tailscale

Commit Graph

Author	SHA1	Message	Date
David Anderson	8f5b52e571	net/netns: add windows support. Also remove rebinding logic from the windows router. Magicsock will instead rebind based on link change signals. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	40e12c17ec	net/netcheck: remove mistaken double Mutex.Unlock in error path Thanks to @dotaheor for noticing. Fixes #751	4 years ago
Brad Fitzpatrick	f65eb4e5c1	net/netstat: start of new netstat package, with Windows for now This will be used in a future change to do localhost connection authentication. This lets us quickly map a localhost TCP connection to a PID. (A future change will then map a pid to a user) TODO: pull portlist's netstat code into this package. Then portlist will be fast on Windows without requiring shelling out to netstat.exe.	4 years ago
Brad Fitzpatrick	9c25968b63	net/tshttpproxy: fix typo in Windows code added at least second I ran tests & vet & staticcheck, but for Linux, not Windows. (#728 would be nice)	4 years ago
Brad Fitzpatrick	b026a638c7	net/tshttpproxy: if winhttp.GetProxyForURL blocks too long, use previous value We currently have a chickend-and-egg situation in some environments where we can set up routes that WinHTTP's WPAD/PAC resolution service needs to download the PAC file to evaluate GetProxyForURL, but the PAC file is behind a route for which we need to call GetProxyForURL to e.g. dial a DERP server. As a short-term fix, just assume that the most recently returned proxy is good enough for such situations.	4 years ago
Brad Fitzpatrick	74ee374667	net/tshttpproxy: add more winhttp logging Notably around duration of calls.	4 years ago
Brad Fitzpatrick	1e0be5a458	tshttp, derphttp: send Proxy-Authorization, not Authorization, to proxies Whoops. But weirdly, sending Authorization sometimes worked?	4 years ago
Brad Fitzpatrick	2bac125cad	net/tshttpproxy: move the TS_DEBUG_FAKE_PROXY_AUTH knob up a level	4 years ago
Brad Fitzpatrick	28f9cd06f5	tshttpproxy, controlclient, derphttp, logpolicy: send Negotiate auth to proxies For Windows only, and only when built with Tailscale's Go tree. Updates tailscale/corp#583	4 years ago
Brad Fitzpatrick	f915ab6552	net/tshttpproxy: add start of Kerberos Negotiate auth to proxies on Windows For now only used by a new cmd/tailscale debug --get-url subcommand. Not yet wired up to the places making HTTP requests. Updates tailscale/corp#583	4 years ago
renthraysk	10cad39abd	net/stun: Fix STUN attribute padding (#710 ) net/stun: fix STUN attribute padding Signed-off-by: RenThraysk <renthraysk@gmail.com>	4 years ago
Brad Fitzpatrick	9be1917c5b	net/tshttpproxy: discard secondary Windows proxies for now	4 years ago
Brad Fitzpatrick	1e562886f5	net/netcheck: in verbose mode, probe all regions So 'tailscale netcheck --verbose' shows all regions' latencies.	4 years ago
Brad Fitzpatrick	c5eb57f4d6	net/tshttpproxy: new package, support WPAD/PAC proxies on Windows Updates tailscale/corp#553 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	dbb4c246fa	wgengine/monitor: add Windows linkchange monitor Updates tailscale/corp#553 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b97aac1718	net/interfaces: include DefaultRouteInterface in interfaces.State And log it in wgengine on change. Changing bug in #643. Updates #643	4 years ago
Josh Bleecher Snyder	a9b1e3f9e8	net/interfaces: remove old debug old Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	25b021388b	net/netns, net/interfaces: move defaultRouteInterface, add Android fallback Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	a16a793605	net/interfaces: use syscalls to find private gateway IP address iOS doesn't let you run subprocesses, which means we can't use netstat to get routing information. Instead, use syscalls and grub around in the results. We keep the old netstat version around, both for use in non-cgo builds, and for use testing the syscall-based version. Note that iOS doesn't ship route.h, so we include a copy here from the macOS 10.15 SDK (which is itself unchanged from the 10.14 SDK). I have tested manually that this yields the correct gateway IP address on my own macOS and iOS devices. More coverage would be most welcome. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Dmytro Shynkevych	28e52a0492	all: dns refactor, add Proxied and PerDomain flags from control (#615 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	c253d4f948	net/interfaces: don't try to fork on iOS in likelyHomeRouterIPDarwin No subprocesses allowed on iOS. Will need to do this differently later.	4 years ago
Brad Fitzpatrick	33a748bec1	net/interfaces: fix likelyHomeRouterIP on Android	4 years ago
David Anderson	a2b4ad839b	net/netcheck: lower the hairpin check timeout to 100ms. This single check is the long pole for netcheck, and significantly slows down magicsock tests. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	25288567ec	net/netcheck: centralize all clock values in one place. This makes it easier to see how long a netcheck might take, and what the slow bits might be. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d60917c0f1	wgengine/router: switch packet marks to avoid conflict with Weave Net. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	10ac066013	all: fix vet warnings	4 years ago
Brad Fitzpatrick	723b9eecb0	net/interfaces: set SysProcAttr.HideWindow to prevent cmd.exe flash on Windows	4 years ago
Brad Fitzpatrick	6c74065053	wgengine/magicsock, tstest/natlab: start hooking up natlab to magicsock Also adds ephemeral port support to natlab. Work in progress. Pairing with @danderson.	4 years ago
Brad Fitzpatrick	ecf5d69c7c	net/netcheck: add missing comment asked for in earlier code review	4 years ago
Brad Fitzpatrick	742b8b44a8	net/tsaddr: new package to hold Tailscale-specific IPs/ranges And update existing callers with (near) duplicated cases.	4 years ago
Brad Fitzpatrick	5c6d8e3053	netcheck, tailcfg, interfaces, magicsock: survey UPnP, NAT-PMP, PCP Don't do anything with UPnP, NAT-PMP, PCP yet, but see how common they are in the wild. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	32156330a8	net/interfaces: add func LikelyHomeRouterIP For discovering where we might direct NAT-PMP/PCP/UPnP queries at in the future.	4 years ago
Brad Fitzpatrick	cf74e9039e	net/netcheck: add an informative payload in the netcheck UDP helper packets Per comment from @normanr: `0a5ab533c1 (r40401954)` Updates #188	4 years ago
Brad Fitzpatrick	0a5ab533c1	net/netcheck: send dummy packet out to help airport extreme in hairpin check At least the Apple Airport Extreme doesn't allow hairpin sends from a private socket until it's seen traffic from that src IP:port to something else out on the internet. See https://github.com/tailscale/tailscale/issues/188#issuecomment-600728643 And it seems that even sending to a likely-filtered RFC 5737 documentation-only IPv4 range is enough to set up the mapping. So do that for now. In the future we might want to classify networks that do and don't require this separately. But for now help it. I've confirmed that this is enough to fix the hairpin check on Avery's home network, even using the RFC 5737 IP. Fixes #188	4 years ago
Brad Fitzpatrick	2d6e84e19e	net/netcheck, wgengine/magicsock: replace more UDPAddr with netaddr.IPPort	4 years ago
Quoc-Viet Nguyen	15a23ce65f	net/stun: Remove unreachable code - Reuse IP length constants from net package. - Remove beu16 to make endianness functions consistent. Signed-off-by: Quoc-Viet Nguyen <afelion@gmail.com>	5 years ago
Brad Fitzpatrick	deb113838e	net/netcheck: use logger.ArgWriter in logConciseReport, fix comma bug, add tests	5 years ago
Brad Fitzpatrick	24009241bf	net/netns: move SOCKS dialing to netns for now This lets control & logs also use SOCKS dials. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	cf0d19f0ab	net/tlsdial, derp/derphttp: finish DERPNode.CertName validation	5 years ago
Brad Fitzpatrick	a5d6c9d616	net/netns: optimize defaultRouteInterface a bit It'll be called a bunch, so worth a bit of effort. Could go further, but not yet. (really, should hook into wgengine/monitor and only re-read on netlink changes?) name old time/op new time/op delta DefaultRouteInterface-8 60.8µs ±11% 44.6µs ± 5% -26.65% (p=0.000 n=20+19) name old alloc/op new alloc/op delta DefaultRouteInterface-8 3.29kB ± 0% 0.55kB ± 0% -83.21% (p=0.000 n=20+20) name old allocs/op new allocs/op delta DefaultRouteInterface-8 9.00 ± 0% 6.00 ± 0% -33.33% (p=0.000 n=20+20)	5 years ago
Brad Fitzpatrick	becce82246	net/netns, misc tests: remove TestOnlySkipPrivilegedOps, argv checks The netns UID check is sufficient for now. We can do something else later if/when needed.	5 years ago
Brad Fitzpatrick	7a410f9236	net/netns: unindent, refactor to remove some redunant code Also: * always error on Control failing. That's very unexpected. * pull out sockopt funcs into their own funcs for easier future testing	5 years ago
Brad Fitzpatrick	45b139d338	net/netns: remove redundant build tag Filename is sufficient.	5 years ago
Brad Fitzpatrick	dcd7a118d3	net/netns: add a test that tailscaleBypassMark stays in sync between packages	5 years ago
Brad Fitzpatrick	1e837b8e81	net/netns: refactor the sync.Once usage a bit	5 years ago
Avery Pennarun	e7ae6a2e06	net/netns, wgengine/router: support Linux machines that don't have 'ip rule'. We'll use SO_BINDTODEVICE instead of fancy policy routing. This has some limitations: for example, we will route all traffic through the interface that has the main "default" (0.0.0.0/0) route, so machines that have multiple physical interfaces might have to go through DERP to get to some peers. But machines with multiple physical interfaces are very likely to have policy routing (ip rule) support anyway. So far, the only OS I know of that needs this feature is ChromeOS (crostini). Fixes #245. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Brad Fitzpatrick	765695eaa2	net/netns: also don't err on tailscaled -fake as a regular user That's one of my dev workflows.	5 years ago
Brad Fitzpatrick	7f68e097dd	net/netcheck: fix HTTPS fallback bug from earlier today My earlier `3fa58303d0` tried to implement the net/http.Tranhsport.DialTLSContext hook, but I didn't return a *tls.Conn, so we ended up sending a plaintext HTTP request to an HTTPS port. The response ended up being Go telling as such, not the /derp/latency-check handler's response (which is currently still a 404). But we didn't even get the 404. This happened to work well enough because Go's built-in error response was still a valid HTTP response that we can measure for timing purposes, but it's not a great answer. Notably, it means we wouldn't be able to get a future handler to run server-side and count those latency requests.	5 years ago
Brad Fitzpatrick	1407540b52	net/netns: don't return an error if we're not root and running the tailscale binary tailscale netcheck was broken otherwise. We can fix this a better way later; I'm just fixing a regression in some way because I'm trying to work on netcheck at the moment.	5 years ago
David Anderson	5114df415e	net/netns: set the bypass socket mark on linux. This allows tailscaled's own traffic to bypass Tailscale-managed routes, so that things like tailscale-provided default routes don't break tailscaled itself. Progress on #144. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago

1 2

75 Commits (64a24e796b8bc7eb633d275052c9ea0f73d01597)