5578 Commits (ba4e58f429029d1b8d51967aa71ccf3bf36de278)

 

All Branches   

Search

Author	SHA1	Message	Date
Mihai Parparita	f4f8ed98d9	sockstats: add validation for TCP socket stats ... We can use the TCP_CONNECTION_INFO getsockopt() on Darwin to get OS-collected tx/rx bytes for TCP sockets. Since this API is not available for UDP sockets (or on Linux/Android), we can't rely on it for actual stats gathering. However, we can use it to validate the stats that we collect ourselves using read/write hooks, so that we can be more confident in them. We do need additional hooks from the Go standard library (added in tailscale/go#59) to be able to collect them. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Tom DNetto	6eca47b16c	Revert "control/controlclient: improve handling of concurrent lite map requests" ... This reverts commit 48f6c1eba4. It unfortunately breaks mapresponse wakeups. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	48f6c1eba4	control/controlclient: improve handling of concurrent lite map requests ... Prior to this change, if we were in the middle of a lite map update we'd tear down the entire map session and restart it. With this change, we'll cancel an in-flight lite map request up to 10 times and restart before we tear down the streaming map request. We tear down everything after 10 retries to ensure that a steady stream of calls to sendNewMapRequest doesn't fail to make progress by repeatedly canceling and restarting. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Co-authored-by: Maisem Ali <maisem@tailscale.com> Change-Id: I9392bf8cf674e7a58ccd1e476039300a359ef3b1	2 years ago
Maisem Ali	b0cb39cda1	tsnet: only intercept TCP flows that have listeners ... Previously, it would accept all TCP connections and then close the ones it did not care about. Make it only ever accept the connections that it cares about. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
M. J. Fromberger	c09578d060	.github: update tibdex/github-app-token to release v1.8.0 (#7495) ... The main motivation for this change is to stop using the deprecated set-output function which triggers deprecation warnings in the action. Change-Id: I80496c44ea1166b9c40d5cd9e450129778ad4aaf Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	2 years ago
M. J. Fromberger	a75360ccd6	util: add truncate package (#7490) ... This package handles cases where we need to truncate human-readable text to fit a length constraint without leaving "ragged" multi-byte rune fragments at the end of the truncated value. Change-Id: Id972135d1880485f41b1fedfb65c2b8cc012d416 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	2 years ago
David Anderson	5b68dcc8c1	go.mod.sri: update for toolchain change. ... Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Kyle Carberry	3862a1e1d5	derp/derphttp: cleanup WebSocket connection on close ... This was causing a leak in our CI! Signed-off-by: Kyle Carberry <kyle@carberry.com>	2 years ago
Andrew Dunham	be107f92d3	wgengine/magicsock: track per-endpoint changes in ringbuffer ... This change adds a ringbuffer to each magicsock endpoint that keeps a fixed set of "changes"–debug information about what updates have been made to that endpoint. Additionally, this adds a LocalAPI endpoint and associated "debug peer-status" CLI subcommand to fetch the set of changes for a given IP or hostname. Updates tailscale/corp#9364 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I34f726a71bddd0dfa36ec05ebafffb24f6e0516a	2 years ago
David Crawshaw	9245d813c6	tsnet: explicit message for panic seen in CI ... Updates #7488 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
shayne	f7a7957a11	sniproxy: add promote-https (#7487) ... Adds support for an HTTP server that promotes all requests to HTTPS. The flag is `-promote-https` and defaults to true. Updates #1748	2 years ago
Brad Fitzpatrick	49e2d3a7bd	words: add word we forgot ... I explained this tails/scales list to my 5yo and he looked at me like it was the most obvious idea ever. Of course we'd make such lists at work! What else do grown-ups do all day? And then he wouldn't stop talking about coelacanths and I had no clue what he was saying or how to spell it until I asked my phone and the phone apparently understood me and I realized it was a fish and he was helping me? I think? Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Denton Gentry	b46c5ae82a	cmd/sniproxy: draw the rest of the DNS owl. ... Add a DNS server which always responds as its own IP addresses. Additionally add a tsnet TailscaleIPs() function to return the IP addresses, both IPv4 and IPv6. Updates https://github.com/tailscale/tailscale/issues/1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Joe Tsai	7e6c5a2db4	tstime: rely on stdlib parse functionality (#7482) ... The time.Parse function has been optimized to the point where it is faster than our custom implementation. See upstream changes in: * https://go.dev/cl/429862 * https://go.dev/cl/425197 * https://go.dev/cl/425116 Performance: BenchmarkGoParse3339/Z 38.75 ns/op 0 B/op 0 allocs/op BenchmarkGoParse3339/TZ 54.02 ns/op 0 B/op 0 allocs/op BenchmarkParse3339/Z 40.17 ns/op 0 B/op 0 allocs/op BenchmarkParse3339/TZ 87.06 ns/op 0 B/op 0 allocs/op We can see that the stdlib implementation is now faster. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	9112e78925	tstime: add Sleep (#7480) ... Sleep is an interruptible sleep variation. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
License Updater	3b18e65c6a	licenses: update android licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Mihai Parparita	6ac6ddbb47	sockstats: switch label to enum ... Makes it cheaper/simpler to persist values, and encourages reuse of labels as opposed to generating an arbitrary number. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Aaron Klotz	9687f3700d	net/dns: deal with Windows wsl.exe hangs ... Despite the fact that WSL configuration is still disabled by default, we continue to log the machine's list of WSL distros as a diagnostic measure. Unfortunately I have seen the "wsl.exe -l" command hang indefinitely. This patch adds a (more than reasonable) 10s timeout to ensure that tailscaled does not get stuck while executing this operation. I also modified the Windows implementation of NewOSConfigurator to do the logging asynchronously, since that information is not required in order to continue starting up. Fixes #7476 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Tom DNetto	2263d9c44b	cmd/tsconnect: pop CTA to make everything work with tailnet lock ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
David Crawshaw	387b68fe11	tsnet: generalize loopback listener to include SOCKS5 ... Some languages do not give you any useful access to the sockets underlying their networking packages. E.g. java.net.http.HttpClient provides no official access to its dialing logic. ...but everyone supports proxies. So add a SOCKS5 proxy on the listener we are already running. (The function being revamped is very new, I only added it in the last week and it wasn't part of any release, so I believe it is fine to redo its function signature.) Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Andrew Dunham	df2561f6a2	ipn/ipnlocal: stop netmap expiry timer when resetting control client ... This prevents a panic where we synthesize a new netmap in setClientStatus after we've shut down and nil'd out the controlclient, since that function expects to be called while connected to control. Fixes #7392 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib631eb90f34f6afa008d69bbb386f70da145e102	2 years ago
David Crawshaw	96a555fc5a	net/socks5: add password auth support ... Conforms to RFC 1929. To support Java HTTP clients via libtailscale, who offer no other reliable hooks into their sockets. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Brad Fitzpatrick	0f4359116e	tsnet: add UDP support to Server.Listen ... No ListenPacket support yet, but Listen with a udp network type fit easier into netstack's model to start. Then added an example of using it to cmd/sniproxy with a little udp :53 handler. No tests in tsnet yet because we don't have support for dialing over UDP in tsnet yet. When that's done, a new test can test both sides. Updates #5871 Updates #1748 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	9ff51ca17f	wgengine/netstack: add support for custom UDP flow handlers ... To be used by tsnet and sniproxy later. Updates #5871 Updates #1748 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	045f995203	ipn/localapi: close portmapper after debug ... This ensures that any mappings that are created are correctly cleaned up, instead of waiting for them to expire in the router. Updates #7377 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I436248ee7740eded6d8adae5df525e785a8f7ccb	2 years ago
Andrew Dunham	f6cd24499b	net/portmapper: relax source port check for UPnP responses ... Per a packet capture provided, some gateways will reply to a UPnP discovery packet with a UDP packet with a source port that does not come from the UPnP port. Accept these packets with a log message. Updates #7377 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I5d4d5b2a0275009ed60f15c20b484fe2025d094b	2 years ago
Andrew Dunham	51eb0b2cb7	net/portmapper: send UPnP protocol in upper-case ... We were previously sending a lower-case "udp" protocol, whereas other implementations like miniupnp send an upper-case "UDP" protocol. For compatibility, use an upper-case protocol instead. Updates #7377 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I4aed204f94e4d51b7a256d29917af1536cb1b70f	2 years ago
Andrew Dunham	d379a25ae4	net/portmapper: don't pick external ports below 1024 ... Some devices don't let you UPnP portmap a port below 1024, so let's just avoid that range of ports entirely. Updates #7377 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib7603b1c9a019162cdc4fa21744a2cae48bb1d86	2 years ago
Andrew Dunham	69f9c17555	ipn/localapi: fix panic after handler returns ... Change-Id: I612f9ebf78d962e094bff908670b3ffd89f756e5 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Maisem Ali	1a30b2d73f	all: use tstest.Replace more ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
License Updater	57a44846ae	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Andrew Dunham	a9c17dbf93	ipn/ipnlocal: reject unmasked routes ... Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic804efd24f5f536de1f2c910de3a24372d48d54d	2 years ago
Andrew Dunham	2d3ae485e3	net/interfaces: add better test for LikelyHomeRouterIP ... Return a mock set of interfaces and a mock gateway during this test and verify that LikelyHomeRouterIP returns the outcome we expect. Also verify that we return an error if there are no IPv4 addresses available. Follow-up to #7447 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8f06989e7f1f0bebd108861cbff17b820ed2e6e4	2 years ago
Maisem Ali	b9ebf7cf14	tstest: add method to Replace values for tests ... We have many function pointers that we replace for the duration of test and restore it on test completion, add method to do that. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	12100320d2	net/interfaces: always return an IPv4 LikelyHomeRouterIP ... We weren't filtering out IPv6 addresses from this function, so we could be returning an IPv4 gateway IP and an IPv6 self IP. Per the function comments, only return IPv4 addresses for the self IP. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If19a4aadc343fbd4383fc5290befa0eff006799e	2 years ago
Andrew Dunham	73fa7dd7af	util/slicesx: add package for generic slice functions, use ... Now that we're using rand.Shuffle in a few locations, create a generic shuffle function and use it instead. While we're at it, move the interleaveSlices function to the same package for use. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I0b00920e5b3eea846b6cedc30bd34d978a049fd3	2 years ago
Tom DNetto	88c7d19d54	tka: compact TKA storage on startup ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	e2d652ec4d	ipn,cmd/tailscale: implement resigning nodes on tka key removal ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	3f8e8b04fd	cmd/tailscale, cmd/tailscaled: move portmapper debugging into tailscale CLI ... The debug flag on tailscaled isn't available in the macOS App Store build, since we don't have a tailscaled binary; move it to the 'tailscale debug' CLI that is available on all platforms instead, accessed over LocalAPI. Updates #7377 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I47bffe4461e036fab577c2e51e173f4003592ff7	2 years ago
Mihai Parparita	3e71e0ef68	net/sockstats: remove explicit dependency on wgengine/monitor ... Followup to #7177 to avoid adding extra dependencies to the CLI. We instead declare an interface for the link monitor. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
James Tucker	7b73c9628d	version/distro,wgengine/router: raise WSL eth0 MTU when too low ... WSL has started to set the eth0 default route interface default to 1280 MTU, which is too low to carry 1280 byte packets from tailscale0 once wrapped in WireGuard. The change down to 1280 is very likely smaller than necessary for almost all users. We can not easily determine the ideal MTU, but if all the preconditions match, we raise the MTU to 1360, which is just enough for Tailscale traffic to work. Updates #4833 Updates #7346 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
shayne	d92ef4c215	cmd/derper: randomize IPs on refreshBootstrapDNS (#7440) ... This is to address a possible DNS failure on startup. Before this change IPv6 addresses would be listed first, and the client dialer would fail for hosts without IPv6 connectivity.	2 years ago
Andrew Dunham	27575cd52d	net/dnsfallback: shuffle returned IPs ... This ensures that we're trying multiple returned IPs, since the DERP servers return the same response to all queries. This should increase the chances that we eventually reach a working IP. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie8d4fb93df96da910fae49ae71bf3e402b9fdecc	2 years ago
Julia at Tailscale	ef6f66bb9a	api.md: refresh of API docs ... Update API documentation to include explanation of resources, a cleaner and more consistent structure, updated terminology, and fixes to a few errors and omissions. Signed-off-by: Julia Stein <julia@tailscale.com> Signed-off-by: Will Norris <will@tailscale.com> Co-authored-by: Will Norris <will@tailscale.com>	2 years ago
Brad Fitzpatrick	1410682fb6	cmd/sniproxy: add start of a tsnet-based SNI proxy ... $ curl https://canhazip.com/ 170.173.0.21 $ curl --resolve canhazip.com:443:100.85.165.81 https://canhazip.com/ 34.223.127.151 Updates #1748 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	283a84724f	types/logid: simplify implementation (#7415) ... Share the same underlying implementation for both PrivateID and PublicID. For the shared methods, declare them in the same order. Only keep documentation on methods without obvious meaning. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Maisem Ali	e1530cdfcc	cmd/containerboot,kube: consolidate the two kube clients ... We had two implemenetations of the kube client, merge them. containerboot was also using a raw http.Transport, this also has the side effect of making it use a http.Client Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Flakes Updater	5eb8a2a86a	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply@tailscale.com>	2 years ago
Andrew Dunham	d8286d0dc2	go.mod: bump golang.org/x/image to latest version ... This resolves a dependabot alert, though the alert does not affect us: https://github.com/tailscale/tailscale/security/dependabot/6 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I087de6f22fb4821d0035fc16b603f9692581b9bd	2 years ago
Denton Gentry	51288221ce	cmd/tailscale: use request Schema+Host for QNAP authLogin.cgi ... QNAP allows users to set the port number for the management WebUI, which includes authLogin.cgi. If they do, then connecting to localhost:8080 fails. https://github.com/tailscale/tailscale-qpkg/issues/74#issuecomment-1407486911 Fixes https://github.com/tailscale/tailscale/issues/7108 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago