tailscale

Commit Graph

Author	SHA1	Message	Date
Maisem Ali	64bbf1738e	tailcfg: make SelfNodeV4MasqAddrForThisPeer a pointer This makes `omitempty` actually work, and saves bytes in each map response. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	edb02b63f8	net/sockstats: pass in logger to sockstats.WithSockStats Using log.Printf may end up being printed out to the console, which is not desirable. I noticed this when I was investigating some client logs with `sockstats: trace "NetcheckClient" was overwritten by another`. That turns to be harmless/expected (the netcheck client will fall back to the DERP client in some cases, which does its own sockstats trace). However, the log output could be visible to users if running the `tailscale netcheck` CLI command, which would be needlessly confusing. Updates tailscale/corp#9230 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
James Tucker	e09c434e5d	wgengine/magicsock: remove locking sync requirements on conn disco keys The lazy initialization of the disco key is not necessary, and contributes to unnecessary locking and state checking. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
James Tucker	e1b71c83ac	wgengine/magicsock: remove unused fields on discoInfo Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
James Tucker	a257b2f88b	wgengine/magicsock: add immutability documentation to endpointDisco Updates #7825 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
James Tucker	fb18af5564	wgengine/netstack: fix data-race on startup Running tailscaled with the race detector enabled immediately fires on this field, as it is updated after first read. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Charlotte Brandhorst-Satzkorn	c573bef0aa	tailcfg,wgengine: add initial support for WireGuard only peers A peer can have IsWireGuardOnly, which means it will not support DERP or Disco, and it must have Endpoints filled in order to be usable. In the present implementation only the first Endpoint will be used as the bestAddr. Updates tailscale/corp#10351 Co-authored-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com> Co-authored-by: James Tucker <james@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
James Tucker	6cfcb3cae4	wgengine/magicsock: fix synchronization of endpoint disco fields Identified in review in #7821 endpoint.discoKey and endpoint.discoShort are often accessed without first taking endpoint.mu. The arrangement with endpoint.mu is inconvenient for a good number of those call-sites, so it is instead replaced with an atomic pointer to carry both pieces of disco info. This will also help with #7821 that wants to add explicit checks/guards to disable disco behaviors when disco keys are missing which is necessarily implicitly mostly covered by this change. Updates #7821 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Tom DNetto	6a627e5a33	net, wgengine/capture: encode NAT addresses in pcap stream Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
valscale	7bfb7744b7	derp,magicsock: add debug envknobs for HTTP and derp server name (#7744 ) Make developing derp easier by: 1. Creating an envknob telling clients to use HTTP to connect to derp servers, so devs don't have to acquire a valid TLS cert. 2. Creating an envknob telling clients which derp server to connect to, so devs don't have to edit the ACLs in the admin console to add a custom DERP map. 3. Explaining how the -dev and -a command lines args to derper interact. To use this: 1. Run derper with -dev. 2. Run tailscaled with TS_DEBUG_USE_DERP_HTTP=1 and TS_DEBUG_USE_DERP_ADDR=localhost This will result in the client connecting to derp via HTTP on port 3340. Fixes #7700 Signed-off-by: Val <valerie@tailscale.com>	2 years ago
Jordan Whited	f475e5550c	net/neterror, wgengine/magicsock: use UDP GSO and GRO on Linux (#7791 ) This commit implements UDP offloading for Linux. GSO size is passed to and from the kernel via socket control messages. Support is probed at runtime. UDP GSO is dependent on checksum offload support on the egress netdev. UDP GSO will be disabled in the event sendmmsg() returns EIO, which is a strong signal that the egress netdev does not support checksum offload. Updates tailscale/corp#8734 Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
Andrew Dunham	8d3acc9235	util/sysresources, magicsock: scale DERP buffer based on system memory This adds the util/sysresources package, which currently only contains a function to return the total memory size of the current system. Then, we modify magicsock to scale the number of buffered DERP messages based on the system's available memory, ensuring that we never use a value lower than the previous constant of 32. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib763c877de4d0d4ee88869078e7d512f6a3a148d	2 years ago
James Tucker	40fa2a420c	envknob,net/tstun,wgengine: use TS_DEBUG_MTU consistently Noted on #5915 TS_DEBUG_MTU was not used consistently everywhere. Extract the default into a function that can apply this centrally and use it everywhere. Added envknob.Lookup{Int,Uint}Sized to make it easier to keep CodeQL happy when using converted values. Updates #5915 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Will Norris	e99c7c3ee5	sockstats: add labels for netlog and sockstatlog packages Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Maisem Ali	985535aebc	net/tstun,wgengine/*: add support for NAT to routes This adds support to make exit nodes and subnet routers work when in scenarios where NAT is required. It also updates the NATConfig to be generated from a `wgcfg.Config` as that handles merging prefs with the netmap, so it has the required information about whether an exit node is already configured and whether routes are accepted. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
James Tucker	c628132b34	wgengine/netstack: do not send packets to netstack after close Use the local context on Impl to check for shut down state in order to drop rather than inject packets after close has begun. Netstack sets endpoint.dispatcher to nil during shutdown. After the recent adjustment in `920ec69241` we now wait for netstack to fully shutdown before we release tests. This means that we may continue to accept packets and attempt to inject them, which we must prevent in order to avoid nil pointer panic. References google/gvisor#8765 Fixes #7715 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Jordan Whited	27e37cf9b3	go.mod, net/tstun, wgengine/magicsock: update wireguard-go (#7712 ) This commit updates the wireguard-go dependency to pull in fixes for the tun package, specifically 052af4a and aad7fca. Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
Maisem Ali	920ec69241	tsnet,wgenegine/netstack: add test and fix resource leaks We were not closing the http.Server and were also not waiting for netstack to fully close. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
valscale	74eb99aed1	derp, derphttp, magicsock: send new unknown peer frame when destination is unknown (#7552 ) * wgengine/magicsock: add envknob to send CallMeMaybe to non-existent peer For testing older client version responses to the PeerGone packet format change. Updates #4326 Signed-off-by: Val <valerie@tailscale.com> * derp: remove dead sclient struct member replaceLimiter Leftover from an previous solution to the duplicate client problem. Updates #2751 Signed-off-by: Val <valerie@tailscale.com> * derp, derp/derphttp, wgengine/magicsock: add new PeerGone message type Not Here Extend the PeerGone message type by adding a reason byte. Send a PeerGone "Not Here" message when an endpoint sends a disco message to a peer that this server has no record of. Fixes #4326 Signed-off-by: Val <valerie@tailscale.com> --------- Signed-off-by: Val <valerie@tailscale.com>	2 years ago
Maisem Ali	bb31fd7d1c	net/tstun: add inital support for NAT v4 This adds support in tstun to utitilize the SelfNodeV4MasqAddrForThisPeer and perform the necessary modifications to the packet as it passes through tstun. Currently this only handles ICMP, UDP and TCP traffic. Subnet routers and Exit Nodes are also unsupported. Updates tailscale/corp#8020 Co-authored-by: Melanie Warrick <warrick@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	535fad16f8	net/tstun: rename filterIn/filterOut methods to be more descriptive Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Will Norris	57a008a1e1	all: pass log IDs as the proper type rather than strings This change focuses on the backend log ID, which is the mostly commonly used in the client. Tests which don't seem to make use of the log ID just use the zero value. Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Maisem Ali	b0cb39cda1	tsnet: only intercept TCP flows that have listeners Previously, it would accept all TCP connections and then close the ones it did not care about. Make it only ever accept the connections that it cares about. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	be107f92d3	wgengine/magicsock: track per-endpoint changes in ringbuffer This change adds a ringbuffer to each magicsock endpoint that keeps a fixed set of "changes"–debug information about what updates have been made to that endpoint. Additionally, this adds a LocalAPI endpoint and associated "debug peer-status" CLI subcommand to fetch the set of changes for a given IP or hostname. Updates tailscale/corp#9364 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I34f726a71bddd0dfa36ec05ebafffb24f6e0516a	2 years ago
Mihai Parparita	6ac6ddbb47	sockstats: switch label to enum Makes it cheaper/simpler to persist values, and encourages reuse of labels as opposed to generating an arbitrary number. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	9ff51ca17f	wgengine/netstack: add support for custom UDP flow handlers To be used by tsnet and sniproxy later. Updates #5871 Updates #1748 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	1a30b2d73f	all: use tstest.Replace more Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	3f8e8b04fd	cmd/tailscale, cmd/tailscaled: move portmapper debugging into tailscale CLI The debug flag on tailscaled isn't available in the macOS App Store build, since we don't have a tailscaled binary; move it to the 'tailscale debug' CLI that is available on all platforms instead, accessed over LocalAPI. Updates #7377 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I47bffe4461e036fab577c2e51e173f4003592ff7	2 years ago
Mihai Parparita	3e71e0ef68	net/sockstats: remove explicit dependency on wgengine/monitor Followup to #7177 to avoid adding extra dependencies to the CLI. We instead declare an interface for the link monitor. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
James Tucker	7b73c9628d	version/distro,wgengine/router: raise WSL eth0 MTU when too low WSL has started to set the eth0 default route interface default to 1280 MTU, which is too low to carry 1280 byte packets from tailscale0 once wrapped in WireGuard. The change down to 1280 is very likely smaller than necessary for almost all users. We can not easily determine the ideal MTU, but if all the preconditions match, we raise the MTU to 1360, which is just enough for Tailscale traffic to work. Updates #4833 Updates #7346 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Mihai Parparita	9cb332f0e2	sockstats: instrument networking code paths Uses the hooks added by tailscale/go#45 to instrument the reads and writes on the major code paths that do network I/O in the client. The convention is to use "<package>.<type>:<label>" as the annotation for the responsible code path. Enabled on iOS, macOS and Android only, since mobile platforms are the ones we're most interested in, and we are less sensitive to any throughput degradation due to the per-I/O callback overhead (macOS is also enabled for ease of testing during development). For now just exposed as counters on a /v0/sockstats PeerAPI endpoint. We also keep track of the current interface so that we can break out the stats by interface. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Joe Tsai	0d19f5d421	all: replace logtail.{Public,Private}ID with logid.{Public,Private}ID (#7404 ) The log ID types were moved to a separate package so that code that only depend on log ID types do not need to link in the logic for the logtail client itself. Not all code need the logtail client. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Denton Gentry	fdc2018d67	wgengine/magicsock: remove superfluous "discokey" from log The stringification of the discokey type now prepends "discokey:" Fixes https://github.com/tailscale/tailscale/issues/3074 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Tom DNetto	2ca6dd1f1d	wgengine: start logging DISCO frames to pcap stream Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	99b9d7a621	all: implement pcap streaming for datapath debugging Updates: tailscale/corp#8470 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	7393ce5e4f	wgengine/magicsock: add envknob to print information about port selection To aid in debugging where a customer has static port-forwards set up and there are issues establishing a connection through that port. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic5558bcdb40c9119b83f79dcacf2233b07777f2a	2 years ago
Brad Fitzpatrick	cf8dd7aa09	all: use Go 1.20's bytes.Clone Updates #7123 Updates #6257 (more to do in other repos) Change-Id: I073e2a6d81a5d7fbecc29caddb7e057ff65239d0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Jordan Whited	39e52c4b0a	wgengine/magicsock: fix de-dup disco ping handling for netmap endpoints (#7118 ) Fixes #7116 Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
Maisem Ali	04b57a371e	ipn/ipnlocal: drop not required StateKey parameter This is #cleanup now that #7121 is merged. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Jordan Whited	7921198c05	wgengine/magicsock: de-dup disco pings (#7093 ) Fixes #7078 Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
Will Norris	947c14793a	all: update tools that manage copyright headers Update all code generation tools, and those that check for license headers to use the new standard header. Also update copyright statement in LICENSE file. Fixes #6865 Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Will Norris	71029cea2d	all: update copyright and license headers This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Brad Fitzpatrick	d8feeeee4c	wgengine/magicsock: fix buggy fast path in Conn.SetNetworkMap Spotted by Maisem. Fixes #6680 Change-Id: I5fdc01de8b006a1c43a2a4848f69397f54b4453a Co-authored-By: Maisem Ali <maisem@tailscale.com> Co-authored-By: Andrew Dunham <andrew@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
James Tucker	e002260b62	wgengine/wglog: add a prefix for all wireguard logs Fixes #7041 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Jordan Whited	fec888581a	wgengine/magicsock: retry failed single packet ops across rebinds (#6990 ) The single packet WriteTo() through RebindingUDPConn.WriteBatch() was not checking for a rebind between loading the PacketConn and writing to it. Same with ReadFrom()/ReadBatch(). Fixes #6989 Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
Andrew Dunham	4fb663fbd2	various: mark more tests as flaky Updates #2855 Updates #3598 Updates #7008 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I2b849e04646456b9f0c8a01563f2add752f4b2a4	2 years ago
Andrew Dunham	58ad21b252	wgengine/netstack: fix data race in tests This uses the helper function added in #6173 to avoid flakes like: https://github.com/tailscale/tailscale/actions/runs/3826912237/jobs/6511078024 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If3f1d3b9c0f64ffcb4ba9a30d3522ec49484f993	2 years ago
Andrew Dunham	aea251d42a	cmd/testwrapper: move from corp; mark magicsock test as flaky Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ibab5860f5797b3db151d3c27855333e43a9088a4	2 years ago
Brad Fitzpatrick	2df38b1feb	wgengine/magicsock: quiet log flood at tailscaled shutdown When you hit control-C on a tailscaled (notably in dev mode, but also on any systemctl stop/restart), there is a flood of messages like: magicsock: doing cleanup for discovery key d:aa9c92321db0807f magicsock: doing cleanup for discovery key d:bb0f16aacadbfd46 magicsock: doing cleanup for discovery key d:b5b2d386296536f2 magicsock: doing cleanup for discovery key d:3b640649f6796c91 magicsock: doing cleanup for discovery key d:71d7b1afbcce52cd magicsock: doing cleanup for discovery key d:315b61d7e0111377 magicsock: doing cleanup for discovery key d:9301f63dce69bf45 magicsock: doing cleanup for discovery key d:376141884d6fe072 .... It can be hundreds or even tens of thousands. So don't do that. Not a useful log message during shutdown. Change-Id: I029a8510741023f740877df28adff778246c18e5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	c1a2e2c380	net/{packet,tstun},wgengine/filter: fix unknown IP protocol handling `01b90df2fa` added SCTP support before (with explicit parsing for ports) and `69de3bf7bf` tried to add support for arbitrary IP protocols (as long as the ACL permited a port of "", since we might not know how to find ports from an arbitrary IP protocol, if it even has such a concept). But apparently that latter commit wasn't tested end-to-end enough. It had a lot of tests, but the tests made assumptions about layering that either weren't true, or regressed since 1.20. Notably, it didn't remove the (Filter).pre bidirectional filter that dropped all "unknown" protocol packets both leaving and entering, even if there were explicit protocol matches allowing them in. Also, don't map all unknown protocols to 0. Keep their IP protocol number parsed so it's matchable by later layers. Only reject illegal things. Fixes #6423 Updates #2162 Updates #2163 Change-Id: I9659b3ece86f4db51d644f9b34df78821758842c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago

1 2 3 4 5 ...

1291 Commits (64bbf1738e17dcc5cc74807a338606c9ebcfb687)