233 Commits (d6e9fb1df0fd67d08065c2277e7c4f4a82b7930f)

Author	SHA1	Message	Date
Brad Fitzpatrick	d6e9fb1df0	all: adjust Unix permissions for those without umasks ... Fixes tailscale/corp#1165 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f85769b1ed	wgengine/magicsock: drop netaddr.IPPort cache ... netaddr.IP no longer allocates, so don't need a cache or all its associated code/complexity. This totally removes groupcache/lru from the deps. Also go mod tidy.	4 years ago
Brad Fitzpatrick	a80446c026	Update depaware (removes lru from wgengine/filter)	4 years ago
Naman Sood	f69e46175d	wengine/netstack: bump gvisor to latest version ... * wengine/netstack: bump gvisor to latest version Signed-off-by: Naman Sood <naman@tailscale.com> * update dependencies Signed-off-by: Naman Sood <naman@tailscale.com> * Don't change hardcoded IP Signed-off-by: Naman Sood <naman@tailscale.com>	4 years ago
Brad Fitzpatrick	5aa5db89d6	cmd/tailscaled, wgengine/netstack: add start of gvisor userspace netstack work ... Not usefully functional yet (mostly a proof of concept), but getting it submitted for some work @namansood is going to do atop this. Updates #707 Updates #634 Updates #48 Updates #835	4 years ago
Brad Fitzpatrick	5efb0a8bca	cmd/tailscale: change formatting of "tailscale status" ... * show DNS name over hostname, removing domain's common MagicDNS suffix. only show hostname if there's no DNS name. but still show shared devices' MagicDNS FQDN. * remove nerdy low-level details by default: endpoints, DERP relay, public key. They're available in JSON mode still for those who need them. * only show endpoint or DERP relay when it's active with the goal of making debugging easier. (so it's easier for users to understand what's happening) The asterisks are gone. * remove Tx/Rx numbers by default for idle peers; only show them when there's traffic. * include peers' owner login names * add CLI option to not show peers (matching --self=true, --peers= also defaults to true) * sort by DNS/host name, not public key * reorder columns	4 years ago
Josh Bleecher Snyder	1271e135cd	wgengine/tstun: initialize wireguard-go TUN parameters ... This will enable us to remove the corresponding code from our fork of wireguard-go. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Frederik “Freso” S. Olesen	83fccf9fe5	tailscaled.service: Lock down clock and /dev (#1071) ... Research in issue #1063 uncovered why tailscaled would fail with ProtectClock enabled (it implicitly enabled DevicePolicy=closed). This knowledge in turn also opens the door for locking down /dev further, e.g. explicitly setting DevicePolicy=strict (instead of closed), and making /dev private for the unit. Additional possible future (or downstream) lockdown that can be done is setting `PrivateDevices=true` (with `BindPaths=/dev/net/`), however, systemd 233 or later is required for this, and tailscaled currently need to work for systemd down to version 215. Closes https://github.com/tailscale/tailscale/issues/1063 Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>	4 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package ... This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Charlotte Brandhorst-Satzkorn	ff2b3d02e6	Fix typo in cmd/tailscale/cli/cli.go (#1069) ... Remove duplicate 'to connect' in error message. Fixes #1068 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@catzkorn.dev>	4 years ago
Frederik “Freso” S. Olesen	a9a80ab372	tailscaled.service: Harden systemd unit somewhat (#1062) ... While not a full capability lockdown of the systemd unit, this still improves sandboxing and security of the running process a good deal. Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>	4 years ago
Matt Layher	1a42cef3a2	cmd/tailscale*: make updatedeps ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	4 years ago
Brad Fitzpatrick	d0baece5fa	go.mod: bump inet.af/netaddr to non-allocating version	4 years ago
Brad Fitzpatrick	15c064f76f	wgengine/router/dns: remove unsafe endianness detection on Linux	4 years ago
Brad Fitzpatrick	57dd247376	cmd/tailscaled, logpolicy, logtail: support log levels ... Log levels can now be specified with "[v1] " or "[v2] " substrings that are then stripped and filtered at the final logger. This follows our existing "[unexpected]" etc convention and doesn't require a wholesale reworking of our logging at the moment. cmd/tailscaled then gets a new --verbose=N flag to take a log level that controls what gets logged to stderr (and thus systemd, syslog, etc). Logtail is unaffected by --verbose. This commit doesn't add annotations to any existing log prints. That is in the next commit. Updates #924 Updates #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	2485faf69a	Merge branch 'main' into report-status-systemd	4 years ago
Christine Dodrill	7ea809897d	ipn/ipnserver: enable systemd-notify support ... Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>	4 years ago
Josh Bleecher Snyder	34a0292433	depaware.txt: update ... Upgrading staticcheck upgraded golang.org/x/sync (one downside of mixing our tools in with our regular go.mod), which introduced a new dependency via https://go-review.googlesource.com/c/sync/+/251677 That CL could and probably should be written without runtime/debug, but it's not clear to me that that is better at this moment than simply accepting the additional package as a dependency. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Aleksandar Pesic	4749a96a5b	Update depaware.txt files. ... Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Brad Fitzpatrick	bce865b61b	logpolicy: migrate from x/crypto/ssh/terminal to x/term	4 years ago
Brad Fitzpatrick	c0af7deb86	tailcfg, cmd/tailscale: add Hostinfo.ShareeNode, hide in "tailscale status"	4 years ago
Josh Bleecher Snyder	aa9d7f4665	tstime: add Parse3339B, for byte slices ... Use go4.org/mem for memory safety. A slight performance hit, but a huge performance win for clients who start with a []byte. The perf hit is due largely to the MapHash call, which adds ~25ns. That is necessary to keep the fast path allocation-free. name old time/op new time/op delta GoParse3339/Z-8 281ns ± 1% 283ns ± 2% ~ (p=0.366 n=9+9) GoParse3339/TZ-8 509ns ± 0% 510ns ± 1% ~ (p=0.059 n=9+9) GoParse3339InLocation-8 330ns ± 1% 330ns ± 0% ~ (p=0.802 n=10+6) Parse3339/Z-8 69.3ns ± 1% 74.4ns ± 1% +7.45% (p=0.000 n=9+10) Parse3339/TZ-8 110ns ± 1% 140ns ± 3% +27.42% (p=0.000 n=9+10) ParseInt-8 8.20ns ± 1% 8.17ns ± 1% ~ (p=0.452 n=9+9) name old alloc/op new alloc/op delta GoParse3339/Z-8 0.00B 0.00B ~ (all equal) GoParse3339/TZ-8 160B ± 0% 160B ± 0% ~ (all equal) GoParse3339InLocation-8 0.00B 0.00B ~ (all equal) Parse3339/Z-8 0.00B 0.00B ~ (all equal) Parse3339/TZ-8 0.00B 0.00B ~ (all equal) name old allocs/op new allocs/op delta GoParse3339/Z-8 0.00 0.00 ~ (all equal) GoParse3339/TZ-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) GoParse3339InLocation-8 0.00 0.00 ~ (all equal) Parse3339/Z-8 0.00 0.00 ~ (all equal) Parse3339/TZ-8 0.00 0.00 ~ (all equal) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	8f76548fd9	tempfork/osexec: remove old fork of os/exec ... This package was a temporary fork of os/exec to fix an EINTR loop bug that was fixed upstream for Go 1.15 in 8c1db77a92 (https://go-review.googlesource.com/c/go/+/232862), in src/os/exec_unix.go: 8c1db77a92 (diff-72072cbd53a7240debad8aa506ff7ec795f9cfac7322e779f9bac29a4d0d0bd4)	4 years ago
Brad Fitzpatrick	51c8fd1dfc	logpolicy: add -race suffix to Go version when race detector in use	4 years ago
Brad Fitzpatrick	7a01cd27ca	net/netstat: remove some unsafe ... Just removing any unnecessary unsafe while auditing unsafe usage for #921.	4 years ago
Brad Fitzpatrick	45d96788b5	net/netns: remove use of unsafe on Windows ... Found while auditing unsafe for #921 via the list at: https://github.com/tailscale/tailscale/issues/921#issuecomment-727365383 No need for unsafe here, so remove it.	4 years ago
Brad Fitzpatrick	a2d78b4d3e	net/dnscache, control/controlclient: use DNS cache when dialing control ... Cache DNS results of earlier login.tailscale.com control dials, and use them for future dials if DNS is slow or broken. Fixes various issues with trickier setups with the domain's DNS server behind a subnet router. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	97e82c6cc0	net/netcheck: remove unused DNSCache from netcheck ... It's easy to add back later if/when the TODO is implemented.	4 years ago
Avery Pennarun	f99f6608ff	Reverse earlier "allow tag without 'tag:' prefix" changes. ... These accidentally make the tag syntax more flexible than was intended, which will create forward compatibility problems later. Let's go back to the old stricter parser. Revert "cmd/tailscale/cli: fix double tag: prefix in tailscale up" Revert "cmd/tailscale/cli, tailcfg: allow tag without "tag:" prefix in 'tailscale up'" This reverts commit a702921620. This reverts commit cd07437ade. Affects #861. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
David Anderson	7988f75b87	tailscaled.service: also cleanup prior to starting. ... Fixes #813. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	427bf2134f	net/packet: rename from wgengine/packet. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	ebd96bf4a9	wgengine/router/dns: use OpenKeyWait to set DNS configuration. ... Fixes tailscale/corp#839. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	696e160cfc	cmd/tailscale/cli: fix double tag: prefix in tailscale up ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	01ee638cca	Change some os.IsNotExist to errors.Is(err, os.ErrNotExist) for non-os errors. ... os.IsNotExist doesn't unwrap errors. errors.Is does. The ioutil.ReadFile ones happened to be fine but I changed them so we're consistent with the rule: if the error comes from os, you can use os.IsNotExist, but from any other package, use errors.Is. (errors.Is always would also work, but not worth updating all the code) The motivation here was that we were logging about failure to migrate legacy relay node prefs file on startup, even though the code tried to avoid that. See golang/go#41122	4 years ago
Brad Fitzpatrick	7e1a146e6c	cmd/tailscaled: update depaware.txt	4 years ago
David Anderson	54e6c3a290	version: use OSS repo's version when building. ... When building with redo, also include the git commit hash from the proprietary repo, so that we have a precise commit that identifies all build info (including Go toolchain version). Add a top-level build script demonstrating to downstream distros how to burn the right information into builds. Adjust `tailscale version` to print commit hashes when available. Fixes #841. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	cd07437ade	cmd/tailscale/cli, tailcfg: allow tag without "tag:" prefix in 'tailscale up' ... Fixes #861	4 years ago
Brad Fitzpatrick	7c8ca28c74	ipn: use cmd/cloner for Prefs.Clone ... Also, make cmd/cloner's top-level "func Clone" generation opt-in. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	86c271caba	types/logger: move RusagePrefixLog to logger package, disable by default ... The RusagePrefixLog is rarely useful, hasn't been useful in a long time, is rarely the measurement we need, and is pretty spammy (and syscall-heavy). Disable it by default. We can enable it when we're debugging memory.	4 years ago
Alex Brainman	f2ce64f0c6	wgengine/router: unfork winipcfg-go package, use upstream ... Use golang.zx2c4.com/wireguard/windows/tunnel/winipcfg instead of github.com/tailscale/winipcfg-go package. Updates #760 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>	4 years ago
Brad Fitzpatrick	515866d7c6	ipn, ipnserver, cmd/tailscale: add "server mode" support on Windows ... This partially (but not yet fully) migrates Windows to tailscaled's StateStore storage system. This adds a new bool Pref, ForceDaemon, defined as: // ForceDaemon specifies whether a platform that normally // operates in "client mode" (that is, requires an active user // logged in with the GUI app running) should keep running after the // GUI ends and/or the user logs out. // // The only current applicable platform is Windows. This // forced Windows to go into "server mode" where Tailscale is // running even with no users logged in. This might also be // used for macOS in the future. This setting has no effect // for Linux/etc, which always operate in daemon mode. Then, when ForceDaemon becomes true, we now write use the StateStore to track which user started it in server mode, and store their prefs under that key. The ipnserver validates the connections/identities and informs that LocalBackend which userid is currently in charge. The GUI can then enable/disable server mode at runtime, without using the CLI. But the "tailscale up" CLI was also fixed, so Windows users can use authkeys or ACL tags, etc. Updates #275	4 years ago
Josh Bleecher Snyder	a5103a4cae	all: upgrade to latest version of depaware	4 years ago
Josh Bleecher Snyder	38dda1ea9e	all: update depaware.txt ... Broken by 8051ecff55. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	90b7293b3b	ipn: add/move some constants, update a comment ... And make the StateStore implementations be Stringers, for error messages.	4 years ago
Brad Fitzpatrick	8b94a769be	cmd/tailscaled: use the standard flag page instead of getopt ... Per discussion with @crawshaw. The CLI tool already used std flag anyway. If either of them, it would've made more sense for the CLI to use getopt.	4 years ago
Josh Bleecher Snyder	6e8328cba5	wgengine/tsdns: replace connections when net link changes (macOS) ... When the network link changes, existing UDP sockets fail immediately and permanently on macOS. The forwarder set up a single UDP conn and never changed it. As a result, any time there was a network link change, all forwarded DNS queries failed. To fix this, create a new connection when send requests fail because of network unreachability. This change is darwin-only, although extended it to other platforms should be straightforward. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	3528d28ed1	wgengine/router: move Tailscale's winipcfg additions into wgengine/router ... Part of unforking our winipcfg-go and using upstream (#760), move our additions into our repo. (We might upstream them later if upstream has interest) Originally these were: @apenwarr: "Add ifc.SyncAddresses() and SyncRoutes()." 609dcf2df5 @bradfitz: "winipcfg: make Interface.AddRoutes do as much as possible, return combined error" e9f93d53f3 @bradfitz: "prevent unnecessary Interface.SyncAddresses work; normalize IPNets in deltaNets" decb9ee8e1	4 years ago
Brad Fitzpatrick	3bdcfa7193	ipn: remove DisableDERP pref ... We depend on DERP for NAT traversal now[0] so disabling it entirely can't work. What we'll do instead in the future is let people specify alternate/additional DERP servers. And perhaps in the future we could also add a pref for nodes to say when they expect to never need/want to use DERP for data (but allow it for NAT traversal communication). But this isn't the right pref and it doesn't work, so delete it. Fixes #318 [0] https://tailscale.com/blog/how-nat-traversal-works/	4 years ago
Christina Wen	f0e9dcdc0a	wgengine/router: restore /etc/resolv.conf after tailscale down is called ... This change is to restore /etc/resolv.conf after tailscale down is called. This is done by setting the dns.Manager before errors occur. Error collection is also added. Fixes #723	4 years ago