374 Commits (777b711d96ee4d8f1358f43632bd20c8fe56398b)

Author	SHA1	Message	Date
julianknodt	777b711d96	net/portmapper: add pcp portmapping ... This adds PCP portmapping, hooking into the existing PMP portmapping. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	5c98b1b8d0	net/portmapper: move pcp code to separate file ... This moves all the PCP code to a separate file in preparation for portmapping with PCP. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Josh Bleecher Snyder	a5da4ed981	all: gofmt with Go 1.17 ... This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	a729070252	net/tstun: add start of Linux TAP support, with DHCP+ARP server ... Still very much a prototype (hard-coded IPs, etc) but should be non-invasive enough to submit at this point and iterate from here. Updates #2589 Co-Author: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fdc081c291	net/portmapper: fix UPnP probing, work against all ports ... Prior to Tailscale 1.12 it detected UPnP on any port. Starting with Tailscale 1.11.x, it stopped detecting UPnP on all ports. Then start plumbing its discovered Location header port number to the code that was assuming port 5000. Fixes #2109 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	260b85458c	net/dns: correct log message. ... Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	54e33b511a	net/dns/resolver: add test that I forgot to git add earlier ... This was meant to be part of 53a2f63658 earlier but I guess I failed at git. Updates #2436 Updates tailscale/corp#2250 Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	be921d1a95	net/dns/resolver: fix skipped DoH test that bitrot ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5a7ff2b231	net/dnsfallback: re-run go generate	3 years ago
Matt Layher	effee49e45	net/interfaces: explicitly check netaddr.IP.Is6 in isUsableV6 ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	3 years ago
Matt Layher	3ff8a55fa7	net/tsaddr: remove IsULA, replace with netaddr.IP.IsPrivate ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	3 years ago
Josh Bleecher Snyder	c2202cc27c	net/tstun: use mono.Time ... There's a call to Now once per packet. Move to mono.Now. Though the current implementation provides high precision, we document it to be coarse, to preserve the ability to switch to a coarse monotonic time later. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	881bb8bcdc	net/dns/resolver: allow an extra alloc for go closure allocation ... Go 1.17 switches to a register ABI on amd64 platforms. Part of that switch is that go and defer calls use an argument-less closure, which allocates. This means that we have an extra alloc in some DNS work. That's unfortunate but not a showstopper, and I don't see a clear path to fixing it. The other performance benefits from the register ABI will all but certainly outweigh this extra alloc. Fixes #2545 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	b6179b9e83	net/dnsfallback: add new nodes ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	f414a9cc01	net/dns/resolver: EDNS OPT record off-by-one ... I don't know how to get access to a real packet. Basing this commit entirely off: +------------+--------------+------------------------------+ | Field Name | Field Type | Description | +------------+--------------+------------------------------+ | NAME | domain name | MUST be 0 (root domain) | | TYPE | u_int16_t | OPT (41) | | CLASS | u_int16_t | requestor's UDP payload size | | TTL | u_int32_t | extended RCODE and flags | | RDLEN | u_int16_t | length of all RDATA | | RDATA | octet stream | {attribute,value} pairs | +------------+--------------+------------------------------+ From https://datatracker.ietf.org/doc/html/rfc6891#section-6.1.2 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Josh Bleecher Snyder	1034b17bc7	net/tstun: buffer outbound channel ... The handoff between tstun.Wrap's Read and poll methods is one of the per-packet hotspots. It shows up in pprof. Making outbound buffered increases throughput. It is hard to measure exactly how much, because the numbers are highly variable, but I'd estimate it at about 1%, using the best observed max throughput across three runs. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	965dccd4fc	net/tstun: buffer outbound channel ... The handoff between tstun.Wrap's Read and poll methods is one of the per-packet hotspots. It shows up in pprof. Making outbound buffered increases throughput. It is hard to measure exactly how much, because the numbers are highly variable, but I'd estimate it at about 1%, using the best observed max throughput across three runs. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	68df379a7d	net/portmapper: rename ErrGatewayNotFound to ErrGatewayRange, reword text ... It confused & scared people. And it was just bad. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	aaf2df7ab1	net/{dnscache,interfaces}: use netaddr.IP.IsPrivate, delete copied code ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c17d743886	net/dnscache: update a comment ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	281d503626	net/dnscache: make Dialer try all resolved IPs ... Tested manually with: $ go test -v ./net/dnscache/ -dial-test=bogusplane.dev.tailscale.com:80 Where bogusplane has three A records, only one of which works. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e299300b48	net/dnscache: cache all IPs per hostname ... Not yet used in the dialer, but plumbed around. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	53a2f63658	net/dns/resolver: race well-known resolvers less aggressively ... Instead of blasting away at all upstream resolvers at the same time, make a timing plan upon reconfiguration and have each upstream have an associated start delay, depending on the overall forwarding config. So now if you have two or four upstream Google or Cloudflare DNS servers (e.g. two IPv4 and two IPv6), we now usually only send a query, not four. This is especially nice on iOS where we start fewer DoH queries and thus fewer HTTP/1 requests (because we still disable HTTP/2 on iOS), fewer sockets, fewer goroutines, and fewer associated HTTP buffers, etc, saving overall memory burstiness. Fixes #2436 Updates tailscale/corp#2250 Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e94ec448a7	net/dns/resolver: add forwardQuery type as race work prep ... Add a place to hang state in a future change for #2436. For now this just simplifies the send signature without any functional change. Updates #2436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	064b916b1a	net/dns/resolver: fix func used as netaddr.IP in printf ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7b295f3d21	net/portmapper: disable UPnP on iOS for now ... Updates #2495 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cecfc14875	net/dns: don't build init*.go on non-windows ... To remove the regexp dep on iOS, notably. Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2968893add	net/dns/resolver: bound DoH usage on iOS ... Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3daf27eaad	net/dns/resolver: fall back to IPv6 for well-known DoH servers if v4 fails ... Should help with IPv6-only environments when the tailnet admin only specified IPv4 DNS IPs. See https://github.com/tailscale/tailscale/issues/2447#issuecomment-884188562 Co-Author: Adrian Dewhurst <adrian@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	74eee4de1c	net/dns/resolver: use correct Cloudflare DoH hostnames ... We were using the wrong ones for the malware & adult content variants. Docs: https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families/setup-instructions/dns-over-https Earlier commit which added them: 236eb4d04d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	3a4201e773	net/portmapper: return correct upnp port ... Previously, this was incorrectly returning the internal port, and using that with the external exposed IP when it did not use WANIPConnection2. In the case when we must provide a port, we return it instead. Noticed this while implementing the integration test for upnp. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	e74d37d30f	net/dns{,/resolver}: quiet DNS output logging ... It was a huge chunk of the overall log output and made debugging difficult. Omit and summarize the spammy *.arpa parts instead. Fixes tailscale/corp#2066 (to which nobody had opinions, so)	3 years ago
Josh Bleecher Snyder	84a6dcd9a9	net/dnsfallback: regenerate ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	171ec9f8f4	control/{controlknobs,controlclient}: simplify knobs API, fix controlclient crash ... From integration tests elsewhere: panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x70 pc=0x845c9b] goroutine 226 [running]: tailscale.com/control/controlclient.(*Direct).sendMapRequest(0xc00053e1e0, 0x16670f0, 0xc000353780, 0xffffffffffffffff, 0xc0003e5f10, 0x0, 0x0) /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/direct.go:803 +0x19bb tailscale.com/control/controlclient.(*Direct).PollNetMap(...) /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/direct.go:574 tailscale.com/control/controlclient.(*Auto).mapRoutine(0xc00052a1e0) /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/auto.go:464 +0x571 created by tailscale.com/control/controlclient.(*Auto).Start /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/auto.go:151 +0x65 exit status 2 Also remove types/opt.Bool API addition which is now unnecessary. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	1bb6abc604	net/portmapper: add upnp port mapping ... Add in UPnP portmapping, using goupnp library in order to get the UPnP client and run the portmapping functions. This rips out anywhere where UPnP used to be in portmapping, and has a flow separate from PMP and PCP. RELNOTE=portmapper now supports UPnP mappings Fixes #682 Updates #2109 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	236eb4d04d	net/dns/resolver: upgrade forwarded MagicDNS queries to DoH when IP known ... Recognize Cloudflare, Google, Quad9 which are by far the majority of upstream DNS servers that people use. RELNOTE=MagicDNS now uses DNS-over-HTTPS when querying popular upstream resolvers, so DNS queries aren't sent in the clear over the Internet. Updates #915 (might fix it?) Updates #988 (gets us closer, if it fixes Android) Updates #74 (not yet configurable, but progress) Updates #2056 (not yet configurable, dup of #74?) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaditya Chaudhary	4f89fe17a2	Implemented Commandline Download Speedtest (#2064) ... Added the net/speedtest package that contains code for starting up a speedtest server and a client. The speedtest command for starting a client takes in a duration for the speedtest as well as the host and port of the speedtest server to connect to. The speedtest command for starting a server takes in a host:port pair to listen on. Signed-off-by: Aaditya Chaudhary <32117362+AadityaChaudhary@users.noreply.github.com>	3 years ago
Denton Gentry	e28bc49e5f	netns_linux: remove special handling for tests. ... With netns handling localhost now, existing tests no longer need special handling. The tests set up their connections to localhost, and the connections work without fuss. Remove the special handling for tests. Also remove the hostinfo.TestCase support, since this was the only use of it. It can be added back later if really needed, but it would be better to try to make tests work without special cases. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	d2480fd508	net/netns: support !CAP_NET_ADMIN ... netns_linux checked whether "ip rule" could run to determine whether to use SO_MARK for network namespacing. However in Linux environments which lack CAP_NET_ADMIN, such as various container runtimes, the "ip rule" command succeeds but SO_MARK fails due to lack of permission. SO_BINDTODEVICE would work in these environments, but isn't tried. In addition to running "ip rule" check directly whether SO_MARK works or not. Among others, this allows Microsoft Azure App Service and AWS App Runner to work. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	1896bf99d9	netns_linux: No namespace for localhost. ... Connections to a control server or log server on localhost, used in a number of tests, are working right now because the calls to SO_MARK in netns fail for non-root but then we ignore the failure when running in tests. Unfortunately that failure in SO_MARK also affects container environments without CAP_NET_ADMIN, breaking Tailscale connectivity. We're about to fix netns to recognize when SO_MARK doesn't work and use SO_BINDTODEVICE instead. Doing so makes tests fail, as their sockets now BINDTODEVICE of the default route and cannot connect to localhost. Add support to skip namespacing for localhost connections, which Darwin and Windows already do. This is not conditional on running within a test, if you tell tailscaled to connect to localhost it will automatically use a non-namespaced socket to do so. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	61622b18fa	net/interface: add AWS App Runner /proc/net/route test ... Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	92077ae78c	wgengine/magicsock: make portmapping async ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	440566c5d2	net/interfaces: trim getPACWindows whitespace before parsing URL ... Fixes #2357 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	0ad92b89a6	net/tstun: fix data races ... To remove some multi-case selects, we intentionally allowed sends on closed channels (cc23049cd2). However, we also introduced concurrent sends and closes, which is a data race. This commit fixes the data race. The mutexes here are uncontended, and thus very cheap. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	c35a832de6	net/tstun: add inner loop to poll ... This avoids re-enqueuing to t.bufferConsumed, which makes the code a bit clearer. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	a4cc7b6d54	net/tstun: simplify code ... Calculate whether the packet is injected directly, rather than via an else branch. Unify the exit paths. It is easier here than duplicating them. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	cc23049cd2	net/tstun: remove multi-case selects from hot code ... Every TUN Read went through several multi-case selects. We know from past experience with wireguard-go that these are slow and cause scheduler churn. The selects served two purposes: they separated errors from data and gracefully handled shutdown. The first is fairly easy to replace by sending errors and data over a single channel. The second, less so. We considered a few approaches: Intricate webs of channels, global condition variables. They all get ugly fast. Instead, let's embrace the ugly and handle shutdown ungracefully. It's horrible, but the horror is simple and localized. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Crawshaw	6b9f8208f4	net/dns: do not run wsl.exe as LocalSystem ... It doesn't work. It needs to run as the user. https://github.com/microsoft/WSL/issues/4803 The mechanism for doing this was extracted from: https://web.archive.org/web/20101009012531/http://blogs.msdn.com/b/winsdk/archive/2009/07/14/launching-an-interactive-process-from-windows-service-in-windows-vista-and-later.aspx While here, we also reclaculate WSL distro set on SetDNS. This accounts for: 1. potential inability to access wsl.exe on startup 2. WSL being installed while Tailscale is running 3. A new WSL distrobution being installed Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	1147c7fd4f	net/dns: set WSL /etc/resolv.conf ... We also have to make a one-off change to /etc/wsl.conf to stop every invocation of wsl.exe clobbering the /etc/resolv.conf. This appears to be a safe change to make permanently, as even though the resolv.conf is constantly clobbered, it is always the same stable internal IP that is set as a nameserver. (I believe the resolv.conf clobbering predates the MS stub resolver.) Tested on WSL2, should work for WSL1 too. Fixes #775 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	9b063b86c3	net/dns: factor directManager out over an FS interface ... This is preliminary work for using the directManager as part of a wslManager on windows, where in addition to configuring windows we'll use wsl.exe to edit the linux file system and modify the system resolv.conf. The pinholeFS is a little funky, but it's designed to work through simple unix tools via wsl.exe without invoking bash. I would not have thought it would stand on its own like this, but it turns out it's useful for writing a test for the directManager. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago