123 Commits (5b7303817eb5fe9d63b05a129be33d36d50301c7)

Author	SHA1	Message	Date
Josh Bleecher Snyder	3fd5f4380f	util/multierr: new package ... github.com/go-multierror/multierror served us well. But we need a few feature from it (implement Is), and it's not worth maintaining a fork of such a small module. Instead, I did a clean room implementation inspired by its API. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	408b0923a6	wgengine/router: remove last non-test "ip" command usage on Linux ... Updates #391 Change-Id: Ic2c3f8460b1e4b8d34b936a1725705fcc1effbae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ff1954cfd9	wgengine/router: use netlink for ip rules on Linux ... Using temporary netlink fork in github.com/tailscale/netlink until we get the necessary changes upstream in either vishvananda/netlink or jsimonetti/rtnetlink. Updates #391 Change-Id: I6e1de96cf0750ccba53dabff670aca0c56dffb7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	19189d7018	wgengine/router: add a addrFamily type [linux] ... In prep for more netlink-ification. Change-Id: I7c34a04001988107dc2583597aa4f26ddb887e91	3 years ago
Brad Fitzpatrick	7c40a5d440	wgengine/router: refactor in prep for Linux netlink-ification ... Pull out the list of policy routing rules to a data structure now shared between the add & delete paths, but to also be shared by the netlink paths in a future change. Updates #391 Change-Id: I119ab1c246f141d639006c808b61c585c3d67924 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	aad46bd9ff	wgengine/router: stop cleaning up old dev rules on Linux ... Anybody using that one old, unreleased version of Tailscale from over a year ago should've rebooted their machine by now to get various non-Tailscale security updates. :) Change-Id: If9e043cb008b20fcd6ddfd03756b3b23a9d7aeb5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	dc2fbf5877	wgengine/router: start using netlink instead of 'ip' on Linux ... Converts up, down, add/del addresses, add/del routes. Not yet done: rules. Updates #391 Change-Id: I02554ca07046d18f838e04a626ba99bbd35266fb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	53199738fb	wgengine: don't try to delete legacy netfilter rules on synology. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	27799a1a96	wgengine: only use AmbientCaps on DSM7+ ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	14f9c75293	wgengine/router: ignore Linux ip route error adding dup route ... Updates #3060 Updates #391 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
nicksherron	f01ff18b6f	all: fix spelling mistakes ... Signed-off-by: nicksherron <nsherron90@gmail.com>	3 years ago
Maisem Ali	5c383bdf5d	wgengine/router: pass in AmbientCaps when calling `ip rule` ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	e4fecfe31d	wgengine/{monitor,router}: restore Linux ip rules when systemd deletes them ... Thanks. Fixes #1591 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ed8587f90d	wgengine/router: take a link monitor ... Prep for #1591 which will need to make Linux's router react to changes that the link monitor observes. The router package already depended on the monitor package transitively. Now it's explicit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	1ece91cede	go.mod: upgrade wireguard-windows, de-fork wireguard-go ... Pull in the latest version of wireguard-windows. Switch to upstream wireguard-go. This requires reverting all of our import paths. Unfortunately, this has to happen at the same time. The wireguard-go change is very low risk, as that commit matches our fork almost exactly. (The only changes are import paths, CI files, and a go.mod entry.) So if there are issues as a result of this commit, the first place to look is wireguard-windows changes. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types ... This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Maisem Ali	1b9d8771dc	ipn/ipnlocal,wgengine/router,cmd/tailscale: add flag to allow local lan access when routing traffic via an exit node. ... For #1527 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
David Anderson	4c61ebacf4	wgengine: move DNS configuration out of wgengine/router. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	fcfc0d3a08	net/dns: remove ManagerConfig, pass relevant args directly. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0a84aaca0a	wgengine/router: remove unused wireguard *Device argument. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	672731ac6f	many: gofmt. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9f7f2af008	wgengine/router/dns: move to net/dns. ... Preparation for merging the APIs and whatnot. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	2d96215d97	wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible ... This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	96a488e37e	wgengine/router: simplify func normalizeCIDR using netaddr method	4 years ago
Brad Fitzpatrick	d76334d2f0	ipn: split LocalBackend off into new ipn/ipnlocal package ... And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a2aa6cd2ed	wgengine/router: clarify disabled IPv6 message on Linux	4 years ago
David Anderson	267531e4f8	wgengine/router: probe better for v6 policy routing support. ... Previously we disabled v6 support if the disable_policy knob was missing in /proc, but some kernels support policy routing without exposing the toggle. So instead, treat disable_policy absence as a "maybe", and make the direct `ip -6 rule` probing a bit more elaborate to compensate. Fixes #1241. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	c7fc4a06da	wgengine/router: don't configure IPv6 on Linux when IPv6 is unavailable ... Fixes #1214 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	0d94fe5f69	wgengine/router: disable IPv6 on Linux if ip rule -6 fails (#1074) ... Updates #562 Fixes #973 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	a664aac877	wgengine/router: disable IPv6 if v6 policy routing is unavailable. ... Fixes #895. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	ff0cf6340a	wgengine/router: fix configuration of loopback netfilter rules for v6. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c493e5804f	wgengine/router: make v6-ness configurable in test, for consistent results. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	bbb56f2303	wgengine/router: fix tests on Debian Buster as regular user on machine with IPv6	4 years ago
David Anderson	fddbcb0c7b	wgengine/router: support various degrees of broken IPv6. ... Gracefully skips touching the v6 NAT table on systems that don't have it, and doesn't configure IPv6 at all if IPv6 is globally disabled. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0d80904fc2	wgengine/router: set up basic IPv6 routing/firewalling. ... Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Christina Wen	f0e9dcdc0a	wgengine/router: restore /etc/resolv.conf after tailscale down is called ... This change is to restore /etc/resolv.conf after tailscale down is called. This is done by setting the dns.Manager before errors occur. Error collection is also added. Fixes #723	4 years ago
Christina Wen	e862f90e34	wgengine/router/router_linux.go: fixed " route del failed" error (#756) ... * wgengine/router/router_linux.go: Switched `cidrDiff("addr")` and `cidrDiff("route")` order Signed-off-by: Christina Wen <christina@tailscale.com> Co-authored-by: Christina Wen <christina@tailscale.com>	4 years ago
Brad Fitzpatrick	a084c44afc	wgengine, wgengine/router, cmd/tailscale: force netfilter mode off on Synology ... For now. Get it working again so it's not stuck on 0.98. Subnet relay can come later. Updates #451 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Dmytro Shynkevych	28e52a0492	all: dns refactor, add Proxied and PerDomain flags from control (#615) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
David Anderson	189d86cce5	wgengine/router: don't use 88 or 8888 as table/rule numbers. ... We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d60917c0f1	wgengine/router: switch packet marks to avoid conflict with Weave Net. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Dmytro Shynkevych	30bbbe9467	wgengine/router: dns: unify on *BSD, multimode on Linux, Magic DNS (#536) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	742b8b44a8	net/tsaddr: new package to hold Tailscale-specific IPs/ranges ... And update existing callers with (near) duplicated cases.	4 years ago
David Anderson	5a32f8e181	wgengine/router: also accept exit code 254 from `ip rule del`. ... iproute2 3.16.0-2 from Debian Jessie (oldoldstable) doesn't return exit code 2 when deleting a non-existent IP rule. Fixes #434 Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	08a38f21c9	wgengine/router: don't filter subnet routing in netfilter. ... We have a filter in tailscaled itself now, which is more robust against weird network topologies (such as the one Docker creates). Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	e7ae6a2e06	net/netns, wgengine/router: support Linux machines that don't have 'ip rule'. ... We'll use SO_BINDTODEVICE instead of fancy policy routing. This has some limitations: for example, we will route all traffic through the interface that has the main "default" (0.0.0.0/0) route, so machines that have multiple physical interfaces might have to go through DERP to get to some peers. But machines with multiple physical interfaces are very likely to have policy routing (ip rule) support anyway. So far, the only OS I know of that needs this feature is ChromeOS (crostini). Fixes #245. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
David Anderson	5114df415e	net/netns: set the bypass socket mark on linux. ... This allows tailscaled's own traffic to bypass Tailscale-managed routes, so that things like tailscale-provided default routes don't break tailscaled itself. Progress on #144. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	f69003fd46	router_linux: work around terrible bugs in old iptables-compat versions. ... Specifically, this sequence: iptables -N ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT iptables -A FORWARD -j ts-forward doesn't work on Debian-9-using-nftables, but this sequence: iptables -N ts-forward iptables -A FORWARD -j ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT does work. I'm sure the reason why is totally fascinating, but it's an old version of iptables and the bug doesn't seem to exist on modern nftables, so let's refactor our code to add rules in the always-safe order and pretend this never happened. Fixes #401. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	9ff51909a3	router_linux: fix behaviour when switching --netfilter-mode. ... On startup, and when switching into =off and =nodivert, we were deleting netfilter rules even if we weren't the ones that added them. In order to avoid interfering with rules added by the sysadmin, we have to be sure to delete rules only in the case that we added them in the first place. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	a496cdc943	router_linux: remove need for iptables.ListChains(). ... Instead of retrieving the list of chains, or the list of rules in a chain, just try deleting the ones we don't want and then adding the ones we do want. An error in flushing/deleting still means the rule doesn't exist anymore, so there was no need to check for it first. This avoids the need to parse iptables output, which avoids the need to ever call iptables -S, which fixes #403, among other things. It's also much more future proof in case the iptables command line changes. Unfortunately the iptables go module doesn't properly pass the iptables command exit code back up when doing .Delete(), so we can't correctly check the exit code there. (exit code 1 really means the rule didn't exist, rather than some other weird problem). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	8a6bd21baf	router_linux: extract process runner routines into runner.go. ... These will probably be useful across platforms. They're not really Linux-specific at all. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	34c30eaea0	router_linux: use only baseline 'ip rule' features that exist in old kernels. ... This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
David Anderson	7fb33123d3	wgengine/router: warn about another variation of busybox's `ip`. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	9c914dc7dd	wgengine/router: stop using -m comment. ... The comment module is compiled out on several embedded systems (and also gentoo, because netfilter can't go brrrr with comments holding it back). Attempting to use comments results in a confusing error, and a non-functional firewall. Additionally, make the legacy rule cleanup non-fatal, because we *do* have to probe for the existence of these -m comment rules, and doing so will error out on these systems. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	3e27b3c33c	wgengine/router: more comments. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	0fe262f093	ipn: plumb NetfilterMode all the way out to the CLI. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	c67c8913c3	wgengine/router: add a test for linux router state transitions. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	292606a975	wgengine/router: support multiple levels of netfilter involvement. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	9ccbcda612	wgengine/router: rename config.Settings to config.Config, make pointer. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	cd01bcc395	wgengine/router: allow loopback traffic from our own IP(s). ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	bfdc8175b1	wgengine/router: add a setting to disable SNAT for subnet routes. ... Part of #320. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	21ac65d3da	wgengine/router: explicitly detect and complain about busybox's `ip`. ... Defensive programming against #368 in environments other than Docker, e.g. if you try using Tailscale in Alpine Linux directly, sans container. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	381b94d4d1	wgengine/router: include command output if `ip rule list` fails. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	efc1feedc9	wgengine/router: include more information when iptables ops fail. ... The iptables package we use doesn't include command output, so we're left with guessing what went wrong most of the time. This will at least narrow things down to which operation failed. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	b01db109f5	wgengine/router: use inet.af/netaddr, not wgcfg.CIDR. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	b8f01eed34	wgengine/router: remove wireguard-go config from settings. ... Instead, pass in only exactly the relevant configuration pieces that the OS network stack cares about. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	8861bb5a19	wgengine/router: alter API to support multiple addrs, and use on linux. ... FreeBSD and OpenBSD will error out with a complaint if we pass >1 address right now, but we don't yet so that's okay.	5 years ago
David Anderson	6802481bf5	wgengine/router: don't use gateway routes on linux.	5 years ago
David Anderson	78b1ed39ea	wgengine/router: add more documentation.	5 years ago
David Anderson	c9de43cd59	wgengine/router: fix typo. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	89198b1691	wgengine/router: rewrite netfilter and routing logic. ... New logic installs precise filters for subnet routes, plays nice with other users of netfilter, and lays the groundwork for fixing routing loops via policy routing. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	7618d7e677	wgengine/router: simplify some cmd invocations. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	1ac570def7	wgengine/router: split out from wgengine. ... The router implementations are logically separate, with their own API. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago