7800 Commits (8f7588900abd66e44fd7348e732d3ef19f1b0289)

 

All Branches   

Search

Author	SHA1	Message	Date
Andrea Gottardo	d7619d273b	health: fix nil DERPMap dereference panic ... Looks like a DERPmap might not be available when we try to get the name associated with a region ID, and that was causing an intermittent panic in CI. Fixes #12534 Change-Id: I4ace53681bf004df46c728cff830b27339254243 Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Brad Fitzpatrick	25eeafde23	derp: don't verify mesh peers when --verify-clients is set ... Updates tailscale/corp#20654 Change-Id: I33c7ca3c7a3c4e492797b73c66eefb699376402c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	4b39b6f7ce	derp: fix fmt verb for nodekeys ... It was hex-ifying the String() form of key.NodePublic, which was already hex. I noticed in some logs: "client 6e6f64656b65793a353537353..." And thought that 6x6x6x6x looked strange. It's "nodekey:" in hex. Updates tailscale/corp#20844 Change-Id: Ib9f2d63b37e324420b86efaa680668a9b807e465 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	21460a5b14	tailcfg, wgengine/filter: remove most FilterRule.SrcBits code ... The control plane hasn't sent it to clients in ages. Updates tailscale/corp#20965 Change-Id: I1d71a4b6dd3f75010a05c544ee39827837c30772 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	162d593514	net/flowtrack: fix, test String method ... I meant to do this in the earlier change and had a git fail. To atone, add a test too while I'm here. Updates #12486 Updates #12507 Change-Id: I4943b454a2530cb5047636f37136aa2898d2ffc7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	9e0a5cc551	net/flowtrack: optimize Tuple type for use as map key ... This gets UDP filter overhead closer to TCP. Still ~2x, but no longer ~3x. goos: darwin goarch: arm64 pkg: tailscale.com/wgengine/filter │ before │ after │ │ sec/op │ sec/op vs base │ FilterMatch/tcp-not-syn-v4-8 15.43n ± 3% 15.38n ± 5% ~ (p=0.339 n=10) FilterMatch/udp-existing-flow-v4-8 42.45n ± 0% 34.77n ± 1% -18.08% (p=0.000 n=10) geomean 25.59n 23.12n -9.65% Updates #12486 Change-Id: I595cfadcc6b7234604bed9c4dd4261e087c0d4c4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Andrea Gottardo	d6a8fb20e7	health: include DERP region name in bad derp notifications (#12530) ... Fixes tailscale/corp#20971 We added some Warnables for DERP failure situations, but their Text currently spits out the DERP region ID ("10") in the UI, which is super ugly. It would be better to provide the RegionName of the DERP region that is failing. We can do so by storing a reference to the last-known DERP map in the health package whenever we fetch one, and using it when generating the notification text. This way, the following message... > Tailscale could not connect to the relay server '10'. The server might be temporarily unavailable, or your Internet connection might be down. becomes: > Tailscale could not connect to the 'Seattle' relay server. The server might be temporarily unavailable, or your Internet connection might be down. which is a lot more user-friendly. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Andrea Gottardo	8eb15d3d2d	cli/netcheck: fail with output if we time out fetching a derpmap (#12528) ... Updates tailscale/corp#20969 Right now, when netcheck starts, it asks tailscaled for a copy of the DERPMap. If it doesn't have one, it makes a HTTPS request to controlplane.tailscale.com to fetch one. This will always fail if you're on a network with a captive portal actively blocking HTTPS traffic. The code appears to hang entirely because the http.Client doesn't have a Timeout set. It just sits there waiting until the request succeeds or fails. This adds a timeout of 10 seconds, and logs more details about the status of the HTTPS request. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Jordan Whited	a93173b56a	cmd/xdpderper,derp/xdp: implement mode that drops STUN packets (#12527) ... This is useful during maintenance as a method for shedding home client load. Updates tailscale/corp#20689 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Andrea Gottardo	d55b105dae	health: expose DependsOn to local API via UnhealthyState (#12513) ... Updates #4136 Small PR to expose the health Warnables dependencies to the GUI via LocalAPI, so that we can only show warnings for root cause issues, and filter out unnecessary messages before user presentation. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Brad Fitzpatrick	bd93c3067e	wgengine/filter/filtertype: make Match.IPProto a view ... I noticed we were allocating these every time when they could just share the same memory. Rather than document ownership, just lock it down with a view. I was considering doing all of the fields but decided to just do this one first as test to see how infectious it became. Conclusion: not very. Updates #cleanup (while working towards tailscale/corp#20514) Change-Id: I8ce08519de0c9a53f20292adfbecd970fe362de0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Flakes Updater	bfb775ce62	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	5 months ago
Tom Proctor	3099323976	cmd/k8s-operator,k8s-operator,go.{mod,sum}: publish proxy status condition for annotated services (#12463) ... Adds a new TailscaleProxyReady condition type for use in corev1.Service conditions. Also switch our CRDs to use metav1.Condition instead of ConnectorCondition. The Go structs are seralized identically, but it updates some descriptions and validation rules. Update k8s controller-tools and controller-runtime deps to fix the documentation generation for metav1.Condition so that it excludes comments and TODOs. Stop expecting the fake client to populate TypeMeta in tests. See kubernetes-sigs/controller-runtime#2633 for details of the change. Finally, make some minor improvements to validation for service hostnames. Fixes #12216 Co-authored-by: Irbe Krumina <irbe@tailscale.com> Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	5 months ago
Andrew Dunham	45d2f4301f	proxymap, various: distinguish between different protocols ... Previously, we were registering TCP and UDP connections in the same map, which could result in erroneously removing a mapping if one of the two connections completes while the other one is still active. Add a "proto string" argument to these functions to avoid this. Additionally, take the "proto" argument in LocalAPI, and plumb that through from the CLI and add a new LocalClient method. Updates tailscale/corp#20600 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I35d5efaefdfbf4721e315b8ca123f0c8af9125fb	5 months ago
Aaron Klotz	2cb408f9b1	hostinfo: update Windows hostinfo to include MSIDist registry value ... We need to expand our enviornment information to include info about the Windows store. Thinking about future plans, it would be nice to include both the packaging mechanism and the distribution mechanism. In this PR we change packageTypeWindows to check a new registry value named MSIDist, and concatenate that value to "msi/" when present. We also remove vestigial NSIS detection. Updates https://github.com/tailscale/corp/issues/2790 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
James Tucker	87c5ad4c2c	derp: add a verifyClients check to the consistency check ... Only implemented for the local tailscaled variant for now. Updates tailscale/corp#20844 Signed-off-by: James Tucker <james@tailscale.com>	5 months ago
Joe Tsai	2db2d04a37	types/logid: add Add method (#12478) ... The Add method derives a new ID by adding a signed integer to the ID, treating it as an unsigned 256-bit big-endian integer. We also add Less and Compare methods to PrivateID to provide feature parity with existing methods on PublicID. Updates tailscale/corp#11038 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	5 months ago
Jordan Whited	315f3d5df1	derp/xdp: fix handling of zero value UDP checksums (#12510) ... validate_udp_checksum was previously indeterminate (not zero) at declaration, and IPv4 zero value UDP checksum packets were being passed to the kernel. Updates tailscale/corp#20689 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Irbe Krumina	8cc2738609	cmd/{containerboot,k8s-operator}: store proxy device ID early to help with cleanup for broken proxies (#12425) ... * cmd/containerboot: store device ID before setting up proxy routes. For containerboot instances whose state needs to be stored in a Kubernetes Secret, we additonally store the device's ID, FQDN and IPs. This is used, between other, by the Kubernetes operator, who uses the ID to delete the device when resources need cleaning up and writes the FQDN and IPs on various kube resource statuses for visibility. This change shifts storing device ID earlier in the proxy setup flow, to ensure that if proxy routing setup fails, the device can still be deleted. Updates tailscale/tailscale#12146 Signed-off-by: Irbe Krumina <irbe@tailscale.com> * code review feedback Signed-off-by: Irbe Krumina <irbe@tailscale.com> --------- Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Andrew Lytvynov	674c998e93	cmd/tailscale/cli: do not allow update --version on macOS (#12508) ... We do not support specific version updates or track switching on macOS. Do not populate the flag to avoid confusion. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Andrew Lytvynov	be54dde0eb	clientupdate: allow switching from unstable to stable tracks (#12477) ... Previously, we would only compare the current version to resolved latest version for track. When running `tailscale update --track=stable` from an unstable build, it would almost always fail because the stable version is "older". But we should support explicitly switching tracks like that. Fixes #12347 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Kristoffer Dalby	a1ab7f7c94	client/tailscale: add NodeID to device ... Updates tailscale/corp#20514 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	5 months ago
Brad Fitzpatrick	1f6645b19f	net/ipset: skip the loop over Prefixes when there's only one ... For pprof cosmetic/confusion reasons more than performance, but it might have tiny speed benefit. Updates #12486 Change-Id: I40e03714f3afa3a7e7f5e1fa99b81c7e889b91b6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	20a5f939ba	wgengine/filter: add UDP flow benchmark ... To show the effects of the flow LRU accounting on e.g. QUIC traffic. For an open TCP connection: BenchmarkFilterMatch/tcp-not-syn-v4-8 66602070 16.74 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 67718179 16.60 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 68403351 16.84 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 66076416 16.87 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 67159012 16.67 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 65009526 16.58 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 66588055 16.62 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 63037071 16.58 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 69124975 21.15 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 54482922 20.41 ns/op And an open UDP connection: BenchmarkFilterMatch/udp-existing-flow-v4-8 25570020 44.09 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 26725958 46.99 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 25936412 47.11 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 25418325 45.99 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 25759848 44.73 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 25212488 46.26 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 25344370 44.55 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 26399372 45.26 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 26274159 47.51 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 26070472 46.79 ns/op Updates #12486 Change-Id: Ica4263fb77972cf43db5a2e9433b4429506edfde Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	bf2d13cfa0	net/ipset: return all closures from named wrappers ... So profiles show more useful names than just func1, func2, func3, etc. There will still be func1 on them all, but the symbol before will say what the lookup type is. Updates #12486 Change-Id: I910b024a7861394eb83d07f5a899eae338cb1f22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	86e0f9b912	net/ipset, wgengine/filter/filtertype: add split-out packages ... This moves NewContainsIPFunc from tsaddr to new ipset package. And wgengine/filter types gets split into wgengine/filter/filtertype, so netmap (and thus the CLI, etc) doesn't need to bring in ipset, bart, etc. Then add a test making sure the CLI deps don't regress. Updates #1278 Change-Id: Ia246d6d9502bbefbdeacc4aef1bed9c8b24f54d5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	36b1b4af2f	wgengine/filter: split local+logging lookups by IPv4-vs-IPv6 ... If we already know it's an incoming IPv4 packet, no need to match against the set of IPv6s and vice versa. goos: darwin goarch: arm64 pkg: tailscale.com/wgengine/filter │ before │ after │ │ sec/op │ sec/op vs base │ FilterMatch/not-local-v4-8 21.40n ± 3% 16.04n ± 1% -25.09% (p=0.000 n=10) FilterMatch/not-local-v6-8 20.75n ± 9% 15.71n ± 0% -24.31% (p=0.000 n=10) FilterMatch/no-match-v4-8 81.37n ± 1% 78.57n ± 3% -3.43% (p=0.005 n=10) FilterMatch/no-match-v6-8 77.73n ± 2% 73.71n ± 3% -5.18% (p=0.002 n=10) FilterMatch/tcp-not-syn-v4-8 21.41n ± 3% 16.86n ± 0% -21.25% (p=0.000 n=10) FilterMatch/tcp-not-syn-v4-no-logs-8 10.04n ± 0% 10.05n ± 0% ~ (p=0.446 n=10) geomean 29.07n 25.05n -13.84% Updates #12486 Change-Id: I70e5024af03893327d26629a994ab2aa9811f4f3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	d4220a76da	wgengine/filter: add TCP non-SYN benchmarks ... To show performance during heavy flows on established connections. BenchmarkFilterMatch/tcp-not-syn-v4-8 52125848 21.46 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 52388781 21.43 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 52916954 21.32 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 52590730 21.43 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 53015923 21.32 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-no-logs-8 122795029 9.783 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-no-logs-8 100000000 10.09 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-no-logs-8 120090948 9.747 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-no-logs-8 122350448 10.55 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-no-logs-8 122943025 9.813 ns/op Updates #12486 Change-Id: I8e7c9380bf969ad646851d53f8a4c287717694ea Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	10e8a2a05c	wgengine/filter: fix copy/pasteo in new benchmark's v6 CIDR ... I noticed the not-local-v6 numbers were nowhere near the v4 numbers (they should be identical) and then saw this. It meant the Addr().Next() wasn't picking an IP that was no longer local, as assumed. Updates #12486 Change-Id: I18dfb641f00c74c6252666bc41bd2248df15fadd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	64ac64fb66	net/tsaddr: use bart in NewContainsIPFunc, add tests, benchmarks ... NewContainsIPFunc was previously documented as performing poorly if there were many netip.Prefixes to search over. As such, we never it used it in such cases. This updates it to use bart at a certain threshold (over 6 prefixes, currently), at which point the bart lookup overhead pays off. This is currently kinda useless because we're not using it. But now we can and get wins elsewhere. And we can remove the caveat in the docs. goos: darwin goarch: arm64 pkg: tailscale.com/net/tsaddr │ before │ after │ │ sec/op │ sec/op vs base │ NewContainsIPFunc/empty-8 2.215n ± 11% 2.239n ± 1% +1.08% (p=0.022 n=10) NewContainsIPFunc/cidr-list-1-8 17.44n ± 0% 17.59n ± 6% +0.89% (p=0.000 n=10) NewContainsIPFunc/cidr-list-2-8 27.85n ± 0% 28.13n ± 1% +1.01% (p=0.000 n=10) NewContainsIPFunc/cidr-list-3-8 36.05n ± 0% 36.56n ± 13% +1.41% (p=0.000 n=10) NewContainsIPFunc/cidr-list-4-8 43.73n ± 0% 44.38n ± 1% +1.50% (p=0.000 n=10) NewContainsIPFunc/cidr-list-5-8 51.61n ± 2% 51.75n ± 0% ~ (p=0.101 n=10) NewContainsIPFunc/cidr-list-10-8 95.65n ± 0% 68.92n ± 0% -27.94% (p=0.000 n=10) NewContainsIPFunc/one-ip-8 4.466n ± 0% 4.469n ± 1% ~ (p=0.491 n=10) NewContainsIPFunc/two-ip-8 8.002n ± 1% 7.997n ± 4% ~ (p=0.697 n=10) NewContainsIPFunc/three-ip-8 27.98n ± 1% 27.75n ± 0% -0.82% (p=0.012 n=10) geomean 19.60n 19.07n -2.71% Updates #12486 Change-Id: I2e2320cc4384f875f41721374da536bab995c1ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Maisem Ali	491483d599	cmd/viewer,type/views: add MapSlice for maps of slices ... This abstraction provides a nicer way to work with maps of slices without having to write out three long type params. This also allows it to provide an AsMap implementation which copies the map and the slices at least. Updates tailscale/corp#20910 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Brad Fitzpatrick	7574f586aa	wgengine/filter: add more benchmarks, make names more explicit ... Updates #12486 Change-Id: If2e6d9c70212644eb4a0bc8ec6768512894a646a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	21ed31e33a	wgengine/filter: use NewContainsIPFunc for Srcs matches ... NewContainsIPFunc returns a contains matcher optimized for its input. Use that instead of what this did before, always doing a test over each of a list of netip.Prefixes. goos: darwin goarch: arm64 pkg: tailscale.com/wgengine/filter │ before │ after │ │ sec/op │ sec/op vs base │ FilterMatch/file1-8 32.60n ± 1% 18.87n ± 1% -42.12% (p=0.000 n=10) Updates #12486 Change-Id: I8f902bc064effb431e5b46751115942104ff6531 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	e2c0d69c9c	wgengine/filter: add filter benchmark ... Baseline, on 2020 M1 Macbook Pro, on power: goos: darwin goarch: arm64 pkg: tailscale.com/wgengine/filter BenchmarkFilterMatch/file1-8 34089133 32.79 ns/op BenchmarkFilterMatch/file1-8 35423917 32.59 ns/op BenchmarkFilterMatch/file1-8 35208598 32.80 ns/op BenchmarkFilterMatch/file1-8 35180470 33.39 ns/op BenchmarkFilterMatch/file1-8 36671608 32.82 ns/op BenchmarkFilterMatch/file1-8 35435991 33.13 ns/op BenchmarkFilterMatch/file1-8 34689181 33.29 ns/op BenchmarkFilterMatch/file1-8 34786053 32.94 ns/op BenchmarkFilterMatch/file1-8 35366235 32.56 ns/op BenchmarkFilterMatch/file1-8 35342799 32.47 ns/op Updates #12486 Change-Id: I8f902bc064effb431e5b46751115942104ff6531 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	7bc9d453c2	health: fix data race in new warnable code ... Fixes #12479 Change-Id: Ice84d5eb12d835eeddf6fc8cc337ea6b4dddcf6c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Nick Khyl	c32efd9118	various: create a catch-all NRPT rule when "Override local DNS" is enabled on Windows ... Without this rule, Windows 8.1 and newer devices issue parallel DNS requests to DNS servers associated with all network adapters, even when "Override local DNS" is enabled and/or a Mullvad exit node is being used, resulting in DNS leaks. This also adds "disable-local-dns-override-via-nrpt" nodeAttr that can be used to disable the new behavior if needed. Fixes tailscale/corp#20718 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Aaron Klotz	7354547bd8	util/winutil: update UserProfile to ensure any environment variables in the roaming profile path are expanded ... Updates #12383 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Andrea Gottardo	a8ee83e2c5	health: begin work to use structured health warnings instead of strings, pipe changes into ipn.Notify (#12406) ... Updates tailscale/tailscale#4136 This PR is the first round of work to move from encoding health warnings as strings and use structured data instead. The current health package revolves around the idea of Subsystems. Each subsystem can have (or not have) a Go error associated with it. The overall health of the backend is given by the concatenation of all these errors. This PR polishes the concept of Warnable introduced by @bradfitz a few weeks ago. Each Warnable is a component of the backend (for instance, things like 'dns' or 'magicsock' are Warnables). Each Warnable has a unique identifying code. A Warnable is an entity we can warn the user about, by setting (or unsetting) a WarningState for it. Warnables have: - an identifying Code, so that the GUI can track them as their WarningStates come and go - a Title, which the GUIs can use to tell the user what component of the backend is broken - a Text, which is a function that is called with a set of Args to generate a more detailed error message to explain the unhappy state Additionally, this PR also begins to send Warnables and their WarningStates through LocalAPI to the clients, using ipn.Notify messages. An ipn.Notify is only issued when a warning is added or removed from the Tracker. In a next PR, we'll get rid of subsystems entirely, and we'll start using structured warnings for all errors affecting the backend functionality. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Andrea Gottardo	e8ca30a5c7	xcode/iOS: support serial number collection via MDM on iOS (#11429) ... Fixes tailscale/corp#18366. This PR provides serial number collection on iOS, by allowing system administrators to pass a `DeviceSerialNumber` MDM key which can be read by the `posture` package in Go. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Aaron Klotz	bd2a6d5386	util/winutil: add UserProfile type for (un)loading user profiles ... S4U logons do not automatically load the associated user profile. In this PR we add UserProfile to handle that part. Windows docs indicate that we should try to resolve a remote profile path when present, so we attempt to do so when the local computer is joined to a domain. Updates #12383 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Jordan Whited	9189fe007b	cmd/stunc: support user-specified port (#12469) ... Updates tailscale/corp#20689 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
James Tucker	85ad0c276c	tailcfg: update PeerAPIDNS Port value documentation ... We do not intend to use this value for feature support communication in the future, and have applied changes elsewhere that now fix the expected value. Updates tailscale/corp#19391 Updates tailscale/corp#20398 Signed-off-by: James Tucker <james@tailscale.com>	5 months ago
Jordan Whited	65888d95c9	derp/xdp,cmd/xdpderper: initial skeleton (#12390) ... This commit introduces a userspace program for managing an experimental eBPF XDP STUN server program. derp/xdp contains the eBPF pseudo-C along with a Go pkg for loading it and exporting its metrics. cmd/xdpderper is a package main user of derp/xdp. Updates tailscale/corp#20689 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Brad Fitzpatrick	6908fb0de3	ipn/localapi,client/tailscale,cmd/derper: add WhoIs lookup by nodekey, use in derper ... Fixes #12465 Change-Id: I9b7c87315a3d2b2ecae2b8db9e94b4f5a1eef74a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Andrew Dunham	72c8f7700b	wgengine/netstack: add test for #12448 ... This refactors the logic for determining whether a packet should be sent to the host or not into a function, and then adds tests for it. Updates #11304 Updates #12448 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ief9afa98eaffae00e21ceb7db073c61b170355e5	5 months ago
Irbe Krumina	88f2d234a4	wgengine/netstack: fix 4via6 subnet routes (#12454) ... Fix a bug where, for a subnet router that advertizes 4via6 route, all packets with a source IP matching the 4via6 address were being sent to the host itself. Instead, only send to host packets whose destination address is host's local address. Fixes tailscale/tailscale#12448 Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Andrew Dunham <andrew@du.nham.ca>	5 months ago
Brad Fitzpatrick	ccdd2e6650	cmd/derper: add a README ... Updates tailscale/corp#20844 Change-Id: Ie3ca5dd7f582f4f298339dd3cd2039243c204ef8 Co-authored-by: James Tucker <james@tailscale.com> Co-authored-by: Maisem Ali <maisem@tailscale.com> Co-authored-by: Andrew Dunham <andrew@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Percy Wegmann	d7fdc01f7f	ssh/tailssh: check IsSELinuxEnforcing in tailscaled process ... Checking in the incubator as this used to do fails because the getenforce command is not on the PATH. Updates #12442 Signed-off-by: Percy Wegmann <percy@tailscale.com>	5 months ago
Jonathan Nobels	02e3c046aa	net/dns: re-query system resolvers on no-upstream resolver failure on apple platforms (#12398) ... Fixes tailscale/corp#20677 On macOS sleep/wake, we're encountering a condition where reconfigure the network a little bit too quickly - before apple has set the nameservers for our interface. This results in a persistent condition where we have no upstream resolver and fail all forwarded DNS queries. No upstream nameservers is a legitimate configuration, and we have no (good) way of determining when Apple is ready - but if we need to forward a query, and we have no nameservers, then something has gone badly wrong and the network is very broken. A simple fix here is to simply inject a netMon event, which will go through the configuration dance again when we hit the SERVFAIL condition. Tested by artificially/randomly returning [] for the list of nameservers in the bespoke ipn-bridge code responsible for getting the nameservers. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	5 months ago
Andrew Dunham	d0f1a838a6	net/dnscache: use parent context to perform lookup ... As an alterative to #11935 using #12003. Updates #11935 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I05f643fe812ceeaec5f266e78e3e529cab3a1ac3	5 months ago