576 Commits (99b06eac49ba1cdc1f72409b957f526b25d62622)

Author	SHA1	Message	Date
Brad Fitzpatrick	b7f508fccf	Revert "control/controlclient: delete unreferenced mapSession UserProfiles" ... This reverts commit 413fb5b933. See long story in #14992 Updates #14992 Updates tailscale/corp#26058 Change-Id: I3de7d080443efe47cbf281ea20887a3caf202488 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	9706c9f4ff	types/netmap,*: pass around UserProfiles as views (pointers) instead ... Smaller. Updates tailscale/corp#26058 (@andrew-d noticed during this) Change-Id: Id33cddd171aaf8f042073b6d3c183b0a746e9931 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	0ed4aa028f	control/controlclient: flesh out a recently added comment ... Updates tailscale/corp#26058 Change-Id: Ib46161fbb2e79c080f886083665961f02cbf5949	10 months ago
Brad Fitzpatrick	ed8bb3b564	control/controlclient: add missing word in comment ... Found by review.ai. Updates #cleanup Change-Id: Ib9126de7327527b8b3818d92cc774bb1c7b6f974 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	bce05ec6c3	control/controlclient,tempfork/httprec: don't link httptest, test certs for c2n ... The c2n handling code was using the Go httptest package's ResponseRecorder code but that's in a test package which brings in Go's test certs, etc. This forks the httptest recorder type into its own package that only has the recorder and adds a test that we don't re-introduce a dependency on httptest. Updates #12614 Change-Id: I3546f49972981e21813ece9064cc2be0b74f4b16 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	2c98c44d9a	control/controlclient: sanitize invalid DERPMap nil Region from control ... Fixes #14752 Change-Id: If364603eefb9ac6dc5ec6df84a0d5e16c94dda8d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	1a7274fccb	control/controlclient: skip SetControlClientStatus when queue has newer results later ... Updates #1909 Updates #12542 Updates tailscale/corp#26058 Change-Id: I3033d235ca49f9739fdf3deaf603eea4ec3e407e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	413fb5b933	control/controlclient: delete unreferenced mapSession UserProfiles ... This was a slow memory leak on busy tailnets with lots of tagged ephemeral nodes. Updates tailscale/corp#26058 Change-Id: I298e7d438e3ffbb3cde795640e344671d244c632 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	7ecb69e32e	tailcfg,control/controlclient: treat nil AllowedIPs as Addresses [capver 112] ... Updates #14635 Change-Id: I21e2bd1ec4eb384eb7a3fc8379f0788a684893f3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Brad Fitzpatrick	27477983e3	control/controlclient: remove misleading TS_DEBUG_NETMAP, make it TS_DEBUG_MAP=2 (or more) ... Updates #cleanup Change-Id: Ic1edaed46b7b451ab58bb2303640225223eba9ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Brad Fitzpatrick	2fc4455e6d	all: add Node.HomeDERP int, phase out "127.3.3.40:$region" hack [capver 111] ... This deprecates the old "DERP string" packing a DERP region ID into an IP:port of 127.3.3.40:$REGION_ID and just uses an integer, like PeerChange.DERPRegion does. We still support servers sending the old form; they're converted to the new form internally right when they're read off the network. Updates #14636 Change-Id: I9427ec071f02a2c6d75ccb0fcbf0ecff9f19f26f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Nick Khyl	da9965d51c	cmd/viewer,types/views,various: avoid allocations in pointer field getters whenever possible ... In this PR, we add a generic views.ValuePointer type that can be used as a view for pointers to basic types and struct types that do not require deep cloning and do not have corresponding view types. Its Get/GetOk methods return stack-allocated shallow copies of the underlying value. We then update the cmd/viewer codegen to produce getters that return either concrete views when available or ValuePointer views when not, for pointer fields in generated view types. This allows us to avoid unnecessary allocations compared to returning pointers to newly allocated shallow copies. Updates #14570 Signed-off-by: Nick Khyl <nickk@tailscale.com>	11 months ago
Andrea Gottardo	6db220b478	controlclient: do not set HTTPS port for any private coordination server IP (#14564) ... Fixes tailscale/tailscale#14563 When creating a NoiseClient, ensure that if any private IP address is provided, with both an `http` scheme and an explicit port number, we do not ever attempt to use HTTPS. We were only handling the case of `127.0.0.1` and `localhost`, but `192.168.x.y` is a private IP as well. This uses the `netip` package to check and adds some logging in case we ever need to troubleshoot this. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	11 months ago
Brad Fitzpatrick	47bd0723a0	all: use iterators in more places instead of Range funcs ... And misc cleanup along the way. Updates #12912 Change-Id: I0cab148b49efc668c6f5cdf09c740b84a713e388 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Brad Fitzpatrick	402fc9d65f	control/controlclient: remove optimization that was more convoluted than useful ... While working on #13390, I ran across this non-idiomatic pointer-to-view and parallel-sorted-map accounting code that was all just to avoid a sort later. But the sort later when building a new netmap.NetworkMap is already a drop in the bucket of CPU compared to how much work & allocs mapSession.netmap and LocalBackend's spamming of the full netmap (potentially tens of thousands of peers, MBs of JSON) out to IPNBus clients for any tiny little change (node changing online status, etc). Removing the parallel sorted slice let everything be simpler to reason about, so this does that. The sort might take a bit more CPU time now in theory, but in practice for any netmap size for which it'd matter, the quadratic netmap IPN bus spam (which we need to fix soon) will overshadow that little sort. Updates #13390 Updates #1909 Change-Id: I3092d7c67dc10b2a0f141496fe0e7e98ccc07712 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Brad Fitzpatrick	ff095606cc	all: add means to set device posture attributes from node ... Updates tailscale/corp#24690 Updates #4077 Change-Id: I05fe799beb1d2a71d1ec3ae08744cc68bcadae2a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Nick Khyl	3353f154bb	control/controlclient: use the most recent syspolicy.MachineCertificateSubject value ... This PR removes the sync.Once wrapper around retrieving the MachineCertificateSubject policy setting value, ensuring the most recent version is always used if it changes after the service starts. Although this policy setting is used by a very limited number of customers, recent support escalations have highlighted issues caused by outdated or incorrect policy values being applied. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	1 year ago
Brad Fitzpatrick	8fd471ce57	control/controlclient: disable https on for http://localhost:$port URLs ... Previously we required the program to be running in a test or have TS_CONTROL_IS_PLAINTEXT_HTTP before we disabled its https fallback on "http" schema control URLs to localhost with ports. But nobody accidentally does all three of "http", explicit port number, localhost and doesn't mean it. And when they mean it, they're testing a localhost dev control server (like I was) and don't want 443 getting involved. As of the changes for #13597, this became more annoying in that we were trying to use a port which wasn't even available. Updates #13597 Change-Id: Icd00bca56043d2da58ab31de7aa05a3b269c490f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	c3306bfd15	control/controlhttp/controlhttpserver: split out Accept to its own package ... Otherwise all the clients only using control/controlhttp for the ts2021 HTTP client were also pulling in WebSocket libraries, as the server side always needs to speak websockets, but only GOOS=js clients speak it. This doesn't yet totally remove the websocket dependency on Linux because Linux has a envknob opt-in to act like GOOS=js for manual testing and force the use of WebSockets for DERP only (not control). We can put that behind a build tag in a future change to eliminate the dep on all GOOSes. Updates #1278 Change-Id: I4f60508f4cad52bf8c8943c8851ecee506b7ebc9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	1f8eea53a8	control/controlclient: include HTTP status string in error message too ... Not just its code. Updates tailscale/corp#23584 Change-Id: I8001a675372fe15da797adde22f04488d8683448 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	a01b545441	control/control{client,http}: don't noise dial localhost:443 in http-only tests ... 1eaad7d3de regressed some tests in another repo that were starting up a control server on `http://127.0.0.1:nnn`. Because there was no https running, and because of a bug in 1eaad7d3de (which ended up checking the recently-dialed-control check twice in a single dial call), we ended up forcing only the use of TLS dials in a test that only had plaintext HTTP running. Instead, plumb down support for explicitly disabling TLS fallbacks and use it only when running in a test and using `http` scheme control plane URLs to 127.0.0.1 or localhost. This fixes the tests elsewhere. Updates #13597 Change-Id: I97212ded21daf0bd510891a278078daec3eebaa6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	30f0fa95d9	control/controlclient: bound ReportHealthChange context lifetime to Direct client's ... Fixes #13651 Change-Id: I8154d3cc0ca40fe7a0223b26ae2e77e8d6ba874b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	3d401c11fa	all: use new Go 1.23 slices.Sorted more ... Updates #12912 Change-Id: If1294e5bc7b5d3cf0067535ae10db75e8b988d8b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Nick Khyl	11d205f6c4	control/controlclient,posture,util/syspolicy: use predefined syspolicy keys instead of string literals ... With the upcoming syspolicy changes, it's imperative that all syspolicy keys are defined in the syspolicy package for proper registration. Otherwise, the corresponding policy settings will not be read. This updates a couple of places where we still use string literals rather than syspolicy consts. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	1 year ago
Anton Tolchanov	227509547f	{control,net}: close idle connections of custom transports ... I noticed a few places with custom http.Transport where we are not closing idle connections when transport is no longer used. Updates tailscale/corp#21609 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	1 year ago
Anton Tolchanov	4651827f20	tka: test SigCredential signatures and netmap filtering ... This change moves handling of wrapped auth keys to the `tka` package and adds a test covering auth key originating signatures (SigCredential) in netmap. Updates tailscale/corp#19764 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	1 year ago
Brad Fitzpatrick	fd3efd9bad	control/controlclient: add more Screen Time blocking detection ... Updates #9658 Updates #12545 Change-Id: Iec1dad354a75f145567b4055d77b1c1db27c89e2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Co-authored-by: Andrea Gottardo <andrea@gottardo.me>	1 year ago
Andrew Dunham	24976b5bfd	cmd/tailscale/cli: actually perform Noise request in 'debug ts2021' ... This actually performs a Noise request in the 'debug ts2021' command, instead of just exiting once we've dialed a connection. This can help debug certain forms of captive portals and deep packet inspection that will allow a connection, but will RST the connection when trying to send data on the post-upgraded TCP connection. Updates #1634 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1e46ca9c9a0751c55f16373a6a76cdc24fec1f18	1 year ago
Andrew Dunham	732605f961	control/controlclient: move noiseConn to internal package ... So that it can be later used in the 'tailscale debug ts2021' function in the CLI, to aid in debugging captive portals/WAFs/etc. Updates #1634 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Iec9423f5e7570f2c2c8218d27fc0902137e73909	1 year ago
Andrea Gottardo	a8ee83e2c5	health: begin work to use structured health warnings instead of strings, pipe changes into ipn.Notify (#12406) ... Updates tailscale/tailscale#4136 This PR is the first round of work to move from encoding health warnings as strings and use structured data instead. The current health package revolves around the idea of Subsystems. Each subsystem can have (or not have) a Go error associated with it. The overall health of the backend is given by the concatenation of all these errors. This PR polishes the concept of Warnable introduced by @bradfitz a few weeks ago. Each Warnable is a component of the backend (for instance, things like 'dns' or 'magicsock' are Warnables). Each Warnable has a unique identifying code. A Warnable is an entity we can warn the user about, by setting (or unsetting) a WarningState for it. Warnables have: - an identifying Code, so that the GUI can track them as their WarningStates come and go - a Title, which the GUIs can use to tell the user what component of the backend is broken - a Text, which is a function that is called with a set of Args to generate a more detailed error message to explain the unhappy state Additionally, this PR also begins to send Warnables and their WarningStates through LocalAPI to the clients, using ipn.Notify messages. An ipn.Notify is only issued when a warning is added or removed from the Tracker. In a next PR, we'll get rid of subsystems entirely, and we'll start using structured warnings for all errors affecting the backend functionality. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	1 year ago
Anton Tolchanov	01847e0123	ipn/ipnlocal: discard node keys that have been rotated out ... A non-signing node can be allowed to re-sign its new node keys following key renewal/rotation (e.g. via `tailscale up --force-reauth`). To be able to do this, node's TLK is written into WrappingPubkey field of the initial SigDirect signature, signed by a signing node. The intended use of this field implies that, for each WrappingPubkey, we typically expect to have at most one active node with a signature tracing back to that key. Multiple valid signatures referring to the same WrappingPubkey can occur if a client's state has been cloned, but it's something we explicitly discourage and don't support: https://tailscale.com/s/clone This change propagates rotation details (wrapping public key, a list of previous node keys that have been rotated out) to netmap processing, and adds tracking of obsolete node keys that, when found, will get filtered out. Updates tailscale/corp#19764 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Brad Fitzpatrick	1384c24e41	control/controlclient: delete unused Client.Login Oauth2Token field ... Updates #12172 (then need to update other repos) Change-Id: I439f65e0119b09e00da2ef5c7a4f002f93558578 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	e968b0ecd7	cmd/tailscale,controlclient,ipnlocal: fix 'up', deflake tests more ... The CLI's "up" is kinda chaotic and LocalBackend.Start is kinda chaotic and they both need to be redone/deleted (respectively), but this fixes some buggy behavior meanwhile. We were previously calling StartLoginInteractive (to start the controlclient's RegisterRequest) redundantly in some cases, causing test flakes depending on timing and up's weird state machine. We only need to call StartLoginInteractive in the client if Start itself doesn't. But Start doesn't tell us that. So cheat a bit and a put the information about whether there's a current NodeKey in the ipn.Status. It used to be accessible over LocalAPI via GetPrefs as a private key but we removed that for security. But a bool is fine. So then only call StartLoginInteractive if that bool is false and don't do it in the WatchIPNBus loop. Fixes #12028 Updates #12042 Change-Id: I0923c3f704a9d6afd825a858eb9a63ca7c1df294 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	32bc596062	ipn/ipnlocal: acquire b.mu once in Start ... We used to Lock, Unlock, Lock, Unlock quite a few times in Start resulting in all sorts of weird race conditions. Simplify it all and only Lock/Unlock once. Updates #11649 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	80df8ffb85	control/controlclient: early return and outdent some code ... I found this too hard to read before. This is pulled out of #12033 as it's unrelated cleanup in retrospect. Updates #12028 Change-Id: I727c47e573217e3d1973c5b66a76748139cf79ee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	af97e7a793	tailcfg,all: add/plumb Node.IsJailed ... This adds a new bool that can be sent down from control to do jailing on the client side. Previously this would only be done from control by modifying the packet filter we sent down to clients. This would result in a lot of additional work/CPU on control, we could instead just do this on the client. This has always been a TODO which we keep putting off, might as well do it now. Updates tailscale/corp#19623 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	e26f76a1c4	tstest/integration: add more debugging, logs to catch flaky test ... Updates #11962 Change-Id: I1ab0db69bdf8d1d535aa2cef434c586311f0fe18 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6b95219e3a	net/netmon, add: add netmon.State type alias of interfaces.State ... ... in prep for merging the net/interfaces package into net/netmon. This is a no-op change that updates a bunch of the API signatures ahead of a future change to actually move things (and remove the type alias) Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: I477613388f09389214db0d77ccf24a65bff2199c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3672f29a4e	net/netns, net/dns/resolver, etc: make netmon required in most places ... The goal is to move more network state accessors to netmon.Monitor where they can be cheaper/cached. But first (this change and others) we need to make sure the one netmon.Monitor is plumbed everywhere. Some notable bits: * tsdial.NewDialer is added, taking a now-required netmon * because a tsdial.Dialer always has a netmon, anything taking both a Dialer and a NetMon is now redundant; take only the Dialer and get the NetMon from that if/when needed. * netmon.NewStatic is added, primarily for tests Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: I877f9cb87618c4eb037cee098241d18da9c01691 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	745931415c	health, all: remove health.Global, finish plumbing health.Tracker ... Updates #11874 Updates #4136 Change-Id: I414470f71d90be9889d44c3afd53956d9f26cd61 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a4a282cd49	control/controlclient: plumb health.Tracker ... Updates #11874 Updates #4136 Change-Id: Ia941153bd83523f0c8b56852010f5231d774d91a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	723c775dbb	tsd, ipnlocal, etc: add tsd.System.HealthTracker, start some plumbing ... This adds a health.Tracker to tsd.System, accessible via a new tsd.System.HealthTracker method. In the future, that new method will return a tsd.System-specific HealthTracker, so multiple tsnet.Servers in the same process are isolated. For now, though, it just always returns the temporary health.Global value. That permits incremental plumbing over a number of changes. When the second to last health.Global reference is gone, then the tsd.System.HealthTracker implementation can return a private Tracker. The primary plumbing this does is adding it to LocalBackend and its dozen and change health calls. A few misc other callers are also plumbed. Subsequent changes will flesh out other parts of the tree (magicsock, controlclient, etc). Updates #11874 Updates #4136 Change-Id: Id51e73cfc8a39110425b6dc19d18b3975eac75ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ebc552d2e0	health: add Tracker type, in prep for removing global variables ... This moves most of the health package global variables to a new `health.Tracker` type. But then rather than plumbing the Tracker in tsd.System everywhere, this only goes halfway and makes one new global Tracker (`health.Global`) that all the existing callers now use. A future change will eliminate that global. Updates #11874 Updates #4136 Change-Id: I6ee27e0b2e35f68cb38fecdb3b2dc4c3f2e09d68 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	5100bdeba7	types/persist: remove unused field Persist.Provider ... It was only obviously unused after the previous change, c39cde79d. Updates #19334 Change-Id: I9896d5fa692cb4346c070b4a339d0d12340c18f7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	c39cde79d2	tailcfg: remove some unused fields from RegisterResponseAuth ... Fixes #19334 Change-Id: Id6463f28af23078a7bc25b9280c99d4491bd9651 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	05bfa022f2	tailcfg: pointerify RegisterRequest.Auth, omitemptify RegisterResponseAuth ... We were storing server-side lots of: "Auth":{"Provider":"","LoginName":"","Oauth2Token":null,"AuthKey":""}, That was about 7% of our total storage of pending RegisterRequest bodies. Updates tailscale/corp#19327 Change-Id: Ib73842759a2b303ff5fe4c052a76baea0d68ae7d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7c1d6e35a5	all: use Go 1.22 range-over-int ... Updates #11058 Change-Id: I35e7ef9b90e83cac04ca93fd964ad00ed5b48430 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	2409661a0d	control/controlclient: delete old naclbox code, require ts2021 Noise ... Updates #11585 Updates tailscale/corp#18882 Change-Id: I90e2e4a211c58d429e2b128604614dde18986442 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
James Tucker	9401b09028	control/controlclient: move client watchdog to cover initial request ... The initial control client request can get stuck in the event that a connection is established but then lost part way through, without any ICMP or RST. Ensure that the control client will be restarted by timing out that initial request as well. Fixes #11542 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Brad Fitzpatrick	7b34154df2	all: deprecate Node.Capabilities (more), remove PeerChange.Capabilities [capver 89] ... First we had Capabilities []string. Then https://tailscale.com/blog/acl-grants (#4217) brought CapMap, a superset of Capabilities. Except we never really finished the transition inside the codebase to go all-in on CapMap. This does so. Notably, this coverts Capabilities on the wire early to CapMap internally so the code can only deal in CapMap, even against an old control server. In the process, this removes PeerChange.Capabilities support, which no known control plane sent anyway. They can and should use PeerChange.CapMap instead. Updates #11508 Updates #4217 Change-Id: I872074e226b873f9a578d9603897b831d50b25d9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b104688e04	ipn/ipnlocal, types/netmap: replace hasCapability with set lookup on NetworkMap ... When node attributes were super rare, the O(n) slice scans looking for node attributes was more acceptable. But now more code and more users are using increasingly more node attributes. Time to make it a map. Noticed while working on tailscale/corp#17879 Updates #cleanup Change-Id: Ic17c80341f418421002fbceb47490729048756d2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f45594d2c9	control/controlclient: free memory on iOS before full netmap work ... Updates tailscale/corp#18514 Change-Id: I8d0330334b030ed8692b25549a0ee887ac6d7188 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	8444937c89	control/controlclient: fix panic regression from earlier load balancer hint header ... In the recent 20e9f3369 we made HealthChangeRequest machine requests include a NodeKey, as it was the oddball machine request that didn't include one. Unfortunately, that code was sometimes being called (at least in some of our integration tests) without a node key due to its registration with health.RegisterWatcher(direct.ReportHealthChange). Fortunately tests in corp caught this before we cut a release. It's possible this only affects this particular integration test's environment, but still worth fixing. Updates tailscale/corp#1297 Change-Id: I84046779955105763dc1be5121c69fec3c138672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	85febda86d	all: use zstdframe where sensible (#11491) ... Use the zstdframe package where sensible instead of plumbing around our own zstd.Encoder just for stateless operations. This causes logtail to have a dependency on zstd, but that's arguably okay since zstd support is implicit to the protocol between a client and the logging service. Also, virtually every caller to logger.NewLogger was manually setting up a zstd.Encoder anyways, meaning that zstd was functionally always a dependency. Updates #cleanup Updates tailscale/corp#18514 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Adrian Dewhurst	2f7e7be2ea	control/controlclient: do not alias peer CapMap ... Updates #cleanup Change-Id: I10fd5e04310cdd7894a3caa3045b86eb0a06b6a0 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2 years ago
Brad Fitzpatrick	20e9f3369d	control/controlclient: send load balancing hint HTTP request header ... Updates tailscale/corp#1297 Change-Id: I0b102081e81dfc1261f4b05521ab248a2e4a1298 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Claire Wang	221de01745	control/controlclient: fix sending peer capmap changes (#11457) ... Instead of just checking if a peer capmap is nil, compare the previous state peer capmap with the new peer capmap. Updates tailscale/corp#17516 Signed-off-by: Claire Wang <claire@tailscale.com>	2 years ago
Brad Fitzpatrick	e1bd7488d0	all: remove LenIter, use Go 1.22 range-over-int instead ... Updates #11058 Updates golang/go#65685 Change-Id: Ibb216b346e511d486271ab3d84e4546c521e4e22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	94a4f701c2	all: use reflect.TypeFor now available in Go 1.22 (#11078) ... Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	2bd3c1474b	util/cmpx: delete now that we're using Go 1.22 ... Updates #11058 Change-Id: I09dea8e86f03ec148b715efca339eab8b1f0f644 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
James Tucker	38a1cf748a	control/controlclient,util/execqueue: extract execqueue into a package ... This is a useful primitive for asynchronous execution of ordered work I want to use in another change. Updates tailscale/corp#16833 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
James 'zofrex' Sanderson	124dc10261	controlclient,tailcfg,types: expose MaxKeyDuration via localapi (#10401) ... Updates tailscale/corp#16016 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	2 years ago
Andrew Lytvynov	2716250ee8	all: cleanup unused code, part 2 (#10670) ... And enable U1000 check in staticcheck. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	2 years ago
Andrew Lytvynov	945cf836ee	ipn: apply tailnet-wide default for auto-updates (#10508) ... When auto-update setting in local Prefs is unset, apply the tailnet default value from control. This only happens once, when we apply the default (or when the user manually overrides it), tailnet default no longer affects the node. Updates #16244 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	2 years ago
Matt Layher	a217f1fccf	all: fix nilness issues ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	2 years ago
Brad Fitzpatrick	fb829ea7f1	control/controlclient: support incremental packet filter updates [capver 81] ... Updates #10299 Change-Id: I87e4235c668a1db7de7ef1abc743f0beecb86d3d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	44c6909c92	control/controlclient: move watchdog out of mapSession ... In prep for making mapSession's lifetime not be 1:1 with a single HTTP response's lifetime, this moves the inactivity timer watchdog out of mapSession and into the caller that owns the streaming HTTP response. (This is admittedly closer to how it was prior to the mapSession type existing, but that was before we connected some dots which were impossible to even see before the mapSession type broke the code up.) Updates #7175 Change-Id: Ia108dac84a4953db41cbd30e73b1de4a2a676c11 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	c87d58063a	control/controlclient: move lastPrintMap field from Direct to mapSession ... It was a really a mutable field owned by mapSession that we didn't move in earlier commits. Once moved, it's then possible to de-func-ify the code and turn it into a regular method rather than an installed optional hook. Noticed while working to move map session lifetimes out of Direct.sendMapRequest's single-HTTP-connection scope. Updates #7175 Updates #cleanup Change-Id: I6446b15793953d88d1cabf94b5943bb3ccac3ad9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Adrian Dewhurst	5347e6a292	control/controlclient: support certstore without cgo ... We no longer build Windows releases with cgo enabled, which automatically turned off certstore support. Rather than re-enabling cgo, we updated our fork of the certstore package to no longer require cgo. This updates the package, cleans up how the feature is configured, and removes the cgo build tag requirement. Fixes tailscale/corp#14797 Fixes tailscale/coral#118 Change-Id: Iaea34340761c0431d759370532c16a48c0913374 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2 years ago
Claire Wang	754fb9a8a8	tailcfg: add tailnet field to register request (#9675) ... Updates tailscale/corp#10967 Signed-off-by: Claire Wang <claire@tailscale.com>	2 years ago
Maisem Ali	3655fb3ba0	control/controlclient: fix deadlock in shutdown ... Fixes a deadlock observed in a different repo. Regressed in 5b3f5eabb5. Updates tailscale/corp#14950 Updates tailscale/corp#14515 Updates tailscale/corp#14139 Updates tailscale/corp#13175 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	425cf9aa9d	tailcfg, all: use []netip.AddrPort instead of []string for Endpoints ... It's JSON wire compatible. Updates #cleanup Change-Id: Ifa5c17768fec35b305b06d75eb5f0611c8a135a6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	246e0ccdca	tsnet: add a test for restarting a tsnet server, fix Windows ... Thanks to @qur and @eric for debugging! Fixes #6973 Change-Id: Ib2cf8f030cf595cc73dd061c72e78ac19f5fae5d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	5b3f5eabb5	control/controlclient: fix leaked http2 goroutines on shutdown ... If a noise dial was happening concurrently with shutdown, the http2 goroutines could leak. Updates tailscale/corp#14950 Updates tailscale/corp#14515 Updates tailscale/corp#14139 Updates tailscale/corp#13175 Signed-off-by: Brad Fitzpatrick <brad@danga.com>	2 years ago
Claire Wang	e3d6236606	winutil: refactor methods to get values from registry to also return (#9536) ... errors Updates tailscale/corp#14879 Signed-off-by: Claire Wang <claire@tailscale.com>	2 years ago
Brad Fitzpatrick	3b32d6c679	wgengine/magicsock, controlclient, net/dns: reduce some logspam ... Updates #cleanup Change-Id: I78b0697a01e94baa33f3de474b591e616fa5e6af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	c08cf2a9c6	all: declare & plumb IPv6 masquerade address for peer ... This PR plumbs through awareness of an IPv6 SNAT/masquerade address from the wire protocol through to the low-level (tstun / wgengine). This PR is the first in two PRs for implementing IPv6 NAT support to/from peers. A subsequent PR will implement the data-plane changes to implement IPv6 NAT - this is just plumbing. Signed-off-by: Tom DNetto <tom@tailscale.com> Updates ENG-991	2 years ago
Maisem Ali	19a9d9037f	tailcfg: add NodeCapMap ... Like PeerCapMap, add a field to `tailcfg.Node` which provides a map of Capability to raw JSON messages which are deferred to be parsed later by the application code which cares about the specific capabilities. This effectively allows us to prototype new behavior without having to commit to a schema in tailcfg, and it also opens up the possibilities to develop custom behavior in tsnet applications w/o having to plumb through application specific data in the MapResponse. Updates #4217 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	0d991249e1	types/netmap: remove NetworkMap.{Addresses,MachineStatus} ... And convert all callers over to the methods that check SelfNode. Now we don't have multiple ways to express things in tests (setting fields on SelfNode vs NetworkMap, sometimes inconsistently) and don't have multiple ways to check those two fields (often only checking one or the other). Updates #9443 Change-Id: I2d7ba1cf6556142d219fae2be6f484f528756e3c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	a61caea911	tailcfg: define a type for NodeCapability ... Instead of untyped string, add a type to identify these. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
James Tucker	e7727db553	tailcfg: add DNS address list for IsWireGuardOnly nodes ... Tailscale exit nodes provide DNS service over the peer API, however IsWireGuardOnly nodes do not have a peer API, and instead need client DNS parameters passed in their node description. For Mullvad nodes this will contain the in network 10.64.0.1 address. Updates #9377 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Brad Fitzpatrick	9203916a4a	control/controlknobs: move more controlknobs code from controlclient ... Updates #cleanup Change-Id: I2b8b6ac97589270f307bfb20e33674894ce873b5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3af051ea27	control/controlclient, types/netmap: start plumbing delta netmap updates ... Currently only the top four most popular changes: endpoints, DERP home, online, and LastSeen. Updates #1909 Change-Id: I03152da176b2b95232b56acabfb55dcdfaa16b79 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	42072683d6	control/controlknobs: move ForceBackgroundSTUN to controlknobs.Knobs ... This is both more efficient (because the knobs' bool is only updated whenever Node is changed, rarely) and also gets us one step closer to removing a case of storing a netmap.NetworkMap in magicsock. (eventually we want to phase out much of the use of that type internally) Updates #1909 Change-Id: I37e81789f94133175064fdc09984e4f3a431f1a1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	4e91cf20a8	control/controlknobs, all: add plumbed Knobs type, not global variables ... Previously two tsnet nodes in the same process couldn't have disjoint sets of controlknob settings from control as both would overwrite each other's global variables. This plumbs a new controlknobs.Knobs type around everywhere and hangs the knobs sent by control on that instead. Updates #9351 Change-Id: I75338646d36813ed971b4ffad6f9a8b41ec91560 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	9a86aa5732	all: depend on zstd unconditionally, remove plumbing to make it optional ... All platforms use it at this point, including iOS which was the original hold out for memory reasons. No more reason to make it optional. Updates #9332 Change-Id: I743fbc2f370921a852fbcebf4eb9821e2bdd3086 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	f6a203fe23	control/controlclient: check c.closed in waitUnpause ... We would only check if the client was paused, but not if the client was closed. This meant that a call to Shutdown may block forever/leak goroutines Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	d06a75dcd0	ipn/ipnlocal: fix deadlock in resetControlClientLocked ... resetControlClientLocked is called while b.mu was held and would call cc.Shutdown which would wait for the observer queue to drain. However, there may be active callbacks from cc already waiting for b.mu resulting in a deadlock. This makes it so that resetControlClientLocked does not call Shutdown, and instead just returns the value. It also makes it so that any status received from previous cc are ignored. Updates tailscale/corp#12827 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Joe Tsai	c6fadd6d71	all: implement AppendText alongside MarshalText (#9207) ... This eventually allows encoding packages that may respect the proposed encoding.TextAppender interface. The performance gains from this is between 10-30%. Updates tailscale/corp#14379 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	003e4aff71	control/controlclient: clean up various things in prep for state overhaul ... We want the overall state (used only for tests) to be computed from the individual states of each component, rather than moving the state around by hand in dozens of places. In working towards that, we found a lot of things to clean up. Updates #cleanup Change-Id: Ieaaae5355dfae789a8ec7a56ce212f1d7e3a92db Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	9cbec4519b	control/controlclient: serialize Observer calls ... Don't just start goroutines and hope for them to be ordered. Fixes potential regression from earlier 7074a40c0. Updates #cleanup Change-Id: I501a6f3e4e8e6306b958bccdc1e47869991c31f7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f7b7ccf835	control/controlclient, ipn/ipnlocal: unplumb a bool true literal opt ... Updates #cleanup Change-Id: I664f280a2e06b9875942458afcaf6be42a5e462a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	959362a1f4	ipn/ipnlocal,control/controlclient: make Logout more sync ... We already removed the async API, make it more sync and remove the FinishLogout state too. This also makes the callback be synchronous again as the previous attempt was trying to work around the logout callback resulting in a client shutdown getting blocked forever. Updates #3833 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	7074a40c06	control/controlclient: run SetControlClientStatus in goroutine ... We have cases where the SetControlClientStatus would result in a Shutdown call back into the auto client that would block forever. The right thing to do here is to fix the LocalBackend state machine but thats a different dumpster fire that we are slowly making progress towards. This makes it so that the SetControlClientStatus happens in a different goroutine so that calls back into the auto client do not block. Also add a few missing mu.Unlocks in LocalBackend.Start. Updates #9181 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	86dc0af5ae	control/controlclient: rename Auto cancel methods, add missing Lock variant ... Then use the Locked variants in Shutdown while we already hold the lock. Updates #cleanup Change-Id: I367d53e6be6f37f783c8f43fc9c4d498d0adf501 Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	04e1ce0034	control/controlclient: remove unused StartLogout ... Updates #cleanup Co-authored-by: Maisem Ali <maisem@tailscale.com> Change-Id: I9d052fdbee787f1e8c872124e4bee61c7f04d142 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	c621141746	control/controlclient: cancel map poll when logging out ... Don't depend on the server to do it. Updates #cleanup Change-Id: I8ff40b02aa877155a71fd4db58cbecb872241ac8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	313a129fe5	control/controlclient: use slices package more ... Updates #cleanup Change-Id: Ic17384266dc59bc4e710efdda311d6e0719529da Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f5bfdefa00	control/controlclient: de-pointer Status.PersistView, document more ... Updates #cleanup Updates #1909 Change-Id: I31d91e120e3b299508de2136021eab3b34131a44 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7053e19562	control/controlclient: delete Status.Log{in,out}Finished ... They were entirely redundant and 1:1 with the status field so this turns them into methods instead. Updates #cleanup Updates #1909 Change-Id: I7d939750749edf7dae4c97566bbeb99f2f75adbc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago