8284 Commits (7fe6e508588c6359fc51b0221aa1c20ac39e3eaa)

 

All Branches   

Search

Author	SHA1	Message	Date
Brad Fitzpatrick	312646c516	tailcfg: add omitempty to FilterRule.SrcBits (#1089) ... It's not used by recent clients, so even more reason to omit it. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e8ae355bb8	ipn: delete domainsForProxying, require explicit DNS search domains (mapver 9) (#1078) ... Previously the client had heuristics to calculate which DNS search domains to set, based on the peers' names. Unfortunately that prevented us from doing some things we wanted to do server-side related to node sharing. So, bump MapRequest.Version to 9 to signal that the client only uses the explicitly configured DNS search domains and doesn't augment it with its own list. Updates tailscale/corp#1026 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1ccf997699	version: new version for a new year	4 years ago
David Anderson	8fc11d582d	go.sum: update to match wireguard-go version update. ... Signed-off-by: David Anderson <dave@natulte.net>	4 years ago
Josh Bleecher Snyder	14af677332	go.mod: update wireguard-go version ... To pick up netaddr deps change	4 years ago
David Anderson	86fe22a1b1	Update netaddr, and adjust wgengine/magicsock due to API change. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package ... This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	13b554fed9	version: bump for the last time in 2020	4 years ago
Brad Fitzpatrick	c2edb2865b	go.sum: update	4 years ago
Christine Dodrill	70f14af21e	add nix-shell boilerplate (#1028) ... This enables users of nix-shell to automagically have the correct development environment by simply changing directory into a checkout of this repo. For more information on this see the following links: - https://christine.website/blog/how-i-start-nix-2020-03-08 - https://direnv.net/	4 years ago
Brad Fitzpatrick	0d94fe5f69	wgengine/router: disable IPv6 on Linux if ip rule -6 fails (#1074) ... Updates #562 Fixes #973 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	1e88050403	net/tsaddr: add ChromeOS contains tests ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	cf2ac2d123	go.mod: upgrade inet.af/netaddr ... To pick up IPPrefix.Contains fix.	4 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Charlotte Brandhorst-Satzkorn	ff2b3d02e6	Fix typo in cmd/tailscale/cli/cli.go (#1069) ... Remove duplicate 'to connect' in error message. Fixes #1068 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@catzkorn.dev>	4 years ago
Frederik “Freso” S. Olesen	a9a80ab372	tailscaled.service: Harden systemd unit somewhat (#1062) ... While not a full capability lockdown of the systemd unit, this still improves sandboxing and security of the running process a good deal. Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>	4 years ago
Matt Layher	1a42cef3a2	cmd/tailscale*: make updatedeps ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Matt Layher	bfbd6b9241	go.mod: bump github.com/mdlayher/netlink to v1.2.0 ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Brad Fitzpatrick	80c94168ae	wgengine: finish updating isTrimmablePeer ... I accidentally merged Dave's change with the XXXX DO NOT SUBMIT comment in it.	4 years ago
David Anderson	cb96b14bf4	net/packet: remove the custom IP4/IP6 types in favor of netaddr.IP. ... Upstream netaddr has a change that makes it alloc-free, so it's safe to use in hot codepaths. This gets rid of one of the many IP types in our codebase. Performance is currently worse across the board. This is likely due in part to netaddr.IP being a larger value type (4b -> 24b for IPv4, 16b -> 24b for IPv6), and in other part due to missing low-hanging fruit optimizations in netaddr. However, the regression is less bad than it looks at first glance, because we'd micro-optimized packet.IP* in the past few weeks. This change drops us back to roughly where we were at the 1.2 release, but with the benefit of a significant code and architectural simplification. name old time/op new time/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 12.2ns ± 5% 29.7ns ± 2% +142.32% (p=0.008 n=5+5) Decode/tcp6-8 12.6ns ± 3% 65.1ns ± 2% +418.47% (p=0.008 n=5+5) Decode/udp4-8 11.8ns ± 3% 30.5ns ± 2% +157.94% (p=0.008 n=5+5) Decode/udp6-8 27.1ns ± 1% 65.7ns ± 2% +142.36% (p=0.016 n=4+5) Decode/icmp4-8 24.6ns ± 2% 30.5ns ± 2% +23.65% (p=0.016 n=4+5) Decode/icmp6-8 22.9ns ±51% 65.5ns ± 2% +186.19% (p=0.008 n=5+5) Decode/igmp-8 18.1ns ±44% 30.2ns ± 1% +66.89% (p=0.008 n=5+5) Decode/unknown-8 20.8ns ± 1% 10.6ns ± 9% -49.11% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 30.5ns ± 1% 77.9ns ± 3% +155.01% (p=0.008 n=5+5) Filter/tcp4_syn_in-8 43.7ns ± 3% 123.0ns ± 3% +181.72% (p=0.008 n=5+5) Filter/tcp4_syn_out-8 24.5ns ± 2% 45.7ns ± 6% +86.22% (p=0.008 n=5+5) Filter/udp4_in-8 64.8ns ± 1% 210.0ns ± 2% +223.87% (p=0.008 n=5+5) Filter/udp4_out-8 119ns ± 0% 278ns ± 0% +133.78% (p=0.016 n=4+5) Filter/icmp6-8 40.3ns ± 2% 204.4ns ± 4% +407.70% (p=0.008 n=5+5) Filter/tcp6_syn_in-8 35.3ns ± 3% 199.2ns ± 2% +464.95% (p=0.008 n=5+5) Filter/tcp6_syn_out-8 32.8ns ± 2% 81.0ns ± 2% +147.10% (p=0.008 n=5+5) Filter/udp6_in-8 106ns ± 2% 290ns ± 2% +174.48% (p=0.008 n=5+5) Filter/udp6_out-8 184ns ± 2% 314ns ± 3% +70.43% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/tstun goos:linux goarch:amd64 Write-8 9.02ns ± 3% 8.92ns ± 1% ~ (p=0.421 n=5+5) name old alloc/op new alloc/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00B 0.00B ~ (all equal) Decode/tcp6-8 0.00B 0.00B ~ (all equal) Decode/udp4-8 0.00B 0.00B ~ (all equal) Decode/udp6-8 0.00B 0.00B ~ (all equal) Decode/icmp4-8 0.00B 0.00B ~ (all equal) Decode/icmp6-8 0.00B 0.00B ~ (all equal) Decode/igmp-8 0.00B 0.00B ~ (all equal) Decode/unknown-8 0.00B 0.00B ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp4_in-8 0.00B 0.00B ~ (all equal) Filter/udp4_out-8 16.0B ± 0% 64.0B ± 0% +300.00% (p=0.008 n=5+5) Filter/icmp6-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp6_in-8 0.00B 0.00B ~ (all equal) Filter/udp6_out-8 48.0B ± 0% 64.0B ± 0% +33.33% (p=0.008 n=5+5) name old allocs/op new allocs/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00 0.00 ~ (all equal) Decode/tcp6-8 0.00 0.00 ~ (all equal) Decode/udp4-8 0.00 0.00 ~ (all equal) Decode/udp6-8 0.00 0.00 ~ (all equal) Decode/icmp4-8 0.00 0.00 ~ (all equal) Decode/icmp6-8 0.00 0.00 ~ (all equal) Decode/igmp-8 0.00 0.00 ~ (all equal) Decode/unknown-8 0.00 0.00 ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp4_in-8 0.00 0.00 ~ (all equal) Filter/udp4_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Filter/icmp6-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp6_in-8 0.00 0.00 ~ (all equal) Filter/udp6_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	d0baece5fa	go.mod: bump inet.af/netaddr to non-allocating version	4 years ago
Brad Fitzpatrick	ef15096a7d	control/controlclient, version/distro: detect NixOS explicitly ... The fallthrough happened to work in controlclient already due to the /etc/os-release PRETTY_NAME default, but make it explicit so it doesn't look like an accident. Also add it to version/distro, even though nothing needs it yet.	4 years ago
David Crawshaw	2b2a16d9a2	wgengine/router/dns: reduce windows registry key open timeout ... The windows key timeout is longer than the wgengine watchdog timeout, which means we never reach the timeout, instead the process exits. Reduce the timeout so if we do hit it, at least the process continues. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
David Crawshaw	b4f70d8232	wgengine/router/dns: use the correct interface GUID ... On Win10, there's a hardcoded GUID and this works. On Win7, this GUID changes and we need to ask the tun for its LUID and convert that from the GUID. This commit uses the computed GUID that is placed in InterfaceName. Diagnosed by Jason Donnenfeld. (Thanks!)	4 years ago
Brad Fitzpatrick	15c064f76f	wgengine/router/dns: remove unsafe endianness detection on Linux	4 years ago
Brad Fitzpatrick	f9659323df	wgengine/router/dns: fix typo in comment	4 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints ... Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	57dd247376	cmd/tailscaled, logpolicy, logtail: support log levels ... Log levels can now be specified with "[v1] " or "[v2] " substrings that are then stripped and filtered at the final logger. This follows our existing "[unexpected]" etc convention and doesn't require a wholesale reworking of our logging at the moment. cmd/tailscaled then gets a new --verbose=N flag to take a log level that controls what gets logged to stderr (and thus systemd, syslog, etc). Logtail is unaffected by --verbose. This commit doesn't add annotations to any existing log prints. That is in the next commit. Updates #924 Updates #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d97ee12179	logtail, logpolicy: remove an unidiomatic use of an interface	4 years ago
Brad Fitzpatrick	83f45ae2dd	version: bump date	4 years ago
Brad Fitzpatrick	c348fb554f	control/controlclient: clarify a comment	4 years ago
Brad Fitzpatrick	90c8519765	go.sum: update	4 years ago
David Anderson	ca676ea645	tailcfg: introduce map version 8, for clients that support v6 node config. ... For now, the server will only send v6 configuration to mapversion 8 clients as part of an early-adopter program, while we verify that the functionality is robust. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	03a039d48d	go.mod: bump wireguard-go version. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f5e33ad761	go.mod: update inet.af/netaddr, go mod tidy. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	89be4037bb	control/controlclient: report broken routing for v4 and v6. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	baa7937998	net/interfaces: return IPv6 addresses from LocalAddresses. ... In practice, we already provide IPv6 endpoint addresses via netcheck, and that address is likely to match a local address anyway (i.e. no NAT66). The comment at that piece of the code mentions needing to figure out a good priority ordering, but that only applies to non-active-discovery clients, who already don't do anything with IPv6 addresses. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	294ceb513c	ipn, wgengine/magicsock: fix `tailscale status` display. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	891110e64c	wgengine: expand lazy config to work with dual-stacked peers. ... Lazy wg configuration now triggers if a peer has only endpoint addresses (/32 for IPv4, /128 for IPv6). Subnet routers still trigger eager configuration to avoid the need for a CIDR match in the hot packet path. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	aa353b8d0f	net/packet: add an IP6 constructor from a raw byte array. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Smitty	f0b0a62873	Clarify that raw format strings are intentional ... This caused some confusion in issue #460, since usually raw format strings aren't printed directly. Hopefully by directly logging that they are intended to be raw format strings, this will be more clear. Rate limited format strings now look like: [RATE LIMITED] format string "control: sendStatus: %s: %v" Closes #460. Signed-off-by: Smitty <me@smitop.com>	4 years ago
David Anderson	c8c493f3d9	wgengine/magicsock: make ReceiveIPv4 a little easier to follow. ... The previous code used a lot of whole-function variables and shared behavior that only triggered based on prior action from a single codepath. Instead of that, move the small amounts of "shared" code into each switch case. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0ad109f63d	wgengine/magicsock: move legacy endpoint creation into legacy.go. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f873da5b16	wgengine/magicsock: move more legacy endpoint handling. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	58fcd103c4	wgengine/magicsock: move legacy sending code to legacy.go. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	65ae66260f	wgengine/magicsock: unexport AddrSet. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c9b9afd761	wgengine/magicsock: move most legacy nat traversal bits to another file. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	5f07da4854	util/systemd: don't log warnings when not running under systemd ... It caused our integration tests to fail, which prohibit logging to os.Stderr for test cleanliness reasons.	4 years ago
Brad Fitzpatrick	741c513e51	wgengine/tsdns: fix error response marshaling, improve bad query logs ... Updates #995 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	554a20becb	wgengine/magicsock: only log about lazy config when actually doing lazy config. ... Before, tailscaled would log every 10 seconds when the periodic noteRecvActivity call happens. This is noisy, but worse it's misleading, because the message suggests that the disco code is starting a lazy config run for a missing peer, whereas in fact it's just an internal piece of keepalive logic. With this change, we still log when going from 0->1 tunnel for the peer, but not every 10s thereafter. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago