tailscale

Commit Graph

Author	SHA1	Message	Date
Mihai Parparita	ec649e707f	ipn/ipnlocal: prefer to use one CGNAT route on the Mac Together with `06aa141632` this minimizes the number of NEPacketTunnelNetworkSettings updates that we have to do, and thus avoids Chrome interrupting outstanding requests due to (perceived) network changes. Updates #3102 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Brad Fitzpatrick	aa37aece9c	ipn/ipnlocal, net/dns, util/cloudenv: add AWS DNS support And remove the GCP special-casing from ipn/ipnlocal; do it only in the forwarder for .internal. Fixes #4980 Fixes #4981 Change-Id: I5c481e96d91f3d51d274a80fbd37c38f16dfa5cb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	88c2afd1e3	ipn/ipnlocal, net/dns, util/cloudenv: specialize DNS config on Google Cloud This does three things: If you're on GCP, it adds a .internal DNS split route to the metadata server, so we never break GCP DNS names. This lets people have some Tailscale nodes on GCP and some not (e.g. laptops at home) without having to add a Tailnet-wide .internal DNS route. If you already have such a route, though, it won't overwrite it. * If the 100.100.100.100 DNS forwarder has nowhere to forward to, it forwards it to the GCP metadata IP, which forwards to 8.8.8.8. This means there are never errNoUpstreams ("upstream nameservers not set") errors on GCP due to e.g. mangled /etc/resolv.conf (GCP default VMs don't have systemd-resolved, so it's likely a DNS supremacy fight) * makes the DNS fallback mechanism use the GCP metadata IP as a fallback before our hosted HTTP-based fallbacks I created a default GCP VM from their web wizard. It has no systemd-resolved. I then made its /etc/resolv.conf be empty and deleted its GCP hostnames in /etc/hosts. I then logged in to a tailnet with no global DNS settings. With this, tailscaled writes /etc/resolv.conf (direct mode, as no systemd-resolved) and sets it to 100.100.100.100, which then has regular DNS via the metadata IP and .internal DNS via the metadata IP as well. If the tailnet configures explicit DNS servers, those are used instead, except for .internal. This also adds a new util/cloudenv package based on version/distro where the cloud type is only detected once. We'll likely expand it in the future for other clouds, doing variants of this change for other popular cloud environments. Fixes #4911 RELNOTES=Google Cloud DNS improvements Change-Id: I19f3c2075983669b2b2c0f29a548da8de373c7cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	87a4c75fd4	control/controlclient, ipn/ipnlocal: remove Client.SetExpirySooner, fix race Client.SetExpirySooner isn't part of the state machine. Remove it from the Client interface. And fix a use of LocalBackend.cc without acquiring the lock that guards that field. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ef0d740270	control/controlclient: remove Client.SetStatusFunc It can't change at runtime. Make it an option. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	70a2797064	control/controlclient, ipn/ipnlocal: remove some Client methods Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a1e429f7c3	control/controlclient, types/netmap: remove unused LocalPort field Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	467eb2eca0	cmd/tailscale/cli, ipn/ipnlocal: give SSH tips when off/unconfigured Updates #3802 Change-Id: I6b9a3175f68a6daa670f912561f2c2ececc07770 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Praneet Loke	d8c05fc1b2	Update a Taildrop error message (#4818 ) ipn/ipnlocal: update error message on Taildrop send while not connected Signed-off-by: Praneet <1466314+praneetloke@users.noreply.github.com>	4 years ago
Melanie Warrick	3a182d5dd6	ipn/ipnstate: add ExitNodeStatus to share the exit node if it is in use, the IP, ID and whether its online. (#4761 ) - Updates #4619 Signed-off-by: nyghtowl <warrick@tailscale.com>	4 years ago
Brad Fitzpatrick	4007601f73	cmd/controlclient: wire up PingRequest peerapi pings too Updates tailscale/corp#754 Change-Id: I61ac3fc44783b54bd02455bcb0baf19159b7a9d2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	fbc079d82d	ipn/ipnlocal: prevent attempting to run SSH on Synology for now On DSM7 as a non-root user it'll run into problems. And we haven't tested on DSM6, even though it might work, but I doubt it. Updates #3802 Updates tailscale/corp#5468 Change-Id: I75729042e4788f03f9eb82057482a44b319f04f3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Jordan Whited	43f9c25fd2	cmd/tailscale: surface authentication errors in status.Health (#4748 ) Fixes #3713 Signed-off-by: Jordan Whited <jordan@tailscale.com>	4 years ago
Maisem Ali	928530a112	ipn/ipnlocal: shutdown sshServer on tailscale down Also lazify SSHServer initialization to allow restarting the server on a subsequent `tailscale up` Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	4d85cf586b	cmd/tailscale, ipn/ipnlocal: add "peerapi" ping type For debugging when stuff like #4750 isn't working. RELNOTE=tailscale ping -peerapi Change-Id: I9c52c90fb046e3ab7d2b121387073319fbf27b99 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	7cd8c3e839	ssh/tailssh: terminate sessions when tailscaled shutsdown Ideally we would re-establish these sessions when tailscaled comes back up, however we do not do that yet so this is better than leaking the sessions. Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	da601c23e1	ipn/ipnlocal: add missing place where we set the SSH atomic This fixes the "tailscale up --authkey=... --ssh" path (or any "up" path that used Start instead of EditPrefs) which wasn't setting the bit. Updates #3802 Change-Id: Ifca532ec58296fedcedb5582312dfee884367ed7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	fd99c54e10	tailcfg,all: change structs to []*dnstype.Resolver Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	35111061e9	wgengine/netstack, ipn/ipnlocal: serve http://100.100.100.100/ For future stuff. Change-Id: I64615b8b2ab50b57e4eef1ca66fa72e3458cb4a9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	3e1f2d01f7	ipn/ipnlocal: move Ping method from IPN bus to LocalBackend (HTTP) Change-Id: I61759f1dae8d9d446353db54c8b1e13bfffb3287 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	c60cbca371	control/controlclient: store netinfo and hostinfo separately Currently, when SetNetInfo is called it sets the value on hostinfo.NetInfo. However, when SetHostInfo is called it overwrites the hostinfo field which may mean it also clears out the NetInfo it had just received. This commit stores NetInfo separately and combines it into Hostinfo as needed so that control is always notified of the latest values. Also, remove unused copies of Hostinfo from ipn.Status and controlclient.Auto. Updates #tailscale/corp#4824 (maybe fixes) Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
James Tucker	ae483d3446	wgengine, net/packet, cmd/tailscale: add ICMP echo Updates tailscale/corp#754 Signed-off-by: James Tucker <james@tailscale.com>	4 years ago
Tom DNetto	9dee6adfab	cmd/tailscaled,ipn/ipnlocal,wgengine/...: pass dns.Manager into netstack Needed for a following commit which moves magicDNS handling into netstack. Signed-off-by: Tom DNetto <tom@tailscale.com>	4 years ago
Maisem Ali	3012a2e1ca	ssh/tailssh,ipn/ipnlocal: terminate any active sessions on `up --ssh=false` Currently the ssh session isn't terminated cleanly, instead the packets are just are no longer routed to the in-proc SSH server. This makes it so that clients get a disconnection when the `RunSSH` pref changes to `false`. Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Mihai Parparita	2ec371fe8b	ipn: remove FakeExpireAfter Backend function No callers remain (last one was removed with tailscale/corp@1c095ae08f), and it's pretty esoteric. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	4 years ago
Mihai Parparita	316523cc1e	ipn: remove enforceDefaults option from PrefsFromBytes The Mac client was using it, but it had the effect of the `RouteAll` ("Use Tailscale subnets") pref always being enabled at startup, regardless of the persisted value. enforceDefaults was added to handle cases from ~2 years ago where we ended up with persisted `"RouteAll": false` values in the keychain, but that should no longer be a concern. New users will get the default of it being enabled via `NewPrefs`. There will be a corresponding Mac client change to stop passing in enforceDefaults. For #3962 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	4 years ago
Maisem Ali	5a1ef1bbb9	net/tsdial: add SystemDial as a wrapper on netns.Dial The connections returned from SystemDial are automatically closed when there is a major link change. Also plumb through the dialer to the noise client so that connections are auto-reset when moving from cellular to WiFi etc. Updates #3363 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Maisem Ali	1a19aed410	ipn/ipnlocal: do not initialize peer api listeners when shutting down Updates tailscale/corp#4824 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	7a097ccc83	ipn/ipnlocal: close peerapi listeners on LocalBackend.Shutdown For tests. Now that we can always listen (whereas we used to fail prior to `a2c330c496`), some goroutine leak checks were failing in tests in another repo after that change. Change-Id: Id95a4b71167eca61962a48616d79741b9991e0bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	8b81254992	ipn/ipnlocal: reject tailscale up --ssh if disabled on tailnet Updates #3802 Change-Id: I3f1e839391fe9b28270f506f4bb8d8e3d36716f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	cc575fe4d6	net/dns: schedule DoH upgrade explicitly, fix Resolver.Addr confusion Two changes in one: * make DoH upgrades an explicitly scheduled send earlier, when we come up with the resolvers-and-delay send plan. Previously we were getting e.g. four Google DNS IPs and then spreading them out in time (for back when we only did UDP) but then later we added DoH upgrading at the UDP packet layer, which resulted in sometimes multiple DoH queries to the same provider running (each doing happy eyeballs dialing to 4x IPs themselves) for each of the 4 source IPs. Instead, take those 4 Google/Cloudflare IPs and schedule 5 things: first the DoH query (which can use all 4 IPs), and then each of the 4 IPs as UDP later. * clean up the dnstype.Resolver.Addr confusion; half the code was using it as an IP string (as documented) as half was using it as an IP:port (from some prior type we used), primarily for tests. Instead, document it was being primarily an IP string but also accepting an IP:port for tests, then add an accessor method on it to get the IPPort and use that consistently everywhere. Change-Id: Ifdd72b9e45433a5b9c029194d50db2b9f9217b53 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	a04eebf59f	ipn/ipnlocal: also use SSHPolicies when updating filterHash Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	8f5e5bff1e	cmd/tailscale, etc: make "tailscale up --ssh" fail fast when unavailable Fail on unsupported platforms (must be Linux or macOS tailscaled with WIP env) or when disabled by admin (with TS_DISABLE_SSH_SERVER=1) Updates #3802 Change-Id: I5ba191ed0d8ba4ddabe9b8fc1c6a0ead8754b286 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ade7bd8745	ssh/tailssh: close sessions on policy change if no longer allowed Updates #3802 Change-Id: I98503c2505b77ac9d0cc792614fcdb691761a70c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4ec83fbad6	ipn/ipnlocal: only call updateFilter with mutex held And rename to updateFilterLocked to prevent future mistakes. Fixes #4427 Change-Id: I4d37b90027d5ff872a339ce8180f5723704848dc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	16f3520089	all: add arbitrary capability support Updates #4217 RELNOTE=start of WhoIsResponse capability support Change-Id: I6522998a911fe49e2f003077dad6164c017eed9b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	8ee044ea4a	ssh/tailssh: make the SSH server a singleton, register with LocalBackend Remove the weird netstack -> tailssh dependency and instead have tailssh register itself with ipnlocal when linked. This makes tailssh.server a singleton, so we can have a global map of all sessions. Updates #3802 Change-Id: Iad5caec3a26a33011796878ab66b8e7b49339f29 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	df9ce972c7	tailcfg, ipn/ipnlocal: add debug flag to enable one-big-CGNAT/10 route To experiment with avoiding Chrome ERR_NETWORK_CHANGED errors on route changes. Updates #3102 Change-Id: I339da14c684fdac45ac261566aa21bf2198672ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	50b4b8b2c6	ipn/ipnlocal: make peerIPs return a sorted slice Currently peerIPs doesn't do any sorting of the routes it returns. This is typically fine, however imagine the case of an HA subnet router failover. When a route R moves from peer A to peer B, the output of peerIPs changes. This in turn causes all the deephash check inside wgengine to fail as the hashed value of [R1, R2] is different than the hashed value of [R2, R1]. When the hash check failes, it causes wgengine to reconfigure all routes in the OS. This is especially problematic for macOS and iOS where we use the NetworkExtension. This commit makes it that the peerIPs are always sorted when returned, thus making the hash be consistent as long as the list of routes remains static. Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	3ae701f0eb	net/tsaddr, wgengine/netstack: add IPv6 range that forwards to site-relative IPv4 This defines a new magic IPv6 prefix, fd7a:115c:a1e0:b1a::/64, a subset of our existing /48, where the final 32 bits are an IPv4 address, and the middle 32 bits are a user-chosen "site ID". (which must currently be 0000:00xx; the top 3 bytes must be zero for now) e.g., I can say my home LAN's "site ID" is "0000:00bb" and then advertise its 10.2.0.0/16 IPv4 range via IPv6, like: tailscale up --advertise-routes=fd7a:115c:a1e0:b1a::bb:10.2.0.0/112 (112 being /128 minuse the /96 v6 prefix length) Then people in my tailnet can: $ curl '[fd7a:115c:a1e0:b1a::bb:10.2.0.230]' <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" .... Updates #3616, etc RELNOTE=initial support for TS IPv6 addresses to route v4 "via" specific nodes Change-Id: I9b49b6ad10410a24b5866b9fbc69d3cae1f600ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	309ddef852	net/netutil: add CheckIPForwardingLinux (#4301 ) Combine the code between `LocalBackend.CheckIPForwarding` and `controlclient.ipForwardingBroken`. Fixes #4300 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Maisem Ali	6fecc16c3b	ipn/ipnlocal: do not process old status messages received out of order When `setWgengineStatus` is invoked concurrently from multiple goroutines, it is possible that the call invoked with a newer status is processed before a call with an older status. e.g. a status that has endpoints might be followed by a status without endpoints. This causes unnecessary work in the engine and can result in packet loss. This patch adds an `AsOf time.Time` field to the status to specifiy when the status was calculated, which later allows `setWgengineStatus` to ignore any status messages it receives that are older than the one it has already processed. Updates tailscale/corp#2579 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	cceacda5eb	ipn/ipnstate: put SSH Host Keys in ipnstate.PeerStatus Updates #3802 Change-Id: I47ba3b4545b25988f375bd867aecd98bb0da8d79 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d2f3ec8a63	envknob, ipn/ipnlocal: add SSH admin kill switch Updates #3802 Change-Id: I6127907446d1a6be1b097d9ba3b534f2b8eb707f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f3b13604b3	control/controlclient, ipn/ipnlocal, tailcfg: add MapResponse.PopBrowserURL Updates #3802 Change-Id: I89481fc5782a0cc8084354706f8f28d94f197325 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	6b9d938c1a	types/views: add generic Slice[T] and remove StringSlice Also make IPPrefixSliceOf use Slice[netaddr.IPPrefix] as it also provides additional functions besides the standard ones provided by Slice[T]. Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	efc48b0578	ssh/tailssh, ipnlocal, controlclient: fetch next SSHAction from network Updates #3802 Change-Id: I08e98805ab86d6bbabb6c365ed4526f54742fd8e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	888e50e1f6	ipn/ipnlocal: migrate all platforms to controlplane.tailscale.com Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Nick O'Neill	1625e87526	control/controlclient, localapi: shorten expiry time via localapi (#4112 ) Signed-off-by: Nick O'Neill <nick@tailscale.com>	4 years ago
Brad Fitzpatrick	d5f8f38ac6	tailcfg: rename map request version to "capability version" And add a CapabilityVersion type, primarily for documentation. This makes MapRequest.Version, RegisterRequest.Version, and SetDNSRequest.Version all use the same version, which will avoid confusing in the future if Register or SetDNS ever changed their semantics on Version change. (Currently they're both always 1) This will requre a control server change to allow a SetDNSRequest.Version value other than 1 to be deployed first. Change-Id: I073042a216e0d745f52ee2dbc45cf336b9f84b7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	c7a8f0992d	ipn/ipnlocal: use views for Peer.PrimaryRoutes and Peer.Tags RELNOTE=`tailscale status --json` now shows Tags and PrimaryRoutes Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Maisem Ali	9cbb0913be	ipn/{ipnlocal,ipnstate}: add Tags and PrimaryRoutes to PeerStatus Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Maisem Ali	f9a50779e2	cmd/tailscaled: add `-state=mem:` to support creation of an ephemeral node. RELNOTE=`tailscaled --state=mem:` registers as an ephemeral node and does not store state to disk. Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	84138450a4	types/logger, logtail: add mechanism to do structured JSON logs e.g. the change to ipnlocal in this commit ultimately logs out: {"logtail":{"client_time":"2022-02-17T20:40:30.511381153-08:00","server_time":"2022-02-18T04:40:31.057771504Z"},"type":"Hostinfo","val":{"GoArch":"amd64","Hostname":"tsdev","IPNVersion":"1.21.0-date.20220107","OS":"linux","OSVersion":"Debian 11.2 (bullseye); kernel=5.10.0-10-amd64"},"v":1} Change-Id: I668646b19aeae4a2fed05170d7b279456829c844 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	bb93e29d5c	tailcfg, ipn/ipnlocal: add Hostinfo.SSH_HostKeys, send when SSH enabled (The name SSH_HostKeys is bad but SSHHostKeys is worse.) Updates #3802 Change-Id: I2a889019c9e8b065b668dd58140db4fcab868a91 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	72d8672ef7	tailcfg: make Node.Hostinfo a HostinfoView Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Ross Zurowski	6d02a48d8d	ipn: add `TailnetStatus` field to `tailscale status --json` (#3865 ) We need to capture some tailnet-related information for some Docker features we're building. This exposes the tailnet name and MagicDNS information via `tailscale status --json`. Fixes tailscale/corp#3670 Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	4 years ago
Brad Fitzpatrick	01e8a152f7	ipn/ipnlocal: log most of Hostinfo once non-verbose at start-up Our previous Hostinfo logging was all as a side effect of telling control. And it got marked as verbose (as it was) This adds a one-time Hostinfo logging that's not verbose, early in start-up. Change-Id: I1896222b207457b9bb12ffa7cf361761fa4d3b3a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a19c110dd3	envknob: track, log env knobs in use Fixes #3921 Change-Id: I8186053b5c09c43f0358b4e7fdd131361a6d8f2e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	2db6cd1025	ipn/ipnlocal, wgengine/magicsock, logpolicy: quiet more logs Updates #1548 Change-Id: Ied169f872e93be2857890211f2e018307d4aeadc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	86a902b201	all: adjust some log verbosity Updates #1548 Change-Id: Ia55f1b5dc7dfea09a08c90324226fb92cd10fa00 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	bd90781b34	ipn/ipnlocal, wgengine/netstack: use netstack for peerapi server We're finding a bunch of host operating systems/firewalls interact poorly with peerapi. We either get ICMP errors from the host or users need to run commands to allow the peerapi port: https://github.com/tailscale/tailscale/issues/3842#issuecomment-1025133727 ... even though the peerapi should be an internal implementation detail. Rather than fight the host OS & firewalls, this change handles the server side of peerapi entirely in netstack (except on iOS), so it never makes its way to the host OS where it might be messed with. Two main downsides are: 1) netstack isn't as fast, but we don't really need speed for peerapi. And actually, with fewer trips to/from the kernel, we might actually make up for some of the netstack performance loss by staying in userspace. 2) tcpdump / Wireshark etc packet captures will no longer see the peerapi traffic. Oh well. Crawshaw's been wanting to add packet capture server support to tailscaled, so we'll probably do that sooner now. A future change might also then use peerapi for the client-side (except on iOS). Updates #3842 (probably fixes, as well as many exit node issues I bet) Change-Id: Ibc25edbb895dc083d1f07bd3cab614134705aa39 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	857cd6c0d7	ipn/ipnstate: add TailnetName to status RELNOTE=tailscale status --json \| jq .TailnetName Fixes tailscale/corp#3665 Change-Id: I85de027ba2781eb31ee1e0c5ab913b0dfa5b4c86 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f3c0023add	wgengine/netstack: add an SSH server experiment Disabled by default. To use, run tailscaled with: TS_SSH_ALLOW_LOGIN=you@bar.com And enable with: $ TAILSCALE_USE_WIP_CODE=true tailscale up --ssh=true Then ssh [any-user]@[your-tailscale-ip] for a root bash shell. (both the "root" and "bash" part are temporary) Updates #3802 Change-Id: I268f8c3c95c8eed5f3231d712a5dc89615a406f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	3690bfecb0	ipn/ipnlocal: fix cert fetching on macOS GUI platforms And clarify the directory they get written to when under the sandbox. Fixes #3667 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	506c727e30	ipnlocal, net/{dns,tsaddr,tstun}, wgengine: support MagicDNS on IPv6 Fixes #3660 RELNOTE=MagicDNS now works over IPv6 when CGNAT IPv4 is disabled. Change-Id: I001e983df5feeb65289abe5012dedd177b841b45 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b09000ad5d	ipn/localapi: add debug handler to Rebind, ReSTUN magicsock And more later probably. Updates #3619 Change-Id: Ia4cba34a7c0dcce4d2eddec8aae17f32b51c207f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	add6dc8ccc	ipn/ipnlocal: make TestShrinkDefaultRoute hermetic Make shrinkDefaultRoute a pure function. Instead of calling interfaceRoutes, accept that information as parameters. Hard-code those parameters in TestShrinkDefaultRoute. Fixes #3580 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	8f43ddf1a2	ipn/ipnlocal, health: populate self node's Online bit in tailscale status One option was to just hide "offline" in the text output, but that doesn't fix the JSON output. The next option was to lie and say it's online in the JSON (which then fixes the "offline" in the text output). But instead, this sets the self node's "Online" to whether we're in an active map poll. Fixes #3564 Change-Id: I9b379989bd14655198959e37eec39bb570fb814a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	93ae11105d	ipn/ipnlocal: clear magicsock's netmap on logout magicsock was hanging onto its netmap on logout, which caused tailscale status to display partial information about a bunch of zombie peers. After logout, there should be no peers. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	cced414c7d	net/dns/resolver: add Windows ExitDNS service support, using net package Updates #1713 Updates #835 Change-Id: Ia71e96d0632c2d617b401695ad68301b07c1c2ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	7b9c7bc42b	ipn/ipnstate: remove old deprecated TailAddr IPv4-only field It's been a bunch of releases now since the TailscaleIPs slice replacement was added. Change-Id: I3bd80e1466b3d9e4a4ac5bedba8b4d3d3e430a03 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Denton Gentry	878a20df29	net/dns: add GetBaseConfig to CallbackRouter. Allow users of CallbackRouter to supply a GetBaseConfig implementation. This is expected to be used on Android, which currently lacks both a) platform support for Split-DNS and b) a way to retrieve the current DNS servers. iOS/macOS also use the CallbackRouter but have platform support for SplitDNS, so don't need getBaseConfig. Updates https://github.com/tailscale/tailscale/issues/2116 Updates https://github.com/tailscale/tailscale/issues/988 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Brad Fitzpatrick	c0701b130d	ipn/ipnstate, cmd/tailscale: add Online bool to tailscale status & --json Fixes #3533 Change-Id: I2f6f0d712cf3f987fba1c15be74cdb5c8d565f04 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Todd Neal	c18dc57861	ipn/{ipnserver,ipnlocal}: support incoming Taildrop on TrueNAS Signed-off-by: Todd Neal <todd@tneal.org>	4 years ago
Brad Fitzpatrick	abc00e9c8d	ipn/{ipnserver,ipnlocal}: support incoming Taildrop on Synology If the user has a "Taildrop" shared folder on startup and the "tailscale" system user has read/write access to it, then the user can "tailscale file cp" to their NAS. Updates #2179 (would be fixes, but not super ideal/easy yet) Change-Id: I68e59a99064b302abeb6d8cc84f7d2a09f764990 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	9c5c9d0a50	ipn/ipnlocal, net/tsdial: make SOCKS/HTTP dials use ExitDNS And simplify, unexport some tsdial/netstack stuff in the the process. Fixes #3475 Change-Id: I186a5a5cbd8958e25c075b4676f7f6e70f3ff76e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	adc5997592	net/tsdial: give netstack a Dialer, start refactoring name resolution This starts to refactor tsdial.Dialer's name resolution to have different stages: in-memory MagicDNS vs system resolution. A future change will plug in ExitDNS resolution. This also plumbs a Dialer into netstack and unexports the dnsMap internals. And it removes some of the async AddNetworkMapCallback usage and replaces it with synchronous updates of the Dialer's netmap from LocalBackend, since the LocalBackend has the Dialer too. Updates #3475 Change-Id: Idcb7b1169878c74f0522f5151031ccbc49fe4cb4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	43983a4a3b	ipn/ipnlocal: run peerapi even if Taildrop storage not configured Change-Id: I77f9ecbe4617d01d13aa1127fa59c83f2aa3e1b8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	44d0c1ab06	ipn/ipnlocal: resolve exit node IP to ID at EditPrefs time. Without this, enabling an exit node immediately blackholes all traffic, but doesn't correctly let it flow to the exit node until the next netmap update. Fixes #3447 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	ad3d6e31f0	net/tsdial: move macOS/iOS peerapi sockopt logic from LocalBackend Change-Id: I812cae027c40c70cdc701427b1a1850cd9bcd60c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c7fb26acdb	net/tsdial: also plumb TUN name and monitor into tsdial.Dialer In prep for moving stuff out of LocalBackend. Change-Id: I9725aa9c3ebc7275f8c40e040b326483c0340127 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c37af58ea4	net/tsdial: move more weirdo dialing into new tsdial package, plumb Not done yet, but this move more of the outbound dial special casing from random packages into tsdial, which aspires to be the one unified place for all outbound dialing shenanigans. Then this plumbs it all around, so everybody is ultimately holding on to the same dialer. As of this commit, macOS/iOS using an exit node should be able to reach to the exit node's DoH DNS proxy over peerapi, doing the sockopt to stay within the Network Extension. A number of steps remain, including but limited to: * move a bunch more random dialing stuff * make netstack-mode tailscaled be able to use exit node's DNS proxy, teaching tsdial's resolver to use it when an exit node is in use. Updates #1713 Change-Id: I1e8ee378f125421c2b816f47bc2c6d913ddcd2f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	3ae6f898cf	ipn/ipnlocal, net/dns/resolver: use exit node's DoH proxy when available Updates #1713 Change-Id: I3695a40ec12d2b4e6dac41cf4559daca6dddd68e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	2a95ee4680	cmd/tailscale, ipn/ipnstate: note which nodes are exit nodes in status Fixes #3446 Change-Id: Ib41d588e7fa434c02d134fa449f85b0e15083683 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b811a316bc	tailcfg, ipn/ipnlocal: advertise a Service when exit node DNS proxy available Updates #1713 Change-Id: I20c8e2ad1062d82ef17363414e372133f4c7181e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	135580a5a8	tailcfg, ipn/ipnlocal, net/dns: forward exit node DNS on Unix to system DNS Updates #1713 Change-Id: I4c073fec0992d9e01a9a4ce97087d5af0efdc68d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c2efe46f72	ipn/ipnlocal: restrict exit node DoH server based on ACL'ed packet filter Don't be a DoH DNS server to peers unless the Tailnet admin has permitted that peer autogroup:internet access. Updates #1713 Change-Id: Iec69360d8e4d24d5187c26904b6a75c1dabc8979 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	097602b3ca	ipn/ipnlocal: warn more precisely about IP forwarding issues on linux. If IP forwarding is disabled globally, but enabled per-interface on all interfaces, don't complain. If only some interfaces have forwarding enabled, warn that some subnet routing/exit node traffic may not work. Fixes #1586 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	33c541ae30	ipn/ipnlocal: populate self status from netmap in ipnlocal, not magicsock. Fixes #1933 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	955aa188b3	ipn/ipnlocal: fix logging We were missing an argument here. Also, switch to %q, in case anything weird is happening with these strings. Updates tailscale/corp#461 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	283ae702c1	ipn/ipnlocal: start adding DoH DNS server to peerapi when exit node Updates #1713 Change-Id: I8d9c488f779e7acc811a9bc18166a2726198a429 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	d6dde5a1ac	ipn/ipnlocal: handle key extensions after key has already expired Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	337757a819	ipn/ipnlocal, control/controlclient: don't propagate all map errors to UI Fixes regression from `81cabf48ec` which made all map errors be sent to the frontend UI. Fixes #3230 Change-Id: I7f142c801c7d15e268a24ddf901c3e6348b6729c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	0532eb30db	all: replace tailcfg.DiscoKey with key.DiscoPublic. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	649f7556e8	cmd/tailscaled, ipn: add tailscaled --statedir flag for var directory Fixes #2932 Change-Id: I1aa2b323ad542386d140f8336bcc4dcbb8310bd0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	3fd5f4380f	util/multierr: new package github.com/go-multierror/multierror served us well. But we need a few feature from it (implement Is), and it's not worth maintaining a fork of such a small module. Instead, I did a clean room implementation inspired by its API. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	7e6a1ef4f1	tailcfg: use key.NodePublic in wire protocol types. Updates #3206. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7e8d5ed6f3	ipn: use key.NodePublic instead of tailcfg.NodeKey Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c17250cee2	ipn/ipnstate: use key.NodePublic instead of tailcfg.NodeKey. Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	418adae379	various: use NodePublic.AsNodeKey() instead of tailcfg.NodeKeyFromNodePublic() Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	429632d32c	ipn/ipnlocal: treat js/wasm interative logins as ephemeral for now At least until js/wasm starts using browser LocalStorage or something. But for the foreseeable future, any login from a browser should be considered ephemeral as the tab can close at any time and lose the wireguard key, never to be seen again. Updates #3157 Change-Id: I6c410d86dc7f9f233c3edd623313d9dee2085aac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	c1d009b9e9	ipn/ipnstate: use key.NodePublic instead of the generic key.Public. Updates #3206. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0c546a28ba	types/persist: use new node key type. Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Maisem Ali	81cabf48ec	control/controlclient,tailcfg: propagate registration errors to the frontend Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Maisem Ali	c6d3f622e9	ipn/ipnlocal: use netaddr.IPSetBuilder when constructing list of interface IPPrefixes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	ddf3394b40	ipn/ipnlocal: don't try to block localhost traffic when using exit nodes Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	cb4a2c00d1	ipn: remove unused Prefs.OSVersion and Prefs.DeviceModel iOS and Android no longer use these. They both now (as of today) use the hostinfo.SetFoo setters instead. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	67e5fabdbd	hostinfo, ipn/ipnlocal: add SetPackage, remove ipnlocal hacks Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	81269fad28	hostinfo: add SetOSVersion like SetDeviceModel, deprecate ipn.Prefs way Turns out the iOS client has been only sending the OS version it first started at. This whole hostinfo-via-prefs mechanism was never a good idea. Start removing it. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	22a1a5d7cf	ipn/ipnlocal: for IPv6-only nodes, publish IPv6 MagicDNS records of peers See https://github.com/tailscale/tailscale/issues/2970#issuecomment-931885268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6d43cbc325	ipn/ipnlocal: make sure mobile clients don't use the old control server URL The new frontends are better for battery. Updates #2442 Updates tailscale/corp#2750 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	3b3994f0db	ipn{,/localapi,ipnlocal}: infer cert dir from state file location This fixes "tailscale cert" on Synology where the var directory is typically like /volume2/@appdata/Tailscale, or any other tailscaled user who specifies a non-standard state file location. This is a interim fix on the way to #2932. Fixes #2927 Updates #2932 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	aae622314e	tailcfg, health: add way for control plane to add problems to health check So if the control plane knows that something's broken about the node, it can include problem(s) in MapResponse and "tailscale status" will show it. (and GUIs in the future, as it's in ipnstate.Status/JSON) This also bumps the MapRequest.Version, though it's not strictly required. Doesn't hurt. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	f834a4ade5	ipn/ipnlocal: fix minor typo in comment Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	45d3174c0d	ipn/ipnlocal: add LocalBackend.broadcastStatusChanged To reduce repetition. Also, document why we acquire the lock. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	b7ede14396	Revert "ipn/ipnlocal: remove locks around sync.Cond.Broadcast call" Reason for revert: Causes ipnlocal tests to deadlock intermittently. This reverts commit `1b15349e01`. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1b15349e01	ipn/ipnlocal: remove locks around sync.Cond.Broadcast call They are unnecessary. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	3b58c118dd	ipn/ipnlocal: inline LocalBackend.getEngineStatus For uniformity. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	0f4c0e558b	ipn/ipnlocal: use a switch statement instead of an else-if chain For clarity. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	7421ba91ec	ipn/ipnlocal: only call UpdateEndpoints when the endpoints change Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	48933b0382	ipn/ipnlocal: flesh out the dnsConfigForNetmap tests Follow-up to #2805 and #2806 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	7fe6ecf165	ipn/ipnlocal: add MagicDNS records for IPv6-only nodes Updates #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	30a614f9b9	ipn/ipnlocal: return early, outdent a bunch in dnsConfigForNetmap Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	2bb0eb5f7e	ipn/ipnlocal: pull out dns.Config construction to its own func In prep for other bug fixes & tests. It's hard to test when it was intermingled into LocalBackend.authReconfig. Now it's a pure function. And rename variable 'uc' (user config?) to the since idiomatic 'prefs'. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Crawshaw	9502b515f1	net/dns: replace resolver IPs with type for DoH We currently plumb full URLs for DNS resolvers from the control server down to the client. But when we pass the values into the net/dns package, we throw away any URL that isn't a bare IP. This commit continues the plumbing, and gets the URL all the way to the built in forwarder. (It stops before plumbing URLs into the OS configurations that can handle them.) For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Dave Anderson	980acc38ba	types/key: add a special key with custom serialization for control private keys (#2792 ) * Revert "Revert "types/key: add MachinePrivate and MachinePublic."" This reverts commit `61c3b98a24`. Signed-off-by: David Anderson <danderson@tailscale.com> * types/key: add ControlPrivate, with custom serialization. ControlPrivate is just a MachinePrivate that serializes differently in JSON, to be compatible with how the Tailscale control plane historically serialized its private key. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	61c3b98a24	Revert "types/key: add MachinePrivate and MachinePublic." Broke the tailscale control plane due to surprise different serialization. This reverts commit `4fdb88efe1`.	4 years ago
David Anderson	4fdb88efe1	types/key: add MachinePrivate and MachinePublic. Plumb throughout the codebase as a replacement for the mixed use of tailcfg.MachineKey and wgkey.Private/Public. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	5bacbf3744	wgengine/magicsock, health, ipn/ipnstate: track DERP-advertised health And add health check errors to ipnstate.Status (tailscale status --json). Updates #2746 Updates #2775 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	88bd796622	tailcfg,ipn/ipnlocal: support DNSConfig.Routes with empty values [mapver 23] Fixes #2706 Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Matt Drollette	c1aa5a2e33	ipn/ipnlocal: update requested tags in host info Fixes #2641 Signed-off-by: Matt Drollette <matt@drollette.com>	4 years ago
Brad Fitzpatrick	47045265b9	hostinfo: add SetDeviceModel setter, move remaining code from controlclient Updates tailscale/corp#1959 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Simeng He	e199e407d2	tailcfg: add IP and Types field to PingRequest Signed-off-by: Simeng He <simeng@tailscale.com>	4 years ago
Josh Bleecher Snyder	a666b546fb	ipn/ipnlocal: log number of packet filters rather than entire filter The number of packet filters can grow very large, so this log entry can be very large. We can get the packet filter server-side, so reduce verbosity here to just the number of filters present. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Crawshaw	360223fccb	types/dnstype: introduce new package for Resolver So the type can be used in net/dns without introducing a tailcfg dependency. For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
David Crawshaw	0554b64452	ipnlocal: allow access to guest VMs/containers while using an exit node Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Brad Fitzpatrick	690ade4ee1	ipn/ipnlocal: add URL to IP forwarding error message Updates #606 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	7428ecfebd	ipn/ipnlocal: populate Hostinfo.Package on Android Fixes tailscale/corp#2266 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Joe Tsai	9a0c8bdd20	util/deephash: make hash type opaque The fact that Hash returns a [sha256.Size]byte leaks details about the underlying hash implementation. This could very well be any other hashing algorithm with a possible different block size. Abstract this implementation detail away by declaring an opaque type that is comparable. While we are changing the signature of UpdateHash, rename it to just Update to reduce stutter (e.g., deephash.Update). Signed-off-by: Joe Tsai <joetsai@digital-static.net>	4 years ago
Brad Fitzpatrick	b6d70203d3	ipn/ipnlocal: fix 'tailscale up' on Windows without GUI With this, I can now: * install Tailscale * stop the GUI * net stop Tailscale * net start Tailscale * tailscale up --unattended (where the middle three steps simulate what would happen on a Windows Server Core machine without a GUI) Fixes #2137 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6eecf3c9d1	ipn/ipnlocal: stay out of map poll when down Fixes #2434 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	01e159b610	ipn/ipnlocal: save prefs to disk on UpdatePrefs Regression from `6d10655dc3`, which added UpdatePrefs but didn't write it out to disk. I'd planned on adding tests to state_test.go which is why I'd earlier added `46896a9311` to prepare for making such persistence tests easier to write, but turns out state_test.go didn't even test UpdatePrefs, so I'm staying out of there. Instead, this is tested using integration tests. Fixes #2321 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Crawshaw	805d5d3cde	ipnlocal: move log line inside if statement Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Brad Fitzpatrick	700badd8f8	util/deephash: move internal/deephash to util/deephash No code changes. Just a minor package doc addition about lack of API stability.	4 years ago
Josh Bleecher Snyder	f11a8928a6	ipn/ipnlocal: fix data race We can't access b.netMap without holding b.mu. We already grabbed it earlier in the function with the lock held. Introduced in Nov 2020 in `7ea809897d`. Discovered during stress testing. Apparently it's a pretty rare? Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Maisem Ali	ec52760a3d	wgengine/router_windows: support toggling local lan access when using exit nodes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
julianknodt	506c2fe8e2	cmd/tailscale: make netcheck use active DERP map, delete static copy After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	5 years ago
David Crawshaw	4ce15505cb	wgengine: randomize client port if netmap says to For testing out #2187 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
David Crawshaw	297b3d6fa4	staticcheck.conf: turn off noisy lint errors Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	0debb99f08	tailcfg: add DNSConfig.ExtraRecords Updates #1748 Updates #1235 Updates #2055 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Maisem Ali	f482321f67	ipn/ipnlocal: support exit node local access switching on darwin. Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 years ago
Brad Fitzpatrick	cd282ec00f	tailcfg: add DNSConfig.CertDomains Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	cc6ab0a70f	ipn/ipnlocal: retry peerapi listen on Android, like we do on Windows Updates #1960 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	e29cec759a	ipn/{ipnlocal,localapi}, control/controlclient: add SetDNS localapi Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	ecfb2639cc	ipn/ipnlocal: avoid initPeerAPIListener crash on certain concurrent actions We were crashing on in initPeerAPIListener when called from authReconfig when b.netMap is nil. But authReconfig already returns before the call to initPeerAPIListener when b.netMap is nil, but it releases the b.mu mutex before calling initPeerAPIListener which reacquires it and assumes it's still nil. The only thing that can be setting it to nil is setNetMapLocked, which is called by ResetForClientDisconnect, Logout/logout, or Start, all of which can happen during an authReconfig. So be more defensive. Fixes #1996 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a321c24667	go.mod: update netaddr Involves minor IPSetBuilder.Set API change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Avery Pennarun	eaa6507cc9	ipnlocal: in Start() fast path, don't forget to send Prefs. The resulting empty Prefs had AllowSingleHosts=false and Routeall=false, so that on iOS if you did these steps: - Login and leave running - Terminate the frontend - Restart the frontend (fast path restart, missing prefs) - Set WantRunning=false - Set WantRunning=true ...then you would have Tailscale running, but with no routes. You would also accidentally disable the ExitNodeID/IP prefs (symptom: the current exit node setting didn't appear in the UI), but since nothing else worked either, you probably didn't notice. The fix was easy enough. It turns out we already knew about the problem, so this also fixes one of the BUG entries in state_test. Fixes: #1918 (BUG-1) and some as-yet-unreported bugs with exit nodes. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	8a7d35594d	ipnlocal: don't assume NeedsLogin immediately after StartLogout(). Previously, there was no server round trip required to log out, so when you asked ipnlocal to Logout(), it could clear the netmap immediately and switch to NeedsLogin state. In v1.8, we added a true Logout operation. ipn.Logout() would trigger an async cc.StartLogout() and also immediately switch to NeedsLogin. Unfortunately, some frontends would see NeedsLogin and immediately trigger a new StartInteractiveLogin() operation, before the controlclient auth state machine actually acted on the Logout command, thus accidentally invalidating the entire logout operation, retaining the netmap, and violating the user's expectations. Instead, add a new LogoutFinished signal from controlclient (paralleling LoginFinished) and, upon starting a logout, don't update the ipn state machine until it's received. Updates: #1918 (BUG-2) Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Brad Fitzpatrick	a04801e037	ipn/ipnlocal: ignore NetfilterMode pref on Synology On clean installs we didn't set use iptables, but during upgrades it looks like we could use old prefs that directed us to go into the iptables paths that might fail on Synology. Updates #1995 Fixes tailscale/tailscale-synology#57 (I think) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Elias Naur	adfe8cf41d	paths: generalize IOSSharedDir to cover Android Also fix an error message while here. Signed-off-by: Elias Naur <mail@eliasnaur.com>	5 years ago
David Anderson	df350e2069	ipn/ipnlocal: initialize DNS config maps unconditionally. Fixes #1963. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	e2dcf63420	net/dns: replace AuthoritativeSuffixes with nil Route entries. This leads to a cleaner separation of intent vs. implementation (Routes is now the only place specifying who handles DNS requests), and allows for cleaner expression of a configuration that creates MagicDNS records without serving them to the OS. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	6690f86ef4	net/dns: always offer MagicDNS records at 100.100.100.100. Fixes #1886. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w(.)\.Port = (.) -> $1 = $1.WithPort($2) \w(.)\.IP = (.) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	5 years ago
Avery Pennarun	6fd4e8d244	ipnlocal: fix switching users while logged in + Stopped. This code path is very tricky since it was originally designed for the "re-authenticate to refresh my keys" use case, which didn't want to lose the original session even if the refresh cycle failed. This is why it acts differently from the Logout(); Login(); case. Maybe that's too fancy, considering that it probably never quite worked at all, for switching between users without logging out first. But it works now. This was more invasive than I hoped, but the necessary fixes actually removed several other suspicious BUG: lines from state_test.go, so I'm pretty confident this is a significant net improvement. Fixes tailscale/corp#1756. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	285d0e3b4d	ipnlocal: fix deadlock in RequestEngineStatusAndWait() error path. If the engine was shutting down from a previous session (e.closing=true), it would return an error code when trying to get status. In that case, ipnlocal would never unblock any callers that were waiting on the status. Not sure if this ever happened in real life, but I accidentally triggered it while writing a test. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Brad Fitzpatrick	36a26e6a71	internal/deephash: rename from deepprint Yes, it printed, but that was an implementation detail for hashing. And coming optimization will make it print even less. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	e72ed3fcc2	ipn/{ipnlocal,ipnstate}: add PeerStatus.ID stable ID to status --json output Needed for the "up checker" to map back from exit node stable IDs (the ipn.Prefs.ExitNodeID) back to an IP address in error messages. But also previously requested so people can use it to then make API calls. The upcoming "tailscale admin" subcommand will probably need it too. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Avery Pennarun	6d10655dc3	ipnlocal: accept a new opts.UpdatePrefs field. This is needed because the original opts.Prefs field was at some point subverted for use in frontend->backend state migration for backward compatibility on some platforms. We still need that feature, but we also need the feature of providing the full set of prefs from `tailscale up`, not including overwriting the prefs.Persist keys, so we can't use the original field from `tailscale up`. `tailscale up` had attempted to compensate for that by doing SetPrefs() before Start(), but that violates the ipn.Backend contract, which says you should call Start() before anything else (that's why it's called Start()). As a result, doing SetPrefs({ControlURL=..., WantRunning=true}) would cause a connection to the previous control server (because WantRunning=true), and then connect to the new control server only after running Start(). This problem may have been avoided before, but only by pure luck. It turned out to be relatively harmless since the connection to the old control server was immediately closed and replaced anyway, but it created a race condition that could have caused spurious notifications or rejected keys if the server responded quickly. As already covered by existing TODOs, a better fix would be to have Start() get out of the business of state migration altogether. But we're approaching a release so I want to make the minimum possible fix. Fixes #1840. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Brad Fitzpatrick	544d8d0ab8	ipn/ipnlocal: remove NewLocalBackendWithClientGen This removes the NewLocalBackendWithClientGen constructor added in `b4d04a065f` and instead adds LocalBackend.SetControlClientGetterForTesting, mirroring LocalBackend.SetHTTPTestClient. NewLocalBackendWithClientGen was weird in being exported but taking an unexported type. This was noted during code review: https://github.com/tailscale/tailscale/pull/1818#discussion_r623155669 which ended in: "I'll leave it for y'all to clean up if you find some way to do it elegantly." This is more idiomatic. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Avery Pennarun	0181a4d0ac	ipnlocal: don't pause the controlclient until we get at least one netmap. Without this, macOS would fail to display its menu state correctly if you started it while !WantRunning. It relies on the netmap in order to show the logged-in username. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	4ef207833b	ipn: !WantRunning + !LoggedOut should not be idle on startup. There was logic that would make a "down" tailscale backend (ie. !WantRunning) refuse to do any network activity. Unfortunately, this makes the macOS and iOS UI unable to render correctly if they start while !WantRunning. Now that we have Prefs.LoggedOut, use that instead. So `tailscale down` will still allow the controlclient to connect its authroutine, but pause the maproutine. `tailscale logout` will entirely stop all activity. This new behaviour is not obviously correct; it's a bit annoying that `tailsale down` doesn't terminate all activity like you might expect. Maybe we should redesign the UI code to render differently when disconnected, and then revert this change. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	4f3315f3da	ipnlocal: setting WantRunning with EditPrefs was special. EditPrefs should be just a wrapper around the action of changing prefs, but someone had added a side effect of calling Login() sometimes. The side effect happened after running the state machine, which would sometimes result in us going into NeedsLogin immediately before calling cc.Login(). This manifested as the macOS app not being able to Connect if you launched it with LoggedOut=false and WantRunning=false. Trying to Connect() would sent us to the NeedsLogin state instead. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	2a4d1cf9e2	Add prefs.LoggedOut to fix several state machine bugs. Fixes: tailscale/corp#1660 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	ac9cd48c80	ipnlocal: fix deadlock when calling Shutdown() from Start(). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	ecdba913d0	Revert "ipn/ipnlocal: be authoritative for the entire MagicDNS record tree." Unfortunately this broke MagicDNS almost entirely. Updates: tailscale/corp#1706 This reverts commit `1d7e7b49eb`.	5 years ago
Avery Pennarun	b4d04a065f	controlclient: extract a Client interface and rename Client->Auto. This will let us create a mock or fake Client implementation for use with ipn.Backend. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
David Anderson	1d7e7b49eb	ipn/ipnlocal: be authoritative for the entire MagicDNS record tree. With this change, shared node names resolve correctly on split DNS-supporting operating systems. Fixes tailscale/corp#1706 Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	b7a497a30b	ipn/ipnlocal: make FileTargets check IPN state first Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	306a094d4b	ipn/ipnlocal: remove IPv6 records from MagicDNS. Fixes #1813. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	3bdc9e9cb2	ipn/ipnlocal: prevent a now-expected [unexpected] log message on Windows Updates #1620 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Aleksandar Pesic	7c985e4944	ipn/ipnlocal: add file sharing to windows shell Updates: tailscale/winmin#33 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	5 years ago
Brad Fitzpatrick	fe53a714bd	ipn/ipnlocal: add a LocalBackend.Start fast path if already running Updates tailscale/corp#1621 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	ad1a595a75	ipn/ipnlocal: close peer API listeners on transition away from Running Updates tailscale/corp#1621 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	36d030cc36	ipn/ipnlocal: use fallback default DNS whenever exit nodes are on. Fixes #1625 Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	2f17a34242	ipn/ipnlocal: fix tailscale status --json AuthURL field It was getting cleared on notify. Document that authURL is cleared on notify and add a new field that isn't, using the new field for the JSON status. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	09891b9868	ipn/ipnlocal: on fresh lazy-connecting install, start in state NeedsLogin Fixes #1759 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	6fd9e28bd0	ipn/ipnlocal: add arpa suffixes to MagicDNS for reverse lookups. This used to not be necessary, because MagicDNS always did full proxying. But with split DNS, we need to know which names to route to our resolver, otherwise reverse lookups break. This captures the entire CGNAT range, as well as our Tailscale ULA. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	48d4f14652	ipn/ipnlocal: only set authoritative domains when using MagicDNS. Otherwise, the existence of authoritative domains forces full DNS proxying even when no other DNS config is present. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	f99e63bb17	ipn: don't Logout when Windows GUI disconnects Logout used to be a no-op, so the ipnserver previously synthensized a Logout on disconnect. Now that Logout actually invalidates the node key that was forcing all GUI closes to log people out. Instead, add a method to LocalBackend to specifically mean "the Windows GUI closed, please forget all the state". Fixes tailscale/corp#1591 (ignoring the notification issues, tracked elsewhere) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	1e5c608fae	ipn/ipnlocal: plumb fallback DNS in as a workaround for split DNS issues. Cause of #1743. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	a58fbb4da9	ipn/ipnlocal: only fix peerapiListener on Windows when running It's just logspam otherwise. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Maisem Ali	36fa29feec	ipn/ipnlocal: restrict local lan access to linux machines. Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 years ago
Brad Fitzpatrick	8f3e453356	ipn, cmd/tailscale/cli: add pref to configure sudo-free operator user From discussion with @danderson. Fixes #1684 (in a different way) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	49808ae6ea	ipn{,/ipnlocal}, cmd/tailscale/cli: don't check pref reverts on initial up The ipn.NewPrefs func returns a populated ipn.Prefs for historical reasons. It's not used or as important as it once was, but it hasn't yet been removed. Meanwhile, it contains some default values that are used on some platforms. Notably, for this bug (#1725), Windows/Mac use its Prefs.RouteAll true value (to accept subnets), but Linux users have always gotten a "false" value for that, because that's what cmd/tailscale's CLI default flag is _for all operating systems_. That meant that "tailscale up" was rightfully reporting that the user was changing an implicit setting: RouteAll was changing from true with false with the user explicitly saying so. An obvious fix might be to change ipn.NewPrefs to return Prefs.RouteAll == false on some platforms, but the logic is complicated by darwin: we want RouteAll true on windows, android, ios, and the GUI mac app, but not the CLI tailscaled-on-macOS mode. But even if we used build tags (e.g. the "redo" build tag) to determine what the default is, that then means we have duplicated and differing "defaults" between both the CLI up flags and ipn.NewPrefs. Furthering that complication didn't seem like a good idea. So, changing the NewPrefs defaults is too invasive at this stage of the release, as is removing the NewPrefs func entirely. Instead, tweak slightly the semantics of the ipn.Prefs.ControlURL field. This now defines that a ControlURL of the empty string means both "we're uninitialized" and also "just use the default". Then, once we have the "empty-string-means-unintialized" semantics, use that to suppress "tailscale up"'s recent implicit-setting-revert checking safety net, if we've never initialized Tailscale yet. And update/add tests. Fixes #1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	b993d9802a	ipn/ipnlocal, etc: require file sharing capability to send/recv files tailscale/corp#1582 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d6a95d807a	ipn/ipnlocal: advertise netstack to control server Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	762180595d	ipn/ipnstate: add PeerStatus.TailscaleIPs slice, deprecate TailAddr Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	34d2f5a3d9	tailcfg: add Endpoint, EndpointType, MapRequest.EndpointType Track endpoints internally with a new tailcfg.Endpoint type that includes a typed netaddr.IPPort (instead of just a string) and includes a type for how that endpoint was discovered (STUN, local, etc). Use []tailcfg.Endpoint instead of []string internally. At the last second, send it to the control server as the existing []string for endpoints, but also include a new parallel MapRequest.EndpointType []tailcfg.EndpointType, so the control server can start filtering out less-important endpoint changes from new-enough clients. Notably, STUN-discovered endpoints can be filtered out from 1.6+ clients, as they can discover them amongst each other via CallMeMaybe disco exchanges started over DERP. And STUN endpoints change a lot, causing a lot of MapResposne updates. But portmapped endpoints are worth keeping for now, as they they work right away without requiring the firewall traversal extra RTT dance. End result will be less control->client bandwidth. (despite negligible increase in client->control bandwidth) Updates tailscale/corp#1543 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	db5e269463	client/tailscale/apitype: move local API types to new apitype package They were scattered/duplicated in misc places before. It can't be in the client package itself for circular dep reasons. This new package is basically tailcfg but for localhost communications, instead of to control. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Maisem Ali	1b9d8771dc	ipn/ipnlocal,wgengine/router,cmd/tailscale: add flag to allow local lan access when routing traffic via an exit node. For #1527 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 years ago
Brad Fitzpatrick	9972c02b60	cmd/tailscale/cli: don't let up change prefs based on implicit flag values This changes the behavior of "tailscale up". Previously "tailscale up" always did a new Start and reset all the settings. Now "tailscale up" with no flags just brings the world [back] up. (The opposite of "tailscale down"). But with flags, "tailscale up" now only is allowed to change preferences if they're explicitly named in the flags. Otherwise it's an error. Or you need to use --reset to explicitly nuke everything. RELNOTE=tailscale up change Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	f5742b0647	ipn/ipnlocal: add LocalBackend.SetDirectFileRoot Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	4c3f7c06fc	ipn/ipnlocal: be consistent in not logging when no notify registered Some paths already didn't. And in the future I hope to shut all the notify funcs down end-to-end when nothing is connected (as in the common case in tailscaled). Then we can save some JSON encoding work. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	7c0e58c537	ipn/ipnlocal: remove redundant notify nil check send does it. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	00d641d9fc	ipn/localapi: move EditPrefs to localapi Follow-up/revision to recent `53cfff109b` which added EditPrefs. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	1a371b93be	util/dnsname: add FQDN type, use throughout codebase. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	3167e55ddf	ipn/{ipnlocal,localapi}, cmd/tailscale: add logout command Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	11127666b2	ipn/ipnlocal: fix deadlock from `227f73284` Sigh. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	227f73284f	ipn/ipnlocal: eagerly announce peerapi service(s) on change We were previously only doing it as a side effect of the port poller, which doesn't run on e.g. iOS. Updates tailscale/corp#1559	5 years ago
Brad Fitzpatrick	fe23506471	ipn/ipnlocal: avoid unneeded initPeerAPIListener work if no changes Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	20e7646b8d	ipn/ipnlocal: always set Notify.FilesWaiting, set IncomingFiles non-nil when empty	5 years ago
Brad Fitzpatrick	6d01d3bece	ipn/ipnlocal: provide IPN bus updates as files arrive Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	2f398106e2	ipn/ipnlocal: allow setting MagicDNS without DefaultResolvers. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	fad21af01c	tailcfg: add DNS routes and advanced resolver config. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	a9a3d3b4c1	ipn/ipnlocal: don't filter by time in FileTargets Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	71432c6449	ipn/ipnlocal: some more variable renames Missed in earlier commit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	e86b7752ef	ipn/ipnlocal: rename some variables to be consistent Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	da4cc8bbb4	net/dns: handle all possible translations of high-level DNS config. With this change, all OSes can sort-of do split DNS, except that the default upstream is hardcoded to 8.8.8.8 pending further plumbing. Additionally, Windows 8-10 can do split DNS fully correctly, without the 8.8.8.8 hack. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	939861773d	net/tstun: accept peerapi connections through the filter Fixes tailscale/corp#1545 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	950fc28887	ipn, paths, cmd/tailscaled: remove LegacyConfigPath, relaynode migration It is time. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d581ee2536	ipn: remove Options.HTTPTestClient, move to LocalBackend Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	50b309c1eb	ipn/localapi, cmd/tailscale: add API to get prefs, CLI debug command to show Updates #1436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	799973a68d	ipn: move Options.Notify to its own method We already had SetNotifyCallback elsewhere on controlclient, so use that name. Baby steps towards some CLI refactor work. Updates tailscale/tailscale#1436	5 years ago
Brad Fitzpatrick	d488678fdc	cmd/tailscaled, wgengine{,/netstack}: add netstack hybrid mode, add to Windows For #707 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	1f99f889e1	ipn/{ipnlocal,localapi}: add localapi handler to dial/proxy file PUTs Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d717499ac4	ipn/localapi: add API for getting file targets Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	f89dc1c903	ipn/ipnlocal: don't install any magicdns names if not proxying. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	9b57cd53ba	ipn/ipnlocal: lazily connect to control, lazily generate machine key Fixes #1573 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d50406f185	ipn/ipnlocal: simplify loadStateLocked control flow a bit, restore logging The common Linux start-up path (fallback file defined but not existing) was missing the log print of initializing Prefs. The code was too twisty. Simplify a bit. Updates #1573 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	6ad44f9fdf	wgengine: take in dns.Config, split out to resolver.Config and dns.OSConfig. Stepping stone towards having the DNS package handle the config splitting. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	8af9d770cf	net/dns: rename Config to OSConfig. Making way for a new higher level config struct. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	cf361bb9b1	net/dns: remove PerDomain from Config. It's currently unused, and no longer makes sense with the upcoming DNS infrastructure. Keep it in tailcfg for now, since we need protocol compat for a bit longer. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	6266cf8e36	ipn/ipnlocal: fix peerapi6 port being report as 0 in netstack mode Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	90f82b6946	net/dns/resolver: add live reconfig, plumb through to ipnlocal. The resolver still only supports a single upstream config, and ipn/wgengine still have to split up the DNS config, but this moves closer to unifying the DNS configs. As a handy side-effect of the refactor, IPv6 MagicDNS records exist now. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	d99f5b1596	net/dns/resolver: factor the resolver out into a sub-package. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	53cfff109b	ipn: replace SetWantRunning(bool) with EditPrefs(MaskedPrefs) This adds a new ipn.MaskedPrefs embedding a ipn.Prefs, along with a bunch of "has bits", kept in sync with tests & reflect. Then it adds a Prefs.ApplyEdits(MaskedPrefs) method. Then the ipn.Backend interface loses its weirdo SetWantRunning(bool) method (that I added in `483141094c` for "tailscale down") and replaces it with EditPrefs (alongside the existing SetPrefs for now). Then updates 'tailscale down' to use EditPrefs instead of SetWantRunning. In the future, we can use this to do more interesting things with the CLI, reconfiguring only certain properties without the reset-the-world "tailscale up". Updates #1436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	4ed6b62c7a	ipn/ipnlocal: refactor to unindent a bit Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	1f583a895e	ipn/ipnlocal: stop sending machine key to frontends We were going to remove this in Tailscale 1.3 but forgot. This means Tailscale 1.8 users won't be able to downgrade to Tailscale 1.0, but that's fine. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	c3bee0b722	ipn/ipnlocal: make peerapi work on iOS again It didn't have a storage directory. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	1bd14a072c	cmd/tailscale, ipn/localapi: move IP forwarding check to tailscaled, API Instead of having the CLI check whether IP forwarding is enabled, ask tailscaled. It has a better idea. If it's netstack, for instance, the sysctl values don't matter. And it's possible that only the daemon has permission to know. Fixes #1626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a998fe7c3d	control/controlclient: support lazy machine key generation It's not done in the caller yet, but the controlclient does it now. Updates #1573 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	cf2beafbcd	ipn/ipnlocal: on Windows peerapi bind failures, try again on link change Updates #1620 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	6d1a9017c9	ipn/{ipnlocal,localapi}, client/tailscale: add file get/delete APIs Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	672b9fd4bd	ipn{,/ipnlocal}: set new Notify.FilesWaiting when server has file(s) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	f01091babe	ipn/ipnlocal: make peerapi work in netstack mode Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	41e4e02e57	net/{packet,tstun}: send peerapi port in TSMP pongs For discovery when an explicit hostname/IP is known. We'll still also send it via control for finding peers by a list. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	9659ab81e0	ipn/ipnlocal: send peerapi port(s) in Hostinfo.Services Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	35596ae5ce	ipn/ipnlocal: push down a user-specific root dir to peerapi handler And add a put handler. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	f26dfd054a	ipn/ipnlocal: rename/document peerapi stuff a bit, pass self identity So handlers can vary based on whether owner of peer matches owner of local node. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	1642dfdb07	ipn/ipnlocal: get peerapi ~working in macOS/iOS NetworkExtension sandbox IPv4 and IPv6 both work remotely, but IPv6 doesn't yet work from the machine itself due to routing mysteries. Untested yet on iOS, but previous prototype worked on iOS, so should work the same. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	5a62aa8047	ipn/ipnlocal: pass down interface state to peerapi ListenConfig hook Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	9f7f2af008	wgengine/router/dns: move to net/dns. Preparation for merging the APIs and whatnot. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	8432999835	Move wgengine/tsdns to net/dns. Straight move+fixup, no other changes. In prep for merging with wgengine/router/dns. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	81143b6d9a	ipn/ipnlocal: start of peerapi between nodes Also some necessary refactoring of the ipn/ipnstate too. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	2384c112c9	net/packet, wgengine/{filter,tstun}: add TSMP ping Fixes #1467 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	8c0a0450d9	ipn/ipnlocal: allow client access to exit node's public IPs. "public IP" is defined as an IP address configured on the exit node itself that isn't in the list of forbidden ranges (RFC1918, CGNAT, Tailscale). Fixes #1522. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	0a02aaf813	control, ipn, tailcfg: remove golang.org/x/oauth2 dep, add tailcfg.Oauth2Token golang.org/x/oauth2 pulls in App Engine and grpc module dependencies, screwing up builds that depend on this module. Some background on the problem: https://go.googlesource.com/proposal/+/master/design/36460-lazy-module-loading.md Fixes tailscale/corp#1471 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	439d70dce2	cmd/tailscale, ipn/localapi: get daemon version from localapi status Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	d0dffe33c0	cmd/tailscale, ipn/localapi: use localapi for status, not IPN acrobatics Yay simpler code. Tested on Linux, macOS and Windows. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	9eb65601ef	health, ipn/ipnlocal: track, log overall health Updates #1505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	ba8c6d0775	health, controlclient, ipn, magicsock: tell health package state of things Not yet checking anything. Just plumbing states into the health package. Updates #1505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Naman Sood	770aa71ffb	client, cmd/hello, ipn, wgengine: fix whois for netstack-forwarded connections Updates #504 Updates #707 Signed-off-by: Naman Sood <mail@nsood.in>	5 years ago
David Crawshaw	bdb91a20eb	ipnstate, ipnlocal: add AuthURL to status Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
David Anderson	d79a2f3809	wgengine/filter: only log packets to/from non-default routes. Fixes tailscale/corp#1429. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	affd859121	ipn/ipnlocal, control/controlclient: propagate link monitor to controlclient Don't use it yet, but get it down there. Updates #1455 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	82edf94df7	ipn/ipnlocal: make IPv6 OS routes be a single /48 for our ULA space And if we have over 10,000 CGNAT routes, just route the entire CGNAT range. (for the hello test server) Fixes #1450 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	625c413508	ipn/ipnlocal: fix another regression from link monitoring refactor Prior to `e3df29d488`, the Engine.SetLinkChangeCallback fired immediately, even if there was no change. The ipnlocal code apparently depended on that, and it broke integration tests (which live in another repo). So mimic the old behavior and call the ipnlocal callback immediately at init. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	f647e3daaf	ipn/ipnlocal: transform default routes into "all but LAN" routes. Fixes #1177. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	e3df29d488	wgengine{,/monitor}: move interface state fetching/comparing to monitor Gets it out of wgengine so the Engine isn't responsible for being a callback registration hub for it. This also removes the Engine.LinkChange method, as it's no longer necessary. The monitor tells us about changes; it doesn't seem to need any help. (Currently it was only used by Swift, but as of `14dc790137` we just do the same from Go) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	8ee1cb6156	ipn/ipnlocal: mark findExitNodeID as requiring mutex. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	2404c0ffad	ipn/ipnlocal: only filter out default routes when computing the local wg config. UIs need to see the full unedited netmap in order to know what exit nodes they can offer to the user. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	b83c273737	wgengine/filter: use IPSet for localNets instead of prefixes. Part of #1177, preparing for doing fancier set operations on the allowed local nets. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	e86b39b73f	ipn/ipnlocal: don't short-circuit default route filtering. If no exit node is specified, the filter must still run to remove offered default routes from all peers. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	1e7a35b225	types/netmap: split controlclient.NetworkMap off into its own leaf package Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	ddfcc4326c	types/persist: split controlclient.Persist into a small leaf package This one alone doesn't modify the global dependency map much (depaware.txt if anything looks slightly worse), but it leave controlclient as only containing NetworkMap: bradfitz@tsdev:~/src/tailscale.com/ipn$ grep -F "controlclient." .go backend.go: NetMap controlclient.NetworkMap // new netmap received fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) handle.go: netmapCache controlclient.NetworkMap handle.go:func (h Handle) NetMap() *controlclient.NetworkMap { Once that goes into a leaf package, then ipn doesn't depend on controlclient at all, and then the client gets smaller. Updates #1278	5 years ago
David Anderson	a046b48593	cmd/tailscale/cli: display currently active exit node in `tailscale status`. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	6064b6ff47	wgengine/wgcfg/nmcfg: split control/controlclient/netmap.go into own package It couldn't move to ipnlocal due to test dependency cycles. Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	b9c2231fdf	ipn: program exit node into the data plane according to user pref. Part of #1153, #1154. Fixes #1224. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	d76334d2f0	ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago

... 4 5 6 7 8 ...

532 Commits (bdd9eeca901b83c4cd9e0e7a7878cb37853d47b5)