tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	5ec01bf3ce	wgengine/filter: support FilterRules matching on srcIP node caps [capver 100] See #12542 for background. Updates #12542 Change-Id: Ida312f700affc00d17681dc7551ee9672eeb1789 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	162d593514	net/flowtrack: fix, test String method I meant to do this in the earlier change and had a git fail. To atone, add a test too while I'm here. Updates #12486 Updates #12507 Change-Id: I4943b454a2530cb5047636f37136aa2898d2ffc7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	9e0a5cc551	net/flowtrack: optimize Tuple type for use as map key This gets UDP filter overhead closer to TCP. Still ~2x, but no longer ~3x. goos: darwin goarch: arm64 pkg: tailscale.com/wgengine/filter │ before │ after │ │ sec/op │ sec/op vs base │ FilterMatch/tcp-not-syn-v4-8 15.43n ± 3% 15.38n ± 5% ~ (p=0.339 n=10) FilterMatch/udp-existing-flow-v4-8 42.45n ± 0% 34.77n ± 1% -18.08% (p=0.000 n=10) geomean 25.59n 23.12n -9.65% Updates #12486 Change-Id: I595cfadcc6b7234604bed9c4dd4261e087c0d4c4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	bd93c3067e	wgengine/filter/filtertype: make Match.IPProto a view I noticed we were allocating these every time when they could just share the same memory. Rather than document ownership, just lock it down with a view. I was considering doing all of the fields but decided to just do this one first as test to see how infectious it became. Conclusion: not very. Updates #cleanup (while working towards tailscale/corp#20514) Change-Id: I8ce08519de0c9a53f20292adfbecd970fe362de0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	1f6645b19f	net/ipset: skip the loop over Prefixes when there's only one For pprof cosmetic/confusion reasons more than performance, but it might have tiny speed benefit. Updates #12486 Change-Id: I40e03714f3afa3a7e7f5e1fa99b81c7e889b91b6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	bf2d13cfa0	net/ipset: return all closures from named wrappers So profiles show more useful names than just func1, func2, func3, etc. There will still be func1 on them all, but the symbol before will say what the lookup type is. Updates #12486 Change-Id: I910b024a7861394eb83d07f5a899eae338cb1f22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	86e0f9b912	net/ipset, wgengine/filter/filtertype: add split-out packages This moves NewContainsIPFunc from tsaddr to new ipset package. And wgengine/filter types gets split into wgengine/filter/filtertype, so netmap (and thus the CLI, etc) doesn't need to bring in ipset, bart, etc. Then add a test making sure the CLI deps don't regress. Updates #1278 Change-Id: Ia246d6d9502bbefbdeacc4aef1bed9c8b24f54d5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	64ac64fb66	net/tsaddr: use bart in NewContainsIPFunc, add tests, benchmarks NewContainsIPFunc was previously documented as performing poorly if there were many netip.Prefixes to search over. As such, we never it used it in such cases. This updates it to use bart at a certain threshold (over 6 prefixes, currently), at which point the bart lookup overhead pays off. This is currently kinda useless because we're not using it. But now we can and get wins elsewhere. And we can remove the caveat in the docs. goos: darwin goarch: arm64 pkg: tailscale.com/net/tsaddr │ before │ after │ │ sec/op │ sec/op vs base │ NewContainsIPFunc/empty-8 2.215n ± 11% 2.239n ± 1% +1.08% (p=0.022 n=10) NewContainsIPFunc/cidr-list-1-8 17.44n ± 0% 17.59n ± 6% +0.89% (p=0.000 n=10) NewContainsIPFunc/cidr-list-2-8 27.85n ± 0% 28.13n ± 1% +1.01% (p=0.000 n=10) NewContainsIPFunc/cidr-list-3-8 36.05n ± 0% 36.56n ± 13% +1.41% (p=0.000 n=10) NewContainsIPFunc/cidr-list-4-8 43.73n ± 0% 44.38n ± 1% +1.50% (p=0.000 n=10) NewContainsIPFunc/cidr-list-5-8 51.61n ± 2% 51.75n ± 0% ~ (p=0.101 n=10) NewContainsIPFunc/cidr-list-10-8 95.65n ± 0% 68.92n ± 0% -27.94% (p=0.000 n=10) NewContainsIPFunc/one-ip-8 4.466n ± 0% 4.469n ± 1% ~ (p=0.491 n=10) NewContainsIPFunc/two-ip-8 8.002n ± 1% 7.997n ± 4% ~ (p=0.697 n=10) NewContainsIPFunc/three-ip-8 27.98n ± 1% 27.75n ± 0% -0.82% (p=0.012 n=10) geomean 19.60n 19.07n -2.71% Updates #12486 Change-Id: I2e2320cc4384f875f41721374da536bab995c1ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Nick Khyl	c32efd9118	various: create a catch-all NRPT rule when "Override local DNS" is enabled on Windows Without this rule, Windows 8.1 and newer devices issue parallel DNS requests to DNS servers associated with all network adapters, even when "Override local DNS" is enabled and/or a Mullvad exit node is being used, resulting in DNS leaks. This also adds "disable-local-dns-override-via-nrpt" nodeAttr that can be used to disable the new behavior if needed. Fixes tailscale/corp#20718 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Andrea Gottardo	a8ee83e2c5	health: begin work to use structured health warnings instead of strings, pipe changes into ipn.Notify (#12406 ) Updates tailscale/tailscale#4136 This PR is the first round of work to move from encoding health warnings as strings and use structured data instead. The current health package revolves around the idea of Subsystems. Each subsystem can have (or not have) a Go error associated with it. The overall health of the backend is given by the concatenation of all these errors. This PR polishes the concept of Warnable introduced by @bradfitz a few weeks ago. Each Warnable is a component of the backend (for instance, things like 'dns' or 'magicsock' are Warnables). Each Warnable has a unique identifying code. A Warnable is an entity we can warn the user about, by setting (or unsetting) a WarningState for it. Warnables have: - an identifying Code, so that the GUI can track them as their WarningStates come and go - a Title, which the GUIs can use to tell the user what component of the backend is broken - a Text, which is a function that is called with a set of Args to generate a more detailed error message to explain the unhappy state Additionally, this PR also begins to send Warnables and their WarningStates through LocalAPI to the clients, using ipn.Notify messages. An ipn.Notify is only issued when a warning is added or removed from the Tracker. In a next PR, we'll get rid of subsystems entirely, and we'll start using structured warnings for all errors affecting the backend functionality. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Jordan Whited	65888d95c9	derp/xdp,cmd/xdpderper: initial skeleton (#12390 ) This commit introduces a userspace program for managing an experimental eBPF XDP STUN server program. derp/xdp contains the eBPF pseudo-C along with a Go pkg for loading it and exporting its metrics. cmd/xdpderper is a package main user of derp/xdp. Updates tailscale/corp#20689 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Jonathan Nobels	02e3c046aa	net/dns: re-query system resolvers on no-upstream resolver failure on apple platforms (#12398 ) Fixes tailscale/corp#20677 On macOS sleep/wake, we're encountering a condition where reconfigure the network a little bit too quickly - before apple has set the nameservers for our interface. This results in a persistent condition where we have no upstream resolver and fail all forwarded DNS queries. No upstream nameservers is a legitimate configuration, and we have no (good) way of determining when Apple is ready - but if we need to forward a query, and we have no nameservers, then something has gone badly wrong and the network is very broken. A simple fix here is to simply inject a netMon event, which will go through the configuration dance again when we hit the SERVFAIL condition. Tested by artificially/randomly returning [] for the list of nameservers in the bespoke ipn-bridge code responsible for getting the nameservers. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	5 months ago
Andrew Dunham	d0f1a838a6	net/dnscache: use parent context to perform lookup As an alterative to #11935 using #12003. Updates #11935 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I05f643fe812ceeaec5f266e78e3e529cab3a1ac3	5 months ago
Aaron Klotz	3511d1f8a2	cmd/tailscaled, net/dns, wgengine/router: start Windows child processes with DETACHED_PROCESS when I/O is being piped When we're starting child processes on Windows that are CLI programs that don't need to output to a console, we should pass in DETACHED_PROCESS as a CreationFlag on SysProcAttr. This prevents the OS from even creating a console for the child (and paying the associated time/space penalty for new conhost processes). This is more efficient than letting the OS create the console window and then subsequently trying to hide it, which we were doing at a few callsites. Fixes #12270 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Nick Khyl	4cdc4ed7db	net/dns/resolver: return an empty successful response instead of NXDomain when resolving A records for 4via6 domains As quad-100 is an authoritative server for 4via6 domains, it should always return responses with a response code of 0 (indicating no error) when resolving records for these domains. If there's no resource record of the specified type (e.g. A), it should return a response with an empty answer section rather than NXDomain. Such a response indicates that there is at least one RR of a different type (e.g., AAAA), suggesting the Windows stub resolver to look for it. Fixes tailscale/corp#20767 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Irbe Krumina	bc53ebd4a0	ipn/{ipnlocal,localapi},net/netkernelconf,client/tailscale,cmd/containerboot: optionally enable UDP GRO forwarding for containers (#12410 ) Add a new TS_EXPERIMENTAL_ENABLE_FORWARDING_OPTIMIZATIONS env var that can be set for tailscale/tailscale container running as a subnet router or exit node to enable UDP GRO forwarding for improved performance. See https://tailscale.com/kb/1320/performance-best-practices#linux-optimizations-for-subnet-routers-and-exit-nodes This is currently considered an experimental approach; the configuration support is partially to allow further experimentation with containerized environments to evaluate the performance improvements. Updates tailscale/tailscale#12295 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Brad Fitzpatrick	916c4db75b	net/dns: fix crash in tests Looks like #12346 as submitted with failing tests. Updates #12346 Change-Id: I582cd0dfb117686330d935d763d972373c5ae598 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Andrea Gottardo	b65221999c	tailcfg,net/dns: add controlknob to disable battery split DNS on iOS (#12346 ) Updates corp#15802. Adds the ability for control to disable the recently added change that uses split DNS in more cases on iOS. This will allow us to disable the feature if it leads to regression in production. We plan to remove this knob once we've verified that the feature works properly. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Brad Fitzpatrick	1ca323ac65	net/netcheck: fix probeProto.String result for IPv6 probes This bug was introduced in `e6b84f215` (May 2020) but was only used in tests when stringifying probeProto values on failure so it wasn't noticed for a long time. But then it was moved into non-test code in `8450a18aa` (Jun 2024) and I didn't notice during the code movement that it was wrong. It's still only used in failure paths in logs, but having wrong/ambiguous debugging information isn't the best. Whoops. Updates tailscale/corp#20654 Change-Id: I296c727ed1c292a04db7b46ecc05c07fc1abc774 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	8450a18aa9	net/netcheck: flesh out some logging in error paths Updates tailscale/corp#20654 Change-Id: Ie190f956b864985668f79b5b986438bbe07ce905	5 months ago
Maisem Ali	4a8cb1d9f3	all: use math/rand/v2 more Updates #11058 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Andrea Gottardo	d636407f14	net/dns: don't set MatchDomains on Apple platforms when no upstream nameservers available (#12334 ) This PR addresses a DNS issue on macOS as discussed this morning. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Andrew Dunham	ced9a0d413	net/dns: fix typo in OSConfig logging (#12330 ) Updates tailscale/corp#20530 Change-Id: I48834a0a5944ed35509c63bdd2830aa34e1bddeb Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	5 months ago
Maisem Ali	42cfbf427c	tsnet,wgengine/netstack: add ListenPacket and tests This adds a new ListenPacket function on tsnet.Server which acts mostly like `net.ListenPacket`. Unlike `Server.Listen`, this requires listening on a specific IP and does not automatically listen on both V4 and V6 addresses of the Server when the IP is unspecified. To test this, it also adds UDP support to tsdial.Dialer.UserDial and plumbs it through the localapi. Then an associated test to make sure the UDP functionality works from both sides. Updates #12182 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Andrea Gottardo	dd77111462	xcode/iOS: set MatchDomains when no route requires a custom DNS resolver (#10576 ) Updates https://github.com/tailscale/corp/issues/15802. On iOS exclusively, this PR adds logic to use a split DNS configuration in more cases, with the goal of improving battery life. Acting as the global DNS resolver on iOS should be avoided, as it leads to frequent wakes of IPNExtension. We try to determine if we can have Tailscale only handle DNS queries for resources inside the tailnet, that is, all routes in the DNS configuration do not require a custom resolver (this is the case for app connectors, for instance). If so, we set all Routes as MatchDomains. This enables a split DNS configuration which will help preserve battery life. Effectively, for the average Tailscale user who only relies on MagicDNS to resolve *.ts.net domains, this means that Tailscale DNS will only be used for those domains. This PR doesn't affect users with Override Local DNS enabled. For these users, there should be no difference and Tailscale will continue acting as a global DNS resolver. Signed-off-by: Andrea Gottardo <andrea@tailscale.com>	6 months ago
James Tucker	87ee559b6f	net/netcheck: apply some polish suggested from #12161 Apply some post-submit code review suggestions. Updates #12161 Updates tailscale/corp#19106 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
James Tucker	9351eec3e1	net/netcheck: remove hairpin probes Palo Alto reported interpreting hairpin probes as LAND attacks, and the firewalls may be responding to this by shutting down otherwise in use NAT sessions prematurely. We don't currently make use of the outcome of the hairpin probes, and they contribute to other user confusion with e.g. the AirPort Extreme hairpin session workaround. We decided in response to remove the whole probe feature as a result. Updates #188 Updates tailscale/corp#19106 Updates tailscale/corp#19116 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
James Tucker	8d1249550a	net/netcheck,wgengine/magicsock: add potential workaround for Palo Alto DIPP misbehavior Palo Alto firewalls have a typically hard NAT, but also have a mode called Persistent DIPP that is supposed to provide consistent port mapping suitable for STUN resolution of public ports. Persistent DIPP works initially on most Palo Alto firewalls, but some models/software versions have a bug which this works around. The bug symptom presents as follows: - STUN sessions resolve a consistent public IP:port to start with - Much later netchecks report the same IP:Port for a subset of sessions, most often the users active DERP, and/or the port related to sustained traffic. - The broader set of DERPs in a full netcheck will now consistently observe a new IP:Port. - After this point of observation, new inbound connections will only succeed to the new IP:Port observed, and existing/old sessions will only work to the old binding. In this patch we now advertise the lowest latency global endpoint discovered as we always have, but in addition any global endpoints that are observed more than once in a single netcheck report. This should provide viable endpoints for potential connection establishment across a NAT with this behavior. Updates tailscale/corp#19106 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
Kevin Liang	7f83f9fc83	Net/DNS/Publicdns: update the IPv6 range that we use to recreate route endpoint for control D In this commit I updated the Ipv6 range we use to generate Control D DOH ip, we were using the NextDNSRanges to generate Control D DOH ip, updated to use the correct range. Updates: #7946 Signed-off-by: Kevin Liang <kevinliang@tailscale.com>	6 months ago
Maisem Ali	1f51bb6891	net/tstun: do SNAT after filterPacketOutboundToWireGuard In a configuration where the local node (ip1) has a different IP (ip2) that it uses to communicate with a peer (ip3) we would do UDP flow tracking on the `ip2->ip3` tuple. When we receive the response from the peer `ip3->ip2` we would dnat it back to `ip3->ip1` which would then not match the flow track state and the packet would get dropped. To fix this, we should do flow tracking on the `ip1->ip3` tuple instead of `ip2->ip3` which requires doing SNAT after the running filterPacketOutboundToWireGuard. Updates tailscale/corp#19971, tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Maisem Ali	85b9a6c601	net/netcheck: do not add derps if IPv4/IPv6 is set to "none" It was documented as such but seems to have been dropped in a refactor, restore the behavior. This brings down the time it takes to run a single integration test by 2s which adds up quite a bit. Updates tailscale/corp#19786 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Maisem Ali	af97e7a793	tailcfg,all: add/plumb Node.IsJailed This adds a new bool that can be sent down from control to do jailing on the client side. Previously this would only be done from control by modifying the packet filter we sent down to clients. This would result in a lot of additional work/CPU on control, we could instead just do this on the client. This has always been a TODO which we keep putting off, might as well do it now. Updates tailscale/corp#19623 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Maisem Ali	e67069550b	ipn/ipnlocal,net/tstun,wgengine: create and plumb jailed packet filter This plumbs a packet filter for jailed nodes through to the tstun.Wrapper; the filter for a jailed node is equivalent to a "shields up" filter. Currently a no-op as there is no way for control to tell the client whether a peer is jailed. Updates tailscale/corp#19623 Co-authored-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: Maisem Ali <maisem@tailscale.com> Change-Id: I5ccc5f00e197fde15dd567485b2a99d8254391ad	6 months ago
Nick Khyl	f62e678df8	net/dns/resolver, control/controlknobs, tailcfg: use UserDial instead of SystemDial to dial DNS servers Now that tsdial.Dialer.UserDial has been updated to honor the configured routes and dial external network addresses without going through Tailscale, while also being able to dial a node/subnet router on the tailnet, we can start using UserDial to forward DNS requests. This is primarily needed for DNS over TCP when forwarding requests to internal DNS servers, but we also update getKnownDoHClientForProvider to use it. Updates tailscale/corp#18725 Signed-off-by: Nick Khyl <nickk@tailscale.com>	6 months ago
Maisem Ali	5ef178fdca	net/tstun: refactor peerConfig to allow storing more details This refactors the peerConfig struct to allow storing more details about a peer and not just the masq addresses. To be used in a follow up change. As a side effect, this also makes the DNAT logic on the inbound packet stricter. Previously it would only match against the packets dst IP, not it also takes the src IP into consideration. The beahvior is at parity with the SNAT case. Updates tailscale/corp#19623 Co-authored-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: Maisem Ali <maisem@tailscale.com> Change-Id: I5f40802bebbf0f055436eb8824e4511d0052772d	6 months ago
Nick Khyl	caa3d7594f	ipn/ipnlocal, net/tsdial: plumb routes into tsdial and use them in UserDial We'd like to use tsdial.Dialer.UserDial instead of SystemDial for DNS over TCP. This is primarily necessary to properly dial internal DNS servers accessible over Tailscale and subnet routes. However, to avoid issues when switching between Wi-Fi and cellular, we need to ensure that we don't retain connections to any external addresses on the old interface. Therefore, we need to determine which dialer to use internally based on the configured routes. This plumbs routes and localRoutes from router.Config to tsdial.Dialer, and updates UserDial to use either the peer dialer or the system dialer, depending on the network address and the configured routes. Updates tailscale/corp#18725 Fixes #4529 Signed-off-by: Nick Khyl <nickk@tailscale.com>	6 months ago
Brad Fitzpatrick	ce8969d82b	net/portmapper: add envknob to disable portmapper in localhost integration tests Updates #11962 Change-Id: I8212cd814985b455d96986de0d4c45f119516cb3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Brad Fitzpatrick	c3c18027c6	all: make more tests pass/skip in airplane mode Updates tailscale/corp#19786 Change-Id: Iedc6730fe91c627b556bff5325bdbaf7bf79d8e6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Maisem Ali	fd6ba43b97	types/views: remove duplicate SliceContainsFunc We already have `(Slice[T]).ContainsFunc`. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Brad Fitzpatrick	e42c4396cf	net/netcheck: don't spam on ICMP socket permission denied errors While debugging a failing test in airplane mode on macOS, I noticed netcheck logspam about ICMP socket creation permission denied errors. Apparently macOS just can't do those, or at least not in airplane mode. Not worth spamming about. Updates #cleanup Change-Id: I302620cfd3c8eabb25202d7eef040c01bd8a843c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Brad Fitzpatrick	ee3bd4dbda	derp/derphttp, net/netcheck: plumb netmon.Monitor to derp netcheck client Fixes #11981 Change-Id: I0e15a09f93aefb3cfddbc12d463c1c08b83e09fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Andrew Dunham	f97d0ac994	net/dns/resolver: add better error wrapping To aid in debugging exactly what's going wrong, instead of the not-particularly-useful "dns udp query: context deadline exceeded" error that we currently get. Updates #3786 Updates #10768 Updates #11620 (etc.) Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I76334bf0681a8a2c72c90700f636c4174931432c	6 months ago
Andrew Dunham	be663c84c1	net/tstun: rename natConfig to peerConfig So that we can use this for additional, non-NAT configuration without it being confusing. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1658d59c9824217917a94ee76d2d08f0a682986f	6 months ago
Andrew Dunham	10497acc95	net/tstun: refactor natConfig to not be per-family This was a holdover from the older, pre-BART days and is no longer necessary. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I71b892bab1898077767b9ff51cef33d59c08faf8	6 months ago
Jonathan Nobels	45b9aa0d83	net/netmon: remove spammy log statements (#11953 ) Updates tailscale/corp#18960 Tests in corp called us using the wrong logging calls. Removed. This is logged downstream anyway. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	6 months ago
Jonathan Nobels	fa1303d632	net/netmon: swap to swift-derived defaultRoute on macos (#11936 ) Updates tailscale/corp#18960 iOS uses Apple's NetworkMonitor to track the default interface and there's no reason we shouldn't also use this on macOS, for the same reasons noted in the comments for why this change was made on iOS. This eliminates the need to load and parse the routing table when querying the defaultRouter() in almost all cases. A slight modification here (on both platforms) to fallback to the default BSD logic in the unhappy-path rather than making assumptions that may not hold. If netmon is eventually parsing AF_ROUTE and able to give a consistently correct answer for the default interface index, we can fall back to that and eliminate the Swift dependency. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	6 months ago
Jordan Whited	a47ce618bd	net/tstun: implement env var for disabling UDP GRO on Linux (#11924 ) Certain device drivers (e.g. vxlan, geneve) do not properly handle coalesced UDP packets later in the stack, resulting in packet loss. Updates #11026 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Brad Fitzpatrick	b9adbe2002	net/{interfaces,netmon}, all: merge net/interfaces package into net/netmon In prep for most of the package funcs in net/interfaces to become methods in a long-lived netmon.Monitor that can cache things. (Many of the funcs are very heavy to call regularly, whereas the long-lived netmon.Monitor can subscribe to things from the OS and remember answers to questions it's asked regularly later) Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: Ie4e8dedb70136af2d611b990b865a822cd1797e5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	6b95219e3a	net/netmon, add: add netmon.State type alias of interfaces.State ... in prep for merging the net/interfaces package into net/netmon. This is a no-op change that updates a bunch of the API signatures ahead of a future change to actually move things (and remove the type alias) Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: I477613388f09389214db0d77ccf24a65bff2199c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	3672f29a4e	net/netns, net/dns/resolver, etc: make netmon required in most places The goal is to move more network state accessors to netmon.Monitor where they can be cheaper/cached. But first (this change and others) we need to make sure the one netmon.Monitor is plumbed everywhere. Some notable bits: * tsdial.NewDialer is added, taking a now-required netmon * because a tsdial.Dialer always has a netmon, anything taking both a Dialer and a NetMon is now redundant; take only the Dialer and get the NetMon from that if/when needed. * netmon.NewStatic is added, primarily for tests Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: I877f9cb87618c4eb037cee098241d18da9c01691 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	7a62dddeac	net/netcheck, wgengine/magicsock: make netmon.Monitor required This has been a TODO for ages. Time to do it. The goal is to move more network state accessors to netmon.Monitor where they can be cheaper/cached. Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: I60fc6508cd2d8d079260bda371fc08b6318bcaf1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	4dece0c359	net/netutil: remove a use of deprecated interfaces.GetState I'm working on moving all network state queries to be on netmon.Monitor, removing old APIs. Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: If0de137e0e2e145520f69e258597fb89cf39a2a3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	745931415c	health, all: remove health.Global, finish plumbing health.Tracker Updates #11874 Updates #4136 Change-Id: I414470f71d90be9889d44c3afd53956d9f26cd61 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	723c775dbb	tsd, ipnlocal, etc: add tsd.System.HealthTracker, start some plumbing This adds a health.Tracker to tsd.System, accessible via a new tsd.System.HealthTracker method. In the future, that new method will return a tsd.System-specific HealthTracker, so multiple tsnet.Servers in the same process are isolated. For now, though, it just always returns the temporary health.Global value. That permits incremental plumbing over a number of changes. When the second to last health.Global reference is gone, then the tsd.System.HealthTracker implementation can return a private Tracker. The primary plumbing this does is adding it to LocalBackend and its dozen and change health calls. A few misc other callers are also plumbed. Subsequent changes will flesh out other parts of the tree (magicsock, controlclient, etc). Updates #11874 Updates #4136 Change-Id: Id51e73cfc8a39110425b6dc19d18b3975eac75ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	5b32264033	health: break Warnable into a global and per-Tracker value halves Previously it was both metadata about the class of warnable item as well as the value. Now it's only metadata and the value is per-Tracker. Updates #11874 Updates #4136 Change-Id: Ia1ed1b6c95d34bc5aae36cffdb04279e6ba77015 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	ebc552d2e0	health: add Tracker type, in prep for removing global variables This moves most of the health package global variables to a new `health.Tracker` type. But then rather than plumbing the Tracker in tsd.System everywhere, this only goes halfway and makes one new global Tracker (`health.Global`) that all the existing callers now use. A future change will eliminate that global. Updates #11874 Updates #4136 Change-Id: I6ee27e0b2e35f68cb38fecdb3b2dc4c3f2e09d68 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Andrew Dunham	375617c5c8	net/tsdial: assume all connections are affected if no default route is present If this happens, it results in us pessimistically closing more connections than might be necessary, but is more correct since we won't "miss" a change to the default route interface and keep trying to send data over a nonexistent interface, or one that can't reach the internet. Updates tailscale/corp#19124 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia0b8b04cb8cdcb0da0155fd08751c9dccba62c1a	7 months ago
kari-ts	048cb61dd0	interfaces: create android impl (#11784 ) -Move Android impl into interfaces_android.go -Instead of using ip route to get the interface name, use the one passed in by Android (ip route is restricted in Android 13+ per termux/termux-app#2993) Follow-up will be to do the same for router Fixes tailscale/corp#19215 Fixes tailscale/corp#19124 Signed-off-by: kari-ts <kari@tailscale.com>	7 months ago
Andrew Dunham	b85c2b2313	net/dns/resolver: use SystemDial in DoH forwarder This ensures that we close the underlying connection(s) when a major link change happens. If we don't do this, on mobile platforms switching between WiFi and cellular can result in leftover connections in the http.Client's connection pool which are bound to the "wrong" interface. Updates #10821 Updates tailscale/corp#19124 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ibd51ce2efcaf4bd68e14f6fdeded61d4e99f9a01	7 months ago
Andrew Dunham	226486eb9a	net/interfaces: handle removed interfaces in State.Equal This wasn't previously handling the case where an interface in s2 was removed and not present in s1, and would cause the Equal method to incorrectly return that the states were equal. Updates tailscale/corp#19124 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I3af22bc631015d1ddd0a1d01bfdf312161b9532d	7 months ago
Brad Fitzpatrick	7c1d6e35a5	all: use Go 1.22 range-over-int Updates #11058 Change-Id: I35e7ef9b90e83cac04ca93fd964ad00ed5b48430 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	068db1f972	net/interfaces: delete unused unexported function It should've been deleted in `11ece02f52`. Updates #9040 Change-Id: If8a136bdb6c82804af658c9d2b0a8c63ce02d509 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	a1abd12f35	cmd/tailscaled, net/tstun: build for aix/ppc64 At least in userspace-networking mode. Fixes #11361 Change-Id: I78d33f0f7e05fe9e9ee95b97c99b593f8fe498f2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Aaron Klotz	4d5d669cd5	net/dns: unconditionally write NRPT rules to local settings We were being too aggressive when deciding whether to write our NRPT rules to the local registry key or the group policy registry key. After once again reviewing the document which calls itself a spec (see issue), it is clear that the presence of the DnsPolicyConfig subkey is the important part, not the presence of values set in the DNSClient subkey. Furthermore, a footnote indicates that the presence of DnsPolicyConfig in the GPO key will always override its counterpart in the local key. The implication of this is important: we may unconditionally write our NRPT rules to the local key. We copy our rules to the policy key only when it contains NRPT rules belonging to somebody other than us. Fixes https://github.com/tailscale/corp/issues/19071 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	7 months ago
James Tucker	db760d0bac	cmd/tailscaled: move cleanup to an implicit action during startup This removes a potentially increased boot delay for certain boot topologies where they block on ExecStartPre that may have socket activation dependencies on other system services (such as systemd-resolved and NetworkManager). Also rename cleanup to clean up in affected/immediately nearby places per code review commentary. Fixes #11599 Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
Brad Fitzpatrick	b0fbd85592	net/tsdial: partially fix "tailscale nc" (UserDial) on macOS At least in the case of dialing a Tailscale IP. Updates #4529 Change-Id: I9fd667d088a14aec4a56e23aabc2b1ffddafa3fe Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
alexelisenko	fe22032fb3	net/dns/{publicdns,resolver}: add start of Control D support Updates #7946 [@bradfitz fixed up version of #8417] Change-Id: I1dbf6fa8d525b25c0d7ad5c559a7f937c3cd142a Signed-off-by: alexelisenko <39712468+alexelisenko@users.noreply.github.com> Signed-off-by: Alex Paguis <alex@windscribe.com>	7 months ago
James Tucker	6e334e64a1	net/netcheck,wgengine/magicsock: align DERP frame receive time heuristics The netcheck package and the magicksock package coordinate via the health package, but both sides have time based heuristics through indirect dependencies. These were misaligned, so the implemented heuristic aimed at reducing DERP moves while there is active traffic were non-operational about 3/5ths of the time. It is problematic to setup a good test for this integration presently, so instead I added comment breadcrumbs along with the initial fix. Updates #8603 Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
Brad Fitzpatrick	8d7894c68e	clientupdate, net/dns: fix some "tailsacle" typos Updates #cleanup Change-Id: I982175e74b0c8c5b3e01a573e5785e6596b7ac39 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
James Tucker	f384742375	net/packet: allow more ICMP errors We now allow some more ICMP errors to flow, specifically: - ICMP parameter problem in both IPv4 and IPv6 (corrupt headers) - ICMP Packet Too Big (for IPv6 PMTU) Updates #311 Updates #8102 Updates #11002 Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
Asutorufa	e20ce7bf0c	net/dns: close ctx when close dns directManager Signed-off-by: Asutorufa <16442314+Asutorufa@users.noreply.github.com>	8 months ago
Percy Wegmann	8b8b315258	net/tstun: use gaissmai/bart instead of tempfork/device This implementation uses less memory than tempfork/device, which helps avoid OOM conditions in the iOS VPN extension when switching to a Tailnet with ExitNode routing enabled. Updates tailscale/corp#18514 Signed-off-by: Percy Wegmann <percy@tailscale.com>	8 months ago
Brad Fitzpatrick	a36cfb4d3d	tailcfg, ipn/ipnlocal, wgengine/magicsock: add only-tcp-443 node attr Updates tailscale/corp#17879 Change-Id: I0dc305d147b76c409cf729b599a94fa723aef0e0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Anton Tolchanov	cf8948da5f	net/routetable: increase route limit used by the test I was running all tests while preparing a recent stable release, and this was failing because my computer is connected to a fairly large tailnet. ``` --- FAIL: TestGetRouteTable (0.01s) routetable_linux_test.go:32: expected at least one default route; ... ``` ``` $ ip route show table 52 \| wc -l 1051 ``` Updates #cleanup Signed-off-by: Anton Tolchanov <anton@tailscale.com>	8 months ago
Andrew Dunham	9884d06b80	net/interfaces: fix test hang on Darwin This test could hang because the subprocess was blocked on writing to the stdout pipe if we find the address we're looking for early in the output. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I68d82c22a5d782098187ae6d8577e43063b72573	8 months ago
Andrew Dunham	62cf83eb92	go.mod: bump gvisor The `stack.PacketBufferPtr` type no longer exists; replace it with `*stack.PacketBuffer` instead. Updates #8043 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib56ceff09166a042aa3d9b80f50b2aa2d34b3683	8 months ago
Andrew Dunham	3dd8ae2f26	net/tstun: fix spelling of "WireGuard" Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ida7e30f4689bc18f5f7502f53a0adb5ac3c7981a	9 months ago
Anton Tolchanov	8cc5c51888	health: warn about reverse path filtering and exit nodes When reverse path filtering is in strict mode on Linux, using an exit node blocks all network connectivity. This change adds a warning about this to `tailscale status` and the logs. Example in `tailscale status`: ``` - not connected to home DERP region 22 - The following issues on your machine will likely make usage of exit nodes impossible: [interface "eth0" has strict reverse-path filtering enabled], please set rp_filter=2 instead of rp_filter=1; see https://github.com/tailscale/tailscale/issues/3310 ``` Example in the logs: ``` 2024/02/21 21:17:07 health("overall"): error: multiple errors: not in map poll The following issues on your machine will likely make usage of exit nodes impossible: [interface "eth0" has strict reverse-path filtering enabled], please set rp_filter=2 instead of rp_filter=1; see https://github.com/tailscale/tailscale/issues/3310 ``` Updates #3310 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	9 months ago
Nick Khyl	7ef1fb113d	cmd/tailscaled, ipn/ipnlocal, wgengine: shutdown tailscaled if wgdevice is closed Tailscaled becomes inoperative if the Tailscale Tunnel wintun adapter is abruptly removed. wireguard-go closes the device in case of a read error, but tailscaled keeps running. This adds detection of a closed WireGuard device, triggering a graceful shutdown of tailscaled. It is then restarted by the tailscaled watchdog service process. Fixes #11222 Signed-off-by: Nick Khyl <nickk@tailscale.com>	9 months ago
Nick Khyl	b42b9817b0	net/dns: do not wait for the interface registry key to appear if the windowsManager is being closed The WinTun adapter may have been removed by the time we're closing the dns.windowsManager, and its associated interface registry key might also have been deleted. We shouldn't use winutil.OpenKeyWait and wait for the interface key to appear when performing a cleanup as a part of the windowsManager shutdown. Updates #11222 Signed-off-by: Nick Khyl <nickk@tailscale.com>	9 months ago
Brad Fitzpatrick	e1bd7488d0	all: remove LenIter, use Go 1.22 range-over-int instead Updates #11058 Updates golang/go#65685 Change-Id: Ibb216b346e511d486271ab3d84e4546c521e4e22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
mrrfv	ff1391a97e	net/dns/publicdns: add Mullvad family DNS to the list of known DoH servers Adds the new Mullvad family DNS server to the known DNS over HTTPS server list. Signed-off-by: mrrfv <rm-rfv-no-preserve-root@protonmail.com>	9 months ago
James Tucker	8d0d46462b	net/dns: timeout DOH requests after 10s without response headers If a client socket is remotely lost but the client is not sent an RST in response to the next request, the socket might sit in RTO for extended lengths of time, resulting in "no internet" for users. Instead, timeout after 10s, which will close the underlying socket, recovering from the situation more promptly. Updates #10967 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
James Tucker	651c4899ac	net/interfaces: reduce & cleanup logs on iOS We don't need a log line every time defaultRoute is read in the good case, and we now only log default interface updates that are actually changes. Updates #3363 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Andrew Dunham	e8d2fc7f7f	net/tshttpproxy: log when we're using a proxy Updates #11196 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id6334c10f52f4cfbda9f03dc8096ab7a6c54a088	9 months ago
James Tucker	8fe504241d	net/ktimeout: add a package to set TCP user timeout Setting a user timeout will be a more practical tuning knob for a number of endpoints, this provides a way to set it. Updates tailscale/corp#17587 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Andrew Dunham	70b7201744	net/dns: fix infinite loop when run on Amazon Linux 2023 This fixes an infinite loop caused by the configuration of systemd-resolved on Amazon Linux 2023 and how that interacts with Tailscale's "direct" mode. We now drop the Tailscale service IP from the OS's "base configuration" when we detect this configuration. Updates #7816 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I73a4ea8e65571eb368c7e179f36af2c049a588ee	9 months ago
Andrew Dunham	b0e96a6c39	net/dns: log more info when openresolv commands fail Updates #11129 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic594868ba3bc31f6d3b0721ecba4090749a81f7f	9 months ago
Brad Fitzpatrick	2bd3c1474b	util/cmpx: delete now that we're using Go 1.22 Updates #11058 Change-Id: I09dea8e86f03ec148b715efca339eab8b1f0f644 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Andrew Dunham	fd94d96e2b	net/portmapper: support legacy "urn:dslforum-org" portmapping services These are functionally the same as the "urn:schemas-upnp-org" services with a few minor changes, and are still used by older devices. Support them to improve our ability to obtain an external IP on such networks. Updates #10911 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I05501fad9d6f0a3b8cf19fc95eee80e7d16cc2cf	10 months ago
Andrew Dunham	b45089ad85	net/portmapper: handle cases where we have no supported clients This no longer results in a nil pointer exception when we get a valid UPnP response with no supported clients. Updates #10911 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6e3715a49a193ff5261013871ad7fff197a4d77e	10 months ago
kari-ts	c9fd166cc6	net/netmon: when a new network is added, trigger netmon update (#10840 ) Fixes #10107	10 months ago
Andrew Dunham	20f3f706a4	net/netutil: allow 16-bit 4via6 site IDs The prefix has space for 32-bit site IDs, but the validateViaPrefix function would previously have disallowed site IDs greater than 255. Fixes tailscale/corp#16470 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I4cdb0711dafb577fae72d86c4014cf623fa538ef	10 months ago
James Tucker	953fa80c6f	cmd/{derper,stund},net/stunserver: add standalone stun server Add a standalone server for STUN that can be hosted independently of the derper, and factor that back into the derper. Fixes #8434 Closes #8435 Closes #10745 Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
Andrew Dunham	35c303227a	net/dns/resolver: add ID to verbose logs in forwarder To make it easier to correlate the starting/ending log messages. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I2802d53ad98e19bc8914bc58f8c04d4443227b26	10 months ago
Andrea Gottardo	d9aeb30281	net/interfaces: handle iOS network transitions (#10680 ) Updates #8022 Updates #6075 On iOS, we currently rely on delegated interface information to figure out the default route interface. The NetworkExtension framework in iOS seems to set the delegate interface only once, upon the creation of the VPN tunnel. If a network transition (e.g. from Wi-Fi to Cellular) happens while the tunnel is connected, it will be ignored and we will still try to set Wi-Fi as the default route because the delegated interface is not getting updated as connectivity transitions. Here we work around this on the Swift side with a NWPathMonitor instance that observes the interface name of the first currently satisfied network path. Our Swift code will call into `UpdateLastKnownDefaultRouteInterface`, so we can rely on that when it is set. If for any reason the Swift machinery didn't work and we don't get any updates, here we also have some fallback logic: we try finding a hardcoded Wi-Fi interface called en0. If en0 is down, we fall back to cellular (pdp_ip0) as a last resort. This doesn't handle all edge cases like USB-Ethernet adapters or multiple Ethernet interfaces, but it is good enough to ensure connectivity isn't broken. I tested this on iPhones and iPads running iOS 17.1 and it appears to work. Switching between different cellular plans on a dual SIM configuration also works (the interface name remains pdp_ip0). Signed-off-by: Andrea Gottardo <andrea@tailscale.com>	10 months ago
Andrew Dunham	fa3639783c	net/portmapper: check returned epoch from PMP and PCP protocols If the epoch that we see during a Probe is less than the existing epoch, it means that the gateway has either restarted or reset its configuration, and an existing mapping is no longer valid. Reset any saved mapping(s) if we detect this case so that a future createOrGetMapping will not attempt to re-use it. Updates #10597 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie3cddaf625cb94a29885f7a1eeea25dbf6b97b47	10 months ago
Andrew Lytvynov	2716250ee8	all: cleanup unused code, part 2 (#10670 ) And enable U1000 check in staticcheck. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Nick Khyl	c9836b454d	net/netmon: fix goroutine leak in winMon if the monitor is never started When the portable Monitor creates a winMon via newOSMon, we register address and route change callbacks with Windows. Once a callback is hit, it starts a goroutine that attempts to send the event into messagec and returns. The newly started goroutine then blocks until it can send to the channel. However, if the monitor is never started and winMon.Receive is never called, the goroutines remain indefinitely blocked, leading to goroutine leaks and significant memory consumption in the tailscaled service process on Windows. Unlike the tailscaled subprocess, the service process creates but never starts a Monitor. This PR adds a check within the callbacks to confirm the monitor's active status, and exits immediately if the monitor hasn't started. Updates #9864 Signed-off-by: Nick Khyl <nickk@tailscale.com>	11 months ago
Andrew Lytvynov	1302bd1181	all: cleanup unused code, part 1 (#10661 ) Run `staticcheck` with `U1000` to find unused code. This cleans up about a half of it. I'll do the other half separately to keep PRs manageable. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago

1 2 3 4 5 ...

1089 Commits (5f4a4c6744fbda767d5bf4b3299a16aea80c4d1c)