150 Commits (c0cdca6d0668ac22911c9db12b0524d5efd50a4e)

Author	SHA1	Message	Date
David Anderson	f647e3daaf	ipn/ipnlocal: transform default routes into "all but LAN" routes. ... Fixes #1177. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	9df4185c94	control/controlclient, net/{dnscache,dnsfallback}: add DNS fallback mechanism ... Updates #1405 Updates #1403 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	38dc6fe758	cmd/tailscaled, wgengine: remove --fake, replace with netstack ... And add a --socks5-server flag. And fix a race in SOCKS5 replies where the response header was written concurrently with the copy from the backend. Co-authored with Naman Sood. Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	fe16ef6812	net/socks5: create SOCKS5 package for proxy server in userspace networking ... Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Brad Fitzpatrick	000b80de9d	net/interfaces: go idle on macOS when wifi/etc is down, ignore utun* interfaces ... Updates tailscale/corp#1289 Updates tailscale/corp#1367 Updates tailscale/corp#1378 Updates tailscale/felicity#4	4 years ago
Brad Fitzpatrick	c64bd587ae	net/portmapper: add NAT-PMP client, move port mapping service probing ... * move probing out of netcheck into new net/portmapper package * use PCP ANNOUNCE op codes for PCP discovery, rather than causing short-lived (sub-second) side effects with a 1-second-expiring map + delete. * track when we heard things from the router so we can be less wasteful in querying the router's port mapping services in the future * use portmapper from magicsock to map a public port Fixes #1298 Fixes #1080 Fixes #1001 Updates #864 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6a2c6541da	net/tshttpproxy: support HTTP proxy environment credentials on Windows too ... and some minor style nits. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	3e5c3e932c	net/tshttpproxy: support basic auth when available (#1354) ... This allows proxy URLs such as: http://azurediamond:hunter2@192.168.122.154:38274 to be used in order to dial out to control, logs or derp servers. Signed-off-by: Christine Dodrill <xe@tailscale.com>	4 years ago
Brad Fitzpatrick	f4ae745b0b	net/{interfaces,netns}: add some new tests, missed from prior commit ... I meant for these to be part of 52e24aa966.	4 years ago
Brad Fitzpatrick	e923639feb	net/interfaces: fix staticcheck error on darwin	4 years ago
Brad Fitzpatrick	52e24aa966	net/{interfaces,ns}: add tailscaled-mode darwin routing looping prevention ... Fixes #1331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	20e66c5b92	net/interfaces: reconcile interface filtering with address printing in logs ... The interface.State logging tried to only log interfaces which had interesting IPs, but the what-is-interesting checks differed between the code that gathered the interface names to print and the printing of their addresses.	4 years ago
Josh Bleecher Snyder	138055dd70	tstest/natlab: use net.ErrClosed instead of a new error ... Upstream wireguard-go decided to use errors.Is(err, net.ErrClosed) instead of checking the error string. It also provided an unsafe linknamed version of net.ErrClosed for clients running Go 1.15. Switch to that. This reduces the time required for the wgengine/magicsock tests on my machine from ~35s back to the ~13s it was before 456cf8a376. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	d37058af72	net/packet: add some more TSMP packet reject reasons and MaybeBroken bit ... Unused for now, but I want to backport this commit to 1.4 so 1.6 can start sending these and then at least 1.4 logs will stringify nicely. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Crawshaw	d139fa9c92	net/interfaces: use a uint32_t for ipv4 address ... The code was using a C "int", which is a signed 32-bit integer. That means some valid IP addresses were negative numbers. (In particular, the default router address handed out by AT&T fiber: 192.168.1.254. No I don't know why they do that.) A negative number is < 255, and so was treated by the Go code as an error. This fixes the unit test failure: $ go test -v -run=TestLikelyHomeRouterIPSyscallExec ./net/interfaces === RUN TestLikelyHomeRouterIPSyscallExec interfaces_darwin_cgo_test.go:15: syscall() = invalid IP, false, netstat = 192.168.1.254, true --- FAIL: TestLikelyHomeRouterIPSyscallExec (0.00s) Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Brad Fitzpatrick	35e10c78fc	net/interfaces: don't send over zt* interfaces ... Fixes #1208 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	692a011b54	net/interfaces: remove IsTailscaleIP, make callers use tsaddr. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	7c1a9e8616	net/nettest: de-flake tests on Windows ... Windows has a low resolution timer. Some of the tests assumed that unblock takes effect immediately. Consider: t := time.Now() elapsed := time.Now().After(t) It seems plausible that elapsed should always be true. However, with a low resolution timer, that might fail. Change time.Now().After to !time.Now().Before, so that unblocking always takes effect immediately. Fixes #873.	4 years ago
Josh Bleecher Snyder	a64d06f15c	net/nettest: remove pointless checks in tests ... If err == nil, then !errors.Is(err, anything).	4 years ago
Josh Bleecher Snyder	503db5540f	net/nettest: add missing check at end of TestLimit ... This appears to have been an oversight.	4 years ago
Brad Fitzpatrick	b560386c1a	net/packet, wgengine, tstun: add inter-node TSMP protocol for connect errors ... This adds a new IP Protocol type, TSMP on protocol number 99 for sending inter-tailscale messages over WireGuard, currently just for why a peer rejects TCP SYNs (ACL rejection, shields up, and in the future: nothing listening, something listening on that port but wrong interface, etc) Updates #1094 Updates tailscale/corp#1185 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Denton Gentry	ac42757cd7	netcheck: use reflect in sortRegions test. ... Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Denton Gentry	43e060b0e5	netcheck: test sortRegions ... Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Brad Fitzpatrick	5eeaea9ef9	net/packet: add TCPFlag type and some more constants ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ad3fb6125d	net/flowtrack: add Tuple.String method ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	676b5b7946	net/netcheck: improve the preferred DERP hysteresis ... Users in Amsterdam (as one example) were flipping back and forth between equidistant London & Frankfurt relays too much. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4d15e954bd	net/flowtrack: add new package to specialize groupcache/lru key type ... Reduces allocs. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	66be052a70	net/dnscache: work on IPv6-only hosts (again) ... This fixes the regression where we had stopped working on IPv6-only hosts. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	1e88050403	net/tsaddr: add ChromeOS contains tests ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	cb96b14bf4	net/packet: remove the custom IP4/IP6 types in favor of netaddr.IP. ... Upstream netaddr has a change that makes it alloc-free, so it's safe to use in hot codepaths. This gets rid of one of the many IP types in our codebase. Performance is currently worse across the board. This is likely due in part to netaddr.IP being a larger value type (4b -> 24b for IPv4, 16b -> 24b for IPv6), and in other part due to missing low-hanging fruit optimizations in netaddr. However, the regression is less bad than it looks at first glance, because we'd micro-optimized packet.IP* in the past few weeks. This change drops us back to roughly where we were at the 1.2 release, but with the benefit of a significant code and architectural simplification. name old time/op new time/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 12.2ns ± 5% 29.7ns ± 2% +142.32% (p=0.008 n=5+5) Decode/tcp6-8 12.6ns ± 3% 65.1ns ± 2% +418.47% (p=0.008 n=5+5) Decode/udp4-8 11.8ns ± 3% 30.5ns ± 2% +157.94% (p=0.008 n=5+5) Decode/udp6-8 27.1ns ± 1% 65.7ns ± 2% +142.36% (p=0.016 n=4+5) Decode/icmp4-8 24.6ns ± 2% 30.5ns ± 2% +23.65% (p=0.016 n=4+5) Decode/icmp6-8 22.9ns ±51% 65.5ns ± 2% +186.19% (p=0.008 n=5+5) Decode/igmp-8 18.1ns ±44% 30.2ns ± 1% +66.89% (p=0.008 n=5+5) Decode/unknown-8 20.8ns ± 1% 10.6ns ± 9% -49.11% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 30.5ns ± 1% 77.9ns ± 3% +155.01% (p=0.008 n=5+5) Filter/tcp4_syn_in-8 43.7ns ± 3% 123.0ns ± 3% +181.72% (p=0.008 n=5+5) Filter/tcp4_syn_out-8 24.5ns ± 2% 45.7ns ± 6% +86.22% (p=0.008 n=5+5) Filter/udp4_in-8 64.8ns ± 1% 210.0ns ± 2% +223.87% (p=0.008 n=5+5) Filter/udp4_out-8 119ns ± 0% 278ns ± 0% +133.78% (p=0.016 n=4+5) Filter/icmp6-8 40.3ns ± 2% 204.4ns ± 4% +407.70% (p=0.008 n=5+5) Filter/tcp6_syn_in-8 35.3ns ± 3% 199.2ns ± 2% +464.95% (p=0.008 n=5+5) Filter/tcp6_syn_out-8 32.8ns ± 2% 81.0ns ± 2% +147.10% (p=0.008 n=5+5) Filter/udp6_in-8 106ns ± 2% 290ns ± 2% +174.48% (p=0.008 n=5+5) Filter/udp6_out-8 184ns ± 2% 314ns ± 3% +70.43% (p=0.016 n=4+5) pkg:tailscale.com/wgengine/tstun goos:linux goarch:amd64 Write-8 9.02ns ± 3% 8.92ns ± 1% ~ (p=0.421 n=5+5) name old alloc/op new alloc/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00B 0.00B ~ (all equal) Decode/tcp6-8 0.00B 0.00B ~ (all equal) Decode/udp4-8 0.00B 0.00B ~ (all equal) Decode/udp6-8 0.00B 0.00B ~ (all equal) Decode/icmp4-8 0.00B 0.00B ~ (all equal) Decode/icmp6-8 0.00B 0.00B ~ (all equal) Decode/igmp-8 0.00B 0.00B ~ (all equal) Decode/unknown-8 0.00B 0.00B ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp4_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp4_in-8 0.00B 0.00B ~ (all equal) Filter/udp4_out-8 16.0B ± 0% 64.0B ± 0% +300.00% (p=0.008 n=5+5) Filter/icmp6-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_in-8 0.00B 0.00B ~ (all equal) Filter/tcp6_syn_out-8 0.00B 0.00B ~ (all equal) Filter/udp6_in-8 0.00B 0.00B ~ (all equal) Filter/udp6_out-8 48.0B ± 0% 64.0B ± 0% +33.33% (p=0.008 n=5+5) name old allocs/op new allocs/op delta pkg:tailscale.com/net/packet goos:linux goarch:amd64 Decode/tcp4-8 0.00 0.00 ~ (all equal) Decode/tcp6-8 0.00 0.00 ~ (all equal) Decode/udp4-8 0.00 0.00 ~ (all equal) Decode/udp6-8 0.00 0.00 ~ (all equal) Decode/icmp4-8 0.00 0.00 ~ (all equal) Decode/icmp6-8 0.00 0.00 ~ (all equal) Decode/igmp-8 0.00 0.00 ~ (all equal) Decode/unknown-8 0.00 0.00 ~ (all equal) pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64 Filter/icmp4-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp4_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp4_in-8 0.00 0.00 ~ (all equal) Filter/udp4_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Filter/icmp6-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_in-8 0.00 0.00 ~ (all equal) Filter/tcp6_syn_out-8 0.00 0.00 ~ (all equal) Filter/udp6_in-8 0.00 0.00 ~ (all equal) Filter/udp6_out-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	d0baece5fa	go.mod: bump inet.af/netaddr to non-allocating version	4 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints ... Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	baa7937998	net/interfaces: return IPv6 addresses from LocalAddresses. ... In practice, we already provide IPv6 endpoint addresses via netcheck, and that address is likely to match a local address anyway (i.e. no NAT66). The comment at that piece of the code mentions needing to figure out a good priority ordering, but that only applies to non-active-discovery clients, who already don't do anything with IPv6 addresses. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	aa353b8d0f	net/packet: add an IP6 constructor from a raw byte array. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	a6cad71fb2	go.mod: upgrade staticcheck to 0.1.0 ... Also run go.mod and fix some staticcheck warnings. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	08f94b3b50	net/netcheck: fix offset of unspecified address in PCP request packet ... Fixes #810	4 years ago
Brad Fitzpatrick	05e5233e07	net/netcheck: don't send flood of PCP unmap requests to router ... Updates #810	4 years ago
Josh Bleecher Snyder	1ebbaaaebb	net/interfaces: make syscall and netstat agree when multiple gateways are present ... likelyHomeRouterIPDarwinSyscall iterates through the list of routes, looking for a private gateway, returning the first one it finds. likelyHomeRouterIPDarwinExec does the same thing, except that it returns the last one it finds. As a result, when there are multiple gateways, TestLikelyHomeRouterIPSyscallExec fails. (At least, I think that that is what is happening; I am going inferring from observed behavior.) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	5d96ecd5e6	net/netstat: remove a bit more unsafe ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	3c508a58cc	wgengine/filter: don't filter GCP DNS. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	7a01cd27ca	net/netstat: remove some unsafe ... Just removing any unnecessary unsafe while auditing unsafe usage for #921.	4 years ago
Brad Fitzpatrick	45d96788b5	net/netns: remove use of unsafe on Windows ... Found while auditing unsafe for #921 via the list at: https://github.com/tailscale/tailscale/issues/921#issuecomment-727365383 No need for unsafe here, so remove it.	4 years ago
Josh Bleecher Snyder	b0526e8284	net/packet: remove unnecessary mark ... There's no need to mask out the bottom four bits of b[0] if we are about to shift them away.	4 years ago
Josh Bleecher Snyder	efad55cf86	net/packet: speed up packet decoding ... The compiler is failing to draw the connection between slice cap and slice len, so is missing some obvious BCE opportunities. Give it a hint by making the cap equal to the length. The generated code is smaller and cleaner, and a bit faster. name old time/op new time/op delta Decode/tcp4-8 12.2ns ± 1% 11.6ns ± 3% -5.31% (p=0.000 n=28+29) Decode/tcp6-8 12.5ns ± 2% 11.9ns ± 2% -4.84% (p=0.000 n=30+30) Decode/udp4-8 11.5ns ± 1% 11.1ns ± 1% -3.11% (p=0.000 n=25+24) Decode/udp6-8 11.8ns ± 3% 11.4ns ± 1% -3.08% (p=0.000 n=30+26) Decode/icmp4-8 11.0ns ± 3% 10.6ns ± 1% -3.38% (p=0.000 n=25+30) Decode/icmp6-8 11.4ns ± 1% 11.1ns ± 2% -2.29% (p=0.000 n=27+30) Decode/igmp-8 10.3ns ± 0% 10.0ns ± 1% -3.26% (p=0.000 n=19+23) Decode/unknown-8 8.68ns ± 1% 8.38ns ± 1% -3.55% (p=0.000 n=28+29)	4 years ago
David Anderson	2d604b3791	net/packet: represent IP6 as two uint64s. ... For the operations we perform on these types (mostly net6.Contains), this encoding is much faster. Part of #19. name old time/op new time/op delta Filter/icmp4-8 27.5ns ± 1% 28.0ns ± 2% +1.89% (p=0.016 n=5+5) Filter/tcp4_syn_in-8 38.8ns ± 2% 38.3ns ± 1% -1.24% (p=0.024 n=5+5) Filter/tcp4_syn_out-8 27.6ns ±12% 24.6ns ± 1% ~ (p=0.063 n=5+5) Filter/udp4_in-8 71.5ns ± 5% 65.9ns ± 1% -7.94% (p=0.008 n=5+5) Filter/udp4_out-8 132ns ±13% 119ns ± 1% -10.29% (p=0.008 n=5+5) Filter/icmp6-8 169ns ±10% 54ns ± 1% -68.35% (p=0.008 n=5+5) Filter/tcp6_syn_in-8 149ns ± 6% 43ns ± 1% -71.11% (p=0.008 n=5+5) Filter/tcp6_syn_out-8 37.7ns ± 4% 24.3ns ± 3% -35.51% (p=0.008 n=5+5) Filter/udp6_in-8 179ns ± 5% 103ns ± 1% -42.75% (p=0.008 n=5+5) Filter/udp6_out-8 156ns ± 3% 191ns ± 1% +22.54% (p=0.008 n=5+5) Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	04ff3c91ee	wgengine/filter: add full IPv6 support. ... Part of #19. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	a2d78b4d3e	net/dnscache, control/controlclient: use DNS cache when dialing control ... Cache DNS results of earlier login.tailscale.com control dials, and use them for future dials if DNS is slow or broken. Fixes various issues with trickier setups with the domain's DNS server behind a subnet router. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	97e82c6cc0	net/netcheck: remove unused DNSCache from netcheck ... It's easy to add back later if/when the TODO is implemented.	4 years ago
Brad Fitzpatrick	19b0cfe89e	all: prepare for GOOS=ios in Go 1.16 ... Work with either way for now on iOS (darwin/arm64 vs ios/arm64). In February when Go 1.16 comes out we'll have a universal binary for darwin/arm64 (macOS) and will drop support for Go 1.15 and its darwin/amd64 meaning iOS. (it'll mean macOS). Context: * https://tip.golang.org/doc/go1.16#darwin * https://github.com/golang/go/issues/38485 * https://github.com/golang/go/issues/42100	4 years ago
David Anderson	a38e28da07	net/packet: documentation pass. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago