tailscale

Commit Graph

Author	SHA1	Message	Date
Tom DNetto	e9b98dd2e1	control/controlclient,ipn/ipnlocal: wire tka enable/disable Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	9b71008ef2	control/controlhttp: move Dial options into options struct (#5661 ) This turns 'dialParams' into something more like net.Dialer, where configuration fields are public on the struct. Split out of #5648 Change-Id: I0c56fd151dc5489c3c94fb40d18fd639e06473bc Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Eng Zer Jun	f0347e841f	refactor: move from io/ioutil to io and os packages The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	2 years ago
Mihai Parparita	1ce0e558a7	cmd/derper, control/controlhttp: disable WebSocket compression The data that we send over WebSockets is encrypted and thus not compressible. Additionally, Safari has a broken implementation of compression (see nhooyr/websocket#218) that makes enabling it actively harmful. Fixes tailscale/corp#6943 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	74674b110d	envknob: support changing envknobs post-init Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	45a3de14a6	cmd/tailscaled, tailcfg, hostinfo: add flag to disable logging + support As noted in #5617, our documented method of blocking log.tailscale.io DNS no longer works due to bootstrap DNS. Instead, provide an explicit flag (--no-logs-no-support) and/or env variable (TS_NO_LOGS_NO_SUPPORT=true) to explicitly disable logcatcher uploads. It also sets a bit on Hostinfo to say that the node is in that mode so we can end any support tickets from such nodes more quickly. This does not yet provide an easy mechanism for users on some platforms (such as Windows, macOS, Synology) to set flags/env. On Linux you'd used /etc/default/tailscaled typically. Making it easier to set flags for other platforms is tracked in #5114. Fixes #5617 Fixes tailscale/corp#1475 Change-Id: I72404e1789f9e56ec47f9b7021b44c025f7a373a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	c66f99fcdc	tailcfg, control/controlclient, ipn/ipnlocal: add c2n (control-to-node) system This lets the control plane can make HTTP requests to nodes. Then we can use this for future things rather than slapping more stuff into MapResponse, etc. Change-Id: Ic802078c50d33653ae1f79d1e5257e7ade4408fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	18edd79421	control/controlclient,tailcfg: [capver 40] create KeySignature field in tailcfg.Node We calve out a space to put the node-key signature (used on tailnets where network lock is enabled). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	dbcc34981a	cmd/tailscale/cli: fix build break Accidental break from `64d482ff48`. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Juan Font Alonso	64d482ff48	Allow any port for HTTPS when using Noise over TLS Signed-off-by: Juan Font Alonso <juanfontalonso@gmail.com>	2 years ago
Brad Fitzpatrick	90555c5cb2	tailcfg, control/controlclient: add PingRequest.URLIsNoise [capver 38] Change-Id: I19bb63b6d99e96b2f9fd2c440afcc31d38137ded Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	4ee64681ad	tailcfg, control/controlclient: make Debug settings sticky in a map session [capver 37] Fixes #4843 Change-Id: I3accfd91be474ac745cb47f5d6e866c37d5c5d2d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	a9f6cd41fd	all: use syncs.AtomicValue Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	4950fe60bd	syncs, all: move to using Go's new atomic types instead of ours Fixes #5185 Change-Id: I850dd532559af78c3895e2924f8237ccc328449d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	9bb5a038e5	all: use atomic.Pointer Also add some missing docs. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	9e5954c598	control/controlclient: fix crash in tests elsewhere when GetNLPublicKey is nil `4001d0bf25` caused tests in another repo to fail with a crash, calling a nil func. This might not be the right fix, but fixes the build. Change-Id: I67263f883c298f307abdd22bc2a30b3393f062e6 Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	4001d0bf25	assorted: plumb tka initialization & network-lock key into tailscaled - A network-lock key is generated if it doesn't already exist, and stored in the StateStore. The public component is communicated to control during registration. - If TKA state exists on the filesystem, a tailnet key authority is initialized (but nothing is done with it for now). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	7c7e23d87a	control/controlclient, tailcfg: add 6 more patchable Node fields [capver 36] Change-Id: Iae997a9a98a5dd841bc41fa91227d5a7dd476a25 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a12aad6b47	all: convert more code to use net/netip directly perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7eaf5e509f	net/netaddr: start migrating to net/netip via new netaddr adapter package Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	d8cb5aae17	tailcfg, control/controlclient: add tailcfg.PeersChangedPatch [capver 33] This adds a lighter mechanism for endpoint updates from control. Change-Id: If169c26becb76d683e9877dc48cfb35f90cc5f24 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b7f1fe7b0d	tailcfg: remove old DNS fields The control plane server doesn't send these to modern clients so we don't need them in the tree. The server has its own serialization code to generate legacy MapResponses when needed. Change-Id: Idd1e5d96ddf9d4306f2da550d20b77f0c252817a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	87a4c75fd4	control/controlclient, ipn/ipnlocal: remove Client.SetExpirySooner, fix race Client.SetExpirySooner isn't part of the state machine. Remove it from the Client interface. And fix a use of LocalBackend.cc without acquiring the lock that guards that field. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ef0d740270	control/controlclient: remove Client.SetStatusFunc It can't change at runtime. Make it an option. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	70a2797064	control/controlclient, ipn/ipnlocal: remove some Client methods Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a1e429f7c3	control/controlclient, types/netmap: remove unused LocalPort field Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	526b0b6890	control/controlclient: start simplifying netmap fetch APIs Step 1 of many, cleaning up the direct/auto client & restarting map requests that leads to all the unnecessary map requests. Updates tailscale/corp#5761 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	13d0b8e6a4	control/controlclient, net/dnscache: use typed singleflight fork Change-Id: I12be4c5a91ae3a812fe88d9b2d15526fdbb5a921 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	2990c2b1cf	control/controlhttp: use secure WebSockets protocol by default Forcing the insecure protocol (and perserving the port number) is only desired for localhost testing, in prod we need to use wss:// to avoid mixed-content errors. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	edc90ebc61	net/wsconn: remove homegrown wrapper for turning a websocket.Conn into a net.Conn The one from the nhooyr/websocket package seems to work equally well. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	4007601f73	cmd/controlclient: wire up PingRequest peerapi pings too Updates tailscale/corp#754 Change-Id: I61ac3fc44783b54bd02455bcb0baf19159b7a9d2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Jordan Whited	43f9c25fd2	cmd/tailscale: surface authentication errors in status.Health (#4748 ) Fixes #3713 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 years ago
Mihai Parparita	a9f32656f5	control/controlhttp: allow client and server to communicate over WebSockets We can't do Noise-over-HTTP in Wasm/JS (because we don't have bidirectional communication), but we should be able to do it over WebSockets. Reuses derp WebSocket support that allows us to turn a WebSocket connection into a net.Conn. Updates #3157 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Brad Fitzpatrick	c81be7b899	control/controlclient: avoid Noise protocol for js/wasm for now Updates #3157 Change-Id: I04accc09783a68257d28cadde5818bf0724a8013 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	c60cbca371	control/controlclient: store netinfo and hostinfo separately Currently, when SetNetInfo is called it sets the value on hostinfo.NetInfo. However, when SetHostInfo is called it overwrites the hostinfo field which may mean it also clears out the NetInfo it had just received. This commit stores NetInfo separately and combines it into Hostinfo as needed so that control is always notified of the latest values. Also, remove unused copies of Hostinfo from ipn.Status and controlclient.Auto. Updates #tailscale/corp#4824 (maybe fixes) Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
James Tucker	ae483d3446	wgengine, net/packet, cmd/tailscale: add ICMP echo Updates tailscale/corp#754 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	1237000efe	control/controlhttp: don't assume port 80 upgrade response will work Just because we get an HTTP upgrade response over port 80, don't assume we'll be able to do bi-di Noise over it. There might be a MITM corp proxy or anti-virus/firewall interfering. Do a bit more work to validate the connection before proceeding to give up on the TLS port 443 dial. Updates #4557 (probably fixes) Change-Id: I0e1bcc195af21ad3d360ffe79daead730dfd86f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	5a1ef1bbb9	net/tsdial: add SystemDial as a wrapper on netns.Dial The connections returned from SystemDial are automatically closed when there is a major link change. Also plumb through the dialer to the noise client so that connections are auto-reset when moving from cellular to WiFi etc. Updates #3363 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	e38d3dfc76	control/controlhttp: start port 443 fallback sooner if 80's stuck Fixes #4544 Change-Id: I39877e71915ad48c6668351c45cd8e33e2f5dbae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	adcb7e59d2	control/controlclient: fix log print with always-empty key In debugging #4541, I noticed this log print was always empty. The value printed was always zero at this point. Updates #4541 Change-Id: I0eef60c32717c293c1c853879446be65d9b2cef6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	910ae68e0b	util/mak: move tailssh's mapSet into a new package for reuse elsewhere Change-Id: Idfe95db82275fd2be6ca88f245830731a0d5aecf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9f1dd716e8	tailcfg, logtail: provide Debug bit to disable logtail For people running self-hosted control planes who want a global opt-out knob instead of running their own logcatcher. Change-Id: I7f996c09f45850ff77b58bfd5a535e197971725a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	c591c91653	tailcfg, control/controlclient: TSMP & disco pings tailcfg.PingResponse formalizes the TSMP & disco response message, and controlclient is wired to send POST responses containing tailcfg.PingResponse for TSMP and disco PingRequests. Updates tailscale/corp#754 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
David Anderson	f570372b4d	control/controlbase: don't enforce a max protocol version at handshake time. Doing so makes development unpleasant, because we have to first break the client by bumping to a version the control server rejects, then upgrade the control server to make it accept the new version. This strict rejection at handshake time is only necessary if we want to blocklist some vulnerable protocol versions in the future. So, switch to a default-permissive stance: until we have such a version that we have to eagerly block early, we'll accept whatever version the client presents, and leave it to the user of controlbase.Conn to make decisions based on that version. Noise still enforces that the client and server agree on what protocol version is being used, and the control server still has the option to finish the handshake and then hang up with an in-noise error, rather than abort at the handshake level. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	02ad987e24	control/controlbase: make the protocol version number selectable. This is so that we can plumb our client capability version through the protocol as the Noise version. The capability version increments more frequently than strictly required (the Noise version only needs to change when cryptographically-significant changes are made to the protocol, whereas the capability version also indicates changes in non-cryptographically-significant parts of the protocol), but this gives us a safe pre-auth way to determine if the client supports future protocol features, while still relying on Noise's strong assurance that the client and server have agreed on the same version. Currently, the server executes the same protocol regardless of the version number, and just presents the version to the caller so they can do capability-based things in the upper RPC protocol. In future, we may add a ratchet to disallow obsolete protocols, or vary the Noise handshake behavior based on requested version. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maisem Ali	309ddef852	net/netutil: add CheckIPForwardingLinux (#4301 ) Combine the code between `LocalBackend.CheckIPForwarding` and `controlclient.ipForwardingBroken`. Fixes #4300 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	b647977b33	net/netutil: move some net utils from control/controlhttp to netutil In prep for reuse elsewhere. Change-Id: I1b804edf76ac66b9108e6f434e77eab7a7472d69 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f3b13604b3	control/controlclient, ipn/ipnlocal, tailcfg: add MapResponse.PopBrowserURL Updates #3802 Change-Id: I89481fc5782a0cc8084354706f8f28d94f197325 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3ea6ddbb5f	control/controlbase: use less memory when idle (remove rxState.buf) Uses 4KB less per Conn. Fixes #4113 Change-Id: I38d25b1cf5ecf45423404a330b7ecab79a9fb176 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	21445b56a5	control/controlbase: use less memory when idle (remove txState.buf) Uses 4KB less per Conn. Updates #4113 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	0868329936	all: use any instead of interface{} My favorite part of generics. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	8c2cb4b431	go.mod: update to latest certstore It includes a fix to allow us to use Go 1.18. We can now remove our Tailscale-only build tags. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	26021b07ec	control/controlclient: only build certstore-related code with the Tailscale Go toolchain The certstore code is impacted by golang/go#51726. The Tailscale Go toolchain fork contains a temporary workaround, so it can compile it. Once the upstream toolchain can compile certstore, presumably in Go 1.18.1, we can revert this change. Note that depaware runs with the upstream toolchain. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	efc48b0578	ssh/tailssh, ipnlocal, controlclient: fetch next SSHAction from network Updates #3802 Change-Id: I08e98805ab86d6bbabb6c365ed4526f54742fd8e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6b11004a2a	control/controlclient: proactively close TLS connection after /key fetch When using Noise. Updates #3488 Change-Id: I1049963763075a15b72fd8065dcf44a9cf37975f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Nick O'Neill	1625e87526	control/controlclient, localapi: shorten expiry time via localapi (#4112 ) Signed-off-by: Nick O'Neill <nick@tailscale.com>	3 years ago
Maisem Ali	2c89b3a601	control/controlbase: make Conn.Write return consumed bytes Currently `Write` returns the number of ciphertext bytes written. According to the docs for io.Writer, Write should return the amount of bytes consumed from the input. ``` // Write writes len(p) bytes from p to the underlying data stream. // It returns the number of bytes written from p (0 <= n <= len(p)) // and any error encountered that caused the write to stop early. // Write must return a non-nil error if it returns n < len(p). // Write must not modify the slice data, even temporarily. Write(p []byte) (n int, err error) ``` Fixes #4126 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	e82a74553b	control/controlclient: make MapRequests go over noise. Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	ba2c0c3145	control/controlclient: call direct.Close after map requests are complete This was causing a flake in another repo. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	91a8cdc84b	control/controlclient: make Auto.Shutdown call Direct.Close Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	0f37317664	control/controlclient: make RegisterRequest go over Noise Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	c4f6df47e5	control/controlclient: fix Noise HTTP/2 regression from earlier commit Fix regression from `21069124db` caught by tests in another repo. The HTTP/2 Transport that was being returned had a ConnPool that never dialed. Updates #3488 Change-Id: I3184d6393813448ae143d37ece14eb732334c05f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	21069124db	control/controlclient: fix the Noise HTTP/2 timeout config We want to close the connection after a minute of inactivity, not heartbeat once a minute to keep it alive forever. Updates #3488 Change-Id: I4b5275e8d1f2528e13de2d54808773c70537db91 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	0588ca5d8b	control/controlclient: make SetDNS attempt to go over Noise first Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	da1821197a	tailcfg: add SetDNSResponse Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	0f31a0fc76	control/controlclient: add Noise client Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	249758df90	control/controlclient: start fetching the server noise key Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	d5f8f38ac6	tailcfg: rename map request version to "capability version" And add a CapabilityVersion type, primarily for documentation. This makes MapRequest.Version, RegisterRequest.Version, and SetDNSRequest.Version all use the same version, which will avoid confusing in the future if Register or SetDNS ever changed their semantics on Version change. (Currently they're both always 1) This will requre a control server change to allow a SetDNSRequest.Version value other than 1 to be deployed first. Change-Id: I073042a216e0d745f52ee2dbc45cf336b9f84b7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5d085a6f41	controlhttp: add some docs, change Dial's path from /switch to /ts2021 When I deployed server-side changes, I put the upgrade handler at /ts2021 instead of /switch. We could move the server to /switch, but ts2021 seems more specific and better, but I don't feel strongly. Updates #3488 Change-Id: Ifbf8ea60a815fd2fa1bfbe1b7af1ac2a27218354 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	823d970d60	control/controlclient: use structured logging for MapResponse.ControlTime Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	8c3c5e80b7	tailcfg: make MapResponse.ControlTime a pointer Otherwise omitempty doesn't work. This is wire-compatible with a non-pointer type, so switching is safe, now and in the future. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	8cf6d0a17b	tailcfg: add MapResponse.ControlTime field And log it when provided in map responses. The test uses the date on which I joined Tailscale. :) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Maisem Ali	72d8672ef7	tailcfg: make Node.Hostinfo a HostinfoView Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	57115e923e	tailcfg: add start of SSH policy to be sent from control plane to nodes Updates #3802 Change-Id: Iec58f35d445aaa267d0f7e7e2f30c049c1df4c0e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3a94ece30c	control/controlclient: remove dummy endpoint in endpoint stripping mode The TODO is done. Magicsock doesn't require any endpoints to create an *endpoint now. Verified both in code and empirically: I can use the env knob and access everything. Change-Id: I4fe7ed5b11c5c5e94b21ef3d77be149daeab998a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	86a902b201	all: adjust some log verbosity Updates #1548 Change-Id: Ia55f1b5dc7dfea09a08c90324226fb92cd10fa00 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	adda2d2a51	control/controlclient: select newer certificate If multiple certificates match when selecting a certificate, use the one issued the most recently (as determined by the NotBefore timestamp). This also adds some tests for the function that performs that comparison. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Brad Fitzpatrick	b3d268c5a1	control/controlclient: turn off Go's implicit compression We don't use it anyway, so be explicit that we're not using it. Change-Id: Iec953271ef0169a2e227811932f5b65b479624af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	96f008cf87	control/controlhttp: package to get a controlbase.Conn over HTTP(S). Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	d5a7eabcd0	control/controlbase: enable asynchronous client handshaking. With this change, the client can obtain the initial handshake message separately from the rest of the handshake, for embedding into another protocol. This enables things like RTT reduction by stuffing the handshake initiation message into an HTTP header. Similarly, the server API optionally accepts a pre-read Noise initiation message, in addition to reading the message directly off a net.Conn. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	6cd180746f	control/controlbase: rename from control/noise. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	25eab78573	control/noise: clean up resources in TestNoReuse Close the server and client. Without this, we leak system threads. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	d9c21936c3	control/controlclient: stop logging about goal.url invariant This isn't the ideal solution, but it's good enough for now. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	758c37b83d	net/netns: thread logf into control functions So that darwin can log there without panicking during tests. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	24ea365d48	netcheck, controlclient, magicsock: add more metrics Updates #3307 Change-Id: Ibb33425764a75bde49230632f1b472f923551126 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	5b94f67956	control/noise: make Conn.readNLocked less surprising. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	a34350ffda	control/noise: factor out nonce checking and incrementing into a type. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	d3acd35a90	control/noise: make message headers match the specification. Only the initiation message should carry a protocol version, all others are just type+len. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	a63c4ab378	control/noise: don't panic when handling ciphertext. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	4004b22fe5	control/noise: stop using poly1305 package constants. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	293431aaea	control/noise: use key.Machine{Public,Private} as appropriate. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	edb33d65c3	control/noise: don't cache mixer, just rebuild a BLAKE2s each time. This should optimize out fine, and readability is preferable to performance here. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	7e9e72887c	control/noise: add singleUseCHP, use it to simplify nonce/key tracking in handshake. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	cf90392174	control/noise: review fixups Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	0b392dbaf7	control/noise: adjust implementation to match revised spec. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	89a68a4c22	control/noise: include the protocol version in the Noise prologue. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	5e005a658f	control/noise: fix typo in docstring. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	eabca699ec	control/noise: remove allocations in the encrypt and decrypt paths. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	da7544bcc5	control/noise: implement the base transport for the 2021 control protocol. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago

1 2 3 4 5 ...

431 Commits (6866aaeab39fee83a4f3292986e7022109d85685)