671 Commits (7325b5a7ba1e2d36ebe59c74e0328d6510da5654)

Author	SHA1	Message	Date
Brad Fitzpatrick	187e22a756	wgengine/magicsock: don't run the DERP cleanup so often ... To save CPU and wakeups, don't run the DERP cleanup timer regularly unless there is a non-home DERP connection open. Also eliminates the goroutine, moving to a time.AfterFunc. Updates #1034 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	5fe5402fcd	Revert "wgengine/magicsock: shortcircuit discoEndpoint.heartbeat when its connection is closed" ... This reverts commit 08baa17d9a. It caused deadlocks due to lock ordering violations. It was not the right fix, and thus should simply be reverted while we look for the right fix (if we haven't already found it in the interim; we've fixed other logging-after-test issues). Fixes #1161	3 years ago
Josh Bleecher Snyder	e4c075cd95	wgengine/magicsock: prevent log-after-test in TestTwoDevicePing	3 years ago
Brad Fitzpatrick	edce91a8a6	wgengine/magicsock: fix a naked return bug/crash where we returned (nil, true) ... The 'ok' from 'ipp, ok :=' above was the result parameter ok. Whoops.	3 years ago
Brad Fitzpatrick	51bd1feae4	wgengine/magicsock: add single element IPPort->endpoint cache in receive path ... name old time/op new time/op delta ReceiveFrom-4 21.8µs ± 2% 20.9µs ± 2% -4.27% (p=0.000 n=10+10) Updates #414 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5c619882bc	wgengine/magicsock: simplify ReceiveIPv4+DERP path ... name old time/op new time/op delta ReceiveFrom-4 35.8µs ± 3% 21.9µs ± 5% -38.92% (p=0.008 n=5+5) Fixes #1145 Updates #414 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	9936cffc1a	wgengine: correctly track all node IPs in lazy config. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	3fa86a8b23	wgengine/magicsock: use relatively new netaddr.IPPort.IsZero method	3 years ago
Brad Fitzpatrick	4811236189	wgengine/magicsock: speed up BenchmarkReceiveFrom, store context.Done chan ... context.cancelCtx.Done involves a mutex and isn't as cheap as I previously assumed. Convert the donec method into a struct field and store the channel value once. Our one magicsock.Conn gets one pointer larger, but it cuts ~1% of the CPU time of the ReceiveFrom benchmark and removes a bubble from the --svg output :)	3 years ago
Denton Gentry	8578b0445d	tstun: add test to send a packet after Close() ... This test serves two purposes: + check that Write() returns an error if the tstun has been closed. + ensure that the close-related code in tstun is exercised in a test case. We were getting spurious code coverage adds/drops based on timing of when the test case finished. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Josh Bleecher Snyder	ed2169ae99	wgengine/magicsock: prevent logging after TestActiveDiscovery completes	4 years ago
Josh Bleecher Snyder	63af950d8c	wgengine/magicsock: adapt to wireguard-go without UpdateDst ... 22507adf54 stopped relying on our fork of wireguard-go's UpdateDst callback. As a result, we can unwind that code, and the extra return value of ReceiveIPv{4,6}. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Denton Gentry	23c2dc2165	magicksock: remove TestConnClosing. (#1140) ... Test is flakey, remove it and figure out what to do differently later. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
David Anderson	e23b4191c4	wgengine/magicsock: disable legacy networking everywhere except TwoDevicePing. ... TwoDevicePing is explicitly testing the behavior of the legacy codepath, everything else is happy to assume that code no longer exists. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0733c5d2e0	wgengine/magicsock: disable legacy behavior in a few more tests. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	57d95dd005	wgengine/magicsock: default legacy networking to off for some tests. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	a2463e8948	wgengine/magicsock: add an option to disable legacy peer handling. ... Used in tests to ensure we're not relying on behavior we're going to remove eventually. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d456bfdc6d	wgengine/magicsock: fix BenchmarkReceiveFrom. ... Previously, this benchmark relied on behavior of the legacy receive codepath, which I changed in 22507adf. With this change, the benchmark instead relies on the new active discovery path. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	2d837f79dc	wgengine/magicsock: close test loggers once we're done with them ... This is a big hammer approach to helping with #1132. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	08baa17d9a	wgengine/magicsock: shortcircuit discoEndpoint.heartbeat when its connection is closed ... This prevents us from continuing to do unnecessary work (including logging) after the connection has closed. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	7c76435bf7	wgengine/magicsock: simplify ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	d2529affa2	wgengine/magicsock: quiet wireguard-go logging in tests ... We already do this in newUserspaceEngineAdvanced. Apply it to newMagicStack as well. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	3ad7c2133a	wgengine/userspace: make wireguard-go log silencing include peer routines ... Also suppress log lines like: peer(Kksd…ySmc) - Routine: sequential sender - stopped Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	b560386c1a	net/packet, wgengine, tstun: add inter-node TSMP protocol for connect errors ... This adds a new IP Protocol type, TSMP on protocol number 99 for sending inter-tailscale messages over WireGuard, currently just for why a peer rejects TCP SYNs (ACL rejection, shields up, and in the future: nothing listening, something listening on that port but wrong interface, etc) Updates #1094 Updates tailscale/corp#1185 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	420c7a35e2	wgengine/netstack: use tailscale IPs instead of a hardcoded one (#1131) ... Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	a4b39022e0	wgengine/tsdns: fix MagicDNS lookups of shared nodes ... Fixes tailscale/corp#1184	4 years ago
Alex Brainman	6e4231c03c	wgengine/router/dns: remove unused code ... Commit 68ddf1 removed code that reads `SOFTWARE\Tailscale IPN\SearchList` registry value. But the commit left code that writes that value. So now this package writes and never reads the value. Remove the code to stop pointless work. Updates #853 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	4 years ago
Josh Bleecher Snyder	654b5f1570	all: convert from []wgcfg.Endpoint to string ... This eliminates a dependency on wgcfg.Endpoint, as part of the effort to eliminate our wireguard-go fork. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	9abcb18061	wgengine/magicsock: import more of wireguard-go, update docstrings. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	22507adf54	wgengine/magicsock: stop depending on UpdateDst in legacy codepaths. ... This makes connectivity between ancient and new tailscale nodes slightly worse in some cases, but only in cases where the ancient version would likely have failed to get connectivity anyway. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	020084e84d	wgengine: adapt to removal of wgcfg.Key in wireguard-go	4 years ago
Smitty	b2a08ddacd	wgengine/tsdns: return NOERROR instead of NOTIMP for most records ... This is what every other DNS resolver I could find does, so tsdns should do it to. This also helps avoid weird error messages about non-existent records being unimplemented, and thus fixes #848. Signed-off-by: Smitty <me@smitop.com>	4 years ago
Denton Gentry	8349e10907	magicsock: add description of testClosingContext ... Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Denton Gentry	2e9728023b	magicsock: test error case in sendDiscoMessage ... In sendDiscoMessage there is a check of whether the connection is closed, which is not being reliably exercised by other tests. This shows up in code coverage reports, the lines of code in sendDiscoMessage are alternately added and subtracted from code coverage. Add a test to specifically exercise and verify this code path. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Denton Gentry	0aa55bffce	magicsock: test error case in derpWriteChanOfAddr ... In derpWriteChanOfAddr when we call derphttp.NewRegionClient(), there is a check of whether the connection is already errored and if so it returns before grabbing the lock. The lock might already be held and would be a deadlock. This corner case is not being reliably exercised by other tests. This shows up in code coverage reports, the lines of code in derpWriteChanOfAddr are alternately added and subtracted from code coverage. Add a test to specifically exercise this code path, and verify that it doesn't deadlock. This is the best tradeoff I could come up with: + the moment code calls Err() to check if there is an error, we grab the lock to make sure it would deadlock if it tries to grab the lock itself. + if a new call to Err() is added in this code path, only the first one will be covered and the rest will not be tested. + this test doesn't verify whether code is checking for Err() in the right place, which ideally I guess it would. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Brad Fitzpatrick	85e54af0d7	wgengine: on TCP connect fail/timeout, log some clues about why it failed ... So users can see why things aren't working. A start. More diagnostics coming. Updates #1094	4 years ago
Brad Fitzpatrick	5eeaea9ef9	net/packet: add TCPFlag type and some more constants ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f85769b1ed	wgengine/magicsock: drop netaddr.IPPort cache ... netaddr.IP no longer allocates, so don't need a cache or all its associated code/complexity. This totally removes groupcache/lru from the deps. Also go mod tidy.	4 years ago
Brad Fitzpatrick	4d15e954bd	net/flowtrack: add new package to specialize groupcache/lru key type ... Reduces allocs. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	f69e46175d	wengine/netstack: bump gvisor to latest version ... * wengine/netstack: bump gvisor to latest version Signed-off-by: Naman Sood <naman@tailscale.com> * update dependencies Signed-off-by: Naman Sood <naman@tailscale.com> * Don't change hardcoded IP Signed-off-by: Naman Sood <naman@tailscale.com>	4 years ago
Brad Fitzpatrick	8b0112649a	wgengine/netstack: don't build netstack on 32-bit platforms ... See google/gvisor#5241	4 years ago
Brad Fitzpatrick	5aa5db89d6	cmd/tailscaled, wgengine/netstack: add start of gvisor userspace netstack work ... Not usefully functional yet (mostly a proof of concept), but getting it submitted for some work @namansood is going to do atop this. Updates #707 Updates #634 Updates #48 Updates #835	4 years ago
Brad Fitzpatrick	5efb0a8bca	cmd/tailscale: change formatting of "tailscale status" ... * show DNS name over hostname, removing domain's common MagicDNS suffix. only show hostname if there's no DNS name. but still show shared devices' MagicDNS FQDN. * remove nerdy low-level details by default: endpoints, DERP relay, public key. They're available in JSON mode still for those who need them. * only show endpoint or DERP relay when it's active with the goal of making debugging easier. (so it's easier for users to understand what's happening) The asterisks are gone. * remove Tx/Rx numbers by default for idle peers; only show them when there's traffic. * include peers' owner login names * add CLI option to not show peers (matching --self=true, --peers= also defaults to true) * sort by DNS/host name, not public key * reorder columns	4 years ago
Brad Fitzpatrick	b5b9866ba2	wgengine/magicsock: copy self DNS name to PeerStatus, re-fill OS ... The OS used to be sent back from the server but that has since been removed as being redundant.	4 years ago
Josh Bleecher Snyder	1271e135cd	wgengine/tstun: initialize wireguard-go TUN parameters ... This will enable us to remove the corresponding code from our fork of wireguard-go. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1e4604f60e	wgengine: quiet some wireguard-go logging ... The log lines that wireguard-go prints as it starts and stops its worker routines are mostly noise. They also happen after other work is completed, which causes failures in some of the log testing packages. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	e0c4ffa71f	wgengine/tsdns: respond with any available addrs for ALL queries ... This appears to have been the intent of the previous code, but in practice, it only returned A records. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Denton Gentry	df64b7abf8	Add IPv6 Reverse DNS Lookup test. ... To be honest I'm not fond of Golden Bytes tests like this, but not so much as to want to rewrite the whole test. The DNS byte format is essentially immutable at this point, the encoded bytes aren't going to change. The rest of the test assumptions about hostnames might, but we can fix that when it comes. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Alex Brainman	9985b3f1ed	wgengine/monitor: close closeHandle ... eccc167 introduced closeHandle which opened the handle, but never closed it. Windows handles should be closed. Updates #921 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	4 years ago
Brad Fitzpatrick	e8ae355bb8	ipn: delete domainsForProxying, require explicit DNS search domains (mapver 9) (#1078) ... Previously the client had heuristics to calculate which DNS search domains to set, based on the peers' names. Unfortunately that prevented us from doing some things we wanted to do server-side related to node sharing. So, bump MapRequest.Version to 9 to signal that the client only uses the explicitly configured DNS search domains and doesn't augment it with its own list. Updates tailscale/corp#1026 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	86fe22a1b1	Update netaddr, and adjust wgengine/magicsock due to API change. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package ... This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	0d94fe5f69	wgengine/router: disable IPv6 on Linux if ip rule -6 fails (#1074) ... Updates #562 Fixes #973 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Matt Layher	bfbd6b9241	go.mod: bump github.com/mdlayher/netlink to v1.2.0 ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Brad Fitzpatrick	80c94168ae	wgengine: finish updating isTrimmablePeer ... I accidentally merged Dave's change with the XXXX DO NOT SUBMIT comment in it.	4 years ago
David Anderson	cb96b14bf4	net/packet: remove the custom IP4/IP6 types in favor of netaddr.IP. ... Upstream netaddr has a change that makes it alloc-free, so it's safe to use in hot codepaths. This gets rid of one of the many IP types in our codebase. Performance is currently worse across the board. This is likely due in part to netaddr.IP being a larger value type (4b -> 24b for IPv4, 16b -> 24b for IPv6), and in other part due to missing low-hanging fruit optimizations in netaddr. However, the regression is less bad than it looks at first glance, because we'd micro-optimized packet.IP* in the past few weeks. This change drops us back to roughly where we were at the 1.2 release, but with the benefit of a significant code and architectural simplification. name old time/op new time/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 12.2ns ± 5% 29.7ns ± 2% +142.32% (p=0.008 n=5+5) Decode/tcp6-8 12.6ns ± 3% 65.1ns ± 2% +418.47% (p=0.008 n=5+5) Decode/udp4-8 11.8ns ± 3% 30.5ns ± 2% +157.94% (p=0.008 n=5+5) Decode/udp6-8 27.1ns ± 1% 65.7ns ± 2% +142.36% (p=0.016 n=4+5) Decode/icmp4-8 24.6ns ± 2% 30.5ns ± 2% +23.65% (p=0.016 n=4+5) Decode/icmp6-8 22.9ns ±51% 65.5ns ± 2% +186.19% (p=0.008 n=5+5) Decode/igmp-8 18.1ns ±44% 30.2ns ± 1% +66.89% (p=0.008 n=5+5) Decode/unknown-8 20.8ns ± 1% 10.6ns ± 9% -49.11% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 30.5ns ± 1% 77.9ns ± 3% +155.01% (p=0.008 n=5+5) Filter/tcp4_syn_in-8 43.7ns ± 3% 123.0ns ± 3% +181.72% (p=0.008 n=5+5) Filter/tcp4_syn_out-8 24.5ns ± 2% 45.7ns ± 6% +86.22% (p=0.008 n=5+5) Filter/udp4_in-8 64.8ns ± 1% 210.0ns ± 2% +223.87% (p=0.008 n=5+5) Filter/udp4_out-8 119ns ± 0% 278ns ± 0% +133.78% (p=0.016 n=4+5) Filter/icmp6-8 40.3ns ± 2% 204.4ns ± 4% +407.70% (p=0.008 n=5+5) Filter/tcp6_syn_in-8 35.3ns ± 3% 199.2ns ± 2% +464.95% (p=0.008 n=5+5) Filter/tcp6_syn_out-8 32.8ns ± 2% 81.0ns ± 2% +147.10% (p=0.008 n=5+5) Filter/udp6_in-8 106ns ± 2% 290ns ± 2% +174.48% (p=0.008 n=5+5) Filter/udp6_out-8 184ns ± 2% 314ns ± 3% +70.43% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/tstun goos:linux goarch:amd64 Write-8 9.02ns ± 3% 8.92ns ± 1% ~ (p=0.421 n=5+5) name old alloc/op new alloc/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00B 0.00B ~ (all equal) Decode/tcp6-8 0.00B 0.00B ~ (all equal) Decode/udp4-8 0.00B 0.00B ~ (all equal) Decode/udp6-8 0.00B 0.00B ~ (all equal) Decode/icmp4-8 0.00B 0.00B ~ (all equal) Decode/icmp6-8 0.00B 0.00B ~ (all equal) Decode/igmp-8 0.00B 0.00B ~ (all equal) Decode/unknown-8 0.00B 0.00B ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp4_in-8 0.00B 0.00B ~ (all equal) Filter/udp4_out-8 16.0B ± 0% 64.0B ± 0% +300.00% (p=0.008 n=5+5) Filter/icmp6-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp6_in-8 0.00B 0.00B ~ (all equal) Filter/udp6_out-8 48.0B ± 0% 64.0B ± 0% +33.33% (p=0.008 n=5+5) name old allocs/op new allocs/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00 0.00 ~ (all equal) Decode/tcp6-8 0.00 0.00 ~ (all equal) Decode/udp4-8 0.00 0.00 ~ (all equal) Decode/udp6-8 0.00 0.00 ~ (all equal) Decode/icmp4-8 0.00 0.00 ~ (all equal) Decode/icmp6-8 0.00 0.00 ~ (all equal) Decode/igmp-8 0.00 0.00 ~ (all equal) Decode/unknown-8 0.00 0.00 ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp4_in-8 0.00 0.00 ~ (all equal) Filter/udp4_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Filter/icmp6-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp6_in-8 0.00 0.00 ~ (all equal) Filter/udp6_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Crawshaw	2b2a16d9a2	wgengine/router/dns: reduce windows registry key open timeout ... The windows key timeout is longer than the wgengine watchdog timeout, which means we never reach the timeout, instead the process exits. Reduce the timeout so if we do hit it, at least the process continues. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
David Crawshaw	b4f70d8232	wgengine/router/dns: use the correct interface GUID ... On Win10, there's a hardcoded GUID and this works. On Win7, this GUID changes and we need to ask the tun for its LUID and convert that from the GUID. This commit uses the computed GUID that is placed in InterfaceName. Diagnosed by Jason Donnenfeld. (Thanks!)	4 years ago
Brad Fitzpatrick	15c064f76f	wgengine/router/dns: remove unsafe endianness detection on Linux	4 years ago
Brad Fitzpatrick	f9659323df	wgengine/router/dns: fix typo in comment	4 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints ... Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	294ceb513c	ipn, wgengine/magicsock: fix `tailscale status` display. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	891110e64c	wgengine: expand lazy config to work with dual-stacked peers. ... Lazy wg configuration now triggers if a peer has only endpoint addresses (/32 for IPv4, /128 for IPv6). Subnet routers still trigger eager configuration to avoid the need for a CIDR match in the hot packet path. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c8c493f3d9	wgengine/magicsock: make ReceiveIPv4 a little easier to follow. ... The previous code used a lot of whole-function variables and shared behavior that only triggered based on prior action from a single codepath. Instead of that, move the small amounts of "shared" code into each switch case. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0ad109f63d	wgengine/magicsock: move legacy endpoint creation into legacy.go. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f873da5b16	wgengine/magicsock: move more legacy endpoint handling. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	58fcd103c4	wgengine/magicsock: move legacy sending code to legacy.go. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	65ae66260f	wgengine/magicsock: unexport AddrSet. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c9b9afd761	wgengine/magicsock: move most legacy nat traversal bits to another file. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	741c513e51	wgengine/tsdns: fix error response marshaling, improve bad query logs ... Updates #995 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	554a20becb	wgengine/magicsock: only log about lazy config when actually doing lazy config. ... Before, tailscaled would log every 10 seconds when the periodic noteRecvActivity call happens. This is noisy, but worse it's misleading, because the message suggests that the disco code is starting a lazy config run for a missing peer, whereas in fact it's just an internal piece of keepalive logic. With this change, we still log when going from 0->1 tunnel for the peer, but not every 10s thereafter. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	fa412c8760	wgengine/filter, wgengine/magicsock: use new IP.BitLen to simplify some code	4 years ago
Brad Fitzpatrick	afcf134812	wgengine/filter, tailcfg: support CIDRs+ranges in PacketFilter (mapver 7) ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	9cee0bfa8c	wgengine/magicsock: sprinkle more docstrings. ... Magicsock is too damn big, but this might help me page it back in faster next time. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	6db9c4a173	wgenginer/router/dns: use constant from golang.org/x/sys/windows ... Made available in https://golang.org/cl/277153	4 years ago
Aleksandar Pesic	0dc295a640	Isolate WireGuard code into a separate file with appropriate copyright info in header. ... Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Aleksandar Pesic	d854fe95d2	Trivial change in function description. ... Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Aleksandar Pesic	338fd44657	Replace registry-access code, update wireguard-go and x/sys/windows. ... Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Aleksandar Pesic	274d32d0aa	Prepare for the new wireguard-go API. ... Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Brad Fitzpatrick	7b92f8e718	wgengine/magicsock: add start of magicsock benchmarks (Conn.ReceiveIPv4 for now) ... And only single-threaded for now. Will get fancier later. Updates #414	4 years ago
Brad Fitzpatrick	713cbe84c1	wgengine/magicsock: use net.JoinHostPort when host might have colons (udp6) ... Only affected tests. (where it just generated log spam)	4 years ago
David Anderson	be6fe393c5	wgengine: don't try pinging IPv6 addresses in legacy pinger. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	eccc167733	wgengine/monitor: fix memory corruption in Windows implementation ... I used the Windows APIs wrong previously, but it had worked just enough. Updates #921 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d9e2edb5ae	wgengine: reconfigure wireguard peer in two steps when its disco key changes ... First remove the device (to clear its wireguard session key), and then add it back. Fixes #929 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	3c508a58cc	wgengine/filter: don't filter GCP DNS. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	fc8bc76e58	wgengine/router: lock goroutine to OS thread before using OLE [windows] ... See https://github.com/tailscale/tailscale/issues/921#issuecomment-727526807 Not yet sure whether this is our problem, but it can't hurt at least, and seems like what we're supposed to do. Updates #921	4 years ago
David Anderson	2eb474dd8d	wgengine/filter: add test cases for len(dsts) > 1. ... While the code was correct, I broke it during a refactoring and tests didn't detect it. This fixes that glitch. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	ce45f4f3ff	wgengine/filter: inline ip6InList into match. ... matchIPsOnly gets 5% slower when inlining, despite significantly reduced memory ops and slightly tighter code. Part of #19. Filter/tcp6_syn_in-8 45.5ns ± 1% 42.4ns ± 2% -6.86% (p=0.000 n=10+10) Filter/udp6_in-8 107ns ± 2% 94ns ± 2% -11.50% (p=0.000 n=9+10) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	3fdae12f0c	wgengine/filter: eliminate unnecessary memory loads. ... Doesn't materially affect benchmarks, but shrinks match6 by 30 instructions and halves memory loads. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	47380ebcfb	wgengine/filter: twiddle bits to optimize ... Part of #19. name old time/op new time/op delta Filter/icmp4-8 32.2ns ± 3% 32.5ns ± 2% ~ (p=0.524 n=10+8) Filter/icmp6-8 49.7ns ± 6% 43.1ns ± 4% -13.12% (p=0.000 n=9+10) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	5062131aad	wgengine/filter: treat * as both a v4 and v6 wildcard. ... Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	2d604b3791	net/packet: represent IP6 as two uint64s. ... For the operations we perform on these types (mostly net6.Contains), this encoding is much faster. Part of #19. name old time/op new time/op delta Filter/icmp4-8 27.5ns ± 1% 28.0ns ± 2% +1.89% (p=0.016 n=5+5) Filter/tcp4_syn_in-8 38.8ns ± 2% 38.3ns ± 1% -1.24% (p=0.024 n=5+5) Filter/tcp4_syn_out-8 27.6ns ±12% 24.6ns ± 1% ~ (p=0.063 n=5+5) Filter/udp4_in-8 71.5ns ± 5% 65.9ns ± 1% -7.94% (p=0.008 n=5+5) Filter/udp4_out-8 132ns ±13% 119ns ± 1% -10.29% (p=0.008 n=5+5) Filter/icmp6-8 169ns ±10% 54ns ± 1% -68.35% (p=0.008 n=5+5) Filter/tcp6_syn_in-8 149ns ± 6% 43ns ± 1% -71.11% (p=0.008 n=5+5) Filter/tcp6_syn_out-8 37.7ns ± 4% 24.3ns ± 3% -35.51% (p=0.008 n=5+5) Filter/udp6_in-8 179ns ± 5% 103ns ± 1% -42.75% (p=0.008 n=5+5) Filter/udp6_out-8 156ns ± 3% 191ns ± 1% +22.54% (p=0.008 n=5+5) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	04ff3c91ee	wgengine/filter: add full IPv6 support. ... Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	a664aac877	wgengine/router: disable IPv6 if v6 policy routing is unavailable. ... Fixes #895. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	19b0cfe89e	all: prepare for GOOS=ios in Go 1.16 ... Work with either way for now on iOS (darwin/arm64 vs ios/arm64). In February when Go 1.16 comes out we'll have a universal binary for darwin/arm64 (macOS) and will drop support for Go 1.15 and its darwin/amd64 meaning iOS. (it'll mean macOS). Context: * https://tip.golang.org/doc/go1.16#darwin * https://github.com/golang/go/issues/38485 * https://github.com/golang/go/issues/42100	4 years ago
David Anderson	c2cc3acbaf	net/packet: remove NewIP, offer only a netaddr constructor. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	55b1221db2	net/packet: support full IPv6 decoding. ... The packet filter still rejects all IPv6, but decodes enough from v6 packets to do something smarter in a followup. name time/op Decode/tcp4-8 28.8ns ± 2% Decode/tcp6-8 20.6ns ± 1% Decode/udp4-8 28.2ns ± 1% Decode/udp6-8 20.0ns ± 6% Decode/icmp4-8 21.7ns ± 2% Decode/icmp6-8 14.1ns ± 2% Decode/unknown-8 9.43ns ± 2% Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	89894c6930	net/packet: add IPv6 source and destination IPs to Parsed. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	450cfedeba	wgengine/magicsock: quiet an IPv6 warning in tests ... In tests, we force binding to localhost to avoid OS firewall warning dialogs. But for IPv6, we were trying (and failing) to bind to 127.0.0.1. You'd think we'd just say "localhost", but that's apparently ill defined. See https://tools.ietf.org/html/draft-ietf-dnsop-let-localhost-be-localhost and golang/go#22826. (It's bitten me in the past, but I can't remember specific bugs.) So use "::1" explicitly for "udp6", which makes the test quieter.	4 years ago
David Anderson	093431f5dd	net/packet: s/ParsedPacket/Parsed/ to avoid package stuttering. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c48253e63b	wgengine/filter: add a method to run the packet filter without a packet. ... The goal is to move some of the shenanigans we have elsewhere into the filter package, so that all the weird things to do with poking at the filter is in a single place, behind clean APIs. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7a54910990	wgengine/filter: remove helper vars, mark NewAllowAll test-only. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	76d99cf01a	wgengine/filter: remove the Matches type. ... It only served to obscure the underlying slice type without adding much value. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b950bd60bf	wgengine/filter: add and clean up documentation. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	a8589636a8	wgengine/filter: remove unused Clone methods. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b3634f020d	wgengine/filter: use netaddr types in public API. ... We still use the packet.* alloc-free types in the data path, but the compilation from netaddr to packet happens within the filter package. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	427bf2134f	net/packet: rename from wgengine/packet. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	19df6a2ee2	wgengine/packet: rename types to reflect their v4-only-ness, document. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	ebd96bf4a9	wgengine/router/dns: use OpenKeyWait to set DNS configuration. ... Fixes tailscale/corp#839. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	119101962c	wgengine/router: don't double-prefix dns log messages [Windows]	4 years ago
Brad Fitzpatrick	28f6552646	wgengine/router/dns: run ipconfig /registerdns async, log timing ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	01ee638cca	Change some os.IsNotExist to errors.Is(err, os.ErrNotExist) for non-os errors. ... os.IsNotExist doesn't unwrap errors. errors.Is does. The ioutil.ReadFile ones happened to be fine but I changed them so we're consistent with the rule: if the error comes from os, you can use os.IsNotExist, but from any other package, use errors.Is. (errors.Is always would also work, but not worth updating all the code) The motivation here was that we were logging about failure to migrate legacy relay node prefs file on startup, even though the code tried to avoid that. See golang/go#41122	4 years ago
David Anderson	68ddf134d7	wgengine/router/dns: issue ipconfig /registerdns when applying DNS settings. ... Amazingly, there doesn't seem to be a documented way of updating network configuration programmatically in a way that Windows takes notice of. The naturopathic remedy for this is to invoke ipconfig /registerdns, which does a variety of harmless things and also invokes the private API that tells windows to notice new adapter settings. This makes our DNS config changes stick within a few seconds of us setting them. If we're invoking a shell command anyway, why futz with the registry at all? Because netsh has no command for changing the DNS suffix list, and its commands for setting resolvers requires parsing its output and keeping track of which server is in what index. Amazingly, twiddling the registry directly is the less painful option. Fixes #853. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	508f5c3ae0	wgengine/router: fix bug where getInterfaceRoutes always returned an empty list ... Regression from f2ce64f0c6 (r43710860) Fixes #870	4 years ago
Brad Fitzpatrick	38bde61b3d	wgengine/router: make Windows firewall configuration async ... Updating the Windows firewall is usually reasonably fast, but sometimes blocks for 20 seconds, 4 minutes, etc. Not sure why. Until we understand that's happening, configure it in the background without blocking the normal control flow. Updates #785 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	fd2a30cd32	wgengine/magicsock: make test pass on Windows and without firewall dialog box ... Updates #50	4 years ago
Brad Fitzpatrick	ac866054c7	wgengine/magicsock: add a backoff on DERP reconnects ... Fixes #808	4 years ago
Brad Fitzpatrick	86c271caba	types/logger: move RusagePrefixLog to logger package, disable by default ... The RusagePrefixLog is rarely useful, hasn't been useful in a long time, is rarely the measurement we need, and is pretty spammy (and syscall-heavy). Disable it by default. We can enable it when we're debugging memory.	4 years ago
David Anderson	ff0cf6340a	wgengine/router: fix configuration of loopback netfilter rules for v6. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	105a820622	wgengine/magicsock: skip an endpoint update at start-up ... At startup the client doesn't yet have the DERP map so can't do STUN queries against DERP servers, so it only knows it local interface addresses, not its STUN-mapped addresses. We were reporting the interface-local addresses to control, getting the DERP map, and then immediately reporting the full set of updates. That was an extra HTTP request to control, but worse: it was an extra broadcast from control out to all the peers in the network. Now, skip the initial update if there are no stun results and we don't have a DERP map. More work remains optimizing start-up requests/map updates, but this is a start. Updates tailscale/corp#557	4 years ago
Brad Fitzpatrick	746f03669c	wgengine: fix lazy wireguard config bug when disco keys change ... There was a bug with the lazy wireguard config code where, if the minimum set of peers to tell wireguard didn't change, we skipped calling userspaceEngine.updateActivityMapsLocked which updated the various data structures that matched incoming traffic to later reconfigure the minimum config. That meant if an idle peer restarted and changed discovery keys, we skipped updating our maps of disco keys/IPs that would caused us to lazily inflate the config for that peer later if/when it did send traffic.	4 years ago
Brad Fitzpatrick	2076a50862	wgengine/magicsock: finish a comment sentence that ended prematurely	4 years ago
Alex Brainman	f2ce64f0c6	wgengine/router: unfork winipcfg-go package, use upstream ... Use golang.zx2c4.com/wireguard/windows/tunnel/winipcfg instead of github.com/tailscale/winipcfg-go package. Updates #760 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	4 years ago
Brad Fitzpatrick	22c462bd91	wgengine/monitor: fix copy/paste-o to actually monitor route changes ... Due to a copy/paste-o, we were monitoring address changes twice, and not monitoring route changes at all. Verified with 'tailscale debug --monitor' that this actually works now (while running 'route add 10.3.0.0 mask 255.255.0.0 10.0.0.1' and 'route delete (same)' back and forth in cmd.exe) In practice route changes are accompanied by address changes and this doesn't fix any known issues. I just noticed this while reading this code again. But at least the code does what it was trying to do now.	4 years ago
Avery Pennarun	0e5f2b90a5	echoRespondToAll: filter.Accept rather than filter.Drop on a match. ... This function is only called in fake mode, which won't do anything more with the packet after we respond to it anyway, so dropping it in the prefilter is not necessary. And it's kinda semantically wrong: we did not reject it, so telling the upper layer that it was rejected produces an ugly error message. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	5041800ac6	wgengine/tstun/faketun: it's a null tunnel, not a loopback. ... At some point faketun got implemented as a loopback (put a packet in from wireguard, the same packet goes back to wireguard) which is not useful. It's supposed to be an interface that just sinks all packets, and then wgengine adds *only* and ICMP Echo responder as a layer on top. This caused extremely odd bugs on darwin, where the special case that reinjects packets from local->local was filling the loopback channel and creating an infinite loop (which became jammed since the reader and writer were in the same goroutine). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Brad Fitzpatrick	3e4c46259d	wgengine/magicsock: don't do netchecks either when network is down ... A continuation of 6ee219a25d Updates #640	4 years ago
Brad Fitzpatrick	6ee219a25d	ipn, wgengine, magicsock, tsdns: be quieter and less aggressive when offline ... If no interfaces are up, calm down and stop spamming so much. It was noticed as especially bad on Windows, but probably was bad everywhere. I just have the best network conditions testing on a Windows VM. Updates #604	4 years ago
Brad Fitzpatrick	587bdc4280	ipn, wgengine: disable subnet routes if network has PAC configuration ... Not configurable yet. Updates tailscale/corp#653 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	c493e5804f	wgengine/router: make v6-ness configurable in test, for consistent results. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	c86761cfd1	Remove tuntap references. We only use TUN.	4 years ago
Brad Fitzpatrick	01098f41d0	wgengine/tstun: fix typo in comment	4 years ago
Brad Fitzpatrick	73cc2d8f89	wgengine/filter: also silently drop link-local unicast traffic ... Updates #629	4 years ago
Brad Fitzpatrick	5f807c389e	wgengine/filter: drop multicast packets out, don't log about them ... Eventually we'll probably support multicast. For now it's just log spam. Fixes #629	4 years ago
Brad Fitzpatrick	bbb56f2303	wgengine/router: fix tests on Debian Buster as regular user on machine with IPv6	4 years ago
David Anderson	fddbcb0c7b	wgengine/router: support various degrees of broken IPv6. ... Gracefully skips touching the v6 NAT table on systems that don't have it, and doesn't configure IPv6 at all if IPv6 is globally disabled. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0d80904fc2	wgengine/router: set up basic IPv6 routing/firewalling. ... Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	f0ef561049	wgengine/tsdns: use netns to obtain a socket ... Fixes #789 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	6e8328cba5	wgengine/tsdns: replace connections when net link changes (macOS) ... When the network link changes, existing UDP sockets fail immediately and permanently on macOS. The forwarder set up a single UDP conn and never changed it. As a result, any time there was a network link change, all forwarded DNS queries failed. To fix this, create a new connection when send requests fail because of network unreachability. This change is darwin-only, although extended it to other platforms should be straightforward. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1fd10061fd	wgengine/tsdns: delegate bonjour service rdns requests ... While we're here, parseQuery into a plain function. This is helpful for fuzzing. (Which I did a bit of. Didn't find anything.) And clean up a few minor things. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	2d0ed99672	wgengine, wgengine/router: add a bunch of (temporary?) engine creation logging ... Trying to debug what's slow on a user's machine. Updates #785	4 years ago
Brad Fitzpatrick	7c11f71ac5	wgengine/router: ignore errors deleting 169.254.255.255/32 route on Windows ... Updates #785	4 years ago
David Anderson	b7e0ff598a	wgengine: don't close tundev in NewUserspaceEngine. ... newUserspaceEngineAdvanced closes the tun device on error already. Fixes #783. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	5d8b88be88	control/controlclient, version/distro, wgengine: recognize OpenWrt ... And help out with missing packages. Thanks to @willangley for tips. Updates #724	4 years ago
Brad Fitzpatrick	3528d28ed1	wgengine/router: move Tailscale's winipcfg additions into wgengine/router ... Part of unforking our winipcfg-go and using upstream (#760), move our additions into our repo. (We might upstream them later if upstream has interest) Originally these were: @apenwarr: "Add ifc.SyncAddresses() and SyncRoutes()." 609dcf2df5 @bradfitz: "winipcfg: make Interface.AddRoutes do as much as possible, return combined error" e9f93d53f3 @bradfitz: "prevent unnecessary Interface.SyncAddresses work; normalize IPNets in deltaNets" decb9ee8e1	4 years ago
Brad Fitzpatrick	fd77268770	wgengine/router: enumerate all interfaces when finding Tailscale adapter by GUID ... Might fix it. I've spent too much time failing to reproduce the issue. This doesn't seem to make it worse, though (it still runs for me), so I'll include this and see if it helps others while I still work on a reliable way to reproduce it. Updates tailscale/corp#474	4 years ago
Brad Fitzpatrick	5bcac4eaac	net/tshttpproxy: add GetProxyForURL negative cache ... Otherwise when PAC server is down, we log, and each log entry is a new HTTP request (from logtail) and a new GetProxyForURL call, which again logs, non-stop. This is also nicer to the WinHTTP service. Then also hook up link change notifications to the cache to reset it if there's a chance the network might work sooner.	4 years ago
Brad Fitzpatrick	64a24e796b	wgengine/tstun: fix 32-bit alignment again	4 years ago
Brad Fitzpatrick	afb2be71de	wgengine: add two missing TUN close calls	4 years ago