409 Commits (72d2122cad6c48655a2ba97f478abf23de5622fe)

Author	SHA1	Message	Date
Brad Fitzpatrick	121d1d002c	tailcfg: add nodeAttrs for forcing OneCGNAT on/off [capver 71] ... Updates #8923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	25663b1307	tailcfg: remove most Debug fields, move bulk to nodeAttrs [capver 70] ... Now a nodeAttr: ForceBackgroundSTUN, DERPRoute, TrimWGConfig, DisableSubnetsIfPAC, DisableUPnP. Kept support for, but also now a NodeAttr: RandomizeClientPort. Removed: SetForceBackgroundSTUN, SetRandomizeClientPort (both never used, sadly... never got around to them. But nodeAttrs are better anyway), EnableSilentDisco (will be a nodeAttr later when that effort resumes). Updates #8923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	239ad57446	tailcfg: move LogHeapPprof from Debug to c2n [capver 69] ... And delete Debug.GoroutineDumpURL, which was already in c2n. Updates #8923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	1fcae42055	control/controlclient: move lastUpdateGenInformed to tighter scope ... No need to have it on Auto or be behind a mutex; it's only read/written from a single goroutine. Move it there. Updates tailscale/corp#5761 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	2398993804	control/controlclient: refactor in prep for optimized delta handling ... See issue. This is a baby step towards passing through deltas end-to-end from node to control back to node and down to the various engine subsystems, not computing diffs from two full netmaps at various levels. This will then let us support larger netmaps without burning CPU. But this change itself changes no behavior. It just changes a func type to an interface with one method. That paves the way for future changes to then add new NetmapUpdater methods that do more fine-grained work than updating the whole world. Updates #1909 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
M. J. Fromberger	9e24a6508a	control/controlclient: avert a data race when logging (#8863) ... The read of the synced field for logging takes place outside the lock, and races with other (locked) writes of this field, including for example the one at current line 556 in mapRoutine. Updates tailscale/corp#13856 Change-Id: I056b36d7a93025aafdf73528dd7645f10b791af6 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	1 year ago
Maisem Ali	d16946854f	control/controlclient: add Auto.updateRoutine ... Instead of having updates replace the map polls, create a third goroutine which is solely responsible for making sure that control is aware of the latest client state. This also makes it so that the streaming map polls are only broken when there are auth changes, or the client is paused. Updates tailscale/corp#5761 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	734928d3cb	control/controlclient: make Direct own all changes to Persist ... It was being modified in two places in Direct for the auth routine and then in LocalBackend when a new NetMap was received. This was confusing, so make Direct also own changes to Persist when a new NetMap is received. Updates #7726 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	6aaf1d48df	types/persist: drop duplicated Persist.LoginName ... It was duplicated from Persist.UserProfile.LoginName, drop it. Updates #7726 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	17ed2da94d	control/controlclient: use ptr.To ... Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
salman aljammaz	25a7204bb4	wgengine,ipn,cmd/tailscale: add size option to ping (#8739) ... This adds the capability to pad disco ping message payloads to reach a specified size. It also plumbs it through to the tailscale ping -size flag. Disco pings used for actual endpoint discovery do not use this yet. Updates #311. Signed-off-by: salman <salman@tailscale.com> Co-authored-by: Val <valerie@tailscale.com>	1 year ago
Claire Wang	a17c45fd6e	control: use tstime instead of time (#8595) ... Updates #8587 Signed-off-by: Claire Wang <claire@tailscale.com>	1 year ago
Maisem Ali	60e5761d60	control/controlclient: reset backoff in mapRoutine on netmap recv ... We were never resetting the backoff in streaming mapResponses. The call to `PollNetMap` always returns with an error. Changing that contract is harder, so manually reset backoff when a netmap is received. Updates tailscale/corp#12894 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Andrew Dunham	7aba0b0d78	net/netcheck, tailcfg: add DERPHomeParams and use it ... This allows providing additional information to the client about how to select a home DERP region, such as preferring a given DERP region over all others. Updates #8603 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I7c4a270f31d8585112fab5408799ffba5b75266f	1 year ago
Maisem Ali	9d1a3a995c	control/controlclient: use ctx passed down to NoiseClient.getConn ... Without this, the client would just get stuck dialing even if the context was canceled. Updates tailscale/corp#12590 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	7c1068b7ac	util/goroutines: let ScrubbedGoroutineDump get only current stack ... ScrubbedGoroutineDump previously only returned the stacks of all goroutines. I also want to be able to use this for only the current goroutine's stack. Add a bool param to support both ways. Updates tailscale/corp#5149 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Andrew Dunham	42fd964090	control/controlclient: use dnscache.Resolver for Noise client ... This passes the *dnscache.Resolver down from the Direct client into the Noise client and from there into the controlhttp client. This retains the Resolver so that it can share state across calls instead of creating a new resolver. Updates #4845 Updates #6110 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia5d6af1870f3b5b5d7dd5685d775dcf300aec7af	2 years ago
Mihai Parparita	7330aa593e	all: avoid repeated default interface lookups ... On some platforms (notably macOS and iOS) we look up the default interface to bind outgoing connections to. This is both duplicated work and results in logspam when the default interface is not available (i.e. when a phone has no connectivity, we log an error and thus cause more things that we will try to upload and fail). Fixed by passing around a netmon.Monitor to more places, so that we can use its cached interface state. Fixes #7850 Updates #7621 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	4722f7e322	all: move network monitoring from wgengine/monitor to net/netmon ... We're using it in more and more places, and it's not really specific to our use of Wireguard (and does more just link/interface monitoring). Also removes the separate interface we had for it in sockstats -- it's a small enough package (we already pull in all of its dependencies via other paths) that it's not worth the extra complexity. Updates #7621 Updates #7850 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	9a655a1d58	net/dnsfallback: more explicitly pass through logf function ... Redoes the approach from #5550 and #7539 to explicitly pass in the logf function, instead of having global state that can be overridden. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	edb02b63f8	net/sockstats: pass in logger to sockstats.WithSockStats ... Using log.Printf may end up being printed out to the console, which is not desirable. I noticed this when I was investigating some client logs with `sockstats: trace "NetcheckClient" was overwritten by another`. That turns to be harmless/expected (the netcheck client will fall back to the DERP client in some cases, which does its own sockstats trace). However, the log output could be visible to users if running the `tailscale netcheck` CLI command, which would be needlessly confusing. Updates tailscale/corp#9230 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Kurnia D Win	9526858b1e	control/controlclient: fix accidental backoff reset ... Signed-off-by: Kurnia D Win <kurnia.d.win@gmail.com>	2 years ago
Andrew Dunham	83fa17d26c	various: pass logger.Logf through to more places ... Updates #7537 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id89acab70ea678c8c7ff0f44792d54c7223337c6	2 years ago
Maisem Ali	be027a9899	control/controlclient: improve handling of concurrent lite map requests ... This reverts commit 6eca47b16c and fixes forward. Previously the first ever streaming MapRequest that a client sent would also set ReadOnly to true as it didn't have any endpoints and expected/relied on the map poll to restart as soon as it got endpoints. However with 48f6c1eba4, we would no longer restart MapRequests as frequently as we used to, so control would only ever get the first streaming MapRequest which had ReadOnly=true. Control would treat this as an uninteresting request and would not send it any further netmaps, while the client would happily stay in the map poll forever while litemap updates happened in parallel. This makes it so that we never set `ReadOnly=true` when we are doing a streaming MapRequest. This is no longer necessary either as most endpoint discovery happens over disco anyway. Co-authored-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	ce99474317	all: implement preauth-key support with tailnet lock ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	6eca47b16c	Revert "control/controlclient: improve handling of concurrent lite map requests" ... This reverts commit 48f6c1eba4. It unfortunately breaks mapresponse wakeups. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	48f6c1eba4	control/controlclient: improve handling of concurrent lite map requests ... Prior to this change, if we were in the middle of a lite map update we'd tear down the entire map session and restart it. With this change, we'll cancel an in-flight lite map request up to 10 times and restart before we tear down the streaming map request. We tear down everything after 10 retries to ensure that a steady stream of calls to sendNewMapRequest doesn't fail to make progress by repeatedly canceling and restarting. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Co-authored-by: Maisem Ali <maisem@tailscale.com> Change-Id: I9392bf8cf674e7a58ccd1e476039300a359ef3b1	2 years ago
Mihai Parparita	6ac6ddbb47	sockstats: switch label to enum ... Makes it cheaper/simpler to persist values, and encourages reuse of labels as opposed to generating an arbitrary number. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	1a30b2d73f	all: use tstest.Replace more ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	9cb332f0e2	sockstats: instrument networking code paths ... Uses the hooks added by tailscale/go#45 to instrument the reads and writes on the major code paths that do network I/O in the client. The convention is to use "<package>.<type>:<label>" as the annotation for the responsible code path. Enabled on iOS, macOS and Android only, since mobile platforms are the ones we're most interested in, and we are less sensitive to any throughput degradation due to the per-I/O callback overhead (macOS is also enabled for ease of testing during development). For now just exposed as counters on a /v0/sockstats PeerAPI endpoint. We also keep track of the current interface so that we can break out the stats by interface. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Will Norris	71029cea2d	all: update copyright and license headers ... This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Brad Fitzpatrick	6edf357b96	all: start groundwork for using capver for localapi & peerapi ... Updates #7015 Change-Id: I3d4c11b42a727a62eaac3262a879f29bb4ce82dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	3a018e51bb	ipn/ipnlocal: move handling of expired nodes to LocalBackend ... In order to be able to synthesize a new NetMap when a node expires, have LocalBackend start a timer when receiving a new NetMap that fires slightly after the next node expires. Additionally, move the logic that updates expired nodes into LocalBackend so it runs on every netmap (whether received from controlclient or self-triggered). Updates #6932 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I833390e16ad188983eac29eb34cc7574f555f2f3	2 years ago
Andrew Dunham	1e67947cfa	control/controlclient, tailcfg: add Node.Expired field, set for expired nodes ... Nodes that are expired, taking into account the time delta calculated from MapResponse.ControlTime have the newly-added Expired boolean set. For additional defense-in-depth, also replicate what control does and clear the Endpoints and DERP fields, and additionally set the node key to a bogus value. Updates #6932 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia2bd6b56064416feee28aef5699ca7090940662a	2 years ago
Brad Fitzpatrick	eafbf8886d	ipn/localapi: add localapi debug endpoints for packet filter/matches ... For debugging #6423. This is easier than TS_DEBUG_MAP, as this means I can pipe things into jq, etc. Updates #6423 Change-Id: Ib3e7496b2eb3f47d4bed42e9b8045a441424b23c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	197a4f1ae8	types/ptr: move all the ptrTo funcs to one new package's ptr.To ... Change-Id: Ia0b820ffe7aa72897515f19bd415204b6fe743c7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	20b27df4d0	tailcfg, ipn, controlclient: add MapResponse.ClientVersion, plumb to IPN bus ... Updates #6480 Change-Id: I6321071425cd091148d8140d1eb24dd536bb7984 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	513780f4f8	ipn/ipnlocal: move URL validation to LocalBackend ... Updates tailscale/corp#7948 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	97319a1970	control/controlclient: filter PopBrowserURL values to https schemes ... No need for http://, etc. In case a control server sends a bogus value and GUIs don't also validate. Updates tailscale/corp#7948 Change-Id: I0b7dd86aa396bdabd88f0c4fe51831fb2ec4175a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	235309adc4	all: store NL keys per profile ... This moves the NetworkLock key from a dedicated StateKey to be part of the persist.Persist struct. This struct is stored as part for ipn.Prefs and is also the place where we store the NodeKey. It also moves the ChonkDir from "/tka" to "/tka-profile/<profile-id>". The rename was intentional to be able to delete the "/tka" dir if it exists. This means that we will have a unique key per profile, and a unique directory per profile. Note: `tailscale logout` will delete the entire profile, including any keys. It currently does not delete the ChonkDir. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	3f8e185003	health: add Warnable, move ownership of warnable items to callers ... The health package was turning into a rando dumping ground. Make a new Warnable type instead that callers can request an instance of, and then Set it locally in their code without the health package being aware of all the things that are warnable. (For plenty of things the health package will want to know details of how Tailscale works so it can better prioritize/suppress errors, but lots of the warnings are pretty leaf-y and unrelated) This just moves two of the health warnings. Can probably move more later. Change-Id: I51e50e46eb633f4e96ced503d3b18a1891de1452 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	f00a49667d	control/controlclient: make Status.Persist a PersistView ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	4d330bac14	ipn/ipnlocal: add support for multiple user profiles ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	da8def8e13	all: remove old +build tags ... The //go:build syntax was introduced in Go 1.17: https://go.dev/doc/go1.17#build-lines gofmt has kept the +build and go:build lines in sync since then, but enough time has passed. Time to remove them. Done with: perl -i -npe 's,^// \+build.*\n,,' $(git grep -l -F '+build') Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	a413fa4f85	control/controlclient: export NoiseClient ... This allows reusing the NoiseClient in other repos without having to reimplement the earlyPayload logic. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	910db02652	client/tailscale, tsnet, ipn/ipnlocal: prove nodekey ownership over noise ... Fixes #5972 Change-Id: Ic33a93d3613ac5dbf172d6a8a459ca06a7f9e547 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	988c1f0ac7	control/controlclient, tailcfg: add support for EarlyNoise payload before http/2 ... Not yet used, but skipped over, parsed, and tested. Updates #5972 Change-Id: Icd00196959ce266ae16a6c9244bd5e458e2c2947 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	d98305c537	cmd,ipn/ipnlocal,tailcfg: implement TKA disablement ... * Plumb disablement values through some of the internals of TKA enablement. * Transmit the node's TKA hash at the end of sync so the control plane understands each node's head. * Implement /machine/tka/disable RPC to actuate disablement on the control plane. There is a partner PR for the control server I'll send shortly. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	231b88cc51	control/controlclient: add start of noise+http2 upgrade test ... Basic HTTP/2-over-noise client test. To be fleshed out in subsequent commits that add more functionality to the noise client. Updates #5972 Change-Id: I0178343523ef4ae8e8fc87bae53cbc81f4e32fde Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	120bfc97ce	control/controlclient: refactor noiseClient, connections, http2 ... In prep for stateful http2 noise connections. Updates #5972 Change-Id: I9ebecc3b2d5d193621b87d39b506f231d6c82145 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago