547 Commits (ad3d6e31f0d9b656b1c8ed6b8d6c46452f0ad225)

Author	SHA1	Message	Date
Brad Fitzpatrick	b91f3c4191	ipn/ipnlocal: fix peerapi printf arg mismatch ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1f4cf1a4f4	ipn/localapi: only require read access to list file targets ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	db5e269463	client/tailscale/apitype: move local API types to new apitype package ... They were scattered/duplicated in misc places before. It can't be in the client package itself for circular dep reasons. This new package is basically tailcfg but for localhost communications, instead of to control. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	1b9d8771dc	ipn/ipnlocal,wgengine/router,cmd/tailscale: add flag to allow local lan access when routing traffic via an exit node. ... For #1527 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	8e75c8504c	ipn/ipnlocal: in direct file mode, don't readdir ... And don't even allow attempts at Open/Delete. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	9972c02b60	cmd/tailscale/cli: don't let up change prefs based on implicit flag values ... This changes the behavior of "tailscale up". Previously "tailscale up" always did a new Start and reset all the settings. Now "tailscale up" with no flags just brings the world [back] up. (The opposite of "tailscale down"). But with flags, "tailscale up" now only is allowed to change preferences if they're explicitly named in the flags. Otherwise it's an error. Or you need to use --reset to explicitly nuke everything. RELNOTE=tailscale up change Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f5742b0647	ipn/ipnlocal: add LocalBackend.SetDirectFileRoot ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a3113a793a	ipn: add hostname to Prefs.Pretty output ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4c3f7c06fc	ipn/ipnlocal: be consistent in not logging when no notify registered ... Some paths already didn't. And in the future I hope to shut all the notify funcs down end-to-end when nothing is connected (as in the common case in tailscaled). Then we can save some JSON encoding work. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	7c0e58c537	ipn/ipnlocal: remove redundant notify nil check ... send does it. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d9ee9a0d3f	ipn: set BackendServer's notify earlier; don't require Start ... We've been slowly making Start less special and making IPN a multi-connection "watch" bus of changes, but this Start specialness had remained. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	8e4d1e3f2c	ipn: include err in Notify decode fatal path ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	303805a389	ipn/localapi: require write access to PATCH prefs ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	79109f4965	ipn/ipnlocal: use PATCH for EditPrefs, not POST ... Addendum to earlier 00d641d9fc. Reserve POST for SetPrefs in the future. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	00d641d9fc	ipn/localapi: move EditPrefs to localapi ... Follow-up/revision to recent 53cfff109b which added EditPrefs. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	1a371b93be	util/dnsname: add FQDN type, use throughout codebase. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	3167e55ddf	ipn/{ipnlocal,localapi}, cmd/tailscale: add logout command ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	11127666b2	ipn/ipnlocal: fix deadlock from 227f73284 ... Sigh. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	227f73284f	ipn/ipnlocal: eagerly announce peerapi service(s) on change ... We were previously only doing it as a side effect of the port poller, which doesn't run on e.g. iOS. Updates tailscale/corp#1559	4 years ago
Brad Fitzpatrick	fe23506471	ipn/ipnlocal: avoid unneeded initPeerAPIListener work if no changes ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	20e7646b8d	ipn/ipnlocal: always set Notify.FilesWaiting, set IncomingFiles non-nil when empty	4 years ago
Brad Fitzpatrick	6d01d3bece	ipn/ipnlocal: provide IPN bus updates as files arrive ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	2f398106e2	ipn/ipnlocal: allow setting MagicDNS without DefaultResolvers. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	fad21af01c	tailcfg: add DNS routes and advanced resolver config. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	a9a3d3b4c1	ipn/ipnlocal: don't filter by time in FileTargets ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	71432c6449	ipn/ipnlocal: some more variable renames ... Missed in earlier commit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e86b7752ef	ipn/ipnlocal: rename some variables to be consistent ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	da4cc8bbb4	net/dns: handle all possible translations of high-level DNS config. ... With this change, all OSes can sort-of do split DNS, except that the default upstream is hardcoded to 8.8.8.8 pending further plumbing. Additionally, Windows 8-10 can do split DNS fully correctly, without the 8.8.8.8 hack. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	939861773d	net/tstun: accept peerapi connections through the filter ... Fixes tailscale/corp#1545 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	950fc28887	ipn, paths, cmd/tailscaled: remove LegacyConfigPath, relaynode migration ... It is time. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d581ee2536	ipn: remove Options.HTTPTestClient, move to LocalBackend ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	50b309c1eb	ipn/localapi, cmd/tailscale: add API to get prefs, CLI debug command to show ... Updates #1436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	799973a68d	ipn: move Options.Notify to its own method ... We already had SetNotifyCallback elsewhere on controlclient, so use that name. Baby steps towards some CLI refactor work. Updates tailscale/tailscale#1436	4 years ago
Brad Fitzpatrick	d488678fdc	cmd/tailscaled, wgengine{,/netstack}: add netstack hybrid mode, add to Windows ... For #707 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1f99f889e1	ipn/{ipnlocal,localapi}: add localapi handler to dial/proxy file PUTs ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d717499ac4	ipn/localapi: add API for getting file targets ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Crawshaw	d2f838c058	ipn/localapi: 404 on bad endpoints ... Confused us for a while! Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
David Anderson	f89dc1c903	ipn/ipnlocal: don't install any magicdns names if not proxying. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	9b57cd53ba	ipn/ipnlocal: lazily connect to control, lazily generate machine key ... Fixes #1573 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d50406f185	ipn/ipnlocal: simplify loadStateLocked control flow a bit, restore logging ... The common Linux start-up path (fallback file defined but not existing) was missing the log print of initializing Prefs. The code was too twisty. Simplify a bit. Updates #1573 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	6ad44f9fdf	wgengine: take in dns.Config, split out to resolver.Config and dns.OSConfig. ... Stepping stone towards having the DNS package handle the config splitting. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	8af9d770cf	net/dns: rename Config to OSConfig. ... Making way for a new higher level config struct. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	cf361bb9b1	net/dns: remove PerDomain from Config. ... It's currently unused, and no longer makes sense with the upcoming DNS infrastructure. Keep it in tailcfg for now, since we need protocol compat for a bit longer. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	6266cf8e36	ipn/ipnlocal: fix peerapi6 port being report as 0 in netstack mode ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e698973196	ipn/policy: mark peerapi4 and peerapi6 as interesting services	4 years ago
David Anderson	90f82b6946	net/dns/resolver: add live reconfig, plumb through to ipnlocal. ... The resolver still only supports a single upstream config, and ipn/wgengine still have to split up the DNS config, but this moves closer to unifying the DNS configs. As a handy side-effect of the refactor, IPv6 MagicDNS records exist now. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d99f5b1596	net/dns/resolver: factor the resolver out into a sub-package. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	53cfff109b	ipn: replace SetWantRunning(bool) with EditPrefs(MaskedPrefs) ... This adds a new ipn.MaskedPrefs embedding a ipn.Prefs, along with a bunch of "has bits", kept in sync with tests & reflect. Then it adds a Prefs.ApplyEdits(MaskedPrefs) method. Then the ipn.Backend interface loses its weirdo SetWantRunning(bool) method (that I added in 483141094c for "tailscale down") and replaces it with EditPrefs (alongside the existing SetPrefs for now). Then updates 'tailscale down' to use EditPrefs instead of SetWantRunning. In the future, we can use this to do more interesting things with the CLI, reconfiguring only certain properties without the reset-the-world "tailscale up". Updates #1436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4ed6b62c7a	ipn/ipnlocal: refactor to unindent a bit ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1f583a895e	ipn/ipnlocal: stop sending machine key to frontends ... We were going to remove this in Tailscale 1.3 but forgot. This means Tailscale 1.8 users won't be able to downgrade to Tailscale 1.0, but that's fine. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	db13b2d0c8	cmd/tailscale, ipn/localapi: add "tailscale bugreport" subcommand ... Adding a subcommand which prints and logs a log marker. This should help diagnose any issues that users face. Fixes #1466 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	c3bee0b722	ipn/ipnlocal: make peerapi work on iOS again ... It didn't have a storage directory. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1bd14a072c	cmd/tailscale, ipn/localapi: move IP forwarding check to tailscaled, API ... Instead of having the CLI check whether IP forwarding is enabled, ask tailscaled. It has a better idea. If it's netstack, for instance, the sysctl values don't matter. And it's possible that only the daemon has permission to know. Fixes #1626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a998fe7c3d	control/controlclient: support lazy machine key generation ... It's not done in the caller yet, but the controlclient does it now. Updates #1573 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	cf2beafbcd	ipn/ipnlocal: on Windows peerapi bind failures, try again on link change ... Updates #1620 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6d1a9017c9	ipn/{ipnlocal,localapi}, client/tailscale: add file get/delete APIs ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	672b9fd4bd	ipn{,/ipnlocal}: set new Notify.FilesWaiting when server has file(s) ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f01091babe	ipn/ipnlocal: make peerapi work in netstack mode ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	41e4e02e57	net/{packet,tstun}: send peerapi port in TSMP pongs ... For discovery when an explicit hostname/IP is known. We'll still also send it via control for finding peers by a list. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	9659ab81e0	ipn/ipnlocal: send peerapi port(s) in Hostinfo.Services ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	35596ae5ce	ipn/ipnlocal: push down a user-specific root dir to peerapi handler ... And add a put handler. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f26dfd054a	ipn/ipnlocal: rename/document peerapi stuff a bit, pass self identity ... So handlers can vary based on whether owner of peer matches owner of local node. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1642dfdb07	ipn/ipnlocal: get peerapi ~working in macOS/iOS NetworkExtension sandbox ... IPv4 and IPv6 both work remotely, but IPv6 doesn't yet work from the machine itself due to routing mysteries. Untested yet on iOS, but previous prototype worked on iOS, so should work the same. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	5a62aa8047	ipn/ipnlocal: pass down interface state to peerapi ListenConfig hook ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	9f7f2af008	wgengine/router/dns: move to net/dns. ... Preparation for merging the APIs and whatnot. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	8432999835	Move wgengine/tsdns to net/dns. ... Straight move+fixup, no other changes. In prep for merging with wgengine/router/dns. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	81143b6d9a	ipn/ipnlocal: start of peerapi between nodes ... Also some necessary refactoring of the ipn/ipnstate too. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	2384c112c9	net/packet, wgengine/{filter,tstun}: add TSMP ping ... Fixes #1467 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	8c0a0450d9	ipn/ipnlocal: allow client access to exit node's public IPs. ... "public IP" is defined as an IP address configured on the exit node itself that isn't in the list of forbidden ranges (RFC1918, CGNAT, Tailscale). Fixes #1522. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	0a02aaf813	control, ipn, tailcfg: remove golang.org/x/oauth2 dep, add tailcfg.Oauth2Token ... golang.org/x/oauth2 pulls in App Engine and grpc module dependencies, screwing up builds that depend on this module. Some background on the problem: https://go.googlesource.com/proposal/+/master/design/36460-lazy-module-loading.md Fixes tailscale/corp#1471 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	439d70dce2	cmd/tailscale, ipn/localapi: get daemon version from localapi status ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d0dffe33c0	cmd/tailscale, ipn/localapi: use localapi for status, not IPN acrobatics ... Yay simpler code. Tested on Linux, macOS and Windows. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	27c4dd9a97	Revert "cmd/tailscaled, ipn/{ipnlocal,ipnserver}: let netstack get access to LocalBackend" ... This reverts commit 2bc518dcb2. @namansood didn't end up needing it in his 770aa71ffb.	4 years ago
Brad Fitzpatrick	9eb65601ef	health, ipn/ipnlocal: track, log overall health ... Updates #1505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ba8c6d0775	health, controlclient, ipn, magicsock: tell health package state of things ... Not yet checking anything. Just plumbing states into the health package. Updates #1505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	770aa71ffb	client, cmd/hello, ipn, wgengine: fix whois for netstack-forwarded connections ... Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	2bc518dcb2	cmd/tailscaled, ipn/{ipnlocal,ipnserver}: let netstack get access to LocalBackend ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Crawshaw	bdb91a20eb	ipnstate, ipnlocal: add AuthURL to status ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
David Anderson	d79a2f3809	wgengine/filter: only log packets to/from non-default routes. ... Fixes tailscale/corp#1429. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	43b30e463c	ipn/ipnserver: refactor permissions checks a bit, document more, fix Windows ... Windows was only running the localapi on the debug port which was a stopgap at the time while doing peercreds work. Removed that, and wired it up correctly, with some more docs. More clean-up to do after 1.6, moving the localhost TCP auth code into the peercreds package. But that's too much for now, so the docs will have to suffice, even if it's at a bit of an awkward stage with the newly-renamed "NotWindows" field, which still isn't named well, but it's better than its old name of "Unknown" which hasn't been accurate since unix sock peercreds work anyway. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a4b585947d	ipn/localapi, client/tailscale: add a goroutine dump handler ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1ca3e739f7	ipn/ipnserver: set PermitWrite on localapi handler ... The TODO was easy now with peerCreds and the isReadonlyConn func. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	affd859121	ipn/ipnlocal, control/controlclient: propagate link monitor to controlclient ... Don't use it yet, but get it down there. Updates #1455 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	82edf94df7	ipn/ipnlocal: make IPv6 OS routes be a single /48 for our ULA space ... And if we have over 10,000 CGNAT routes, just route the entire CGNAT range. (for the hello test server) Fixes #1450 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	15b6969a95	ipn/ipnserver: grant client r/w access if peer uid matches tailscaled ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	be779b3587	safesocket, ipn/ipnserver: unify peercred info, fix bug on FreeBSD etc ... FreeBSD wasn't able to run "tailscale up" since the recent peercred refactoring. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	625c413508	ipn/ipnlocal: fix another regression from link monitoring refactor ... Prior to e3df29d488, the Engine.SetLinkChangeCallback fired immediately, even if there was no change. The ipnlocal code apparently depended on that, and it broke integration tests (which live in another repo). So mimic the old behavior and call the ipnlocal callback immediately at init. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	f647e3daaf	ipn/ipnlocal: transform default routes into "all but LAN" routes. ... Fixes #1177. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	e3df29d488	wgengine{,/monitor}: move interface state fetching/comparing to monitor ... Gets it out of wgengine so the Engine isn't responsible for being a callback registration hub for it. This also removes the Engine.LinkChange method, as it's no longer necessary. The monitor tells us about changes; it doesn't seem to need any help. (Currently it was only used by Swift, but as of 14dc790137 we just do the same from Go) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	38dc6fe758	cmd/tailscaled, wgengine: remove --fake, replace with netstack ... And add a --socks5-server flag. And fix a race in SOCKS5 replies where the response header was written concurrently with the copy from the backend. Co-authored with Naman Sood. Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	360095cd34	ipn: add tests for exit node pretty printing. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	8ee1cb6156	ipn/ipnlocal: mark findExitNodeID as requiring mutex. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	abfd73f569	ipn: print currently selected exit route in Prefs.String(). ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	2404c0ffad	ipn/ipnlocal: only filter out default routes when computing the local wg config. ... UIs need to see the full unedited netmap in order to know what exit nodes they can offer to the user. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	f11952ad7f	ipn/ipnserver: fix Windows connection auth regression ... Regression from code movement in d3efe8caf6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	b83c273737	wgengine/filter: use IPSet for localNets instead of prefixes. ... Part of #1177, preparing for doing fancier set operations on the allowed local nets. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Sonia Appasamy	76fb27bea7	dnsname,tailcfg: add hostname sanitation logic to node display names (#1304) ... Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	4 years ago
Brad Fitzpatrick	7038c09bc9	ipn/ipnserver: on darwin, let users who are admins use CLI without sudo ... Tangentially related to #987, #177, #594, #925, #505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d3efe8caf6	safesocket, ipn/ipnserver: look up peer creds on Darwin ... And open up socket permissions like Linux, now that we know who connections are from. This uses the new inet.af/peercred that supports Linux and Darwin at the moment. Fixes #1347 Fixes #1348 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	fdac0387a7	ipn/ipnserver, ipn/ipnlocal: move whois handler to new localapi package	4 years ago
David Anderson	e86b39b73f	ipn/ipnlocal: don't short-circuit default route filtering. ... If no exit node is specified, the filter must still run to remove offered default routes from all peers. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	1e7a35b225	types/netmap: split controlclient.NetworkMap off into its own leaf package ... Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ddfcc4326c	types/persist: split controlclient.Persist into a small leaf package ... This one alone doesn't modify the global dependency map much (depaware.txt if anything looks slightly worse), but it leave controlclient as only containing NetworkMap: bradfitz@tsdev:~/src/tailscale.com/ipn$ grep -F "controlclient." *.go backend.go: NetMap *controlclient.NetworkMap // new netmap received fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) handle.go: netmapCache *controlclient.NetworkMap handle.go:func (h *Handle) NetMap() *controlclient.NetworkMap { Once that goes into a leaf package, then ipn doesn't depend on controlclient at all, and then the client gets smaller. Updates #1278	4 years ago
David Anderson	a046b48593	cmd/tailscale/cli: display currently active exit node in `tailscale status`. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	6064b6ff47	wgengine/wgcfg/nmcfg: split control/controlclient/netmap.go into own package ... It couldn't move to ipnlocal due to test dependency cycles. Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	b9c2231fdf	ipn: program exit node into the data plane according to user pref. ... Part of #1153, #1154. Fixes #1224. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	d76334d2f0	ipn: split LocalBackend off into new ipn/ipnlocal package ... And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	e8cd7bb66f	tstest: simplify goroutine leak tests ... Use tb.Cleanup to simplify both the API and the implementation. One behavior change: When the number of goroutines shrinks, don't log. I've never found these logs to be useful, and they frequently add noise. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	c7d4bf2333	cmd/tailscale/cli: recommend sudo for 'tailscale up' on failure ... Fixes #1220	4 years ago
Brad Fitzpatrick	006a224f50	ipn/ipnserver, cmd/hello: do whois over unix socket, not debug http ... Start of a local HTTP API. Not a stable interface yet.	4 years ago
Josh Bleecher Snyder	fe7c3e9c17	all: move wgcfg from wireguard-go ... This is mostly code movement from the wireguard-go repo. Most of the new wgcfg package corresponds to the wireguard-go wgcfg package. wgengine/wgcfg/device{_test}.go was device/config{_test}.go. There were substantive but simple changes to device_test.go to remove internal package device references. The API of device.Config (now wgcfg.DeviceConfig) grew an error return; we previously logged the error and threw it away. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	c611d8480b	cmd/tailscaled: add whois/identd-ish debug handler	4 years ago
Brad Fitzpatrick	a7edcd0872	ipn/ipnstate: update tailscale status -web to match CLI	4 years ago
Brad Fitzpatrick	4d3c09ced4	ipn/ipnserver: on Windows in unattended mode, wait for Engine forever ... Updates #1187	4 years ago
Brad Fitzpatrick	fa3543d629	control/controlclient: use more direct way of getting the MagicDNS suffix ... Suggested by Avery earlier. Ends up fixing bug in "tailscale status" when MagicDNS if off too: https://forum.tailscale.com/t/1-3-293-is-released-a-1-4-0-pre-release/349/11?u=bradfitz	4 years ago
Brad Fitzpatrick	e7bf144c3f	ipn, wgengine/filter: fix Shields Up recent regression and old bug ... Fixes #1192 (regression) Fixes #1193 (old bug)	4 years ago
Brad Fitzpatrick	b560386c1a	net/packet, wgengine, tstun: add inter-node TSMP protocol for connect errors ... This adds a new IP Protocol type, TSMP on protocol number 99 for sending inter-tailscale messages over WireGuard, currently just for why a peer rejects TCP SYNs (ACL rejection, shields up, and in the future: nothing listening, something listening on that port but wrong interface, etc) Updates #1094 Updates tailscale/corp#1185 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	5611f290eb	ipn, ipnserver: only require sudo on Linux for mutable CLI actions ... This partially reverts d6e9fb1df0, which modified the permissions on the tailscaled Unix socket and thus required "sudo tailscale" even for "tailscale status". Instead, open the permissions back up (on Linux only) but have the server look at the peer creds and only permit read-only actions unless you're root. In the future we'll also have a group that can do mutable actions. On OpenBSD and FreeBSD, the permissions on the socket remain locked down to 0600 from d6e9fb1df0. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d6e9fb1df0	all: adjust Unix permissions for those without umasks ... Fixes tailscale/corp#1165 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Sonia Appasamy	024671406b	ipn: only send services in Hostinfo if Tailnet has opted-in to services collection (#1107) ... Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	4 years ago
Brad Fitzpatrick	5aa5db89d6	cmd/tailscaled, wgengine/netstack: add start of gvisor userspace netstack work ... Not usefully functional yet (mostly a proof of concept), but getting it submitted for some work @namansood is going to do atop this. Updates #707 Updates #634 Updates #48 Updates #835	4 years ago
Brad Fitzpatrick	5efb0a8bca	cmd/tailscale: change formatting of "tailscale status" ... * show DNS name over hostname, removing domain's common MagicDNS suffix. only show hostname if there's no DNS name. but still show shared devices' MagicDNS FQDN. * remove nerdy low-level details by default: endpoints, DERP relay, public key. They're available in JSON mode still for those who need them. * only show endpoint or DERP relay when it's active with the goal of making debugging easier. (so it's easier for users to understand what's happening) The asterisks are gone. * remove Tx/Rx numbers by default for idle peers; only show them when there's traffic. * include peers' owner login names * add CLI option to not show peers (matching --self=true, --peers= also defaults to true) * sort by DNS/host name, not public key * reorder columns	4 years ago
Josh Bleecher Snyder	18471a8792	ipn: close logger at the end of TestLocalLogLines ... If any goroutine continues to use the logger in TestLocalLogLines after the test finishes, the test panics. The culprit for this was wireguard-go; the previous commit fixed that. This commit adds suspenders: When the test is done, make logging calls into no-ops. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Denton Gentry	fa3e8e1a28	Add names to test cases in ipn/local_test.go. ... There are so many now that just a number doesn't work well. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Denton Gentry	414cb4a695	Add test for dnsMapsEqual. ... Exercises most cases in the function. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Brad Fitzpatrick	b5129dadfd	ipn: fix buggy-looking format string in error log ... On shutdown, logs showed: wgengine status error: &errors.errorString{s:"engine closing; no status"}	4 years ago
Brad Fitzpatrick	e8ae355bb8	ipn: delete domainsForProxying, require explicit DNS search domains (mapver 9) (#1078) ... Previously the client had heuristics to calculate which DNS search domains to set, based on the peers' names. Unfortunately that prevented us from doing some things we wanted to do server-side related to node sharing. So, bump MapRequest.Version to 9 to signal that the client only uses the explicitly configured DNS search domains and doesn't augment it with its own list. Updates tailscale/corp#1026 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package ... This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints ... Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	294ceb513c	ipn, wgengine/magicsock: fix `tailscale status` display. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Christine Dodrill	2485faf69a	Merge branch 'main' into report-status-systemd	4 years ago
Christine Dodrill	7ea809897d	ipn/ipnserver: enable systemd-notify support ... Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>	4 years ago
Josh Bleecher Snyder	a6cad71fb2	go.mod: upgrade staticcheck to 0.1.0 ... Also run go.mod and fix some staticcheck warnings. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	dfbde3d3aa	ipn: pass through the prefix length from control. ... Control sets this to /32 for IPv4 and /128 for IPv6. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	c0af7deb86	tailcfg, cmd/tailscale: add Hostinfo.ShareeNode, hide in "tailscale status"	4 years ago
Brad Fitzpatrick	cd6099113f	ipn: add a comment about skipping files with null bytes ... Updates #954	4 years ago
Alex Brainman	72e082aaf5	ipn: make LoadPrefs return os.ErrNotExist when reading corrupted files ... It appears some users have corrupted pref.conf files. Have LoadPrefs treat these files as non-existent. This way tailscale will make user login, and not crash. Fixes #954 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	4 years ago
Sonia Appasamy	0710fca0cd	tailcfg: include ShieldsUp in HostInfo	4 years ago
Brad Fitzpatrick	acade77c86	ipn/ipnserver: add knob to disable babysitter	4 years ago
Brad Fitzpatrick	19b0cfe89e	all: prepare for GOOS=ios in Go 1.16 ... Work with either way for now on iOS (darwin/arm64 vs ios/arm64). In February when Go 1.16 comes out we'll have a universal binary for darwin/arm64 (macOS) and will drop support for Go 1.15 and its darwin/amd64 meaning iOS. (it'll mean macOS). Context: * https://tip.golang.org/doc/go1.16#darwin * https://github.com/golang/go/issues/38485 * https://github.com/golang/go/issues/42100	4 years ago
Brad Fitzpatrick	d21956436a	ipn, tailcfg: change Windows subnet disabling behavior w/ WPAD ... In 1.0, subnet relays were not specially handled when WPAD+PAC was present on the network. In 1.2, on Windows, subnet relays were disabled if WPAD+PAC was present. That was what some users wanted, but not others. This makes it configurable per domain, reverting back to the 1.0 default state of them not being special. Users who want that behavior can then enable it. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	76d99cf01a	wgengine/filter: remove the Matches type. ... It only served to obscure the underlying slice type without adding much value. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b3634f020d	wgengine/filter: use netaddr types in public API. ... We still use the packet.* alloc-free types in the data path, but the compilation from netaddr to packet happens within the filter package. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	b4e19b95ed	ipn: debug zero bytes in IPN json messages ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	8f30fa67aa	ipn: treat zero-length file state store file as missing ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4f4e84236a	ipn: clean up Prefs logging at start ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6bcb466096	ipn: disambiguate how machine key was initialized ... Seeing "frontend-provided legacy machine key" was weird (and not quite accurate) on Linux machines where it comes from the _daemon key's persist prefs, not the "frontend". Make the log message distinguish between the cases. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	07b6ffd55c	ipn: only use Prefs, not computed stateKey, to determine server mode ... When the service was running without a client (e.g. after a reboot) and then the owner logs in and the GUI attaches, the computed state key changed to "" (driven by frontend prefs), and then it was falling out of server mode, despite the GUI-provided prefs still saying it wanted server mode. Also add some logging. And remove a scary "Access denied" from a user-visible error, making the two possible already-in-use error messages consistent with each other.	4 years ago
Brad Fitzpatrick	20a357b386	ipn, ipn/ipnserver: add IPN state for server in use, handle explicitly ... On Windows, we were previously treating a server used by different users as a fatal error, which meant the second user (upon starting Tailscale, explicitly or via Start Up programs) got an invasive error message dialog. Instead, give it its own IPN state and change the Notify.ErrMessage to be details in that state. Then the Windows GUI can be less aggresive about that happening. Also, * wait to close the IPN connection until the server ownership state changes so the GUI doesn't need to repeatedly reconnect to discover changes. * fix a bug discovered during testing: on system reboot, the ipnserver's serverModeUser was getting cleared while the state transitioned from Unknown to Running. Instead, track 'inServerMode' explicitly and remove the old accessor method which was error prone. * fix a rare bug where the client could start up and set the server mode prefs in its Start call and we wouldn't persist that to the StateStore storage's prefs start key. (Previously it was only via a prefs toggle at runtime)	4 years ago
Brad Fitzpatrick	f3aa08de76	ipn/ipnserver: remove "Server mode" from a user-visible error message ... That's an internal nickname.	4 years ago
Brad Fitzpatrick	cc3259f8d9	ipn: fix crash generating machine key on new installs ... Regression from d6ad41dcea (for #732). Probably also means eab6e9ea4e was unnecessary, but it's fine. Fixes #887	4 years ago
Brad Fitzpatrick	01ee638cca	Change some os.IsNotExist to errors.Is(err, os.ErrNotExist) for non-os errors. ... os.IsNotExist doesn't unwrap errors. errors.Is does. The ioutil.ReadFile ones happened to be fine but I changed them so we're consistent with the rule: if the error comes from os, you can use os.IsNotExist, but from any other package, use errors.Is. (errors.Is always would also work, but not worth updating all the code) The motivation here was that we were logging about failure to migrate legacy relay node prefs file on startup, even though the code tried to avoid that. See golang/go#41122	4 years ago
Elias Naur	eab6e9ea4e	ipn: don't temporarilySetMachineKeyInPersist for Android clients ... Without this change, newly installed Android clients crash on startup with panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x9881b9f8] goroutine 29 [running]: tailscale.com/ipn.(*LocalBackend).initMachineKeyLocked.func1(0x50cb1b9c, 0x503c9a00) /home/elias/proj/tailscale/ipn/local.go:711 +0x2c tailscale.com/ipn.(*LocalBackend).initMachineKeyLocked(0x503c9a00, 0x0, 0x0) /home/elias/proj/tailscale/ipn/local.go:736 +0x728 tailscale.com/ipn.(*LocalBackend).loadStateLocked(0x503c9a00, 0x988be40e, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0) /home/elias/proj/tailscale/ipn/local.go:817 +0x1e8 tailscale.com/ipn.(*LocalBackend).Start(0x503c9a00, 0x0, 0x0, 0x988be40e, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, ...) /home/elias/proj/tailscale/ipn/local.go:412 +0x200 main.(*backend).Start(...) /home/elias/proj/tailscale-android/cmd/tailscale/backend.go:116 main.(*App).runBackend.func3(0x50106340, 0x5000c060, 0x50d9a280) /home/elias/proj/tailscale-android/cmd/tailscale/main.go:169 +0x90 created by main.(*App).runBackend /home/elias/proj/tailscale-android/cmd/tailscale/main.go:168 +0x27c Signed-off-by: Elias Naur <mail@eliasnaur.com>	4 years ago
Brad Fitzpatrick	2b819ab38c	ipn: don't log redundant peer stats so often ... It was especially bad on our GUI platforms with a frontend that polls it. No need to log it every few seconds if it's unchanged. Make it slightly less allocate-y while I'm here.	4 years ago
Brad Fitzpatrick	ff7ddd9d20	ipn/ipnserver: move Windows local disk logging up to the parent process ... To capture panics, log.Printf writes to os.Stderr, etc. Fixes #726	4 years ago
Brad Fitzpatrick	c64718e9a0	ipn/ipnserver: work around os/user.LookupId failure on Windows ... If we can't find the mapping from SID ("user ID") -> username, don't treat that as a fatal. Apparently that happens in the wild for Reasons. Ignore it for now. It's just a nice-to-have for error messages in the rare multi-user case. Updates #869 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	54e6c3a290	version: use OSS repo's version when building. ... When building with redo, also include the git commit hash from the proprietary repo, so that we have a precise commit that identifies all build info (including Go toolchain version). Add a top-level build script demonstrating to downstream distros how to burn the right information into builds. Adjust `tailscale version` to print commit hashes when available. Fixes #841. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	d6ad41dcea	ipn: send machine key to clients so they can downgrade to 1.0.x if needed ... Fixes #732 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e72f480d22	ipn: convert an int to a bool	4 years ago
Brad Fitzpatrick	999bc93a4d	ipn: log active account on change ... Updates tailscale/corp#461	4 years ago
Brad Fitzpatrick	66d196326f	ipn: rename 'new' variable to 'newp' ... Both to avoid shadowing new and because new is a little vague for such a long method handling multiple new & old things.	4 years ago
Brad Fitzpatrick	6b1d2a5630	ipn: don't set DebugFlags to len 1 slice of empty string [""] ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	62d941dc26	tailcfg: add a DebugFlags field for experiments and debugging. ... Also replaces the IPv6Overlay bool with use of DebugFlags, since it's currently an experimental configuration. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	7c8ca28c74	ipn: use cmd/cloner for Prefs.Clone ... Also, make cmd/cloner's top-level "func Clone" generation opt-in. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1fd9958e9d	ipn: wait for initial portpoll result before starting controlclient ... We were creating the controlclient and starting the portpoll concurrently, which frequently resulted in the first controlclient connection being canceled by the firsdt portpoll result ~milliseconds later, resulting in another HTTP request. Instead, wait a bit for the first portpoll result so it's much less likely to interrupt our controlclient connection. Updates tailscale/corp#557	4 years ago
Brad Fitzpatrick	515866d7c6	ipn, ipnserver, cmd/tailscale: add "server mode" support on Windows ... This partially (but not yet fully) migrates Windows to tailscaled's StateStore storage system. This adds a new bool Pref, ForceDaemon, defined as: // ForceDaemon specifies whether a platform that normally // operates in "client mode" (that is, requires an active user // logged in with the GUI app running) should keep running after the // GUI ends and/or the user logs out. // // The only current applicable platform is Windows. This // forced Windows to go into "server mode" where Tailscale is // running even with no users logged in. This might also be // used for macOS in the future. This setting has no effect // for Linux/etc, which always operate in daemon mode. Then, when ForceDaemon becomes true, we now write use the StateStore to track which user started it in server mode, and store their prefs under that key. The ipnserver validates the connections/identities and informs that LocalBackend which userid is currently in charge. The GUI can then enable/disable server mode at runtime, without using the CLI. But the "tailscale up" CLI was also fixed, so Windows users can use authkeys or ACL tags, etc. Updates #275	4 years ago
Brad Fitzpatrick	638127530b	ipn/ipnserver: prevent use by multiple Windows users, add HTML status page ... It was previously possible for two different Windows users to connect to the IPN server at once, but it didn't really work. They mostly stepped on each other's toes and caused chaos. Now only one can control it, but it can be active for everybody else. Necessary dependency step for Windows server/headless mode (#275) While here, finish wiring up the HTTP status page on Windows, now that all the dependent pieces are available.	4 years ago
Brad Fitzpatrick	6ee219a25d	ipn, wgengine, magicsock, tsdns: be quieter and less aggressive when offline ... If no interfaces are up, calm down and stop spamming so much. It was noticed as especially bad on Windows, but probably was bad everywhere. I just have the best network conditions testing on a Windows VM. Updates #604	4 years ago
Brad Fitzpatrick	587bdc4280	ipn, wgengine: disable subnet routes if network has PAC configuration ... Not configurable yet. Updates tailscale/corp#653 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	585a0d8997	all: use testing.T.TempDir ... Bit of Friday cleanup. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	12e28aa87d	ipn: on transition from no PAC to PAC, reset state ... So previous routes aren't shadowing resources that the operating system might need (Windows Domain Controller, DNS server, corp HTTP proxy, WinHTTP fetching the PAC file itself, etc). This effectively detects when we're transitioning from, say, public wifi to corp wifi and makes Tailscale remove all its routes and stops its TCP connections and tries connecting to everything anew. Updates tailscale/corp#653	4 years ago
Brad Fitzpatrick	b5a3850d29	control/controlclient, ipn: store machine key separately from user prefs/persist ... Updates #610 (fixes after some win/xcode changes in a separate repo)	4 years ago
Brad Fitzpatrick	c8f257df00	Revert "all: keep UserProfiles a slice instead of a map for longer" ... This reverts commit e5894aba42. Breaks macOS/iOS build. Reverting per chat with Josh; he'll fix later today.	4 years ago
Brad Fitzpatrick	90b7293b3b	ipn: add/move some constants, update a comment ... And make the StateStore implementations be Stringers, for error messages.	4 years ago
Josh Bleecher Snyder	e5894aba42	all: keep UserProfiles a slice instead of a map for longer ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	3bdcfa7193	ipn: remove DisableDERP pref ... We depend on DERP for NAT traversal now[0] so disabling it entirely can't work. What we'll do instead in the future is let people specify alternate/additional DERP servers. And perhaps in the future we could also add a pref for nodes to say when they expect to never need/want to use DERP for data (but allow it for NAT traversal communication). But this isn't the right pref and it doesn't work, so delete it. Fixes #318 [0] https://tailscale.com/blog/how-nat-traversal-works/	4 years ago
Brad Fitzpatrick	c41947903a	ipn: don't log if legacy prefs don't exist (the normal case these days)	4 years ago
Brad Fitzpatrick	96fd20e3c0	ipn: bail out a bit earlier when a peer doesn't have a DNS name ... It's properly handled later in tsdns.NewMap anyway, but there's work done in the meantime that can be skipped when a peer lacks a DNS name. It's also more clear that it's okay for it to be blank.	4 years ago
David Anderson	8f5b52e571	net/netns: add windows support. ... Also remove rebinding logic from the windows router. Magicsock will instead rebind based on link change signals. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	4f71319f7c	ipn/ipnserver: make ipnserver also be an HTTP server for localhost clients ... For now it just says hello to show auth works. More later.	4 years ago
Brad Fitzpatrick	3af64765fd	ipn: fix Windows crash from improperly strict assertion	4 years ago
Brad Fitzpatrick	8ecee476f6	ipn: simplify TestLocalLogLines, defer a Shutdown of its LocalBackend ... The test's LocalBackend was not shut down (Shutdown both releases resources and waits for its various goroutines to end). This should fix the test race we were seeing. It definitely fixes the file descriptor leak that preventing -race -count=500 from passing before.	4 years ago
Brad Fitzpatrick	68c42530e9	tstest: rename LogListener to LogLineTracker ... But mostly to rename tstest.ListenFor which has no mention of log lines in it. It sounded like a net.Listener or something.	4 years ago
Brad Fitzpatrick	9b07517f18	wgengine: add Engine.SetLinkChangeCallback ... Start of making the IPN state machine react to link changes and down its DNS & routes if necessary to unblock proxy resolution (e.g. for transitioning from public to corp networks where the corp network has mandatory proxies and WPAD PAC files that can't be resolved while using the DNS/routes configured previously) This change should be a no-op. Just some callback plumbing.	4 years ago
Brad Fitzpatrick	5acbb149a2	ipn/ipnstate: include DNSName in tailscale status --json output	4 years ago
Brad Fitzpatrick	483141094c	cmd/tailscale/cli: add basic 'down' subcommand ... RELNOTE=yes	4 years ago
halulu	f27a57911b	cmd/tailscale: add derp and endpoints status (#703) ... cmd/tailscale: add local node's information to status output (by default) RELNOTE=yes Updates #477 Signed-off-by: Halulu <lzjluzijie@gmail.com>	4 years ago
Wendi Yu	a3fb422a39	ipn: tag and test for grinder log lines (#711) ... Signed-off-by: Wendi <wendi.yu@yahoo.ca>	4 years ago
Dmytro Shynkevych	a903d6c2ed	tailcfg, tsdns: derive root domains from list of nodes (#708) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	84dc891843	cmd/tailscale/cli: add ping subcommand ... For example: $ tailscale ping -h USAGE ping <hostname-or-IP> FLAGS -c 10 max number of pings to send -stop-once-direct true stop once a direct path is established -verbose false verbose output $ tailscale ping mon.ts.tailscale.com pong from monitoring (100.88.178.64) via DERP(sfo) in 65ms pong from monitoring (100.88.178.64) via DERP(sfo) in 252ms pong from monitoring (100.88.178.64) via [2604:a880:2:d1::36:d001]:41641 in 33ms Fixes #661 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a275b9d7aa	control/controlclient: use less battery when stopped, stop map requests ... Updates #604 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	dd97111d06	backoff: update to Go style, document a bit, make 30s explicit ... Also, bit of behavior change: on non-nil err but expired context, don't reset the consecutive failure count. I don't think the old behavior was intentional. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b62b07bc2d	ipn: jack up the MaxMessageSize from 1MB to 10MB ... hello.ipn.dev has a 2.5MB network map	4 years ago
Dmytro Shynkevych	934c63115e	ipn: put Magic DNS domains first ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
David Anderson	d64de1ddf7	Revert "cmd/tailscaled: exit gracefully on SIGPIPE" ... tailscaled receives a SIGPIPE when CLIs disconnect from it. We shouldn't shut down in that case. This reverts commit 43b271cb26. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	358cd3fd92	ipn: fix incorrect change tracking for packet filter. ... ORder of operations to trigger a problem: - Start an already authed tailscaled, verify you can ping stuff. - Run `tailscale up`. Notice you can no longer ping stuff. The problem is that `tailscale up` stops the IPN state machine before restarting it, which zeros out the packet filter but _not_ the packet filter hash. Then, upon restarting IPN, the uncleared hash incorrectly makes the code conclude that the filter doesn't need updating, and so we stay with a zero filter (reject everything) for ever. The fix is simply to update the filterHash correctly in all cases, so that running -> stopped -> running correctly changes the filter at every transition. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Dmytro Shynkevych	28e52a0492	all: dns refactor, add Proxied and PerDomain flags from control (#615) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Avery Pennarun	60c00605d3	ipn/setClientStatus: fix inverted prefsChanged check. ... We need to emit Prefs when it *has* changed, not when it hasn't. Test is added in our e2e test, separately. Fixes: #620 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Brad Fitzpatrick	cbf71d5eba	ipn/ipnserver: fix bug in earlier commit where conn can be stranded ... If a connection causes getEngine to transition from broken to fixed, that connection was getting lost.	4 years ago
Brad Fitzpatrick	9ff5b380cb	ipn/ipnserver: staticcheck is not wrong ... shamecube.gif	4 years ago
Brad Fitzpatrick	4aba86cc03	ipn/ipnserver: make Engine argument a func that tries again for each connection ... So a backend in server-an-error state (as used by Windows) can try to create a new Engine again each time somebody re-connects, relaunching the GUI app. (The proper fix is actually fixing Windows issues, but this makes things better in the short term) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Dmytro Shynkevych	c7582dc234	ipn: fix netmap change tracking and dns map generation (#609) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
David Anderson	0249236cc0	ipn/ipnstate: record assigned Tailscale IPs. ... wgengine/magicsock: use ipnstate to find assigned Tailscale IPs. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Elias Naur	0a42b0a726	ipn: add OSVersion, DeviceModel fields to Prefs and propagate to Hostinfos ... Needed for Android. Signed-off-by: Elias Naur <mail@eliasnaur.com>	4 years ago
Brad Fitzpatrick	3b0514ef6d	control/controlclient: rename uflags, give it a type, remove dead code	4 years ago
Dmytro Shynkevych	218de6d530	ipn: load hostname in Start. ... This prevents hostname being forced to os.Hostname despite override when control is contacted for the first time after starting tailscaled. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	de11f90d9d	ipn: remove unused parameter to func LoadPrefs, fix godoc subject	4 years ago
Brad Fitzpatrick	1f923124bf	ipn/ipnserver: support simultaneous connections ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	7ba148e54e	cmd/tailscale: make tailscale status -active also filter in -json mode	4 years ago
Dmytro Shynkevych	d9ac2ada45	ipn: add self to dns map ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	30bbbe9467	wgengine/router: dns: unify on *BSD, multimode on Linux, Magic DNS (#536) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Elias Naur	6e8f0860af	ipn: add Login backend command for sign-in with token ... The StartLoginInteractive command is for delegating the sign-in flow to a browser. The Android Gooogle Sign-In SDK inverts the flow by giving the client ID tokens. Add a new backend command for accepting such tokens by exposing the existing controlclient.Client.Login support for OAuth2 tokens. Introduce a custom TokenType to distinguish ID tokens from other OAuth2 tokens. Signed-off-by: Elias Naur <mail@eliasnaur.com>	4 years ago
Dmytro Shynkevych	61abab999e	cmd/tailscaled: graceful shutdown (#534) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	96d806789f	ipn: add Notify.LocalTCPPort field for macOS Network Extension to use ... We want the macOS Network Extension to share fate with the UI frontend, so we need the backend to know when the frontend disappears. One easy way to do that is to reuse the existing TCP server it's already running (for tailscale status clietns). We now tell the frontend our ephemeral TCP port number, and then have the UI connect to it, so the backend can know when it disappears. There are likely Swift ways of doing this, but I couldn't find them quickly enough, so I reached for the hammer I knew.	4 years ago
Brad Fitzpatrick	a8b95571fb	ipn, control/controlclient: fix some data races ... More remain. Fixes tailscale/corp#432	4 years ago
Brad Fitzpatrick	3984f9be2f	ipn, ipn/ipnserver: add support for serving in error-message-only mode ... So Windows service failures can be propagated to the Windows UI client.	4 years ago
Dmytro Shynkevych	67ebba90e1	tsdns: dual resolution mode, IPv6 support (#526) ... This change adds to tsdns the ability to delegate lookups to upstream nameservers. This is crucial for setting Magic DNS as the system resolver. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	6196b7e658	wgengine/magicsock: change API to not permit disco key changes ... Generate the disco key ourselves and give out the public half instead. Fixes #525	4 years ago
Brad Fitzpatrick	630379a1d0	cmd/tailscale: add tailscale status region name, last write, consistently star ... There's a lot of confusion around what tailscale status shows, so make it better: show region names, last write time, and put stars around DERP too if active. Now stars are always present if activity, and always somewhere.	4 years ago
David Anderson	9cd4e65191	smallzstd: new package that constructs zstd small encoders/decoders. ... It's just a config wrapper that passes "use less memory at the expense of compression" parameters by default, so that we don't accidentally construct resource-hungry (de)compressors. Also includes a benchmark that measures the memory cost of the small variants vs. the stock variants. The savings are significant on both compressors (~8x less memory) and decompressors (~1.4x less, not including the savings from the significantly smaller window on the compression side - with those savings included it's more like ~140x smaller). BenchmarkSmallEncoder-8 56174 19354 ns/op 31 B/op 0 allocs/op BenchmarkSmallEncoderWithBuild-8 2900 382940 ns/op 1746547 B/op 36 allocs/op BenchmarkStockEncoder-8 48921 25761 ns/op 286 B/op 0 allocs/op BenchmarkStockEncoderWithBuild-8 426 2630241 ns/op 13843842 B/op 124 allocs/op BenchmarkSmallDecoder-8 123814 9344 ns/op 0 B/op 0 allocs/op BenchmarkSmallDecoderWithBuild-8 41547 27455 ns/op 27694 B/op 31 allocs/op BenchmarkStockDecoder-8 129832 9417 ns/op 1 B/op 0 allocs/op BenchmarkStockDecoderWithBuild-8 25561 51751 ns/op 39607 B/op 92 allocs/op Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	a975e86bb8	wgengine/magicsock: add new endpoint type used for discovery-supporting peers ... This adds a new magicsock endpoint type only used when both sides support discovery (that is, are advertising a discovery key). Otherwise the old code is used. So far the new code only communicates over DERP as proof that the new code paths are wired up. None of the actually discovery messaging is implemented yet. Support for discovery (generating and advertising a key) are still behind an environment variable for now. Updates #483	4 years ago
Brad Fitzpatrick	fe50cd0c48	ipn, wgengine: plumb NetworkMap down to magicsock ... Now we can have magicsock make decisions based on tailcfg.Debug settings sent by the server. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	5bc29e7388	ipn: add missing locking in LocalBackend.NetMap ... Looks like it's only used by tests.	4 years ago
Brad Fitzpatrick	666d404066	ipn: put discovery key generation behind an environment flag for now ... Later we'll want to use the presence of a discovery key as a signal that the node knows how to participate in discovery. Currently the code generates keys and sends them to the control server but doesn't do anything with them, which is a bad state to stay in lest we release this code and end up with nodes in the future that look like they're functional with the new discovery protocol but aren't. So for now, make this opt-in as a debug option for now, until the rest of it is in. Updates #483	4 years ago
Dmytro Shynkevych	00ca17edf4	ipn: fix race in enterState ... Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	53fb25fc2f	all: generate discovery key, plumb it around ... Not actually used yet. Updates #483	4 years ago
David Anderson	0ecaf7b5ed	control/controlclient: make netmap generation use rate-limited logger.	4 years ago
Dmytro Shynkevych	c12d87c54b	Fix concurrency issues in controlclient, ipn, types/logger (#456) ... Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	07e02ec9d3	wgengine/tsdns: add test and prevent useless updates (#449) ... Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	511840b1f6	tsdns: initial implementation of a Tailscale DNS resolver (#396) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
David Anderson	c71754eba2	ipn/ipnserver: revert decoder memory limit. ... The zstd library treats that limit as a hard cap on decompressed size, in the mode we're using it, rather than a window size. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Elias Naur	364a8508b2	ipn: add Hostname override to Prefs ... Overriding the hostname is required for Android, where os.Hostname is often just "localhost". Updates #409 Signed-off-by: Elias Naur <mail@eliasnaur.com>	5 years ago
Avery Pennarun	f0b6ba78e8	wgengine: don't pass nil router.Config objects. ... These are hard for swift to decode in the iOS app. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Brad Fitzpatrick	004780b312	ipn: restore LiveDERPs assignment in LocalBackend.parseWgStatus ... Updates #421 (likely fixes it; need to do an iOS build to be sure)	5 years ago
Avery Pennarun	34c30eaea0	router_linux: use only baseline 'ip rule' features that exist in old kernels. ... This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
David Anderson	2b74236567	ipn: move e2e_test back to corp repo. ... It depends on corp things, so can't run here anyway. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	e6b84f2159	all: make client use server-provided DERP map, add DERP region support ... Instead of hard-coding the DERP map (except for cmd/tailscale netcheck for now), get it from the control server at runtime. And make the DERP map support multiple nodes per region with clients picking the first one that's available. (The server will balance the order presented to clients for load balancing) This deletes the stunner package, merging it into the netcheck package instead, to minimize all the config hooks that would've been required. Also fix some test flakes & races. Fixes #387 (Don't hard-code the DERP map) Updates #388 (Add DERP region support) Fixes #399 (wgengine: flaky tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	e8b3a5e7a1	wgengine/filter: implement a destination IP pre-filter. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	3ed2124356	ipn: Resolve some resource leaks in test. ... Updates tailscale/corp#255. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	ea8f92b312	ipn/local: get rid of some straggling calls to the log module. ... Use b.logf() instead. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	db051fb013	ipnserver and logpolicy: configure zstd with low-memory settings. ... The compressed blobs we send back and forth are small and infrequent, which doesn't justify the 8MB * GOMAXPROCS memory that was being allocated. This was the overwhelming majority of memory use in tailscaled. On my system it goes from ~100M RSS to ~15M RSS (which is still suspiciously high, but we can worry about that more later). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
David Anderson	c97c45f268	ipn: sprinkle documentation and clarity rewrites through LocalBackend. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Wendi Yu	bb55694c95	wgengine: log node IDs when peers are added/removed (#381) ... Also stop logging data sent/received from nodes we're not connected to (ie all those `x`s being logged in the `peers: ` line) Signed-off-by: Wendi <wendi.yu@yahoo.ca>	5 years ago
David Anderson	0fe262f093	ipn: plumb NetfilterMode all the way out to the CLI. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	292606a975	wgengine/router: support multiple levels of netfilter involvement. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	08acb502e5	Add tstest.PanicOnLog(), and fix various problems detected by this. ... If a test calls log.Printf, 'go test' horrifyingly rearranges the output to no longer be in chronological order, which makes debugging virtually impossible. Let's stop that from happening by making log.Printf panic if called from any module, no matter how deep, during tests. This required us to change the default error handler in at least one http.Server, as well as plumbing a bunch of logf functions around, especially in magicsock and wgengine, but also in logtail and backoff. To add insult to injury, 'go test' also rearranges the output when a parent test has multiple sub-tests (all the sub-test's t.Logf is always printed after all the parent tests t.Logf), so we need to screw around with a special Logf that can point at the "current" t (current_t.Logf) in some places. Probably our entire way of using subtests is wrong, since 'go test' would probably like to run them all in parallel if you called t.Parallel(), but it definitely can't because the're all manipulating the shared state created by the parent test. They should probably all be separate toplevel tests instead, with common setup/teardown logic. But that's a job for another time. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	89a6f27cf8	Merge remote-tracking branch 'origin/master' into base ... * origin/master: types/logger: add ArgWriter wgengine: wrap tun.Device to support filtering and packet injection (#358)	5 years ago
Avery Pennarun	a7edf11a40	{ipn,control/controlclient}/tests: pass a logf function to control.New(). ... This matches the new API requirements. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Dmytro Shynkevych	33b2f30cea	wgengine: wrap tun.Device to support filtering and packet injection (#358) ... Right now, filtering and packet injection in wgengine depend on a patch to wireguard-go that probably isn't suitable for upstreaming. This need not be the case: wireguard-go/tun.Device is an interface. For example, faketun.go implements it to mock a TUN device for testing. This patch implements the same interface to provide filtering and packet injection at the tunnel device level, at which point the wireguard-go patch should no longer be necessary. This patch has the following performance impact on i7-7500U @ 2.70GHz, tested in the following namespace configuration: ┌────────────────┐ ┌─────────────────────────────────┐ ┌────────────────┐ │ $ns1 │ │ $ns0 │ │ $ns2 │ │ client0 │ │ tailcontrol, logcatcher │ │ client1 │ │ ┌─────┐ │ │ ┌──────┐ ┌──────┐ │ │ ┌─────┐ │ │ │vethc│───────┼────┼──│vethrc│ │vethrs│──────┼─────┼──│veths│ │ │ ├─────┴─────┐ │ │ ├──────┴────┐ ├──────┴────┐ │ │ ├─────┴─────┐ │ │ │10.0.0.2/24│ │ │ │10.0.0.1/24│ │10.0.1.1/24│ │ │ │10.0.1.2/24│ │ │ └───────────┘ │ │ └───────────┘ └───────────┘ │ │ └───────────┘ │ └────────────────┘ └─────────────────────────────────┘ └────────────────┘ Before: --------------------------------------------------- | TCP send | UDP send | |------------------------|------------------------| | 557.0 (±8.5) Mbits/sec | 3.03 (±0.02) Gbits/sec | --------------------------------------------------- After: --------------------------------------------------- | TCP send | UDP send | |------------------------|------------------------| | 544.8 (±1.6) Mbits/sec | 3.13 (±0.02) Gbits/sec | --------------------------------------------------- The impact on receive performance is similar. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago