5594 Commits (c573bef0aa088d519f6fd4cde10f2b42fa221c39)

 

All Branches   

Search

Author	SHA1	Message	Date
Charlotte Brandhorst-Satzkorn	c573bef0aa	tailcfg,wgengine: add initial support for WireGuard only peers ... A peer can have IsWireGuardOnly, which means it will not support DERP or Disco, and it must have Endpoints filled in order to be usable. In the present implementation only the first Endpoint will be used as the bestAddr. Updates tailscale/corp#10351 Co-authored-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com> Co-authored-by: James Tucker <james@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
James Tucker	6cfcb3cae4	wgengine/magicsock: fix synchronization of endpoint disco fields ... Identified in review in #7821 endpoint.discoKey and endpoint.discoShort are often accessed without first taking endpoint.mu. The arrangement with endpoint.mu is inconvenient for a good number of those call-sites, so it is instead replaced with an atomic pointer to carry both pieces of disco info. This will also help with #7821 that wants to add explicit checks/guards to disable disco behaviors when disco keys are missing which is necessarily implicitly mostly covered by this change. Updates #7821 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Mihai Parparita	e978299bf0	net/sockstats: disable deltas for the cell radio power state metric ... Updates tailscale/corp#9230 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Will Norris	22680a11ae	net/sockstats: return early if no radio period length ... Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Will Norris	75784e10e2	sockstats: add client metrics for radio power state ... power state is very roughly approximated based on observed network activity and AT&T's state transition timings for a typical 3G radio. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Tom DNetto	6a627e5a33	net, wgengine/capture: encode NAT addresses in pcap stream ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
License Updater	92459a9248	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	2 years ago
License Updater	7012bf7981	licenses: update tailscale{,d} licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
License Updater	07b29f13dc	licenses: update android licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Mihai Parparita	f49b9f75b8	util/clientmetric: allow client metric values to be provided by a function ... Adds NewGaugeFunc and NewCounterFunc (inspired by expvar.Func) which change the current value to be reported by a function. This allows some client metric values to be computed on-demand during uploading (at most every 15 seconds), instead of being continuously updated. clientmetric uploading had a bunch of micro-optimizations for memory access (#3331) which are not possible with this approach. However, any performance hit from function-based metrics is contained to those metrics only, and we expect to have very few. Also adds a DisableDeltas() option for client metrics, so that absolute values are always reported. This makes server-side processing of some metrics easier to reason about. Updates tailscale/corp#9230 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
phirework	c0e0a5458f	cmd/tailscale: show reauth etc. links even if no login name (#7803) ... Signed-off-by: Jenny Zhang <jz@tailscale.com>	2 years ago
shayne	81fd00a6b7	cmd/tailscale/cli: [serve] add support for proxy paths (#7800)	2 years ago
Maisem Ali	d42d570066	ssh/tailssh: handle output matching better in tests (#7799)	2 years ago
Brad Fitzpatrick	2c0bda6e2e	ssh/tailssh: make Tailscale SSH work on gokrazy ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Flakes Updater	3d29da105c	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply@tailscale.com>	2 years ago
Jordan Whited	765d3253f3	go.mod: bump wireguard-go (#7792) ... Pull in TUN checksum optimizations and crypto channel changes. Updates tailscale/corp#8734 Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
shayne	ba4e58f429	cmd/tailscale/cli: do not allow turning Funnel on while shields-up (#7770)	2 years ago
valscale	7bfb7744b7	derp,magicsock: add debug envknobs for HTTP and derp server name (#7744) ... Make developing derp easier by: 1. Creating an envknob telling clients to use HTTP to connect to derp servers, so devs don't have to acquire a valid TLS cert. 2. Creating an envknob telling clients which derp server to connect to, so devs don't have to edit the ACLs in the admin console to add a custom DERP map. 3. Explaining how the -dev and -a command lines args to derper interact. To use this: 1. Run derper with -dev. 2. Run tailscaled with TS_DEBUG_USE_DERP_HTTP=1 and TS_DEBUG_USE_DERP_ADDR=localhost This will result in the client connecting to derp via HTTP on port 3340. Fixes #7700 Signed-off-by: Val <valerie@tailscale.com>	2 years ago
Jordan Whited	f475e5550c	net/neterror, wgengine/magicsock: use UDP GSO and GRO on Linux (#7791) ... This commit implements UDP offloading for Linux. GSO size is passed to and from the kernel via socket control messages. Support is probed at runtime. UDP GSO is dependent on checksum offload support on the egress netdev. UDP GSO will be disabled in the event sendmmsg() returns EIO, which is a strong signal that the egress netdev does not support checksum offload. Updates tailscale/corp#8734 Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
David Anderson	45138fcfba	go.toolchain.rev: update for go 1.20.3 ... Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
James Tucker	b0ed863d55	atomicfile: use /tmp for socket path on macOS ... macOS does not allow unix socket creation in private temp directories, but global /tmp is ok, so swap out for global temp for now. Updates #7658 Updates #7785 Signed-off-by: James Tucker <jftucker@gmail.com>	2 years ago
David Anderson	4d1b3bc26f	net/art: implement the stride table building block of ART ... A stride table is an 8-bit routing table implemented as an array binary tree, with a special tree updating function (allot) that enables lightning fast address lookups and reasonably fast insertion and deletion. Insertion, deletion and lookup are all allocation-free. Updates #7781 │ sec/op │ StrideTableInsertion/10/random_order 16.79n ± 2% StrideTableInsertion/10/largest_first 16.83n ± 1% StrideTableInsertion/10/smallest_first 16.83n ± 0% StrideTableInsertion/50/random_order 17.84n ± 1% StrideTableInsertion/50/largest_first 20.04n ± 1% StrideTableInsertion/50/smallest_first 16.39n ± 0% StrideTableInsertion/100/random_order 14.63n ± 0% StrideTableInsertion/100/largest_first 17.45n ± 4% StrideTableInsertion/100/smallest_first 12.98n ± 0% StrideTableInsertion/200/random_order 12.51n ± 4% StrideTableInsertion/200/largest_first 18.36n ± 3% StrideTableInsertion/200/smallest_first 9.609n ± 3% StrideTableDeletion/10/random_order 19.50n ± 1% StrideTableDeletion/10/largest_first 19.34n ± 0% StrideTableDeletion/10/smallest_first 19.43n ± 0% StrideTableDeletion/50/random_order 14.58n ± 1% StrideTableDeletion/50/largest_first 14.27n ± 2% StrideTableDeletion/50/smallest_first 15.51n ± 0% StrideTableDeletion/100/random_order 12.02n ± 3% StrideTableDeletion/100/largest_first 10.64n ± 0% StrideTableDeletion/100/smallest_first 13.21n ± 3% StrideTableDeletion/200/random_order 14.05n ± 4% StrideTableDeletion/200/largest_first 9.288n ± 5% StrideTableDeletion/200/smallest_first 18.51n ± 1% StrideTableGet 0.5010n ± 0% │ routes/s │ StrideTableInsertion/10/random_order 59.55M ± 2% StrideTableInsertion/10/largest_first 59.42M ± 1% StrideTableInsertion/10/smallest_first 59.43M ± 0% StrideTableInsertion/50/random_order 56.04M ± 1% StrideTableInsertion/50/largest_first 49.91M ± 1% StrideTableInsertion/50/smallest_first 61.00M ± 0% StrideTableInsertion/100/random_order 68.35M ± 0% StrideTableInsertion/100/largest_first 57.32M ± 3% StrideTableInsertion/100/smallest_first 77.06M ± 0% StrideTableInsertion/200/random_order 79.93M ± 4% StrideTableInsertion/200/largest_first 54.47M ± 3% StrideTableInsertion/200/smallest_first 104.1M ± 3% StrideTableDeletion/10/random_order 51.28M ± 1% StrideTableDeletion/10/largest_first 51.70M ± 0% StrideTableDeletion/10/smallest_first 51.48M ± 0% StrideTableDeletion/50/random_order 68.60M ± 1% StrideTableDeletion/50/largest_first 70.09M ± 2% StrideTableDeletion/50/smallest_first 64.45M ± 0% StrideTableDeletion/100/random_order 83.21M ± 3% StrideTableDeletion/100/largest_first 94.03M ± 0% StrideTableDeletion/100/smallest_first 75.69M ± 3% StrideTableDeletion/200/random_order 71.20M ± 5% StrideTableDeletion/200/largest_first 107.7M ± 5% StrideTableDeletion/200/smallest_first 54.02M ± 1% StrideTableGet 1.996G ± 0% Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Will Norris	6d5c3c1637	ipn: prefer allow/denylist terminology ... Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Will Norris	5a3da3cd7f	ipn: add sockstat logger to stable builds ... This makes the sockstat logger available on all builds, but only enables it by default for unstable. For stable builds, the logger must be explicitly enabled via C2N component logger. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Aaron Klotz	90fd04cbde	ipn/ipnlocal, util/winutil/policy: modify Windows profile migration to load legacy prefs from within tailscaled ... I realized that a lot of the problems that we're seeing around migration and LocalBackend state can be avoided if we drive Windows pref migration entirely from within tailscaled. By doing it this way, tailscaled can automatically perform the migration as soon as the connection with the client frontend is established. Since tailscaled is already running as LocalSystem, it already has access to the user's local AppData directory. The profile manager already knows which user is connected, so we simply need to resolve the user's prefs file and read it from there. Of course, to properly migrate this information we need to also check system policies. I moved a bunch of policy resolution code out of the GUI and into a new package in util/winutil/policy. Updates #7626 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Mihai Parparita	e3cb8cc88d	ipn/ipnlocal: automatically upload sockstats logs when the period ends ... Avoids needing a separate c2n call to get the logs uploaded. Updates tailscale/corp#9230 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Andrew Dunham	8d3acc9235	util/sysresources, magicsock: scale DERP buffer based on system memory ... This adds the util/sysresources package, which currently only contains a function to return the total memory size of the current system. Then, we modify magicsock to scale the number of buffered DERP messages based on the system's available memory, ensuring that we never use a value lower than the previous constant of 32. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib763c877de4d0d4ee88869078e7d512f6a3a148d	2 years ago
Tom DNetto	483109b8fc	client/tailscale: Fix NPE caused by erroneous close in error case ... Fixes https://github.com/tailscale/tailscale/issues/7572 When handling an error during `StreamDebugCapture`, the response body is closed, even though the response struct is always nil. Thanks to https://github.com/darkrain42 for debugging this!! Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
shayne	59879e5770	cmd/tailscale/cli: make serve and funnel visible in list (#7737)	2 years ago
Flakes Updater	1bf65e4760	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply@tailscale.com>	2 years ago
Mihai Parparita	38bbb30aaf	.github/workflows: remove tsconnect-pkg-publish.yml ... Moved to the corp repo with tailscale/corp#7990 Updates tailscale/corp#10165 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
James Tucker	f4da995940	atomicfile: reject overwriting irregular files ... The intent of atomicfile is to overwrite regular files. Most use cases that would overwrite irregular files, unix sockets, named pipes, devices, and so on are more than likely misuse, so disallow them. Fixes #7658 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Mihai Parparita	02582083d5	cmd/tsconnect: allow root directory to be passed in ... #7339 changed the root directory logic to find the ancestor of the cwd with a go.mod file. This works when running the the binary from this repo directly, but breaks when we're a dependency in another repo. Allow the directory to be passed in via a -rootdir flag (the repo that depends on it can then use `go list -m -f '{{.Dir}}' tailscale.com` or similar to pass in the value). Updates tailscale/corp#10165 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
James Tucker	40fa2a420c	envknob,net/tstun,wgengine: use TS_DEBUG_MTU consistently ... Noted on #5915 TS_DEBUG_MTU was not used consistently everywhere. Extract the default into a function that can apply this centrally and use it everywhere. Added envknob.Lookup{Int,Uint}Sized to make it easier to keep CodeQL happy when using converted values. Updates #5915 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Andrew Dunham	8ed4fd1dbc	envknob/logknob: add package for configurable logging ... A LogKnob allows enabling logs with an envknob, netmap capability, and manually, and calling a logging function when logs are enabled. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id66c608d4e488bfd4eaa5e867a8d9289686748be	2 years ago
Andrew Dunham	3b39ca9017	ipn/ipnlocal: update comment in SetComponentDebugLogging ... Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8c36a62079dce77fc81b9cdfb5fe723b007218ba	2 years ago
Maisem Ali	e0d291ab8a	ipn/store: add support for stores to hook into a custom dialer ... For stores like k8s secrets we need to dial out to the k8s API as though Tailscale wasn't running. The issue currently only manifests when you try to use an exit node while running inside a k8s cluster and are trying to use Kubernetes secrets as the backing store. This doesn't address cmd/containerboot, which I'll do in a follow up. Updates #7695 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
License Updater	2b00d6922f	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	2 years ago
License Updater	7b4e85aa78	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	2 years ago
Will Norris	e99c7c3ee5	sockstats: add labels for netlog and sockstatlog packages ... Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Andrew Dunham	38e4d303a2	net/tshttpproxy: don't proxy through ourselves ... When running a SOCKS or HTTP proxy, configure the tshttpproxy package to drop those addresses from any HTTP_PROXY or HTTPS_PROXY environment variables. Fixes #7407 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6cd7cad7a609c639780484bad521c7514841764b	2 years ago
Will Norris	62a1e9a44f	log/sockstatlog: add delay before writing logs to disk ... Split apart polling of sockstats and logging them to disk. Add a 3 second delay before writing logs to disk to prevent an infinite upload loop when uploading stats to logcatcher. Fixes #7719 Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Maisem Ali	985535aebc	net/tstun,wgengine/*: add support for NAT to routes ... This adds support to make exit nodes and subnet routers work when in scenarios where NAT is required. It also updates the NATConfig to be generated from a `wgcfg.Config` as that handles merging prefs with the netmap, so it has the required information about whether an exit node is already configured and whether routes are accepted. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	d1d5d52b2c	net/tstun/table: add initial RoutingTable implementation ... It is based on `*tempfork/device.AllowedIPs`. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	2522b0615f	tempfork/device: add a temp fork of golang.zx2c4.com/wireguard/device ... This will allow us to reuse the AllowedIPs for NAT decisions in a follow on commit. The files `allowedips_*.go` are as-is, `peer.go` only keeps the `Peer` declaration with a single element required for AllowedIPs. Upstream commit https://git.zx2c4.com/wireguard-go/commit/?id=052af4a8072bbbd3bfe7edf46fe3c1b350f71f08 Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	c98652c333	doctor/permissions: add new check to print process permissions ... Since users can run tailscaled in a variety of ways (root, non-root, non-root with process capabilities on Linux), this check will print the current process permissions to the log to aid in debugging. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ida93a206123f98271a0c664775d0baba98b330c7	2 years ago
License Updater	524f53de89	licenses: update tailscale{,d} licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
James Tucker	8c2b755b2e	tool/gocross: use grep -E over egrep to avoid warning ... Recent egrep builds produce a warning: ``` egrep: warning: egrep is obsolescent; using grep -E ``` Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
James Tucker	a31e43f760	go.mod: bump gvisor to 20230320 for dispatcher locking ... Upstream improved code around an issue showing up in CI, where sometimes shutdown will race on endpoint.dispatcher being nil'd, causing a panic down stack of injectInbound. The upstream patch makes some usage more safe, but it does not itself fix the local issue. See panic in https://github.com/tailscale/tailscale/actions/runs/4548299564/jobs/8019187385#step:7:843 See fix in google/gvisor@13d7bf69d8 Updates #7715 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
James Tucker	c628132b34	wgengine/netstack: do not send packets to netstack after close ... Use the local context on Impl to check for shut down state in order to drop rather than inject packets after close has begun. Netstack sets endpoint.dispatcher to nil during shutdown. After the recent adjustment in 920ec69241 we now wait for netstack to fully shutdown before we release tests. This means that we may continue to accept packets and attempt to inject them, which we must prevent in order to avoid nil pointer panic. References google/gvisor#8765 Fixes #7715 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago