tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	74674b110d	envknob: support changing envknobs post-init Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	cf61070e26	net/dnscache: add better logging to bootstrap DNS path (#5640 ) Change-Id: I4cde3a72e06dac18df856a0cfeac10ab7e3a9108 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Kris Brandow	19008a3023	net/dnscache: use net/netip Removes usage of net.IP and net.IPAddr where possible from net/dnscache. Fixes #5282 Signed-off-by: Kris Brandow <kris.brandow@gmail.com>	2 years ago
Kris Brandow	9ae1161e85	net/dnscache: fix v4addrs to return only v4 addrs Update the v4addrs function to filter out IPv6 addresses. Fixes regression from `8725b14056`. Signed-off-by: Kris Brandow <kris.brandow@gmail.com>	2 years ago
Andrew Dunham	d942a2ff56	net/dnscache: try IPv6 addresses first (#5349 ) Signed-off-by: Andrew Dunham <andrew@tailscale.com> Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Brad Fitzpatrick	8725b14056	all: migrate more code code to net/netip directly Instead of going through the tailscale.com/net/netaddr transitional wrappers. Updates #5162 Change-Id: I3dafd1c2effa1a6caa9b7151ecf6edd1a3fda3dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a12aad6b47	all: convert more code to use net/netip directly perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6a396731eb	all: use various net/netip parse funcs directly Mechanical change with perl+goimports. Changed {Must,}Parse{IP,IPPrefix,IPPort} to their netip variants, then goimports -d . Finally, removed the net/netaddr wrappers, to prevent future use. Updates #5162 Change-Id: I59c0e38b5fbca5a935d701645789cddf3d7863ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7eaf5e509f	net/netaddr: start migrating to net/netip via new netaddr adapter package Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	aa37aece9c	ipn/ipnlocal, net/dns, util/cloudenv: add AWS DNS support And remove the GCP special-casing from ipn/ipnlocal; do it only in the forwarder for .internal. Fixes #4980 Fixes #4981 Change-Id: I5c481e96d91f3d51d274a80fbd37c38f16dfa5cb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	88c2afd1e3	ipn/ipnlocal, net/dns, util/cloudenv: specialize DNS config on Google Cloud This does three things: If you're on GCP, it adds a .internal DNS split route to the metadata server, so we never break GCP DNS names. This lets people have some Tailscale nodes on GCP and some not (e.g. laptops at home) without having to add a Tailnet-wide .internal DNS route. If you already have such a route, though, it won't overwrite it. * If the 100.100.100.100 DNS forwarder has nowhere to forward to, it forwards it to the GCP metadata IP, which forwards to 8.8.8.8. This means there are never errNoUpstreams ("upstream nameservers not set") errors on GCP due to e.g. mangled /etc/resolv.conf (GCP default VMs don't have systemd-resolved, so it's likely a DNS supremacy fight) * makes the DNS fallback mechanism use the GCP metadata IP as a fallback before our hosted HTTP-based fallbacks I created a default GCP VM from their web wizard. It has no systemd-resolved. I then made its /etc/resolv.conf be empty and deleted its GCP hostnames in /etc/hosts. I then logged in to a tailnet with no global DNS settings. With this, tailscaled writes /etc/resolv.conf (direct mode, as no systemd-resolved) and sets it to 100.100.100.100, which then has regular DNS via the metadata IP and .internal DNS via the metadata IP as well. If the tailnet configures explicit DNS servers, those are used instead, except for .internal. This also adds a new util/cloudenv package based on version/distro where the cloud type is only detected once. We'll likely expand it in the future for other clouds, doing variants of this change for other popular cloud environments. Fixes #4911 RELNOTES=Google Cloud DNS improvements Change-Id: I19f3c2075983669b2b2c0f29a548da8de373c7cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	13d0b8e6a4	control/controlclient, net/dnscache: use typed singleflight fork Change-Id: I12be4c5a91ae3a812fe88d9b2d15526fdbb5a921 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ecea6cb994	net/dns/resolver: make DoH dialer use existing dnscache happy eyeball dialer Simplify the ability to reason about the DoH dialing code by reusing the dnscache's dialer we already have. Also, reduce the scope of the "ip" variable we don't want to close over. This necessarily adds a new field to dnscache.Resolver: SingleHostStaticResult, for when the caller already knows the IPs to be returned. Change-Id: I9f2aef7926f649137a5a3e63eebad6a3fffa48c0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	b45bb577a0	net/dnscache: do not call LookupIPFallback if the context was canceled. When the context is canceled, dc.dialOne returns an error from line 345. This causes the defer on line 312 to try to resolve the host again, which triggers a dns lookup of "127.0.0.1" from derp. Updates tailscale/corp#4475 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Josh Bleecher Snyder	0868329936	all: use any instead of interface{} My favorite part of generics. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	8d6cf14456	net/dnscache: don't do bootstrap DNS lookup after most failed dials If we've already connected to a certain name's IP in the past, don't assume the problem was DNS related. That just puts unnecessarily load on our bootstrap DNS servers during regular restarts of Tailscale infrastructure components. Also, if we do do a bootstrap DNS lookup and it gives the same IP(s) that we already tried, don't try them again. Change-Id: I743e8991a7f957381b8e4c1508b8e9d0df1782fe Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	903988b392	net/dnscache: refactor from func-y closure-y state to types & methods No behavior changes (intended, at least). This is in prep for future changes to this package, which would get too complicated in the current style. Change-Id: Ic260f8e34ae2f64f34819d4a56e38bee8d8ac5ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	463b3e8f62	net/dnscache: use tls.Conn.HandshakeContext. Go 1.17 added a HandshakeContext func to take care of timeouts during TLS handshaking, so switch from our homegrown goroutine implementation to the standard way. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	a9da6b73a8	net/dnscache: don't cancel the TLS context before writing to the result channel. Cancelling the context makes the timeout goroutine race with the write that reports a successful TLS handshake, so you can end up with a successful TLS handshake that mysteriously reports that it timed out after ~0s in flight. The context is always canceled and cleaned up as the function exits, which happens mere microseconds later, so just let function exit clean up and thereby avoid races. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	39ffa16853	net/dnscache, net/tsdial: add DNS caching to tsdial UserDial This is enough to handle the DNS queries as generated by Go's net package (which our HTTP/SOCKS client uses), and the responses generated by the ExitDNS DoH server. This isn't yet suitable for putting on 100.100.100.100 where a number of different DNS clients would hit it, as this doesn't yet do EDNS0. It might work, but it's untested and likely incomplete. Likewise, this doesn't handle anything about truncation, as the exchanges are entirely in memory between Go or DoH. That would also need to be handled later, if/when it's hooked up to 100.100.100.100. Updates #3507 Change-Id: I1736b0ad31eea85ea853b310c52c5e6bf65c6e2a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	aaf2df7ab1	net/{dnscache,interfaces}: use netaddr.IP.IsPrivate, delete copied code Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c17d743886	net/dnscache: update a comment Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	281d503626	net/dnscache: make Dialer try all resolved IPs Tested manually with: $ go test -v ./net/dnscache/ -dial-test=bogusplane.dev.tailscale.com:80 Where bogusplane has three A records, only one of which works. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e299300b48	net/dnscache: cache all IPs per hostname Not yet used in the dialer, but plumbed around. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9df4185c94	control/controlclient, net/{dnscache,dnsfallback}: add DNS fallback mechanism Updates #1405 Updates #1403 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	66be052a70	net/dnscache: work on IPv6-only hosts (again) This fixes the regression where we had stopped working on IPv6-only hosts. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a2d78b4d3e	net/dnscache, control/controlclient: use DNS cache when dialing control Cache DNS results of earlier login.tailscale.com control dials, and use them for future dials if DNS is slow or broken. Fixes various issues with trickier setups with the domain's DNS server behind a subnet router. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	19b0cfe89e	all: prepare for GOOS=ios in Go 1.16 Work with either way for now on iOS (darwin/arm64 vs ios/arm64). In February when Go 1.16 comes out we'll have a universal binary for darwin/arm64 (macOS) and will drop support for Go 1.15 and its darwin/amd64 meaning iOS. (it'll mean macOS). Context: * https://tip.golang.org/doc/go1.16#darwin * https://github.com/golang/go/issues/38485 * https://github.com/golang/go/issues/42100	4 years ago
David Anderson	657f331e8b	net/dnscache: remove unnecessary lint warning.	5 years ago
Elias Naur	ad0795efc2	net/dnscache: don't use the Go resolver on Android The local resolver is not available for apps on Android. Signed-off-by: Elias Naur <mail@eliasnaur.com>	5 years ago
Brad Fitzpatrick	bd0e20f351	net/dnscache: ignore annoying staticcheck check	5 years ago
Brad Fitzpatrick	d44325295e	net/dnscache: initialize the single Resolver more directly	5 years ago
David Crawshaw	cac68fe102	net/dnscache: do not PreferGo on macOS/iOS With this commit my iPhone can now DERP.	5 years ago
Brad Fitzpatrick	8f0fd01efd	net/dnscache: add copyright header to test	5 years ago
David Crawshaw	5a1ce4adae	net/dnscache: parse passed CIDR Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	2cff9016e4	net/dnscache: add overly simplistic DNS cache package for selective use I started to write a full DNS caching resolver and I realized it was overkill and wouldn't work on Windows even in Go 1.14 yet, so I'm doing this tiny one instead for now, just for all our netcheck STUN derp lookups, and connections to DERP servers. (This will be caching a exactly 8 DNS entries, all ours.) Fixes #145 (can be better later, of course)	5 years ago

37 Commits (5623ef0271c8069f895f30bac9789c63aaf6943e)