tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	69f4b4595a	wgengine{,/wgint}: add wgint.Peer wrapper type, add to wgengine.Engine This adds a method to wgengine.Engine and plumbed down into magicsock to add a way to get a type-safe Tailscale-safe wrapper around a wireguard-go device.Peer that only exposes methods that are safe for Tailscale to use internally. It also removes HandshakeAttempts from PeerStatusLite that was just added as it wasn't needed yet and is now accessible ala cart as needed from the Peer type accessor. None of this is used yet. Updates #7617 Change-Id: I07be0c4e6679883e6eeddf8dbed7394c9e79c5f4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	b4ff9a578f	wgengine: rename local variable from 'found' to conventional 'ok' Updates #cleanup Change-Id: I799dc86ea9e4a3a949592abdd8e74282e7e5d086 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	a8a525282c	wgengine: use slices.Clone in two places Updates #cleanup Change-Id: I1cb30efb6d09180e82b807d6146f37897ef99307 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	74b8985e19	ipn/ipnstate, wgengine: make PeerStatusLite.LastHandshake zero Time means none ... rather than 1970. Code was using IsZero against the 1970 team (which isn't a zero value), but fortunately not anywhere that seems to have mattered. Updates #cleanup Change-Id: I708a3f2a9398aaaedc9503678b4a8a311e0e019e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Andrew Dunham	3dd8ae2f26	net/tstun: fix spelling of "WireGuard" Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ida7e30f4689bc18f5f7502f53a0adb5ac3c7981a	9 months ago
Andrew Dunham	c5abbcd4b4	wgengine/netstack: add a per-client limit for in-flight TCP forwards This is a fun one. Right now, when a client is connecting through a subnet router, here's roughly what happens: 1. The client initiates a connection to an IP address behind a subnet router, and sends a TCP SYN 2. The subnet router gets the SYN packet from netstack, and after running through acceptTCP, starts DialContext-ing the destination IP, without accepting the connection¹ 3. The client retransmits the SYN packet a few times while the dial is in progress, until either... 4. The subnet router successfully establishes a connection to the destination IP and sends the SYN-ACK back to the client, or... 5. The subnet router times out and sends a RST to the client. 6. If the connection was successful, the client ACKs the SYN-ACK it received, and traffic starts flowing As a result, the notification code in forwardTCP never notices when a new connection attempt is aborted, and it will wait until either the connection is established, or until the OS-level connection timeout is reached and it aborts. To mitigate this, add a per-client limit on how many in-flight TCP forwarding connections can be in-progress; after this, clients will see a similar behaviour to the global limit, where new connection attempts are aborted instead of waiting. This prevents a single misbehaving client from blocking all other clients of a subnet router by ensuring that it doesn't starve the global limiter. Also, bump the global limit again to a higher value. ¹ We can't accept the connection before establishing a connection to the remote server since otherwise we'd be opening the connection and then immediately closing it, which breaks a bunch of stuff; see #5503 for more details. Updates tailscale/corp#12184 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I76e7008ddd497303d75d473f534e32309c8a5144	9 months ago
Brad Fitzpatrick	1cf85822d0	ipn/ipnstate, wgengine/wgint: add handshake attempts accessors Not yet used. This is being made available so magicsock/wgengine can use it to ignore certain sends (UDP + DERP) later on at least mobile, letting wireguard-go think it's doing its full attempt schedule, but we can cut it short conditionally based on what we know from the control plane. Updates #7617 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: Ia367cf6bd87b2aeedd3c6f4989528acdb6773ca7	9 months ago
Brad Fitzpatrick	eb28818403	wgengine: make pendOpen time later, after dup check Otherwise on OS retransmits, we'd make redundant timers in Go's timer heap that upon firing just do nothing (well, grab a mutex and check a map and see that there's nothing to do). Updates #cleanup Change-Id: Id30b8b2d629cf9c7f8133a3f7eca5dc79e81facb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	219efebad4	wgengine: reduce critical section No need to hold wgLock while using the device to LookupPeer; that has its own mutex already. Updates #cleanup Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: Ib56049fcc7163cf5a2c2e7e12916f07b4f9d67cb	9 months ago
Nick Khyl	7ef1fb113d	cmd/tailscaled, ipn/ipnlocal, wgengine: shutdown tailscaled if wgdevice is closed Tailscaled becomes inoperative if the Tailscale Tunnel wintun adapter is abruptly removed. wireguard-go closes the device in case of a read error, but tailscaled keeps running. This adds detection of a closed WireGuard device, triggering a graceful shutdown of tailscaled. It is then restarted by the tailscaled watchdog service process. Fixes #11222 Signed-off-by: Nick Khyl <nickk@tailscale.com>	9 months ago
Anton Tolchanov	cd9cf93de6	wgengine/netstack: expose TCP forwarder drops via clientmetrics - add a clientmetric with a counter of TCP forwarder drops due to the max attempts; - fix varz metric types, as they are all counters. Updates #8210 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	9 months ago
Brad Fitzpatrick	e1bd7488d0	all: remove LenIter, use Go 1.22 range-over-int instead Updates #11058 Updates golang/go#65685 Change-Id: Ibb216b346e511d486271ab3d84e4546c521e4e22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	6ad6d6b252	wgengine/wglog: add TS_DEBUG_RAW_WGLOG envknob for raw wg logs Updates #7617 (part of debugging it) Change-Id: I1bcbdcf0f929e3bcf83f244b1033fd438aa6dac1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	8b9474b06a	wgengine/wgcfg: don't send UAPI to disable keep-alives on new peers That's already the default. Avoid the overhead of writing it on one side and reading it on the other to do nothing. Updates #cleanup (noticed while researching something else) Change-Id: I449c88a022271afb9be5da876bfaf438fe5d3f58 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
James Tucker	131f9094fd	wgengine/wglog: quieten WireGuard logs for allowedips An increasing number of users have very large subnet route configurations, which can produce very large amounts of log data when WireGuard is reconfigured. The logs don't contain the actual routes, so they're largely useless for diagnostics, so we'll just suppress them. Fixes tailscale/corp#17532 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Jason Barnett	4d668416b8	wgengine/router: fix ip rule restoration Fixes #10857 Signed-off-by: Jason Barnett <J@sonBarnett.com>	9 months ago
Aaron Klotz	f7acbefbbb	wgengine/router: make the Windows ifconfig implementation reuse existing MibIPforwardRow2 when possible Looking at profiles, we spend a lot of time in winipcfg.LUID.DeleteRoute looking up the routing table entry for the provided RouteData. But we already have the row! We previously obtained that data via the full table dump we did in getInterfaceRoutes. We can make this a lot faster by hanging onto a reference to the wipipcfg.MibIPforwardRow2 and executing the delete operation directly on that. Fixes #11123 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	9 months ago
Percy Wegmann	c42a4e407a	tailfs: listen for local clients only on 100.100.100.100 FileSystemForLocal was listening on the node's Tailscale address, which potentially exposes the user's view of TailFS shares to other Tailnet users. Remote nodes should connect to exported shares via the peerapi. This removes that code so that FileSystemForLocal is only avaialable on 100.100.100.100:8080. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago
Percy Wegmann	ddcffaef7a	tailfs: disable TailFSForLocal via policy Adds support for node attribute tailfs:access. If this attribute is not present, Tailscale will not accept connections to the local TailFS server at 100.100.100.100:8080. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago
Percy Wegmann	abab0d4197	tailfs: clean up naming and package structure - Restyles tailfs -> tailFS - Defines interfaces for main TailFS types - Moves implemenatation of TailFS into tailfsimpl package Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago
Percy Wegmann	993acf4475	tailfs: initial implementation Add a WebDAV-based folder sharing mechanism that is exposed to local clients at 100.100.100.100:8080 and to remote peers via a new peerapi endpoint at /v0/tailfs. Add the ability to manage folder sharing via the new 'share' CLI sub-command. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago
Joe Tsai	94a4f701c2	all: use reflect.TypeFor now available in Go 1.22 (#11078 ) Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>	9 months ago
Jordan Whited	8b47322acc	wgengine/magicsock: implement probing of UDP path lifetime (#10844 ) This commit implements probing of UDP path lifetime on the tail end of an active direct connection. Probing configuration has two parts - Cliffs, which are various timeout cliffs of interest, and CycleCanStartEvery, which limits how often a probing cycle can start, per-endpoint. Initially a statically defined default configuration will be used. The default configuration has cliffs of 10s, 30s, and 60s, with a CycleCanStartEvery of 24h. Probing results are communicated via clientmetric counters. Probing is off by default, and can be enabled via control knob. Probing is purely informational and does not yet drive any magicsock behaviors. Updates #540 Signed-off-by: Jordan Whited <jordan@tailscale.com>	10 months ago
James Tucker	7e3bcd297e	go.mod,wgengine/netstack: bump gvisor Updates #8043 Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
Claire Wang	213d696db0	magicsock: mute noisy expected peer mtu related error (#10870 )	10 months ago
Andrew Dunham	7a0392a8a3	wgengine/netstack: expose gVisor metrics through expvar When tailscaled is run with "-debug 127.0.0.1:12345", these metrics are available at: http://localhost:12345/debug/metrics Updates #8210 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I19db6c445ac1f8344df2bc1066a3d9c9030606f8	10 months ago
Andrew Dunham	6540d1f018	wgengine/router: look up absolute path to netsh.exe on Windows This is in response to logs from a customer that show that we're unable to run netsh due to the following error: router: firewall: adding Tailscale-Process rule to allow UDP for "C:\\Program Files\\Tailscale\\tailscaled.exe" ... router: firewall: error adding Tailscale-Process rule: exec: "netsh": cannot run executable found relative to current directory: There's approximately no reason to ever dynamically look up the path of a system utility like netsh.exe, so instead let's first look for it in the System32 directory and only if that fails fall back to the previous behaviour. Updates #10804 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I68cfeb4cab091c79ccff3187d35f50359a690573	10 months ago
Jordan Whited	b084888e4d	wgengine/magicsock: fix typos in docs (#10729 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	10 months ago
Andrew Lytvynov	2716250ee8	all: cleanup unused code, part 2 (#10670 ) And enable U1000 check in staticcheck. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Andrew Lytvynov	1302bd1181	all: cleanup unused code, part 1 (#10661 ) Run `staticcheck` with `U1000` to find unused code. This cleans up about a half of it. I'll do the other half separately to keep PRs manageable. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Jordan Whited	685b853763	wgengine/magicsock: fix handling of derp.PeerGoneMessage (#10589 ) The switch in Conn.runDerpReader() on the derp.ReceivedMessage type contained cases other than derp.ReceivedPacket that fell through to writing to c.derpRecvCh, which should only be reached for derp.ReceivedPacket. This can result in the last/previous derp.ReceivedPacket to be re-handled, effectively creating a duplicate packet. If the last derp.ReceivedPacket happens to be a disco.CallMeMaybe it may result in a disco ping scan towards the originating peer on the endpoints contained. The change in this commit moves the channel write on c.derpRecvCh and subsequent select awaiting the result into the derp.ReceivedMessage case, preventing it from being reached from any other case. Explicit continue statements are also added to non-derp.ReceivedPacket cases where they were missing, in order to signal intent to the reader. Fixes #10586 Signed-off-by: Jordan Whited <jordan@tailscale.com>	11 months ago
Andrew Dunham	727acf96a6	net/netcheck: use DERP frames as a signal for home region liveness This uses the fact that we've received a frame from a given DERP region within a certain time as a signal that the region is stil present (and thus can still be a node's PreferredDERP / home region) even if we don't get a STUN response from that region during a netcheck. This should help avoid DERP flaps that occur due to losing STUN probes while still having a valid and active TCP connection to the DERP server. RELNOTE=Reduce home DERP flapping when there's still an active connection Updates #8603 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If7da6312581e1d434d5c0811697319c621e187a0	11 months ago
Naman Sood	97f84200ac	wgengine/router: implement UpdateMagicsockPort for CallbackRouter (#10494 ) Updates #9084. Signed-off-by: Naman Sood <mail@nsood.in>	11 months ago
Naman Sood	d46a4eced5	util/linuxfw, wgengine: allow ingress to magicsock UDP port on Linux (#10370 ) * util/linuxfw, wgengine: allow ingress to magicsock UDP port on Linux Updates #9084. Currently, we have to tell users to manually open UDP ports on Linux when certain firewalls (like ufw) are enabled. This change automates the process of adding and updating those firewall rules as magicsock changes what port it listens on. Signed-off-by: Naman Sood <mail@nsood.in>	11 months ago
Naman Sood	0a59754eda	linuxfw,wgengine/route,ipn: add c2n and nodeattrs to control linux netfilter Updates tailscale/corp#14029. Signed-off-by: Naman Sood <mail@nsood.in>	11 months ago
James Tucker	215f657a5e	wgengine/router: create netfilter runner in setNetfilterMode This will enable the runner to be replaced as a configuration side effect in a later change. Updates tailscale/corp#14029 Signed-off-by: James Tucker <james@tailscale.com>	11 months ago
Andrew Lytvynov	263e01c47b	wgengine/filter: add protocol-agnostic packet checker (#10446 ) For use in ACL tests, we need a way to check whether a packet is allowed not just with TCP, but any protocol. Updates #3561 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	12 months ago
Jordan Whited	5e861c3871	wgengine/netstack: disable RACK on Windows (#10402 ) Updates #9707 Signed-off-by: Jordan Whited <jordan@tailscale.com>	12 months ago
Jordan Whited	1af7f5b549	wgengine/magicsock: fix typo in Conn.handlePingLocked() (#10365 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	12 months ago
Brad Fitzpatrick	4d196c12d9	health: don't report a warning in DERP homeless mode Updates #3363 Updates tailscale/corp#396 Change-Id: Ibfb0496821cb58a78399feb88d4206d81e95ca0f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	3bd382f369	wgengine/magicsock: add DERP homeless debug mode for testing In DERP homeless mode, a DERP home connection is not sought or maintained and the local node is not reachable. Updates #3363 Updates tailscale/corp#396 Change-Id: Ibc30488ac2e3cfe4810733b96c2c9f10a51b8331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jordan Whited	2ff54f9d12	wgengine/magicsock: move trustBestAddrUntil forward on non-disco rx (#10274 ) This is gated behind the silent disco control knob, which is still in its infancy. Prior to this change disco pong reception was the only event that could move trustBestAddrUntil forward, so even though we weren't heartbeating, we would kick off discovery pings every trustUDPAddrDuration and mirror to DERP. Updates #540 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Jordan Whited	c99488ea19	wgengine/magicsock: fix typo in endpoint.sendDiscoPing() docs (#10232 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Jordan Whited	e848736927	control/controlknobs,wgengine/magicsock: implement SilentDisco toggle (#10195 ) This change exposes SilentDisco as a control knob, and plumbs it down to magicsock.endpoint. No changes are being made to magicsock.endpoint disco behavior, yet. Updates #540 Signed-off-by: Jordan Whited <jordan@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Charlotte Brandhorst-Satzkorn	839fee9ef4	wgengine/magicsock: handle wireguard only clean up and log messages This change updates log messaging when cleaning up wireguard only peers. This change also stops us unnecessarily attempting to clean up disco pings for wireguard only endpoints. Updates #7826 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	1 year ago
Maisem Ali	d0f2c0664b	wgengine/netstack: standardize var names in UpdateNetstackIPs Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	eaf8aa63fc	wgengine/netstack: remove unnecessary map in UpdateNetstackIPs Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	d601c81c51	wgengine/netstack: use netip.Prefix as map keys Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
James Tucker	6f69fe8ad7	wgnengine: remove unused field in userspaceEngine Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Brad Fitzpatrick	514539b611	wgengine/magicsock: close disco listeners on Conn.Close, fix Linux root TestNewConn TestNewConn now passes as root on Linux. It wasn't closing the BPF listeners and their goroutines. The code is still a mess of two Close overlapping code paths, but that can be refactored later. For now, make the two close paths more similar. Updates #9945 Change-Id: I8a3cf5fb04d22ba29094243b8e645de293d9ed85 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
James Tucker	7df6f8736a	wgengine/netstack: only add addresses to correct protocols Prior to an earlier netstack bump this code used a string conversion path to cover multiple cases of behavior seemingly checking for unspecified addresses, adding unspecified addresses to v6. The behavior is now crashy in netstack, as it is enforcing address length in various areas of the API, one in particular being address removal. As netstack is now protocol specific, we must not create invalid protocol addresses - an address is v4 or v6, and the address value contained inside must match. If a control path attempts to do something otherwise it is now logged and skipped rather than incorrect addressing being added. Fixes tailscale/corp#15377 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Jordan Whited	891d964bd4	wgengine/magicsock: simplify tryEnableUDPOffload() (#9872 ) Don't assume Linux lacks UDP_GRO support if it lacks UDP_SEGMENT support. This mirrors a similar change in wireguard/wireguard-go@177caa7 for consistency sake. We haven't found any issues here, just being overly paranoid. Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Brad Fitzpatrick	c363b9055d	tstest/integration: add tests for tun mode (requiring root) Updates #7894 Change-Id: Iff0b07b21ae28c712dd665b12918fa28d6f601d0 Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	a6270826a3	wgengine/magicsock: fix data race regression in disco ping callbacks Regression from `c15997511d`. The callback could be run multiple times from different endpoints. Fixes #9801 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	5297bd2cff	cmd/tailscaled,net/tstun: fix data race on start-up in TUN mode Fixes #7894 Change-Id: Ice3f8019405714dd69d02bc07694f3872bb598b8 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	8b630c91bc	wgengine/filter: use slices.Contains in another place We keep finding these. Updates #cleanup Change-Id: Iabc049b0f8da07341011356f0ecd5315c33ff548 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	fbfee6a8c0	cmd/containerboot: use linuxfw.NetfilterRunner This migrates containerboot to reuse the NetfilterRunner used by tailscaled instead of manipulating iptables rule itself. This has the added advantage of now working with nftables and we can potentially drop the `iptables` command from the container image in the future. Updates #9310 Co-authored-by: Irbe Krumina <irbe@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	05a1f5bf71	util/linuxfw: move detection logic Just a refactor to consolidate the firewall detection logic in a single package so that it can be reused in a later commit by containerboot. Updates #9310 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Val	249edaa349	wgengine/magicsock: add probed MTU metrics Record the number of MTU probes sent, the total bytes sent, the number of times we got a successful return from an MTU probe of a particular size, and the max MTU recorded. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	893bdd729c	disco,net/tstun,wgengine/magicsock: probe peer MTU Automatically probe the path MTU to a peer when peer MTU is enabled, but do not use the MTU information for anything yet. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Brad Fitzpatrick	6f36f8842c	cmd/tailscale, magicsock: add debug command to flip DERP homes For testing netmap patchification server-side. Updates #1909 Change-Id: Ib1d784bd97b8d4a31e48374b4567404aae5280cc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	f991c8a61f	tstest: make ResourceCheck panic on parallel tests To find potential flakes earlier. Updates #deflake-effort Change-Id: I52add6111d660821c3a23d4b1dd032821344bc48 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jordan Whited	eb22c0dfc7	wgengine/magicsock: use binary.NativeEndian for UDP GSO control data (#9640 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Val	4130851f12	wgengine/magicsock: probe but don't use path MTU from CLI ping When sending a CLI ping with a specific size, continue to probe all possible UDP paths to the peer until we find one with a large enough MTU to accommodate the ping. Record any peer path MTU information we discover (but don't use it for anything other than CLI pings). Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	67926ede39	wgengine/magicsock: add MTU to addrLatency and rename to addrQuality Add a field to record the wire MTU of the path to this address to the addrLatency struct and rename it addrQuality. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Brad Fitzpatrick	425cf9aa9d	tailcfg, all: use []netip.AddrPort instead of []string for Endpoints It's JSON wire compatible. Updates #cleanup Change-Id: Ifa5c17768fec35b305b06d75eb5f0611c8a135a6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	5f5c9142cc	util/slicesx: add EqualSameNil, like slices.Equal but same nilness Then use it in tailcfg which had it duplicated a couple times. I think we have it a few other places too. And use slices.Equal in wgengine/router too. (found while looking for callers) Updates #cleanup Change-Id: If5350eee9b3ef071882a3db29a305081e4cd9d23 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
James Tucker	324f0d5f80	cmd/cloner,*: revert: optimize nillable slice cloner This reverts commit `ee90cd02fd`. The outcome is not identical for empty slices. Cloner really needs tests! Updates #9601 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
James Tucker	ee90cd02fd	cmd/cloner,*: optimize nillable slice cloner A wild @josharian appears with a good suggestion for a refactor, thanks Josh! Updates #9410 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Jordan Whited	16fa3c24ea	wgengine/magicsock: use x/sys/unix constants for UDP GSO (#9597 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Andrea Barisani	f50b2a87ec	wgengine/netstack: refactor address construction and conversion Updates #9252 Updates #9253 Signed-off-by: Andrea Barisani <andrea@inversepath.com> Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Andrea Barisani	b5b4298325	go.mod,*: bump gvisor Updates #9253 Signed-off-by: Andrea Barisani <andrea@inversepath.com> Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
James Tucker	80206b5323	wgengine/magicsock: add nodeid to panic condition on public key reuse If the condition arises, it should be easy to track down. Updates #9547 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Val	c608660d12	wgengine,net,ipn,disco: split up and define different types of MTU Prepare for path MTU discovery by splitting up the concept of DefaultMTU() into the concepts of the Tailscale TUN MTU, MTUs of underlying network interfaces, minimum "safe" TUN MTU, user configured TUN MTU, probed path MTU to a peer, and maximum probed MTU. Add a set of likely MTUs to probe. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	578b357849	wgengine/netstack: use buffer pools for UDP packet forwarding Use buffer pools for UDP packet forwarding to prepare for increasing the forwarded UDP packet size for peer path MTU discovery. Updates #311 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Andrew Dunham	530aaa52f1	net/dns: retry forwarder requests over TCP We weren't correctly retrying truncated requests to an upstream DNS server with TCP. Instead, we'd return a truncated request to the user, even if the user was querying us over TCP and thus able to handle a large response. Also, add an envknob and controlknob to allow users/us to disable this behaviour if it turns out to be buggy (✨ DNS ✨). Updates #9264 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ifb04b563839a9614c0ba03e9c564e8924c1a2bfd	1 year ago
Brad Fitzpatrick	3b32d6c679	wgengine/magicsock, controlclient, net/dns: reduce some logspam Updates #cleanup Change-Id: I78b0697a01e94baa33f3de474b591e616fa5e6af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Val	08302c0731	Revert "wgengine/netstack: use buffer pools for UDP packet forwarding" This reverts commit `fb2f3e4741`. Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	6cc5b272d8	Revert "wgengine,net,ipn,disco: split up and define different types of MTU" This reverts commit `059051c58a`. Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	059051c58a	wgengine,net,ipn,disco: split up and define different types of MTU Prepare for path MTU discovery by splitting up the concept of DefaultMTU() into the concepts of the Tailscale TUN MTU, MTUs of underlying network interfaces, minimum "safe" TUN MTU, user configured TUN MTU, probed path MTU to a peer, and maximum probed MTU. Add a set of likely MTUs to probe. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	fb2f3e4741	wgengine/netstack: use buffer pools for UDP packet forwarding Use buffer pools for UDP packet forwarding to prepare for increasing the forwarded UDP packet size for peer path MTU discovery. Updates #311 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	65dc711c76	control,tailcfg,wgengine/magicsock: add nodeAttr to enable/disable peer MTU Add a nodeAttr to enable/disable peer path MTU discovery. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	95635857dc	wgengine/magicsock: replace CanPMTUD() with ShouldPMTUD() Replace CanPMTUD() with ShouldPMTUD() to check if peer path MTU discovery should be enabled, in preparation for adding support for enabling/disabling peer MTU dynamically. Updated #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	a5ae21a832	wgengine/magicsock: improve don't fragment bit set/get support Add an enable/disable argument to setDontFragment() in preparation for dynamic enable/disable of peer path MTU discovery. Add getDontFragment() to get the status of the don't fragment bit from a socket. Updates #311 Co-authored-by: James Tucker <james@tailscale.com> Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	4c793014af	wgengine/magicsock: fix don't fragment setsockopt arg for IPv6 on linux Use IPV6_MTU_DISCOVER for setting don't fragment on IPv6 sockets on Linux (was using IP_MTU_DISCOVER, the IPv4 arg). Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	055f3fd843	wgengine/magicsock: rename debugPMTUD() to debugEnablePMTUD() Make the debugknob variable name for enabling peer path MTU discovery match the env variable name. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	bb3d338334	wgengine/magicsock: rename files for peer MTU Rename dontfrag* to peermtu* to prepare for more peer MTU related code going into these files. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Tom DNetto	c08cf2a9c6	all: declare & plumb IPv6 masquerade address for peer This PR plumbs through awareness of an IPv6 SNAT/masquerade address from the wire protocol through to the low-level (tstun / wgengine). This PR is the first in two PRs for implementing IPv6 NAT support to/from peers. A subsequent PR will implement the data-plane changes to implement IPv6 NAT - this is just plumbing. Signed-off-by: Tom DNetto <tom@tailscale.com> Updates ENG-991	1 year ago
Maisem Ali	4da0689c2c	tailcfg: add Node.HasCap helpers This makes a follow up change less noisy. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	d06b48dd0a	tailcfg: add RawMessage This adds a new RawMessage type backed by string instead of the json.RawMessage which is backed by []byte. The byte slice makes the generated views be a lot more defensive than the need to be which we can get around by using a string instead. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	0d991249e1	types/netmap: remove NetworkMap.{Addresses,MachineStatus} And convert all callers over to the methods that check SelfNode. Now we don't have multiple ways to express things in tests (setting fields on SelfNode vs NetworkMap, sometimes inconsistently) and don't have multiple ways to check those two fields (often only checking one or the other). Updates #9443 Change-Id: I2d7ba1cf6556142d219fae2be6f484f528756e3c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	a61caea911	tailcfg: define a type for NodeCapability Instead of untyped string, add a type to identify these. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	3d37328af6	wgengine, proxymap: split out port mapping from Engine to new type (Continuing quest to remove rando stuff from the "Engine") Updates #cleanup Change-Id: I77f39902c2194410c10c054b545d70c9744250b0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	926c990a09	types/netmap: start phasing out Addresses, add GetAddresses method NetworkMap.Addresses is redundant with the SelfNode.Addresses. This works towards a TODO to delete NetworkMap.Addresses and replace it with a method. This is similar to #9389. Updates #cleanup Change-Id: Id000509ca5d16bb636401763d41bdb5f38513ba0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
James Tucker	1858ad65c8	cmd/cloner: do not allocate slices when the source is nil tailcfg.Node zero-value clone equality checks failed when I added a []*foo to the structure, as the zero value and it's clone contained a different slice header. Updates #9377 Updates #9408 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Brad Fitzpatrick	99bb355791	wgengine: remove DiscoKey method from Engine interface It has one user (LocalBackend) which can ask magicsock itself. Updates #cleanup Change-Id: I8c03cbb1e5ba57b0b442621b5fa467030c14a2e2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	3c276d7de2	wgengine: remove SetDERPMap method from Engine interface (continuing the mission of removing rando methods from the Engine interface that we don't need anymore) Updates #cleanup Change-Id: Id5190917596bf04d7185c3b331a852724a3f5a16 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	b8a4c96c53	wgengine: remove LinkChange method from Engine interface It was only used by Android, until https://github.com/tailscale/tailscale-android/pull/131 which does the call to the netMon directly instead. Updates #cleanup Change-Id: Iab8a1d8f1e63250705835c75f40e2cd8c1c4d5b8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	727b1432a8	wgengine: remove SetNetInfoCallback method from Engine LocalBackend can talk to magicsock on its own to do this without the "Engine" being involved. (Continuing a little side quest of cleaning up the Engine interface...) Updates #cleanup Change-Id: I8654acdca2b883b1bd557fdc0cfb90cd3a418a62 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	343c0f1031	wgengine{,/netstack}: remove AddNetworkMapCallback from Engine interface It had exactly one user: netstack. Just have LocalBackend notify netstack when here's a new netmap instead, simplifying the bloated Engine interface that has grown a bunch of non-Engine-y things. (plenty of rando stuff remains after this, but it's a start) Updates #cleanup Change-Id: I45e10ab48119e962fc4967a95167656e35b141d8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago

1 2 3 4 5 ...

1515 Commits (486a423716579200e8f8d2eae9d49ba474761c9a)