301 Commits (5088af68cfa6003416413fecb11613c332b22e4f)

Author	SHA1	Message	Date
Brad Fitzpatrick	a321c24667	go.mod: update netaddr ... Involves minor IPSetBuilder.Set API change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ca455ac84b	net/tsaddr: simplify TailscaleServiceIP ... netaddr allocated at the time this was written. No longer. name old time/op new time/op delta TailscaleServiceAddr-4 5.46ns ± 4% 1.83ns ± 3% -66.52% (p=0.008 n=5+5) A bunch of the others can probably be simplified too, but this was the only one with just an IP and not an IPPrefix. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	1ece91cede	go.mod: upgrade wireguard-windows, de-fork wireguard-go ... Pull in the latest version of wireguard-windows. Switch to upstream wireguard-go. This requires reverting all of our import paths. Unfortunately, this has to happen at the same time. The wireguard-go change is very low risk, as that commit matches our fork almost exactly. (The only changes are import paths, CI files, and a go.mod entry.) So if there are issues as a result of this commit, the first place to look is wireguard-windows changes. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	5666663370	net/packet: use netaddr AppendTo methods ... This lets us remote the types/strbuilder package, which had only a single user. And it's faster. name old time/op new time/op delta String/tcp4-8 175ns ± 0% 58ns ± 1% -66.95% (p=0.000 n=10+9) String/tcp6-8 226ns ± 1% 136ns ± 1% -39.85% (p=0.000 n=10+10) String/udp4-8 175ns ± 1% 58ns ± 1% -67.01% (p=0.000 n=10+9) String/udp6-8 230ns ± 1% 140ns ± 0% -39.32% (p=0.000 n=10+9) String/icmp4-8 164ns ± 0% 50ns ± 1% -69.89% (p=0.000 n=10+10) String/icmp6-8 217ns ± 1% 129ns ± 0% -40.46% (p=0.000 n=10+10) String/igmp-8 196ns ± 0% 56ns ± 1% -71.32% (p=0.000 n=10+10) String/unknown-8 2.06ns ± 1% 2.06ns ± 2% ~ (p=0.985 n=10+10) name old alloc/op new alloc/op delta String/tcp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/tcp6-8 168B ± 0% 96B ± 0% -42.86% (p=0.000 n=10+10) String/udp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/udp6-8 168B ± 0% 96B ± 0% -42.86% (p=0.000 n=10+10) String/icmp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/icmp6-8 104B ± 0% 64B ± 0% -38.46% (p=0.000 n=10+10) String/igmp-8 48.0B ± 0% 48.0B ± 0% ~ (all equal) String/unknown-8 0.00B 0.00B ~ (all equal) name old allocs/op new allocs/op delta String/tcp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/tcp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/udp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/udp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/icmp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/icmp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/igmp-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/unknown-8 0.00 0.00 ~ (all equal) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	d6d1951897	net/packet: add BenchmarkString ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	e2dcf63420	net/dns: replace AuthoritativeSuffixes with nil Route entries. ... This leads to a cleaner separation of intent vs. implementation (Routes is now the only place specifying who handles DNS requests), and allows for cleaner expression of a configuration that creates MagicDNS records without serving them to the OS. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6690f86ef4	net/dns: always offer MagicDNS records at 100.100.100.100. ... Fixes #1886. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types ... This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	cfde997699	net/dns: don't use interfaces.Tailscale to find the tailscale interface index. ... interfaces.Tailscale only returns an interface if it has at least one Tailscale IP assigned to it. In the resolved DNS manager, when we're called upon to tear down DNS config, the interface no longer has IPs. Instead, look up the interface index on construction and reuse it throughout the daemon lifecycle. Fixes #1892. Signed-off-by: David Anderson <dave@natulte.net>	4 years ago
Brad Fitzpatrick	3173c5a65c	net/interface: remove darwin fetchRoutingTable workaround ... Fixed upstream. Bump dep. Updates #1345 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	3c8e230ee1	Revert "net/dns: set IPv4 auto mode in NM, so it lets us set DNS." ... This reverts commit 7d16c8228b. I have no idea how I ended up here. The bug I was fixing with this change fails to reproduce on Ubuntu 18.04 now, and this change definitely does break 20.04, 20.10, and Debian Buster. So, until we can reliably reproduce the problem this was meant to fix, reverting. Part of #1875 Signed-off-by: David Anderson <dave@natulte.net>	4 years ago
David Anderson	5bd38b10b4	net/dns: log the correct error when NM Reapply fails. ... Found while debugging #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7d16c8228b	net/dns: set IPv4 auto mode in NM, so it lets us set DNS. ... Part of #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	77e2375501	net/dns: don't try to configure LLMNR or mdns in NetworkManager. ... Fixes #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	7f2eb1d87a	net/tstun: fix TUN log spam when ACLs drop a packet ... Whenever we dropped a packet due to ACLs, wireguard-go was logging: Failed to write packet to TUN device: packet dropped by filter Instead, just lie to wireguard-go and pretend everything is okay. Fixes #1229 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	7629cd6120	net/tsaddr: add NewContainsIPFunc (move from wgengine) ... I want to use this from netstack but it's not exported. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	42c8b9ad53	net/tstun: remove unnecessary break statement ... Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Brad Fitzpatrick	3237e140c4	tstest/integration: add testNode.AwaitListening, DERP+STUN, improve proxy trap ... Updates #1840	4 years ago
Josh Bleecher Snyder	20e04418ff	net/dns: add GOOS build tags ... Fixes #1786 Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
David Anderson	bf9ef1ca27	net/dns: stop NetworkManager breaking v6 connectivity when setting DNS. ... Tentative fix for #1699 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	72b6d98298	net/interfaces: return all Tailscale addresses from Tailscale(). ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	44c2b7dc79	net/dns: on windows, skip site-local v6 resolvers. ... Further refinement for tailscale/corp#1662. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	99705aa6b7	net/tstun: split TUN events channel into up/down and MTU ... We had a long-standing bug in which our TUN events channel was being received from simultaneously in two places. The first is wireguard-go. At wgengine/userspace.go:366, we pass e.tundev to wireguard-go, which starts a goroutine (RoutineTUNEventReader) that receives from that channel and uses events to adjust the MTU and bring the device up/down. At wgengine/userspace.go:374, we launch a goroutine that receives from e.tundev, logs MTU changes, and triggers state updates when up/down changes occur. Events were getting delivered haphazardly between the two of them. We don't really want wireguard-go to receive the up/down events; we control the state of the device explicitly by calling device.Up. And the userspace.go loop MTU logging duplicates logging that wireguard-go does when it received MTU updates. So this change splits the single TUN events channel into up/down and other (aka MTU), and sends them to the parties that ought to receive them. I'm actually a bit surprised that this hasn't caused more visible trouble. If a down event went to wireguard-go but the subsequent up event went to userspace.go, we could end up with the wireguard-go device disappearing. I believe that this may also (somewhat accidentally) be a fix for #1790. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
David Anderson	97d2fa2f56	net/dns: work around WSL DNS implementation flaws. ... Fixes tailscale/corp#1662 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Avery Pennarun	a92b9647c5	wgengine/bench: speed test for channels, sockets, and wireguard-go. ... This tries to generate traffic at a rate that will saturate the receiver, without overdoing it, even in the event of packet loss. It's unrealistically more aggressive than TCP (which will back off quickly in case of packet loss) but less silly than a blind test that just generates packets as fast as it can (which can cause all the CPU to be absorbed by the transmitter, giving an incorrect impression of how much capacity the total system has). Initial indications are that a syscall about every 10 packets (TCP bulk delivery) is roughly the same speed as sending every packet through a channel. A syscall per packet is about 5x-10x slower than that. The whole tailscale wireguard-go + magicsock + packet filter combination is about 4x slower again, which is better than I thought we'd do, but probably has room for improvement. Note that in "full" tailscale, there is also a tundev read/write for every packet, effectively doubling the syscall overhead per packet. Given these numbers, it seems like read/write syscalls are only 25-40% of the total CPU time used in tailscale proper, so we do have significant non-syscall optimization work to do too. Sample output: $ GOMAXPROCS=2 go test -bench . -benchtime 5s ./cmd/tailbench goos: linux goarch: amd64 pkg: tailscale.com/cmd/tailbench cpu: Intel(R) Core(TM) i7-4785T CPU @ 2.20GHz BenchmarkTrivialNoAlloc/32-2 56340248 93.85 ns/op 340.98 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivialNoAlloc/124-2 57527490 99.27 ns/op 1249.10 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivialNoAlloc/1024-2 52537773 111.3 ns/op 9200.39 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivial/32-2 41878063 135.6 ns/op 236.04 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivial/124-2 41270439 138.4 ns/op 896.02 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivial/1024-2 36337252 154.3 ns/op 6635.30 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkBlockingChannel/32-2 12171654 494.3 ns/op 64.74 MB/s 0 %lost 1791 B/op 0 allocs/op BenchmarkBlockingChannel/124-2 12149956 507.8 ns/op 244.17 MB/s 0 %lost 1792 B/op 1 allocs/op BenchmarkBlockingChannel/1024-2 11034754 528.8 ns/op 1936.42 MB/s 0 %lost 1792 B/op 1 allocs/op BenchmarkNonlockingChannel/32-2 8960622 2195 ns/op 14.58 MB/s 8.825 %lost 1792 B/op 1 allocs/op BenchmarkNonlockingChannel/124-2 3014614 2224 ns/op 55.75 MB/s 11.18 %lost 1792 B/op 1 allocs/op BenchmarkNonlockingChannel/1024-2 3234915 1688 ns/op 606.53 MB/s 3.765 %lost 1792 B/op 1 allocs/op BenchmarkDoubleChannel/32-2 8457559 764.1 ns/op 41.88 MB/s 5.945 %lost 1792 B/op 1 allocs/op BenchmarkDoubleChannel/124-2 5497726 1030 ns/op 120.38 MB/s 12.14 %lost 1792 B/op 1 allocs/op BenchmarkDoubleChannel/1024-2 7985656 1360 ns/op 752.86 MB/s 13.57 %lost 1792 B/op 1 allocs/op BenchmarkUDP/32-2 1652134 3695 ns/op 8.66 MB/s 0 %lost 176 B/op 3 allocs/op BenchmarkUDP/124-2 1621024 3765 ns/op 32.94 MB/s 0 %lost 176 B/op 3 allocs/op BenchmarkUDP/1024-2 1553750 3825 ns/op 267.72 MB/s 0 %lost 176 B/op 3 allocs/op BenchmarkTCP/32-2 11056336 503.2 ns/op 63.60 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTCP/124-2 11074869 533.7 ns/op 232.32 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTCP/1024-2 8934968 671.4 ns/op 1525.20 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkWireGuardTest/32-2 1403702 4547 ns/op 7.04 MB/s 14.37 %lost 467 B/op 3 allocs/op BenchmarkWireGuardTest/124-2 780645 7927 ns/op 15.64 MB/s 1.537 %lost 420 B/op 3 allocs/op BenchmarkWireGuardTest/1024-2 512671 11791 ns/op 86.85 MB/s 0.5206 %lost 411 B/op 3 allocs/op PASS ok tailscale.com/wgengine/bench 195.724s Updates #414. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
David Anderson	f6b7d08aea	net/dns: work around new NetworkManager in other selection paths. ... Further bits of #1788 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	25ce9885a2	net/dns: don't use NM+resolved for NM >=1.26.6. ... NetworkManager fixed the bug that forced us to use NetworkManager if it's programming systemd-resolved, and in the same release also made NetworkManager ignore DNS settings provided for unmanaged interfaces... Which breaks what we used to do. So, with versions 1.26.6 and above, we MUST NOT use NetworkManager to indirectly program systemd-resolved, but thankfully we can talk to resolved directly and get the right outcome. Fixes #1788 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	e41075dd4a	net/interfaces: work around race fetching routing table ... Fixes #1345 Updates golang/go#45736 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	30f5d706a1	net/dns/resolver: remove unnecessary/racy WaitGroup. ... Fixes #1663 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	89c81c26c5	net/dns: fix resolved match domains when no nameservers are provided. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4be26b269f	net/dns: correctly capture all traffic in non-split configs. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	ca283ac899	net/dns: remove config in openresolv when given an empty DNS config. ... Part of #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	53213114ec	net/dns: make debian_resolvconf correctly clear DNS configs. ... More of #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	3b1ab78954	net/dns: restore resolv.conf when given an empty config in directManager. ... Fixes #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	158328ba24	net/dns: remove ForceSplitDNSForTesting. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Naman Sood	71b7e48547	net/tsaddr: expand ephemeral nodes range to /64 ... Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Naman Sood	b85d80b37f	net/tsaddr: add new IP range for ephemeral nodes in Tailscale ULA (#1715) ... Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
David Anderson	bb0710d51d	net/dns: add debugging traces to DNS manager selection on linux. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4b70c7b717	net/dns: fix inverted test for NetworkManager. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4849a4d3c8	net/dns: error out on linux if /etc/resolv.conf can't be read. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1f9b73a531	net/dns: fix freebsd DNS manager selection. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
AdamKorcz	2243bb48c2	stun fuzzer: Small fix ... Signed-off-by: AdamKorcz <adam@adalogics.com>	4 years ago
Brad Fitzpatrick	c2ca2ac8c4	net/dns: fix FreeBSD build ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	84bd50329a	net/dns: fix staticheck. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d6bb11b5bf	net/dns: implement correct manager detection on linux. ... Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9ef932517b	net/dns: fix NM's GetBaseConfig when no configs exist. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	fe3b1ab747	net/dns: refactor dbus connection setup in resolved manager. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	854d5d36a1	net/dns: return error from NewOSManager, use it to initialize NM. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9aa33b43e6	net/dns: support split and unsplit DNS in NetworkManager. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	87eb8384f5	net/dns: fix up NetworkManager configurator a bit. ... Clear LLMNR and mdns flags, update reasoning for our settings, and set our override priority harder than before when we want to be primary resolver. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago