tailscale

Commit Graph

Author	SHA1	Message	Date
Mihai Parparita	a9f32656f5	control/controlhttp: allow client and server to communicate over WebSockets We can't do Noise-over-HTTP in Wasm/JS (because we don't have bidirectional communication), but we should be able to do it over WebSockets. Reuses derp WebSocket support that allows us to turn a WebSocket connection into a net.Conn. Updates #3157 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	c81be7b899	control/controlclient: avoid Noise protocol for js/wasm for now Updates #3157 Change-Id: I04accc09783a68257d28cadde5818bf0724a8013 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	c60cbca371	control/controlclient: store netinfo and hostinfo separately Currently, when SetNetInfo is called it sets the value on hostinfo.NetInfo. However, when SetHostInfo is called it overwrites the hostinfo field which may mean it also clears out the NetInfo it had just received. This commit stores NetInfo separately and combines it into Hostinfo as needed so that control is always notified of the latest values. Also, remove unused copies of Hostinfo from ipn.Status and controlclient.Auto. Updates #tailscale/corp#4824 (maybe fixes) Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
James Tucker	ae483d3446	wgengine, net/packet, cmd/tailscale: add ICMP echo Updates tailscale/corp#754 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	1237000efe	control/controlhttp: don't assume port 80 upgrade response will work Just because we get an HTTP upgrade response over port 80, don't assume we'll be able to do bi-di Noise over it. There might be a MITM corp proxy or anti-virus/firewall interfering. Do a bit more work to validate the connection before proceeding to give up on the TLS port 443 dial. Updates #4557 (probably fixes) Change-Id: I0e1bcc195af21ad3d360ffe79daead730dfd86f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	5a1ef1bbb9	net/tsdial: add SystemDial as a wrapper on netns.Dial The connections returned from SystemDial are automatically closed when there is a major link change. Also plumb through the dialer to the noise client so that connections are auto-reset when moving from cellular to WiFi etc. Updates #3363 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	e38d3dfc76	control/controlhttp: start port 443 fallback sooner if 80's stuck Fixes #4544 Change-Id: I39877e71915ad48c6668351c45cd8e33e2f5dbae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	adcb7e59d2	control/controlclient: fix log print with always-empty key In debugging #4541, I noticed this log print was always empty. The value printed was always zero at this point. Updates #4541 Change-Id: I0eef60c32717c293c1c853879446be65d9b2cef6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	910ae68e0b	util/mak: move tailssh's mapSet into a new package for reuse elsewhere Change-Id: Idfe95db82275fd2be6ca88f245830731a0d5aecf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9f1dd716e8	tailcfg, logtail: provide Debug bit to disable logtail For people running self-hosted control planes who want a global opt-out knob instead of running their own logcatcher. Change-Id: I7f996c09f45850ff77b58bfd5a535e197971725a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	c591c91653	tailcfg, control/controlclient: TSMP & disco pings tailcfg.PingResponse formalizes the TSMP & disco response message, and controlclient is wired to send POST responses containing tailcfg.PingResponse for TSMP and disco PingRequests. Updates tailscale/corp#754 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
David Anderson	f570372b4d	control/controlbase: don't enforce a max protocol version at handshake time. Doing so makes development unpleasant, because we have to first break the client by bumping to a version the control server rejects, then upgrade the control server to make it accept the new version. This strict rejection at handshake time is only necessary if we want to blocklist some vulnerable protocol versions in the future. So, switch to a default-permissive stance: until we have such a version that we have to eagerly block early, we'll accept whatever version the client presents, and leave it to the user of controlbase.Conn to make decisions based on that version. Noise still enforces that the client and server agree on what protocol version is being used, and the control server still has the option to finish the handshake and then hang up with an in-noise error, rather than abort at the handshake level. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	02ad987e24	control/controlbase: make the protocol version number selectable. This is so that we can plumb our client capability version through the protocol as the Noise version. The capability version increments more frequently than strictly required (the Noise version only needs to change when cryptographically-significant changes are made to the protocol, whereas the capability version also indicates changes in non-cryptographically-significant parts of the protocol), but this gives us a safe pre-auth way to determine if the client supports future protocol features, while still relying on Noise's strong assurance that the client and server have agreed on the same version. Currently, the server executes the same protocol regardless of the version number, and just presents the version to the caller so they can do capability-based things in the upper RPC protocol. In future, we may add a ratchet to disallow obsolete protocols, or vary the Noise handshake behavior based on requested version. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maisem Ali	309ddef852	net/netutil: add CheckIPForwardingLinux (#4301 ) Combine the code between `LocalBackend.CheckIPForwarding` and `controlclient.ipForwardingBroken`. Fixes #4300 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	b647977b33	net/netutil: move some net utils from control/controlhttp to netutil In prep for reuse elsewhere. Change-Id: I1b804edf76ac66b9108e6f434e77eab7a7472d69 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f3b13604b3	control/controlclient, ipn/ipnlocal, tailcfg: add MapResponse.PopBrowserURL Updates #3802 Change-Id: I89481fc5782a0cc8084354706f8f28d94f197325 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3ea6ddbb5f	control/controlbase: use less memory when idle (remove rxState.buf) Uses 4KB less per Conn. Fixes #4113 Change-Id: I38d25b1cf5ecf45423404a330b7ecab79a9fb176 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	21445b56a5	control/controlbase: use less memory when idle (remove txState.buf) Uses 4KB less per Conn. Updates #4113 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	0868329936	all: use any instead of interface{} My favorite part of generics. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	8c2cb4b431	go.mod: update to latest certstore It includes a fix to allow us to use Go 1.18. We can now remove our Tailscale-only build tags. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	26021b07ec	control/controlclient: only build certstore-related code with the Tailscale Go toolchain The certstore code is impacted by golang/go#51726. The Tailscale Go toolchain fork contains a temporary workaround, so it can compile it. Once the upstream toolchain can compile certstore, presumably in Go 1.18.1, we can revert this change. Note that depaware runs with the upstream toolchain. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	efc48b0578	ssh/tailssh, ipnlocal, controlclient: fetch next SSHAction from network Updates #3802 Change-Id: I08e98805ab86d6bbabb6c365ed4526f54742fd8e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6b11004a2a	control/controlclient: proactively close TLS connection after /key fetch When using Noise. Updates #3488 Change-Id: I1049963763075a15b72fd8065dcf44a9cf37975f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Nick O'Neill	1625e87526	control/controlclient, localapi: shorten expiry time via localapi (#4112 ) Signed-off-by: Nick O'Neill <nick@tailscale.com>	3 years ago
Maisem Ali	2c89b3a601	control/controlbase: make Conn.Write return consumed bytes Currently `Write` returns the number of ciphertext bytes written. According to the docs for io.Writer, Write should return the amount of bytes consumed from the input. ``` // Write writes len(p) bytes from p to the underlying data stream. // It returns the number of bytes written from p (0 <= n <= len(p)) // and any error encountered that caused the write to stop early. // Write must return a non-nil error if it returns n < len(p). // Write must not modify the slice data, even temporarily. Write(p []byte) (n int, err error) ``` Fixes #4126 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	e82a74553b	control/controlclient: make MapRequests go over noise. Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	ba2c0c3145	control/controlclient: call direct.Close after map requests are complete This was causing a flake in another repo. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	91a8cdc84b	control/controlclient: make Auto.Shutdown call Direct.Close Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	0f37317664	control/controlclient: make RegisterRequest go over Noise Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	c4f6df47e5	control/controlclient: fix Noise HTTP/2 regression from earlier commit Fix regression from `21069124db` caught by tests in another repo. The HTTP/2 Transport that was being returned had a ConnPool that never dialed. Updates #3488 Change-Id: I3184d6393813448ae143d37ece14eb732334c05f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	21069124db	control/controlclient: fix the Noise HTTP/2 timeout config We want to close the connection after a minute of inactivity, not heartbeat once a minute to keep it alive forever. Updates #3488 Change-Id: I4b5275e8d1f2528e13de2d54808773c70537db91 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	0588ca5d8b	control/controlclient: make SetDNS attempt to go over Noise first Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	da1821197a	tailcfg: add SetDNSResponse Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	0f31a0fc76	control/controlclient: add Noise client Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	249758df90	control/controlclient: start fetching the server noise key Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	d5f8f38ac6	tailcfg: rename map request version to "capability version" And add a CapabilityVersion type, primarily for documentation. This makes MapRequest.Version, RegisterRequest.Version, and SetDNSRequest.Version all use the same version, which will avoid confusing in the future if Register or SetDNS ever changed their semantics on Version change. (Currently they're both always 1) This will requre a control server change to allow a SetDNSRequest.Version value other than 1 to be deployed first. Change-Id: I073042a216e0d745f52ee2dbc45cf336b9f84b7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5d085a6f41	controlhttp: add some docs, change Dial's path from /switch to /ts2021 When I deployed server-side changes, I put the upgrade handler at /ts2021 instead of /switch. We could move the server to /switch, but ts2021 seems more specific and better, but I don't feel strongly. Updates #3488 Change-Id: Ifbf8ea60a815fd2fa1bfbe1b7af1ac2a27218354 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	823d970d60	control/controlclient: use structured logging for MapResponse.ControlTime Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	8c3c5e80b7	tailcfg: make MapResponse.ControlTime a pointer Otherwise omitempty doesn't work. This is wire-compatible with a non-pointer type, so switching is safe, now and in the future. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	8cf6d0a17b	tailcfg: add MapResponse.ControlTime field And log it when provided in map responses. The test uses the date on which I joined Tailscale. :) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Maisem Ali	72d8672ef7	tailcfg: make Node.Hostinfo a HostinfoView Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	57115e923e	tailcfg: add start of SSH policy to be sent from control plane to nodes Updates #3802 Change-Id: Iec58f35d445aaa267d0f7e7e2f30c049c1df4c0e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3a94ece30c	control/controlclient: remove dummy endpoint in endpoint stripping mode The TODO is done. Magicsock doesn't require any endpoints to create an *endpoint now. Verified both in code and empirically: I can use the env knob and access everything. Change-Id: I4fe7ed5b11c5c5e94b21ef3d77be149daeab998a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	86a902b201	all: adjust some log verbosity Updates #1548 Change-Id: Ia55f1b5dc7dfea09a08c90324226fb92cd10fa00 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	adda2d2a51	control/controlclient: select newer certificate If multiple certificates match when selecting a certificate, use the one issued the most recently (as determined by the NotBefore timestamp). This also adds some tests for the function that performs that comparison. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Brad Fitzpatrick	b3d268c5a1	control/controlclient: turn off Go's implicit compression We don't use it anyway, so be explicit that we're not using it. Change-Id: Iec953271ef0169a2e227811932f5b65b479624af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	96f008cf87	control/controlhttp: package to get a controlbase.Conn over HTTP(S). Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	d5a7eabcd0	control/controlbase: enable asynchronous client handshaking. With this change, the client can obtain the initial handshake message separately from the rest of the handshake, for embedding into another protocol. This enables things like RTT reduction by stuffing the handshake initiation message into an HTTP header. Similarly, the server API optionally accepts a pre-read Noise initiation message, in addition to reading the message directly off a net.Conn. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	6cd180746f	control/controlbase: rename from control/noise. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	25eab78573	control/noise: clean up resources in TestNoReuse Close the server and client. Without this, we leak system threads. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	d9c21936c3	control/controlclient: stop logging about goal.url invariant This isn't the ideal solution, but it's good enough for now. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	758c37b83d	net/netns: thread logf into control functions So that darwin can log there without panicking during tests. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	24ea365d48	netcheck, controlclient, magicsock: add more metrics Updates #3307 Change-Id: Ibb33425764a75bde49230632f1b472f923551126 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	5b94f67956	control/noise: make Conn.readNLocked less surprising. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	a34350ffda	control/noise: factor out nonce checking and incrementing into a type. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	d3acd35a90	control/noise: make message headers match the specification. Only the initiation message should carry a protocol version, all others are just type+len. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	a63c4ab378	control/noise: don't panic when handling ciphertext. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	4004b22fe5	control/noise: stop using poly1305 package constants. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	293431aaea	control/noise: use key.Machine{Public,Private} as appropriate. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	edb33d65c3	control/noise: don't cache mixer, just rebuild a BLAKE2s each time. This should optimize out fine, and readability is preferable to performance here. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	7e9e72887c	control/noise: add singleUseCHP, use it to simplify nonce/key tracking in handshake. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	cf90392174	control/noise: review fixups Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	0b392dbaf7	control/noise: adjust implementation to match revised spec. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	89a68a4c22	control/noise: include the protocol version in the Noise prologue. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	5e005a658f	control/noise: fix typo in docstring. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	eabca699ec	control/noise: remove allocations in the encrypt and decrypt paths. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	da7544bcc5	control/noise: implement the base transport for the 2021 control protocol. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	3e1daab704	hostinfo, control/controlclient: tell control when Ubuntu has disabled Tailscale's sources Fixes #3177 Updates #2500 Change-Id: Iff2a8e27ec7d36a1c210263d6218f20ebed37924 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d2ef73ed82	control/controlclient: rename a variable to not shadow a package name Change-Id: I1bcb577cb2c47e936d545ad57f308e57399de323 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ad63fc0510	control/controlclient: make js/wasm work with Go 1.18+ Updates #3157 Change-Id: I2d67e582842ab3638d720bb5db4701b878ad4473 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	337757a819	ipn/ipnlocal, control/controlclient: don't propagate all map errors to UI Fixes regression from `81cabf48ec` which made all map errors be sent to the frontend UI. Fixes #3230 Change-Id: I7f142c801c7d15e268a24ddf901c3e6348b6729c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	0532eb30db	all: replace tailcfg.DiscoKey with key.DiscoPublic. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	7e6a1ef4f1	tailcfg: use key.NodePublic in wire protocol types. Updates #3206. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	d6e7cec6a7	types/netmap: use key.NodePublic instead of tailcfg.NodeKey. Update #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	ff597e773e	tailcfg, control/controlclient: add method to exit client from control plane Change-Id: Ic28ef283ba63396b68fab86bfb0a8ee8f432474c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	418adae379	various: use NodePublic.AsNodeKey() instead of tailcfg.NodeKeyFromNodePublic() Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	4d38194c21	control/controlclient: stop using wgkey. Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	ada8cd99af	control/controlclient: add a LoginEphemeral LoginFlags bit Change-Id: Ib9029ea0c49aa2ee1b6aac6e464ab1f16aef92e8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	6e5175373e	types/netmap: use new node key type. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	0c546a28ba	types/persist: use new node key type. Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maisem Ali	81cabf48ec	control/controlclient,tailcfg: propagate registration errors to the frontend Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
nicksherron	f01ff18b6f	all: fix spelling mistakes Signed-off-by: nicksherron <nsherron90@gmail.com>	3 years ago
Brad Fitzpatrick	aae622314e	tailcfg, health: add way for control plane to add problems to health check So if the control plane knows that something's broken about the node, it can include problem(s) in MapResponse and "tailscale status" will show it. (and GUIs in the future, as it's in ipnstate.Status/JSON) This also bumps the MapRequest.Version, though it's not strictly required. Doesn't hurt. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	4da559d7cc	control/controlclient: update machine certificate signature version This iterates on the original signature format. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Josh Bleecher Snyder	5b02ad16b9	control/controlclient: replace TODO with explanation Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Dave Anderson	980acc38ba	types/key: add a special key with custom serialization for control private keys (#2792 ) * Revert "Revert "types/key: add MachinePrivate and MachinePublic."" This reverts commit `61c3b98a24`. Signed-off-by: David Anderson <danderson@tailscale.com> * types/key: add ControlPrivate, with custom serialization. ControlPrivate is just a MachinePrivate that serializes differently in JSON, to be compatible with how the Tailscale control plane historically serialized its private key. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	61c3b98a24	Revert "types/key: add MachinePrivate and MachinePublic." Broke the tailscale control plane due to surprise different serialization. This reverts commit `4fdb88efe1`.	3 years ago
David Anderson	4fdb88efe1	types/key: add MachinePrivate and MachinePublic. Plumb throughout the codebase as a replacement for the mixed use of tailcfg.MachineKey and wgkey.Private/Public. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	daf54d1253	control/controlclient: remove TS_DEBUG_USE_DISCO=only. It was useful early in development when disco clients were the exception and tailscale logs were noisier than today, but now non-disco is the exception. Updates #2752 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
slowy07	ac0353e982	fix: typo spelling grammar Signed-off-by: slowy07 <slowy.arfy@gmail.com>	3 years ago
Brad Fitzpatrick	47045265b9	hostinfo: add SetDeviceModel setter, move remaining code from controlclient Updates tailscale/corp#1959 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6f8c8c771b	control/controlclient: tweak a couple error messages Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Simeng He	e199e407d2	tailcfg: add IP and Types field to PingRequest Signed-off-by: Simeng He <simeng@tailscale.com>	3 years ago
Josh Bleecher Snyder	4c8b5fdec4	control/controlclient: do not periodically print full netmap The netmaps can get really large. Printing, processing, and uploading them is expensive. Only print the header on an ongoing basis. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	a5da4ed981	all: gofmt with Go 1.17 This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	dfa5e38fad	control/controlclient: report whether we're in a snap package Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4a2c3e2a0a	control/controlclient: grow goroutine debug buffer as needed To not allocate 1MB up front on iOS. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1986d071c3	control/controlclient: don't use regexp in goroutine stack scrubbing To reduce binary size on iOS. Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	171ec9f8f4	control/{controlknobs,controlclient}: simplify knobs API, fix controlclient crash From integration tests elsewhere: panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x70 pc=0x845c9b] goroutine 226 [running]: tailscale.com/control/controlclient.(Direct).sendMapRequest(0xc00053e1e0, 0x16670f0, 0xc000353780, 0xffffffffffffffff, 0xc0003e5f10, 0x0, 0x0) /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/direct.go:803 +0x19bb tailscale.com/control/controlclient.(Direct).PollNetMap(...) /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/direct.go:574 tailscale.com/control/controlclient.(Auto).mapRoutine(0xc00052a1e0) /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/auto.go:464 +0x571 created by tailscale.com/control/controlclient.(Auto).Start /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/auto.go:151 +0x65 exit status 2 Also remove types/opt.Bool API addition which is now unnecessary. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	1bb6abc604	net/portmapper: add upnp port mapping Add in UPnP portmapping, using goupnp library in order to get the UPnP client and run the portmapping functions. This rips out anywhere where UPnP used to be in portmapping, and has a flow separate from PMP and PCP. RELNOTE=portmapper now supports UPnP mappings Fixes #682 Updates #2109 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	fd7fddd44f	control/controlclient: add debug knob to force node to only IPv6 self addr Updates #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	54199d9d58	controlclient: log server key and URL Turns out we never reliably log the control plane URL a client connects to. Do it here, and include the server public key, which might inadvertently tell us something interesting some day. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	03311bb0d6	hostinfo: add hostinfo package, move stuff out of controlclient And make it cheaper, so other parts of the code can check the environment. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b461ba9554	control/controlclient: fix typo/braino in error message Thanks to @normanr for noticing. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	333e9e75d4	tailcfg, control/controlclient: clarify more, enforce PingRequest.URL is unique Updates #2079 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	857bc4a752	hostinfo: capitalization of AWS Missed one comment from https://github.com/tailscale/tailscale/pull/1868 should be isAWSLambda not isAwsLambda Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	4b71291cdb	hostinfo: detect when running in Azure App Service. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	3ab587abe7	hostinfo: detect Heroku Dyno. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	3c1a73d370	hostinfo: detect AWS Lambda as a container. AWS Lambda uses Docker containers but does not have the string "docker" in its /proc/1/cgroup. Infer AWS Lambda via the environment variables it sets. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Simeng He	f0121468f4	control/controlclient: add Pinger interface, Options.Pinger Plumbs down a pinger to the direct to enable client to client Ping functionality from control. Signed-off-by: Simeng He <simeng@tailscale.com>	3 years ago
Brad Fitzpatrick	e29cec759a	ipn/{ipnlocal,localapi}, control/controlclient: add SetDNS localapi Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Avery Pennarun	8a7d35594d	ipnlocal: don't assume NeedsLogin immediately after StartLogout(). Previously, there was no server round trip required to log out, so when you asked ipnlocal to Logout(), it could clear the netmap immediately and switch to NeedsLogin state. In v1.8, we added a true Logout operation. ipn.Logout() would trigger an async cc.StartLogout() and also immediately switch to NeedsLogin. Unfortunately, some frontends would see NeedsLogin and immediately trigger a new StartInteractiveLogin() operation, before the controlclient auth state machine actually acted on the Logout command, thus accidentally invalidating the entire logout operation, retaining the netmap, and violating the user's expectations. Instead, add a new LogoutFinished signal from controlclient (paralleling LoginFinished) and, upon starting a logout, don't update the ipn state machine until it's received. Updates: #1918 (BUG-2) Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Adrian Dewhurst	6d6cf88d82	control/controlclient: use our fork of certstore The cyolosecurity fork of certstore did not update its module name and thus can only be used with a replace directive. This interferes with installing using `go install` so I created a tailscale fork with an updated module name. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w(.)\.Port = (.) -> $1 = $1.WithPort($2) \w(.)\.IP = (.) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Avery Pennarun	6307a9285d	controlclient: update Persist.LoginName when it changes. Well, that was anticlimactic. Fixes tailscale/corp#461. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	0181a4d0ac	ipnlocal: don't pause the controlclient until we get at least one netmap. Without this, macOS would fail to display its menu state correctly if you started it while !WantRunning. It relies on the netmap in order to show the logged-in username. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	b4d04a065f	controlclient: extract a Client interface and rename Client->Auto. This will let us create a mock or fake Client implementation for use with ipn.Backend. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Avery Pennarun	cc3119e27e	controlclient: extract State and Status stuff into its own file. No changes other than moving stuff around. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Brad Fitzpatrick	3411bb959a	control/controlclient: fix signRegisterRequest log suppression check on Windows Fixes #1774 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6f52fa02a3	control/controlclient, tailcfg: add Debug.SleepSeconds (mapver 19) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	09891b9868	ipn/ipnlocal: on fresh lazy-connecting install, start in state NeedsLogin Fixes #1759 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e9d24341e0	tailcfg, control/controlclient: accept nil MapResponse.Node (mapver 18) All MapResponse fields can not be omitted and are tagged "omitempty". Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	3739cf22b0	tailcfg, control/controlclient: allow empty MapResponse.Domain (mapver17) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	5092cffd1f	control/controlclient: add start of some MapResponse->NetworkMap tests Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	aef3c0350c	control/controlclient: break direct.go into map.go (+tests), add mapSession So the NetworkMap-from-incremental-MapResponses can be tested easily. And because direct.go was getting too big. No change in behavior at this point. Just movement. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b993d9802a	ipn/ipnlocal, etc: require file sharing capability to send/recv files tailscale/corp#1582 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	670838c45f	tailcfg, control/controlclient: (mapver 16) add Node.Online, MapResponse.OnlineChange And fix PeerSeenChange bug where it was ignored unless there were other peer changes. Updates tailscale/corp#1574 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	7055f870f8	control/controlclient: only use a single DNS label as the hostname. Fixes #971 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	34d2f5a3d9	tailcfg: add Endpoint, EndpointType, MapRequest.EndpointType Track endpoints internally with a new tailcfg.Endpoint type that includes a typed netaddr.IPPort (instead of just a string) and includes a type for how that endpoint was discovered (STUN, local, etc). Use []tailcfg.Endpoint instead of []string internally. At the last second, send it to the control server as the existing []string for endpoints, but also include a new parallel MapRequest.EndpointType []tailcfg.EndpointType, so the control server can start filtering out less-important endpoint changes from new-enough clients. Notably, STUN-discovered endpoints can be filtered out from 1.6+ clients, as they can discover them amongst each other via CallMeMaybe disco exchanges started over DERP. And STUN endpoints change a lot, causing a lot of MapResposne updates. But portmapped endpoints are worth keeping for now, as they they work right away without requiring the firewall traversal extra RTT dance. End result will be less control->client bandwidth. (despite negligible increase in client->control bandwidth) Updates tailscale/corp#1543 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ccb322db04	tailcfg, control/controlclient: make nil MapResponse.DNSConfig mean unchanged (mapver15) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Simon Kirillov	a64b57e2fb	control/controlclient: create tls client config with server hostname instead of serverURL.Host Signed-off-by: Simon Kirillov <svkirillov3@gmail.com>	4 years ago
Brad Fitzpatrick	3167e55ddf	ipn/{ipnlocal,localapi}, cmd/tailscale: add logout command Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	597c19ff4e	control/controlclient: refactor some internals Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Adrian Dewhurst	3f456ba2e7	control/controlclient: return correct certificate When searching for the matching client identity, the returned certificate chain was accidentally set to that of the last identity returned by the certificate store instead of the one corresponding to the selected identity. Also, add some extra error checking for invalid certificate chains, just in case. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago
Denton Gentry	224e60cef2	hostifo: update LXC, add Cloud Run. Recent LXC support no longer has "lxc" in /proc/1/cgroup: # cat /proc/1/cgroup 12:freezer:/ 11:rdma:/ 10:cpuset:/ 9:pids:/ 8:blkio:/ 7:devices:/ 6:perf_event:/ 5:net_cls,net_prio:/ 4:memory:/ 3:hugetlb:/ 2:cpu,cpuacct:/ 1:name=systemd:/init.scope 0::/init.scope Look for fuse.lxcfs in /proc.mounts in addition: # grep lxc /proc/mounts lxcfs /proc/cpuinfo fuse.lxcfs ... lxcfs /proc/diskstats fuse.lxcfs ... lxcfs /proc/loadavg fuse.lxcfs ... lxcfs /proc/meminfo fuse.lxcfs ... lxcfs /proc/stat fuse.lxcfs ... lxcfs /proc/swaps fuse.lxcfs ... lxcfs /proc/uptime fuse.lxcfs ... lxcfs /sys/devices/system/cpu/online fuse.lxcfs ... Add Knative detection by looking for the environment variables which are part of its container contract. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Brad Fitzpatrick	1bd14a072c	cmd/tailscale, ipn/localapi: move IP forwarding check to tailscaled, API Instead of having the CLI check whether IP forwarding is enabled, ask tailscaled. It has a better idea. If it's netstack, for instance, the sysctl values don't matter. And it's possible that only the daemon has permission to know. Fixes #1626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a998fe7c3d	control/controlclient: support lazy machine key generation It's not done in the caller yet, but the controlclient does it now. Updates #1573 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ddaacf0a57	control/controlclient: document a few things Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	12ae2d73b3	control/controlclient: fix TS_DEBUG_MAP on requests The concrete type being encoded changed from a value to pointer earlier and this was never adjusted. (People don't frequently use TS_DEBUG_MAP to see requests, so it went unnoticed until now.) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Adrian Dewhurst	04dd6d1dae	control/controlclient: sign RegisterRequest (#1549 ) control/controlclient: sign RegisterRequest Some customers wish to verify eligibility for devices to join their tailnets using machine identity certificates. TLS client certs could potentially fulfill this role but the initial customer for this feature has technical requirements that prevent their use. Instead, the certificate is loaded from the Windows local machine certificate store and uses its RSA public key to sign the RegisterRequest message. There is room to improve the flexibility of this feature in future and it is currently only tested on Windows (although Darwin theoretically works too), but this offers a reasonable starting place for now. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago
Brad Fitzpatrick	0a02aaf813	control, ipn, tailcfg: remove golang.org/x/oauth2 dep, add tailcfg.Oauth2Token golang.org/x/oauth2 pulls in App Engine and grpc module dependencies, screwing up builds that depend on this module. Some background on the problem: https://go.googlesource.com/proposal/+/master/design/36460-lazy-module-loading.md Fixes tailscale/corp#1471 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	cc508be603	control/controlclient: remove redundant Hostinfo log The direct client already logs it in JSON form. Then it's immediately logged again in an unformatted dump, so this removes that unformatted one. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	9eb65601ef	health, ipn/ipnlocal: track, log overall health Updates #1505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6fbc9b3a98	control/controlclient: cache Windows version To atone for `1d7f9d5b4a`, the revert of `4224b3f731`. At least it's fast again, even if it's shelling out to cmd.exe (once now). Updates #1478 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1d7f9d5b4a	Revert "control/controlclient: use API to get Windows version number" This reverts commit `4224b3f731`. From https://github.com/tailscale/tailscale/pull/1494#discussion_r594852889 ... > Actually, I want all four numbers back. I spent the evening > debugging an issue for a user running an old version of Windows > and then going to to > https://en.wikipedia.org/wiki/Windows_10_version_history_(version_1809) > and reading all the revision notes in the footnotes of that wikipedia > page. > > I'm going to revert this for now for Tailscale 1.6. We can land it > again later when we figure out how to get the fourth numbers. Updates #1478	4 years ago
Brad Fitzpatrick	232cfda280	wgengine/router: report to control when setPrivateNetwork fails Fixes #1503 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ba8c6d0775	health, controlclient, ipn, magicsock: tell health package state of things Not yet checking anything. Just plumbing states into the health package. Updates #1505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Aleksandar Pesic	4224b3f731	control/controlclient: use API to get Windows version number Fixes #1478 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
David Anderson	1bc3c03562	control/controlclient: allow for an unset linkMon. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0b66cfe1e0	control/controlclient: report broken IP forwarding more precisely. IP forwarding is not required when advertising a machine's local IPs over Tailscale. Fixes #1435. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	f45a9e291b	tailcfg, control/controlclient: add MapResponse.PingRequest So the control server can test whether a client's actually present. Most clients are over HTTP/2, so these pings (to the same host) are super cheap. This mimics the earlier goroutine dump mechanism. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	affd859121	ipn/ipnlocal, control/controlclient: propagate link monitor to controlclient Don't use it yet, but get it down there. Updates #1455 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	92cdb30b26	tailcfg, control/controlclient: add goroutine dump debug feature Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	9df4185c94	control/controlclient, net/{dnscache,dnsfallback}: add DNS fallback mechanism Updates #1405 Updates #1403 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	fd8e070d01	health, control/controlclient, wgengine: report when router unhealthy Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4ec01323c1	control/controlclient: note package type in Hostinfo Fixes tailscale/corp#440 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1e7a35b225	types/netmap: split controlclient.NetworkMap off into its own leaf package Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ddfcc4326c	types/persist: split controlclient.Persist into a small leaf package This one alone doesn't modify the global dependency map much (depaware.txt if anything looks slightly worse), but it leave controlclient as only containing NetworkMap: bradfitz@tsdev:~/src/tailscale.com/ipn$ grep -F "controlclient." .go backend.go: NetMap controlclient.NetworkMap // new netmap received fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) handle.go: netmapCache controlclient.NetworkMap handle.go:func (h Handle) NetMap() *controlclient.NetworkMap { Once that goes into a leaf package, then ipn doesn't depend on controlclient at all, and then the client gets smaller. Updates #1278	4 years ago
Brad Fitzpatrick	6064b6ff47	wgengine/wgcfg/nmcfg: split control/controlclient/netmap.go into own package It couldn't move to ipnlocal due to test dependency cycles. Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	b9c2231fdf	ipn: program exit node into the data plane according to user pref. Part of #1153, #1154. Fixes #1224. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	e8d4afedd1	control/controlclient: don't call lite endpoint update path when logged out This was the other half of the #1271 problem. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	7529b74018	control/controlclient: avoid crash sending map request with zero node key Fixes #1271 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	fe7c3e9c17	all: move wgcfg from wireguard-go This is mostly code movement from the wireguard-go repo. Most of the new wgcfg package corresponds to the wireguard-go wgcfg package. wgengine/wgcfg/device{_test}.go was device/config{_test}.go. There were substantive but simple changes to device_test.go to remove internal package device references. The API of device.Config (now wgcfg.DeviceConfig) grew an error return; we previously logged the error and threw it away. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Sonia Appasamy	4dab0c1702	tailcfg: update node display name fields and methods (#1207 ) Signed-off-by: Sonia Appasamy <sonia@tailscale.com> Consolidates the node display name logic from each of the clients into tailcfg.Node. UI clients can use these names directly, rather than computing them independently.	4 years ago
Sonia Appasamy	567c5a6d9e	tailcfg, controlclient: add DisplayName field to tailcfg.Node and populate it from controlclient (#1191 ) Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	4 years ago
Brad Fitzpatrick	fa3543d629	control/controlclient: use more direct way of getting the MagicDNS suffix Suggested by Avery earlier. Ends up fixing bug in "tailscale status" when MagicDNS if off too: https://forum.tailscale.com/t/1-3-293-is-released-a-1-4-0-pre-release/349/11?u=bradfitz	4 years ago
Brad Fitzpatrick	a905ce5607	control/controlclient: add debug knob to not use control's endpoints	4 years ago
Brad Fitzpatrick	b5628cee4e	control/controlclient: add detail to verbose log about route skips	4 years ago
Brad Fitzpatrick	ec77b80c53	tailcfg, control/controlclient: add mapver 10: MapResponse.PeerSeenChange This adds a more wire-efficient way of updating peers' Node.LastSeen times. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	654b5f1570	all: convert from []wgcfg.Endpoint to string This eliminates a dependency on wgcfg.Endpoint, as part of the effort to eliminate our wireguard-go fork. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	c1dabd9436	control/controlclient: let clients opt in to Sharer-vs-User split model Updates tailscale/corp#1183	4 years ago
Brad Fitzpatrick	b987b2ab18	control/controlclient: treat node sharer as owner for display purposes This make clients (macOS, Windows, tailscale status) show the node sharer's profile rather than the node owner (which may be anonymized). Updates #992	4 years ago
Brad Fitzpatrick	9d73f84a71	tailcfg, control/controlclient: make MapResponse.CollectServices an opt.Bool Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Sonia Appasamy	024671406b	ipn: only send services in Hostinfo if Tailnet has opted-in to services collection (#1107 ) Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	4 years ago
Brad Fitzpatrick	5efb0a8bca	cmd/tailscale: change formatting of "tailscale status" * show DNS name over hostname, removing domain's common MagicDNS suffix. only show hostname if there's no DNS name. but still show shared devices' MagicDNS FQDN. * remove nerdy low-level details by default: endpoints, DERP relay, public key. They're available in JSON mode still for those who need them. * only show endpoint or DERP relay when it's active with the goal of making debugging easier. (so it's easier for users to understand what's happening) The asterisks are gone. * remove Tx/Rx numbers by default for idle peers; only show them when there's traffic. * include peers' owner login names * add CLI option to not show peers (matching --self=true, --peers= also defaults to true) * sort by DNS/host name, not public key * reorder columns	4 years ago
Denton Gentry	02c34881b5	Add more tests for Direct. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Denton Gentry	b716c76df9	cover one more case in TestStatusEqual. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Brad Fitzpatrick	2f04f49376	control/controlclient: use lite map request handler to avoid aborting streams Previously, any change to endpoints or hostinfo (or hostinfo's netinfo) would result in the long-running map request HTTP stream being torn down and restarted, losing all compression context along with it. This change makes us instead send a lite map request (OmitPeers: true, Stream: false) that doesn't subscribe to anything, and then the coordination server knows to not close other streams for that node when it recives a lite request. Fixes tailscale/corp#797 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e8ae355bb8	ipn: delete domainsForProxying, require explicit DNS search domains (mapver 9) (#1078 ) Previously the client had heuristics to calculate which DNS search domains to set, based on the peers' names. Unfortunately that prevented us from doing some things we wanted to do server-side related to node sharing. So, bump MapRequest.Version to 9 to signal that the client only uses the explicitly configured DNS search domains and doesn't augment it with its own list. Updates tailscale/corp#1026 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	ef15096a7d	control/controlclient, version/distro: detect NixOS explicitly The fallthrough happened to work in controlclient already due to the /etc/os-release PRETTY_NAME default, but make it explicit so it doesn't look like an accident. Also add it to version/distro, even though nothing needs it yet.	4 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c348fb554f	control/controlclient: clarify a comment	4 years ago
David Anderson	ca676ea645	tailcfg: introduce map version 8, for clients that support v6 node config. For now, the server will only send v6 configuration to mapversion 8 clients as part of an early-adopter program, while we verify that the functionality is robust. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	89be4037bb	control/controlclient: report broken routing for v4 and v6. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	afcf134812	wgengine/filter, tailcfg: support CIDRs+ranges in PacketFilter (mapver 7) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	2485faf69a	Merge branch 'main' into report-status-systemd	4 years ago
Christine Dodrill	7ea809897d	ipn/ipnserver: enable systemd-notify support Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>	4 years ago
Brad Fitzpatrick	a0a8b9d76a	control/controlclient: don't spin when starting up when node key is expired Fixes #1018 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	b3c7b631c2	tailcfg, control/controlclient: make nil PacketFilter mean unchanged (mapver 6) After mapver 5's incremental netmap updates & user profiles, much of the remaining bandwidth for streamed MapResponses were redundant, unchanged PacketFilters. So make MapRequest.Version 6 mean that nil means unchanged from the previous value.	4 years ago
Brad Fitzpatrick	fac2b30eff	control/controlclient: diagnose zero bytes from control Updates #921 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a2d78b4d3e	net/dnscache, control/controlclient: use DNS cache when dialing control Cache DNS results of earlier login.tailscale.com control dials, and use them for future dials if DNS is slow or broken. Fixes various issues with trickier setups with the domain's DNS server behind a subnet router. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	76d99cf01a	wgengine/filter: remove the Matches type. It only served to obscure the underlying slice type without adding much value. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	782e07c0ae	control/controlclient: send warning flag in map request when IP forwarding off Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4f4e84236a	ipn: clean up Prefs logging at start Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	54e6c3a290	version: use OSS repo's version when building. When building with redo, also include the git commit hash from the proprietary repo, so that we have a precise commit that identifies all build info (including Go toolchain version). Add a top-level build script demonstrating to downstream distros how to burn the right information into builds. Adjust `tailscale version` to print commit hashes when available. Fixes #841. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	a3f17b8108	control/controlclient: also log active account in netmaps Updates tailscale/corp#461	4 years ago
Brad Fitzpatrick	5b1d03f016	control/controlclient: remove prior temporary macos debugging It was an x/net/http2 bug, since fixed.	4 years ago
Brad Fitzpatrick	c44e244276	control/controlclient: add some temporary debugging for #839	4 years ago
Brad Fitzpatrick	9957c45995	tailcfg: bump, document MapRequest.Version value Fixes tailscale/corp#634 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	3909c82f3d	control/controlclient: rename map debug knob, make it do both request+response Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	62d941dc26	tailcfg: add a DebugFlags field for experiments and debugging. Also replaces the IPv6Overlay bool with use of DebugFlags, since it's currently an experimental configuration. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	22024a38c3	control/controlclient: log Hostinfo on change Fixes #830 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	c6dbd24f67	tailcfg: add a field to advertise support for IPv6 tailscale config. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	a6c34bdc28	control/controlclient: also include our own profile (for when no self-owned peers) Fix from regression in previous commit (`0e3048d8e0`) that was caught by e2e tests. In that previous commit, the user's own profile was omitted from the NetworkMap in the case where the user only had one node.	4 years ago
Brad Fitzpatrick	0e3048d8e0	control/controlclient: support delta userprofiles from control I was going to make support for this advertised from the client, but turns out only "tailscale status" even uses the UserProfiles field and fails gracefully (omits that field) if a user profile for a user is missing, so I think we can just reuse the DeltaPeers field from the client to ask the control server to also delta encode the user profiles. For the few users running 1.1.x (unstable) versions between DeltaPeers support (1.1.82) and this (~1.1.541), they'll just sometimes have missing names in "tailscale status --json" or "tailscale status --web" (the only places the UserProfile is used).	4 years ago
Brad Fitzpatrick	82f2fdc194	control/controlclient: adjust some logging point names The previous code read too explicitly like log.Printf("I am here1"), log.Printf("I am here2"). It still is with this change, but prettier, and less subject to code rearranging order.	4 years ago
Brad Fitzpatrick	1819f6f8c8	control/controlclient: set MapRequest.ReadOnly on initial empty endpoint request On startup, clients do a MapRequest with empty endpoints while they learn the DERP map to discover the STUN servers they then query to learn their endpoints. Set MapRequest.ReadOnly on those initial queries to not broadcast the empty endpoints out to peers. The read results will come a half second later (or less). Updates tailscale/corp#557	4 years ago
Avery Pennarun	6332bc5e08	controlclient: print http errors if result code != 200. Turns out for the particular error I was chasing, it actually returns 200 and zero data. But this code mirrors the same check in the map poll, and is the right thing to do in the name of future debugging. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
David Crawshaw	15297a3a09	control/controlclient: some extra debug info in errors Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Brad Fitzpatrick	b5a3850d29	control/controlclient, ipn: store machine key separately from user prefs/persist Updates #610 (fixes after some win/xcode changes in a separate repo)	4 years ago
Josh Bleecher Snyder	efb08e4fee	all: use IsZero methods Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	c8f257df00	Revert "all: keep UserProfiles a slice instead of a map for longer" This reverts commit `e5894aba42`. Breaks macOS/iOS build. Reverting per chat with Josh; he'll fix later today.	4 years ago
Josh Bleecher Snyder	1fecf87363	control/controlclient: use wgcfg.PrivateKey.IsZero Generated by eg using template: --- package p import "github.com/tailscale/wireguard-go/wgcfg" func before(k wgcfg.PrivateKey) bool { return k == wgcfg.PrivateKey{} } func after(k wgcfg.PrivateKey) bool { return k.IsZero() } Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	e5894aba42	all: keep UserProfiles a slice instead of a map for longer Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	4d4ca2e496	control/controlclient: remove Roles fields from client They are unused. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	5d8b88be88	control/controlclient, version/distro, wgengine: recognize OpenWrt And help out with missing packages. Thanks to @willangley for tips. Updates #724	4 years ago
Brad Fitzpatrick	904a91038a	tailcfg: add MapRequest.ReadOnly and OmitPeers; remove DebugForceDisco DebugForceDisco was a development & safety knob during the the transition to discovery. It's no longer needed. Add MapRequest.ReadOnly to prevent clients needing to do two peer-spamming MapRequest at start-up. This only adds the field, not the use of the field. (The control server needs to support it first.) Updates tailscale/corp#557 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	761fe19e5f	control/controlclient: don't accept /32 routes without --accept-routes Fixes tailscale/corp#500 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	88107b1287	control/controlclient: add TS_DEBUG_MAPRESPONSE to dump all MapResponses I'm always adding this by hand during development. Time to check it in.	4 years ago
Brad Fitzpatrick	931bcd44cb	control/controlclient: report Synology "distro" + its version to control	4 years ago
David Anderson	8f5b52e571	net/netns: add windows support. Also remove rebinding logic from the windows router. Magicsock will instead rebind based on link change signals. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	662c19551a	control/controlclient: deal with localized 'Version' string getting Windows version	4 years ago
Brad Fitzpatrick	28f9cd06f5	tshttpproxy, controlclient, derphttp, logpolicy: send Negotiate auth to proxies For Windows only, and only when built with Tailscale's Go tree. Updates tailscale/corp#583	4 years ago
Brad Fitzpatrick	9337a99dff	tailcfg, wgengine, controlclient: add control-side gating of lazy WG config	4 years ago
chungdaniel	4d56d19b46	control/controlclient, wgengine/filter: extract parsePacketFilter to … (#696 ) control/controlclient, wgengine/filter: extract parsePacketFilter to new constructor in wgengine/filter Signed-off-by: chungdaniel <daniel@tailscale.com>	4 years ago
Brad Fitzpatrick	c5eb57f4d6	net/tshttpproxy: new package, support WPAD/PAC proxies on Windows Updates tailscale/corp#553 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f6dc47efe4	tailcfg, controlclient, magicsock: add control feature flag to enable DRPO Updates #150	4 years ago
Brad Fitzpatrick	337c86b89d	control/controlclient: don't crash on invalid filter CIDR from server Fixes #691	4 years ago
Brad Fitzpatrick	a275b9d7aa	control/controlclient: use less battery when stopped, stop map requests Updates #604 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	dd97111d06	backoff: update to Go style, document a bit, make 30s explicit Also, bit of behavior change: on non-nil err but expired context, don't reset the consecutive failure count. I don't think the old behavior was intentional. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	696020227c	tailcfg, control/controlclient: support delta-encoded netmaps Should greatly reduce bandwidth for large networks (including our hello.ipn.dev node). Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	5590daa97d	control/controlclient: reset timeout timer on non-keepalive map updates Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	41c4560592	control/controlclient: remove unused NetworkMap.UAPI method And remove last remaining use of wgcfg.ToUAPI in a test's debug output; replace it with JSON.	4 years ago
Brad Fitzpatrick	6298018704	control/controlclient: print disco keys NetworkMap diffs (debug change only) NetworkMap text diffs being empty were currently used to short-circuit calling magicsock's SetNetworkMap (via Engine.SetNetworkMap), but that went away in `c7582dc2` (0.100.0-230) Prior to `c7582dc2` (notably, in 0.100.0-225 and below, down to 0.100.0), a change in only disco key (as when a node restarts) but without endpoint changes (as would happen for a client not behind a NAT with random ports) could result in a "netmap diff: (none)" being printed, as well as Engine.SetNetworkMap being skipped, leading to broken discovery endpoints. `c7582dc2` fixed the Engine.SetNetworkMap skippage. This change fixes the "netmap diff: (none)" print so we'll actually see when a peer restarts with identical endpoints but a new discovery key.	4 years ago
Dmytro Shynkevych	28e52a0492	all: dns refactor, add Proxied and PerDomain flags from control (#615 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	c7582dc234	ipn: fix netmap change tracking and dns map generation (#609 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	91d95dafd2	control/controlclient: remove an 'unexpected' log that no longer is Fixes #611	4 years ago
Brad Fitzpatrick	b77d752623	control/controlclient: populate OSVersion on Windows	4 years ago
Brad Fitzpatrick	cd21ba0a71	tailcfg, control/controlclient: add GoArch, populate OSVersion on Linux	4 years ago
Brad Fitzpatrick	be3ca5cbfd	control/controlclient: remove unused, slow, often-not-what-you-want NetworkMap.Equal	4 years ago
Brad Fitzpatrick	05a79d79ae	control/controlclient: rewrite, test NetworkMap.ConciseDiffFrom It stood out a lot in hello.ipn.dev's profiles for generating a lot of garbage (and thus GC CPU).	4 years ago
Brad Fitzpatrick	3b0514ef6d	control/controlclient: rename uflags, give it a type, remove dead code	4 years ago
Brad Fitzpatrick	32ecdea157	control/controlclient: generate wireguard config w/o WgQuick text indirection	4 years ago
Dmytro Shynkevych	d361511512	control/controlclient: eliminate race in loginGoal access. This code is currently racy due to an incorrect assumption that goal is never modified in-place, so does not require extra locking. This change makes the assumption correct. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	96994ec431	control/controlclient: fix a couple more data races	4 years ago
Brad Fitzpatrick	a8b95571fb	ipn, control/controlclient: fix some data races More remain. Fixes tailscale/corp#432	4 years ago
Brad Fitzpatrick	c9089c82e8	control/controlclient, tailcfg: turn active route discovery on by default Updates #483	4 years ago

... 3 4 5 6 7 ...

549 Commits (c88abff3e8ee99493652fbd22d9636bf0fd24456)