4345 Commits (b997304bf6eec22d174f66561ec7fe0400c5ec63)

 

All Branches   

Search

Author	SHA1	Message	Date
Aaron Klotz	b997304bf6	tailcfg: add CapabilityDataPlaneAuditLogs. ... We're going to want to enable audit logging on a per-Tailnet basis. When this happens, we want control to inform the Tailnet's clients of this capability. Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Maisem Ali	9197dd14cc	net/dns: [win] add MagicDNS entries to etc/hosts ... This works around the 2.3s delay in short name lookups when SNR is enabled. C:\Windows\System32\drivers\etc\hosts file. We only add known hosts that match the search domains, and we populate the list in order of Search Domains so that our matching algorithm mimics what Windows would otherwise do itself if SNR was off. Updates #1659 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Denton Gentry	3c8d257b3e	cmd/tailscale: set /dev/net perms in configure-host ... Several customers have had issues due to the permissions on /dev/net. Set permissions to 0755. Fixes https://github.com/tailscale/tailscale/issues/5048 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Joe Tsai	d32700c7b2	util/deephash: specialize for netip.Addr and drop AppendTo support (#5402) ... There are 5 types that we care about that implement AppendTo: key.DiscoPublic key.NodePublic netip.Prefix netipx.IPRange netip.Addr The key types are thin wrappers around [32]byte and are memory hashable. The netip.Prefix and netipx.IPRange types are thin wrappers over netip.Addr and are hashable by default if netip.Addr is hashable. The netip.Addr type is the only one with a complex structure where the default behavior of deephash does not hash it correctly due to the presence of the intern.Value type. Drop support for AppendTo and instead add specialized hashing for netip.Addr that would be semantically equivalent to == on the netip.Addr values. The AppendTo support was already broken prior to this change. It was fully removed (intentionally or not) in #4870. It was partially restored in #4858 for the fast path, but still broken in the slow path. Just drop support for it altogether. This does mean we lack any ability for types to self-hash themselves. In the future we can add support for types that implement: interface { DeepHash() Sum } Test and fuzz cases were added for the relevant types that used to rely on the AppendTo method. FuzzAddr has been executed on 1 billion samples without issues. Signed-off-by: Joe Tsai joetsai@digital-static.net	2 years ago
Brad Fitzpatrick	0de66386d4	cmd/viewer: add flag to support Clone generation without Views ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Kris Brandow	9ae1161e85	net/dnscache: fix v4addrs to return only v4 addrs ... Update the v4addrs function to filter out IPv6 addresses. Fixes regression from 8725b14056. Signed-off-by: Kris Brandow <kris.brandow@gmail.com>	2 years ago
Joe Tsai	03f7e4e577	util/hashx: move from sha256x (#5388)	2 years ago
Joe Tsai	f061d20c9d	util/sha256x: rename Hash as Block512 (#5351) ... Rename Hash as Block512 to indicate that this is a general-purpose hash.Hash for any algorithm that operates on 512-bit block sizes. While we rename the package as hashx in this commit, a subsequent commit will move the sha256x package to hashx. This is done separately to avoid confusing git. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	44d62b65d0	util/deephash: move typeIsRecursive and canMemHash to types.go (#5386) ... Also, rename canMemHash to typeIsMemHashable to be consistent. There are zero changes to the semantics. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	d53eb6fa11	util/deephash: simplify typeIsRecursive (#5385) ... Any type that is memory hashable must not be recursive since there are definitely no pointers involved to make a cycle. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	23ec3c104a	util/deephash: remove unused stack slice in typeIsRecursive (#5363) ... No operation ever reads from this variable. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	c200229f9e	util/deephash: simplify canMemHash (#5384) ... Put the t.Size() == 0 check first since this is applicable in all cases. Drop the last struct field conditional since this is covered by the sumFieldSize check at the end. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	766ea96adf	cmd/tailscaled: enable hybrid netstack mode on openbsd too ... Apparently OpenBSD can forward packets with manual configuration, https://github.com/tailscale/tailscale/issues/2498#issuecomment-1114216999 But this makes it work by default. People doing things by hand can set TS_DEBUG_WRAP_NETSTACK=0 in the environment. Change-Id: Iee5f32252f83af2baa0ebbe3f20ce9fec5f29e96 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Juan Font	ffc67806ef	tailcfg: bump capver for clients to talk Noise over any HTTPS port [capver 39] ... Signed-off-by: Juan Font Alonso <juanfontalonso@gmail.com>	2 years ago
Joe Tsai	32a1a3d1c0	util/deephash: avoid variadic argument for Update (#5372) ... Hashing []any is slow since hashing of interfaces is slow. Hashing of interfaces is slow since we pessimistically assume that cycles can occur through them and start cycle tracking. Drop the variadic signature of Update and fix callers to pass in an anonymous struct so that we are hashing concrete types near the root of the value tree. Signed-off-by: Joe Tsai <joetsai@digital-static.net> Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Denton Gentry	1c0286e98a	scripts/installer.sh: add `-y` for unattended install ... Fixes https://github.com/tailscale/tailscale/issues/5377 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Kris Brandow	8f38afbf8e	net/stun: convert to use net/netip.AddrPort ... Convert ParseResponse and Response to use netip.AddrPort instead of net.IP and separate port. Fixes #5281 Signed-off-by: Kris Brandow <kris.brandow@gmail.com>	2 years ago
Maisem Ali	c3270af52b	Makefile: add target for wasm and make it part of check ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	06eac9bbff	tka: Use strict decoding settings, implement Unserialize() ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	dbcc34981a	cmd/tailscale/cli: fix build break ... Accidental break from 64d482ff48. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	d4916a8be3	.github/workflows: cancel previous CI runs on PR update ... Currently scheduled runs are not canceled when we update PRs, those results are unused and the resources are just wasted. Instead of doing that, this PR makes it so that when a PR is updated (force-pushed or new commit added) the previous runs are canceled. https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-a-fallback-value Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Juan Font Alonso	64d482ff48	Allow any port for HTTPS when using Noise over TLS ... Signed-off-by: Juan Font Alonso <juanfontalonso@gmail.com>	2 years ago
Maisem Ali	25865f81ee	net/dns: disable NetBIOS on Tailscale interfaces ... Like LLMNR, NetBIOS also adds resolution delays and we don't support it anyway so just disable it on the interface. Updates #1659 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	545639ee44	util/winutil: consolidate interface specific registry keys ... Code movement to allow reuse in a follow up PR. Updates #1659 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	23f37b05a3	atomicfile: update docs to clarify behavior of argument ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	1cff719015	net/dns: [win] respond with SERVFAIL queries when no resolvers ... Currently we forward unmatched queries to the default resolver on Windows. This results in duplicate queries being issued to the same resolver which is just wasted. Updates #1659 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Joe Tsai	548fa63e49	util/deephash: use binary encoding of time.Time (#5352) ... Formatting a time.Time as RFC3339 is slow. See https://go.dev/issue/54093 Now that we have efficient hashing of fixed-width integers, just hash the time.Time as a binary value. Performance: Hash-24 19.0µs ± 1% 18.6µs ± 1% -2.03% (p=0.000 n=10+9) TailcfgNode-24 1.79µs ± 1% 1.40µs ± 1% -21.74% (p=0.000 n=10+9) Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	0476c8ebc6	.github/workflows: delete flaky windows-race.yml ... It flakes more often than it runs. It provides no value and builds failure blindness, making people get used to submitting on red. Bye. Change-Id: If5491c70737b4c9851c103733b1855af2a90a9e9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	1f7479466e	util/deephash: use sha256x (#5339) ... Switch deephash to use sha256x.Hash. We add sha256x.HashString to efficiently hash a string. It uses unsafe under the hood to convert a string to a []byte. We also modify sha256x.Hash to export the underlying hash.Hash for testing purposes so that we can intercept all hash.Hash calls. Performance: name old time/op new time/op delta Hash-24 19.8µs ± 1% 19.2µs ± 1% -3.01% (p=0.000 n=10+10) HashPacketFilter-24 2.61µs ± 0% 2.53µs ± 1% -3.01% (p=0.000 n=8+10) HashMapAcyclic-24 31.3µs ± 1% 29.8µs ± 0% -4.80% (p=0.000 n=10+9) TailcfgNode-24 1.83µs ± 1% 1.82µs ± 2% ~ (p=0.305 n=10+10) HashArray-24 344ns ± 2% 323ns ± 1% -6.02% (p=0.000 n=9+10) The performance gains is not as dramatic as sha256x over sha256 due to: 1. most of the hashing already occurring through the direct memory hashing logic, and 2. what does not go through direct memory hashing is slowed down by reflect. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Andrew Dunham	d942a2ff56	net/dnscache: try IPv6 addresses first (#5349) ... Signed-off-by: Andrew Dunham <andrew@tailscale.com> Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Brad Fitzpatrick	90555c5cb2	tailcfg, control/controlclient: add PingRequest.URLIsNoise [capver 38] ... Change-Id: I19bb63b6d99e96b2f9fd2c440afcc31d38137ded Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b33c337baa	tailcfg: actually bump capver to 37, add test ... I documented capver 37 in 4ee64681a but forgot to bump the actual constant. I've done this previously too, so add a test to prevent it from happening again. Change-Id: I6f7659db1243d30672121a384beb386d9f9f5b98 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	77a92f326d	util/deephash: avoid using sync.Pool for reflect.MapIter (#5333) ... In Go 1.19, the reflect.Value.MapRange method uses "function outlining" so that the allocation of reflect.MapIter is inlinable by the caller. If the iterator doesn't escape the caller, it can be stack allocated. See https://go.dev/cl/400675 Performance: name old time/op new time/op delta HashMapAcyclic-24 31.9µs ± 2% 32.1µs ± 1% ~ (p=0.075 n=10+10) name old alloc/op new alloc/op delta HashMapAcyclic-24 0.00B 0.00B ~ (all equal) Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Denton Gentry	5d731ca13f	installer.sh: add manjaro-arm & EndeavourOS. ... Fixes https://github.com/tailscale/tailscale/issues/5192 Fixes https://github.com/tailscale/tailscale/issues/5284 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Joe Tsai	1c3c6b5382	util/sha256x: make Hash.Sum non-escaping (#5338) ... Since Hash is a concrete type, we can make it such that Sum never escapes the input. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	76b0e578c5	util/sha256x: new package (#5337) ... The hash.Hash provided by sha256.New is much more efficient if we always provide it with data a multiple of the block size. This avoids double-copying of data into the internal block of sha256.digest.x. Effectively, we are managing a block ourselves to ensure we only ever call hash.Hash.Write with full blocks. Performance: name old time/op new time/op delta Hash 33.5µs ± 1% 20.6µs ± 1% -38.40% (p=0.000 n=10+9) The logic has gone through CPU-hours of fuzzing. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	090033ede5	cmd/derper: fix data race & server panic in manual cert mode ... (Thanks for debugging, Roland!) Fixes #4082 Change-Id: I400a64001c3c58899bb570b759b08e745abc0be1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
dependabot[bot]	9996d94b3c	build(deps): bump github.com/u-root/u-root from 0.8.0 to 0.9.0 ... Bumps [github.com/u-root/u-root](https://github.com/u-root/u-root) from 0.8.0 to 0.9.0. - [Release notes](https://github.com/u-root/u-root/releases) - [Changelog](https://github.com/u-root/u-root/blob/main/RELEASES) - [Commits](https://github.com/u-root/u-root/compare/v0.8.0...v0.9.0) --- updated-dependencies: - dependency-name: github.com/u-root/u-root dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2 years ago
Brad Fitzpatrick	c8dd39fcbc	.github/workflows: use a matrix for staticcheck GOOS/GOARCHes ... Change-Id: Ic4eda169729117afc4031bbefbe265195b38c19b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	539c5e44c5	util/deephash: always keep values addressable (#5328) ... The logic of deephash is both simpler and easier to reason about if values are always addressable. In Go, the composite kinds are slices, arrays, maps, structs, interfaces, pointers, channels, and functions, where we define "composite" as a Go value that encapsulates some other Go value (e.g., a map is a collection of key-value entries). In the cases of pointers and slices, the sub-values are always addressable. In the cases of arrays and structs, the sub-values are always addressable if and only if the parent value is addressable. In the case of maps and interfaces, the sub-values are never addressable. To make them addressable, we need to copy them onto the heap. For the purposes of deephash, we do not care about channels and functions. For all non-composite kinds (e.g., strings and ints), they are only addressable if obtained from one of the composite kinds that produce addressable values (i.e., pointers, slices, addressable arrays, and addressable structs). A non-addressible, non-composite kind can be made addressable by allocating it on the heap, obtaining a pointer to it, and dereferencing it. Thus, if we can ensure that values are addressable at the entry points, and shallow copy sub-values whenever we encounter an interface or map, then we can ensure that all values are always addressable and assume such property throughout all the logic. Performance: name old time/op new time/op delta Hash-24 21.5µs ± 1% 19.7µs ± 1% -8.29% (p=0.000 n=9+9) HashPacketFilter-24 2.61µs ± 1% 2.62µs ± 0% +0.29% (p=0.037 n=10+9) HashMapAcyclic-24 30.8µs ± 1% 30.9µs ± 1% ~ (p=0.400 n=9+10) TailcfgNode-24 1.84µs ± 1% 1.84µs ± 2% ~ (p=0.928 n=10+10) HashArray-24 324ns ± 2% 332ns ± 2% +2.45% (p=0.000 n=10+10) Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	4ee64681ad	tailcfg, control/controlclient: make Debug settings sticky in a map session [capver 37] ... Fixes #4843 Change-Id: I3accfd91be474ac745cb47f5d6e866c37d5c5d2d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	8e821d7aa8	types/opt: support an explicit "unset" value for Bool ... Updates #4843 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	3bb57504af	net/dns/resolver: add comments clarifying nil error returns ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	4497bb0b81	net/dns/resolver: return SERVFAIL when no upstream resolvers set ... Otherwise we just keep looping over the same thing again and again. ``` dns udp query: upstream nameservers not set dns udp query: upstream nameservers not set dns udp query: upstream nameservers not set ``` Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Charlotte Brandhorst-Satzkorn	0f12ead567	tsconnect: pass in authkey in dev mode (#5320) ... This change allows for an auth key to be specified as a url query param for use in development mode. If an auth key is specified and valid, it will authorize the client for use immediately. Updates #5144 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	2 years ago
Mihai Parparita	ab159f748b	cmd/tsconnect: switch UI to Preact ... Reduces the amount of boilerplate to render the UI and makes it easier to respond to state changes (e.g. machine getting authorized, netmap changing, etc.) Preact adds ~13K to our bundle size (5K after Brotli) thus is a neglibible size contribution. We mitigate the delay in rendering the UI by having a static placeholder in the HTML. Required bumping the esbuild version to pick up evanw/esbuild#2349, which makes it easier to support Preact's JSX code generation. Fixes #5137 Fixes #5273 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
David Crawshaw	15b8665787	tka: stable text representation of AUMHash ... This makes debugging easier, you can pass an AUMHash to a printf and get a string that is easy to debug. Also rearrange how directories/files work in the FS store: use the first two characters of the string representation as the prefix directory, and use the entire AUMHash string as the file name. This is again to aid debugging: you can `ls` a directory and line up what prints out easily with what you get from a printf in debug code. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Maisem Ali	40ec8617ac	util/must: rename Do->Get, add Do ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	ec9d13bce5	hostinfo, net/netcheck: use CutPrefix ... Updates #5309 Change-Id: I37e594cfd245784bf810c493de68a66d3ff20677 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	01e8ef7293	util/strs: add new package for string utility funcs ... Updates #5309 Change-Id: I677cc6e01050b6e10d8d6907d961b11c7a787a05 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago