tailscale

Commit Graph

Author	SHA1	Message	Date
Dmytro Shynkevych	28e52a0492	all: dns refactor, add Proxied and PerDomain flags from control (#615 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	8c850947db	router: split off sandboxed path from router_darwin (#624 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	2ce2b63239	router: stop iOS subprocess sandbox violations (#617 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	154d1cde05	router: reload systemd-resolved after changing /etc/resolv.conf (#619 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	c53ab3111d	wgengine/router: support legacy resolvconf Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
David Anderson	189d86cce5	wgengine/router: don't use 88 or 8888 as table/rule numbers. We originally picked those numbers somewhat at random, but with the idea that 8 is a traditionally lucky number in Chinese culture. Unfortunately, "88" is also neo-nazi shorthand language. Use 52 instead, because those are the digits above the letters "TS" (tailscale) on a qwerty keyboard, so we're unlikely to collide with other users. 5, 2 and 52 are also pleasantly culturally meaningless. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	972a42cb33	wgengine/router: fix router_test to match the new marks. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d60917c0f1	wgengine/router: switch packet marks to avoid conflict with Weave Net. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Dmytro Shynkevych	a3e7252ce6	wgengine/router: use better NetworkManager API Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Eduardo Kienetz	5df6be9d38	Use LittleEndian for correct byte order on DNS IPs Nameserver IP 10.11.12.13 would otherwise get written to resolv.conf as 13.12.11.10, as was happening on my client. Signed-off-by: Eduardo Kienetz <eduardo@kienetz.com>	4 years ago
Wendi Yu	c3736250a4	wgengine: fix macos staticcheck errors (#557 ) Signed-off-by: Wendi <wendi.yu@yahoo.ca>	4 years ago
Dmytro Shynkevych	30bbbe9467	wgengine/router: dns: unify on *BSD, multimode on Linux, Magic DNS (#536 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	61abab999e	cmd/tailscaled: graceful shutdown (#534 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	742b8b44a8	net/tsaddr: new package to hold Tailscale-specific IPs/ranges And update existing callers with (near) duplicated cases.	4 years ago
David Crawshaw	9258d64261	wgengine/router: do not call ifconfig up if SetRoutesFunc is set The NetworkExtension brings up the interface itself and does not have access to `ifconfig`, which the underlying BSD userspace router attempts to use when Up is called. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Reinaldo de Souza	a8635784bc	wgengine: add BSD userspace router to darwin Darwin and FreeBSD are compatible enough to share the userspace router. The OSX router delegates to the BSD userspace router unless `SetRoutesFunc` is set. That preserves the mechanism that allows `ipn-go-bridge` to specify its own routing behavior. Fixes #177 Signed-off-by: Reinaldo de Souza <github@rei.nal.do>	4 years ago
David Anderson	5a32f8e181	wgengine/router: also accept exit code 254 from `ip rule del`. iproute2 3.16.0-2 from Debian Jessie (oldoldstable) doesn't return exit code 2 when deleting a non-existent IP rule. Fixes #434 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	08a38f21c9	wgengine/router: don't filter subnet routing in netfilter. We have a filter in tailscaled itself now, which is more robust against weird network topologies (such as the one Docker creates). Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Avery Pennarun	e7ae6a2e06	net/netns, wgengine/router: support Linux machines that don't have 'ip rule'. We'll use SO_BINDTODEVICE instead of fancy policy routing. This has some limitations: for example, we will route all traffic through the interface that has the main "default" (0.0.0.0/0) route, so machines that have multiple physical interfaces might have to go through DERP to get to some peers. But machines with multiple physical interfaces are very likely to have policy routing (ip rule) support anyway. So far, the only OS I know of that needs this feature is ChromeOS (crostini). Fixes #245. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	f0b6ba78e8	wgengine: don't pass nil router.Config objects. These are hard for swift to decode in the iOS app. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
David Anderson	5114df415e	net/netns: set the bypass socket mark on linux. This allows tailscaled's own traffic to bypass Tailscale-managed routes, so that things like tailscale-provided default routes don't break tailscaled itself. Progress on #144. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	fff062b461	wgengine/router: make runner.go linux-only for now. Otherwise, staticcheck complains that these functions are unused and unexported on macOS. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Avery Pennarun	f69003fd46	router_linux: work around terrible bugs in old iptables-compat versions. Specifically, this sequence: iptables -N ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT iptables -A FORWARD -j ts-forward doesn't work on Debian-9-using-nftables, but this sequence: iptables -N ts-forward iptables -A FORWARD -j ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT does work. I'm sure the reason why is totally fascinating, but it's an old version of iptables and the bug doesn't seem to exist on modern nftables, so let's refactor our code to add rules in the always-safe order and pretend this never happened. Fixes #401. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	9ff51909a3	router_linux: fix behaviour when switching --netfilter-mode. On startup, and when switching into =off and =nodivert, we were deleting netfilter rules even if we weren't the ones that added them. In order to avoid interfering with rules added by the sysadmin, we have to be sure to delete rules only in the case that we added them in the first place. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	a496cdc943	router_linux: remove need for iptables.ListChains(). Instead of retrieving the list of chains, or the list of rules in a chain, just try deleting the ones we don't want and then adding the ones we do want. An error in flushing/deleting still means the rule doesn't exist anymore, so there was no need to check for it first. This avoids the need to parse iptables output, which avoids the need to ever call iptables -S, which fixes #403, among other things. It's also much more future proof in case the iptables command line changes. Unfortunately the iptables go module doesn't properly pass the iptables command exit code back up when doing .Delete(), so we can't correctly check the exit code there. (exit code 1 really means the rule didn't exist, rather than some other weird problem). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	8a6bd21baf	router_linux: extract process runner routines into runner.go. These will probably be useful across platforms. They're not really Linux-specific at all. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	34c30eaea0	router_linux: use only baseline 'ip rule' features that exist in old kernels. This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
David Anderson	7fb33123d3	wgengine/router: warn about another variation of busybox's `ip`. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	9c914dc7dd	wgengine/router: stop using -m comment. The comment module is compiled out on several embedded systems (and also gentoo, because netfilter can't go brrrr with comments holding it back). Attempting to use comments results in a confusing error, and a non-functional firewall. Additionally, make the legacy rule cleanup non-fatal, because we do have to probe for the existence of these -m comment rules, and doing so will error out on these systems. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	3e27b3c33c	wgengine/router: more comments. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	0fe262f093	ipn: plumb NetfilterMode all the way out to the CLI. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	c67c8913c3	wgengine/router: add a test for linux router state transitions. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	292606a975	wgengine/router: support multiple levels of netfilter involvement. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	d53e8fc0da	router_darwin_support: we can build this on every platform. Our new build scripts try to build ipn-go-bridge on more than just linux and darwin, so let's enable this file so it can be successful on every platform.	5 years ago
David Anderson	9ccbcda612	wgengine/router: rename config.Settings to config.Config, make pointer. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	cd01bcc395	wgengine/router: allow loopback traffic from our own IP(s). Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	bfdc8175b1	wgengine/router: add a setting to disable SNAT for subnet routes. Part of #320. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	21ac65d3da	wgengine/router: explicitly detect and complain about busybox's `ip`. Defensive programming against #368 in environments other than Docker, e.g. if you try using Tailscale in Alpine Linux directly, sans container. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	381b94d4d1	wgengine/router: include command output if `ip rule list` fails. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	efc1feedc9	wgengine/router: include more information when iptables ops fail. The iptables package we use doesn't include command output, so we're left with guessing what went wrong most of the time. This will at least narrow things down to which operation failed. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	b01db109f5	wgengine/router: use inet.af/netaddr, not wgcfg.CIDR. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	b8f01eed34	wgengine/router: remove wireguard-go config from settings. Instead, pass in only exactly the relevant configuration pieces that the OS network stack cares about. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	8861bb5a19	wgengine/router: alter API to support multiple addrs, and use on linux. FreeBSD and OpenBSD will error out with a complaint if we pass >1 address right now, but we don't yet so that's okay.	5 years ago
David Anderson	6802481bf5	wgengine/router: don't use gateway routes on linux.	5 years ago
David Anderson	78b1ed39ea	wgengine/router: add more documentation.	5 years ago
David Anderson	c9de43cd59	wgengine/router: fix typo. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	89198b1691	wgengine/router: rewrite netfilter and routing logic. New logic installs precise filters for subnet routes, plays nice with other users of netfilter, and lays the groundwork for fixing routing loops via policy routing. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	7618d7e677	wgengine/router: simplify some cmd invocations. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	755fd9253c	wgengine/router: fix up docstring. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	1ac570def7	wgengine/router: split out from wgengine. The router implementations are logically separate, with their own API. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago

50 Commits (b62b07bc2df93b241ee383901a04c720a71d7fd4)