear-down normally experienced by a conn.Bind. We thus have to explicitly close the magicsock.Conn when the close the wireguard-go device. One downside of this change is that we are reliant on wireguard-go to call receiveDERP to process DERP messages. This is fine for now, but is perhaps something we should fix in the future. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1df162b05b	wgengine/magicsock: adapt CreateEndpoint signature to match wireguard-go ... Part of a temporary change to make merging wireguard-go easier. See https://github.com/tailscale/wireguard-go/pull/45. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	47363c95b0	go.mod: bump wireguard-go	4 years ago
Brad Fitzpatrick	a7be780155	go.mod, go.sum: bump wireguard-go	4 years ago
David Anderson	95ca86c048	go.mod: update to new wireguard-go version. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Adrian Dewhurst	04dd6d1dae	control/controlclient: sign RegisterRequest (#1549) ... control/controlclient: sign RegisterRequest Some customers wish to verify eligibility for devices to join their tailnets using machine identity certificates. TLS client certs could potentially fulfill this role but the initial customer for this feature has technical requirements that prevent their use. Instead, the certificate is loaded from the Windows local machine certificate store and uses its RSA public key to sign the RegisterRequest message. There is room to improve the flexibility of this feature in future and it is currently only tested on Windows (although Darwin theoretically works too), but this offers a reasonable starting place for now. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago
Josh Bleecher Snyder	28af46fb3b	wgengine: pass logger as a separate arg to device.NewDevice ... Adapt to minor API changes in wireguard-go. And factor out device.DeviceOptions variables. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	79f02de55f	go.sum: add entries for upstream wireguard-go ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	0a02aaf813	control, ipn, tailcfg: remove golang.org/x/oauth2 dep, add tailcfg.Oauth2Token ... golang.org/x/oauth2 pulls in App Engine and grpc module dependencies, screwing up builds that depend on this module. Some background on the problem: https://go.googlesource.com/proposal/+/master/design/36460-lazy-module-loading.md Fixes tailscale/corp#1471 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	aa79a57f63	wgengine/netstack: use inet.af/netstack, remove 64-bit only limitation ... This reverts the revert commit 84aba349d9. And changes us to use inet.af/netstack. Updates #1518 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a217078f67	go.mod: update golang.org/x/oauth2 ... go.sum gets a bit wild, but tolerable. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ec1b31ea83	go.mod: update golang.org/x/{crypto,sync,sys,term,time} ... These ones don't have large dependency trees. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a4fa2c5611	go.mod, go.sum: go mod tidy ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	84aba349d9	Revert "wgengine/netstack: update gvisor to remove 64-bit only limitation" ... Breaks our corp repo due to gRPC dependency hell. This reverts commit d42f8b7f9a.	4 years ago
Brad Fitzpatrick	d42f8b7f9a	wgengine/netstack: update gvisor to remove 64-bit only limitation ... gVisor fixed their google/gvisor#1446 so we can include gVisor mode on 32-bit machines. A few minor upstream API changes, as normal. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Denton Gentry	6756f20632	go.mod: update peercred ... Adds FreeBSD support. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
David Anderson	b83c273737	wgengine/filter: use IPSet for localNets instead of prefixes. ... Part of #1177, preparing for doing fancier set operations on the allowed local nets. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Matt Layher	2c500cee23	go.mod: bump github.com/mdlayher/netlink, github.com/jsimonetti/rtnetlink ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Filippo Valsorda	39f7a61e9c	tstest/staticcheck: import the main package to fix "go mod tidy" ... Importing the non-main package was missing some dependencies that "go mod tidy" would then cleanup. Also added a non-ignore build tag to avoid other tools getting upset about importing a main package. Signed-off-by: Filippo Valsorda <hi@filippo.io>	4 years ago
Filippo Valsorda	87f2e4c12c	go.mod: bump github.com/kr/pty to build on openbsd/arm64 ... $ GOOS=openbsd GOARCH=arm64 go install tailscale.com/cmd/...@latest pkg/mod/github.com/kr/pty@v1.1.4-0.20190131011033-7dc38fb350b1/pty_openbsd.go:24:10: undefined: ptmget pkg/mod/github.com/kr/pty@v1.1.4-0.20190131011033-7dc38fb350b1/pty_openbsd.go:25:34: undefined: ioctl_PTMGET "go mod tidy" did some unrelated work in go.sum, maybe because it was not run with Go 1.16 before. Signed-off-by: Filippo Valsorda <hi@filippo.io>	4 years ago
Brad Fitzpatrick	d3efe8caf6	safesocket, ipn/ipnserver: look up peer creds on Darwin ... And open up socket permissions like Linux, now that we know who connections are from. This uses the new inet.af/peercred that supports Linux and Darwin at the moment. Fixes #1347 Fixes #1348 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	11bbfbd8bb	go.mod: update to latest wireguard-go ... All changes are trivial.	4 years ago
Josh Bleecher Snyder	1f0fa8b814	go.mod: pull in upstream wireguard-go bug fixes	4 years ago
Josh Bleecher Snyder	4a82e36491	go.mod: bump to latest wireguard-go ... Stabilization and performance improvements.	4 years ago
Josh Bleecher Snyder	aa6856a9eb	wgengine: adapt to wireguard-go changes ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	dd10babaed	wgenginer/magicsock: remove Addrs methods ... They are now unused. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	fe7c3e9c17	all: move wgcfg from wireguard-go ... This is mostly code movement from the wireguard-go repo. Most of the new wgcfg package corresponds to the wireguard-go wgcfg package. wgengine/wgcfg/device{_test}.go was device/config{_test}.go. There were substantive but simple changes to device_test.go to remove internal package device references. The API of device.Config (now wgcfg.DeviceConfig) grew an error return; we previously logged the error and threw it away. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	daf2c70a08	go.mod: bump wireguard-go	4 years ago
Brad Fitzpatrick	c78ed5b399	go.sum: update (forgotten after earlier wireguard-go update again)	4 years ago
Brad Fitzpatrick	3ac952d4e9	go.sum: update	4 years ago
Brad Fitzpatrick	b00c0e5f60	go.sum: update	4 years ago
Brad Fitzpatrick	f85769b1ed	wgengine/magicsock: drop netaddr.IPPort cache ... netaddr.IP no longer allocates, so don't need a cache or all its associated code/complexity. This totally removes groupcache/lru from the deps. Also go mod tidy.	4 years ago
Naman Sood	f69e46175d	wengine/netstack: bump gvisor to latest version ... * wengine/netstack: bump gvisor to latest version Signed-off-by: Naman Sood <naman@tailscale.com> * update dependencies Signed-off-by: Naman Sood <naman@tailscale.com> * Don't change hardcoded IP Signed-off-by: Naman Sood <naman@tailscale.com>	4 years ago
Brad Fitzpatrick	5aa5db89d6	cmd/tailscaled, wgengine/netstack: add start of gvisor userspace netstack work ... Not usefully functional yet (mostly a proof of concept), but getting it submitted for some work @namansood is going to do atop this. Updates #707 Updates #634 Updates #48 Updates #835	4 years ago
Brad Fitzpatrick	a4cc31e7d8	go.sum: update	4 years ago
David Anderson	8fc11d582d	go.sum: update to match wireguard-go version update. ... Signed-off-by: David Anderson <dave@natulte.net>	4 years ago
David Anderson	86fe22a1b1	Update netaddr, and adjust wgengine/magicsock due to API change. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package ... This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	c2edb2865b	go.sum: update	4 years ago
Josh Bleecher Snyder	cf2ac2d123	go.mod: upgrade inet.af/netaddr ... To pick up IPPrefix.Contains fix.	4 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Matt Layher	bfbd6b9241	go.mod: bump github.com/mdlayher/netlink to v1.2.0 ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Brad Fitzpatrick	d0baece5fa	go.mod: bump inet.af/netaddr to non-allocating version	4 years ago
Brad Fitzpatrick	90c8519765	go.sum: update	4 years ago
David Anderson	f5e33ad761	go.mod: update inet.af/netaddr, go mod tidy. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	fa412c8760	wgengine/filter, wgengine/magicsock: use new IP.BitLen to simplify some code	4 years ago
Brad Fitzpatrick	afcf134812	wgengine/filter, tailcfg: support CIDRs+ranges in PacketFilter (mapver 7) ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	2485faf69a	Merge branch 'main' into report-status-systemd	4 years ago
Christine Dodrill	7ea809897d	ipn/ipnserver: enable systemd-notify support ... Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>	4 years ago
Josh Bleecher Snyder	ce4d68b416	go.mod: upgrade depaware version ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	a6cad71fb2	go.mod: upgrade staticcheck to 0.1.0 ... Also run go.mod and fix some staticcheck warnings. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	6db9c4a173	wgenginer/router/dns: use constant from golang.org/x/sys/windows ... Made available in https://golang.org/cl/277153	4 years ago
Aleksandar Pesic	338fd44657	Replace registry-access code, update wireguard-go and x/sys/windows. ... Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Brad Fitzpatrick	bce865b61b	logpolicy: migrate from x/crypto/ssh/terminal to x/term	4 years ago
Brad Fitzpatrick	9cb6ee3777	go.mod, go.sum: update	4 years ago
Brad Fitzpatrick	19c2c6403d	Update go.sum	4 years ago
Josh Bleecher Snyder	aa9d7f4665	tstime: add Parse3339B, for byte slices ... Use go4.org/mem for memory safety. A slight performance hit, but a huge performance win for clients who start with a []byte. The perf hit is due largely to the MapHash call, which adds ~25ns. That is necessary to keep the fast path allocation-free. name old time/op new time/op delta GoParse3339/Z-8 281ns ± 1% 283ns ± 2% ~ (p=0.366 n=9+9) GoParse3339/TZ-8 509ns ± 0% 510ns ± 1% ~ (p=0.059 n=9+9) GoParse3339InLocation-8 330ns ± 1% 330ns ± 0% ~ (p=0.802 n=10+6) Parse3339/Z-8 69.3ns ± 1% 74.4ns ± 1% +7.45% (p=0.000 n=9+10) Parse3339/TZ-8 110ns ± 1% 140ns ± 3% +27.42% (p=0.000 n=9+10) ParseInt-8 8.20ns ± 1% 8.17ns ± 1% ~ (p=0.452 n=9+9) name old alloc/op new alloc/op delta GoParse3339/Z-8 0.00B 0.00B ~ (all equal) GoParse3339/TZ-8 160B ± 0% 160B ± 0% ~ (all equal) GoParse3339InLocation-8 0.00B 0.00B ~ (all equal) Parse3339/Z-8 0.00B 0.00B ~ (all equal) Parse3339/TZ-8 0.00B 0.00B ~ (all equal) name old allocs/op new allocs/op delta GoParse3339/Z-8 0.00 0.00 ~ (all equal) GoParse3339/TZ-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) GoParse3339InLocation-8 0.00 0.00 ~ (all equal) Parse3339/Z-8 0.00 0.00 ~ (all equal) Parse3339/TZ-8 0.00 0.00 ~ (all equal) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	7a01cd27ca	net/netstat: remove some unsafe ... Just removing any unnecessary unsafe while auditing unsafe usage for #921.	4 years ago
Brad Fitzpatrick	cccdd81441	go.mod: update some deps to get past a wireguard-windows checkptr fix	4 years ago
David Anderson	ce45f4f3ff	wgengine/filter: inline ip6InList into match. ... matchIPsOnly gets 5% slower when inlining, despite significantly reduced memory ops and slightly tighter code. Part of #19. Filter/tcp6_syn_in-8 45.5ns ± 1% 42.4ns ± 2% -6.86% (p=0.000 n=10+10) Filter/udp6_in-8 107ns ± 2% 94ns ± 2% -11.50% (p=0.000 n=9+10) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
chungdaniel	e7ac9a4b90	tsweb: refactor JSONHandler to take status code from error if it is present (#905) ... This change is to make JSONHandler error handling intuitive, as before there would be two sources of HTTP status code when HTTPErrors were generated: one as the first return value of the handler function, and one nested inside the HTTPError. Previously, it took the first return value as the status code, and ignored the code inside the HTTPError. Now, it should expect the first return value to be 0 if there is an error, and it takes the status code of the HTTPError to set as the response code. Signed-off-by: Daniel Chung <daniel@tailscale.com>	4 years ago
Brad Fitzpatrick	f33da73a82	go.sum: update	4 years ago
Brad Fitzpatrick	371f1a9502	go.sum: add a missing entry that Go keeps adding	4 years ago
Alex Brainman	f2ce64f0c6	wgengine/router: unfork winipcfg-go package, use upstream ... Use golang.zx2c4.com/wireguard/windows/tunnel/winipcfg instead of github.com/tailscale/winipcfg-go package. Updates #760 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	4 years ago
Avery Pennarun	6332bc5e08	controlclient: print http errors if result code != 200. ... Turns out for the particular error I was chasing, it actually returns 200 and zero data. But this code mirrors the same check in the map poll, and is the right thing to do in the name of future debugging. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Josh Bleecher Snyder	a5103a4cae	all: upgrade to latest version of depaware	4 years ago
Brad Fitzpatrick	94a68a113b	go.sum: tidy	4 years ago
Brad Fitzpatrick	ec95e901e6	go.sum: update	4 years ago
Brad Fitzpatrick	56a787fff8	go.mod, go.sum: bump wireguard-go	4 years ago
Christina Wen	f0e9dcdc0a	wgengine/router: restore /etc/resolv.conf after tailscale down is called ... This change is to restore /etc/resolv.conf after tailscale down is called. This is done by setting the dns.Manager before errors occur. Error collection is also added. Fixes #723	4 years ago
Brad Fitzpatrick	3aeb2e204c	go.mod: bump github.com/tailscale/winipcfg-go for some Windows fixes	4 years ago
Josh Bleecher Snyder	3f4d93feb2	go.mod: bump depaware to get diffs out of -check, again ... I had to use go get -u github.com/tailscale/depaware@e09ee10c18249e4bf198e66bbd47babcd502637a to force it to the correct version; it kept selecting head~1. Maybe because the branch is called main instead of master? Maybe because of some delay?	4 years ago
Josh Bleecher Snyder	41f6c78c53	go.mod: bump depaware to get diffs out of -check	4 years ago
Brad Fitzpatrick	158202dbb1	go mod tidy	4 years ago
Brad Fitzpatrick	22ed3c503e	Add depaware.txt files and GitHub checks. (#745) ... See https://github.com/tailscale/depaware Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	82a3721661	go.sum: update	4 years ago
Brad Fitzpatrick	f915ab6552	net/tshttpproxy: add start of Kerberos Negotiate auth to proxies on Windows ... For now only used by a new cmd/tailscale debug --get-url subcommand. Not yet wired up to the places making HTTP requests. Updates tailscale/corp#583	4 years ago
Brad Fitzpatrick	c5eb57f4d6	net/tshttpproxy: new package, support WPAD/PAC proxies on Windows ... Updates tailscale/corp#553 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	1b5b59231b	derp: break down received packets by kind (disco vs. wireguard). ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	87cbc067c2	cmd/tailscale/cli: validate advertised routes' IP address-vs-network bits ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b840e7dd5b	go mod tidy	4 years ago
Josh Bleecher Snyder	1b27eb431a	go.mod: update to newly rebased wireguard-go	4 years ago
Brad Fitzpatrick	84f2320972	go.sum: update	4 years ago
Brad Fitzpatrick	43e2efe441	go mod tidy	4 years ago
Brad Fitzpatrick	648268192b	go.mod: bump wireguard-go	4 years ago
Brad Fitzpatrick	7cf50f6c84	go.sum: update	4 years ago
Dmytro Shynkevych	3efc29d39d	go.mod: bump netaddr. ... Closes #567. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	cdfea347d0	wgengine: update for tailscale/wireguard-go API changes ... * update to new HandshakeDone signature * use new Device.IpcGetOperationFiltered call to avoid sending allowed_ips See dd6c1c8fe1	4 years ago
Dmytro Shynkevych	30bbbe9467	wgengine/router: dns: unify on *BSD, multimode on Linux, Magic DNS (#536) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	6c74065053	wgengine/magicsock, tstest/natlab: start hooking up natlab to magicsock ... Also adds ephemeral port support to natlab. Work in progress. Pairing with @danderson.	4 years ago
Brad Fitzpatrick	edcbb5394e	go.sum: update	4 years ago
Dmytro Shynkevych	21d1dbfce0	wgengine/tsdns: local DNS server for testing ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	67ebba90e1	tsdns: dual resolution mode, IPv6 support (#526) ... This change adds to tsdns the ability to delegate lookups to upstream nameservers. This is crucial for setting Magic DNS as the system resolver. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	32156330a8	net/interfaces: add func LikelyHomeRouterIP ... For discovering where we might direct NAT-PMP/PCP/UPnP queries at in the future.	4 years ago
Brad Fitzpatrick	b9a95e6ce1	go.sum: add missing lines	4 years ago
Brad Fitzpatrick	7883e5c5e7	go.mod: restore staticcheck module, make it stick around, go mod tidy ... It kept coming & going as different people ran go mod tidy and others ran staticcheck. Make it stop going away with go mod tidy by adding a dep to it.	4 years ago
David Anderson	9cd4e65191	smallzstd: new package that constructs zstd small encoders/decoders. ... It's just a config wrapper that passes "use less memory at the expense of compression" parameters by default, so that we don't accidentally construct resource-hungry (de)compressors. Also includes a benchmark that measures the memory cost of the small variants vs. the stock variants. The savings are significant on both compressors (~8x less memory) and decompressors (~1.4x less, not including the savings from the significantly smaller window on the compression side - with those savings included it's more like ~140x smaller). BenchmarkSmallEncoder-8 56174 19354 ns/op 31 B/op 0 allocs/op BenchmarkSmallEncoderWithBuild-8 2900 382940 ns/op 1746547 B/op 36 allocs/op BenchmarkStockEncoder-8 48921 25761 ns/op 286 B/op 0 allocs/op BenchmarkStockEncoderWithBuild-8 426 2630241 ns/op 13843842 B/op 124 allocs/op BenchmarkSmallDecoder-8 123814 9344 ns/op 0 B/op 0 allocs/op BenchmarkSmallDecoderWithBuild-8 41547 27455 ns/op 27694 B/op 31 allocs/op BenchmarkStockDecoder-8 129832 9417 ns/op 1 B/op 0 allocs/op BenchmarkStockDecoderWithBuild-8 25561 51751 ns/op 39607 B/op 92 allocs/op Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	a477e70632	tstest/natlab: network address allocation ... Pairing with @danderson	4 years ago
Brad Fitzpatrick	77d3ef36f4	wgengine/magicsock: hook up discovery messages, upgrade to LAN works ... Ping messages now go out somewhat regularly, pong replies are sent, and pong replies are now partially handled enough to upgrade off DERP to LAN. CallMeMaybe packets are sent & received over DERP, but aren't yet handled. That's next (and regular maintenance timers), and then WAN should work. Updates #483	4 years ago
Brad Fitzpatrick	9b8ca219a1	wgengine/magicsock: remove allocs in UDP write, use new netaddr.PutUDPAddr ... The allocs were only introduced yesterday with a TODO. Now they're gone again.	4 years ago
Brad Fitzpatrick	eb4eb34f37	disco: new package for parsing & marshaling discovery messages ... Updates #483	4 years ago
Brad Fitzpatrick	d9054da86a	wgengine: disambiguate Reconfig logging paths	4 years ago
Brad Fitzpatrick	6757c990a8	Fix staticcheck warning, add Makefile with staticcheck targets, lock in staticcheck version in go.mod	4 years ago
Brad Fitzpatrick	722673f307	Update go4.org/mem, adjust to revised API.	5 years ago
Brad Fitzpatrick	c5495288a6	Bump inet.af/netaddr dep for FromStdIP behavior change I want to depend on.	5 years ago
Brad Fitzpatrick	e6b84f2159	all: make client use server-provided DERP map, add DERP region support ... Instead of hard-coding the DERP map (except for cmd/tailscale netcheck for now), get it from the control server at runtime. And make the DERP map support multiple nodes per region with clients picking the first one that's available. (The server will balance the order presented to clients for load balancing) This deletes the stunner package, merging it into the netcheck package instead, to minimize all the config hooks that would've been required. Also fix some test flakes & races. Fixes #387 (Don't hard-code the DERP map) Updates #388 (Add DERP region support) Fixes #399 (wgengine: flaky tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	35a8586f7e	go.sum: go mod tidy	5 years ago
Wendi Yu	bb55694c95	wgengine: log node IDs when peers are added/removed (#381) ... Also stop logging data sent/received from nodes we're not connected to (ie all those `x`s being logged in the `peers: ` line) Signed-off-by: Wendi <wendi.yu@yahoo.ca>	5 years ago
halulu	874be6566d	netcheck: DERP latency over HTTPS when UDP is blocked ... * netcheck: DERP letency over HTTPS when UDP failed Updates #207 Signed-off-by: Zijie Lu <zijie@tailscale.com> * netcheck: async DERP latency check over HTTPS Updates #207 Signed-off-by: Zijie Lu <zijie@tailscale.com> * netcheck: DERP latency check over HTTPS: fix concurrent map Updates #207 Signed-off-by: Zijie Lu <zijie@tailscale.com> * netcheck: DERP latency check over HTTPS: some improvements Updates #207 Signed-off-by: Zijie Lu <zijie@tailscale.com> * netcheck: DERP latency check over HTTPS: use timeout context Updates #207 Signed-off-by: Zijie Lu <zijie@tailscale.com> * netcheck: DERP latency check over HTTPS: use report mutex Updates #207 Signed-off-by: Zijie Lu <zijie@tailscale.com> * netcheck: DERP latency check over HTTPS if UDP is BLOCKED Updates #207 Signed-off-by: Zijie Lu <zijie@tailscale.com> * netcheck: DERP latency check over HTTPS: new function measureHTTPSLatency Updates #207 Signed-off-by: Zijie Lu <zijie@tailscale.com>	5 years ago
David Anderson	b01db109f5	wgengine/router: use inet.af/netaddr, not wgcfg.CIDR. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Elias Naur	0068e57407	go.mod,go.sum: bump golang.org/x/sys for the Android dup2 fix ... No tidy, because it doesn't work for me: $ go mod tidy go: finding module for package tailscale.io/control go: finding module for package tailscale.io/control/cfgdb tailscale.com/control/controlclient tested by tailscale.com/control/controlclient.test imports tailscale.io/control: cannot find module providing package tailscale.io/control: unrecognized import path "tailscale.io/control": parse https://tailscale.io/control?go-get=1: no go-import meta tags (meta tag tailscale.com did not match import path tailscale.io/control) tailscale.com/control/controlclient tested by tailscale.com/control/controlclient.test imports tailscale.io/control/cfgdb: cannot find module providing package tailscale.io/control/cfgdb: unrecognized import path "tailscale.io/control/cfgdb": parse https://tailscale.io/control/cfgdb?go-get=1: no go-import meta tags (meta tag tailscale.com did not match import path tailscale.io/control/cfgdb) Signed-off-by: Elias Naur <mail@eliasnaur.com>	5 years ago
Brad Fitzpatrick	1a0f6fea58	go.mod, go.sum: bump wireguard-go, tidy	5 years ago
Brad Fitzpatrick	7fc97c5493	wgengine/magicsock: use netaddr more ... In prep for deleting from the ever-growing maps.	5 years ago
Brad Fitzpatrick	6fb30ff543	wgengine/magicsock: start using inet.af/netaddr a bit	5 years ago
David Anderson	ccfc4e0634	go.mod: bump wireguard-go version. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	dc9b39e3fb	wgengine/windows: use new winipcfg.Sync{Addresses,Routes} functions. ... This avoids flushing and reloading the whole list of addresses and routes whenever remote node information changes.	5 years ago
Brad Fitzpatrick	780deb9996	go.mod, go.sum: update go4.org/mem to its new home in its own module ... Cleans up our go.sum, not that it really matters.	5 years ago
Brad Fitzpatrick	73249f8032	netcheck: aggregate spammy logging onto one concise line	5 years ago
Brad Fitzpatrick	922d9546bf	wgengine: don't allocate so much in userspaceEngine.getStatus ... It was one of the top garbage producers on my phone. It's slated to be deleted and replaced anyway, but this helps in the meantime. The go.sum changes look scary, but the new dep only adds 240 bytes to the binary. The go.sum noise is just cmd/go being aggressive in including a lot of stuff (which is being fixed in Go 1.15, for what I understand). And I ran a go mod tidy, which added some too. (I had to write a custom wrapper around go mod tidy because this mod tidy normally breaks on tailscale.io/control being missing but referenced in tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a4ef345737	cmd/tailscale: add status subcommand ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	2c7ddd0828	go.mod, go.sum: tidy	5 years ago
Brad Fitzpatrick	f9184ad12b	go.mod: update wireguard-go for https://github.com/tailscale/wireguard-go/pull/13	5 years ago
Brad Fitzpatrick	5fa825f057	go.mod, go.sum: update	5 years ago
Brad Fitzpatrick	14a2564ef0	go.mod: bump wireguard-go	5 years ago
Brad Fitzpatrick	e085aec8ef	all: update to wireguard-go API changes ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	bf98913106	go.mod: bump wireguard-go version. ... Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
David Anderson	72d9e1d633	go.mod: bump wireguard-go version.	5 years ago
Brad Fitzpatrick	01b4bec33f	stunner: re-do how Stunner works ... It used to make assumptions based on having Anycast IPs that are super near. Now we're intentionally going to a bunch of different distant IPs to measure latency. Also, optimize how the hairpin detection works. No need to STUN on that socket. Just use that separate socket for sending, once we know the other UDP4 socket's endpoint. The trick is: make our test probe also a STUN packet, so it fits through magicsock's existing STUN routing. This drops netcheck from ~5 seconds to ~250-500ms. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d07146aafb	go.mod, go.sum: update	5 years ago
David Anderson	9b802d338c	go.mod: pull in deadlock fix from tailscale/wireguard-go. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	6b49347e4d	Update staticcheck version in go.mod. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	7e1bed82bd	go.sum: update	5 years ago
Brad Fitzpatrick	89a2c3eb04	wgengine: don't create duplicate iptables rules on Linux, clean up ... Fixes #131 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	11489a6e67	go.sum: add lines	5 years ago
David Anderson	9cdaeac00a	go.mod: update wireguard-go version. ... I accidentally crushed one of crawshaw's patches, fixing this now.	5 years ago
David Anderson	18fb98792b	go.mod: update wireguard-go version. ... Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
Brad Fitzpatrick	4cd3e82bbd	go.mod: bump wireguard-go ... Updates #112 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	78654ee1bd	cmd/tailscale: switch to an ffcli based CLI. ... Two commands for now, `up` and `netcheck`. The commands and the flags they take will change a bunch in the future, but this is good enough to launch on parity with relaynode. Signed-Off-By: David Anderson <dave@natulte.net>	5 years ago
Brad Fitzpatrick	14559340ee	Start of netcheck package & including network state in Hostinfo. ... * adds new packet "netcheck" to do the checking of UDP, IPv6, and nearest DERP server, and the Report type for all that (and more in the future, probably pulling in danderson's natprobe) * new tailcfg.NetInfo type * cmd/tailscale netcheck subcommand (tentative name, likely to change/move) to print out the netcheck.Report. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	74650d6fb5	go.mod, go.sum: update	5 years ago
Brad Fitzpatrick	f473965ca1	go.sum: update ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	cc44e8a443	cmd/mkpkg: add small wrapper around nfpm to build deb/rpm packages. ... Signed-Off-By: David Anderson <dave@natulte.net>	5 years ago
Brad Fitzpatrick	88f1cc0c98	derp, cmd/derper: add rate limiting support, add default 5Mbps limit ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	f266e2d1eb	version: add CmdName func for future use by logpolicy ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I02a7c907844f71242ef06ed097f2a92ece7ae091	5 years ago
David Crawshaw	431929c09a	go.mod: fix wireguard-go version	5 years ago
Tobias Klauser	4d09316f9a	wgengine/monitor: use RTMGRP_* consts from x/sys/unix ... Bump golang.org/x/sys/unix to get the RTMGRP_* consts and use them. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>	5 years ago
Brad Fitzpatrick	9dbc52bb5b	go.mod: fix wireguard-go dep ... Fixes #59 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	745c8c92b1	wgengine: fix windows build for winipcfg-go ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d404f1caed	cmd/tsshd: add basic SSH server	5 years ago
David Anderson	2227ede8af	controlclient: fix staticcheck lint. ... Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
David Crawshaw	87334fb332	wgengine, controlclient: fewer pointers in wgcfg key types ... Signed-off-by: David Crawshaw <david@zentus.com>	5 years ago
Earl Lee	a8d8b8719a	Move Linux client & common packages into a public repo.	5 years ago