285 Commits (44d9929208e1b9e5f656df37c05808c93b4c3597)

Author	SHA1	Message	Date
Brad Fitzpatrick	1642dfdb07	ipn/ipnlocal: get peerapi ~working in macOS/iOS NetworkExtension sandbox ... IPv4 and IPv6 both work remotely, but IPv6 doesn't yet work from the machine itself due to routing mysteries. Untested yet on iOS, but previous prototype worked on iOS, so should work the same. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5a62aa8047	ipn/ipnlocal: pass down interface state to peerapi ListenConfig hook ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	9f7f2af008	wgengine/router/dns: move to net/dns. ... Preparation for merging the APIs and whatnot. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	8432999835	Move wgengine/tsdns to net/dns. ... Straight move+fixup, no other changes. In prep for merging with wgengine/router/dns. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	81143b6d9a	ipn/ipnlocal: start of peerapi between nodes ... Also some necessary refactoring of the ipn/ipnstate too. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2384c112c9	net/packet, wgengine/{filter,tstun}: add TSMP ping ... Fixes #1467 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	8c0a0450d9	ipn/ipnlocal: allow client access to exit node's public IPs. ... "public IP" is defined as an IP address configured on the exit node itself that isn't in the list of forbidden ranges (RFC1918, CGNAT, Tailscale). Fixes #1522. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	0a02aaf813	control, ipn, tailcfg: remove golang.org/x/oauth2 dep, add tailcfg.Oauth2Token ... golang.org/x/oauth2 pulls in App Engine and grpc module dependencies, screwing up builds that depend on this module. Some background on the problem: https://go.googlesource.com/proposal/+/master/design/36460-lazy-module-loading.md Fixes tailscale/corp#1471 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	439d70dce2	cmd/tailscale, ipn/localapi: get daemon version from localapi status ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d0dffe33c0	cmd/tailscale, ipn/localapi: use localapi for status, not IPN acrobatics ... Yay simpler code. Tested on Linux, macOS and Windows. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	27c4dd9a97	Revert "cmd/tailscaled, ipn/{ipnlocal,ipnserver}: let netstack get access to LocalBackend" ... This reverts commit 2bc518dcb2. @namansood didn't end up needing it in his 770aa71ffb.	3 years ago
Brad Fitzpatrick	9eb65601ef	health, ipn/ipnlocal: track, log overall health ... Updates #1505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ba8c6d0775	health, controlclient, ipn, magicsock: tell health package state of things ... Not yet checking anything. Just plumbing states into the health package. Updates #1505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Naman Sood	770aa71ffb	client, cmd/hello, ipn, wgengine: fix whois for netstack-forwarded connections ... Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	3 years ago
Brad Fitzpatrick	2bc518dcb2	cmd/tailscaled, ipn/{ipnlocal,ipnserver}: let netstack get access to LocalBackend ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	bdb91a20eb	ipnstate, ipnlocal: add AuthURL to status ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Anderson	d79a2f3809	wgengine/filter: only log packets to/from non-default routes. ... Fixes tailscale/corp#1429. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	43b30e463c	ipn/ipnserver: refactor permissions checks a bit, document more, fix Windows ... Windows was only running the localapi on the debug port which was a stopgap at the time while doing peercreds work. Removed that, and wired it up correctly, with some more docs. More clean-up to do after 1.6, moving the localhost TCP auth code into the peercreds package. But that's too much for now, so the docs will have to suffice, even if it's at a bit of an awkward stage with the newly-renamed "NotWindows" field, which still isn't named well, but it's better than its old name of "Unknown" which hasn't been accurate since unix sock peercreds work anyway. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a4b585947d	ipn/localapi, client/tailscale: add a goroutine dump handler ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1ca3e739f7	ipn/ipnserver: set PermitWrite on localapi handler ... The TODO was easy now with peerCreds and the isReadonlyConn func. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	affd859121	ipn/ipnlocal, control/controlclient: propagate link monitor to controlclient ... Don't use it yet, but get it down there. Updates #1455 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	82edf94df7	ipn/ipnlocal: make IPv6 OS routes be a single /48 for our ULA space ... And if we have over 10,000 CGNAT routes, just route the entire CGNAT range. (for the hello test server) Fixes #1450 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	15b6969a95	ipn/ipnserver: grant client r/w access if peer uid matches tailscaled ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	be779b3587	safesocket, ipn/ipnserver: unify peercred info, fix bug on FreeBSD etc ... FreeBSD wasn't able to run "tailscale up" since the recent peercred refactoring. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	625c413508	ipn/ipnlocal: fix another regression from link monitoring refactor ... Prior to e3df29d488, the Engine.SetLinkChangeCallback fired immediately, even if there was no change. The ipnlocal code apparently depended on that, and it broke integration tests (which live in another repo). So mimic the old behavior and call the ipnlocal callback immediately at init. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	f647e3daaf	ipn/ipnlocal: transform default routes into "all but LAN" routes. ... Fixes #1177. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	e3df29d488	wgengine{,/monitor}: move interface state fetching/comparing to monitor ... Gets it out of wgengine so the Engine isn't responsible for being a callback registration hub for it. This also removes the Engine.LinkChange method, as it's no longer necessary. The monitor tells us about changes; it doesn't seem to need any help. (Currently it was only used by Swift, but as of 14dc790137 we just do the same from Go) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	38dc6fe758	cmd/tailscaled, wgengine: remove --fake, replace with netstack ... And add a --socks5-server flag. And fix a race in SOCKS5 replies where the response header was written concurrently with the copy from the backend. Co-authored with Naman Sood. Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	360095cd34	ipn: add tests for exit node pretty printing. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	8ee1cb6156	ipn/ipnlocal: mark findExitNodeID as requiring mutex. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	abfd73f569	ipn: print currently selected exit route in Prefs.String(). ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	2404c0ffad	ipn/ipnlocal: only filter out default routes when computing the local wg config. ... UIs need to see the full unedited netmap in order to know what exit nodes they can offer to the user. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	f11952ad7f	ipn/ipnserver: fix Windows connection auth regression ... Regression from code movement in d3efe8caf6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	b83c273737	wgengine/filter: use IPSet for localNets instead of prefixes. ... Part of #1177, preparing for doing fancier set operations on the allowed local nets. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Sonia Appasamy	76fb27bea7	dnsname,tailcfg: add hostname sanitation logic to node display names (#1304) ... Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	3 years ago
Brad Fitzpatrick	7038c09bc9	ipn/ipnserver: on darwin, let users who are admins use CLI without sudo ... Tangentially related to #987, #177, #594, #925, #505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d3efe8caf6	safesocket, ipn/ipnserver: look up peer creds on Darwin ... And open up socket permissions like Linux, now that we know who connections are from. This uses the new inet.af/peercred that supports Linux and Darwin at the moment. Fixes #1347 Fixes #1348 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fdac0387a7	ipn/ipnserver, ipn/ipnlocal: move whois handler to new localapi package	3 years ago
David Anderson	e86b39b73f	ipn/ipnlocal: don't short-circuit default route filtering. ... If no exit node is specified, the filter must still run to remove offered default routes from all peers. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	1e7a35b225	types/netmap: split controlclient.NetworkMap off into its own leaf package ... Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ddfcc4326c	types/persist: split controlclient.Persist into a small leaf package ... This one alone doesn't modify the global dependency map much (depaware.txt if anything looks slightly worse), but it leave controlclient as only containing NetworkMap: bradfitz@tsdev:~/src/tailscale.com/ipn$ grep -F "controlclient." *.go backend.go: NetMap *controlclient.NetworkMap // new netmap received fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) handle.go: netmapCache *controlclient.NetworkMap handle.go:func (h *Handle) NetMap() *controlclient.NetworkMap { Once that goes into a leaf package, then ipn doesn't depend on controlclient at all, and then the client gets smaller. Updates #1278	3 years ago
David Anderson	a046b48593	cmd/tailscale/cli: display currently active exit node in `tailscale status`. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	6064b6ff47	wgengine/wgcfg/nmcfg: split control/controlclient/netmap.go into own package ... It couldn't move to ipnlocal due to test dependency cycles. Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	b9c2231fdf	ipn: program exit node into the data plane according to user pref. ... Part of #1153, #1154. Fixes #1224. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	d76334d2f0	ipn: split LocalBackend off into new ipn/ipnlocal package ... And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	e8cd7bb66f	tstest: simplify goroutine leak tests ... Use tb.Cleanup to simplify both the API and the implementation. One behavior change: When the number of goroutines shrinks, don't log. I've never found these logs to be useful, and they frequently add noise. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	c7d4bf2333	cmd/tailscale/cli: recommend sudo for 'tailscale up' on failure ... Fixes #1220	3 years ago
Brad Fitzpatrick	006a224f50	ipn/ipnserver, cmd/hello: do whois over unix socket, not debug http ... Start of a local HTTP API. Not a stable interface yet.	3 years ago
Josh Bleecher Snyder	fe7c3e9c17	all: move wgcfg from wireguard-go ... This is mostly code movement from the wireguard-go repo. Most of the new wgcfg package corresponds to the wireguard-go wgcfg package. wgengine/wgcfg/device{_test}.go was device/config{_test}.go. There were substantive but simple changes to device_test.go to remove internal package device references. The API of device.Config (now wgcfg.DeviceConfig) grew an error return; we previously logged the error and threw it away. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	c611d8480b	cmd/tailscaled: add whois/identd-ish debug handler	3 years ago