tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	5aa5db89d6	cmd/tailscaled, wgengine/netstack: add start of gvisor userspace netstack work Not usefully functional yet (mostly a proof of concept), but getting it submitted for some work @namansood is going to do atop this. Updates #707 Updates #634 Updates #48 Updates #835	5 years ago
Brad Fitzpatrick	5efb0a8bca	cmd/tailscale: change formatting of "tailscale status" * show DNS name over hostname, removing domain's common MagicDNS suffix. only show hostname if there's no DNS name. but still show shared devices' MagicDNS FQDN. * remove nerdy low-level details by default: endpoints, DERP relay, public key. They're available in JSON mode still for those who need them. * only show endpoint or DERP relay when it's active with the goal of making debugging easier. (so it's easier for users to understand what's happening) The asterisks are gone. * remove Tx/Rx numbers by default for idle peers; only show them when there's traffic. * include peers' owner login names * add CLI option to not show peers (matching --self=true, --peers= also defaults to true) * sort by DNS/host name, not public key * reorder columns	5 years ago
Brad Fitzpatrick	b5b9866ba2	wgengine/magicsock: copy self DNS name to PeerStatus, re-fill OS The OS used to be sent back from the server but that has since been removed as being redundant.	5 years ago
Josh Bleecher Snyder	1271e135cd	wgengine/tstun: initialize wireguard-go TUN parameters This will enable us to remove the corresponding code from our fork of wireguard-go. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	1e4604f60e	wgengine: quiet some wireguard-go logging The log lines that wireguard-go prints as it starts and stops its worker routines are mostly noise. They also happen after other work is completed, which causes failures in some of the log testing packages. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	e0c4ffa71f	wgengine/tsdns: respond with any available addrs for ALL queries This appears to have been the intent of the previous code, but in practice, it only returned A records. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Denton Gentry	df64b7abf8	Add IPv6 Reverse DNS Lookup test. To be honest I'm not fond of Golden Bytes tests like this, but not so much as to want to rewrite the whole test. The DNS byte format is essentially immutable at this point, the encoded bytes aren't going to change. The rest of the test assumptions about hostnames might, but we can fix that when it comes. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	5 years ago
Alex Brainman	9985b3f1ed	wgengine/monitor: close closeHandle `eccc167` introduced closeHandle which opened the handle, but never closed it. Windows handles should be closed. Updates #921 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	5 years ago
Brad Fitzpatrick	e8ae355bb8	ipn: delete domainsForProxying, require explicit DNS search domains (mapver 9) (#1078 ) Previously the client had heuristics to calculate which DNS search domains to set, based on the peers' names. Unfortunately that prevented us from doing some things we wanted to do server-side related to node sharing. So, bump MapRequest.Version to 9 to signal that the client only uses the explicitly configured DNS search domains and doesn't augment it with its own list. Updates tailscale/corp#1026 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	86fe22a1b1	Update netaddr, and adjust wgengine/magicsock due to API change. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	0d94fe5f69	wgengine/router: disable IPv6 on Linux if ip rule -6 fails (#1074 ) Updates #562 Fixes #973 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Matt Layher	bfbd6b9241	go.mod: bump github.com/mdlayher/netlink to v1.2.0 Signed-off-by: Matt Layher <mdlayher@gmail.com>	5 years ago
Brad Fitzpatrick	80c94168ae	wgengine: finish updating isTrimmablePeer I accidentally merged Dave's change with the XXXX DO NOT SUBMIT comment in it.	5 years ago
David Anderson	cb96b14bf4	net/packet: remove the custom IP4/IP6 types in favor of netaddr.IP. Upstream netaddr has a change that makes it alloc-free, so it's safe to use in hot codepaths. This gets rid of one of the many IP types in our codebase. Performance is currently worse across the board. This is likely due in part to netaddr.IP being a larger value type (4b -> 24b for IPv4, 16b -> 24b for IPv6), and in other part due to missing low-hanging fruit optimizations in netaddr. However, the regression is less bad than it looks at first glance, because we'd micro-optimized packet.IP* in the past few weeks. This change drops us back to roughly where we were at the 1.2 release, but with the benefit of a significant code and architectural simplification. name old time/op new time/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 12.2ns ± 5% 29.7ns ± 2% +142.32% (p=0.008 n=5+5) Decode/tcp6-8 12.6ns ± 3% 65.1ns ± 2% +418.47% (p=0.008 n=5+5) Decode/udp4-8 11.8ns ± 3% 30.5ns ± 2% +157.94% (p=0.008 n=5+5) Decode/udp6-8 27.1ns ± 1% 65.7ns ± 2% +142.36% (p=0.016 n=4+5) Decode/icmp4-8 24.6ns ± 2% 30.5ns ± 2% +23.65% (p=0.016 n=4+5) Decode/icmp6-8 22.9ns ±51% 65.5ns ± 2% +186.19% (p=0.008 n=5+5) Decode/igmp-8 18.1ns ±44% 30.2ns ± 1% +66.89% (p=0.008 n=5+5) Decode/unknown-8 20.8ns ± 1% 10.6ns ± 9% -49.11% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 30.5ns ± 1% 77.9ns ± 3% +155.01% (p=0.008 n=5+5) Filter/tcp4_syn_in-8 43.7ns ± 3% 123.0ns ± 3% +181.72% (p=0.008 n=5+5) Filter/tcp4_syn_out-8 24.5ns ± 2% 45.7ns ± 6% +86.22% (p=0.008 n=5+5) Filter/udp4_in-8 64.8ns ± 1% 210.0ns ± 2% +223.87% (p=0.008 n=5+5) Filter/udp4_out-8 119ns ± 0% 278ns ± 0% +133.78% (p=0.016 n=4+5) Filter/icmp6-8 40.3ns ± 2% 204.4ns ± 4% +407.70% (p=0.008 n=5+5) Filter/tcp6_syn_in-8 35.3ns ± 3% 199.2ns ± 2% +464.95% (p=0.008 n=5+5) Filter/tcp6_syn_out-8 32.8ns ± 2% 81.0ns ± 2% +147.10% (p=0.008 n=5+5) Filter/udp6_in-8 106ns ± 2% 290ns ± 2% +174.48% (p=0.008 n=5+5) Filter/udp6_out-8 184ns ± 2% 314ns ± 3% +70.43% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/tstun goos:linux goarch:amd64 Write-8 9.02ns ± 3% 8.92ns ± 1% ~ (p=0.421 n=5+5) name old alloc/op new alloc/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00B 0.00B ~ (all equal) Decode/tcp6-8 0.00B 0.00B ~ (all equal) Decode/udp4-8 0.00B 0.00B ~ (all equal) Decode/udp6-8 0.00B 0.00B ~ (all equal) Decode/icmp4-8 0.00B 0.00B ~ (all equal) Decode/icmp6-8 0.00B 0.00B ~ (all equal) Decode/igmp-8 0.00B 0.00B ~ (all equal) Decode/unknown-8 0.00B 0.00B ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp4_in-8 0.00B 0.00B ~ (all equal) Filter/udp4_out-8 16.0B ± 0% 64.0B ± 0% +300.00% (p=0.008 n=5+5) Filter/icmp6-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp6_in-8 0.00B 0.00B ~ (all equal) Filter/udp6_out-8 48.0B ± 0% 64.0B ± 0% +33.33% (p=0.008 n=5+5) name old allocs/op new allocs/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00 0.00 ~ (all equal) Decode/tcp6-8 0.00 0.00 ~ (all equal) Decode/udp4-8 0.00 0.00 ~ (all equal) Decode/udp6-8 0.00 0.00 ~ (all equal) Decode/icmp4-8 0.00 0.00 ~ (all equal) Decode/icmp6-8 0.00 0.00 ~ (all equal) Decode/igmp-8 0.00 0.00 ~ (all equal) Decode/unknown-8 0.00 0.00 ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp4_in-8 0.00 0.00 ~ (all equal) Filter/udp4_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Filter/icmp6-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp6_in-8 0.00 0.00 ~ (all equal) Filter/udp6_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Crawshaw	2b2a16d9a2	wgengine/router/dns: reduce windows registry key open timeout The windows key timeout is longer than the wgengine watchdog timeout, which means we never reach the timeout, instead the process exits. Reduce the timeout so if we do hit it, at least the process continues. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
David Crawshaw	b4f70d8232	wgengine/router/dns: use the correct interface GUID On Win10, there's a hardcoded GUID and this works. On Win7, this GUID changes and we need to ask the tun for its LUID and convert that from the GUID. This commit uses the computed GUID that is placed in InterfaceName. Diagnosed by Jason Donnenfeld. (Thanks!)	5 years ago
Brad Fitzpatrick	15c064f76f	wgengine/router/dns: remove unsafe endianness detection on Linux	5 years ago
Brad Fitzpatrick	f9659323df	wgengine/router/dns: fix typo in comment	5 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	294ceb513c	ipn, wgengine/magicsock: fix `tailscale status` display. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	891110e64c	wgengine: expand lazy config to work with dual-stacked peers. Lazy wg configuration now triggers if a peer has only endpoint addresses (/32 for IPv4, /128 for IPv6). Subnet routers still trigger eager configuration to avoid the need for a CIDR match in the hot packet path. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	c8c493f3d9	wgengine/magicsock: make ReceiveIPv4 a little easier to follow. The previous code used a lot of whole-function variables and shared behavior that only triggered based on prior action from a single codepath. Instead of that, move the small amounts of "shared" code into each switch case. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	0ad109f63d	wgengine/magicsock: move legacy endpoint creation into legacy.go. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	f873da5b16	wgengine/magicsock: move more legacy endpoint handling. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	58fcd103c4	wgengine/magicsock: move legacy sending code to legacy.go. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	65ae66260f	wgengine/magicsock: unexport AddrSet. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	c9b9afd761	wgengine/magicsock: move most legacy nat traversal bits to another file. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	741c513e51	wgengine/tsdns: fix error response marshaling, improve bad query logs Updates #995 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	554a20becb	wgengine/magicsock: only log about lazy config when actually doing lazy config. Before, tailscaled would log every 10 seconds when the periodic noteRecvActivity call happens. This is noisy, but worse it's misleading, because the message suggests that the disco code is starting a lazy config run for a missing peer, whereas in fact it's just an internal piece of keepalive logic. With this change, we still log when going from 0->1 tunnel for the peer, but not every 10s thereafter. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	fa412c8760	wgengine/filter, wgengine/magicsock: use new IP.BitLen to simplify some code	5 years ago
Brad Fitzpatrick	afcf134812	wgengine/filter, tailcfg: support CIDRs+ranges in PacketFilter (mapver 7) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	9cee0bfa8c	wgengine/magicsock: sprinkle more docstrings. Magicsock is too damn big, but this might help me page it back in faster next time. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	6db9c4a173	wgenginer/router/dns: use constant from golang.org/x/sys/windows Made available in https://golang.org/cl/277153	5 years ago
Aleksandar Pesic	0dc295a640	Isolate WireGuard code into a separate file with appropriate copyright info in header. Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	5 years ago
Aleksandar Pesic	d854fe95d2	Trivial change in function description. Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	5 years ago
Aleksandar Pesic	338fd44657	Replace registry-access code, update wireguard-go and x/sys/windows. Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	5 years ago
Aleksandar Pesic	274d32d0aa	Prepare for the new wireguard-go API. Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	5 years ago
Brad Fitzpatrick	7b92f8e718	wgengine/magicsock: add start of magicsock benchmarks (Conn.ReceiveIPv4 for now) And only single-threaded for now. Will get fancier later. Updates #414	5 years ago
Brad Fitzpatrick	713cbe84c1	wgengine/magicsock: use net.JoinHostPort when host might have colons (udp6) Only affected tests. (where it just generated log spam)	5 years ago
David Anderson	be6fe393c5	wgengine: don't try pinging IPv6 addresses in legacy pinger. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	eccc167733	wgengine/monitor: fix memory corruption in Windows implementation I used the Windows APIs wrong previously, but it had worked just enough. Updates #921 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d9e2edb5ae	wgengine: reconfigure wireguard peer in two steps when its disco key changes First remove the device (to clear its wireguard session key), and then add it back. Fixes #929 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	3c508a58cc	wgengine/filter: don't filter GCP DNS. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	fc8bc76e58	wgengine/router: lock goroutine to OS thread before using OLE [windows] See https://github.com/tailscale/tailscale/issues/921#issuecomment-727526807 Not yet sure whether this is our problem, but it can't hurt at least, and seems like what we're supposed to do. Updates #921	5 years ago
David Anderson	2eb474dd8d	wgengine/filter: add test cases for len(dsts) > 1. While the code was correct, I broke it during a refactoring and tests didn't detect it. This fixes that glitch. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	ce45f4f3ff	wgengine/filter: inline ip6InList into match. matchIPsOnly gets 5% slower when inlining, despite significantly reduced memory ops and slightly tighter code. Part of #19. Filter/tcp6_syn_in-8 45.5ns ± 1% 42.4ns ± 2% -6.86% (p=0.000 n=10+10) Filter/udp6_in-8 107ns ± 2% 94ns ± 2% -11.50% (p=0.000 n=9+10) Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	3fdae12f0c	wgengine/filter: eliminate unnecessary memory loads. Doesn't materially affect benchmarks, but shrinks match6 by 30 instructions and halves memory loads. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	47380ebcfb	wgengine/filter: twiddle bits to optimize Part of #19. name old time/op new time/op delta Filter/icmp4-8 32.2ns ± 3% 32.5ns ± 2% ~ (p=0.524 n=10+8) Filter/icmp6-8 49.7ns ± 6% 43.1ns ± 4% -13.12% (p=0.000 n=9+10) Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	5062131aad	wgengine/filter: treat * as both a v4 and v6 wildcard. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	2d604b3791	net/packet: represent IP6 as two uint64s. For the operations we perform on these types (mostly net6.Contains), this encoding is much faster. Part of #19. name old time/op new time/op delta Filter/icmp4-8 27.5ns ± 1% 28.0ns ± 2% +1.89% (p=0.016 n=5+5) Filter/tcp4_syn_in-8 38.8ns ± 2% 38.3ns ± 1% -1.24% (p=0.024 n=5+5) Filter/tcp4_syn_out-8 27.6ns ±12% 24.6ns ± 1% ~ (p=0.063 n=5+5) Filter/udp4_in-8 71.5ns ± 5% 65.9ns ± 1% -7.94% (p=0.008 n=5+5) Filter/udp4_out-8 132ns ±13% 119ns ± 1% -10.29% (p=0.008 n=5+5) Filter/icmp6-8 169ns ±10% 54ns ± 1% -68.35% (p=0.008 n=5+5) Filter/tcp6_syn_in-8 149ns ± 6% 43ns ± 1% -71.11% (p=0.008 n=5+5) Filter/tcp6_syn_out-8 37.7ns ± 4% 24.3ns ± 3% -35.51% (p=0.008 n=5+5) Filter/udp6_in-8 179ns ± 5% 103ns ± 1% -42.75% (p=0.008 n=5+5) Filter/udp6_out-8 156ns ± 3% 191ns ± 1% +22.54% (p=0.008 n=5+5) Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	04ff3c91ee	wgengine/filter: add full IPv6 support. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	a664aac877	wgengine/router: disable IPv6 if v6 policy routing is unavailable. Fixes #895. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	19b0cfe89e	all: prepare for GOOS=ios in Go 1.16 Work with either way for now on iOS (darwin/arm64 vs ios/arm64). In February when Go 1.16 comes out we'll have a universal binary for darwin/arm64 (macOS) and will drop support for Go 1.15 and its darwin/amd64 meaning iOS. (it'll mean macOS). Context: * https://tip.golang.org/doc/go1.16#darwin * https://github.com/golang/go/issues/38485 * https://github.com/golang/go/issues/42100	5 years ago
David Anderson	c2cc3acbaf	net/packet: remove NewIP, offer only a netaddr constructor. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	55b1221db2	net/packet: support full IPv6 decoding. The packet filter still rejects all IPv6, but decodes enough from v6 packets to do something smarter in a followup. name time/op Decode/tcp4-8 28.8ns ± 2% Decode/tcp6-8 20.6ns ± 1% Decode/udp4-8 28.2ns ± 1% Decode/udp6-8 20.0ns ± 6% Decode/icmp4-8 21.7ns ± 2% Decode/icmp6-8 14.1ns ± 2% Decode/unknown-8 9.43ns ± 2% Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	89894c6930	net/packet: add IPv6 source and destination IPs to Parsed. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	450cfedeba	wgengine/magicsock: quiet an IPv6 warning in tests In tests, we force binding to localhost to avoid OS firewall warning dialogs. But for IPv6, we were trying (and failing) to bind to 127.0.0.1. You'd think we'd just say "localhost", but that's apparently ill defined. See https://tools.ietf.org/html/draft-ietf-dnsop-let-localhost-be-localhost and golang/go#22826. (It's bitten me in the past, but I can't remember specific bugs.) So use "::1" explicitly for "udp6", which makes the test quieter.	5 years ago
David Anderson	093431f5dd	net/packet: s/ParsedPacket/Parsed/ to avoid package stuttering. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	c48253e63b	wgengine/filter: add a method to run the packet filter without a packet. The goal is to move some of the shenanigans we have elsewhere into the filter package, so that all the weird things to do with poking at the filter is in a single place, behind clean APIs. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	7a54910990	wgengine/filter: remove helper vars, mark NewAllowAll test-only. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	76d99cf01a	wgengine/filter: remove the Matches type. It only served to obscure the underlying slice type without adding much value. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	b950bd60bf	wgengine/filter: add and clean up documentation. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	a8589636a8	wgengine/filter: remove unused Clone methods. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	b3634f020d	wgengine/filter: use netaddr types in public API. We still use the packet.* alloc-free types in the data path, but the compilation from netaddr to packet happens within the filter package. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	427bf2134f	net/packet: rename from wgengine/packet. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	19df6a2ee2	wgengine/packet: rename types to reflect their v4-only-ness, document. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	ebd96bf4a9	wgengine/router/dns: use OpenKeyWait to set DNS configuration. Fixes tailscale/corp#839. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	119101962c	wgengine/router: don't double-prefix dns log messages [Windows]	5 years ago
Brad Fitzpatrick	28f6552646	wgengine/router/dns: run ipconfig /registerdns async, log timing Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	01ee638cca	Change some os.IsNotExist to errors.Is(err, os.ErrNotExist) for non-os errors. os.IsNotExist doesn't unwrap errors. errors.Is does. The ioutil.ReadFile ones happened to be fine but I changed them so we're consistent with the rule: if the error comes from os, you can use os.IsNotExist, but from any other package, use errors.Is. (errors.Is always would also work, but not worth updating all the code) The motivation here was that we were logging about failure to migrate legacy relay node prefs file on startup, even though the code tried to avoid that. See golang/go#41122	5 years ago
David Anderson	68ddf134d7	wgengine/router/dns: issue ipconfig /registerdns when applying DNS settings. Amazingly, there doesn't seem to be a documented way of updating network configuration programmatically in a way that Windows takes notice of. The naturopathic remedy for this is to invoke ipconfig /registerdns, which does a variety of harmless things and also invokes the private API that tells windows to notice new adapter settings. This makes our DNS config changes stick within a few seconds of us setting them. If we're invoking a shell command anyway, why futz with the registry at all? Because netsh has no command for changing the DNS suffix list, and its commands for setting resolvers requires parsing its output and keeping track of which server is in what index. Amazingly, twiddling the registry directly is the less painful option. Fixes #853. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	508f5c3ae0	wgengine/router: fix bug where getInterfaceRoutes always returned an empty list Regression from `f2ce64f0c6 (r43710860)` Fixes #870	5 years ago
Brad Fitzpatrick	38bde61b3d	wgengine/router: make Windows firewall configuration async Updating the Windows firewall is usually reasonably fast, but sometimes blocks for 20 seconds, 4 minutes, etc. Not sure why. Until we understand that's happening, configure it in the background without blocking the normal control flow. Updates #785 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	fd2a30cd32	wgengine/magicsock: make test pass on Windows and without firewall dialog box Updates #50	5 years ago
Brad Fitzpatrick	ac866054c7	wgengine/magicsock: add a backoff on DERP reconnects Fixes #808	5 years ago
Brad Fitzpatrick	86c271caba	types/logger: move RusagePrefixLog to logger package, disable by default The RusagePrefixLog is rarely useful, hasn't been useful in a long time, is rarely the measurement we need, and is pretty spammy (and syscall-heavy). Disable it by default. We can enable it when we're debugging memory.	5 years ago
David Anderson	ff0cf6340a	wgengine/router: fix configuration of loopback netfilter rules for v6. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	105a820622	wgengine/magicsock: skip an endpoint update at start-up At startup the client doesn't yet have the DERP map so can't do STUN queries against DERP servers, so it only knows it local interface addresses, not its STUN-mapped addresses. We were reporting the interface-local addresses to control, getting the DERP map, and then immediately reporting the full set of updates. That was an extra HTTP request to control, but worse: it was an extra broadcast from control out to all the peers in the network. Now, skip the initial update if there are no stun results and we don't have a DERP map. More work remains optimizing start-up requests/map updates, but this is a start. Updates tailscale/corp#557	5 years ago
Brad Fitzpatrick	746f03669c	wgengine: fix lazy wireguard config bug when disco keys change There was a bug with the lazy wireguard config code where, if the minimum set of peers to tell wireguard didn't change, we skipped calling userspaceEngine.updateActivityMapsLocked which updated the various data structures that matched incoming traffic to later reconfigure the minimum config. That meant if an idle peer restarted and changed discovery keys, we skipped updating our maps of disco keys/IPs that would caused us to lazily inflate the config for that peer later if/when it did send traffic.	5 years ago
Brad Fitzpatrick	2076a50862	wgengine/magicsock: finish a comment sentence that ended prematurely	5 years ago
Alex Brainman	f2ce64f0c6	wgengine/router: unfork winipcfg-go package, use upstream Use golang.zx2c4.com/wireguard/windows/tunnel/winipcfg instead of github.com/tailscale/winipcfg-go package. Updates #760 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	5 years ago
Brad Fitzpatrick	22c462bd91	wgengine/monitor: fix copy/paste-o to actually monitor route changes Due to a copy/paste-o, we were monitoring address changes twice, and not monitoring route changes at all. Verified with 'tailscale debug --monitor' that this actually works now (while running 'route add 10.3.0.0 mask 255.255.0.0 10.0.0.1' and 'route delete (same)' back and forth in cmd.exe) In practice route changes are accompanied by address changes and this doesn't fix any known issues. I just noticed this while reading this code again. But at least the code does what it was trying to do now.	5 years ago
Avery Pennarun	0e5f2b90a5	echoRespondToAll: filter.Accept rather than filter.Drop on a match. This function is only called in fake mode, which won't do anything more with the packet after we respond to it anyway, so dropping it in the prefilter is not necessary. And it's kinda semantically wrong: we did not reject it, so telling the upper layer that it was rejected produces an ugly error message. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	5041800ac6	wgengine/tstun/faketun: it's a null tunnel, not a loopback. At some point faketun got implemented as a loopback (put a packet in from wireguard, the same packet goes back to wireguard) which is not useful. It's supposed to be an interface that just sinks all packets, and then wgengine adds only and ICMP Echo responder as a layer on top. This caused extremely odd bugs on darwin, where the special case that reinjects packets from local->local was filling the loopback channel and creating an infinite loop (which became jammed since the reader and writer were in the same goroutine). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Brad Fitzpatrick	3e4c46259d	wgengine/magicsock: don't do netchecks either when network is down A continuation of `6ee219a25d` Updates #640	5 years ago
Brad Fitzpatrick	6ee219a25d	ipn, wgengine, magicsock, tsdns: be quieter and less aggressive when offline If no interfaces are up, calm down and stop spamming so much. It was noticed as especially bad on Windows, but probably was bad everywhere. I just have the best network conditions testing on a Windows VM. Updates #604	5 years ago
Brad Fitzpatrick	587bdc4280	ipn, wgengine: disable subnet routes if network has PAC configuration Not configurable yet. Updates tailscale/corp#653 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	c493e5804f	wgengine/router: make v6-ness configurable in test, for consistent results. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	c86761cfd1	Remove tuntap references. We only use TUN.	5 years ago
Brad Fitzpatrick	01098f41d0	wgengine/tstun: fix typo in comment	5 years ago
Brad Fitzpatrick	73cc2d8f89	wgengine/filter: also silently drop link-local unicast traffic Updates #629	5 years ago
Brad Fitzpatrick	5f807c389e	wgengine/filter: drop multicast packets out, don't log about them Eventually we'll probably support multicast. For now it's just log spam. Fixes #629	5 years ago
Brad Fitzpatrick	bbb56f2303	wgengine/router: fix tests on Debian Buster as regular user on machine with IPv6	5 years ago
David Anderson	fddbcb0c7b	wgengine/router: support various degrees of broken IPv6. Gracefully skips touching the v6 NAT table on systems that don't have it, and doesn't configure IPv6 at all if IPv6 is globally disabled. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	0d80904fc2	wgengine/router: set up basic IPv6 routing/firewalling. Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	f0ef561049	wgengine/tsdns: use netns to obtain a socket Fixes #789 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	6e8328cba5	wgengine/tsdns: replace connections when net link changes (macOS) When the network link changes, existing UDP sockets fail immediately and permanently on macOS. The forwarder set up a single UDP conn and never changed it. As a result, any time there was a network link change, all forwarded DNS queries failed. To fix this, create a new connection when send requests fail because of network unreachability. This change is darwin-only, although extended it to other platforms should be straightforward. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	1fd10061fd	wgengine/tsdns: delegate bonjour service rdns requests While we're here, parseQuery into a plain function. This is helpful for fuzzing. (Which I did a bit of. Didn't find anything.) And clean up a few minor things. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	2d0ed99672	wgengine, wgengine/router: add a bunch of (temporary?) engine creation logging Trying to debug what's slow on a user's machine. Updates #785	5 years ago
Brad Fitzpatrick	7c11f71ac5	wgengine/router: ignore errors deleting 169.254.255.255/32 route on Windows Updates #785	5 years ago
David Anderson	b7e0ff598a	wgengine: don't close tundev in NewUserspaceEngine. newUserspaceEngineAdvanced closes the tun device on error already. Fixes #783. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	5d8b88be88	control/controlclient, version/distro, wgengine: recognize OpenWrt And help out with missing packages. Thanks to @willangley for tips. Updates #724	5 years ago
Brad Fitzpatrick	3528d28ed1	wgengine/router: move Tailscale's winipcfg additions into wgengine/router Part of unforking our winipcfg-go and using upstream (#760), move our additions into our repo. (We might upstream them later if upstream has interest) Originally these were: @apenwarr: "Add ifc.SyncAddresses() and SyncRoutes()." `609dcf2df5` @bradfitz: "winipcfg: make Interface.AddRoutes do as much as possible, return combined error" `e9f93d53f3` @bradfitz: "prevent unnecessary Interface.SyncAddresses work; normalize IPNets in deltaNets" `decb9ee8e1`	5 years ago
Brad Fitzpatrick	fd77268770	wgengine/router: enumerate all interfaces when finding Tailscale adapter by GUID Might fix it. I've spent too much time failing to reproduce the issue. This doesn't seem to make it worse, though (it still runs for me), so I'll include this and see if it helps others while I still work on a reliable way to reproduce it. Updates tailscale/corp#474	5 years ago
Brad Fitzpatrick	5bcac4eaac	net/tshttpproxy: add GetProxyForURL negative cache Otherwise when PAC server is down, we log, and each log entry is a new HTTP request (from logtail) and a new GetProxyForURL call, which again logs, non-stop. This is also nicer to the WinHTTP service. Then also hook up link change notifications to the cache to reset it if there's a chance the network might work sooner.	5 years ago
Brad Fitzpatrick	64a24e796b	wgengine/tstun: fix 32-bit alignment again	5 years ago
Brad Fitzpatrick	afb2be71de	wgengine: add two missing TUN close calls	5 years ago
Brad Fitzpatrick	abe095f036	wgengine/tstun: make Close safe for concurrent use	5 years ago
Christina Wen	f0e9dcdc0a	wgengine/router: restore /etc/resolv.conf after tailscale down is called This change is to restore /etc/resolv.conf after tailscale down is called. This is done by setting the dns.Manager before errors occur. Error collection is also added. Fixes #723	5 years ago
Brad Fitzpatrick	acafe9811f	wgengine/router: run netsh advfirewall less, rename, document setFirewall	5 years ago
Christina Wen	48fbe93e72	wgengine/magicsock: clarify pre-disco 'tailscale ping' error message This change clarifies the error message when a user pings a peer that is using an outdated version of Tailscale.	5 years ago
Christina Wen	e862f90e34	wgengine/router/router_linux.go: fixed " route del failed" error (#756 ) * wgengine/router/router_linux.go: Switched `cidrDiff("addr")` and `cidrDiff("route")` order Signed-off-by: Christina Wen <christina@tailscale.com> Co-authored-by: Christina Wen <christina@tailscale.com>	5 years ago
Brad Fitzpatrick	7e9d1f7808	wgengine/router: tighten isMissingIPv6Err So it doesn't false positive if misused. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	8f5b52e571	net/netns: add windows support. Also remove rebinding logic from the windows router. Magicsock will instead rebind based on link change signals. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	a5d701095b	wgengine/magicsock: increase test timeout to reduce flakiness Updates #654. See that issue for a discussion of why this timeout reduces flakiness, and what next steps are. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	0c0239242c	wgengine/magicsock: make discoPingPurpose a stringer It was useful for debugging once, it'll probably be useful again. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Josh Bleecher Snyder	6e38d29485	wgengine/magicsock: improve test logging output This fixes line numbers and reduces timestamp precision to overwhelming the output. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	a084c44afc	wgengine, wgengine/router, cmd/tailscale: force netfilter mode off on Synology For now. Get it working again so it's not stuck on 0.98. Subnet relay can come later. Updates #451 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	31c13013ae	wgengine/router: tolerate disabled IPv6 on Windows Fixes #412 Updates #524 (maybe fixes?) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	37b40b035b	wgengine/router/dns: appease staticcheck (again)	5 years ago
Josh Bleecher Snyder	a877dd575c	wgengine/router/dns: remove unnecessary lint ignore line Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Brad Fitzpatrick	913c1bd04f	wgengine/router: on Windows, add a firewall rule to allow Tailscale Updates tailscale/tailscale#454	5 years ago
Josh Bleecher Snyder	57e642648f	wgengine/magicsock: fix typo in comment	5 years ago
Brad Fitzpatrick	6d14678009	wgengine/router: remove unnecessary newlines in log.Printf formats	5 years ago
Brad Fitzpatrick	09d56f54a7	wgengine/router: fix Windows route sorting that caused de-dup to not work (#727 ) Updates #725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	9b07517f18	wgengine: add Engine.SetLinkChangeCallback Start of making the IPN state machine react to link changes and down its DNS & routes if necessary to unblock proxy resolution (e.g. for transitioning from public to corp networks where the corp network has mandatory proxies and WPAD PAC files that can't be resolved while using the DNS/routes configured previously) This change should be a no-op. Just some callback plumbing.	5 years ago
Dmytro Shynkevych	cb5f3c0819	tsdns: log when settings upstreams. It turns out that otherwise we don't know what exactly was set. Also remove the now unused RootDomain config option. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	aa1da24f18	tsdns: remove now unused fields. Missed in `7541982635`. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	7541982635	tsdns: remove forwarding queue. Two levels of queueing are unnecessary. The resulting implementation performs as follows under request bursts (`count` packets sent concurrently): lost count avg latency 0 / 256 (00.00%) - 28ms 0 / 512 (00.00%) - 146ms 0 / 768 (00.00%) - 166ms 0 / 1024 (00.00%) - 416ms 11 / 1280 (00.86%) - 430ms 145 / 1536 (09.44%) - 715ms 364 / 2048 (17.77%) - 836ms Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	34a7e7c12b	tsdns: be more strict with type validation. Previously, a type AAAA query would be answered with an A record if only an IPv4 address was available. This is irrelevant for us while we only use IPv4, but it will be a bug one day, so it's worth being precise about semantics. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	bc34788e65	tsdns: fix accidental rejection of all non-{A, AAAA} questions. This is a bug introduced in `a903d6c2ed`. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	756d6a72bd	wgengine: lazily create peer wireguard configs more explicitly Rather than consider bigs jumps in last-received-from activity as a signal to possibly reconfigure the set of wireguard peers to have configured, instead just track the set of peers that are currently excluded from the configuration. Easier to reason about. Also adds a bit more logging. This might fix an error we saw on a machine running a recent unstable build: 2020-08-26 17:54:11.528033751 +0000 UTC: 8.6M/92.6M magicsock: [unexpected] lazy endpoint not created for [UcppE], d:42a770f678357249 2020-08-26 17:54:13.691305296 +0000 UTC: 8.7M/92.6M magicsock: DERP packet received from idle peer [UcppE]; created=false 2020-08-26 17:54:13.691383687 +0000 UTC: 8.7M/92.6M magicsock: DERP packet from unknown key: [UcppE] If it does happen again, though, we'll have more logs.	5 years ago
halulu	f27a57911b	cmd/tailscale: add derp and endpoints status (#703 ) cmd/tailscale: add local node's information to status output (by default) RELNOTE=yes Updates #477 Signed-off-by: Halulu <lzjluzijie@gmail.com>	5 years ago
David Crawshaw	dd2c61a519	magicsock: call RequestStatus when DERP connects Second attempt. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
David Crawshaw	a67b174da1	Revert "magicsock: call RequestStatus when DERP connects" Seems to break linux CI builder. Cannot reproduce locally, so attempting a rollback. This reverts commit `cd7bc02ab1`. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
David Crawshaw	cd7bc02ab1	magicsock: call RequestStatus when DERP connects Without this, a freshly started ipn client will be stuck in the "Starting" state until something triggers a call to RequestStatus. Usually a UI does this, but until then we can sit in this state until poked by an external event, as is evidenced by our e2e tests locking up when DERP is attached. (This only recently became a problem when we enabled lazy handshaking everywhere, otherwise the wireugard tunnel creation would also trigger a RequestStatus.) Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	24d1a38e81	wgengine/monitor: add a poller to the Windows link change monitor The poller is slow by default, but speeds up for a bit after a network change, in case WPAD/PAC files are still loading.	5 years ago
Dmytro Shynkevych	a903d6c2ed	tailcfg, tsdns: derive root domains from list of nodes (#708 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Disconnect3d	44598e3e89	wgengine/monitor_freebsd.go: remove duplicated errcheck Signed-off-by: disconnect3d <dominik.b.czarnota@gmail.com>	5 years ago
Brad Fitzpatrick	7841c97af5	wgengine: make lazy wireguard on by default It can still be explicitly enabled or disabled via the environment variable, then via control. But the default is to be lazy now.	5 years ago
Dmytro Shynkevych	6c71e5b851	tsdns: copy name when loewrcasing. The previous approach modifies name in-place in the request slice to avoid an allocation. This is incorrect: the question section of a DNS request must be copied verbatim, without any such modification. Software may rely on it (we rely on other resolvers doing it it in tsdns/forwarder). Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	1886dfdca3	tsdns: lowercase the name in parseQuery. Domains in DNS should be case-insensitive. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	9337a99dff	tailcfg, wgengine, controlclient: add control-side gating of lazy WG config	5 years ago
chungdaniel	4d56d19b46	control/controlclient, wgengine/filter: extract parsePacketFilter to … (#696 ) control/controlclient, wgengine/filter: extract parsePacketFilter to new constructor in wgengine/filter Signed-off-by: chungdaniel <daniel@tailscale.com>	5 years ago
Brad Fitzpatrick	461db356b9	wgengine/router/dns: fix staticcheck error on Mac	5 years ago
Dmytro Shynkevych	1af70e2468	tsdns: delegate requests asynchronously (#687 ) Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	a583e498b0	router/dns: set all domains on Windows (#672 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	f6dc47efe4	tailcfg, controlclient, magicsock: add control feature flag to enable DRPO Updates #150	5 years ago
Brad Fitzpatrick	dbb4c246fa	wgengine/monitor: add Windows linkchange monitor Updates tailscale/corp#553 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	85c3d17b3c	wgengine/magicsock: use disco ping src as a candidate endpoint Consider: Hard NAT (A) <---> Hard NAT w/ mapped port (B) If A sends a packet to B's mapped port, A can disco ping B directly, with low latency, without DERP. But B couldn't establish a path back to A and needed to use DERP, despite already logging about A's endpoint and adding a mapping to it for other purposes (the wireguard conn.Endpoint lookup also needed it). This adds the tracking to discoEndpoint too so it'll be used for finding a path back. Fixes tailscale/corp#556 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	0512fd89a1	wgengine/magicsock: simplify handlePingLocked It's no longer true that 'de may be nil'	5 years ago
Brad Fitzpatrick	b983e5340f	wgengine/monitor: add, clean up netlink logging on route changes Updates #643	5 years ago
Mike Kramlich	6fa7a9a055	wgengine/router/router_userspace_bsd: on Mac the route program syntax expects delete not del -- this had caused router reconfig to fail in some cases. Fixes #673 Signed-off-by: Mike Kramlich <groglogic@gmail.com>	5 years ago
Dmytro Shynkevych	95a18f815c	router/dns: detect host endianness for NetworkManager. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	b97aac1718	net/interfaces: include DefaultRouteInterface in interfaces.State And log it in wgengine on change. Changing bug in #643. Updates #643	5 years ago
Brad Fitzpatrick	84dc891843	cmd/tailscale/cli: add ping subcommand For example: $ tailscale ping -h USAGE ping <hostname-or-IP> FLAGS -c 10 max number of pings to send -stop-once-direct true stop once a direct path is established -verbose false verbose output $ tailscale ping mon.ts.tailscale.com pong from monitoring (100.88.178.64) via DERP(sfo) in 65ms pong from monitoring (100.88.178.64) via DERP(sfo) in 252ms pong from monitoring (100.88.178.64) via [2604:a880:2:d1::36:d001]:41641 in 33ms Fixes #661 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	c64a43a734	wgengine/router: set MTU on Windows to min(configured,possible) Fixes tailscale/corp#542 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Josh Bleecher Snyder	2622e8e082	wgenginer/router: fix build Rebasing github.com/tailscale/wireguard-go to upstream wireguard-go changed the API. This commit is analogous to https://git.zx2c4.com/wireguard-windows/commit/?id=6823cc10ffe193c0cb1d61a5d1828d563d3d0e5f	5 years ago
Dmytro Shynkevych	cb01058a53	wgengine: stop giving tsdns a buffer that will be reused Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	9a346fd8b4	wgengine,magicsock: fix two lazy wireguard config issues 1) we weren't waking up a discoEndpoint that once existed and went idle for 5 minutes and then got a disco message again. 2) userspaceEngine.noteReceiveActivity had a buggy check; fixed and added a test	5 years ago
Dmytro Shynkevych	78c2e1ff83	tsdns: implement reverse DNS lookups, canonicalize names everywhere. (#640 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	41c4560592	control/controlclient: remove unused NetworkMap.UAPI method And remove last remaining use of wgcfg.ToUAPI in a test's debug output; replace it with JSON.	5 years ago
Brad Fitzpatrick	cff737786e	wgengine/magicsock: fix lazy config deadlock, document more lock ordering This removes the atomic bool that tried to track whether we needed to acquire the lock on a future recursive call back into magicsock. Unfortunately that hack doesn't work because we also had a lock ordering issue between magicsock and userspaceEngine (see issue). This documents that too. Fixes #644	5 years ago
Brad Fitzpatrick	43bc86588e	wgengine/monitor: log RTM_DELROUTE details, fix format strings Updates #643	5 years ago
Brad Fitzpatrick	2bd9ad4b40	wgengine: fix deadlock between engine and magicsock	5 years ago
Brad Fitzpatrick	7c38db0c97	wgengine/magicsock: don't deadlock on pre-disco Endpoints w/ lazy wireguard configs Fixes tailscale/tailscale#637	5 years ago
Brad Fitzpatrick	4987a7d46c	wgengine/magicsock: when hard NAT, add stun-ipv4:static-port as candidate If a node is behind a hard NAT and is using an explicit local port number, assume they might've mapped a port and add their public IPv4 address with the local tailscaled's port number as a candidate endpoint.	5 years ago
Brad Fitzpatrick	bfcb0aa0be	wgengine/magicsock: deflake tests, Close deadlock again Better fix than `37903a9056` Fixes tailscale/corp#533	5 years ago
Brad Fitzpatrick	da3b50ad88	wgengine/filter: omit logging for all v6 multicast, remove debug panic :(	5 years ago
Dmytro Shynkevych	28e52a0492	all: dns refactor, add Proxied and PerDomain flags from control (#615 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	3e493e0417	wgengine: fix lazy wireguard config bug on sent packet minute+ later A comparison operator was backwards. The bad case went: * device A send packet to B at t=1s * B gets added to A's wireguard config * B gets packet (5 minutes pass) * some other activity happens, causing B to expire to be removed from A's network map, since it's been over 5 minutes since sent or received activity * device A sends packet to B at t=5m1s * normally, B would get added back, but the old send time was not zero (we sent earlier!) and the time comparison was backwards, so we never regenerated the wireguard config. This also refactors the code for legibility and moves constants up top, with comments.	5 years ago
Dmytro Shynkevych	8c850947db	router: split off sandboxed path from router_darwin (#624 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	cb970539a6	wgengine/magicsock: remove TODO comment that's no longer applicable	5 years ago
Brad Fitzpatrick	915f65ddae	wgengine/magicsock: stop disco activity on IPN stop Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	c180abd7cf	wgengine/magicsock: merge errClosed and errConnClosed	5 years ago
Brad Fitzpatrick	7cc8fcb784	wgengine/filter: remove leftover debug knob that staticcheck doesn't like	5 years ago
Brad Fitzpatrick	b4d97d2532	wgengine/filter: fix IPv4 IGMP spam omission, also omit ff02::16 spam And add tests. Fixes #618 Updates #402	5 years ago
Dmytro Shynkevych	2ce2b63239	router: stop iOS subprocess sandbox violations (#617 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	154d1cde05	router: reload systemd-resolved after changing /etc/resolv.conf (#619 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	b3fc61b132	wgengine: disable wireguard config trimming for now except iOS w/ many peers Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d55fdd4669	wgengine/magicsock: update, flesh out a TODO	5 years ago
Brad Fitzpatrick	d96d26c22a	wgengine/filter: don't spam logs on dropped outgoing IPv6 ICMP or IPv4 IGMP The OS (tries) to send these but we drop them. No need to worry the user with spam that we're dropping it. Fixes #402 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Dmytro Shynkevych	c7582dc234	ipn: fix netmap change tracking and dns map generation (#609 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	3e3c24b8f6	wgengine/packet: add IPVersion field, don't use IPProto to note version As prep for IPv6 log spam fixes in a future change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	f8e4c75f6b	wgengine/magicsock: check slightly less aggressively for connectivity. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	58b721f374	wgengine/magicsock: deflake some tests with an ugly hack Starting with `fe68841dc7`, some e2e tests got flaky. Rather than debug them (they're gnarly), just revert to the old behavior as far as those tests are concerned. The tests were somehow using magicsock without a private key and expecting it to do ... something. My goal with `fe68841dc7` was to stop log spam and unnecessary work I saw on the iOS app when when stopping the app. Instead, only stop doing that work on any transition from once-had-a-private-key to no-longer-have-a-private-key. That fixes what I wanted to fix while still making the mysterious e2e tests happy.	5 years ago
David Anderson	41d0c81859	wgengine/magicsock: make disco subtest name more precise. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	9beea8b314	wgengine/magicsock: remove unnecessary use of context. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	b62341d308	wgengine/magicsock: add docstring. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	9265296b33	wgengine/magicsock: don't deadlock on shutdown if sending blocks. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	0249236cc0	ipn/ipnstate: record assigned Tailscale IPs. wgengine/magicsock: use ipnstate to find assigned Tailscale IPs. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	c3958898f1	tstest/natlab: be a bit more lenient during test shutdown. There is a race in natlab where we might start shutdown while natlab is still running a goroutine or two to deliver packets. This adds a small grace period to try and receive it before continuing shutdown. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	7578c815be	wgengine/magicsock: give pinger a more generous packet timeout. The first packet to transit may take several seconds to do so, because setup rates in wgengine may result in the initial WireGuard handshake init to get dropped. So, we have to wait at least long enough for a retransmit to correct the fault. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	c3994fd77c	derp: remove OnlyDisco option. Active discovery lets us introspect the state of the network stack precisely enough that it's unnecessary, and dropping the initial DERP packets greatly slows down tests. Additionally, it's unrealistic since our production network will never deliver _only_ discovery packets, it'll be all or nothing. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	5455c64f1d	wgengine/magicsock: add a test for two facing endpoint-independent NATs. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	f794493b4f	wgengine/magicsock: explicitly check path discovery, add a firewall test. The test proves that active discovery can traverse two facing firewalls. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	f582eeabd1	wgengine/magicsock: add a test for active path discovery. Uses natlab only, because the point of this active discovery test is going to be that it should get through a lot of obstacles. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	37903a9056	wgengine/magicsock: fix occasional deadlock on Conn.Close on c.derpStarted The deadlock was: * Conn.Close was called, which acquired c.mu * Then this goroutine scheduled: if firstDerp { startGate = c.derpStarted go func() { dc.Connect(ctx) close(c.derpStarted) }() } * The getRegion hook for that derphttp.Client then ran, which also tries to acquire c.mu. This change makes that hook first see if we're already in a closing state and then it can pretend that region doesn't exist.	5 years ago
Brad Fitzpatrick	fe68841dc7	wgengine/magicsock: log better with less spam on transition to stopped state Required a minor test update too, which now needs a private key to get far enough to test the thing being tested.	5 years ago
Brad Fitzpatrick	e298327ba8	wgengine/magicsock: remove overkill, slow reflect.DeepEqual of NetworkMap No need to allocate or compare all the fields we don't care about.	5 years ago
Brad Fitzpatrick	4970e771ab	wgengine: add debug knob to disable the watchdog during debugging It launches goroutines and interferes with panic-based debugging, obscuring stacks.	5 years ago
David Anderson	3669296cef	wgengine/magicsock: refactor twoDevicePing to make stack construction cleaner. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	16a9cfe2f4	wgengine: configure wireguard peers lazily, as needed wireguard-go uses 3 goroutines per peer (with reasonably large stacks & buffers). Rather than tell wireguard-go about all our peers, only tell it about peers we're actively communicating with. That means we need hooks into magicsock's packet receiving path and tstun's packet sending path to lazily create a wireguard peer on demand from the network map. This frees up lots of memory for iOS (where we have almost nothing left for larger domains with many users). We should ideally do this in wireguard-go itself one day, but that'd be a pretty big change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	5066b824a6	wgengine/magicsock: don't log about disco ping timeouts if we have a working address Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a89d610a3d	wgengine/tstun: move sync.Pool to package global sync.Pools should almost always be packate globals, even though in this case we only have exactly 1 TUN device anyway, so it matters less. Still, it's unusual to see a Pool that's not a package global, so move it.	5 years ago
Dmytro Shynkevych	c53ab3111d	wgengine/router: support legacy resolvconf Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
David Anderson	189d86cce5	wgengine/router: don't use 88 or 8888 as table/rule numbers. We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	972a42cb33	wgengine/router: fix router_test to match the new marks. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	d60917c0f1	wgengine/router: switch packet marks to avoid conflict with Weave Net. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	c06d2a8513	wgengine/magicsock: fix typo in comment	5 years ago
Brad Fitzpatrick	bf195cd3d8	wgengine/magicsock: reduce log verbosity of discovery messages Don't log heartbeat pings & pongs. Track the reason for pings and then only log the ping/pong traffic if it was for initial path discovery.	5 years ago
Dmytro Shynkevych	a3e7252ce6	wgengine/router: use better NetworkManager API Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Eduardo Kienetz	5df6be9d38	Use LittleEndian for correct byte order on DNS IPs Nameserver IP 10.11.12.13 would otherwise get written to resolv.conf as 13.12.11.10, as was happening on my client. Signed-off-by: Eduardo Kienetz <eduardo@kienetz.com>	5 years ago
Brad Fitzpatrick	a6559a8924	wgengine/magicsock: run test DERP in mode where only disco packets allowed So we don't accidentally pass a NAT traversal test by having DERP pick up our slack when we really just wanted DERP as an OOB messaging channel.	5 years ago
Brad Fitzpatrick	10ac066013	all: fix vet warnings	5 years ago
Brad Fitzpatrick	d74c9aa95b	wgengine/magicsock: update comment, fix earlier commit `891898525c` had a continue that meant the didCopy synchronization never ran. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	c976264bd1	wgengine/magicsock: gofmt	5 years ago
Dmytro Shynkevych	f3e2b65637	wgengine/magicsock: time.Sleep -> time.After Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	380ee76d00	wgengine/magicsock: make time.Sleep in runDerpReader respect cancellation. Before this patch, the 250ms sleep would not be interrupted by context cancellation, which would result in the goroutine sometimes lingering in tests (100ms grace period). Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	891898525c	wgengine/magicsock: make receive from didCopy respect cancellation. Very rarely, cancellation occurs between a successful send on derpRecvCh and a call to copyBuf on the receiving side. Without this patch, this situation results in <-copyBuf blocking indefinitely. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	a2267aae99	wgengine: only launch pingers for peers predating the discovery protocol Peers advertising a discovery key know how to speak the discovery protocol and do their own heartbeats to get through NATs and keep NATs open. No need for the pinger except for with legacy peers.	5 years ago
Brad Fitzpatrick	cdfea347d0	wgengine: update for tailscale/wireguard-go API changes * update to new HandshakeDone signature * use new Device.IpcGetOperationFiltered call to avoid sending allowed_ips See `dd6c1c8fe1`	5 years ago
David Anderson	45578b47f3	tstest/natlab: refactor PacketHandler into a larger interface. The new interface lets implementors more precisely distinguish local traffic from forwarded traffic, and applies different forwarding logic within Machines for each type. This allows Machines to be packet forwarders, which didn't quite work with the implementation of Inject. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Dmytro Shynkevych	19867b2b6d	tstun: remove buggy-looking log line. This log line looks buggy, even though lacking a filter is expected during bringup. We already know if we forget to SetFilter: it breaks the magicsock test, so no useful information is lost. Resolves #559. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Wendi Yu	c3736250a4	wgengine: fix macos staticcheck errors (#557 ) Signed-off-by: Wendi <wendi.yu@yahoo.ca>	5 years ago
Dmytro Shynkevych	3b36400e35	tsdns: response to type ANY queries Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	2f15894a10	wgengine/magicsock: wait for derphttp client goroutine to exit Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	30bbbe9467	wgengine/router: dns: unify on *BSD, multimode on Linux, Magic DNS (#536 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	61abab999e	cmd/tailscaled: graceful shutdown (#534 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
David Anderson	88e8456e9b	wgengine/magicsock: add a connectivity test for facing firewalls. The test demonstrates that magicsock can traverse two stateful firewalls facing each other, that each require localhost to initiate connections. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	1f7b1a4c6c	wgengine/magicsock: rearrange TwoDevicePing test for future natlab tests. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	977381f9cc	wgengine/magicsock: make trivial natlab test pass. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	6c74065053	wgengine/magicsock, tstest/natlab: start hooking up natlab to magicsock Also adds ephemeral port support to natlab. Work in progress. Pairing with @danderson.	5 years ago
Dmytro Shynkevych	21d1dbfce0	wgengine/tsdns: local DNS server for testing Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	248d28671b	tsdns: fix race in delegate Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	bd59bba8e6	wgengine/magicsock: stop discoEndpoint timers on Close And add some defensive early returns on c.closed.	5 years ago
Brad Fitzpatrick	de875a4d87	wgengine/magicsock: remove DisableSTUNForTesting	5 years ago
Dmytro Shynkevych	67ebba90e1	tsdns: dual resolution mode, IPv6 support (#526 ) This change adds to tsdns the ability to delegate lookups to upstream nameservers. This is crucial for setting Magic DNS as the system resolver. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	ce1b52bb71	wgengine/monitor: fix other potential crashes on Linux Never return "nil, nil" anymore. The caller expected a usable interface now. I missed some of these earlier. Also, handle address deletion now. Updates #532	5 years ago
Brad Fitzpatrick	4b75a27969	wgengine/monitor: fix crash on Linux on type 21 messages Fixes #532	5 years ago
Brad Fitzpatrick	724ad13fe1	wgengine/tstun: fix alignment of 64-bit atomic field We had a test for it, but no 32-bit builder apparently. :( Fixes #529	5 years ago
Brad Fitzpatrick	4db60a8436	wgengine/monitor: parse Linux netlink messages, ignore our own events Fixes tailscale/corp#412 ("flood of link change events at start-up") Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	742b8b44a8	net/tsaddr: new package to hold Tailscale-specific IPs/ranges And update existing callers with (near) duplicated cases.	5 years ago
Brad Fitzpatrick	5c6d8e3053	netcheck, tailcfg, interfaces, magicsock: survey UPnP, NAT-PMP, PCP Don't do anything with UPnP, NAT-PMP, PCP yet, but see how common they are in the wild. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	6196b7e658	wgengine/magicsock: change API to not permit disco key changes Generate the disco key ourselves and give out the public half instead. Fixes #525	6 years ago
Brad Fitzpatrick	5132edacf7	wgengine/magicsock: fix data race from undocumented wireguard-go requirement Endpoints need to be Stringers apparently. Fixes tailscale/corp#422	6 years ago
Brad Fitzpatrick	630379a1d0	cmd/tailscale: add tailscale status region name, last write, consistently star There's a lot of confusion around what tailscale status shows, so make it better: show region names, last write time, and put stars around DERP too if active. Now stars are always present if activity, and always somewhere.	6 years ago
Brad Fitzpatrick	9a8700b02a	wgengine/magicsock: add discoEndpoint heartbeat Updates #483	6 years ago
Brad Fitzpatrick	9f930ef2bf	wgengine/magicsock: remove the discoEndpoint.timers map It ended up being more complicated than it was worth.	6 years ago
Brad Fitzpatrick	f5f3885b5b	wgengine/magicsock: bunch of misc discovery path cleanups * fix tailscale status for peers using discovery * as part of that, pull out disco address selection into reusable and testable discoEndpoint.addrForSendLocked * truncate ping/pong logged hex txids in half to eliminate noise * move a bunch of random time constants into named constants with docs * track a history of per-endpoint pong replies for future use & status display * add "send" and " got" prefix to discovery message logging immediately before the frame type so it's easier to read than searching for the "<-" or "->" arrows earlier in the line; but keep those as the more reasily machine readable part for later. Updates #483	6 years ago
Dmytro Shynkevych	e9643ae724	wgengine: prevent log after exit in watchdog test Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	6 years ago
Dmytro Shynkevych	16b2bbbbbb	wgengine: close in reverse order of bringup Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	6 years ago
Brad Fitzpatrick	6c70cf7222	wgengine/magicsock: stop ping timeout timer on pong receipt, misc log cleanup Updates #483	6 years ago
Brad Fitzpatrick	c52905abaa	wgengine/magicsock: log less on no-op disco route switches Also, renew trustBestAddrUntil even if latency isn't better.	6 years ago
Brad Fitzpatrick	0f0ed3dca0	wgengine/magicsock: clean up discovery logging Updates #483	6 years ago
Brad Fitzpatrick	056fbee4ef	wgengine/magicsock: add TS_DEBUG_OMIT_LOCAL_ADDRS knob to force STUN use only For debugging.	6 years ago
Brad Fitzpatrick	e03cc2ef57	wgengine/magicsock: populate discoOfAddr upon receiving ping frames Updates #483	6 years ago
Brad Fitzpatrick	275a20f817	wgengine/magicsock: keep discoOfAddr populated, use it for findEndpoint Update the mapping from ip:port to discokey, so when we retrieve a packet from the network, we can find the same conn.Endpoint that we gave to wireguard-go previously, without making it think we've roamed. (We did, but we're not using its roaming.) Updates #483	6 years ago
Brad Fitzpatrick	77e89c4a72	wgengine/magicsock: handle CallMeMaybe discovery mesages Roughly feature complete now. Testing and polish remains. Updates #483	6 years ago
Brad Fitzpatrick	710ee88e94	wgengine/magicsock: add timeout on discovery pings, clean up state Updates #483	6 years ago
Brad Fitzpatrick	77d3ef36f4	wgengine/magicsock: hook up discovery messages, upgrade to LAN works Ping messages now go out somewhat regularly, pong replies are sent, and pong replies are now partially handled enough to upgrade off DERP to LAN. CallMeMaybe packets are sent & received over DERP, but aren't yet handled. That's next (and regular maintenance timers), and then WAN should work. Updates #483	6 years ago
Brad Fitzpatrick	9b8ca219a1	wgengine/magicsock: remove allocs in UDP write, use new netaddr.PutUDPAddr The allocs were only introduced yesterday with a TODO. Now they're gone again.	6 years ago
Brad Fitzpatrick	7b3c0bb7f6	wgengine/magicsock: fix crash reading DERP packet Starting at yesterday's `e96f22e560` (convering some UDPAddrs to IPPorts), Conn.ReceiveIPv4 could return a nil addr, which would make its way through wireguard-go and blow up later. The DERP read path wasn't initializing the addr result parameter any more, and wgRecvAddr wasn't checking it either. Fixes #515	6 years ago
Brad Fitzpatrick	47b4a19786	wgengine/magicsock: use netaddr.ParseIPPort instead of net.ResolveUDPAddr	6 years ago
Brad Fitzpatrick	f7124c7f06	wgengine/magicsock: start of discoEndpoint state tracking Updates #483	6 years ago
Brad Fitzpatrick	92252b0988	wgengine/magicsock: add a little LRU cache for netaddr.IPPort lookups And while plumbing, a bit of discovery work I'll need: the endpointOfAddr map to map from validated paths to the discoEndpoint. Not being populated yet. Updates #483	6 years ago
Brad Fitzpatrick	2d6e84e19e	net/netcheck, wgengine/magicsock: replace more UDPAddr with netaddr.IPPort	6 years ago
Brad Fitzpatrick	9070aacdee	wgengine/magicsock: minor comments & logging & TODO changes	6 years ago
Brad Fitzpatrick	e96f22e560	wgengine/magicsock: start handling disco message, use netaddr.IPPort more Updates #483	6 years ago
Brad Fitzpatrick	a83ca9e734	wgengine/magicsock: cache precomputed nacl/box shared keys Updates #483	6 years ago
Brad Fitzpatrick	a975e86bb8	wgengine/magicsock: add new endpoint type used for discovery-supporting peers This adds a new magicsock endpoint type only used when both sides support discovery (that is, are advertising a discovery key). Otherwise the old code is used. So far the new code only communicates over DERP as proof that the new code paths are wired up. None of the actually discovery messaging is implemented yet. Support for discovery (generating and advertising a key) are still behind an environment variable for now. Updates #483	6 years ago
Brad Fitzpatrick	6f73f2c15a	wgengine, internal/deepprint: replace UAPI usage as hash func; add deepprint The new deepprint package just walks a Go data structure and writes to an io.Writer. It's not pretty like go-spew, etc. We then use it to replace the use of UAPI (which we have a TODO to remove) to generate signatures of data structures to detect whether anything changed (without retaining the old copy). This was necessary because the UAPI conversion ends up trying to do DNS lookups which an upcoming change depends on not happening.	6 years ago
Brad Fitzpatrick	103c06cc68	wgengine/magicsock: open discovery naclbox messages from known peers And track known peers. Doesn't yet do anything with the messages. (nor does it send any yet) Start of docs on the message format. More will come in subsequent changes. Updates #483	6 years ago
David Crawshaw	9258d64261	wgengine/router: do not call ifconfig up if SetRoutesFunc is set The NetworkExtension brings up the interface itself and does not have access to `ifconfig`, which the underlying BSD userspace router attempts to use when Up is called. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	6 years ago
Brad Fitzpatrick	23e74a0f7a	wgengine, magicsock, tstun: don't regularly STUN when idle (mobile only for now) If there's been 5 minutes of inactivity, stop doing STUN lookups. That means NAT mappings will expire, but they can resume later when there's activity again. We'll do this for all platforms later. Updates tailscale/corp#320 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	fe50cd0c48	ipn, wgengine: plumb NetworkMap down to magicsock Now we can have magicsock make decisions based on tailcfg.Debug settings sent by the server. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	19d95e095a	wgengine: fix blank line in interface method comment	6 years ago
Reinaldo de Souza	a8635784bc	wgengine: add BSD userspace router to darwin Darwin and FreeBSD are compatible enough to share the userspace router. The OSX router delegates to the BSD userspace router unless `SetRoutesFunc` is set. That preserves the mechanism that allows `ipn-go-bridge` to specify its own routing behavior. Fixes #177 Signed-off-by: Reinaldo de Souza <github@rei.nal.do>	6 years ago
Dmytro Shynkevych	de5f6d70a8	magicsock: eliminate logging race in test Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	6 years ago
Brad Fitzpatrick	53fb25fc2f	all: generate discovery key, plumb it around Not actually used yet. Updates #483	6 years ago
Brad Fitzpatrick	d9054da86a	wgengine: disambiguate Reconfig logging paths	6 years ago
Brad Fitzpatrick	abd79ea368	derp: reduce DERP memory use; don't require callers to pass in memory to use The magicsock derpReader was holding onto 65KB for each DERP connection forever, just in case. Make the derp{,http}.Client be in charge of memory instead. It can reuse its bufio.Reader buffer space.	6 years ago
Brad Fitzpatrick	280e8884dd	wgengine/magicsock: limit redundant log spam on packets from low-pri addresses Fixes #407 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
David Anderson	d05b0500ac	wgengine: loop back tuntap packets destined for local IPs. macOS incorrectly sends packets for the local Tailscale IP into our tunnel interface. We have to turn the packets around and send them back to the kernel. Fixes tailscale/corp#189. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Avery Pennarun	51d176ecff	wgengine: Remove leftover debug message. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Dmytro Shynkevych	07e02ec9d3	wgengine/tsdns: add test and prevent useless updates (#449 ) Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>	6 years ago
Dmytro Shynkevych	511840b1f6	tsdns: initial implementation of a Tailscale DNS resolver (#396 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	6 years ago
Dmytro Shynkevych	02231e968e	wgengine/tstun: add tests and benchmarks (#436 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	6 years ago
Dmytro Shynkevych	059b1d10bb	wgengine/packet: refactor and expose UDP header marshaling (#408 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	6 years ago
David Anderson	5a32f8e181	wgengine/router: also accept exit code 254 from `ip rule del`. iproute2 3.16.0-2 from Debian Jessie (oldoldstable) doesn't return exit code 2 when deleting a non-existent IP rule. Fixes #434 Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	08a38f21c9	wgengine/router: don't filter subnet routing in netfilter. We have a filter in tailscaled itself now, which is more robust against weird network topologies (such as the one Docker creates). Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Dmytro Shynkevych	73c40c77b0	filter: prevent escape of QDecode to the heap (#417 ) Performance impact: name old time/op new time/op delta Filter/tcp_in-4 70.7ns ± 1% 30.9ns ± 1% -56.30% (p=0.008 n=5+5) Filter/tcp_out-4 58.6ns ± 0% 19.4ns ± 0% -66.87% (p=0.000 n=5+4) Filter/udp_in-4 96.8ns ± 2% 55.5ns ± 0% -42.64% (p=0.016 n=5+4) Filter/udp_out-4 120ns ± 1% 79ns ± 1% -33.87% (p=0.008 n=5+5) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	6 years ago
Brad Fitzpatrick	722673f307	Update go4.org/mem, adjust to revised API.	6 years ago
Brad Fitzpatrick	9e5d79e2f1	wgengine/magicsock: drop a bytes.Buffer sync.Pool, use logger.ArgWriter instead	6 years ago
Brad Fitzpatrick	becce82246	net/netns, misc tests: remove TestOnlySkipPrivilegedOps, argv checks The netns UID check is sufficient for now. We can do something else later if/when needed.	6 years ago
Avery Pennarun	e7ae6a2e06	net/netns, wgengine/router: support Linux machines that don't have 'ip rule'. We'll use SO_BINDTODEVICE instead of fancy policy routing. This has some limitations: for example, we will route all traffic through the interface that has the main "default" (0.0.0.0/0) route, so machines that have multiple physical interfaces might have to go through DERP to get to some peers. But machines with multiple physical interfaces are very likely to have policy routing (ip rule) support anyway. So far, the only OS I know of that needs this feature is ChromeOS (crostini). Fixes #245. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	e46238a2af	wgengine: separately dedupe wireguard configs and router configs. Otherwise iOS/macOS will reconfigure their routing every time anything minor changes in the netmap (in particular, endpoints and DERP homes), which is way too often. Some users reported "network reconfigured" errors from Chrome when this happens. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	f0b6ba78e8	wgengine: don't pass nil router.Config objects. These are hard for swift to decode in the iOS app. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
David Anderson	5114df415e	net/netns: set the bypass socket mark on linux. This allows tailscaled's own traffic to bypass Tailscale-managed routes, so that things like tailscale-provided default routes don't break tailscaled itself. Progress on #144. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Brad Fitzpatrick	db2a216561	wgengine/magicsock: don't log on UDP send errors if address family known missing Fixes #376	6 years ago
David Crawshaw	cf5d25e15b	wgengine: ensure pingers are gone before returning from Close We canceled the pingers in Close, but didn't wait around for their goroutines to be cleaned up. This caused the ipn/e2e_test to catch pingers in its resource leak check. This commit introduces an object, but also simplifies the semantics around the pinger's cancel functions. They no longer need to be called while holding the mutex. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	6 years ago
Brad Fitzpatrick	9e3ad4f79f	net/netns: add package for start of network namespace support And plumb in netcheck STUN packets. TODO: derphttp, logs, control. Updates #144 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	a428656280	wgengine/magicsock: don't report v4 localhost addresses on IPv6-only systems Updates #376	6 years ago
David Anderson	fff062b461	wgengine/router: make runner.go linux-only for now. Otherwise, staticcheck complains that these functions are unused and unexported on macOS. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Avery Pennarun	f69003fd46	router_linux: work around terrible bugs in old iptables-compat versions. Specifically, this sequence: iptables -N ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT iptables -A FORWARD -j ts-forward doesn't work on Debian-9-using-nftables, but this sequence: iptables -N ts-forward iptables -A FORWARD -j ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT does work. I'm sure the reason why is totally fascinating, but it's an old version of iptables and the bug doesn't seem to exist on modern nftables, so let's refactor our code to add rules in the always-safe order and pretend this never happened. Fixes #401. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	9ff51909a3	router_linux: fix behaviour when switching --netfilter-mode. On startup, and when switching into =off and =nodivert, we were deleting netfilter rules even if we weren't the ones that added them. In order to avoid interfering with rules added by the sysadmin, we have to be sure to delete rules only in the case that we added them in the first place. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	a496cdc943	router_linux: remove need for iptables.ListChains(). Instead of retrieving the list of chains, or the list of rules in a chain, just try deleting the ones we don't want and then adding the ones we do want. An error in flushing/deleting still means the rule doesn't exist anymore, so there was no need to check for it first. This avoids the need to parse iptables output, which avoids the need to ever call iptables -S, which fixes #403, among other things. It's also much more future proof in case the iptables command line changes. Unfortunately the iptables go module doesn't properly pass the iptables command exit code back up when doing .Delete(), so we can't correctly check the exit code there. (exit code 1 really means the rule didn't exist, rather than some other weird problem). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	8a6bd21baf	router_linux: extract process runner routines into runner.go. These will probably be useful across platforms. They're not really Linux-specific at all. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	34c30eaea0	router_linux: use only baseline 'ip rule' features that exist in old kernels. This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	30e5c19214	magicsock: work around race condition initializing .Regions[]. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Dmytro Shynkevych	737124ef70	tstun: tolerate zero reads Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	6 years ago
Brad Fitzpatrick	b0c10fa610	stun, netcheck: move under net	6 years ago
Brad Fitzpatrick	43ded2b581	wgengine/packet: add some tests, more docs, minor Go style, performance changes	6 years ago
Brad Fitzpatrick	e6b84f2159	all: make client use server-provided DERP map, add DERP region support Instead of hard-coding the DERP map (except for cmd/tailscale netcheck for now), get it from the control server at runtime. And make the DERP map support multiple nodes per region with clients picking the first one that's available. (The server will balance the order presented to clients for load balancing) This deletes the stunner package, merging it into the netcheck package instead, to minimize all the config hooks that would've been required. Also fix some test flakes & races. Fixes #387 (Don't hard-code the DERP map) Updates #388 (Add DERP region support) Fixes #399 (wgengine: flaky tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
David Anderson	e8b3a5e7a1	wgengine/filter: implement a destination IP pre-filter. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	7fb33123d3	wgengine/router: warn about another variation of busybox's `ip`. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Dmytro Shynkevych	635f7b99f1	wgengine: pass tun.NativeDevice to router Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	6 years ago
David Anderson	9c914dc7dd	wgengine/router: stop using -m comment. The comment module is compiled out on several embedded systems (and also gentoo, because netfilter can't go brrrr with comments holding it back). Attempting to use comments results in a confusing error, and a non-functional firewall. Additionally, make the legacy rule cleanup non-fatal, because we do have to probe for the existence of these -m comment rules, and doing so will error out on these systems. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	3e27b3c33c	wgengine/router: more comments. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	0fe262f093	ipn: plumb NetfilterMode all the way out to the CLI. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	c67c8913c3	wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	292606a975	wgengine/router: support multiple levels of netfilter involvement. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Brad Fitzpatrick	e6d0c92b1d	wgengine/magicsock: clean up earlier fix a bit Move WaitReady from `fc88e34f42` into the test code, and keep the derp-reading goroutine named for debugging.	6 years ago
Avery Pennarun	d53e8fc0da	router_darwin_support: we can build this on every platform. Our new build scripts try to build ipn-go-bridge on more than just linux and darwin, so let's enable this file so it can be successful on every platform.	6 years ago
Avery Pennarun	fc88e34f42	wgengine/magicsock/tests: wait for home DERP connection before sending packets. This fixes an elusive test flake. Fixes #161. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	4f128745d8	magicsock/test: oops, fix a data race in nested-test logf hack. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	42a0e0c601	wgengine/magicsock/tests: call tstest.ResourceCheck for each test. This didn't catch anything yet, but it's good practice for detecting goroutine leaks that we might not find otherwise. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	08acb502e5	Add tstest.PanicOnLog(), and fix various problems detected by this. If a test calls log.Printf, 'go test' horrifyingly rearranges the output to no longer be in chronological order, which makes debugging virtually impossible. Let's stop that from happening by making log.Printf panic if called from any module, no matter how deep, during tests. This required us to change the default error handler in at least one http.Server, as well as plumbing a bunch of logf functions around, especially in magicsock and wgengine, but also in logtail and backoff. To add insult to injury, 'go test' also rearranges the output when a parent test has multiple sub-tests (all the sub-test's t.Logf is always printed after all the parent tests t.Logf), so we need to screw around with a special Logf that can point at the "current" t (current_t.Logf) in some places. Probably our entire way of using subtests is wrong, since 'go test' would probably like to run them all in parallel if you called t.Parallel(), but it definitely can't because the're all manipulating the shared state created by the parent test. They should probably all be separate toplevel tests instead, with common setup/teardown logic. But that's a job for another time. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Dmytro Shynkevych	33b2f30cea	wgengine: wrap tun.Device to support filtering and packet injection (#358 ) Right now, filtering and packet injection in wgengine depend on a patch to wireguard-go that probably isn't suitable for upstreaming. This need not be the case: wireguard-go/tun.Device is an interface. For example, faketun.go implements it to mock a TUN device for testing. This patch implements the same interface to provide filtering and packet injection at the tunnel device level, at which point the wireguard-go patch should no longer be necessary. This patch has the following performance impact on i7-7500U @ 2.70GHz, tested in the following namespace configuration: ┌────────────────┐ ┌─────────────────────────────────┐ ┌────────────────┐ │ $ns1 │ │ $ns0 │ │ $ns2 │ │ client0 │ │ tailcontrol, logcatcher │ │ client1 │ │ ┌─────┐ │ │ ┌──────┐ ┌──────┐ │ │ ┌─────┐ │ │ │vethc│───────┼────┼──│vethrc│ │vethrs│──────┼─────┼──│veths│ │ │ ├─────┴─────┐ │ │ ├──────┴────┐ ├──────┴────┐ │ │ ├─────┴─────┐ │ │ │10.0.0.2/24│ │ │ │10.0.0.1/24│ │10.0.1.1/24│ │ │ │10.0.1.2/24│ │ │ └───────────┘ │ │ └───────────┘ └───────────┘ │ │ └───────────┘ │ └────────────────┘ └─────────────────────────────────┘ └────────────────┘ Before: --------------------------------------------------- \| TCP send \| UDP send \| \|------------------------\|------------------------\| \| 557.0 (±8.5) Mbits/sec \| 3.03 (±0.02) Gbits/sec \| --------------------------------------------------- After: --------------------------------------------------- \| TCP send \| UDP send \| \|------------------------\|------------------------\| \| 544.8 (±1.6) Mbits/sec \| 3.13 (±0.02) Gbits/sec \| --------------------------------------------------- The impact on receive performance is similar. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	6 years ago
David Anderson	9ccbcda612	wgengine/router: rename config.Settings to config.Config, make pointer. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	72cae5504c	wgengine: generate and plumb router.Settings in from ipn. This saves a layer of translation, and saves us having to pass in extra bits and pieces of the netmap and prefs to wgengine. Now it gets one Wireguard config, and one OS network stack config. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	cd01bcc395	wgengine/router: allow loopback traffic from our own IP(s). Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	bfdc8175b1	wgengine/router: add a setting to disable SNAT for subnet routes. Part of #320. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Brad Fitzpatrick	8a3e77fc43	ipn, wgengine/filter: remove exported type aliases	6 years ago
David Anderson	21ac65d3da	wgengine/router: explicitly detect and complain about busybox's `ip`. Defensive programming against #368 in environments other than Docker, e.g. if you try using Tailscale in Alpine Linux directly, sans container. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	381b94d4d1	wgengine/router: include command output if `ip rule list` fails. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	e83d02ffd1	wgengine: don't double-close tundev on setup error. Part of #368. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	efc1feedc9	wgengine/router: include more information when iptables ops fail. The iptables package we use doesn't include command output, so we're left with guessing what went wrong most of the time. This will at least narrow things down to which operation failed. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	e16f7e48a3	wgengine: simplify wgcfg.* to netaddr.* conversion. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	ccbd0937d0	wgengine: avoid v6 mapped v4 IPs when converting to netaddr types. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Wendi Yu	499c8fcbb3	Replace our ratelimiter with standard rate package (#359 ) * Replace our ratelimiter with standard rate package Signed-off-by: Wendi Yu <wendi.yu@yahoo.ca>	6 years ago
David Anderson	b01db109f5	wgengine/router: use inet.af/netaddr, not wgcfg.CIDR. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	b8f01eed34	wgengine/router: remove wireguard-go config from settings. Instead, pass in only exactly the relevant configuration pieces that the OS network stack cares about. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	8861bb5a19	wgengine/router: alter API to support multiple addrs, and use on linux. FreeBSD and OpenBSD will error out with a complaint if we pass >1 address right now, but we don't yet so that's okay.	6 years ago
David Anderson	6802481bf5	wgengine/router: don't use gateway routes on linux.	6 years ago
David Anderson	78b1ed39ea	wgengine/router: add more documentation.	6 years ago
David Anderson	c9de43cd59	wgengine/router: fix typo. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	89af51b84d	wgengine: plumb locally advertised subnet routes. With this change, advertising subnet routes configures the firewall correctly. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	89198b1691	wgengine/router: rewrite netfilter and routing logic. New logic installs precise filters for subnet routes, plays nice with other users of netfilter, and lays the groundwork for fixing routing loops via policy routing. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	7618d7e677	wgengine/router: simplify some cmd invocations. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Brad Fitzpatrick	fefd7e10dc	types/structs: add structs.Incomparable annotation, use it where applicable Shotizam before and output queries: sqlite> select sum(size) from bin where func like 'type..%'; 129067 => 120216	6 years ago
David Anderson	755fd9253c	wgengine/router: fix up docstring. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
David Anderson	1ac570def7	wgengine/router: split out from wgengine. The router implementations are logically separate, with their own API. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Avery Pennarun	ee3395e63a	wgengine/filter: fix linter warning. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	65fbb9c303	wgengine/filter: support subnet mask rules, not just /32 IPs. This depends on improved support from the control server, to send the new subnet width (Bits) fields. If these are missing, we fall back to assuming their value is /32. Conversely, if the server sends Bits fields to an older client, it will interpret them as /32 addresses. Since the only rules we allow are "accept" rules, this will be narrower or equal to the intended rule, so older clients will simply reject hosts on the wider subnet (fail closed). With this change, the internal filter.Matches format has diverged from the wire format used by controlclient, so move the wire format into tailcfg and convert it to filter.Matches in controlclient. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Avery Pennarun	85e675940d	wgengine/filter: allow ICMP response packets. Longer term, we should probably update the packet filter to be fully stateful, for both TCP and ICMP. That is, only ICMP packets related to a session we initiated should be allowed back in. But this is reasonably secure for now, since wireguard is already trimming most traffic. The current code would not protect against eg. Ping-of-Death style attacks from VPN nodes. Fixes tailscale/tailscale#290. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	6 years ago
Brad Fitzpatrick	e1526b796e	ipn: don't listen on the unspecified address in test To avoid the Mac firewall dialog of (test) death. See `4521a59f30` which I added to help debug this.	6 years ago
Brad Fitzpatrick	18017f7630	ipn, wgengine/magicsock: be more idle when in Stopped state with no peers (Previously as #288, but with some more.) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
fgergo	8296c934ac	Update ifconfig_windows.go OLE calls sometimes unexpectedly fail, but retries can succeed. Change panic() to return errors. This way ConfigureInterface() retries can succeed.	6 years ago
David Anderson	9669b85b41	wgengine/magicsock: wait for endpoint updater goroutine when closing. Fixes #204. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Elias Naur	2dac4f2b24	wgengine/monitor: disable monitor on Android Netlink is not supported on Android. Signed-off-by: Elias Naur <mail@eliasnaur.com>	6 years ago
Brad Fitzpatrick	268d331cb5	wgengine/magicsock: prune key.Public-keyed on peer removals Fixes #215	6 years ago
Brad Fitzpatrick	00d053e25a	wgengine/magicsock: fix slow memory leak as peer endpoints move around Updates #215	6 years ago
Brad Fitzpatrick	7fc97c5493	wgengine/magicsock: use netaddr more In prep for deleting from the ever-growing maps.	6 years ago
Brad Fitzpatrick	6fb30ff543	wgengine/magicsock: start using inet.af/netaddr a bit	6 years ago
David Anderson	afbfe4f217	wgengine: drop wireguard MTU to 1280 bytes. Signed-off-by: David Anderson <danderson@tailscale.com>	6 years ago
Avery Pennarun	dc9b39e3fb	wgengine/windows: use new winipcfg.Sync{Addresses,Routes} functions. This avoids flushing and reloading the whole list of addresses and routes whenever remote node information changes.	6 years ago
Brad Fitzpatrick	adf74c75ed	wgengine: also diagnose not-yet-rebooted system updates on Arch	6 years ago
Brad Fitzpatrick	45f2b53aca	all: remove unnecessary trailing newlines in format patterns for consistency And document on logger.Logf that it's unnecessary.	6 years ago
Brad Fitzpatrick	a7e7c7b548	wgengine/magicsock: close derp connections on rebind Fixes #276 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	614261d00d	wgengine/magicsock: reset AddrSet states on Rebind Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	c0697e1feb	net/interfaces: add IsExpensive and up state to State Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	a55c4217db	wgengine: diagnose why CreateTUN might've failed for users Fixes #273 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	3a3b64301e	wgengine: quiet some engine reconfig logging, make more consistent Updates #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	1ec27dbb5b	wgengine: remove an allocation in reconfig Minor.	6 years ago
David Crawshaw	5b95aa81ea	wgengine: remove IpcSetOperation on LinkChange This was only done occasionally, but was extremely disruptive when done and is no longer necessary. It used to be that when switching links, we had to immediately generate handshakes to everyone we were communicating with to punch a hole in any NAT we were talking through. (This ended up not really working, because in the process we got rid of our session keys and ended up having a futile conversation for many seconds.) Now we have DERP, our link change propogates to the other side as a new list of endpoints, so they start spraying packets. We will definitely get one thanks to DERP, which will cause us to spray, opening any NAT we are behind. The result is that for good connections, we don't trash session keys and cause an interruption. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	6 years ago
Brad Fitzpatrick	922d9546bf	wgengine: don't allocate so much in userspaceEngine.getStatus It was one of the top garbage producers on my phone. It's slated to be deleted and replaced anyway, but this helps in the meantime. The go.sum changes look scary, but the new dep only adds 240 bytes to the binary. The go.sum noise is just cmd/go being aggressive in including a lot of stuff (which is being fixed in Go 1.15, for what I understand). And I ran a go mod tidy, which added some too. (I had to write a custom wrapper around go mod tidy because this mod tidy normally breaks on tailscale.io/control being missing but referenced in tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	0f64d7f9cc	wgengine: remove a tiny allocation Drop in the bucket compared to the larger issues, but noticed it when looking at pprof.	6 years ago
Blake Gentry	e19287f60f	wgengine/magicsock: fix Conn docs type reference The docs on magicsock.Conn stated that they implemented the wireguard/device.Bind interface, yet this type does not exist. In reality, the Conn type implements the wireguard/conn.Bind interface. I also fixed a small typo in the same file. Signed-off-by: Blake Gentry <blakesgentry@gmail.com>	6 years ago
Brad Fitzpatrick	50aeb5b9ad	wgengine: unexport some windows funcs	6 years ago
Brad Fitzpatrick	322499473e	cmd/tailscaled, wgengine, ipn: add /debug/ipn handler with world state Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	2d48f92a82	wgengine/magicsock: re-stun every [20,27] sec, not 28 28 is cutting it close, and we think jitter will help some spikes we're seeing. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	577f321c38	wgengine/magicsock: revise derp fallback logic Revision to earlier `6284454ae5` Don't be sticky if we have no peers. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	2e420ad8b6	wgengine, wgengine/filter: minor doc, style, performance, locking changes Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	6284454ae5	wgengine/magicsock: if UDP blocked, pick DERP where most peers are Updates #207 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Avery Pennarun	f53e78e0d5	wgengine: don't lose filter state on filter reconfig. We were abandoning the UDP port LRU every time we got a new packet filter from tailcontrol, which caused return packets to suddenly stop arriving.	6 years ago
Brad Fitzpatrick	d321190578	wgengine/magicsock: stringify [IPv6]:port normally in AddrSet.String	6 years ago
Brad Fitzpatrick	3c3ea8bc8a	wgengine/magicsock: finish IPv6 transport support DEBUG_INCLUDE_IPV6=1 is still required, but works now. Updates #18 (fixes it, once env var gate is removed)	6 years ago
Brad Fitzpatrick	82ed7e527e	wgengine/magicsock: remove log allocation This was the whole point but I goofed at the last line.	6 years ago
Brad Fitzpatrick	8454bbbda5	wgengine/magicsock: more logging improvements * remove endpoint discovery noise when results unchanged * consistently spell derp nodes as "derp-N" * replace "127.3.3.40:" with "derp-" in CreateEndpoint log output * stop early DERP setup before SetPrivateKey is called; it just generates log nosie * fix stringification of peer ShortStrings (it had an old %x on it, rendering it garbage) * describe why derp routes are changing, with one of: shared home, their home, our home, alt	6 years ago
Brad Fitzpatrick	680311b3df	wgengine/magicsock: fix few remaining logs without package prefix	6 years ago
Brad Fitzpatrick	c473927558	wgengine/magicsock: clean up, add, improve DERP logs	6 years ago
Brad Fitzpatrick	ea9310403d	wgengine/magicsock: re-STUN on DERP connection death Fixes #201	6 years ago
Brad Fitzpatrick	1ab5b31c4b	derp, magicsock: send new "peer gone" frames when previous sender disconnects Updates #150 (not yet enabled by default in magicsock) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	b6f77cc48d	wgengine/magicsock: return early, outdent in derpWriteChanOfAddr	6 years ago
Brad Fitzpatrick	dd31285ad4	wgengine/magicsock: send IPv6 using pconn6, if available In prep for IPv6 support. Nothing should make it this far yet.	6 years ago
Brad Fitzpatrick	af277a6762	controlclient, magicsock: add debug knob to request IPv6 endpoints Add opt-in method to request IPv6 endpoints from the control plane. For now they should just be skipped. A previous version of this CL was unconditional and reportedly had problems that I can't reproduce. So make it a knob until the mystery is solved. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 years ago
Brad Fitzpatrick	221e7d7767	wgengine/magicsock: make log message include DERP port (node)	6 years ago

... 6 7 8 9 10 ...

880 Commits (98d557dd24cb15d106810828d51c3e6a35f1b230)