230 Commits (5611f290eb118eddc256560eaaa69f509347b4de)

Author	SHA1	Message	Date
Brad Fitzpatrick	5611f290eb	ipn, ipnserver: only require sudo on Linux for mutable CLI actions ... This partially reverts d6e9fb1df0, which modified the permissions on the tailscaled Unix socket and thus required "sudo tailscale" even for "tailscale status". Instead, open the permissions back up (on Linux only) but have the server look at the peer creds and only permit read-only actions unless you're root. In the future we'll also have a group that can do mutable actions. On OpenBSD and FreeBSD, the permissions on the socket remain locked down to 0600 from d6e9fb1df0. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d6e9fb1df0	all: adjust Unix permissions for those without umasks ... Fixes tailscale/corp#1165 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Sonia Appasamy	024671406b	ipn: only send services in Hostinfo if Tailnet has opted-in to services collection (#1107) ... Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	4 years ago
Brad Fitzpatrick	5aa5db89d6	cmd/tailscaled, wgengine/netstack: add start of gvisor userspace netstack work ... Not usefully functional yet (mostly a proof of concept), but getting it submitted for some work @namansood is going to do atop this. Updates #707 Updates #634 Updates #48 Updates #835	4 years ago
Brad Fitzpatrick	5efb0a8bca	cmd/tailscale: change formatting of "tailscale status" ... * show DNS name over hostname, removing domain's common MagicDNS suffix. only show hostname if there's no DNS name. but still show shared devices' MagicDNS FQDN. * remove nerdy low-level details by default: endpoints, DERP relay, public key. They're available in JSON mode still for those who need them. * only show endpoint or DERP relay when it's active with the goal of making debugging easier. (so it's easier for users to understand what's happening) The asterisks are gone. * remove Tx/Rx numbers by default for idle peers; only show them when there's traffic. * include peers' owner login names * add CLI option to not show peers (matching --self=true, --peers= also defaults to true) * sort by DNS/host name, not public key * reorder columns	4 years ago
Josh Bleecher Snyder	18471a8792	ipn: close logger at the end of TestLocalLogLines ... If any goroutine continues to use the logger in TestLocalLogLines after the test finishes, the test panics. The culprit for this was wireguard-go; the previous commit fixed that. This commit adds suspenders: When the test is done, make logging calls into no-ops. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Denton Gentry	fa3e8e1a28	Add names to test cases in ipn/local_test.go. ... There are so many now that just a number doesn't work well. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Denton Gentry	414cb4a695	Add test for dnsMapsEqual. ... Exercises most cases in the function. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Brad Fitzpatrick	b5129dadfd	ipn: fix buggy-looking format string in error log ... On shutdown, logs showed: wgengine status error: &errors.errorString{s:"engine closing; no status"}	4 years ago
Brad Fitzpatrick	e8ae355bb8	ipn: delete domainsForProxying, require explicit DNS search domains (mapver 9) (#1078) ... Previously the client had heuristics to calculate which DNS search domains to set, based on the peers' names. Unfortunately that prevented us from doing some things we wanted to do server-side related to node sharing. So, bump MapRequest.Version to 9 to signal that the client only uses the explicitly configured DNS search domains and doesn't augment it with its own list. Updates tailscale/corp#1026 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package ... This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints ... Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	294ceb513c	ipn, wgengine/magicsock: fix `tailscale status` display. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Christine Dodrill	2485faf69a	Merge branch 'main' into report-status-systemd	4 years ago
Christine Dodrill	7ea809897d	ipn/ipnserver: enable systemd-notify support ... Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>	4 years ago
Josh Bleecher Snyder	a6cad71fb2	go.mod: upgrade staticcheck to 0.1.0 ... Also run go.mod and fix some staticcheck warnings. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	dfbde3d3aa	ipn: pass through the prefix length from control. ... Control sets this to /32 for IPv4 and /128 for IPv6. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	c0af7deb86	tailcfg, cmd/tailscale: add Hostinfo.ShareeNode, hide in "tailscale status"	4 years ago
Brad Fitzpatrick	cd6099113f	ipn: add a comment about skipping files with null bytes ... Updates #954	4 years ago
Alex Brainman	72e082aaf5	ipn: make LoadPrefs return os.ErrNotExist when reading corrupted files ... It appears some users have corrupted pref.conf files. Have LoadPrefs treat these files as non-existent. This way tailscale will make user login, and not crash. Fixes #954 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	4 years ago
Sonia Appasamy	0710fca0cd	tailcfg: include ShieldsUp in HostInfo	4 years ago
Brad Fitzpatrick	acade77c86	ipn/ipnserver: add knob to disable babysitter	4 years ago
Brad Fitzpatrick	19b0cfe89e	all: prepare for GOOS=ios in Go 1.16 ... Work with either way for now on iOS (darwin/arm64 vs ios/arm64). In February when Go 1.16 comes out we'll have a universal binary for darwin/arm64 (macOS) and will drop support for Go 1.15 and its darwin/amd64 meaning iOS. (it'll mean macOS). Context: * https://tip.golang.org/doc/go1.16#darwin * https://github.com/golang/go/issues/38485 * https://github.com/golang/go/issues/42100	4 years ago
Brad Fitzpatrick	d21956436a	ipn, tailcfg: change Windows subnet disabling behavior w/ WPAD ... In 1.0, subnet relays were not specially handled when WPAD+PAC was present on the network. In 1.2, on Windows, subnet relays were disabled if WPAD+PAC was present. That was what some users wanted, but not others. This makes it configurable per domain, reverting back to the 1.0 default state of them not being special. Users who want that behavior can then enable it. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	76d99cf01a	wgengine/filter: remove the Matches type. ... It only served to obscure the underlying slice type without adding much value. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b3634f020d	wgengine/filter: use netaddr types in public API. ... We still use the packet.* alloc-free types in the data path, but the compilation from netaddr to packet happens within the filter package. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	b4e19b95ed	ipn: debug zero bytes in IPN json messages ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	8f30fa67aa	ipn: treat zero-length file state store file as missing ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4f4e84236a	ipn: clean up Prefs logging at start ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6bcb466096	ipn: disambiguate how machine key was initialized ... Seeing "frontend-provided legacy machine key" was weird (and not quite accurate) on Linux machines where it comes from the _daemon key's persist prefs, not the "frontend". Make the log message distinguish between the cases. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	07b6ffd55c	ipn: only use Prefs, not computed stateKey, to determine server mode ... When the service was running without a client (e.g. after a reboot) and then the owner logs in and the GUI attaches, the computed state key changed to "" (driven by frontend prefs), and then it was falling out of server mode, despite the GUI-provided prefs still saying it wanted server mode. Also add some logging. And remove a scary "Access denied" from a user-visible error, making the two possible already-in-use error messages consistent with each other.	4 years ago
Brad Fitzpatrick	20a357b386	ipn, ipn/ipnserver: add IPN state for server in use, handle explicitly ... On Windows, we were previously treating a server used by different users as a fatal error, which meant the second user (upon starting Tailscale, explicitly or via Start Up programs) got an invasive error message dialog. Instead, give it its own IPN state and change the Notify.ErrMessage to be details in that state. Then the Windows GUI can be less aggresive about that happening. Also, * wait to close the IPN connection until the server ownership state changes so the GUI doesn't need to repeatedly reconnect to discover changes. * fix a bug discovered during testing: on system reboot, the ipnserver's serverModeUser was getting cleared while the state transitioned from Unknown to Running. Instead, track 'inServerMode' explicitly and remove the old accessor method which was error prone. * fix a rare bug where the client could start up and set the server mode prefs in its Start call and we wouldn't persist that to the StateStore storage's prefs start key. (Previously it was only via a prefs toggle at runtime)	4 years ago
Brad Fitzpatrick	f3aa08de76	ipn/ipnserver: remove "Server mode" from a user-visible error message ... That's an internal nickname.	4 years ago
Brad Fitzpatrick	cc3259f8d9	ipn: fix crash generating machine key on new installs ... Regression from d6ad41dcea (for #732). Probably also means eab6e9ea4e was unnecessary, but it's fine. Fixes #887	4 years ago
Brad Fitzpatrick	01ee638cca	Change some os.IsNotExist to errors.Is(err, os.ErrNotExist) for non-os errors. ... os.IsNotExist doesn't unwrap errors. errors.Is does. The ioutil.ReadFile ones happened to be fine but I changed them so we're consistent with the rule: if the error comes from os, you can use os.IsNotExist, but from any other package, use errors.Is. (errors.Is always would also work, but not worth updating all the code) The motivation here was that we were logging about failure to migrate legacy relay node prefs file on startup, even though the code tried to avoid that. See golang/go#41122	4 years ago
Elias Naur	eab6e9ea4e	ipn: don't temporarilySetMachineKeyInPersist for Android clients ... Without this change, newly installed Android clients crash on startup with panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x9881b9f8] goroutine 29 [running]: tailscale.com/ipn.(*LocalBackend).initMachineKeyLocked.func1(0x50cb1b9c, 0x503c9a00) /home/elias/proj/tailscale/ipn/local.go:711 +0x2c tailscale.com/ipn.(*LocalBackend).initMachineKeyLocked(0x503c9a00, 0x0, 0x0) /home/elias/proj/tailscale/ipn/local.go:736 +0x728 tailscale.com/ipn.(*LocalBackend).loadStateLocked(0x503c9a00, 0x988be40e, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0) /home/elias/proj/tailscale/ipn/local.go:817 +0x1e8 tailscale.com/ipn.(*LocalBackend).Start(0x503c9a00, 0x0, 0x0, 0x988be40e, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, ...) /home/elias/proj/tailscale/ipn/local.go:412 +0x200 main.(*backend).Start(...) /home/elias/proj/tailscale-android/cmd/tailscale/backend.go:116 main.(*App).runBackend.func3(0x50106340, 0x5000c060, 0x50d9a280) /home/elias/proj/tailscale-android/cmd/tailscale/main.go:169 +0x90 created by main.(*App).runBackend /home/elias/proj/tailscale-android/cmd/tailscale/main.go:168 +0x27c Signed-off-by: Elias Naur <mail@eliasnaur.com>	4 years ago
Brad Fitzpatrick	2b819ab38c	ipn: don't log redundant peer stats so often ... It was especially bad on our GUI platforms with a frontend that polls it. No need to log it every few seconds if it's unchanged. Make it slightly less allocate-y while I'm here.	4 years ago
Brad Fitzpatrick	ff7ddd9d20	ipn/ipnserver: move Windows local disk logging up to the parent process ... To capture panics, log.Printf writes to os.Stderr, etc. Fixes #726	4 years ago
Brad Fitzpatrick	c64718e9a0	ipn/ipnserver: work around os/user.LookupId failure on Windows ... If we can't find the mapping from SID ("user ID") -> username, don't treat that as a fatal. Apparently that happens in the wild for Reasons. Ignore it for now. It's just a nice-to-have for error messages in the rare multi-user case. Updates #869 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	54e6c3a290	version: use OSS repo's version when building. ... When building with redo, also include the git commit hash from the proprietary repo, so that we have a precise commit that identifies all build info (including Go toolchain version). Add a top-level build script demonstrating to downstream distros how to burn the right information into builds. Adjust `tailscale version` to print commit hashes when available. Fixes #841. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	d6ad41dcea	ipn: send machine key to clients so they can downgrade to 1.0.x if needed ... Fixes #732 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e72f480d22	ipn: convert an int to a bool	4 years ago
Brad Fitzpatrick	999bc93a4d	ipn: log active account on change ... Updates tailscale/corp#461	4 years ago
Brad Fitzpatrick	66d196326f	ipn: rename 'new' variable to 'newp' ... Both to avoid shadowing new and because new is a little vague for such a long method handling multiple new & old things.	4 years ago
Brad Fitzpatrick	6b1d2a5630	ipn: don't set DebugFlags to len 1 slice of empty string [""] ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	62d941dc26	tailcfg: add a DebugFlags field for experiments and debugging. ... Also replaces the IPv6Overlay bool with use of DebugFlags, since it's currently an experimental configuration. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	7c8ca28c74	ipn: use cmd/cloner for Prefs.Clone ... Also, make cmd/cloner's top-level "func Clone" generation opt-in. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1fd9958e9d	ipn: wait for initial portpoll result before starting controlclient ... We were creating the controlclient and starting the portpoll concurrently, which frequently resulted in the first controlclient connection being canceled by the firsdt portpoll result ~milliseconds later, resulting in another HTTP request. Instead, wait a bit for the first portpoll result so it's much less likely to interrupt our controlclient connection. Updates tailscale/corp#557	4 years ago
Brad Fitzpatrick	515866d7c6	ipn, ipnserver, cmd/tailscale: add "server mode" support on Windows ... This partially (but not yet fully) migrates Windows to tailscaled's StateStore storage system. This adds a new bool Pref, ForceDaemon, defined as: // ForceDaemon specifies whether a platform that normally // operates in "client mode" (that is, requires an active user // logged in with the GUI app running) should keep running after the // GUI ends and/or the user logs out. // // The only current applicable platform is Windows. This // forced Windows to go into "server mode" where Tailscale is // running even with no users logged in. This might also be // used for macOS in the future. This setting has no effect // for Linux/etc, which always operate in daemon mode. Then, when ForceDaemon becomes true, we now write use the StateStore to track which user started it in server mode, and store their prefs under that key. The ipnserver validates the connections/identities and informs that LocalBackend which userid is currently in charge. The GUI can then enable/disable server mode at runtime, without using the CLI. But the "tailscale up" CLI was also fixed, so Windows users can use authkeys or ACL tags, etc. Updates #275	4 years ago