tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	03d5d1f0f9	wgengine/magicsock: disable portmapper in tunchan-faked tests Most of the magicsock tests fake the network, simulating packets going out and coming in. There's no reason to actually hit your router to do UPnP/NAT-PMP/PCP during in tests. But while debugging thousands of iterations of tests to deflake some things, I saw it slamming my router. This stops that. Updates #11762 Change-Id: I59b9f48f8f5aff1fa16b4935753d786342e87744 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	7c1d6e35a5	all: use Go 1.22 range-over-int Updates #11058 Change-Id: I35e7ef9b90e83cac04ca93fd964ad00ed5b48430 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	0fba9e7570	cmd/tailscale/cli: prevent concurrent Start calls in 'up' Seems to deflake tstest/integration tests. I can't reproduce it anymore on one of my VMs that was consistently flaking after a dozen runs before. Now I can run hundreds of times. Updates #11649 Fixes #7036 Change-Id: I2f7d4ae97500d507bdd78af9e92cd1242e8e44b8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Claire Wang	9171b217ba	cmd/tailscale, ipn/ipnlocal: add suggest exit node CLI option (#11407 ) Updates tailscale/corp#17516 Signed-off-by: Claire Wang <claire@tailscale.com>	7 months ago
Charlotte Brandhorst-Satzkorn	449f46c207	wgengine/magicsock: rebind/restun if a syscall.EPERM error is returned (#11711 ) We have seen in macOS client logs that the "operation not permitted", a syscall.EPERM error, is being returned when traffic is attempted to be sent. This may be caused by security software on the client. This change will perform a rebind and restun if we receive a syscall.EPERM error on clients running darwin. Rebinds will only be called if we haven't performed one specifically for an EPERM error in the past 5 seconds. Updates #11710 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	7 months ago
James Tucker	a2eb1c22b0	wgengine/magicsock: allow disco communication without known endpoints Just because we don't have known endpoints for a peer does not mean that the peer should become unreachable. If we know the peers key, it should be able to call us, then we can talk back via whatever path it called us on. First step - don't drop the packet in this context. Updates tailscale/corp#19106 Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
James Tucker	6e334e64a1	net/netcheck,wgengine/magicsock: align DERP frame receive time heuristics The netcheck package and the magicksock package coordinate via the health package, but both sides have time based heuristics through indirect dependencies. These were misaligned, so the implemented heuristic aimed at reducing DERP moves while there is active traffic were non-operational about 3/5ths of the time. It is problematic to setup a good test for this integration presently, so instead I added comment breadcrumbs along with the initial fix. Updates #8603 Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
Brad Fitzpatrick	a36cfb4d3d	tailcfg, ipn/ipnlocal, wgengine/magicsock: add only-tcp-443 node attr Updates tailscale/corp#17879 Change-Id: I0dc305d147b76c409cf729b599a94fa723aef0e0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	5d1c72f76b	wgengine/magicsock: don't use endpoint debug ringbuffer on mobile. Save some memory. Updates tailscale/corp#18514 Change-Id: Ibcaf3c6d8e5cc275c81f04141d0f176e2249509b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Andrew Dunham	f072d017bd	wgengine/magicsock: don't change DERP home when not connected to control This pretty much always results in an outage because peers won't discover our new home region and thus won't be able to establish connectivity. Updates tailscale/corp#18095 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic0d09133f198b528dd40c6383b16d7663d9d37a7	9 months ago
Andrew Dunham	4338db28f7	wgengine/magicsock: prefer link-local addresses to private ones Since link-local addresses are definitionally more likely to be a direct (lower-latency, more reliable) connection than a non-link-local private address, give those a bit of a boost when selecting endpoints. Updates #8097 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I93fdeb07de55ba39ba5fcee0834b579ca05c2a4e	9 months ago
Brad Fitzpatrick	69f4b4595a	wgengine{,/wgint}: add wgint.Peer wrapper type, add to wgengine.Engine This adds a method to wgengine.Engine and plumbed down into magicsock to add a way to get a type-safe Tailscale-safe wrapper around a wireguard-go device.Peer that only exposes methods that are safe for Tailscale to use internally. It also removes HandshakeAttempts from PeerStatusLite that was just added as it wasn't needed yet and is now accessible ala cart as needed from the Peer type accessor. None of this is used yet. Updates #7617 Change-Id: I07be0c4e6679883e6eeddf8dbed7394c9e79c5f4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	e1bd7488d0	all: remove LenIter, use Go 1.22 range-over-int instead Updates #11058 Updates golang/go#65685 Change-Id: Ibb216b346e511d486271ab3d84e4546c521e4e22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Jordan Whited	8b47322acc	wgengine/magicsock: implement probing of UDP path lifetime (#10844 ) This commit implements probing of UDP path lifetime on the tail end of an active direct connection. Probing configuration has two parts - Cliffs, which are various timeout cliffs of interest, and CycleCanStartEvery, which limits how often a probing cycle can start, per-endpoint. Initially a statically defined default configuration will be used. The default configuration has cliffs of 10s, 30s, and 60s, with a CycleCanStartEvery of 24h. Probing results are communicated via clientmetric counters. Probing is off by default, and can be enabled via control knob. Probing is purely informational and does not yet drive any magicsock behaviors. Updates #540 Signed-off-by: Jordan Whited <jordan@tailscale.com>	10 months ago
Claire Wang	213d696db0	magicsock: mute noisy expected peer mtu related error (#10870 )	10 months ago
Jordan Whited	b084888e4d	wgengine/magicsock: fix typos in docs (#10729 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	11 months ago
Andrew Lytvynov	2716250ee8	all: cleanup unused code, part 2 (#10670 ) And enable U1000 check in staticcheck. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Jordan Whited	685b853763	wgengine/magicsock: fix handling of derp.PeerGoneMessage (#10589 ) The switch in Conn.runDerpReader() on the derp.ReceivedMessage type contained cases other than derp.ReceivedPacket that fell through to writing to c.derpRecvCh, which should only be reached for derp.ReceivedPacket. This can result in the last/previous derp.ReceivedPacket to be re-handled, effectively creating a duplicate packet. If the last derp.ReceivedPacket happens to be a disco.CallMeMaybe it may result in a disco ping scan towards the originating peer on the endpoints contained. The change in this commit moves the channel write on c.derpRecvCh and subsequent select awaiting the result into the derp.ReceivedMessage case, preventing it from being reached from any other case. Explicit continue statements are also added to non-derp.ReceivedPacket cases where they were missing, in order to signal intent to the reader. Fixes #10586 Signed-off-by: Jordan Whited <jordan@tailscale.com>	12 months ago
Andrew Dunham	727acf96a6	net/netcheck: use DERP frames as a signal for home region liveness This uses the fact that we've received a frame from a given DERP region within a certain time as a signal that the region is stil present (and thus can still be a node's PreferredDERP / home region) even if we don't get a STUN response from that region during a netcheck. This should help avoid DERP flaps that occur due to losing STUN probes while still having a valid and active TCP connection to the DERP server. RELNOTE=Reduce home DERP flapping when there's still an active connection Updates #8603 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If7da6312581e1d434d5c0811697319c621e187a0	12 months ago
Naman Sood	d46a4eced5	util/linuxfw, wgengine: allow ingress to magicsock UDP port on Linux (#10370 ) * util/linuxfw, wgengine: allow ingress to magicsock UDP port on Linux Updates #9084. Currently, we have to tell users to manually open UDP ports on Linux when certain firewalls (like ufw) are enabled. This change automates the process of adding and updating those firewall rules as magicsock changes what port it listens on. Signed-off-by: Naman Sood <mail@nsood.in>	12 months ago
Jordan Whited	1af7f5b549	wgengine/magicsock: fix typo in Conn.handlePingLocked() (#10365 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Brad Fitzpatrick	4d196c12d9	health: don't report a warning in DERP homeless mode Updates #3363 Updates tailscale/corp#396 Change-Id: Ibfb0496821cb58a78399feb88d4206d81e95ca0f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	3bd382f369	wgengine/magicsock: add DERP homeless debug mode for testing In DERP homeless mode, a DERP home connection is not sought or maintained and the local node is not reachable. Updates #3363 Updates tailscale/corp#396 Change-Id: Ibc30488ac2e3cfe4810733b96c2c9f10a51b8331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jordan Whited	2ff54f9d12	wgengine/magicsock: move trustBestAddrUntil forward on non-disco rx (#10274 ) This is gated behind the silent disco control knob, which is still in its infancy. Prior to this change disco pong reception was the only event that could move trustBestAddrUntil forward, so even though we weren't heartbeating, we would kick off discovery pings every trustUDPAddrDuration and mirror to DERP. Updates #540 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Jordan Whited	c99488ea19	wgengine/magicsock: fix typo in endpoint.sendDiscoPing() docs (#10232 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Jordan Whited	e848736927	control/controlknobs,wgengine/magicsock: implement SilentDisco toggle (#10195 ) This change exposes SilentDisco as a control knob, and plumbs it down to magicsock.endpoint. No changes are being made to magicsock.endpoint disco behavior, yet. Updates #540 Signed-off-by: Jordan Whited <jordan@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Charlotte Brandhorst-Satzkorn	839fee9ef4	wgengine/magicsock: handle wireguard only clean up and log messages This change updates log messaging when cleaning up wireguard only peers. This change also stops us unnecessarily attempting to clean up disco pings for wireguard only endpoints. Updates #7826 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	1 year ago
Brad Fitzpatrick	514539b611	wgengine/magicsock: close disco listeners on Conn.Close, fix Linux root TestNewConn TestNewConn now passes as root on Linux. It wasn't closing the BPF listeners and their goroutines. The code is still a mess of two Close overlapping code paths, but that can be refactored later. For now, make the two close paths more similar. Updates #9945 Change-Id: I8a3cf5fb04d22ba29094243b8e645de293d9ed85 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jordan Whited	891d964bd4	wgengine/magicsock: simplify tryEnableUDPOffload() (#9872 ) Don't assume Linux lacks UDP_GRO support if it lacks UDP_SEGMENT support. This mirrors a similar change in wireguard/wireguard-go@177caa7 for consistency sake. We haven't found any issues here, just being overly paranoid. Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Brad Fitzpatrick	c363b9055d	tstest/integration: add tests for tun mode (requiring root) Updates #7894 Change-Id: Iff0b07b21ae28c712dd665b12918fa28d6f601d0 Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	a6270826a3	wgengine/magicsock: fix data race regression in disco ping callbacks Regression from `c15997511d`. The callback could be run multiple times from different endpoints. Fixes #9801 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	5297bd2cff	cmd/tailscaled,net/tstun: fix data race on start-up in TUN mode Fixes #7894 Change-Id: Ice3f8019405714dd69d02bc07694f3872bb598b8 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Val	249edaa349	wgengine/magicsock: add probed MTU metrics Record the number of MTU probes sent, the total bytes sent, the number of times we got a successful return from an MTU probe of a particular size, and the max MTU recorded. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	893bdd729c	disco,net/tstun,wgengine/magicsock: probe peer MTU Automatically probe the path MTU to a peer when peer MTU is enabled, but do not use the MTU information for anything yet. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Brad Fitzpatrick	6f36f8842c	cmd/tailscale, magicsock: add debug command to flip DERP homes For testing netmap patchification server-side. Updates #1909 Change-Id: Ib1d784bd97b8d4a31e48374b4567404aae5280cc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	f991c8a61f	tstest: make ResourceCheck panic on parallel tests To find potential flakes earlier. Updates #deflake-effort Change-Id: I52add6111d660821c3a23d4b1dd032821344bc48 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jordan Whited	eb22c0dfc7	wgengine/magicsock: use binary.NativeEndian for UDP GSO control data (#9640 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Val	4130851f12	wgengine/magicsock: probe but don't use path MTU from CLI ping When sending a CLI ping with a specific size, continue to probe all possible UDP paths to the peer until we find one with a large enough MTU to accommodate the ping. Record any peer path MTU information we discover (but don't use it for anything other than CLI pings). Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	67926ede39	wgengine/magicsock: add MTU to addrLatency and rename to addrQuality Add a field to record the wire MTU of the path to this address to the addrLatency struct and rename it addrQuality. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Brad Fitzpatrick	425cf9aa9d	tailcfg, all: use []netip.AddrPort instead of []string for Endpoints It's JSON wire compatible. Updates #cleanup Change-Id: Ifa5c17768fec35b305b06d75eb5f0611c8a135a6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jordan Whited	16fa3c24ea	wgengine/magicsock: use x/sys/unix constants for UDP GSO (#9597 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
James Tucker	80206b5323	wgengine/magicsock: add nodeid to panic condition on public key reuse If the condition arises, it should be easy to track down. Updates #9547 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Val	c608660d12	wgengine,net,ipn,disco: split up and define different types of MTU Prepare for path MTU discovery by splitting up the concept of DefaultMTU() into the concepts of the Tailscale TUN MTU, MTUs of underlying network interfaces, minimum "safe" TUN MTU, user configured TUN MTU, probed path MTU to a peer, and maximum probed MTU. Add a set of likely MTUs to probe. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Brad Fitzpatrick	3b32d6c679	wgengine/magicsock, controlclient, net/dns: reduce some logspam Updates #cleanup Change-Id: I78b0697a01e94baa33f3de474b591e616fa5e6af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Val	6cc5b272d8	Revert "wgengine,net,ipn,disco: split up and define different types of MTU" This reverts commit `059051c58a`. Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	059051c58a	wgengine,net,ipn,disco: split up and define different types of MTU Prepare for path MTU discovery by splitting up the concept of DefaultMTU() into the concepts of the Tailscale TUN MTU, MTUs of underlying network interfaces, minimum "safe" TUN MTU, user configured TUN MTU, probed path MTU to a peer, and maximum probed MTU. Add a set of likely MTUs to probe. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	65dc711c76	control,tailcfg,wgengine/magicsock: add nodeAttr to enable/disable peer MTU Add a nodeAttr to enable/disable peer path MTU discovery. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	95635857dc	wgengine/magicsock: replace CanPMTUD() with ShouldPMTUD() Replace CanPMTUD() with ShouldPMTUD() to check if peer path MTU discovery should be enabled, in preparation for adding support for enabling/disabling peer MTU dynamically. Updated #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	a5ae21a832	wgengine/magicsock: improve don't fragment bit set/get support Add an enable/disable argument to setDontFragment() in preparation for dynamic enable/disable of peer path MTU discovery. Add getDontFragment() to get the status of the don't fragment bit from a socket. Updates #311 Co-authored-by: James Tucker <james@tailscale.com> Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	4c793014af	wgengine/magicsock: fix don't fragment setsockopt arg for IPv6 on linux Use IPV6_MTU_DISCOVER for setting don't fragment on IPv6 sockets on Linux (was using IP_MTU_DISCOVER, the IPv4 arg). Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago

1 2 3 4 5 ...

682 Commits (5d4b4ffc3c16e1d7a4101de9105b081d69188a12)