tailscale

Commit Graph

Author	SHA1	Message	Date
Dmytro Shynkevych	33b2f30cea	wgengine: wrap tun.Device to support filtering and packet injection (#358 ) Right now, filtering and packet injection in wgengine depend on a patch to wireguard-go that probably isn't suitable for upstreaming. This need not be the case: wireguard-go/tun.Device is an interface. For example, faketun.go implements it to mock a TUN device for testing. This patch implements the same interface to provide filtering and packet injection at the tunnel device level, at which point the wireguard-go patch should no longer be necessary. This patch has the following performance impact on i7-7500U @ 2.70GHz, tested in the following namespace configuration: ┌────────────────┐ ┌─────────────────────────────────┐ ┌────────────────┐ │ $ns1 │ │ $ns0 │ │ $ns2 │ │ client0 │ │ tailcontrol, logcatcher │ │ client1 │ │ ┌─────┐ │ │ ┌──────┐ ┌──────┐ │ │ ┌─────┐ │ │ │vethc│───────┼────┼──│vethrc│ │vethrs│──────┼─────┼──│veths│ │ │ ├─────┴─────┐ │ │ ├──────┴────┐ ├──────┴────┐ │ │ ├─────┴─────┐ │ │ │10.0.0.2/24│ │ │ │10.0.0.1/24│ │10.0.1.1/24│ │ │ │10.0.1.2/24│ │ │ └───────────┘ │ │ └───────────┘ └───────────┘ │ │ └───────────┘ │ └────────────────┘ └─────────────────────────────────┘ └────────────────┘ Before: --------------------------------------------------- \| TCP send \| UDP send \| \|------------------------\|------------------------\| \| 557.0 (±8.5) Mbits/sec \| 3.03 (±0.02) Gbits/sec \| --------------------------------------------------- After: --------------------------------------------------- \| TCP send \| UDP send \| \|------------------------\|------------------------\| \| 544.8 (±1.6) Mbits/sec \| 3.13 (±0.02) Gbits/sec \| --------------------------------------------------- The impact on receive performance is similar. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
David Anderson	9ccbcda612	wgengine/router: rename config.Settings to config.Config, make pointer. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	72cae5504c	wgengine: generate and plumb router.Settings in from ipn. This saves a layer of translation, and saves us having to pass in extra bits and pieces of the netmap and prefs to wgengine. Now it gets one Wireguard config, and one OS network stack config. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	cd01bcc395	wgengine/router: allow loopback traffic from our own IP(s). Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	bfdc8175b1	wgengine/router: add a setting to disable SNAT for subnet routes. Part of #320. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	8a3e77fc43	ipn, wgengine/filter: remove exported type aliases	5 years ago
David Anderson	21ac65d3da	wgengine/router: explicitly detect and complain about busybox's `ip`. Defensive programming against #368 in environments other than Docker, e.g. if you try using Tailscale in Alpine Linux directly, sans container. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	381b94d4d1	wgengine/router: include command output if `ip rule list` fails. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	e83d02ffd1	wgengine: don't double-close tundev on setup error. Part of #368. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	efc1feedc9	wgengine/router: include more information when iptables ops fail. The iptables package we use doesn't include command output, so we're left with guessing what went wrong most of the time. This will at least narrow things down to which operation failed. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	e16f7e48a3	wgengine: simplify wgcfg.* to netaddr.* conversion. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	ccbd0937d0	wgengine: avoid v6 mapped v4 IPs when converting to netaddr types. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Wendi Yu	499c8fcbb3	Replace our ratelimiter with standard rate package (#359 ) * Replace our ratelimiter with standard rate package Signed-off-by: Wendi Yu <wendi.yu@yahoo.ca>	5 years ago
David Anderson	b01db109f5	wgengine/router: use inet.af/netaddr, not wgcfg.CIDR. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	b8f01eed34	wgengine/router: remove wireguard-go config from settings. Instead, pass in only exactly the relevant configuration pieces that the OS network stack cares about. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	8861bb5a19	wgengine/router: alter API to support multiple addrs, and use on linux. FreeBSD and OpenBSD will error out with a complaint if we pass >1 address right now, but we don't yet so that's okay.	5 years ago
David Anderson	6802481bf5	wgengine/router: don't use gateway routes on linux.	5 years ago
David Anderson	78b1ed39ea	wgengine/router: add more documentation.	5 years ago
David Anderson	c9de43cd59	wgengine/router: fix typo. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	89af51b84d	wgengine: plumb locally advertised subnet routes. With this change, advertising subnet routes configures the firewall correctly. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	89198b1691	wgengine/router: rewrite netfilter and routing logic. New logic installs precise filters for subnet routes, plays nice with other users of netfilter, and lays the groundwork for fixing routing loops via policy routing. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	7618d7e677	wgengine/router: simplify some cmd invocations. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	fefd7e10dc	types/structs: add structs.Incomparable annotation, use it where applicable Shotizam before and output queries: sqlite> select sum(size) from bin where func like 'type..%'; 129067 => 120216	5 years ago
David Anderson	755fd9253c	wgengine/router: fix up docstring. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	1ac570def7	wgengine/router: split out from wgengine. The router implementations are logically separate, with their own API. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	ee3395e63a	wgengine/filter: fix linter warning. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	65fbb9c303	wgengine/filter: support subnet mask rules, not just /32 IPs. This depends on improved support from the control server, to send the new subnet width (Bits) fields. If these are missing, we fall back to assuming their value is /32. Conversely, if the server sends Bits fields to an older client, it will interpret them as /32 addresses. Since the only rules we allow are "accept" rules, this will be narrower or equal to the intended rule, so older clients will simply reject hosts on the wider subnet (fail closed). With this change, the internal filter.Matches format has diverged from the wire format used by controlclient, so move the wire format into tailcfg and convert it to filter.Matches in controlclient. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	85e675940d	wgengine/filter: allow ICMP response packets. Longer term, we should probably update the packet filter to be fully stateful, for both TCP and ICMP. That is, only ICMP packets related to a session we initiated should be allowed back in. But this is reasonably secure for now, since wireguard is already trimming most traffic. The current code would not protect against eg. Ping-of-Death style attacks from VPN nodes. Fixes tailscale/tailscale#290. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Brad Fitzpatrick	e1526b796e	ipn: don't listen on the unspecified address in test To avoid the Mac firewall dialog of (test) death. See `4521a59f30` which I added to help debug this.	5 years ago
Brad Fitzpatrick	18017f7630	ipn, wgengine/magicsock: be more idle when in Stopped state with no peers (Previously as #288, but with some more.) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
fgergo	8296c934ac	Update ifconfig_windows.go OLE calls sometimes unexpectedly fail, but retries can succeed. Change panic() to return errors. This way ConfigureInterface() retries can succeed.	5 years ago
David Anderson	9669b85b41	wgengine/magicsock: wait for endpoint updater goroutine when closing. Fixes #204. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Elias Naur	2dac4f2b24	wgengine/monitor: disable monitor on Android Netlink is not supported on Android. Signed-off-by: Elias Naur <mail@eliasnaur.com>	5 years ago
Brad Fitzpatrick	268d331cb5	wgengine/magicsock: prune key.Public-keyed on peer removals Fixes #215	5 years ago
Brad Fitzpatrick	00d053e25a	wgengine/magicsock: fix slow memory leak as peer endpoints move around Updates #215	5 years ago
Brad Fitzpatrick	7fc97c5493	wgengine/magicsock: use netaddr more In prep for deleting from the ever-growing maps.	5 years ago
Brad Fitzpatrick	6fb30ff543	wgengine/magicsock: start using inet.af/netaddr a bit	5 years ago
David Anderson	afbfe4f217	wgengine: drop wireguard MTU to 1280 bytes. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	dc9b39e3fb	wgengine/windows: use new winipcfg.Sync{Addresses,Routes} functions. This avoids flushing and reloading the whole list of addresses and routes whenever remote node information changes.	5 years ago
Brad Fitzpatrick	adf74c75ed	wgengine: also diagnose not-yet-rebooted system updates on Arch	5 years ago
Brad Fitzpatrick	45f2b53aca	all: remove unnecessary trailing newlines in format patterns for consistency And document on logger.Logf that it's unnecessary.	5 years ago
Brad Fitzpatrick	a7e7c7b548	wgengine/magicsock: close derp connections on rebind Fixes #276 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	614261d00d	wgengine/magicsock: reset AddrSet states on Rebind Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	c0697e1feb	net/interfaces: add IsExpensive and up state to State Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a55c4217db	wgengine: diagnose why CreateTUN might've failed for users Fixes #273 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	3a3b64301e	wgengine: quiet some engine reconfig logging, make more consistent Updates #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	1ec27dbb5b	wgengine: remove an allocation in reconfig Minor.	5 years ago
David Crawshaw	5b95aa81ea	wgengine: remove IpcSetOperation on LinkChange This was only done occasionally, but was extremely disruptive when done and is no longer necessary. It used to be that when switching links, we had to immediately generate handshakes to everyone we were communicating with to punch a hole in any NAT we were talking through. (This ended up not really working, because in the process we got rid of our session keys and ended up having a futile conversation for many seconds.) Now we have DERP, our link change propogates to the other side as a new list of endpoints, so they start spraying packets. We will definitely get one thanks to DERP, which will cause us to spray, opening any NAT we are behind. The result is that for good connections, we don't trash session keys and cause an interruption. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	922d9546bf	wgengine: don't allocate so much in userspaceEngine.getStatus It was one of the top garbage producers on my phone. It's slated to be deleted and replaced anyway, but this helps in the meantime. The go.sum changes look scary, but the new dep only adds 240 bytes to the binary. The go.sum noise is just cmd/go being aggressive in including a lot of stuff (which is being fixed in Go 1.15, for what I understand). And I ran a go mod tidy, which added some too. (I had to write a custom wrapper around go mod tidy because this mod tidy normally breaks on tailscale.io/control being missing but referenced in tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	0f64d7f9cc	wgengine: remove a tiny allocation Drop in the bucket compared to the larger issues, but noticed it when looking at pprof.	5 years ago

1 2 3 4

200 Commits (89a6f27cf82b591dde58fcff3d4c36b71aaf123e)