tailscale

Commit Graph

Author	SHA1	Message	Date
David Anderson	ff3442d92d	cmd/derper: record TLS versions used for requests. Surveying the fleet prior to turning off old/unused/insecure TLS versions. Updates tailscale/corp#3615 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	b8ad90c2bf	cmd/derper: in manual cert mode, don't discard error from VerifyHostname Updates #3701 Change-Id: If8ca5104bd8221c99cc390ca49ee3401aff09b62 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Arnaud Dezandee	656809e4ee	cmd/derper: allow http port configuration Signed-off-by: Arnaud Dezandee <dezandee.arnaud@gmail.com>	3 years ago
David Anderson	db800ddeac	cmd/derper: set Content-Security-Policy on DERPs. It's a basic "deny everything" policy, since DERP's HTTP server is very uninteresting from a browser POV. But it stops every security scanner under the sun from reporting "dangerously configured" HTTP servers. Updates tailscale/corp#3119 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	9a217ec841	cmd/derper: increase HSTS cache lifetime to 2 years. Fixes #3373. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	937e96f43d	cmd/derper: enable HSTS when serving over HTTPS. Starting with a short lifetime, to verify nothing breaks. Updates #3373 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
oocococo	3a2b0fc36c	cmd/derper: support custom TLS port when in manual mode (#3231 ) Fixes #3232 Change-Id: I8dae5c01f9dfdfd6d45e34e4ca3534b642ae5c8e Signed-off-by: oocococo <mercurial.lx@gmail.com>	3 years ago
David Anderson	37c150aee1	derp: use new node key type. Update #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	a47158e14d	cmd/derper: use new node key type. Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	b0b0a80318	net/netcheck: implement netcheck for js/wasm clients And the derper change to add a CORS endpoint for latency measurement. And a little magicsock change to cut down some log spam on js/wasm. Updates #3157 Change-Id: I5fd9e6f5098c815116ddc8ac90cbcd0602098a48 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	505f844a43	cmd/derper, derp/derphttp: add websocket support Updates #3157 Change-Id: I337a919a3b350bc7bd9af567b49c4d5d6616abdd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0be26599ca	cmd/derper: refactor STUN path for testing, add serverSTUN benchmark Real goal is to eliminate some allocs in the STUN path, but that requires work in the standard library. See comments in #2783. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d5851d2e06	cmd/derper: fix real staticcheck failure from prior commit Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Silver Bullet	d8c5d00ecb	cmd/derper: support manual TLS certificate mode (#2793 ) Add a mode control for derp server, and add a "manual" mode to get derp server certificate. Under manual mode, certificate is searched in the directory given by "--cert-dir". Certificate should in PEM format, and use "hostname.{key,crt}" as filename. If no hostname is used, search by the hostname given for listen. Fixes #2794 Signed-off-by: SilverBut <SilverBut@users.noreply.github.com>	3 years ago
Brad Fitzpatrick	5d800152d9	cmd/derper: increase port 80's WriteTimeout to permit longer CPU profiles Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Chuangbo Li	e4e4d336d9	cmd/derper: listen on host of flag server addr for port 80 and 3478 (#2768 ) cmd/derper: listen on host of flag server addr for port 80 and 3478 When using custom derp on the server with multiple IP addresses, we would like to bind derp 80, 443 and stun 3478 to a certain IP. derp command provides flag `-a` to customize which address to bind for port 443. But port :80 and :3478 were hard-coded. Fixes #2767 Signed-off-by: Li Chuangbo <im@chuangbo.li>	3 years ago
Brad Fitzpatrick	7a7aa8f2b0	cmd/derper: also add port 80 timeouts Didn't notice this one in earlier `00b3c1c042` Updates tailscale/corp#2486 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	00b3c1c042	cmd/derper: add missing read/write timeouts Updates tailscale/corp#2486 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d37451bac6	cmd/derper: dial VPC address with right context Fix bug from just-submitted `e422e9f4c9`. Updates #2414 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e422e9f4c9	cmd/derper: mesh over VPC network Updates #2414 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	b67a3007d5	cmd/derper: remove default for non-root users Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	9d4eddcef8	cmd/derper: add default -c arguments This adds some convenient defaults for -c, so that user-provided DERPs require less command line flags. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	61e8fd4698	cmd/derpprobe: move from cmd/derper/derpprobe Because our corp build system is confused by nested binaries. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	05da2691a5	cmd/derper/derpprobe: add derp prober Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	148602a89a	derp,cmd/derper: allow server to verify clients This adds a flag to the DERP server which specifies to verify clients through a local tailscaled. It is opt-in, so should not affect existing clients, and is mainly intended for users who want to run their own DERP servers. It assumes there is a local tailscaled running and will attempt to hit it for peer status information. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	3728634af9	derp: add debug traffic handler This adds a handler on the DERP server for logging bytes send and received by clients of the server, by holding open a connection and recording if there is a difference between the number of bytes sent and received. It sends a JSON marshalled object if there is an increase in the number of bytes. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
David Anderson	0022c3d2e2	tsweb: replace NewMux with a more flexible DebugHandler. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	f68431fc02	cmd/derper: add /bootstrap-dns handler For option (d) of #1405. For an HTTPS request of /bootstrap-dns, this returns e.g.: { "log.tailscale.io": [ "2600:1f14:436:d603:342:4c0d:2df9:191b", "34.210.105.16" ], "login.tailscale.com": [ "2a05:d014:386:203:f8b4:1d5a:f163:e187", "3.121.18.47" ] } Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	99d67493be	cmd/derper: update a link from godoc.org to pkg.go.dev Save a redirect. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	741d654aa3	derp/derphttp: add a context and infoLogger option to RunWatchConnectionLoop	4 years ago
Brad Fitzpatrick	d6e9fb1df0	all: adjust Unix permissions for those without umasks Fixes tailscale/corp#1165 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	01ee638cca	Change some os.IsNotExist to errors.Is(err, os.ErrNotExist) for non-os errors. os.IsNotExist doesn't unwrap errors. errors.Is does. The ioutil.ReadFile ones happened to be fine but I changed them so we're consistent with the rule: if the error comes from os, you can use os.IsNotExist, but from any other package, use errors.Is. (errors.Is always would also work, but not worth updating all the code) The motivation here was that we were logging about failure to migrate legacy relay node prefs file on startup, even though the code tried to avoid that. See golang/go#41122	4 years ago
David Anderson	54e6c3a290	version: use OSS repo's version when building. When building with redo, also include the git commit hash from the proprietary repo, so that we have a precise commit that identifies all build info (including Go toolchain version). Add a top-level build script demonstrating to downstream distros how to burn the right information into builds. Adjust `tailscale version` to print commit hashes when available. Fixes #841. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	3fa863e6d9	cmd/derper: add missing html.EscapeString calls in /debug page Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	e415991256	derp, derp/derphttp: remove one RTT from DERP setup * advertise server's DERP public key following its ServerHello * have client look for that DEPR public key in the response PeerCertificates * let client advertise it's going into a "fast start" mode if it finds it * modify server to support that fast start mode, just not sending the HTTP response header Cuts down another round trip, bringing the latency of being able to write our first DERP frame from SF to Bangalore from ~725ms (3 RTT) to ~481ms (2 RTT: TCP and TLS). Fixes #693 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	b23f2263c1	derp: add server version to /debug, expvars This will make it easier for a human to tell what version is deployed, for (say) correlating line numbers in profiles or panics to corresponding source code. It'll also let us observe version changes in prometheus. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	10ac066013	all: fix vet warnings	4 years ago
Brad Fitzpatrick	3553512a71	cmd/derper: fix embarassing bug introduced in earlier refactor The remove hook implementation was copy/pasted from the line above and I didn't change the body, resulting in packet forwarding routes never being removed. Fortunately we weren't using this path yet, but it led to stats being off, and (very) slow memory growth.	4 years ago
Brad Fitzpatrick	b87396b5d9	cmd/derper, derp: add some more varz and consistency check handler I'm trying to hunt down a slow drift in numbers not agreeing.	4 years ago
Brad Fitzpatrick	c8cf3169ba	cmd/derper, derp/derphttp: move bulk of derp mesh code into derphttp To be reused in various other tools.	4 years ago
Brad Fitzpatrick	7cbf6ab771	cmd/derper: remove unused parameter in runMeshClient	4 years ago
Brad Fitzpatrick	abd79ea368	derp: reduce DERP memory use; don't require callers to pass in memory to use The magicsock derpReader was holding onto 65KB for each DERP connection forever, just in case. Make the derp{,http}.Client be in charge of memory instead. It can reuse its bufio.Reader buffer space.	4 years ago
Brad Fitzpatrick	1cb7dab881	cmd/derper: support forwarding packets amongst set of peer DERP servers Updates #388 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b663ab4685	cmd/derper: treat self-connection connection watch as no-op Updates #388	4 years ago
Brad Fitzpatrick	5798826990	cmd/derper: add /home/bradfitz/keys to default mesh key search list	4 years ago
Brad Fitzpatrick	484b7fc9a3	derp, cmd/derper: add frameWatchConns, framePeerPresent for inter-DERP routing This lets a trusted DERP client that knows a pre-shared key subscribe to the connection list. Upon subscribing, they get the current set of connected public keys, and then all changes over time. This lets a set of DERP server peers within a region all stay connected to each other and know which clients are connected to which nodes. Updates #388 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b0c10fa610	stun, netcheck: move under net	4 years ago
David Anderson	1e031001db	derp: move write timeout to package constant. Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
David Anderson	dbfc916273	derp: add short queues between reader and writer, drop on overload. This avoids the server blocking on misbehaving or heavily contended clients. We attempt to drop from the head of the queue to keep overall queueing time lower. Also: - fixes server->client keepalives, which weren't happening. - removes read rate-limiter, deferring instead to kernel-level global limiter/fair queuer. Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
David Crawshaw	5ad947c761	cmd/derper: set a write timeout Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	8abdbbdd1f	cmd/derper: also link to /debug/varz	5 years ago
David Anderson	f192c05413	metrics: add a LabelMap type for variables with 1 label dimension. This lets us publish sets of vars that are breakdowns along one dimension in a format that Prometheus and Grafana natively know how to do useful things with. Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
Brad Fitzpatrick	e371520cc5	tsweb, derp: add expvar http.Handler for Prometheus's format And add some opinions. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	dd68debd64	cmd/derper: set autocert Email Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a399ef3dc7	cmd/derper: appease staticcheck	5 years ago
Brad Fitzpatrick	051b6ef141	cmd/derper: accept more LetsEncrypt hostnames without explicit config	5 years ago
Brad Fitzpatrick	00ad93ec25	cmd/derper: add a STUN server Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	824f825552	tsweb, cmd/derper: move common web/debug stuff from derper to new tsweb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	c763901b1a	cmd/derper: provide debug access over port 80 to trusted (tailscale) IPs Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	2612e54ad1	derp, cmd/derper: add debug handlers, stats Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	37e115834e	cmd/derper: support logging to logtail Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	88f1cc0c98	derp, cmd/derper: add rate limiting support, add default 5Mbps limit Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	b72e6446e2	cmd/derper: add a basic DERP server Mostly Crawshaw's earlier code, refactored a bit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago

1 2 3 4 5

214 Commits (6ab39b7bcd259a7cf4adb9331586a64698c85dcc)