tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	38be964c2b	go.mod: update netstack Fixes a atomic alignment crash on 32-bit machines. Fixes #2129 Fixes tailscale/tailscale-synology#66 (same) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Matt Layher	6956645ec8	go.mod: bump github.com/mdlayher/netlink to v1.4.1 Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Christine Dodrill	622dc7b093	tstest/integration/vms: download images from s3 (#2035 ) This makes integration tests pull pristine VM images from Amazon S3 if they don't exist on disk. If the S3 fetch fails, it will fall back to grabbing the image from the public internet. The VM images on the public internet are known to be updated without warning and thusly change their SHA256 checksum. This is not ideal for a test that we want to be able to fire and forget, then run reliably for a very long time. This requires an AWS profile to be configured at the default path. The S3 bucket is rigged so that the requester pays. The VM images are currently about 6.9 gigabytes. Please keep this in mind when running these tests on your machine. Documentation was added to the integration test folder to aid others in running these tests on their machine. Some wording in the logs of the tests was altered. Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>	4 years ago
Christine Dodrill	a282819026	tstest/integration/vms: fix OpenSUSE Leap 15.1 (#2038 ) The OpenSUSE 15.1 image we are using (and conseqentially the only one that is really available easily given it is EOL) has cloud-init hardcoded to use the OpenStack metadata thingy. Other OpenSUSE Leap images function fine with the NoCloud backend, but this one seems to just not work with it. No bother, we can just pretend to be OpenStack. Thanks to Okami for giving me an example OpenStack configuration seed image. Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>	4 years ago
Brad Fitzpatrick	a321c24667	go.mod: update netaddr Involves minor IPSetBuilder.Set API change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	33bc06795b	go.mod: update for corp resync.	4 years ago
Christine Dodrill	14c1113d2b	tstest/integration/vms: copy locally built binaries (#2006 ) Instead of pulling packages from pkgs.tailscale.com, we should use the tailscale binaries that are local to this git commit. This exposes a bit of the integration testing stack in order to copy the binaries correctly. This commit also bumps our version of github.com/pkg/sftp to the latest commit. If you run into trouble with yaml, be sure to check out the commented-out alpine linux image complete with instructions on how to use it. Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>	4 years ago
Adrian Dewhurst	6d6cf88d82	control/controlclient: use our fork of certstore The cyolosecurity fork of certstore did not update its module name and thus can only be used with a replace directive. This interferes with installing using `go install` so I created a tailscale fork with an updated module name. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago
Christine Dodrill	ba59c0391b	tstest/integration: add experimental integration test (#1966 ) This will spin up a few vms and then try and make them connect to a testcontrol server. Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>	4 years ago
Josh Bleecher Snyder	60e920bf18	go.mod: go mod tidy Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1ece91cede	go.mod: upgrade wireguard-windows, de-fork wireguard-go Pull in the latest version of wireguard-windows. Switch to upstream wireguard-go. This requires reverting all of our import paths. Unfortunately, this has to happen at the same time. The wireguard-go change is very low risk, as that commit matches our fork almost exactly. (The only changes are import paths, CI files, and a go.mod entry.) So if there are issues as a result of this commit, the first place to look is wireguard-windows changes. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	a86a0361a7	go.mod: upgrade all deps At the start of a dev cycle we'll upgrade all dependencies. Done with: $ for Dep in $(cat go.mod \| perl -ne '/(\S+) v/ and print "$1\n"'); do go get $Dep@upgrade; done Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	8bf2a38f29	go.mod: update wireguard-go, taking control over iOS memory usage from our fork Our wireguard-go fork used different values from upstream for package device's memory limits on iOS. This was the last blocker to removing our fork. These values are now vars rather than consts for iOS. `c27ff9b9f6` Adjust them on startup to our preferred values. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	eb9757a290	go.mod: upgrade netaddr to get AppendTo methods Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	85df1b0fa7	go.mod: bump wireguard-go. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w(.)\.Port = (.) -> $1 = $1.WithPort($2) \w(.)\.IP = (.) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	cb97062bac	go.mod: bump inet.af/netaddr For IPPort.MarshalText optimizations. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	d82b28ba73	go.mod: bump wireguard-go	4 years ago
Josh Bleecher Snyder	c0a70f3a06	go.mod: pull in wintun alignment fix from upstream wireguard-go `6cd106ab13...030c638da3` Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Maisem Ali	7027fa06c3	wf: implement windows firewall using inet.af/wf. Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	3173c5a65c	net/interface: remove darwin fetchRoutingTable workaround Fixed upstream. Bump dep. Updates #1345 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	96ef8d34ef	ipn/ipnlocal: switch from testify to quicktest Per discussion, we want to have only one test assertion library, and we want to start by exploring quicktest. This was a mostly mechanical translation. I think we could make this nicer by defining a few helper closures at the beginning of the test. Later. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Avery Pennarun	b7e31ab1a4	ipn: mock controlclient.Client; big ipn.Backend state machine test. A very long unit test that verifies the way the controlclient and ipn.Backend interact. This is a giant sequential test of the state machine. The test passes, but only because it's asserting all the wrong behaviour. I marked all the behaviour I think is wrong with BUG comments, and several additional test opportunities with TODO. Note: the new test supercedes TestStartsInNeedsLoginState, which was checking for incorrect behaviour (although the new test still checks for the same incorrect behaviour) and assumed .Start() would converge before returning, which it happens to do, but only for this very specific case, for the current implementation. You're supposed to wait for the notifications. Updates: tailscale/corp#1660 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
David Anderson	bf5fc8edda	go.mod: update wireguard-go. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	ae36b57b71	go.mod: upgrade wireguard-go This should be the last bump before 1.8. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Brad Fitzpatrick	8efc7834f2	go.mod: bump wireguard-go Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	5ecc7c7200	cmd/tailscale: make the new 'up' errors prettier and more helpful Fixes #1746 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	f72a120016	go.mod: upgrade to latest wireguard-go Pull in minor upstream changes. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Josh Bleecher Snyder	7183e1f052	go.mod: update wireguard-go again To pick up https://go-review.googlesource.com/c/sys/+/307129. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	63c00764e1	go.mod: update to latest wireguard-go and x/sys To fix windows checkptr failures. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	b3ceca1dd7	wgengine/...: split into multiple receive functions Upstream wireguard-go has changed its receive model. NewDevice now accepts a conn.Bind interface. The conn.Bind is stateless; magicsock.Conns are stateful. To work around this, we add a connBind type that supports cheap teardown and bring-up, backed by a Conn. The new conn.Bind allows us to specify a set of receive functions, rather than having to shoehorn everything into ReceiveIPv4 and ReceiveIPv6. This lets us plumbing DERP messages directly into wireguard-go, instead of having to mux them via ReceiveIPv4. One consequence of the new conn.Bind layer is that closing the wireguard-go device is now indistinguishable from the routine bring-up and tear-down normally experienced by a conn.Bind. We thus have to explicitly close the magicsock.Conn when the close the wireguard-go device. One downside of this change is that we are reliant on wireguard-go to call receiveDERP to process DERP messages. This is fine for now, but is perhaps something we should fix in the future. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1df162b05b	wgengine/magicsock: adapt CreateEndpoint signature to match wireguard-go Part of a temporary change to make merging wireguard-go easier. See https://github.com/tailscale/wireguard-go/pull/45. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	47363c95b0	go.mod: bump wireguard-go	4 years ago
Brad Fitzpatrick	a7be780155	go.mod, go.sum: bump wireguard-go	4 years ago
David Anderson	95ca86c048	go.mod: update to new wireguard-go version. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Adrian Dewhurst	04dd6d1dae	control/controlclient: sign RegisterRequest (#1549 ) control/controlclient: sign RegisterRequest Some customers wish to verify eligibility for devices to join their tailnets using machine identity certificates. TLS client certs could potentially fulfill this role but the initial customer for this feature has technical requirements that prevent their use. Instead, the certificate is loaded from the Windows local machine certificate store and uses its RSA public key to sign the RegisterRequest message. There is room to improve the flexibility of this feature in future and it is currently only tested on Windows (although Darwin theoretically works too), but this offers a reasonable starting place for now. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago
Josh Bleecher Snyder	28af46fb3b	wgengine: pass logger as a separate arg to device.NewDevice Adapt to minor API changes in wireguard-go. And factor out device.DeviceOptions variables. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	0a02aaf813	control, ipn, tailcfg: remove golang.org/x/oauth2 dep, add tailcfg.Oauth2Token golang.org/x/oauth2 pulls in App Engine and grpc module dependencies, screwing up builds that depend on this module. Some background on the problem: https://go.googlesource.com/proposal/+/master/design/36460-lazy-module-loading.md Fixes tailscale/corp#1471 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	aa79a57f63	wgengine/netstack: use inet.af/netstack, remove 64-bit only limitation This reverts the revert commit `84aba349d9`. And changes us to use inet.af/netstack. Updates #1518 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a217078f67	go.mod: update golang.org/x/oauth2 go.sum gets a bit wild, but tolerable. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ec1b31ea83	go.mod: update golang.org/x/{crypto,sync,sys,term,time} These ones don't have large dependency trees. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a4fa2c5611	go.mod, go.sum: go mod tidy Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	84aba349d9	Revert "wgengine/netstack: update gvisor to remove 64-bit only limitation" Breaks our corp repo due to gRPC dependency hell. This reverts commit `d42f8b7f9a`.	4 years ago
Brad Fitzpatrick	d42f8b7f9a	wgengine/netstack: update gvisor to remove 64-bit only limitation gVisor fixed their google/gvisor#1446 so we can include gVisor mode on 32-bit machines. A few minor upstream API changes, as normal. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Denton Gentry	6756f20632	go.mod: update peercred Adds FreeBSD support. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
David Anderson	b83c273737	wgengine/filter: use IPSet for localNets instead of prefixes. Part of #1177, preparing for doing fancier set operations on the allowed local nets. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Matt Layher	2c500cee23	go.mod: bump github.com/mdlayher/netlink, github.com/jsimonetti/rtnetlink Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Filippo Valsorda	87f2e4c12c	go.mod: bump github.com/kr/pty to build on openbsd/arm64 $ GOOS=openbsd GOARCH=arm64 go install tailscale.com/cmd/...@latest pkg/mod/github.com/kr/pty@v1.1.4-0.20190131011033-7dc38fb350b1/pty_openbsd.go:24:10: undefined: ptmget pkg/mod/github.com/kr/pty@v1.1.4-0.20190131011033-7dc38fb350b1/pty_openbsd.go:25:34: undefined: ioctl_PTMGET "go mod tidy" did some unrelated work in go.sum, maybe because it was not run with Go 1.16 before. Signed-off-by: Filippo Valsorda <hi@filippo.io>	4 years ago
Brad Fitzpatrick	86d3a6c9a6	Switch to Go 1.16. Fixes #1370 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d3efe8caf6	safesocket, ipn/ipnserver: look up peer creds on Darwin And open up socket permissions like Linux, now that we know who connections are from. This uses the new inet.af/peercred that supports Linux and Darwin at the moment. Fixes #1347 Fixes #1348 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago

1 2 3 4

200 Commits (9ae3bd09394c8d41bc065fdf8856739b468f51f7)