tailscale

Commit Graph

Author	SHA1	Message	Date
Dmytro Shynkevych	28e52a0492	all: dns refactor, add Proxied and PerDomain flags from control (#615 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	915f65ddae	wgengine/magicsock: stop disco activity on IPN stop Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	f8e4c75f6b	wgengine/magicsock: check slightly less aggressively for connectivity. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	41d0c81859	wgengine/magicsock: make disco subtest name more precise. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9beea8b314	wgengine/magicsock: remove unnecessary use of context. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b62341d308	wgengine/magicsock: add docstring. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9265296b33	wgengine/magicsock: don't deadlock on shutdown if sending blocks. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0249236cc0	ipn/ipnstate: record assigned Tailscale IPs. wgengine/magicsock: use ipnstate to find assigned Tailscale IPs. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c3958898f1	tstest/natlab: be a bit more lenient during test shutdown. There is a race in natlab where we might start shutdown while natlab is still running a goroutine or two to deliver packets. This adds a small grace period to try and receive it before continuing shutdown. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7578c815be	wgengine/magicsock: give pinger a more generous packet timeout. The first packet to transit may take several seconds to do so, because setup rates in wgengine may result in the initial WireGuard handshake init to get dropped. So, we have to wait at least long enough for a retransmit to correct the fault. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c3994fd77c	derp: remove OnlyDisco option. Active discovery lets us introspect the state of the network stack precisely enough that it's unnecessary, and dropping the initial DERP packets greatly slows down tests. Additionally, it's unrealistic since our production network will never deliver _only_ discovery packets, it'll be all or nothing. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	5455c64f1d	wgengine/magicsock: add a test for two facing endpoint-independent NATs. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f794493b4f	wgengine/magicsock: explicitly check path discovery, add a firewall test. The test proves that active discovery can traverse two facing firewalls. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f582eeabd1	wgengine/magicsock: add a test for active path discovery. Uses natlab only, because the point of this active discovery test is going to be that it should get through a lot of obstacles. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	fe68841dc7	wgengine/magicsock: log better with less spam on transition to stopped state Required a minor test update too, which now needs a private key to get far enough to test the thing being tested.	4 years ago
David Anderson	3669296cef	wgengine/magicsock: refactor twoDevicePing to make stack construction cleaner. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	16a9cfe2f4	wgengine: configure wireguard peers lazily, as needed wireguard-go uses 3 goroutines per peer (with reasonably large stacks & buffers). Rather than tell wireguard-go about all our peers, only tell it about peers we're actively communicating with. That means we need hooks into magicsock's packet receiving path and tstun's packet sending path to lazily create a wireguard peer on demand from the network map. This frees up lots of memory for iOS (where we have almost nothing left for larger domains with many users). We should ideally do this in wireguard-go itself one day, but that'd be a pretty big change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a6559a8924	wgengine/magicsock: run test DERP in mode where only disco packets allowed So we don't accidentally pass a NAT traversal test by having DERP pick up our slack when we really just wanted DERP as an OOB messaging channel.	4 years ago
David Anderson	45578b47f3	tstest/natlab: refactor PacketHandler into a larger interface. The new interface lets implementors more precisely distinguish local traffic from forwarded traffic, and applies different forwarding logic within Machines for each type. This allows Machines to be packet forwarders, which didn't quite work with the implementation of Inject. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	88e8456e9b	wgengine/magicsock: add a connectivity test for facing firewalls. The test demonstrates that magicsock can traverse two stateful firewalls facing each other, that each require localhost to initiate connections. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1f7b1a4c6c	wgengine/magicsock: rearrange TwoDevicePing test for future natlab tests. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	977381f9cc	wgengine/magicsock: make trivial natlab test pass. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	6c74065053	wgengine/magicsock, tstest/natlab: start hooking up natlab to magicsock Also adds ephemeral port support to natlab. Work in progress. Pairing with @danderson.	4 years ago
Brad Fitzpatrick	6196b7e658	wgengine/magicsock: change API to not permit disco key changes Generate the disco key ourselves and give out the public half instead. Fixes #525	4 years ago
Brad Fitzpatrick	5132edacf7	wgengine/magicsock: fix data race from undocumented wireguard-go requirement Endpoints need to be Stringers apparently. Fixes tailscale/corp#422	4 years ago
Brad Fitzpatrick	77e89c4a72	wgengine/magicsock: handle CallMeMaybe discovery mesages Roughly feature complete now. Testing and polish remains. Updates #483	4 years ago
Brad Fitzpatrick	2d6e84e19e	net/netcheck, wgengine/magicsock: replace more UDPAddr with netaddr.IPPort	4 years ago
Brad Fitzpatrick	e96f22e560	wgengine/magicsock: start handling disco message, use netaddr.IPPort more Updates #483	4 years ago
Brad Fitzpatrick	a83ca9e734	wgengine/magicsock: cache precomputed nacl/box shared keys Updates #483	4 years ago
Brad Fitzpatrick	a975e86bb8	wgengine/magicsock: add new endpoint type used for discovery-supporting peers This adds a new magicsock endpoint type only used when both sides support discovery (that is, are advertising a discovery key). Otherwise the old code is used. So far the new code only communicates over DERP as proof that the new code paths are wired up. None of the actually discovery messaging is implemented yet. Support for discovery (generating and advertising a key) are still behind an environment variable for now. Updates #483	4 years ago
Brad Fitzpatrick	103c06cc68	wgengine/magicsock: open discovery naclbox messages from known peers And track known peers. Doesn't yet do anything with the messages. (nor does it send any yet) Start of docs on the message format. More will come in subsequent changes. Updates #483	4 years ago
Dmytro Shynkevych	de5f6d70a8	magicsock: eliminate logging race in test Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	280e8884dd	wgengine/magicsock: limit redundant log spam on packets from low-pri addresses Fixes #407 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	becce82246	net/netns, misc tests: remove TestOnlySkipPrivilegedOps, argv checks The netns UID check is sufficient for now. We can do something else later if/when needed.	4 years ago
David Anderson	5114df415e	net/netns: set the bypass socket mark on linux. This allows tailscaled's own traffic to bypass Tailscale-managed routes, so that things like tailscale-provided default routes don't break tailscaled itself. Progress on #144. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	b0c10fa610	stun, netcheck: move under net	5 years ago
Brad Fitzpatrick	e6b84f2159	all: make client use server-provided DERP map, add DERP region support Instead of hard-coding the DERP map (except for cmd/tailscale netcheck for now), get it from the control server at runtime. And make the DERP map support multiple nodes per region with clients picking the first one that's available. (The server will balance the order presented to clients for load balancing) This deletes the stunner package, merging it into the netcheck package instead, to minimize all the config hooks that would've been required. Also fix some test flakes & races. Fixes #387 (Don't hard-code the DERP map) Updates #388 (Add DERP region support) Fixes #399 (wgengine: flaky tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	e8b3a5e7a1	wgengine/filter: implement a destination IP pre-filter. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	e6d0c92b1d	wgengine/magicsock: clean up earlier fix a bit Move WaitReady from `fc88e34f42` into the test code, and keep the derp-reading goroutine named for debugging.	5 years ago
Avery Pennarun	fc88e34f42	wgengine/magicsock/tests: wait for home DERP connection before sending packets. This fixes an elusive test flake. Fixes #161. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	4f128745d8	magicsock/test: oops, fix a data race in nested-test logf hack. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	42a0e0c601	wgengine/magicsock/tests: call tstest.ResourceCheck for each test. This didn't catch anything yet, but it's good practice for detecting goroutine leaks that we might not find otherwise. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	08acb502e5	Add tstest.PanicOnLog(), and fix various problems detected by this. If a test calls log.Printf, 'go test' horrifyingly rearranges the output to no longer be in chronological order, which makes debugging virtually impossible. Let's stop that from happening by making log.Printf panic if called from any module, no matter how deep, during tests. This required us to change the default error handler in at least one http.Server, as well as plumbing a bunch of logf functions around, especially in magicsock and wgengine, but also in logtail and backoff. To add insult to injury, 'go test' also rearranges the output when a parent test has multiple sub-tests (all the sub-test's t.Logf is always printed after all the parent tests t.Logf), so we need to screw around with a special Logf that can point at the "current" t (current_t.Logf) in some places. Probably our entire way of using subtests is wrong, since 'go test' would probably like to run them all in parallel if you called t.Parallel(), but it definitely can't because the're all manipulating the shared state created by the parent test. They should probably all be separate toplevel tests instead, with common setup/teardown logic. But that's a job for another time. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Dmytro Shynkevych	33b2f30cea	wgengine: wrap tun.Device to support filtering and packet injection (#358 ) Right now, filtering and packet injection in wgengine depend on a patch to wireguard-go that probably isn't suitable for upstreaming. This need not be the case: wireguard-go/tun.Device is an interface. For example, faketun.go implements it to mock a TUN device for testing. This patch implements the same interface to provide filtering and packet injection at the tunnel device level, at which point the wireguard-go patch should no longer be necessary. This patch has the following performance impact on i7-7500U @ 2.70GHz, tested in the following namespace configuration: ┌────────────────┐ ┌─────────────────────────────────┐ ┌────────────────┐ │ $ns1 │ │ $ns0 │ │ $ns2 │ │ client0 │ │ tailcontrol, logcatcher │ │ client1 │ │ ┌─────┐ │ │ ┌──────┐ ┌──────┐ │ │ ┌─────┐ │ │ │vethc│───────┼────┼──│vethrc│ │vethrs│──────┼─────┼──│veths│ │ │ ├─────┴─────┐ │ │ ├──────┴────┐ ├──────┴────┐ │ │ ├─────┴─────┐ │ │ │10.0.0.2/24│ │ │ │10.0.0.1/24│ │10.0.1.1/24│ │ │ │10.0.1.2/24│ │ │ └───────────┘ │ │ └───────────┘ └───────────┘ │ │ └───────────┘ │ └────────────────┘ └─────────────────────────────────┘ └────────────────┘ Before: --------------------------------------------------- \| TCP send \| UDP send \| \|------------------------\|------------------------\| \| 557.0 (±8.5) Mbits/sec \| 3.03 (±0.02) Gbits/sec \| --------------------------------------------------- After: --------------------------------------------------- \| TCP send \| UDP send \| \|------------------------\|------------------------\| \| 544.8 (±1.6) Mbits/sec \| 3.13 (±0.02) Gbits/sec \| --------------------------------------------------- The impact on receive performance is similar. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Brad Fitzpatrick	577f321c38	wgengine/magicsock: revise derp fallback logic Revision to earlier `6284454ae5` Don't be sticky if we have no peers. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	e085aec8ef	all: update to wireguard-go API changes Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	b9c6d3ceb8	netcheck: work behind UDP-blocked networks again, add tests Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	b0f8931d26	wgengine/magicsock: make a test signature a bit more explicit	5 years ago
Brad Fitzpatrick	01b4bec33f	stunner: re-do how Stunner works It used to make assumptions based on having Anycast IPs that are super near. Now we're intentionally going to a bunch of different distant IPs to measure latency. Also, optimize how the hairpin detection works. No need to STUN on that socket. Just use that separate socket for sending, once we know the other UDP4 socket's endpoint. The trick is: make our test probe also a STUN packet, so it fits through magicsock's existing STUN routing. This drops netcheck from ~5 seconds to ~250-500ms. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	77af7e5436	wgengine/magicsock: mark test logfunc as a helper. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago

1 2

74 Commits (c3467fbadb7e2f28c3f786dfabdc13c173e62055)