1356 Commits (a5dcc4c87b3cb3235cea23566620102d600be5e6)

Author	SHA1	Message	Date
Charlotte Brandhorst-Satzkorn	ddb4040aa0	wgengine/magicsock: add address selection for wireguard only endpoints (#7979) ... This change introduces address selection for wireguard only endpoints. If a endpoint has not been used before, an address is randomly selected to be used based on information we know about, such as if they are able to use IPv4 or IPv6. When an address is initially selected, we also initiate a new ICMP ping to the endpoints addresses to determine which endpoint offers the best latency. This information is then used to update which endpoint we should be using based on the best possible route. If the latency is the same for a IPv4 and an IPv6 address, IPv6 will be used. Updates #7826 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	1 year ago
Andrew Dunham	bcf7b63d7e	wgengine/magicsock: add hysteresis to endpoint selection ... Avoid selecting an endpoint as "better" than the current endpoint if the total latency improvement is less than 1%. This adds some hysteresis to avoid flapping between endpoints for a minimal improvement in latency. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If8312e1768ea65c4b4d4e13d8de284b3825d7a73	1 year ago
Mihai Parparita	7330aa593e	all: avoid repeated default interface lookups ... On some platforms (notably macOS and iOS) we look up the default interface to bind outgoing connections to. This is both duplicated work and results in logspam when the default interface is not available (i.e. when a phone has no connectivity, we log an error and thus cause more things that we will try to upload and fail). Fixed by passing around a netmon.Monitor to more places, so that we can use its cached interface state. Fixes #7850 Updates #7621 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Mihai Parparita	4722f7e322	all: move network monitoring from wgengine/monitor to net/netmon ... We're using it in more and more places, and it's not really specific to our use of Wireguard (and does more just link/interface monitoring). Also removes the separate interface we had for it in sockstats -- it's a small enough package (we already pull in all of its dependencies via other paths) that it's not worth the extra complexity. Updates #7621 Updates #7850 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Andrew Dunham	f85dc6f97c	ci: add more lints (#7909) ... This is a follow-up to #7905 that adds two more linters and fixes the corresponding findings. As per the previous PR, this only flags things that are "obviously" wrong, and fixes the issues found. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8739bdb7bc4f75666a7385a7a26d56ec13741b7c	1 year ago
Andrew Dunham	280255acae	various: add golangci-lint, fix issues (#7905) ... This adds an initial and intentionally minimal configuration for golang-ci, fixes the issues reported, and adds a GitHub Action to check new pull requests against this linter configuration. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8f38fbc315836a19a094d0d3e986758b9313f163	1 year ago
Brad Fitzpatrick	d5a870b4dc	wgengine/monitor: add --monitor-duration flag to opt-in TestMonitorMode ... TestMonitorMode skips by default, without the --monitor flag, and then it previously ran forever. This adds an option --monitor-duration flag that defaults to zero (run forever) but if non-zero bounds how long the tests runs. This means you can then also use e.g. `go test --cpuprofile` and capture a CPU/mem profile for a minute or two. Updates #7621 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Andrew Dunham	80b138f0df	wgengine/magicsock: keep advertising endpoints after we stop discovering them ... Previously, when updating endpoints we would immediately stop advertising any endpoint that wasn't discovered during determineEndpoints. This could result in, for example, a case where we performed an incremental netcheck, didn't get any of our three STUN packets back, and then dropped our STUN endpoint from the set of advertised endpoints... which would result in clients falling back to a DERP connection until the next call to determineEndpoints. Instead, let's cache endpoints that we've discovered and continue reporting them to clients until a timeout expires. In the above case where we temporarily don't have a discovered STUN endpoint, we would continue reporting the old value, then re-discover the STUN endpoint again and continue reporting it as normal, so clients never see a withdrawal. Updates tailscale/coral#108 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I42de72e7418ab328a6c732bdefc74549708cf8b9	1 year ago
Brad Fitzpatrick	4b49ca4a12	wgengine/magicsock: update comments on what implements conn.Bind ... The comment still said *magicsock.Conn implemented wireguard-go conn.Bind. That wasn't accurate anymore. A doc #cleanup. Change-Id: I7fd003b939497889cc81147bfb937b93e4f6865c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	10f1c90f4d	wgengine/magicsock, types/nettype, etc: finish ReadFromUDPAddrPort netip migration ... So we're staying within the netip.Addr/AddrPort consistently and avoiding allocs/conversions to the legacy net addr types. Updates #5162 Change-Id: I59feba60d3de39f773e68292d759766bac98c917 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	29f7df9d8f	wgengine/magicsock, etc: remove mostly unused WriteTo methods ... Updates #2331 Updates #5162 Change-Id: I8291884425481eeaedde38a54adfd8ed7292a497 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
James Tucker	20f17d6e7b	wgengine/magicsock: reenable magicsock tests on Windows ... These tests are passing locally and on CI. They had failed earlier in the day when first fixing up CI, and it is not immediately clear why. I have cycled IPv6 support locally, but this should not have a substantial effect. Updates #7876 Signed-off-by: James Tucker <jftucker@gmail.com>	1 year ago
James Tucker	8dec1a8724	.github/workflows: reenable Windows CI, disable broken tests ... We accidentally switched to ./tool/go in 4022796484 which resulted in no longer running Windows builds, as this is attempting to run a bash script. I was unable to quickly fix the various tests that have regressed, so instead I've added skips referencing #7876, which we need to back and fix. Updates #7262 Updates #7876 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Brad Fitzpatrick	6866aaeab3	wgengine/magicsock: factor out receiveIPv4 & receiveIPv6 common code ... Updates #2331 Change-Id: I801df38b217f5d17203e8dc3b8654f44747e0f4b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Andrew Dunham	228d0c6aea	net/netcheck: use dnscache.Resolver when resolving DERP IPs ... This also adds a bunch of tests for this function to ensure that we're returning the proper IP(s) in all cases. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I0d9d57170dbab5f2bf07abdf78ecd17e0e635399	1 year ago
Maisem Ali	64bbf1738e	tailcfg: make SelfNodeV4MasqAddrForThisPeer a pointer ... This makes `omitempty` actually work, and saves bytes in each map response. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Mihai Parparita	edb02b63f8	net/sockstats: pass in logger to sockstats.WithSockStats ... Using log.Printf may end up being printed out to the console, which is not desirable. I noticed this when I was investigating some client logs with `sockstats: trace "NetcheckClient" was overwritten by another`. That turns to be harmless/expected (the netcheck client will fall back to the DERP client in some cases, which does its own sockstats trace). However, the log output could be visible to users if running the `tailscale netcheck` CLI command, which would be needlessly confusing. Updates tailscale/corp#9230 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
James Tucker	e09c434e5d	wgengine/magicsock: remove locking sync requirements on conn disco keys ... The lazy initialization of the disco key is not necessary, and contributes to unnecessary locking and state checking. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
James Tucker	e1b71c83ac	wgengine/magicsock: remove unused fields on discoInfo ... Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
James Tucker	a257b2f88b	wgengine/magicsock: add immutability documentation to endpointDisco ... Updates #7825 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
James Tucker	fb18af5564	wgengine/netstack: fix data-race on startup ... Running tailscaled with the race detector enabled immediately fires on this field, as it is updated after first read. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Charlotte Brandhorst-Satzkorn	c573bef0aa	tailcfg,wgengine: add initial support for WireGuard only peers ... A peer can have IsWireGuardOnly, which means it will not support DERP or Disco, and it must have Endpoints filled in order to be usable. In the present implementation only the first Endpoint will be used as the bestAddr. Updates tailscale/corp#10351 Co-authored-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com> Co-authored-by: James Tucker <james@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
James Tucker	6cfcb3cae4	wgengine/magicsock: fix synchronization of endpoint disco fields ... Identified in review in #7821 endpoint.discoKey and endpoint.discoShort are often accessed without first taking endpoint.mu. The arrangement with endpoint.mu is inconvenient for a good number of those call-sites, so it is instead replaced with an atomic pointer to carry both pieces of disco info. This will also help with #7821 that wants to add explicit checks/guards to disable disco behaviors when disco keys are missing which is necessarily implicitly mostly covered by this change. Updates #7821 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Tom DNetto	6a627e5a33	net, wgengine/capture: encode NAT addresses in pcap stream ... Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
valscale	7bfb7744b7	derp,magicsock: add debug envknobs for HTTP and derp server name (#7744) ... Make developing derp easier by: 1. Creating an envknob telling clients to use HTTP to connect to derp servers, so devs don't have to acquire a valid TLS cert. 2. Creating an envknob telling clients which derp server to connect to, so devs don't have to edit the ACLs in the admin console to add a custom DERP map. 3. Explaining how the -dev and -a command lines args to derper interact. To use this: 1. Run derper with -dev. 2. Run tailscaled with TS_DEBUG_USE_DERP_HTTP=1 and TS_DEBUG_USE_DERP_ADDR=localhost This will result in the client connecting to derp via HTTP on port 3340. Fixes #7700 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Jordan Whited	f475e5550c	net/neterror, wgengine/magicsock: use UDP GSO and GRO on Linux (#7791) ... This commit implements UDP offloading for Linux. GSO size is passed to and from the kernel via socket control messages. Support is probed at runtime. UDP GSO is dependent on checksum offload support on the egress netdev. UDP GSO will be disabled in the event sendmmsg() returns EIO, which is a strong signal that the egress netdev does not support checksum offload. Updates tailscale/corp#8734 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Andrew Dunham	8d3acc9235	util/sysresources, magicsock: scale DERP buffer based on system memory ... This adds the util/sysresources package, which currently only contains a function to return the total memory size of the current system. Then, we modify magicsock to scale the number of buffered DERP messages based on the system's available memory, ensuring that we never use a value lower than the previous constant of 32. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib763c877de4d0d4ee88869078e7d512f6a3a148d	1 year ago
James Tucker	40fa2a420c	envknob,net/tstun,wgengine: use TS_DEBUG_MTU consistently ... Noted on #5915 TS_DEBUG_MTU was not used consistently everywhere. Extract the default into a function that can apply this centrally and use it everywhere. Added envknob.Lookup{Int,Uint}Sized to make it easier to keep CodeQL happy when using converted values. Updates #5915 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Will Norris	e99c7c3ee5	sockstats: add labels for netlog and sockstatlog packages ... Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Maisem Ali	985535aebc	net/tstun,wgengine/*: add support for NAT to routes ... This adds support to make exit nodes and subnet routers work when in scenarios where NAT is required. It also updates the NATConfig to be generated from a `wgcfg.Config` as that handles merging prefs with the netmap, so it has the required information about whether an exit node is already configured and whether routes are accepted. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
James Tucker	c628132b34	wgengine/netstack: do not send packets to netstack after close ... Use the local context on Impl to check for shut down state in order to drop rather than inject packets after close has begun. Netstack sets endpoint.dispatcher to nil during shutdown. After the recent adjustment in 920ec69241 we now wait for netstack to fully shutdown before we release tests. This means that we may continue to accept packets and attempt to inject them, which we must prevent in order to avoid nil pointer panic. References google/gvisor#8765 Fixes #7715 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Jordan Whited	27e37cf9b3	go.mod, net/tstun, wgengine/magicsock: update wireguard-go (#7712) ... This commit updates the wireguard-go dependency to pull in fixes for the tun package, specifically 052af4a and aad7fca. Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Maisem Ali	920ec69241	tsnet,wgenegine/netstack: add test and fix resource leaks ... We were not closing the http.Server and were also not waiting for netstack to fully close. Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
valscale	74eb99aed1	derp, derphttp, magicsock: send new unknown peer frame when destination is unknown (#7552) ... * wgengine/magicsock: add envknob to send CallMeMaybe to non-existent peer For testing older client version responses to the PeerGone packet format change. Updates #4326 Signed-off-by: Val <valerie@tailscale.com> * derp: remove dead sclient struct member replaceLimiter Leftover from an previous solution to the duplicate client problem. Updates #2751 Signed-off-by: Val <valerie@tailscale.com> * derp, derp/derphttp, wgengine/magicsock: add new PeerGone message type Not Here Extend the PeerGone message type by adding a reason byte. Send a PeerGone "Not Here" message when an endpoint sends a disco message to a peer that this server has no record of. Fixes #4326 Signed-off-by: Val <valerie@tailscale.com> --------- Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Maisem Ali	bb31fd7d1c	net/tstun: add inital support for NAT v4 ... This adds support in tstun to utitilize the SelfNodeV4MasqAddrForThisPeer and perform the necessary modifications to the packet as it passes through tstun. Currently this only handles ICMP, UDP and TCP traffic. Subnet routers and Exit Nodes are also unsupported. Updates tailscale/corp#8020 Co-authored-by: Melanie Warrick <warrick@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	535fad16f8	net/tstun: rename filterIn/filterOut methods to be more descriptive ... Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Will Norris	57a008a1e1	all: pass log IDs as the proper type rather than strings ... This change focuses on the backend log ID, which is the mostly commonly used in the client. Tests which don't seem to make use of the log ID just use the zero value. Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Maisem Ali	b0cb39cda1	tsnet: only intercept TCP flows that have listeners ... Previously, it would accept all TCP connections and then close the ones it did not care about. Make it only ever accept the connections that it cares about. Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Andrew Dunham	be107f92d3	wgengine/magicsock: track per-endpoint changes in ringbuffer ... This change adds a ringbuffer to each magicsock endpoint that keeps a fixed set of "changes"–debug information about what updates have been made to that endpoint. Additionally, this adds a LocalAPI endpoint and associated "debug peer-status" CLI subcommand to fetch the set of changes for a given IP or hostname. Updates tailscale/corp#9364 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I34f726a71bddd0dfa36ec05ebafffb24f6e0516a	1 year ago
Mihai Parparita	6ac6ddbb47	sockstats: switch label to enum ... Makes it cheaper/simpler to persist values, and encourages reuse of labels as opposed to generating an arbitrary number. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Brad Fitzpatrick	9ff51ca17f	wgengine/netstack: add support for custom UDP flow handlers ... To be used by tsnet and sniproxy later. Updates #5871 Updates #1748 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	1a30b2d73f	all: use tstest.Replace more ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Andrew Dunham	3f8e8b04fd	cmd/tailscale, cmd/tailscaled: move portmapper debugging into tailscale CLI ... The debug flag on tailscaled isn't available in the macOS App Store build, since we don't have a tailscaled binary; move it to the 'tailscale debug' CLI that is available on all platforms instead, accessed over LocalAPI. Updates #7377 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I47bffe4461e036fab577c2e51e173f4003592ff7	1 year ago
Mihai Parparita	3e71e0ef68	net/sockstats: remove explicit dependency on wgengine/monitor ... Followup to #7177 to avoid adding extra dependencies to the CLI. We instead declare an interface for the link monitor. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
James Tucker	7b73c9628d	version/distro,wgengine/router: raise WSL eth0 MTU when too low ... WSL has started to set the eth0 default route interface default to 1280 MTU, which is too low to carry 1280 byte packets from tailscale0 once wrapped in WireGuard. The change down to 1280 is very likely smaller than necessary for almost all users. We can not easily determine the ideal MTU, but if all the preconditions match, we raise the MTU to 1360, which is just enough for Tailscale traffic to work. Updates #4833 Updates #7346 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Mihai Parparita	9cb332f0e2	sockstats: instrument networking code paths ... Uses the hooks added by tailscale/go#45 to instrument the reads and writes on the major code paths that do network I/O in the client. The convention is to use "<package>.<type>:<label>" as the annotation for the responsible code path. Enabled on iOS, macOS and Android only, since mobile platforms are the ones we're most interested in, and we are less sensitive to any throughput degradation due to the per-I/O callback overhead (macOS is also enabled for ease of testing during development). For now just exposed as counters on a /v0/sockstats PeerAPI endpoint. We also keep track of the current interface so that we can break out the stats by interface. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Joe Tsai	0d19f5d421	all: replace logtail.{Public,Private}ID with logid.{Public,Private}ID (#7404) ... The log ID types were moved to a separate package so that code that only depend on log ID types do not need to link in the logic for the logtail client itself. Not all code need the logtail client. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	1 year ago
Denton Gentry	fdc2018d67	wgengine/magicsock: remove superfluous "discokey" from log ... The stringification of the discokey type now prepends "discokey:" Fixes https://github.com/tailscale/tailscale/issues/3074 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
Tom DNetto	2ca6dd1f1d	wgengine: start logging DISCO frames to pcap stream ... Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Tom DNetto	99b9d7a621	all: implement pcap streaming for datapath debugging ... Updates: tailscale/corp#8470 Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Andrew Dunham	7393ce5e4f	wgengine/magicsock: add envknob to print information about port selection ... To aid in debugging where a customer has static port-forwards set up and there are issues establishing a connection through that port. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic5558bcdb40c9119b83f79dcacf2233b07777f2a	1 year ago
Brad Fitzpatrick	cf8dd7aa09	all: use Go 1.20's bytes.Clone ... Updates #7123 Updates #6257 (more to do in other repos) Change-Id: I073e2a6d81a5d7fbecc29caddb7e057ff65239d0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jordan Whited	39e52c4b0a	wgengine/magicsock: fix de-dup disco ping handling for netmap endpoints (#7118) ... Fixes #7116 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Maisem Ali	04b57a371e	ipn/ipnlocal: drop not required StateKey parameter ... This is #cleanup now that #7121 is merged. Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Jordan Whited	7921198c05	wgengine/magicsock: de-dup disco pings (#7093) ... Fixes #7078 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Will Norris	947c14793a	all: update tools that manage copyright headers ... Update all code generation tools, and those that check for license headers to use the new standard header. Also update copyright statement in LICENSE file. Fixes #6865 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Will Norris	71029cea2d	all: update copyright and license headers ... This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Brad Fitzpatrick	d8feeeee4c	wgengine/magicsock: fix buggy fast path in Conn.SetNetworkMap ... Spotted by Maisem. Fixes #6680 Change-Id: I5fdc01de8b006a1c43a2a4848f69397f54b4453a Co-authored-By: Maisem Ali <maisem@tailscale.com> Co-authored-By: Andrew Dunham <andrew@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
James Tucker	e002260b62	wgengine/wglog: add a prefix for all wireguard logs ... Fixes #7041 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Jordan Whited	fec888581a	wgengine/magicsock: retry failed single packet ops across rebinds (#6990) ... The single packet WriteTo() through RebindingUDPConn.WriteBatch() was not checking for a rebind between loading the PacketConn and writing to it. Same with ReadFrom()/ReadBatch(). Fixes #6989 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Andrew Dunham	4fb663fbd2	various: mark more tests as flaky ... Updates #2855 Updates #3598 Updates #7008 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I2b849e04646456b9f0c8a01563f2add752f4b2a4	1 year ago
Andrew Dunham	58ad21b252	wgengine/netstack: fix data race in tests ... This uses the helper function added in #6173 to avoid flakes like: https://github.com/tailscale/tailscale/actions/runs/3826912237/jobs/6511078024 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If3f1d3b9c0f64ffcb4ba9a30d3522ec49484f993	1 year ago
Andrew Dunham	aea251d42a	cmd/testwrapper: move from corp; mark magicsock test as flaky ... Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ibab5860f5797b3db151d3c27855333e43a9088a4	1 year ago
Brad Fitzpatrick	2df38b1feb	wgengine/magicsock: quiet log flood at tailscaled shutdown ... When you hit control-C on a tailscaled (notably in dev mode, but also on any systemctl stop/restart), there is a flood of messages like: magicsock: doing cleanup for discovery key d:aa9c92321db0807f magicsock: doing cleanup for discovery key d:bb0f16aacadbfd46 magicsock: doing cleanup for discovery key d:b5b2d386296536f2 magicsock: doing cleanup for discovery key d:3b640649f6796c91 magicsock: doing cleanup for discovery key d:71d7b1afbcce52cd magicsock: doing cleanup for discovery key d:315b61d7e0111377 magicsock: doing cleanup for discovery key d:9301f63dce69bf45 magicsock: doing cleanup for discovery key d:376141884d6fe072 .... It can be hundreds or even tens of thousands. So don't do that. Not a useful log message during shutdown. Change-Id: I029a8510741023f740877df28adff778246c18e5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	c1a2e2c380	net/{packet,tstun},wgengine/filter: fix unknown IP protocol handling ... 01b90df2fa added SCTP support before (with explicit parsing for ports) and 69de3bf7bf tried to add support for arbitrary IP protocols (as long as the ACL permited a port of "*", since we might not know how to find ports from an arbitrary IP protocol, if it even has such a concept). But apparently that latter commit wasn't tested end-to-end enough. It had a lot of tests, but the tests made assumptions about layering that either weren't true, or regressed since 1.20. Notably, it didn't remove the (*Filter).pre bidirectional filter that dropped all "unknown" protocol packets both leaving and entering, even if there were explicit protocol matches allowing them in. Also, don't map all unknown protocols to 0. Keep their IP protocol number parsed so it's matchable by later layers. Only reject illegal things. Fixes #6423 Updates #2162 Updates #2163 Change-Id: I9659b3ece86f4db51d644f9b34df78821758842c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	3386a59cf1	wgengine/filter: include IP proto number in unknown protocol errors ... Updates #6423 Change-Id: I9e363922e2c24fdc42687707c069af5bba68b93e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	006ec659e6	wgengine/filter: reorder RunOut disjunctive cases to match RunIn above ... Change-Id: Ia422121cde1687044b18be7bea9e7bf51a4183b9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Andrew Dunham	11ce5b7e57	ipn/ipnlocal, wgengine/magicsock: check Expired bool on Node; print error in Ping ... Change-Id: Ic5f533f175a6e1bb73d4957d8c3f970add42e82e Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	1 year ago
Tom DNetto	2ac5474be1	net/flowtrack,wgengine/filter: refactor Cache to use generics ... Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Tom DNetto	673b3d8dbd	net/dns,userspace: remove unused DNS paths, normalize query limit on iOS ... With a42a594bb3, iOS uses netstack and hence there are no longer any platforms which use the legacy MagicDNS path. As such, we remove it. We also normalize the limit for max in-flight DNS queries on iOS (it was 64, now its 256 as per other platforms). It was 64 for the sake of being cautious about memory, but now we have 50Mb (iOS-15 and greater) instead of 15Mb so we have the spare headroom. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	aad6830df0	util/codegen, all: use latest year, not time.Now, in generated files ... Updates #6865 Change-Id: I6b86c646968ebbd4553cf37df5e5612fbf5c5f7d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Claire Wang	a45c9f982a	wgengine/netstack: change netstack API to require LocalBackend ... The macOS client was forgetting to call netstack.Impl.SetLocalBackend. Change the API so that it can't be started without one, eliminating this class of bug. Then update all the callers. Updates #6764 Change-Id: I2b3a4f31fdfd9fdbbbbfe25a42db0c505373562f Signed-off-by: Claire Wang <claire@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	caa2fe394f	wgengine/netstack: delete some dead code, old comment, use atomic int types ... Noticed while looking at something else; #cleanup. Change-Id: Icde7749363014eab9bebe1dd80708f5491f933d1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	1011e64ad7	wgengine/monitor: don't log unhandled RTM_{NEW,DEL}LINK messages ... These aren't handled, but it's not an error to get one. Fixes #6806 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1fcb9032ac36420aa72a048bf26f58360b9461f9	2 years ago
Brad Fitzpatrick	be10b529ec	wgengine/magicsock: add TS_DISCO_PONG_IPV4_DELAY knob to bias IPv6 paths ... Fixes #6818 Change-Id: I71597a045c5b4117af69fba869cb616271c0dfe1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
andig	14e8afe444	go.mod, etc: bump gvisor ... Fixes #6554 Change-Id: Ia04ae37a47b67fa57091c9bfe1d45a1842589aa8 Signed-off-by: andig <cpuidle@gmx.de>	2 years ago
Brad Fitzpatrick	2eff9c8277	wgengine/magicsock: avoid ReadBatch/WriteBatch on old Linux kernels ... Fixes #6807 Change-Id: I161424ef8a7338e1941d5e43d72dc6529993a0e3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	0f604923d3	ipn/ipnlocal: fix StatusWithoutPeers not populating parts of Status ... Fixes #4311 Change-Id: Iaae0615148fa7154f4ef8f66b455e3a6c2fa9df3 Co-authored-by: Claire Wang <claire@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	d9df023e6f	net/connstats: enforce maximum number of connections (#6760) ... The Tailscale logging service has a hard limit on the maximum log message size that can be accepted. We want to ensure that netlog messages never exceed this limit otherwise a client cannot transmit logs. Move the goroutine for periodically dumping netlog messages from wgengine/netlog to net/connstats. This allows net/connstats to manage when it dumps messages, either based on time or by size. Updates tailscale/corp#8427 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	44be59c15a	wgengine/magicsock: fix panic in wireguard-go rate limiting path ... Fixes #6686 Change-Id: I1055a87141b07261afed8e36c963a69f3be26088 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	0d47cd2284	wgengine/monitor: fix panic due to race on Windows ... It's possible for the 'somethingChanged' callback to be registered and then trigger before the ctx field is assigned; move the assignment earlier so this can't happen. Change-Id: Ia7ee8b937299014a083ab40adf31a8b3e0db4ec5 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Jordan Whited	ea5ee6f87c	all: update golang.zx2c4.com/wireguard to github.com/tailscale/wireguard-go (#6692) ... This is temporary while we work to upstream performance work in https://github.com/WireGuard/wireguard-go/pull/64. A replace directive is less ideal as it breaks dependent code without duplication of the directive. Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
Andrew Dunham	b63094431b	wgengine/router: fix tests on systems with older Busybox 'ip' binary ... Adjust the expected system output by removing the unsupported mask component including and after the slash in expected output like: fwmask 0xabc/0xdef This package's tests now pass in an Alpine container when the 'go' and 'iptables' packages are installed (and run as privileged so /dev/net/tun exists). Fixes #5928 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id1a3896282bfa36b64afaec7a47205e63ad88542	2 years ago
Jordan Whited	76389d8baf	net/tstun, wgengine/magicsock: enable vectorized I/O on Linux (#6663) ... This commit updates the wireguard-go dependency and implements the necessary changes to the tun.Device and conn.Bind implementations to support passing vectors of packets in tailscaled. This significantly improves throughput performance on Linux. Updates #414 Signed-off-by: Jordan Whited <jordan@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com> Co-authored-by: James Tucker <james@tailscale.com>	2 years ago
Mihai Parparita	bdc45b9066	wgengine/magicsock: fix panic when rebinding fails ... We would replace the existing real implementation of nettype.PacketConn with a blockForeverConn, but that violates the contract of atomic.Value (where the type cannot change). Fix by switching to a pointer value (atomic.Pointer[nettype.PacketConn]). A longstanding issue, but became more prevalent when we started binding connections to interfaces on macOS and iOS (#6566), which could lead to the bind call failing if the interface was no longer available. Fixes #6641 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Joe Tsai	2e5d08ec4f	net/connstats: invert network logging data flow (#6272) ... Previously, tstun.Wrapper and magicsock.Conn managed their own statistics data structure and relied on an external call to Extract to extract (and reset) the statistics. This makes it difficult to ensure a maximum size on the statistics as the caller has no introspection into whether the number of unique connections is getting too large. Invert the control flow such that a *connstats.Statistics is registered with tstun.Wrapper and magicsock.Conn. Methods on non-nil *connstats.Statistics are called for every packet. This allows the implementation of connstats.Statistics (in the future) to better control when it needs to flush to ensure bounds on maximum sizes. The value registered into tstun.Wrapper and magicsock.Conn could be an interface, but that has two performance detriments: 1. Method calls on interface values are more expensive since they must go through a virtual method dispatch. 2. The implementation would need a sync.Mutex to protect the statistics value instead of using an atomic.Pointer. Given that methods on constats.Statistics are called for every packet, we want reduce the CPU cost on this hot path. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	35c10373b5	types/logid: move logtail ID types here (#6336) ... Many packages reference the logtail ID types, but unfortunately pull in the transitive dependencies of logtail. Fix this problem by putting the log ID types in its own package with minimal dependencies. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	ea25ef8236	util/set: add new set package for SetHandle type ... We use this pattern in a number of places (in this repo and elsewhere) and I was about to add a fourth to this repo which was crossing the line. Add this type instead so they're all the same. Also, we have another Set type (SliceSet, which tracks its keys in order) in another repo we can move to this package later. Change-Id: Ibbdcdba5443fae9b6956f63990bdb9e9443cefa9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Aaron Klotz	033bd94d4c	cmd/tailscaled, wgengine/router: use wingoes/com for COM initialization instead of go-ole ... This patch removes the crappy, half-backed COM initialization used by `go-ole` and replaces that with the `StartRuntime` function from `wingoes`, a library I have started which, among other things, initializes COM properly. In particular, we should always be initializing COM to use the multithreaded apartment. Every single OS thread in the process becomes implicitly initialized as part of the MTA, so we do not need to concern ourselves as to whether or not any particular OS thread has initialized COM. Furthermore, we no longer need to lock the OS thread when calling methods on COM interfaces. Single-threaded apartments are designed solely for working with Win32 threads that have a message pump; any other use of the STA is invalid. Fixes https://github.com/tailscale/tailscale/issues/3137 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Maisem Ali	18c7c3981a	ipn/ipnlocal: call checkPrefs in Start too ... We were not calling checkPrefs on `opts.*Prefs` in (*LocalBackend).Start(). Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	3a168cc1ff	wgengine/magicsock: ignore pre-disco (pre-0.100) peers ... There aren't any in the wild, other than one we ran on purpose to keep us honest, but we can bump that one forward to 0.100. Change-Id: I129e70724b2d3f8edf3b496dc01eba3ac5a2a907 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
phirework	a011320370	magicsock: cleanup canp2p (#6391) ... This renames canP2P in magicsock to canP2PLocked to reflect expectation of mutex lock, fixes a race we discovered in the meantime, and updates the current stats. Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Jenny Zhang <jz@tailscale.com>	2 years ago
Brad Fitzpatrick	3f8e185003	health: add Warnable, move ownership of warnable items to callers ... The health package was turning into a rando dumping ground. Make a new Warnable type instead that callers can request an instance of, and then Set it locally in their code without the health package being aware of all the things that are warnable. (For plenty of things the health package will want to know details of how Tailscale works so it can better prioritize/suppress errors, but lots of the warnings are pretty leaf-y and unrelated) This just moves two of the health warnings. Can probably move more later. Change-Id: I51e50e46eb633f4e96ced503d3b18a1891de1452 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	d585cbf02a	wgengine/router: [bsd/darwin] remove and readd routes on profile change ... Noticed when testing FUS on tailscale-on-macOS, that routing would break completely when switching between profiles. However, it would start working again when going back to the original profile tailscaled started with. Turns out that if we change the addrs on the interface we need to remove and readd all the routes. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	4d330bac14	ipn/ipnlocal: add support for multiple user profiles ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	b683921b87	ipn/ipnlocal: add start of handling TCP proxying ... Updates tailscale/corp#7515 Change-Id: I82d19b5864674b2169f25ec8e429f60a543e0c57 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	79472a4a6e	wgengine/netstack: optimize shouldProcessInbound, avoiding 4via6 lookups ... All IPv6 packets for the self address were doing netip.Prefix.Contains lookups. If if we know they're for a self address (which we already previously computed and have sitting in a bool), then they can't be for a 4via6 range. Change-Id: Iaaaf1248cb3fecec229935a80548ead0eb4cb892 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	2daf0f146c	ipn/ipnlocal, wgengine/netstack: start handling ports for future serving ... Updates tailscale/corp#7515 Change-Id: I966e936e72a2ee99be8d0f5f16872b48cc150258 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	acf5839dd2	wgengine/netstack: add tests for shouldProcessInbound ... Inspired by #6235, let's explicitly test the behaviour of this function to ensure that we're not processing things we don't expect to. Change-Id: I158050a63be7410fb99452089ea607aaf89fe91a Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Brad Fitzpatrick	abfdcd0f70	wgengine/netstack: fix shouldProcessInbound peerapi non-SYN handling ... It was eating TCP packets to peerapi ports to subnet routers. Some of the TCP flow's packets went onward, some got eaten. So some TCP flows to subnet routers, if they used an unfortunate TCP port number, got broken. Change-Id: Ifea036119ccfb081f4dfa18b892373416a5239f8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago