tailscale

Commit Graph

Author	SHA1	Message	Date
julianknodt	72a0b5f042	net/dns/resolver: fmt item This has been bothering me for a while, but everytime I run format from the root directory it also formats this file. I didn't want to add it to my other PRs but it's annoying to have to revert it every time. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	10d7c2583c	net/dnsfallback: don't depend on derpmap.Prod Move derpmap.Prod to a static JSON file (go:generate'd) instead, to make its role explicit. And add a TODO about making dnsfallback use an update-over-time DERP map file instead of a baked-in one. Updates #1264 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Christine Dodrill	194d5b8412	tstest/integration/vms: add in-process DERP server (#2108 ) Previously this test would reach out to the public DERP servers in order to help machines connect with eachother. This is not ideal given our plans to run these tests completely disconnected from the internet. This patch introduces an in-process DERP server running on its own randomly assigned HTTP port. Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Christine Dodrill	6b234323a0	tstest/integration/vms: fix flake when testing (#2145 ) Occasionally the test framework would fail with a timeout due to a virtual machine not phoning home in time. This seems to be happen whenever qemu can't bind the VNC or SSH ports for a virtual machine. This was fixed by taking the following actions: 1. Don't listen on VNC unless the `-use-vnc` flag is passed, this removes the need to listen on VNC at all in most cases. The option to use VNC is still left in for debugging virtual machines, but removing this makes it easier to deal with (VNC uses this odd system of "displays" that are mapped to ports above 5900, and qemu doesn't offer a decent way to use a normal port number, so we just disable VNC by default as a compromise). 2. Use a (hopefully) inactive port for SSH. In an ideal world I'd just have the VM's SSH port be exposed via a Unix socket, however the QEMU documentation doesn't really say if you can do this or not. While I do more research, this stopgap will have to make do. 3. Strictly tie more VM resource lifetimes to the tests themselves. Previously the disk image layers for virtual machines were only cleaned up at the end of the test and existed in the parent test-scoped temporary folder. This can make your tmpfs run out of space, which is not ideal. This should minimize the use of temporary storage as much as I know how to. 4. Strictly tie the qemu process lifetime to the lifetime of the test using testing.T#Cleanup. Previously it used a defer statement to clean up the qemu process, however if the tests timed out this defer was not run. This left around an orphaned qemu process that had to be killed manually. This change ensures that all qemu processes exit when their relevant tests finish. Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Brad Fitzpatrick	8a4dffee07	types/logger: fix deadlock RateLimitedFn reentrancy Fix regression from `19c3e6cc9e` which made the locking coarser. Found while debugging #2245, which ended up looking like a tswin/Windows issue where Crawshaw had blocked cmd.exe's output. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Christine Dodrill	59e9b44f53	wgengine/filter: add a debug flag for filter logs (#2241 ) This uses a debug envvar to optionally disable filter logging rate limits by setting the environment variable TS_DEBUG_FILTER_RATE_LIMIT_LOGS to "all", and if it matches, the code will effectively disable the limits on the log rate by setting the limit to 1 millisecond. This should make sure that all filter logs will be captured. Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
David Crawshaw	80b1308974	net/dns: remove ref to managerImpl Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Adrian Dewhurst	bcaae3e074	net/dns/resolver: clamp EDNS size This change (subject to some limitations) looks for the EDNS OPT record in queries and responses, clamping the size field to fit within our DNS receive buffer. If the size field is smaller than the DNS receive buffer then it is left unchanged. I think we will eventually need to transition to fully processing the DNS queries to handle all situations, but this should cover the most common case. Mostly fixes #2066 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
David Anderson	c69d30cdd7	VERSION.txt: this is v1.11.0. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
julianknodt	148602a89a	derp,cmd/derper: allow server to verify clients This adds a flag to the DERP server which specifies to verify clients through a local tailscaled. It is opt-in, so should not affect existing clients, and is mainly intended for users who want to run their own DERP servers. It assumes there is a local tailscaled running and will attempt to hit it for peer status information. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	c45bfd4180	wgengine: make dnsIPsOverTailscale also consider DefaultResolvers Found during a failed experiment debugging something on Android. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7b8ed1fc09	net/netns: add Android implementation, allowing registration of JNI hook Updates #2102 Updates #1809 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b92e2ebd24	wgengine/netstack: add Impl.DialContextUDP Unused so far, but eventually we'll want this for SOCKS5 UDP binds (we currently only do TCP with SOCKS5), and also for #2102 for forwarding MagicDNS upstream to Tailscale IPs over netstack. Updates #2102 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3d777c13b0	net/socks5: fix a typo Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	084d48d22d	net/dns: always proxy through quad-100 on windows 8.1. Windows 8.1 incorrectly handles search paths on an interface with no associated resolver, so we have to provide a full primary DNS config rather than use Windows 8.1's nascent-but-present NRPT functionality. Fixes #2237. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	45e64f2e1a	net/dns{,/resolver}: refactor DNS forwarder, send out of right link on macOS/iOS Fixes #2224 Fixes tailscale/corp#2045 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	597fa3d3c3	tailcfg/derpmap: add flag to omit ts's derps This adds a flag to derp maps which specifies that default Tailscale DERP servers should not be used. If true and there are entries in this map, it indicates that the entries in this map should take precedent and not hit any of tailscale's DERP servers. This change is backwards compatible, as the default behavior should be false. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Julian Knodt	48883272ea	Merge pull request #2227 from tailscale/jknodt/cloner cmd/cloner: support maps with clone ptrs	3 years ago
David Crawshaw	4ce15505cb	wgengine: randomize client port if netmap says to For testing out #2187 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	5f8ffbe166	magicsock: add SetPreferredPort method Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	676e32ad72	syncs: add AtomicUint32 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	733d52827b	net/dns/resolver: skip test on macOS Fixes #2229 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	0f18801716	cmd/cloner: support maps with clone ptrs In order to clone DERPMaps, it was necessary to extend the cloner so that it supports nested pointers inside of maps which are also cloneable. This also adds cloning for DERPRegions and DERPNodes because they are on DERPMap's maps. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
David Crawshaw	ece138ffc3	staticcheck.conf: remove unnecessary warning Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	bb363095a5	tailcfg: add Debug.RandomizeClientPort Not yet used. Updates #2187 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	38be964c2b	go.mod: update netstack Fixes a atomic alignment crash on 32-bit machines. Fixes #2129 Fixes tailscale/tailscale-synology#66 (same) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a0c632f6b5	tstest/integration: fix a race Noticed on a CI failure. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	ad288baaea	net/interfaces: use IPv4 link local if nothing better The only connectivity an AWS Lambda container has is an IPv4 link-local 169.254.x.x address using NAT: 12: vtarget_1@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 7e:1c:3f:00:00:00 brd ff:ff:ff:ff:ff:ff link-netnsid 1 inet 169.254.79.1/32 scope global vtarget_1 valid_lft forever preferred_lft forever If there are no other IPv4/v6 addresses available, and we are running in AWS Lambda, allow IPv4 169.254.x.x addresses to be used. ---- Similarly, a Google Cloud Run container's only connectivity is a Unique Local Address fddf:3978:feb1:d745::c001/128. If there are no other addresses available then allow IPv6 Unique Local Addresses to be used. We actually did this in an earlier release, but now refactor it to work the same way as the IPv4 link-local support is being done. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
julianknodt	3687e5352b	derp: fix traffic handler peer addresses Before it was using the local address and port, so fix that. The fields in the response from `ss` are: State, Recv-Q, Send-Q, Local Address:Port, Peer Address:Port, Process Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
David Crawshaw	297b3d6fa4	staticcheck.conf: turn off noisy lint errors Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
julianknodt	3728634af9	derp: add debug traffic handler This adds a handler on the DERP server for logging bytes send and received by clients of the server, by holding open a connection and recording if there is a difference between the number of bytes sent and received. It sends a JSON marshalled object if there is an increase in the number of bytes. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	2f4817fe20	tstest/integration: fix race flake Fixes #2172 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1ae35b6c59	net/{interfaces,netcheck}: rename some fields, funcs Split out of Denton's #2164, to make that diff smaller to review. This change has no behavior changes. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	03311bb0d6	hostinfo: add hostinfo package, move stuff out of controlclient And make it cheaper, so other parts of the code can check the environment. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	0022c3d2e2	tsweb: replace NewMux with a more flexible DebugHandler. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	b461ba9554	control/controlclient: fix typo/braino in error message Thanks to @normanr for noticing. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0debb99f08	tailcfg: add DNSConfig.ExtraRecords Updates #1748 Updates #1235 Updates #2055 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Christine Dodrill	e0f0d10672	tstest/integration/vms: log to t.Logf directly (#2147 ) Previously we used t.Logf indirectly via package log. This worked, but it was not ideal for our needs. It could cause the streams of output to get crossed. This change uses a logger.FuncWriter every place log.Output was previously used, which will more correctly write log information to the right test output stream. Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Maisem Ali	f482321f67	ipn/ipnlocal: support exit node local access switching on darwin. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	2919b3e3e6	wf: loopback condition should use MatchTypeFlagsAllSet. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Anderson	48c25fa36f	tsweb: fold StdHandlerOpts and StdHandler200s with StdHandler. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	72343fbbec	tsweb: register expvars once at startup. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	9337826011	net/dns: fix inverted test for NetworkManager version. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	320cc8fa21	net/dns: verify that systemd-resolved is actually in charge. It's possible to install a configuration that passes our current checks for systemd-resolved, without actually pointing to systemd-resolved. In that case, we end up programming DNS in resolved, but that config never applies to any name resolution requests on the system. This is quite a far-out edge case, but there's a simple additional check we can do: if the header comment names systemd-resolved, there should be a single nameserver in resolv.conf pointing to 127.0.0.53. If not, the configuration should be treated as an unmanaged resolv.conf. Fixes #2136. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e7164425b3	net/dns: don't use NetworkManager for DNS on very old NetworkManagers. Fixes #1945. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	ac07ff43bf	cmd/tailscaled: start after NetworkManager and systemd-resolved. The dependency is a "soft" ordering dependency only, meaning that tailscaled will start after those services if those services were going to be run anyway, but doesn't force either of them to run. That's why it's safe to specify this dependency unconditionally, even for systems that don't run those services. Updates #2127. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	cd282ec00f	tailcfg: add DNSConfig.CertDomains Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	082cc1b0a7	tstest/integration: reenable TestAddPingRequest Failure understood now; see: https://github.com/tailscale/tailscale/pull/2088#issuecomment-859896598 As of `333e9e75d4`, PingRequest is now safe for the server to send multiple times, without fear of the client handling it multiple times. Fixes #2079 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	333e9e75d4	tailcfg, control/controlclient: clarify more, enforce PingRequest.URL is unique Updates #2079 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	c61d777705	tstest/integration: disable TestAddPingRequest Failing often now, we don't want people to get used to routinely ignoring test failures. Can be re-enabled when https://github.com/tailscale/tailscale/issues/2079 is resolved. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago

1 2 3 4 5 ...

2609 Commits (72a0b5f04204a7b796fbda196d8790f0138274bd) All Branches Search

2609 Commits (72a0b5f04204a7b796fbda196d8790f0138274bd)

All Branches