1525 Commits (70f14af21eaa130f0f677d30310951715c9498eb)

 

All Branches   

Search

Author	SHA1	Message	Date
Christine Dodrill	70f14af21e	add nix-shell boilerplate (#1028) ... This enables users of nix-shell to automagically have the correct development environment by simply changing directory into a checkout of this repo. For more information on this see the following links: - https://christine.website/blog/how-i-start-nix-2020-03-08 - https://direnv.net/	4 years ago
Brad Fitzpatrick	0d94fe5f69	wgengine/router: disable IPv6 on Linux if ip rule -6 fails (#1074) ... Updates #562 Fixes #973 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	1e88050403	net/tsaddr: add ChromeOS contains tests ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	cf2ac2d123	go.mod: upgrade inet.af/netaddr ... To pick up IPPrefix.Contains fix.	4 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Charlotte Brandhorst-Satzkorn	ff2b3d02e6	Fix typo in cmd/tailscale/cli/cli.go (#1069) ... Remove duplicate 'to connect' in error message. Fixes #1068 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@catzkorn.dev>	4 years ago
Frederik “Freso” S. Olesen	a9a80ab372	tailscaled.service: Harden systemd unit somewhat (#1062) ... While not a full capability lockdown of the systemd unit, this still improves sandboxing and security of the running process a good deal. Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>	4 years ago
Matt Layher	1a42cef3a2	cmd/tailscale*: make updatedeps ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Matt Layher	bfbd6b9241	go.mod: bump github.com/mdlayher/netlink to v1.2.0 ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Brad Fitzpatrick	80c94168ae	wgengine: finish updating isTrimmablePeer ... I accidentally merged Dave's change with the XXXX DO NOT SUBMIT comment in it.	4 years ago
David Anderson	cb96b14bf4	net/packet: remove the custom IP4/IP6 types in favor of netaddr.IP. ... Upstream netaddr has a change that makes it alloc-free, so it's safe to use in hot codepaths. This gets rid of one of the many IP types in our codebase. Performance is currently worse across the board. This is likely due in part to netaddr.IP being a larger value type (4b -> 24b for IPv4, 16b -> 24b for IPv6), and in other part due to missing low-hanging fruit optimizations in netaddr. However, the regression is less bad than it looks at first glance, because we'd micro-optimized packet.IP* in the past few weeks. This change drops us back to roughly where we were at the 1.2 release, but with the benefit of a significant code and architectural simplification. name old time/op new time/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 12.2ns ± 5% 29.7ns ± 2% +142.32% (p=0.008 n=5+5) Decode/tcp6-8 12.6ns ± 3% 65.1ns ± 2% +418.47% (p=0.008 n=5+5) Decode/udp4-8 11.8ns ± 3% 30.5ns ± 2% +157.94% (p=0.008 n=5+5) Decode/udp6-8 27.1ns ± 1% 65.7ns ± 2% +142.36% (p=0.016 n=4+5) Decode/icmp4-8 24.6ns ± 2% 30.5ns ± 2% +23.65% (p=0.016 n=4+5) Decode/icmp6-8 22.9ns ±51% 65.5ns ± 2% +186.19% (p=0.008 n=5+5) Decode/igmp-8 18.1ns ±44% 30.2ns ± 1% +66.89% (p=0.008 n=5+5) Decode/unknown-8 20.8ns ± 1% 10.6ns ± 9% -49.11% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 30.5ns ± 1% 77.9ns ± 3% +155.01% (p=0.008 n=5+5) Filter/tcp4_syn_in-8 43.7ns ± 3% 123.0ns ± 3% +181.72% (p=0.008 n=5+5) Filter/tcp4_syn_out-8 24.5ns ± 2% 45.7ns ± 6% +86.22% (p=0.008 n=5+5) Filter/udp4_in-8 64.8ns ± 1% 210.0ns ± 2% +223.87% (p=0.008 n=5+5) Filter/udp4_out-8 119ns ± 0% 278ns ± 0% +133.78% (p=0.016 n=4+5) Filter/icmp6-8 40.3ns ± 2% 204.4ns ± 4% +407.70% (p=0.008 n=5+5) Filter/tcp6_syn_in-8 35.3ns ± 3% 199.2ns ± 2% +464.95% (p=0.008 n=5+5) Filter/tcp6_syn_out-8 32.8ns ± 2% 81.0ns ± 2% +147.10% (p=0.008 n=5+5) Filter/udp6_in-8 106ns ± 2% 290ns ± 2% +174.48% (p=0.008 n=5+5) Filter/udp6_out-8 184ns ± 2% 314ns ± 3% +70.43% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/tstun goos:linux goarch:amd64 Write-8 9.02ns ± 3% 8.92ns ± 1% ~ (p=0.421 n=5+5) name old alloc/op new alloc/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00B 0.00B ~ (all equal) Decode/tcp6-8 0.00B 0.00B ~ (all equal) Decode/udp4-8 0.00B 0.00B ~ (all equal) Decode/udp6-8 0.00B 0.00B ~ (all equal) Decode/icmp4-8 0.00B 0.00B ~ (all equal) Decode/icmp6-8 0.00B 0.00B ~ (all equal) Decode/igmp-8 0.00B 0.00B ~ (all equal) Decode/unknown-8 0.00B 0.00B ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp4_in-8 0.00B 0.00B ~ (all equal) Filter/udp4_out-8 16.0B ± 0% 64.0B ± 0% +300.00% (p=0.008 n=5+5) Filter/icmp6-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp6_in-8 0.00B 0.00B ~ (all equal) Filter/udp6_out-8 48.0B ± 0% 64.0B ± 0% +33.33% (p=0.008 n=5+5) name old allocs/op new allocs/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00 0.00 ~ (all equal) Decode/tcp6-8 0.00 0.00 ~ (all equal) Decode/udp4-8 0.00 0.00 ~ (all equal) Decode/udp6-8 0.00 0.00 ~ (all equal) Decode/icmp4-8 0.00 0.00 ~ (all equal) Decode/icmp6-8 0.00 0.00 ~ (all equal) Decode/igmp-8 0.00 0.00 ~ (all equal) Decode/unknown-8 0.00 0.00 ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp4_in-8 0.00 0.00 ~ (all equal) Filter/udp4_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Filter/icmp6-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp6_in-8 0.00 0.00 ~ (all equal) Filter/udp6_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	d0baece5fa	go.mod: bump inet.af/netaddr to non-allocating version	4 years ago
Brad Fitzpatrick	ef15096a7d	control/controlclient, version/distro: detect NixOS explicitly ... The fallthrough happened to work in controlclient already due to the /etc/os-release PRETTY_NAME default, but make it explicit so it doesn't look like an accident. Also add it to version/distro, even though nothing needs it yet.	4 years ago
David Crawshaw	2b2a16d9a2	wgengine/router/dns: reduce windows registry key open timeout ... The windows key timeout is longer than the wgengine watchdog timeout, which means we never reach the timeout, instead the process exits. Reduce the timeout so if we do hit it, at least the process continues. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
David Crawshaw	b4f70d8232	wgengine/router/dns: use the correct interface GUID ... On Win10, there's a hardcoded GUID and this works. On Win7, this GUID changes and we need to ask the tun for its LUID and convert that from the GUID. This commit uses the computed GUID that is placed in InterfaceName. Diagnosed by Jason Donnenfeld. (Thanks!)	4 years ago
Brad Fitzpatrick	15c064f76f	wgengine/router/dns: remove unsafe endianness detection on Linux	4 years ago
Brad Fitzpatrick	f9659323df	wgengine/router/dns: fix typo in comment	4 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints ... Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	57dd247376	cmd/tailscaled, logpolicy, logtail: support log levels ... Log levels can now be specified with "[v1] " or "[v2] " substrings that are then stripped and filtered at the final logger. This follows our existing "[unexpected]" etc convention and doesn't require a wholesale reworking of our logging at the moment. cmd/tailscaled then gets a new --verbose=N flag to take a log level that controls what gets logged to stderr (and thus systemd, syslog, etc). Logtail is unaffected by --verbose. This commit doesn't add annotations to any existing log prints. That is in the next commit. Updates #924 Updates #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d97ee12179	logtail, logpolicy: remove an unidiomatic use of an interface	4 years ago
Brad Fitzpatrick	83f45ae2dd	version: bump date	4 years ago
Brad Fitzpatrick	c348fb554f	control/controlclient: clarify a comment	4 years ago
Brad Fitzpatrick	90c8519765	go.sum: update	4 years ago
David Anderson	ca676ea645	tailcfg: introduce map version 8, for clients that support v6 node config. ... For now, the server will only send v6 configuration to mapversion 8 clients as part of an early-adopter program, while we verify that the functionality is robust. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	03a039d48d	go.mod: bump wireguard-go version. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f5e33ad761	go.mod: update inet.af/netaddr, go mod tidy. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	89be4037bb	control/controlclient: report broken routing for v4 and v6. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	baa7937998	net/interfaces: return IPv6 addresses from LocalAddresses. ... In practice, we already provide IPv6 endpoint addresses via netcheck, and that address is likely to match a local address anyway (i.e. no NAT66). The comment at that piece of the code mentions needing to figure out a good priority ordering, but that only applies to non-active-discovery clients, who already don't do anything with IPv6 addresses. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	294ceb513c	ipn, wgengine/magicsock: fix `tailscale status` display. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	891110e64c	wgengine: expand lazy config to work with dual-stacked peers. ... Lazy wg configuration now triggers if a peer has only endpoint addresses (/32 for IPv4, /128 for IPv6). Subnet routers still trigger eager configuration to avoid the need for a CIDR match in the hot packet path. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	aa353b8d0f	net/packet: add an IP6 constructor from a raw byte array. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Smitty	f0b0a62873	Clarify that raw format strings are intentional ... This caused some confusion in issue #460, since usually raw format strings aren't printed directly. Hopefully by directly logging that they are intended to be raw format strings, this will be more clear. Rate limited format strings now look like: [RATE LIMITED] format string "control: sendStatus: %s: %v" Closes #460. Signed-off-by: Smitty <me@smitop.com>	4 years ago
David Anderson	c8c493f3d9	wgengine/magicsock: make ReceiveIPv4 a little easier to follow. ... The previous code used a lot of whole-function variables and shared behavior that only triggered based on prior action from a single codepath. Instead of that, move the small amounts of "shared" code into each switch case. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0ad109f63d	wgengine/magicsock: move legacy endpoint creation into legacy.go. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f873da5b16	wgengine/magicsock: move more legacy endpoint handling. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	58fcd103c4	wgengine/magicsock: move legacy sending code to legacy.go. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	65ae66260f	wgengine/magicsock: unexport AddrSet. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c9b9afd761	wgengine/magicsock: move most legacy nat traversal bits to another file. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	5f07da4854	util/systemd: don't log warnings when not running under systemd ... It caused our integration tests to fail, which prohibit logging to os.Stderr for test cleanliness reasons.	4 years ago
Brad Fitzpatrick	741c513e51	wgengine/tsdns: fix error response marshaling, improve bad query logs ... Updates #995 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	554a20becb	wgengine/magicsock: only log about lazy config when actually doing lazy config. ... Before, tailscaled would log every 10 seconds when the periodic noteRecvActivity call happens. This is noisy, but worse it's misleading, because the message suggests that the disco code is starting a lazy config run for a missing peer, whereas in fact it's just an internal piece of keepalive logic. With this change, we still log when going from 0->1 tunnel for the peer, but not every 10s thereafter. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	da1bad51cd	tailcfg: document new OmitPeers endpoint updating functionality	4 years ago
Brad Fitzpatrick	fa412c8760	wgengine/filter, wgengine/magicsock: use new IP.BitLen to simplify some code	4 years ago
Brad Fitzpatrick	afcf134812	wgengine/filter, tailcfg: support CIDRs+ranges in PacketFilter (mapver 7) ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	0681c6da49	Merge pull request #967 from Xe/report-status-systemd ... ipn/ipnserver: enable systemd-notify support	4 years ago
Christine Dodrill	2485faf69a	Merge branch 'main' into report-status-systemd	4 years ago
Christine Dodrill	7ea809897d	ipn/ipnserver: enable systemd-notify support ... Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>	4 years ago
David Anderson	9cee0bfa8c	wgengine/magicsock: sprinkle more docstrings. ... Magicsock is too damn big, but this might help me page it back in faster next time. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	34a0292433	depaware.txt: update ... Upgrading staticcheck upgraded golang.org/x/sync (one downside of mixing our tools in with our regular go.mod), which introduced a new dependency via https://go-review.googlesource.com/c/sync/+/251677 That CL could and probably should be written without runtime/debug, but it's not clear to me that that is better at this moment than simply accepting the additional package as a dependency. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	ce4d68b416	go.mod: upgrade depaware version ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago