488 Commits (b6c6960e40a79bc8869b004edc7d17df06a46dec)

Author	SHA1	Message	Date
Paul Scott	ed052eac62	tstest: parse goroutines for diff in ResourceCheck (#15619) ... ResourceCheck was previously using cmp.Diff on multiline goroutine stacks The produced output was difficult to read for a number of reasons: - the goroutines were sorted by count, and a changing count caused them to jump around - diffs would be in the middle of stacks Instead, we now parse the pprof/goroutines?debug=1 format goroutines and only diff whole stacks. Updates #1253 Signed-off-by: Paul Scott <paul@tailscale.com>	8 months ago
Brad Fitzpatrick	fb96137d79	net/{netx,memnet},all: add netx.DialFunc, move memnet Network impl ... This adds netx.DialFunc, unifying a type we have a bazillion other places, giving it now a nice short name that's clickable in editors, etc. That highlighted that my earlier move (03b47a55c7) of stuff from nettest into netx moved too much: it also dragged along the memnet impl, meaning all users of netx.DialFunc who just wanted netx for the type definition were instead also pulling in all of memnet. So move the memnet implementation netx.Network into memnet, a package we already had. Then use netx.DialFunc in a bunch of places. I'm sure I missed some. And plenty remain in other repos, to be updated later. Updates tailscale/corp#27636 Change-Id: I7296cd4591218e8624e214f8c70dab05fb884e95 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	03b47a55c7	tstest/nettest: pull the non-test Network abstraction out to netx package ... We want to be able to use the netx.Network (and RealNetwork implemementation) outside of tests, without linking "testing". So split out the non-test stuff of nettest into its own package. We tend to use "foox" as the convention for things we wish were in the standard library's foo package, so "netx" seems consistent. Updates tailscale/corp#27636 Change-Id: I1911d361f4fbdf189837bf629a20f2ebfa863c44 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	c76d075472	nettest, *: add option to run HTTP tests with in-memory network ... To avoid ephemeral port / TIME_WAIT exhaustion with high --count values, and to eventually detect leaked connections in tests. (Later the memory network will register a Cleanup on the TB to verify that everything's been shut down) Updates tailscale/corp#27636 Change-Id: Id06f1ae750d8719c5a75d871654574a8226d2733 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	2a12e634bf	cmd/vnet: add wsproxy mode ... For hooking up websocket VM clients to natlab. Updates #13038 Change-Id: Iaf728b9146042f3d0c2d3a5e25f178646dd10951 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Nick Khyl	6a9a7f35d9	cmd/tailscaled,ipn/{auditlog,ipnlocal},tsd: omit auditlog unless explicitly imported ... In this PR, we update ipnlocal.LocalBackend to allow registering callbacks for control client creation and profile changes. We also allow to register ipnauth.AuditLogFunc to be called when an auditable action is attempted. We then use all this to invert the dependency between the auditlog and ipnlocal packages and make the auditlog functionality optional, where it only registers its callbacks via ipnlocal-provided hooks when the auditlog package is imported. We then underscore-import it when building tailscaled for Windows, and we'll explicitly import it when building xcode/ipn-go-bridge for macOS. Since there's no default log-store location for macOS, we'll also need to call auditlog.SetStoreFilePath to specify where pending audit logs should be persisted. Fixes #15394 Updates tailscale/corp#26435 Updates tailscale/corp#27012 Signed-off-by: Nick Khyl <nickk@tailscale.com>	8 months ago
James Sanderson	ea79dc161d	tstest/integration/testcontrol: fix AddRawMapResponse race condition ... Only send a stored raw map message in reply to a streaming map response. Otherwise a non-streaming map response might pick it up first, and potentially drop it. This guarantees that a map response sent via AddRawMapResponse will be picked up by the main map response loop in the client. Fixes #15362 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	8 months ago
Brad Fitzpatrick	5c0e08fbbd	tstest/mts: add multiple-tailscaled development tool ... To let you easily run multiple tailscaled instances for development and let you route CLI commands to the right one. Updates #15145 Change-Id: I06b6a7bf024f341c204f30705b4c3068ac89b1a2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
James Sanderson	c261fb198f	tstest: make it clearer where AwaitRunning failed and why ... Signed-off-by: James Sanderson <jsanderson@tailscale.com>	9 months ago
Brad Fitzpatrick	75a03fc719	wgengine/magicsock: use learned DERP route as send path of last resort ... If we get a packet in over some DERP and don't otherwise know how to reply (no known DERP home or UDP endpoint), this makes us use the DERP connection on which we received the packet to reply. This will almost always be our own home DERP region. This is particularly useful for large one-way nodes (such as hello.ts.net) that don't actively reach out to other nodes, so don't need to be told the DERP home of peers. They can instead learn the DERP home upon getting the first connection. This can also help nodes from a slow or misbehaving control plane. Updates tailscale/corp#26438 Change-Id: I6241ec92828bf45982e0eb83ad5c7404df5968bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	5eafce7e25	gokrazy/natlab: update gokrazy, wire up natlab tests to GitHub CI ... Updates #13038 Change-Id: I610f9076816f44d59c0ca405a1b4f5eb4c6c0594 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Brad Fitzpatrick	781c1e9624	tstest/deptest: add DepChecker.ExtraEnv option for callers to set ... For tests (in another repo) that use cgo, we'd like to set CGO_ENABLED=1 explicitly when evaluating cross-compiled deps with "go list". Updates tailscale/corp#26717 Updates tailscale/corp#26737 Change-Id: Ic21a54379ae91688d2456985068a47e73d04a645 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Nick Khyl	6df5c8f32e	various: keep tailscale connected when Always On mode is enabled on Windows ... In this PR, we enable the registration of LocalBackend extensions to exclude code specific to certain platforms or environments. We then introduce desktopSessionsExt, which is included only in Windows builds and only if the ts_omit_desktop_sessions tag is disabled for the build. This extension tracks desktop sessions and switches to (or remains on) the appropriate profile when a user signs in or out, locks their screen, or disconnects a remote session. As desktopSessionsExt requires an ipn/desktop.SessionManager, we register it with tsd.System for the tailscaled subprocess on Windows. We also fix a bug in the sessionWatcher implementation where it attempts to close a nil channel on stop. Updates #14823 Updates tailscale/corp#26247 Signed-off-by: Nick Khyl <nickk@tailscale.com>	10 months ago
Brad Fitzpatrick	05ac21ebe4	all: use new LocalAPI client package location ... It was moved in f57fa3cbc3. Updates tailscale/corp#22748 Change-Id: I19f965e6bded1d4c919310aa5b864f2de0cd6220 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	04029b857f	tstest/deptest: verify that tailscale.com BadDeps actually exist ... This protects against rearranging packages and not catching that a BadDeps package got moved. That would then effectively remove a test. Updates #12614 Change-Id: I257f1eeda9e3569c867b7628d5bfb252d3354ba6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	68a66ee81b	feature/capture: move packet capture to feature/*, out of iOS + CLI ... We had the debug packet capture code + Lua dissector in the CLI + the iOS app. Now we don't, with tests to lock it in. As a bonus, tailscale.com/net/packet and tailscale.com/net/flowtrack no longer appear in the CLI's binary either. A new build tag ts_omit_capture disables the packet capture code and was added to build_dist.sh's --extra-small mode. Updates #12614 Change-Id: I79b0628c0d59911bd4d510c732284d97b0160f10 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Nick Khyl	f0db47338e	cmd/tailscaled,util/syspolicy/source,util/winutil/gp: disallow acquiring the GP lock during service startup ... In v1.78, we started acquiring the GP lock when reading policy settings. This led to a deadlock during Tailscale installation via Group Policy Software Installation because the GP engine holds the write lock for the duration of policy processing, which in turn waits for the installation to complete, which in turn waits for the service to enter the running state. In this PR, we prevent the acquisition of GP locks (aka EnterCriticalPolicySection) during service startup and update the Windows Registry-based util/syspolicy/source.PlatformPolicyStore to handle this failure gracefully. The GP lock is somewhat optional; it’s safe to read policy settings without it, but acquiring the lock is recommended when reading multiple values to prevent the Group Policy engine from modifying settings mid-read and to avoid inconsistent results. Fixes #14416 Signed-off-by: Nick Khyl <nickk@tailscale.com>	10 months ago
Brad Fitzpatrick	1562a6f2f2	feature/*: make Wake-on-LAN conditional, start supporting modular features ... This pulls out the Wake-on-LAN (WoL) code out into its own package (feature/wakeonlan) that registers itself with various new hooks around tailscaled. Then a new build tag (ts_omit_wakeonlan) causes the package to not even be linked in the binary. Ohter new packages include: * feature: to just record which features are loaded. Future: dependencies between features. * feature/condregister: the package with all the build tags that tailscaled, tsnet, and the Tailscale Xcode project extension can empty (underscore) import to load features as a function of the defined build tags. Future commits will move of our "ts_omit_foo" build tags into this style. Updates #12614 Change-Id: I9c5378dafb1113b62b816aabef02714db3fc9c4a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	2fc4455e6d	all: add Node.HomeDERP int, phase out "127.3.3.40:$region" hack [capver 111] ... This deprecates the old "DERP string" packing a DERP region ID into an IP:port of 127.3.3.40:$REGION_ID and just uses an integer, like PeerChange.DERPRegion does. We still support servers sending the old form; they're converted to the new form internally right when they're read off the network. Updates #14636 Change-Id: I9427ec071f02a2c6d75ccb0fcbf0ecff9f19f26f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Will Norris	60daa2adb8	all: fix golangci-lint errors ... These erroneously blocked a recent PR, which I fixed by simply re-running CI. But we might as well fix them anyway. These are mostly `printf` to `print` and a couple of `!=` to `!Equal()` Updates #cleanup Signed-off-by: Will Norris <will@tailscale.com>	11 months ago
Brad Fitzpatrick	b90707665e	tailcfg: remove unused User fields ... Fixes #14542 Change-Id: Ifeb0f90c570c1b555af761161f79df75f18ae3f9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	11 months ago
Joe Tsai	b62a013ecb	Switch logging service from log.tailscale.io to log.tailscale.com (#14398) ... Updates tailscale/corp#23617 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	12 months ago
Brad Fitzpatrick	c3c4c05331	tstest/integration/testcontrol: remove a vestigial unused parameter ... Back in the day this testcontrol package only spoke the nacl-boxed-based control protocol, which used this. Then we added ts2021, which didn't, but still sometimes used it. Then we removed the old mode and didn't remove this parameter in 2409661a0d. Updates #11585 Change-Id: Ifd290bd7dbbb52b681b3599786437a15bc98b6a5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	020cacbe70	derp/derphttp: don't link websockets other than on GOOS=js ... Or unless the new "ts_debug_websockets" build tag is set. Updates #1278 Change-Id: Ic4c4f81c1924250efd025b055585faec37a5491d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	c3306bfd15	control/controlhttp/controlhttpserver: split out Accept to its own package ... Otherwise all the clients only using control/controlhttp for the ts2021 HTTP client were also pulling in WebSocket libraries, as the server side always needs to speak websockets, but only GOOS=js clients speak it. This doesn't yet totally remove the websocket dependency on Linux because Linux has a envknob opt-in to act like GOOS=js for manual testing and force the use of WebSockets for DERP only (not control). We can put that behind a build tag in a future change to eliminate the dep on all GOOSes. Updates #1278 Change-Id: I4f60508f4cad52bf8c8943c8851ecee506b7ebc9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	23880eb5b0	cmd/tailscaled: support "ts_omit_ssh" build tag to remove SSH ... Some environments would like to remove Tailscale SSH support for the binary for various reasons when not needed (either for peace of mind, or the ~1MB of binary space savings). Updates tailscale/corp#24454 Updates #1278 Updates #12614 Change-Id: Iadd6c5a393992c254b5dc9aa9a526916f96fd07a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jonathan Nobels	aecb0ab76b	tstest/tailmac: add support for mounting host directories in the guest (#13957) ... updates tailscale/corp#24197 tailmac run now supports the --share option which will allow you to specify a directory on the host which can be mounted in the guest using mount_virtiofs vmshare <path>. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	1 year ago
Jonathan Nobels	0f9a054cba	tstest/tailmac: fix Host.app path generation (#13953) ... updates tailscale/corp#24197 Generation of the Host.app path was erroneous and tailmac run would not work unless the pwd was tailmac/bin. Now you can be able to invoke tailmac from anywhere. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	1 year ago
James Tucker	c0a1ed86cb	tstest/natlab: add latency & loss simulation ... A simple implementation of latency and loss simulation, applied to writes to the ethernet interface of the NIC. The latency implementation could be optimized substantially later if necessary. Updates #13355 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Paul Scott	adc8368964	tstest: avoid Fatal in ResourceCheck to show panic (#13790) ... Fixes #13789 Signed-off-by: Paul Scott <paul@tailscale.com>	1 year ago
Brad Fitzpatrick	508980603b	ipn/conffile: don't depend on hujson on iOS/Android ... Fixes #13772 Change-Id: I3ae03a5ee48c801f2e5ea12d1e54681df25d4604 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	1938685d39	clientupdate: don't link distsign on platforms that don't download ... Updates tailscale/corp#20099 Change-Id: Ie3b782379b19d5f7890a8d3a378096b4f3e8a612 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	2531065d10	clientupdate, ipn/localapi: don't use google/uuid, thin iOS deps ... We were using google/uuid in two places and that brought in database/sql/driver. We didn't need it in either place. Updates #13760 Updates tailscale/corp#20099 Change-Id: Ieed32f1bebe35d35f47ec5a2a429268f24f11f1f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	fb420be176	safesocket: don't depend on go-ps on iOS ... There's never a tailscaled on iOS. And we can't run child processes to look for it anyway. Updates tailscale/corp#20099 Change-Id: Ieb3776f4bb440c4f1c442fdd169bacbe17f23ddb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	367fba8520	control/controlhttp: don't link ts2021 server + websocket code on iOS ... We probably shouldn't link it in anywhere, but let's fix iOS for now. Updates #13762 Updates tailscale/corp#20099 Change-Id: Idac116e9340434334c256acba3866f02bd19827c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	c763b7a7db	syncs: delete Map.Range, update callers to iterators ... Updates #11038 Change-Id: I2819fed896cc4035aba5e4e141b52c12637373b1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Nick Khyl	d837e0252f	wf/firewall: allow link-local multicast for permitted local routes when the killswitch is on on Windows ... When an Exit Node is used, we create a WFP rule to block all inbound and outbound traffic, along with several rules to permit specific types of traffic. Notably, we allow all inbound and outbound traffic to and from LocalRoutes specified in wgengine/router.Config. The list of allowed routes always includes routes for internal interfaces, such as loopback and virtual Hyper-V/WSL2 interfaces, and may also include LAN routes if the "Allow local network access" option is enabled. However, these permitting rules do not allow link-local multicast on the corresponding interfaces. This results in broken mDNS/LLMNR, and potentially other similar issues, whenever an exit node is used. In this PR, we update (*wf.Firewall).UpdatePermittedRoutes() to create rules allowing outbound and inbound link-local multicast traffic to and from the permitted IP ranges, partially resolving the mDNS/LLMNR and *.local name resolution issue. Since Windows does not attempt to send mDNS/LLMNR queries if a catch-all NRPT rule is present, it is still necessary to disable the creation of that rule using the disable-local-dns-override-via-nrpt nodeAttr. Updates #13571 Signed-off-by: Nick Khyl <nickk@tailscale.com>	1 year ago
Brad Fitzpatrick	b8af93310a	tstest: add the start of a testing wishlist ... Of tests we wish we could easily add. One day. Updates #13038 Change-Id: If44646f8d477674bbf2c9a6e58c3cd8f94a4e8df Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	a01b545441	control/control{client,http}: don't noise dial localhost:443 in http-only tests ... 1eaad7d3de regressed some tests in another repo that were starting up a control server on `http://127.0.0.1:nnn`. Because there was no https running, and because of a bug in 1eaad7d3de (which ended up checking the recently-dialed-control check twice in a single dial call), we ended up forcing only the use of TLS dials in a test that only had plaintext HTTP running. Instead, plumb down support for explicitly disabling TLS fallbacks and use it only when running in a test and using `http` scheme control plane URLs to 127.0.0.1 or localhost. This fixes the tests elsewhere. Updates #13597 Change-Id: I97212ded21daf0bd510891a278078daec3eebaa6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Kristoffer Dalby	77832553e5	ipn/ipnlocal: add advertised and primary route metrics ... Updates tailscale/corp#22075 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	1 year ago
Andrew Dunham	40833a7524	wgengine/magicsock: disable raw disco by default; add envknob to enable ... Updates #13140 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ica85b2ac8ac7eab4ec5413b212f004aecc453279	1 year ago
Andrew Dunham	7dcf65a10a	net/dns: fix IsZero and Equal methods on OSConfig ... Discovered this while investigating the following issue; I think it's unrelated, but might as well fix it. Also, add a test helper for checking things that have an IsZero method using the reflect package. Updates tailscale/support-escalations#55 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I57b7adde43bcef9483763b561da173b4c35f49e2	1 year ago
Brad Fitzpatrick	c4d0237e5c	tstest/natlab: add dual stack with blackholed IPv4 ... This reproduces the bug report from https://github.com/tailscale/tailscale/issues/13346 It does not yet fix it. Updates #13346 Change-Id: Ia5af7b0481a64a37efe259c798facdda6d9da618 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	3d9e3a17fa	tstest/natlab/vnet: move some boilerplate to mkPacket helper ... No need to make callers specify the redundant IP version or TTL/HopLimit or EthernetType in the common case. The mkPacket helper can set those when unset. And use the mkIPLayer in another place, simplifying some code. And rename mkPacketErr to just mkPacket, then move mkPacket to test-only code, as mustPacket. Updates #13038 Change-Id: Ic216e44dda760c69ab9bfc509370040874a47d30 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	7e88d6712e	tstest/natlab/vnet: add syslog tests ... Updates #13038 Change-Id: I4ac96cb0a9e46a2fb1e09ddedd3614eb006c2c8c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	b1a5b40318	tstest/natlab/vnet: add DHCP tests, ignore DHCPv4 on v6-only networks ... And clean up some of the test helpers in the process. Updates #13038 Change-Id: I3e2b5f7028a32d97af7f91941e59399a8e222b25 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	ffa1c93f59	tstest/natlab/vnet: use mkPacketErr in more places ... I'd added this helper for tests, but then moved it to non-test code and forgot some places to use it. This uses it in more places to remove some boilerplate. Updates #13038 Change-Id: Ic4dc339be1c47a55b71d806bab421097ee3d75ed Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jordan Whited	71acf87830	tstest/integration: add UDP netstack loopback integration test (#13312) ... Updates tailscale/corp#22713 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Brad Fitzpatrick	82c2c5c597	tstest/natlab/vnet: add more tests ... This adds tests for DNS requests, and ignoring IPv6 packets on v4-only networks. No behavior changes. But some things are pulled out into functions. And the mkPacket helpers previously just for tests are moved into non-test code to be used elsewhere to reduce duplication, doing the checksum stuff automatically. Updates #13038 Change-Id: I4dd0b73c75b2b9567b4be3f05a2792999d83f6a3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jordan Whited	d21ebc28af	wgengine/netstack: implement netstack loopback (#13301) ... When the TS_DEBUG_NETSTACK_LOOPBACK_PORT environment variable is set, netstack will loop back (dnat to addressFamilyLoopback:loopbackPort) TCP & UDP flows originally destined to localServicesIP:loopbackPort. localServicesIP is quad-100 or the IPv6 equivalent. Updates tailscale/corp#22713 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Brad Fitzpatrick	73b3c8fc8c	tstest/natlab/vnet: add IPv6 all-nodes support ... This adds support for sending packets to 33:33:00:00:01 at IPv6 multicast address ff02::1 to send to all nodes. Nothing in Tailscale depends on this (yet?), but it makes debugging in VMs behind natlab easier (e.g. you can ping all nodes), and other things might depend on this in the future. Mostly I'm trying to flesh out the IPv6 support in natlab now that we can write vnet tests. Updates #13038 Change-Id: If590031fcf075690ca35c7b230a38c3e72e621eb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	8b23ba7d05	tstest/natlab/vnet: add qemu + Virtualization.framework protocol tests ... To test how virtual machines connect to the natlab vnet code. Updates #13038 Change-Id: Ia4fd4b0c1803580ee7d94cc9878d777ad4f24f82 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	ff1d0aa027	tstest/natlab/vnet: start adding tests ... And refactor some of vnet.go for testability. The only behavioral change (with a new test) is that ethernet broadcasts no longer get sent back to the sender. Updates #13038 Change-Id: Ic2e7e7d6d8805b7b7f2b5c52c2c5ba97101cef14 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	f99f970dc1	tstest/natlab/vnet: rename some things for clarity ... The bad naming (which had only been half updated with the IPv6 changes) tripped me up in the earlier change. Updates #13038 Change-Id: I65ce07c167e8219d35b87e1f4bf61aab4cac31ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	0157000cab	tstest/natlab: fix IPv6 tests, remove TODOs ... The reason they weren't working was because the cmd/tta agent in the guest was dialing out to the test and the vnet couldn't map its global unicast IPv6 address to a node as it was just using a map[netip.Addr]*node and blindly trusting the *node was populated. Instead, it was nil, so the agent connection fetching didn't work for its RoundTripper and the test could never drive the node. That map worked for IPv4 but for IPv6 we need to use the method that takes into account the node's IPv6 SLAAC address. Most call sites had been converted but I'd missed that one. Also clean up some debug, and prohibit nodes' link-local unicast addresses from dialing 2000::/3 directly for now. We can allow that to be configured opt-in later (some sort of IPv6 NAT mode. Whatever it's called.) That mode was working on accident, but was confusing: Linux would do source address selection from link local for the first few seconds and then after SLAAC and DAD, switch to using the global unicast source address. Be consistent for now and force it to use the global unicast. Updates #13038 Change-Id: I85e973aaa38b43c14611943ff45c7c825ee9200a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	6dd1af0d1e	tstest/natlab: refactor HandleEthernetPacketForRouter a bit ... Move all the UDP handling to its own func to remove a bunch of "if isUDP" checks in a bunch of blocks. Updates #13038 Change-Id: If71d71b49e57651d15bd307a2233c43751cc8639 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	3a8cfbc381	tstest/natlab: be more paranoid about IP versions from gvisor ... I didn't actually see this, but added this while debugging something and figured it'd be good to keep. Updates #13038 Change-Id: I67934c8a329e0233f79c3b08516fd6bad6bfe22a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	e0bdd5d058	tstest/natlab: simplify a defer ... Updates #13038 Change-Id: I4d38701491523c64c81767b0838010609e683a9f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	b78df4d48a	tstest/natlab/vnet: add start of IPv6 support ... Updates #13038 Change-Id: Ic3d095f167daf6c7129463e881b18f2e0d5693f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	31b5239a2f	tstest/natlab/vnet: flush and sync pcap file after every packet ... So that we can view the pcap as we debug interactively. Updates #13038 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Jordan Whited	978306565d	tstest/integration: change log.Fatal() to t.Fatal() (#13253) ... Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Jordan Whited	367bfa607c	tstest/integration: exercise TCP DNS queries against quad-100 (#13231) ... Updates tailscale/corp#22511 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Brad Fitzpatrick	e5fd36ad78	tstest/natlab: respect NATTable interface's invalid-means-drop everywhere ... And sprinkle some more docs around. Updates #13038 Change-Id: Ia2dcf567b68170481cc2094d64b085c6b94a778a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	aa42ae9058	tstest/natlab: make a new virtualIP type in prep for IPv6 support ... All the magic service names with virtual IPs will need IPv6 variants. Pull this out in prep. Updates #13038 Change-Id: I53b5eebd0679f9fa43dc0674805049258c83a0de Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	5a99940dfa	tstest/natlab/vnet: explicitly ignore PCP and SSDP UDP queries ... So we don't log about them when verbose logging is enabled. Updates #13038 Change-Id: I925bc3a23e6c93d60dd4fb4bf6a4fdc5a326de95 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	3b70968c25	cmd/vnet: add --blend and --pcap flags ... Updates #13038 Change-Id: Id16ea9eb94447a3d9651215f04b2525daf10b3eb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	3904e4d175	cmd/tta, tstest/natlab/vnet: remove unneeded port 124 log hack, add log buffer ... The natlab Test Agent (tta) still had its old log streaming hack in place where it dialed out to anything on TCP port 124 and those logs were streamed to the host running the tests. But we'd since added gokrazy syslog streaming support, which made that redundant. So remove all the port 124 stuff. And then make sure we log to stderr so gokrazy logs it to syslog. Also, keep the first 1MB of logs in memory in tta too, exported via localhost:8034/logs for interactive debugging. That was very useful during debugging when I added IPv6 support. (which is coming in future PRs) Updates #13038 Change-Id: Ieed904a704410b9031d5fd5f014a73412348fa7f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jonathan Nobels	1191eb0e3d	tstest/natlab: add unix address to writer for dgram mode ... updates tailcale/corp#22371 For dgram mode, we need to store the write addresses of the client socket(s) alongside the writer functions and the write operation needs to use WriteToUnix. Unix also has multiple clients writing to the same socket, so the serve method is modified to handle packets from multiple mac addresses. Cleans up a bit of cruft from the initial tailmac tooling commit. Now all the macOS packets are belong to us. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	1 year ago
Brad Fitzpatrick	0ff474ff37	all: fix new lint warnings from bumping staticcheck ... In prep for updating to new staticcheck required for Go 1.23. Updates #12912 Change-Id: If77892a023b79c6fa798f936fc80428fd4ce0673 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Jonathan Nobels	8fad8c4b9b	tstest/tailmac: add customized macOS virtualization tooling (#13146) ... updates tailcale/corp#22371 Adds custom macOS vm tooling. See the README for the general gist, but this will spin up VMs with unixgram capable network interfaces listening to a named socket, and with a virtio socket device for host-guest communication. We can add other devices like consoles, serial, etc as needed. The whole things is buildable with a single make command, and everything is controllable via the command line using the TailMac utility. This should all be generally functional but takes a few shortcuts with error handling and the like. The virtio socket device support has not been tested and may require some refinement. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	1 year ago
Brad Fitzpatrick	02581b1603	gokrazy,tstest/integration/nat: add Gokrazy appliance just for natlab ... ... rather than abusing the generic tsapp. Per discussion in https://github.com/gokrazy/gokrazy/pull/275 It also means we can remove stuff we don't need, like ntp or randomd. Updates #13038 Change-Id: Iccf579c354bd3b5025d05fa1128e32f1d5bde4e4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	b358f489b9	tstest/integration/nat: remove -audio none flag from qemu ... It's too new to be supported in Debian bookworm so just remove it. It doesn't seem to matter or help speed anything up. Updates #13038 Change-Id: I39077ba8032bebecd75209552b88f1842c843c33 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	d985da207f	tstest/natlab/vnet: fix one-by-one from earlier numbering change ... 84adfa1ba3 made MAC addresses 1-based too, but didn't adjust this IP address calculation which was based on the MAC address Updates #13038 Change-Id: Idc112b303b0b85f41fe51fd61ce1c0d8a3f0f57e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	b26c53368d	tstest/integration/nat: make Tailscale status log print less spammy ... No need to print all the internal fields. We only care about the BackendState. Updates #13038 Change-Id: Iaa0e47ade3c6d30e1887ab1e2a7412ed4e0dab7d	1 year ago
Brad Fitzpatrick	eae6a00651	tstest/integration/nat: crank up verbosity of a failing test ... Updates #13038 Change-Id: I36cde97b74e4a675b6c0f3be30f817bccdbe8715	1 year ago
Brad Fitzpatrick	84adfa1ba3	tstest/natlab/vnet: standardize on 1-based naming of nodes, networks, MACs ... We had a mix of 0-based and 1-based nodes and MACs in logs. Updates #13038 Change-Id: I36d1b00f7f94b37b4ae2cd439bcdc5dbee6eda4d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	10d0ce8dde	tstest/natlab: get tailscaled logs from gokrazy via syslog ... Using https://github.com/gokrazy/gokrazy/pull/275 This is much lower latency than logcatcher, which is higher latency and chunkier. And this is better than getting it via 'tailscale debug daemon-logs', which misses early interesting logs. Updates #13038 Change-Id: I499ec254c003a9494c0e9910f9c650c8ac44ef33 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	10662c4282	tstest/integration/nat: annotate test 'want' values, fail on mismatch ... Updates #13038 Change-Id: Id711ee19e52a7051a2273c806b184c5571c6e24f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	a61825c7b8	cmd/tta, vnet: add host firewall, env var support, more tests ... In particular, tests showing that #3824 works. But that test doesn't actually work yet; it only gets a DERP connection. (why?) Updates #13038 Change-Id: Ie1fd1b6a38d4e90fae7e72a0b9a142a95f0b2e8f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	10c2bee9e1	tstest/natlab/vnet: capture network wan/lan interfaces ... Updates #13038 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	2e32abc3e2	cmd/tailscaled: allow setting env via linux cmdline for integration tests ... Updates #13038 Change-Id: I51e016d0eb7c14647159706c08f017fdedd68e2a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	2a88428f24	tstest/integration/nat: skip some tests by default without flags ... Updates #13038 Change-Id: I7ebf8bd8590e65ce4d30dd9f03c713b77868fa36 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	44d634395b	tstest/natlab/vnet: add easyAF ... Endpoint-indepedent Mapping with only Address (but not port) dependent filtering. Updates #13038 Change-Id: I1ec88301acafcb79bf878f9600a7286e8af0f173 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	d4cc074187	tstest/natlab/vnet: add pcap support ... Updates #13038 Change-Id: I89ce2129fee856f97986d6313d2b661c76476c0c Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	194ff6ee3d	tstest/integration/nat: add sameLAN node type ... To test local connections. Updates #13038 Change-Id: I575dcab31ca812edf7d04fa126772611cf89b9a7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	730fec1cfd	tstest/integration/nat: add start of TestGrid ... Updates #13038 Change-Id: I41d1c2bf20ae6dfbb071020d9dc2b742e7995835 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	f47a5fe52b	vnet: reduce some log spam ... Updates #13038 Change-Id: I76038a90dfde10a82063988a5b54190074d4b5c5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	bb3e95c40d	vnet: fix port mapping (w/ maisem + andrew) ... Co-authored-by: Maisem Ali <maisem@tailscale.com> Co-authored-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I703b39f05af2e3e1a979be8e77091586cb9ec3eb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	f8d23b3582	tstest/integration/nat: stream daemon logs directly ... Updates #13038 Signed-off-by: Maisem Ali <maisem@tailscale.com> Change-Id: I5da5706149c082c27d74c8b894bf53dd9b259e84	1 year ago
Brad Fitzpatrick	17a10f702f	vnet: add network.logf ... Updates #13038 Change-Id: Ia5a9359b8bfa18264d64600dfa1ef01eb8728dc2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	082e46b48d	vnet: don't hard-code bradfitz or maisem in paths ... Updates #13038 Change-Id: Ie8c7591fac3800bb3b7f8c35356cce309fd3c164 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	6798f8ea88	tstest/natlab/vnet: add port mapping ... Updates #13038 Change-Id: Iaf274d250398973790873534b236d5cbb34fbe0e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	12764e9db4	natlab: add NodeAgentClient ... This adds a new NodeAgentClient type that can be used to invoke the LocalAPI using the LocalClient instead of handcrafted URLs. However, there are certain cases where it does make sense for the node agent to provide more functionality than whats possible with just the LocalClient, as such it also exposes a http.Client to make requests directly. Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	1016aa045f	hostinfo: add hostinfo.IsNATLabGuestVM ... And don't make guests under vnet/natlab upload to logcatcher, as there won't be a valid cert anyway. Updates #13038 Change-Id: Ie1ce0139788036b8ecc1804549a9b5d326c5fef5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	8594292aa4	vnet: add control/derps to test, stateful firewall ... Updates #13038 Change-Id: Icd65b34c5f03498b5a7109785bb44692bce8911a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	1ed958fe23	tstest/natlab/vnet: add start of virtual network-based NAT Lab ... Updates #13038 Change-Id: I3c74120d73149c1329288621f6474bbbcaa7e1a6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	a7a394e7d9	tstest/integration: mark TestNATPing flaky ... Updates #12169 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Irbe Krumina	c5623e0471	go.{mod,sum},tstest/tools,k8s-operator,cmd/k8s-operator: autogenerate CRD API docs (#12884) ... Re-instates the functionality that generates CRD API docs, but using a different library as the one we were using earlier seemed to have some issues with its Git history. Also regenerates the docs (make kube-generate-all). Updates tailscale/tailscale#12859 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	1 year ago
Irbe Krumina	0f57b9340b	cmd/k8s-operator,tstest,go.{mod,sum}: remove fybrik.io/crdoc dependency (#12862) ... Remove fybrik.io/crdoc dependency as it is causing issues for folks attempting to vendor tailscale using GOPROXY=direct. This means that the CRD API docs in ./k8s-operator/api.md will no longer be generated- I am going to look at replacing it with another tool in a follow-up. Updates tailscale/tailscale#12859 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	1 year ago
Brad Fitzpatrick	c6af5bbfe8	all: add test for package comments, fix, add comments as needed ... Updates #cleanup Change-Id: Ic4304e909d2131a95a38b26911f49e7b1729aaef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago