tailscale

Commit Graph

Author	SHA1	Message	Date
Andrew Dunham	e85613aa2d	net/netcheck: don't use a space in the captive portal challenge The derpers don't allow whitespace in the challenge. Change-Id: I93a8b073b846b87854fba127b5c1d80db205f658 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Brad Fitzpatrick	db2cc393af	util/dirwalk, metrics, portlist: add new package for fast directory walking This is similar to the golang.org/x/tools/internal/fastwalk I'd previously written but not recursive and using mem.RO. The metrics package already had some Linux-specific directory reading code in it. Move that out to a new general package that can be reused by portlist too, which helps its scanning of all /proc files: name old time/op new time/op delta FindProcessNames-8 2.79ms ± 6% 2.45ms ± 7% -12.11% (p=0.000 n=10+10) name old alloc/op new alloc/op delta FindProcessNames-8 62.9kB ± 0% 33.5kB ± 0% -46.76% (p=0.000 n=9+10) name old allocs/op new allocs/op delta FindProcessNames-8 2.25k ± 0% 0.38k ± 0% -82.98% (p=0.000 n=9+10) Change-Id: I75db393032c328f12d95c39f71c9742c375f207a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	d57cba8655	net/tshttpproxy: add clientmetrics on Windows proxy lookup paths To collect some data on how widespread this is and whether there's any correlation between different versions of Windows, etc. Updates #4811 Change-Id: I003041d0d7e61d2482acd8155c1a4ed413a2c5c4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f4ff26f577	types/pad32: delete package Use Go 1.19's new 64-bit alignment ~hidden feature instead. Fixes #5356 Change-Id: Ifcbcb115875a7da01df3bc29e9e7feadce5bc956 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	223126fe5b	cmd/derper, net/netcheck: add challenge/response to generate_204 endpoint The Lufthansa in-flight wifi generates a synthetic 204 response to the DERP server's /generate_204 endpoint. This PR adds a basic challenge/response to the endpoint; something sufficiently complicated that it's unlikely to be implemented by a captive portal. We can then check for the expected response to verify whether we're being MITM'd. Follow-up to #5601 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I94a68c9a16a7be7290200eea6a549b64f02ff48f	2 years ago
Mihai Parparita	9d04ffc782	net/wsconn: add back custom wrapper for turning a websocket.Conn into a net.Conn We removed it in #4806 in favor of the built-in functionality from the nhooyr.io/websocket package. However, it has an issue with deadlines that has not been fixed yet (see nhooyr/websocket#350). Temporarily go back to using a custom wrapper (using the fix from our fork) so that derpers will stop closing connections too aggressively. Updates #5921 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Josh Soref	d4811f11a0	all: fix spelling mistakes Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>	2 years ago
Aaron Klotz	44f13d32d7	cmd/tailscaled, util/winutil: log Windows service diagnostics when the wintun device fails to install I added new functions to winutil to obtain the state of a service and all its depedencies, serialize them to JSON, and write them to a Logf. When tstun.New returns a wrapped ERROR_DEVICE_NOT_AVAILABLE, we know that wintun installation failed. We then log the service graph rooted at "NetSetupSvc". We are interested in that specific service because network devices will not install if that service is not running. Updates https://github.com/tailscale/tailscale/issues/5531 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Tom DNetto	e9b98dd2e1	control/controlclient,ipn/ipnlocal: wire tka enable/disable Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Eng Zer Jun	f0347e841f	refactor: move from io/ioutil to io and os packages The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	2 years ago
Mihai Parparita	1ce0e558a7	cmd/derper, control/controlhttp: disable WebSocket compression The data that we send over WebSockets is encrypted and thus not compressible. Additionally, Safari has a broken implementation of compression (see nhooyr/websocket#218) that makes enabling it actively harmful. Fixes tailscale/corp#6943 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Andrew Dunham	eb5939289c	cmd/derper: add /generate_204 endpoint (#5601 ) For captive portal detection. Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Brad Fitzpatrick	89fee056d3	cmd/derper: add robots.txt to disallow all Fixes #5565 Change-Id: I5626ec2116d9be451caef651dc301b7a82e35550 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	c9961b8b95	cmd/derper: filter out useless HTTP error logs (#5563 ) These errors aren't actionable and just fill up logs with useless data. See the following Go issue for more details: https://golang.org/issue/26918 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Brad Fitzpatrick	02de34fb10	cmd/derper: add flag to run derper in bootstrap-dns-only mode Change-Id: Iba128e94464afa605bc9df1f06a91d296380eed0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	a0bae4dac8	cmd/derper: add support for unpublished bootstrap DNS entries (#5529 ) Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Tom DNetto	facafd8819	client,cmd/tailscale,ipn,tka,types: implement tka initialization flow This PR implements the client-side of initializing network-lock with the Coordination server. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	18edd79421	control/controlclient,tailcfg: [capver 40] create KeySignature field in tailcfg.Node We calve out a space to put the node-key signature (used on tailnets where network lock is enabled). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Kris Brandow	8f38afbf8e	net/stun: convert to use net/netip.AddrPort Convert ParseResponse and Response to use netip.AddrPort instead of net.IP and separate port. Fixes #5281 Signed-off-by: Kris Brandow <kris.brandow@gmail.com>	2 years ago
Brad Fitzpatrick	090033ede5	cmd/derper: fix data race & server panic in manual cert mode (Thanks for debugging, Roland!) Fixes #4082 Change-Id: I400a64001c3c58899bb570b759b08e745abc0be1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ec9d13bce5	hostinfo, net/netcheck: use CutPrefix Updates #5309 Change-Id: I37e594cfd245784bf810c493de68a66d3ff20677 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Crawshaw	93324cc7b3	cmd/derper: add depaware.txt Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Maisem Ali	a9f6cd41fd	all: use syncs.AtomicValue Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Joe Tsai	b905db7a56	cmd/derper: remove support for logtail logging (#5248 ) There aren't really any useful logs produced by derper. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Charlotte Brandhorst-Satzkorn	4c0feba38e	derp: plumb '/derp' request context through (#5083 ) This change is required to implement tracing for derp. Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	2 years ago
Mihai Parparita	edc90ebc61	net/wsconn: remove homegrown wrapper for turning a websocket.Conn into a net.Conn The one from the nhooyr/websocket package seems to work equally well. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Mihai Parparita	a9f32656f5	control/controlhttp: allow client and server to communicate over WebSockets We can't do Noise-over-HTTP in Wasm/JS (because we don't have bidirectional communication), but we should be able to do it over WebSockets. Reuses derp WebSocket support that allows us to turn a WebSocket connection into a net.Conn. Updates #3157 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Brad Fitzpatrick	740e3c006c	cmd/derper: add --stun-port flag And flesh out docs on the --http-port flag. Change-Id: If9d42665f67409082081cb9a25ad74e98869337b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a80cef0c13	cmd/derper: fix regression from bootstrap DNS optimization The commit `b9c92b90db` earlier today caused a regression of serving an empty map always, as it was JSON marshalling an atomic.Value instead of the DNS entries map it just built. Change-Id: I9da3eeca132c6324462dedeaa7d002908557384b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	84046d6f7c	Revert "cmd/derper: stop setting content header in handleBootstrapDNS" Didn't help enough. We are setting another header anyway. Restore it. This reverts commit `60abeb027b`. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	ec62217f52	cmd/derper: close connections once bootstrap DNS has been served Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	60abeb027b	cmd/derper: stop setting content header in handleBootstrapDNS No one really cares. Its cost outweighs its usefulness. name old time/op new time/op delta HandleBootstrapDNS-10 105ns ± 4% 65ns ± 2% -37.68% (p=0.000 n=15+14) name old alloc/op new alloc/op delta HandleBootstrapDNS-10 416B ± 0% 0B -100.00% (p=0.000 n=15+15) name old allocs/op new allocs/op delta HandleBootstrapDNS-10 3.00 ± 0% 0.00 -100.00% (p=0.000 n=15+15) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	b9c92b90db	cmd/derper: optimize handleBootstrapDNS Do json formatting once, rather than on every request. Use an atomic.Value. name old time/op new time/op delta HandleBootstrapDNS-10 6.35µs ± 0% 0.10µs ± 4% -98.35% (p=0.000 n=14+15) name old alloc/op new alloc/op delta HandleBootstrapDNS-10 3.20kB ± 0% 0.42kB ± 0% -86.99% (p=0.000 n=12+15) name old allocs/op new allocs/op delta HandleBootstrapDNS-10 41.0 ± 0% 3.0 ± 0% -92.68% (p=0.000 n=15+15) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	e206a3663f	cmd/derper: add BenchmarkHandleBootstrapDNS Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Joe Tsai	0173a50bf0	cmd/derper: add a rate limiter for accepting new connection (#3908 ) A large influx of new connections can bring down DERP since it spins off a new goroutine for each connection, where each routine may do significant amount of work (e.g., allocating memory and crunching numbers for TLS crypto). The momentary spike can cause the process to OOM. This commit sets the groundwork for limiting connections, but leaves the limit at infinite by default. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Brad Fitzpatrick	fa612c28cf	cmd/derper: make --stun default to on, flesh out flag docs Change-Id: I49e80c61ab19e78e4c8b4bc9012bb70cfe3bfa75 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	f5ec916214	cmd/derper: disable TLS 1.0 and 1.1. Updates tailscale/corp#3568 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	508f332bb2	cmd/derper: export TLS vars with derper_ prefix, not stun_ Updates tailscale/corp#3568 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	ff3442d92d	cmd/derper: record TLS versions used for requests. Surveying the fleet prior to turning off old/unused/insecure TLS versions. Updates tailscale/corp#3615 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	b8ad90c2bf	cmd/derper: in manual cert mode, don't discard error from VerifyHostname Updates #3701 Change-Id: If8ca5104bd8221c99cc390ca49ee3401aff09b62 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Arnaud Dezandee	656809e4ee	cmd/derper: allow http port configuration Signed-off-by: Arnaud Dezandee <dezandee.arnaud@gmail.com>	3 years ago
David Anderson	db800ddeac	cmd/derper: set Content-Security-Policy on DERPs. It's a basic "deny everything" policy, since DERP's HTTP server is very uninteresting from a browser POV. But it stops every security scanner under the sun from reporting "dangerously configured" HTTP servers. Updates tailscale/corp#3119 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	9a217ec841	cmd/derper: increase HSTS cache lifetime to 2 years. Fixes #3373. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	937e96f43d	cmd/derper: enable HSTS when serving over HTTPS. Starting with a short lifetime, to verify nothing breaks. Updates #3373 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
oocococo	3a2b0fc36c	cmd/derper: support custom TLS port when in manual mode (#3231 ) Fixes #3232 Change-Id: I8dae5c01f9dfdfd6d45e34e4ca3534b642ae5c8e Signed-off-by: oocococo <mercurial.lx@gmail.com>	3 years ago
David Anderson	37c150aee1	derp: use new node key type. Update #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	a47158e14d	cmd/derper: use new node key type. Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	b0b0a80318	net/netcheck: implement netcheck for js/wasm clients And the derper change to add a CORS endpoint for latency measurement. And a little magicsock change to cut down some log spam on js/wasm. Updates #3157 Change-Id: I5fd9e6f5098c815116ddc8ac90cbcd0602098a48 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	505f844a43	cmd/derper, derp/derphttp: add websocket support Updates #3157 Change-Id: I337a919a3b350bc7bd9af567b49c4d5d6616abdd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0be26599ca	cmd/derper: refactor STUN path for testing, add serverSTUN benchmark Real goal is to eliminate some allocs in the STUN path, but that requires work in the standard library. See comments in #2783. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago

1 2 3

102 Commits (9dfb0916c2f146febe99a502a517a8979a9961ac)