tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	73cc2d8f89	wgengine/filter: also silently drop link-local unicast traffic Updates #629	4 years ago
Brad Fitzpatrick	5f807c389e	wgengine/filter: drop multicast packets out, don't log about them Eventually we'll probably support multicast. For now it's just log spam. Fixes #629	4 years ago
Brad Fitzpatrick	b4d97d2532	wgengine/filter: fix IPv4 IGMP spam omission, also omit ff02::16 spam And add tests. Fixes #618 Updates #402	4 years ago
Brad Fitzpatrick	d96d26c22a	wgengine/filter: don't spam logs on dropped outgoing IPv6 ICMP or IPv4 IGMP The OS (tries) to send these but we drop them. No need to worry the user with spam that we're dropping it. Fixes #402 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	3e3c24b8f6	wgengine/packet: add IPVersion field, don't use IPProto to note version As prep for IPv6 log spam fixes in a future change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	10ac066013	all: fix vet warnings	4 years ago
Dmytro Shynkevych	67ebba90e1	tsdns: dual resolution mode, IPv6 support (#526 ) This change adds to tsdns the ability to delegate lookups to upstream nameservers. This is crucial for setting Magic DNS as the system resolver. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	07e02ec9d3	wgengine/tsdns: add test and prevent useless updates (#449 ) Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	511840b1f6	tsdns: initial implementation of a Tailscale DNS resolver (#396 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	059b1d10bb	wgengine/packet: refactor and expose UDP header marshaling (#408 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	43ded2b581	wgengine/packet: add some tests, more docs, minor Go style, performance changes	5 years ago
Avery Pennarun	65fbb9c303	wgengine/filter: support subnet mask rules, not just /32 IPs. This depends on improved support from the control server, to send the new subnet width (Bits) fields. If these are missing, we fall back to assuming their value is /32. Conversely, if the server sends Bits fields to an older client, it will interpret them as /32 addresses. Since the only rules we allow are "accept" rules, this will be narrower or equal to the intended rule, so older clients will simply reject hosts on the wider subnet (fail closed). With this change, the internal filter.Matches format has diverged from the wire format used by controlclient, so move the wire format into tailcfg and convert it to filter.Matches in controlclient. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	85e675940d	wgengine/filter: allow ICMP response packets. Longer term, we should probably update the packet filter to be fully stateful, for both TCP and ICMP. That is, only ICMP packets related to a session we initiated should be allowed back in. But this is reasonably secure for now, since wireguard is already trimming most traffic. The current code would not protect against eg. Ping-of-Death style attacks from VPN nodes. Fixes tailscale/tailscale#290. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
David Anderson	43becc4334	wgengine/packet: fix minor lint errors. Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
Earl Lee	a8d8b8719a	Move Linux client & common packages into a public repo.	5 years ago

15 Commits (82f2fdc194df66aa027e627f43c1be72ee451e29)