412 Commits (da8def8e13d44df0c4183300c826523ba933cb37)

Author	SHA1	Message	Date
Brad Fitzpatrick	506c727e30	ipnlocal, net/{dns,tsaddr,tstun}, wgengine: support MagicDNS on IPv6 ... Fixes #3660 RELNOTE=MagicDNS now works over IPv6 when CGNAT IPv4 is disabled. Change-Id: I001e983df5feeb65289abe5012dedd177b841b45 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b09000ad5d	ipn/localapi: add debug handler to Rebind, ReSTUN magicsock ... And more later probably. Updates #3619 Change-Id: Ia4cba34a7c0dcce4d2eddec8aae17f32b51c207f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	0aa4c6f147	net/dns/resolver: add debug HTML handler to see what DNS traffic was forwarded ... Change-Id: I6b790e92dcc608515ac8b178f2271adc9fd98f78 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ae319b4636	wgengine/magicsock: add HTML debug handler to see magicsock state ... Change-Id: Ibc46f4e9651e1c86ec6f5d139f5e9bdc7a488415 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Josh Bleecher Snyder	add6dc8ccc	ipn/ipnlocal: make TestShrinkDefaultRoute hermetic ... Make shrinkDefaultRoute a pure function. Instead of calling interfaceRoutes, accept that information as parameters. Hard-code those parameters in TestShrinkDefaultRoute. Fixes #3580 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	2 years ago
Brad Fitzpatrick	8f43ddf1a2	ipn/ipnlocal, health: populate self node's Online bit in tailscale status ... One option was to just hide "offline" in the text output, but that doesn't fix the JSON output. The next option was to lie and say it's online in the JSON (which then fixes the "offline" in the text output). But instead, this sets the self node's "Online" to whether we're in an active map poll. Fixes #3564 Change-Id: I9b379989bd14655198959e37eec39bb570fb814a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Josh Bleecher Snyder	93ae11105d	ipn/ipnlocal: clear magicsock's netmap on logout ... magicsock was hanging onto its netmap on logout, which caused tailscale status to display partial information about a bunch of zombie peers. After logout, there should be no peers. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	2 years ago
Brad Fitzpatrick	aac974a5e5	ipn/ipnlocal: deflake (mostly) TestStateMachine ... I'm sick of this flaking. Even if this isn't the right fix, it stops the alert fatigue. Updates #3020 Change-Id: I4001c127d78f1056302f7741adec34210a72ee61 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	486059589b	all: gofmt -w -s (simplify) tests ... And it updates the build tag style on a couple files. Change-Id: I84478d822c8de3f84b56fa1176c99d2ea5083237 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	cced414c7d	net/dns/resolver: add Windows ExitDNS service support, using net package ... Updates #1713 Updates #835 Change-Id: Ia71e96d0632c2d617b401695ad68301b07c1c2ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7b9c7bc42b	ipn/ipnstate: remove old deprecated TailAddr IPv4-only field ... It's been a bunch of releases now since the TailscaleIPs slice replacement was added. Change-Id: I3bd80e1466b3d9e4a4ac5bedba8b4d3d3e430a03 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	878a20df29	net/dns: add GetBaseConfig to CallbackRouter. ... Allow users of CallbackRouter to supply a GetBaseConfig implementation. This is expected to be used on Android, which currently lacks both a) platform support for Split-DNS and b) a way to retrieve the current DNS servers. iOS/macOS also use the CallbackRouter but have platform support for SplitDNS, so don't need getBaseConfig. Updates https://github.com/tailscale/tailscale/issues/2116 Updates https://github.com/tailscale/tailscale/issues/988 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	c0701b130d	ipn/ipnstate, cmd/tailscale: add Online bool to tailscale status & --json ... Fixes #3533 Change-Id: I2f6f0d712cf3f987fba1c15be74cdb5c8d565f04 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Todd Neal	c18dc57861	ipn/{ipnserver,ipnlocal}: support incoming Taildrop on TrueNAS ... Signed-off-by: Todd Neal <todd@tneal.org>	3 years ago
Brad Fitzpatrick	d3d503d997	ipn/ipnlocal: add HTTP/2 h2c server support to peerapi on non-mobile platforms ... To make ExitDNS cheaper. Might not finish client-side support in December before 1.20, but at least server support can start rolling out ahead of clients being ready for it. Tested with curl against peerapi. Updates #1713 Change-Id: I676fed5fb1aef67e78c542a3bc93bddd04dd11fe Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	abc00e9c8d	ipn/{ipnserver,ipnlocal}: support incoming Taildrop on Synology ... If the user has a "Taildrop" shared folder on startup and the "tailscale" system user has read/write access to it, then the user can "tailscale file cp" to their NAS. Updates #2179 (would be fixes, but not super ideal/easy yet) Change-Id: I68e59a99064b302abeb6d8cc84f7d2a09f764990 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9c5c9d0a50	ipn/ipnlocal, net/tsdial: make SOCKS/HTTP dials use ExitDNS ... And simplify, unexport some tsdial/netstack stuff in the the process. Fixes #3475 Change-Id: I186a5a5cbd8958e25c075b4676f7f6e70f3ff76e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	adc5997592	net/tsdial: give netstack a Dialer, start refactoring name resolution ... This starts to refactor tsdial.Dialer's name resolution to have different stages: in-memory MagicDNS vs system resolution. A future change will plug in ExitDNS resolution. This also plumbs a Dialer into netstack and unexports the dnsMap internals. And it removes some of the async AddNetworkMapCallback usage and replaces it with synchronous updates of the Dialer's netmap from LocalBackend, since the LocalBackend has the Dialer too. Updates #3475 Change-Id: Idcb7b1169878c74f0522f5151031ccbc49fe4cb4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	43983a4a3b	ipn/ipnlocal: run peerapi even if Taildrop storage not configured ... Change-Id: I77f9ecbe4617d01d13aa1127fa59c83f2aa3e1b8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	44d0c1ab06	ipn/ipnlocal: resolve exit node IP to ID at EditPrefs time. ... Without this, enabling an exit node immediately blackholes all traffic, but doesn't correctly let it flow to the exit node until the next netmap update. Fixes #3447 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	ad3d6e31f0	net/tsdial: move macOS/iOS peerapi sockopt logic from LocalBackend ... Change-Id: I812cae027c40c70cdc701427b1a1850cd9bcd60c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c7fb26acdb	net/tsdial: also plumb TUN name and monitor into tsdial.Dialer ... In prep for moving stuff out of LocalBackend. Change-Id: I9725aa9c3ebc7275f8c40e040b326483c0340127 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c37af58ea4	net/tsdial: move more weirdo dialing into new tsdial package, plumb ... Not done yet, but this move more of the outbound dial special casing from random packages into tsdial, which aspires to be the one unified place for all outbound dialing shenanigans. Then this plumbs it all around, so everybody is ultimately holding on to the same dialer. As of this commit, macOS/iOS using an exit node should be able to reach to the exit node's DoH DNS proxy over peerapi, doing the sockopt to stay within the Network Extension. A number of steps remain, including but limited to: * move a bunch more random dialing stuff * make netstack-mode tailscaled be able to use exit node's DNS proxy, teaching tsdial's resolver to use it when an exit node is in use. Updates #1713 Change-Id: I1e8ee378f125421c2b816f47bc2c6d913ddcd2f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3ae6f898cf	ipn/ipnlocal, net/dns/resolver: use exit node's DoH proxy when available ... Updates #1713 Change-Id: I3695a40ec12d2b4e6dac41cf4559daca6dddd68e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	16abd7e07c	ipn/ipnlocal: fix Content-Length in DoH DNS proxy response ... Updates #1713 Change-Id: I912d90383b751ad97b32bcec55e8fedbcf4d3db8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2a95ee4680	cmd/tailscale, ipn/ipnstate: note which nodes are exit nodes in status ... Fixes #3446 Change-Id: Ib41d588e7fa434c02d134fa449f85b0e15083683 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b811a316bc	tailcfg, ipn/ipnlocal: advertise a Service when exit node DNS proxy available ... Updates #1713 Change-Id: I20c8e2ad1062d82ef17363414e372133f4c7181e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	135580a5a8	tailcfg, ipn/ipnlocal, net/dns: forward exit node DNS on Unix to system DNS ... Updates #1713 Change-Id: I4c073fec0992d9e01a9a4ce97087d5af0efdc68d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c2efe46f72	ipn/ipnlocal: restrict exit node DoH server based on ACL'ed packet filter ... Don't be a DoH DNS server to peers unless the Tailnet admin has permitted that peer autogroup:internet access. Updates #1713 Change-Id: Iec69360d8e4d24d5187c26904b6a75c1dabc8979 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	097602b3ca	ipn/ipnlocal: warn more precisely about IP forwarding issues on linux. ... If IP forwarding is disabled globally, but enabled per-interface on all interfaces, don't complain. If only some interfaces have forwarding enabled, warn that some subnet routing/exit node traffic may not work. Fixes #1586 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	33c541ae30	ipn/ipnlocal: populate self status from netmap in ipnlocal, not magicsock. ... Fixes #1933 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	25525b7754	net/dns/resolver, ipn/ipnlocal: wire up peerapi DoH server to DNS forwarder ... Updates #1713 Change-Id: Ia4ed9d8c9cef0e70aa6d30f2852eaab80f5f695a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	955aa188b3	ipn/ipnlocal: fix logging ... We were missing an argument here. Also, switch to %q, in case anything weird is happening with these strings. Updates tailscale/corp#461 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	283ae702c1	ipn/ipnlocal: start adding DoH DNS server to peerapi when exit node ... Updates #1713 Change-Id: I8d9c488f779e7acc811a9bc18166a2726198a429 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4a59a2781a	ipn/ipnlocal: export client metrics over peerapi to owner ... Updates #3307 Change-Id: I41b1f3c16af5f385575e8d6cea70ae8386504dd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	d6dde5a1ac	ipn/ipnlocal: handle key extensions after key has already expired ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	337757a819	ipn/ipnlocal, control/controlclient: don't propagate all map errors to UI ... Fixes regression from 81cabf48ec which made all map errors be sent to the frontend UI. Fixes #3230 Change-Id: I7f142c801c7d15e268a24ddf901c3e6348b6729c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	0532eb30db	all: replace tailcfg.DiscoKey with key.DiscoPublic. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	649f7556e8	cmd/tailscaled, ipn: add tailscaled --statedir flag for var directory ... Fixes #2932 Change-Id: I1aa2b323ad542386d140f8336bcc4dcbb8310bd0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c7bff35fee	ipn/ipnlocal: add owner-only debug handler to get process env ... For debugging Synology. Like the existing goroutines handler, in that it's owner-only. Change-Id: I852f0626be8e1c0b6794c1e062111d14adc3e6ac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	3fd5f4380f	util/multierr: new package ... github.com/go-multierror/multierror served us well. But we need a few feature from it (implement Is), and it's not worth maintaining a fork of such a small module. Instead, I did a clean room implementation inspired by its API. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Anderson	7e6a1ef4f1	tailcfg: use key.NodePublic in wire protocol types. ... Updates #3206. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	7e8d5ed6f3	ipn: use key.NodePublic instead of tailcfg.NodeKey ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	c17250cee2	ipn/ipnstate: use key.NodePublic instead of tailcfg.NodeKey. ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	418adae379	various: use NodePublic.AsNodeKey() instead of tailcfg.NodeKeyFromNodePublic() ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	eeb97fd89f	various: remove remaining uses of key.NewPrivate. ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	429632d32c	ipn/ipnlocal: treat js/wasm interative logins as ephemeral for now ... At least until js/wasm starts using browser LocalStorage or something. But for the foreseeable future, any login from a browser should be considered ephemeral as the tab can close at any time and lose the wireguard key, never to be seen again. Updates #3157 Change-Id: I6c410d86dc7f9f233c3edd623313d9dee2085aac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	c1d009b9e9	ipn/ipnstate: use key.NodePublic instead of the generic key.Public. ... Updates #3206. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	0c546a28ba	types/persist: use new node key type. ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maisem Ali	81cabf48ec	control/controlclient,tailcfg: propagate registration errors to the frontend ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	c6d3f622e9	ipn/ipnlocal: use netaddr.IPSetBuilder when constructing list of interface IPPrefixes. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	ddf3394b40	ipn/ipnlocal: don't try to block localhost traffic when using exit nodes ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cb4a2c00d1	ipn: remove unused Prefs.OSVersion and Prefs.DeviceModel ... iOS and Android no longer use these. They both now (as of today) use the hostinfo.SetFoo setters instead. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	67e5fabdbd	hostinfo, ipn/ipnlocal: add SetPackage, remove ipnlocal hacks ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	81269fad28	hostinfo: add SetOSVersion like SetDeviceModel, deprecate ipn.Prefs way ... Turns out the iOS client has been only sending the OS version it first started at. This whole hostinfo-via-prefs mechanism was never a good idea. Start removing it. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	22a1a5d7cf	ipn/ipnlocal: for IPv6-only nodes, publish IPv6 MagicDNS records of peers ... See https://github.com/tailscale/tailscale/issues/2970#issuecomment-931885268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6d43cbc325	ipn/ipnlocal: make sure mobile clients don't use the old control server URL ... The new frontends are better for battery. Updates #2442 Updates tailscale/corp#2750 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3b3994f0db	ipn{,/localapi,ipnlocal}: infer cert dir from state file location ... This fixes "tailscale cert" on Synology where the var directory is typically like /volume2/@appdata/Tailscale, or any other tailscaled user who specifies a non-standard state file location. This is a interim fix on the way to #2932. Fixes #2927 Updates #2932 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	aae622314e	tailcfg, health: add way for control plane to add problems to health check ... So if the control plane knows that something's broken about the node, it can include problem(s) in MapResponse and "tailscale status" will show it. (and GUIs in the future, as it's in ipnstate.Status/JSON) This also bumps the MapRequest.Version, though it's not strictly required. Doesn't hurt. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	07c09f470d	ipn/ipnlocal: do not shut down the backend halfway through TestStateMachine ... LocalBackend.Shutdown's docs say: > The backend can no longer be used after Shutdown returns. Nevertheless, TestStateMachine blithely calls Shutdown, talks some smack, and continues on, expecting things to work. Other uses of Shutdown in the codebase are as intended. Things mostly kinda work anyway, except that the wgengine.Engine has been shut down, so calls to Reconfig fail. Those get logged: > local.go:603: wgengine status error: engine closing; no status but otherwise ignored. However, the Reconfig failure caused one fewer call to pause/unpause than normal. Now the assertCalls lines match the equivalent ones earlier in the test. I don't see an obvious correct replacement for Shutdown in the context of this test; I'm not sure entirely what it is trying to accomplish. It is possible that many of the tests remaining after the prior call to Shutdown are now extraneous. They don't harm anything, though, so err on the side of safety and leave them for now. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	f834a4ade5	ipn/ipnlocal: fix minor typo in comment ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	221cc5f8f2	ipn/ipnlocal: reduce line noise in tests ... Use helpers and variadic functions to make the call sites a lot easier to read, since they occur a lot. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	45d3174c0d	ipn/ipnlocal: add LocalBackend.broadcastStatusChanged ... To reduce repetition. Also, document why we acquire the lock. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	b7ede14396	Revert "ipn/ipnlocal: remove locks around sync.Cond.Broadcast call" ... Reason for revert: Causes ipnlocal tests to deadlock intermittently. This reverts commit 1b15349e01. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	3ea8cf9c62	ipn/ipnlocal: use quicktest.IsNotNil in tests ... This didn't exist when the test was written. Now it does (frankban/quicktest#94); use it. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	1b15349e01	ipn/ipnlocal: remove locks around sync.Cond.Broadcast call ... They are unnecessary. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	3b58c118dd	ipn/ipnlocal: inline LocalBackend.getEngineStatus ... For uniformity. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	0f4c0e558b	ipn/ipnlocal: use a switch statement instead of an else-if chain ... For clarity. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	7421ba91ec	ipn/ipnlocal: only call UpdateEndpoints when the endpoints change ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	b681edc572	ipn/ipnlocal: add failing test ... Concurrent calls to LocalBackend.setWgengineStatus could result in some of the status updates being dropped. This was exacerbated by 92077ae78c, which increases the probability of concurrent status updates, causing test failures (tailscale/corp#2579). It's going to take a bit of work to fix this test. The ipnlocal state machine is difficult to reason about, particularly in the face of concurrency. We could fix the test trivially by throwing a new mutex around setWgengineStatus to serialize calls to it, but I'd like to at least try to do better than cosmetics. In the meantime, commit the test. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	7693d36aed	all: close fake userspace engines when tests complete ... We were leaking FDs. In a few places, switch from defer to t.Cleanup. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	640134421e	all: update tests to use tstest.MemLogger ... And give MemLogger a mutex, as one caller had, which does match the logf contract better. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	48933b0382	ipn/ipnlocal: flesh out the dnsConfigForNetmap tests ... Follow-up to #2805 and #2806 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7fe6ecf165	ipn/ipnlocal: add MagicDNS records for IPv6-only nodes ... Updates #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	90b0cd0c51	ipn/ipnlocal: start adding some netmap to DNS config tests ... Follow-up to #2805 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	30a614f9b9	ipn/ipnlocal: return early, outdent a bunch in dnsConfigForNetmap ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2bb0eb5f7e	ipn/ipnlocal: pull out dns.Config construction to its own func ... In prep for other bug fixes & tests. It's hard to test when it was intermingled into LocalBackend.authReconfig. Now it's a pure function. And rename variable 'uc' (user config?) to the since idiomatic 'prefs'. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	9502b515f1	net/dns: replace resolver IPs with type for DoH ... We currently plumb full URLs for DNS resolvers from the control server down to the client. But when we pass the values into the net/dns package, we throw away any URL that isn't a bare IP. This commit continues the plumbing, and gets the URL all the way to the built in forwarder. (It stops before plumbing URLs into the OS configurations that can handle them.) For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Dave Anderson	980acc38ba	types/key: add a special key with custom serialization for control private keys (#2792) ... * Revert "Revert "types/key: add MachinePrivate and MachinePublic."" This reverts commit 61c3b98a24. Signed-off-by: David Anderson <danderson@tailscale.com> * types/key: add ControlPrivate, with custom serialization. ControlPrivate is just a MachinePrivate that serializes differently in JSON, to be compatible with how the Tailscale control plane historically serialized its private key. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	61c3b98a24	Revert "types/key: add MachinePrivate and MachinePublic." ... Broke the tailscale control plane due to surprise different serialization. This reverts commit 4fdb88efe1.	3 years ago
David Anderson	4fdb88efe1	types/key: add MachinePrivate and MachinePublic. ... Plumb throughout the codebase as a replacement for the mixed use of tailcfg.MachineKey and wgkey.Private/Public. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	5bacbf3744	wgengine/magicsock, health, ipn/ipnstate: track DERP-advertised health ... And add health check errors to ipnstate.Status (tailscale status --json). Updates #2746 Updates #2775 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	88bd796622	tailcfg,ipn/ipnlocal: support DNSConfig.Routes with empty values [mapver 23] ... Fixes #2706 Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Matt Drollette	c1aa5a2e33	ipn/ipnlocal: update requested tags in host info ... Fixes #2641 Signed-off-by: Matt Drollette <matt@drollette.com>	3 years ago
Brad Fitzpatrick	47045265b9	hostinfo: add SetDeviceModel setter, move remaining code from controlclient ... Updates tailscale/corp#1959 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Simeng He	e199e407d2	tailcfg: add IP and Types field to PingRequest ... Signed-off-by: Simeng He <simeng@tailscale.com>	3 years ago
Josh Bleecher Snyder	a666b546fb	ipn/ipnlocal: log number of packet filters rather than entire filter ... The number of packet filters can grow very large, so this log entry can be very large. We can get the packet filter server-side, so reduce verbosity here to just the number of filters present. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	a24cee0d67	all: simplify ts_macext build tags ... Now that we have the easier-to-parse go:build build tags, it is straightforward to simplify them. Yay. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Crawshaw	360223fccb	types/dnstype: introduce new package for Resolver ... So the type can be used in net/dns without introducing a tailcfg dependency. For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Josh Bleecher Snyder	a5da4ed981	all: gofmt with Go 1.17 ... This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Crawshaw	0554b64452	ipnlocal: allow access to guest VMs/containers while using an exit node ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	690ade4ee1	ipn/ipnlocal: add URL to IP forwarding error message ... Updates #606 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7428ecfebd	ipn/ipnlocal: populate Hostinfo.Package on Android ... Fixes tailscale/corp#2266 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Joe Tsai	9a0c8bdd20	util/deephash: make hash type opaque ... The fact that Hash returns a [sha256.Size]byte leaks details about the underlying hash implementation. This could very well be any other hashing algorithm with a possible different block size. Abstract this implementation detail away by declaring an opaque type that is comparable. While we are changing the signature of UpdateHash, rename it to just Update to reduce stutter (e.g., deephash.Update). Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Brad Fitzpatrick	b6d70203d3	ipn/ipnlocal: fix 'tailscale up' on Windows without GUI ... With this, I can now: * install Tailscale * stop the GUI * net stop Tailscale * net start Tailscale * tailscale up --unattended (where the middle three steps simulate what would happen on a Windows Server Core machine without a GUI) Fixes #2137 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Avery Pennarun	14135dd935	ipn/ipnlocal: make state_test catch the bug fixed by #2445 ... Updates #2434 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Brad Fitzpatrick	6eecf3c9d1	ipn/ipnlocal: stay out of map poll when down ... Fixes #2434 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	01e159b610	ipn/ipnlocal: save prefs to disk on UpdatePrefs ... Regression from 6d10655dc3, which added UpdatePrefs but didn't write it out to disk. I'd planned on adding tests to state_test.go which is why I'd earlier added 46896a9311 to prepare for making such persistence tests easier to write, but turns out state_test.go didn't even test UpdatePrefs, so I'm staying out of there. Instead, this is tested using integration tests. Fixes #2321 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	46896a9311	ipn/ipnlocal: start to test whether all state transitions save prefs to disk ... Updates #2321 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	805d5d3cde	ipnlocal: move log line inside if statement ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	700badd8f8	util/deephash: move internal/deephash to util/deephash ... No code changes. Just a minor package doc addition about lack of API stability.	3 years ago
Josh Bleecher Snyder	f11a8928a6	ipn/ipnlocal: fix data race ... We can't access b.netMap without holding b.mu. We already grabbed it earlier in the function with the lock held. Introduced in Nov 2020 in 7ea809897d. Discovered during stress testing. Apparently it's a pretty rare? Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Maisem Ali	ec52760a3d	wgengine/router_windows: support toggling local lan access when using ... exit nodes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
julianknodt	506c2fe8e2	cmd/tailscale: make netcheck use active DERP map, delete static copy ... After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	45e64f2e1a	net/dns{,/resolver}: refactor DNS forwarder, send out of right link on macOS/iOS ... Fixes #2224 Fixes tailscale/corp#2045 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	4ce15505cb	wgengine: randomize client port if netmap says to ... For testing out #2187 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	297b3d6fa4	staticcheck.conf: turn off noisy lint errors ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	0debb99f08	tailcfg: add DNSConfig.ExtraRecords ... Updates #1748 Updates #1235 Updates #2055 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	f482321f67	ipn/ipnlocal: support exit node local access switching on darwin. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	cd282ec00f	tailcfg: add DNSConfig.CertDomains ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cc6ab0a70f	ipn/ipnlocal: retry peerapi listen on Android, like we do on Windows ... Updates #1960 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e29cec759a	ipn/{ipnlocal,localapi}, control/controlclient: add SetDNS localapi ... Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ecfb2639cc	ipn/ipnlocal: avoid initPeerAPIListener crash on certain concurrent actions ... We were crashing on in initPeerAPIListener when called from authReconfig when b.netMap is nil. But authReconfig already returns before the call to initPeerAPIListener when b.netMap is nil, but it releases the b.mu mutex before calling initPeerAPIListener which reacquires it and assumes it's still nil. The only thing that can be setting it to nil is setNetMapLocked, which is called by ResetForClientDisconnect, Logout/logout, or Start, all of which can happen during an authReconfig. So be more defensive. Fixes #1996 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	713c5c9ab1	net/{interfaces,netns}: change which build tag means mac/ios Network/System Extension ... We used to use "redo" for that, but it was pretty vague. Also, fix the build tags broken in interfaces_default_route_test.go from a9745a0b68, moving those Linux-specific tests to interfaces_linux_test.go. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a321c24667	go.mod: update netaddr ... Involves minor IPSetBuilder.Set API change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Avery Pennarun	eaa6507cc9	ipnlocal: in Start() fast path, don't forget to send Prefs. ... The resulting empty Prefs had AllowSingleHosts=false and Routeall=false, so that on iOS if you did these steps: - Login and leave running - Terminate the frontend - Restart the frontend (fast path restart, missing prefs) - Set WantRunning=false - Set WantRunning=true ...then you would have Tailscale running, but with no routes. You would also accidentally disable the ExitNodeID/IP prefs (symptom: the current exit node setting didn't appear in the UI), but since nothing else worked either, you probably didn't notice. The fix was easy enough. It turns out we already knew about the problem, so this also fixes one of the BUG entries in state_test. Fixes: #1918 (BUG-1) and some as-yet-unreported bugs with exit nodes. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	8a7d35594d	ipnlocal: don't assume NeedsLogin immediately after StartLogout(). ... Previously, there was no server round trip required to log out, so when you asked ipnlocal to Logout(), it could clear the netmap immediately and switch to NeedsLogin state. In v1.8, we added a true Logout operation. ipn.Logout() would trigger an async cc.StartLogout() and *also* immediately switch to NeedsLogin. Unfortunately, some frontends would see NeedsLogin and immediately trigger a new StartInteractiveLogin() operation, before the controlclient auth state machine actually acted on the Logout command, thus accidentally invalidating the entire logout operation, retaining the netmap, and violating the user's expectations. Instead, add a new LogoutFinished signal from controlclient (paralleling LoginFinished) and, upon starting a logout, don't update the ipn state machine until it's received. Updates: #1918 (BUG-2) Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Brad Fitzpatrick	a04801e037	ipn/ipnlocal: ignore NetfilterMode pref on Synology ... On clean installs we didn't set use iptables, but during upgrades it looks like we could use old prefs that directed us to go into the iptables paths that might fail on Synology. Updates #1995 Fixes tailscale/tailscale-synology#57 (I think) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Elias Naur	adfe8cf41d	paths: generalize IOSSharedDir to cover Android ... Also fix an error message while here. Signed-off-by: Elias Naur <mail@eliasnaur.com>	3 years ago
David Anderson	df350e2069	ipn/ipnlocal: initialize DNS config maps unconditionally. ... Fixes #1963. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e2dcf63420	net/dns: replace AuthoritativeSuffixes with nil Route entries. ... This leads to a cleaner separation of intent vs. implementation (Routes is now the only place specifying who handles DNS requests), and allows for cleaner expression of a configuration that creates MagicDNS records without serving them to the OS. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	6690f86ef4	net/dns: always offer MagicDNS records at 100.100.100.100. ... Fixes #1886. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types ... This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Avery Pennarun	6fd4e8d244	ipnlocal: fix switching users while logged in + Stopped. ... This code path is very tricky since it was originally designed for the "re-authenticate to refresh my keys" use case, which didn't want to lose the original session even if the refresh cycle failed. This is why it acts differently from the Logout(); Login(); case. Maybe that's too fancy, considering that it probably never quite worked at all, for switching between users without logging out first. But it works now. This was more invasive than I hoped, but the necessary fixes actually removed several other suspicious BUG: lines from state_test.go, so I'm pretty confident this is a significant net improvement. Fixes tailscale/corp#1756. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	285d0e3b4d	ipnlocal: fix deadlock in RequestEngineStatusAndWait() error path. ... If the engine was shutting down from a previous session (e.closing=true), it would return an error code when trying to get status. In that case, ipnlocal would never unblock any callers that were waiting on the status. Not sure if this ever happened in real life, but I accidentally triggered it while writing a test. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Brad Fitzpatrick	36a26e6a71	internal/deephash: rename from deepprint ... Yes, it printed, but that was an implementation detail for hashing. And coming optimization will make it print even less. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e72ed3fcc2	ipn/{ipnlocal,ipnstate}: add PeerStatus.ID stable ID to status --json output ... Needed for the "up checker" to map back from exit node stable IDs (the ipn.Prefs.ExitNodeID) back to an IP address in error messages. But also previously requested so people can use it to then make API calls. The upcoming "tailscale admin" subcommand will probably need it too. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	78d4c561b5	types/logger: add key grinder stats lines to rate-limiting exemption list ... Updates #1749 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Avery Pennarun	6d10655dc3	ipnlocal: accept a new opts.UpdatePrefs field. ... This is needed because the original opts.Prefs field was at some point subverted for use in frontend->backend state migration for backward compatibility on some platforms. We still need that feature, but we also need the feature of providing the full set of prefs from `tailscale up`, *not* including overwriting the prefs.Persist keys, so we can't use the original field from `tailscale up`. `tailscale up` had attempted to compensate for that by doing SetPrefs() before Start(), but that violates the ipn.Backend contract, which says you should call Start() before anything else (that's why it's called Start()). As a result, doing SetPrefs({ControlURL=..., WantRunning=true}) would cause a connection to the *previous* control server (because WantRunning=true), and then connect to the *new* control server only after running Start(). This problem may have been avoided before, but only by pure luck. It turned out to be relatively harmless since the connection to the old control server was immediately closed and replaced anyway, but it created a race condition that could have caused spurious notifications or rejected keys if the server responded quickly. As already covered by existing TODOs, a better fix would be to have Start() get out of the business of state migration altogether. But we're approaching a release so I want to make the minimum possible fix. Fixes #1840. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Brad Fitzpatrick	4066c606df	ipn/ipnlocal: update peerapi logging of received PUTs ... Clarify direction and add duration. (per chat with Avery) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f5bccc0746	ipn/ipnlocal: redact more errors ... Updates tailscale/corp#1636 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	96ef8d34ef	ipn/ipnlocal: switch from testify to quicktest ... Per discussion, we want to have only one test assertion library, and we want to start by exploring quicktest. This was a mostly mechanical translation. I think we could make this nicer by defining a few helper closures at the beginning of the test. Later. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	3 years ago
Brad Fitzpatrick	544d8d0ab8	ipn/ipnlocal: remove NewLocalBackendWithClientGen ... This removes the NewLocalBackendWithClientGen constructor added in b4d04a065f and instead adds LocalBackend.SetControlClientGetterForTesting, mirroring LocalBackend.SetHTTPTestClient. NewLocalBackendWithClientGen was weird in being exported but taking an unexported type. This was noted during code review: https://github.com/tailscale/tailscale/pull/1818#discussion_r623155669 which ended in: "I'll leave it for y'all to clean up if you find some way to do it elegantly." This is more idiomatic. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Avery Pennarun	0181a4d0ac	ipnlocal: don't pause the controlclient until we get at least one netmap. ... Without this, macOS would fail to display its menu state correctly if you started it while !WantRunning. It relies on the netmap in order to show the logged-in username. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	4ef207833b	ipn: !WantRunning + !LoggedOut should not be idle on startup. ... There was logic that would make a "down" tailscale backend (ie. !WantRunning) refuse to do any network activity. Unfortunately, this makes the macOS and iOS UI unable to render correctly if they start while !WantRunning. Now that we have Prefs.LoggedOut, use that instead. So `tailscale down` will still allow the controlclient to connect its authroutine, but pause the maproutine. `tailscale logout` will entirely stop all activity. This new behaviour is not obviously correct; it's a bit annoying that `tailsale down` doesn't terminate all activity like you might expect. Maybe we should redesign the UI code to render differently when disconnected, and then revert this change. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	4f3315f3da	ipnlocal: setting WantRunning with EditPrefs was special. ... EditPrefs should be just a wrapper around the action of changing prefs, but someone had added a side effect of calling Login() sometimes. The side effect happened *after* running the state machine, which would sometimes result in us going into NeedsLogin immediately before calling cc.Login(). This manifested as the macOS app not being able to Connect if you launched it with LoggedOut=false and WantRunning=false. Trying to Connect() would sent us to the NeedsLogin state instead. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	2a4d1cf9e2	Add prefs.LoggedOut to fix several state machine bugs. ... Fixes: tailscale/corp#1660 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	b0382ca167	ipn/ipnlocal: some state_test cleanups. ... This doesn't change the actual functionality. Just some additional comments and fine tuning. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	ac9cd48c80	ipnlocal: fix deadlock when calling Shutdown() from Start(). ... Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	ecdba913d0	Revert "ipn/ipnlocal: be authoritative for the entire MagicDNS record tree." ... Unfortunately this broke MagicDNS almost entirely. Updates: tailscale/corp#1706 This reverts commit 1d7e7b49eb.	3 years ago
Avery Pennarun	b7e31ab1a4	ipn: mock controlclient.Client; big ipn.Backend state machine test. ... A very long unit test that verifies the way the controlclient and ipn.Backend interact. This is a giant sequential test of the state machine. The test passes, but only because it's asserting all the wrong behaviour. I marked all the behaviour I think is wrong with BUG comments, and several additional test opportunities with TODO. Note: the new test supercedes TestStartsInNeedsLoginState, which was checking for incorrect behaviour (although the new test still checks for the same incorrect behaviour) and assumed .Start() would converge before returning, which it happens to do, but only for this very specific case, for the current implementation. You're supposed to wait for the notifications. Updates: tailscale/corp#1660 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Avery Pennarun	b4d04a065f	controlclient: extract a Client interface and rename Client->Auto. ... This will let us create a mock or fake Client implementation for use with ipn.Backend. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
David Anderson	1d7e7b49eb	ipn/ipnlocal: be authoritative for the entire MagicDNS record tree. ... With this change, shared node names resolve correctly on split DNS-supporting operating systems. Fixes tailscale/corp#1706 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	b7a497a30b	ipn/ipnlocal: make FileTargets check IPN state first ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4bf6939ee0	ipn/ipnlocal: remove t.Parallel from recently added test ... The test modifies a global; it shouldn't be parallel. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a48c8991f1	ipn/ipnlocal: add a test for earlier lazy machine key generation change ... Updates #1573 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	306a094d4b	ipn/ipnlocal: remove IPv6 records from MagicDNS. ... Fixes #1813. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	3bdc9e9cb2	ipn/ipnlocal: prevent a now-expected [unexpected] log message on Windows ... Updates #1620 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	138921ae40	ipn/ipnlocal: always write files to partial files, even in buffered mode ... The intention was always that files only get written to *.partial files and renamed at the end once fully received, but somewhere in the process that got lost in buffered mode and *.partial files were only being used in direct receive mode. This fix prevents WaitingFiles from returning files that are still being transferred. Updates tailscale/corp#1626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5e268e6153	ipn/ipnlocal: use delete marker files to work around Windows delete problems ... If DeleteFile fails on Windows due to another process (anti-virus, probably) having our file open, instead leave a marker file that the file is logically deleted, and remove it from API calls and clean it up lazily later. Updates tailscale/corp#1626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aleksandar Pesic	7c985e4944	ipn/ipnlocal: add file sharing to windows shell ... Updates: tailscale/winmin#33 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	3 years ago
Brad Fitzpatrick	fe53a714bd	ipn/ipnlocal: add a LocalBackend.Start fast path if already running ... Updates tailscale/corp#1621 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ad1a595a75	ipn/ipnlocal: close peer API listeners on transition away from Running ... Updates tailscale/corp#1621 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	36d030cc36	ipn/ipnlocal: use fallback default DNS whenever exit nodes are on. ... Fixes #1625 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	86e85d8934	ipn/ipnlocal: add peerapi goroutine fetch ... Between owners. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2d786821f6	ipn/ipnlocal: put a retry loop around Windows file deletes ... oh, Windows. Updates tailscale/corp#1626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	529ef98b2a	ipn/ipnlocal: fix approxSize operator precedence ... Whoops. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b03c23d2ed	ipn/ipnlocal: log on DeleteFile error ... Updates tailscale/corp#1626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2f17a34242	ipn/ipnlocal: fix tailscale status --json AuthURL field ... It was getting cleared on notify. Document that authURL is cleared on notify and add a new field that isn't, using the new field for the JSON status. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	09891b9868	ipn/ipnlocal: on fresh lazy-connecting install, start in state NeedsLogin ... Fixes #1759 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	6fd9e28bd0	ipn/ipnlocal: add arpa suffixes to MagicDNS for reverse lookups. ... This used to not be necessary, because MagicDNS always did full proxying. But with split DNS, we need to know which names to route to our resolver, otherwise reverse lookups break. This captures the entire CGNAT range, as well as our Tailscale ULA. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	48d4f14652	ipn/ipnlocal: only set authoritative domains when using MagicDNS. ... Otherwise, the existence of authoritative domains forces full DNS proxying even when no other DNS config is present. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	f99e63bb17	ipn: don't Logout when Windows GUI disconnects ... Logout used to be a no-op, so the ipnserver previously synthensized a Logout on disconnect. Now that Logout actually invalidates the node key that was forcing all GUI closes to log people out. Instead, add a method to LocalBackend to specifically mean "the Windows GUI closed, please forget all the state". Fixes tailscale/corp#1591 (ignoring the notification issues, tracked elsewhere) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	1e5c608fae	ipn/ipnlocal: plumb fallback DNS in as a workaround for split DNS issues. ... Cause of #1743. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	3d0599fca0	ipn{,/ipnlocal}: in direct file receive mode, don't rename partial file ... Let caller (macOS) do it so Finder progress bar can be dismissed without races. Updates tailscale/corp#1575 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a58fbb4da9	ipn/ipnlocal: only fix peerapiListener on Windows when running ... It's just logspam otherwise. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	36fa29feec	ipn/ipnlocal: restrict local lan access to linux machines. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	8570f82c8b	ipn/ipnlocal: finish/fix up filename validation & encoding on disk ... It used to just store received files URL-escaped on disk, but that was a half done lazy implementation, and pushed the burden to callers to validate and write things to disk in an unescaped way. Instead, do all the validation in the receive handler and only accept filenames that are UTF-8 and in the intersection of valid names that all platforms support. Fixes tailscale/corp#1594 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cad8df500c	ipn/ipnlocal: add some more peerapi handlePeerPut tests ... Updates tailscale/corp#1594 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0d1550898e	ipn/ipnlocal: add some peerapi tests ... Updates tailscale/corp#1594 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8f3e453356	ipn, cmd/tailscale/cli: add pref to configure sudo-free operator user ... From discussion with @danderson. Fixes #1684 (in a different way) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	49808ae6ea	ipn{,/ipnlocal}, cmd/tailscale/cli: don't check pref reverts on initial up ... The ipn.NewPrefs func returns a populated ipn.Prefs for historical reasons. It's not used or as important as it once was, but it hasn't yet been removed. Meanwhile, it contains some default values that are used on some platforms. Notably, for this bug (#1725), Windows/Mac use its Prefs.RouteAll true value (to accept subnets), but Linux users have always gotten a "false" value for that, because that's what cmd/tailscale's CLI default flag is _for all operating systems_. That meant that "tailscale up" was rightfully reporting that the user was changing an implicit setting: RouteAll was changing from true with false with the user explicitly saying so. An obvious fix might be to change ipn.NewPrefs to return Prefs.RouteAll == false on some platforms, but the logic is complicated by darwin: we want RouteAll true on windows, android, ios, and the GUI mac app, but not the CLI tailscaled-on-macOS mode. But even if we used build tags (e.g. the "redo" build tag) to determine what the default is, that then means we have duplicated and differing "defaults" between both the CLI up flags and ipn.NewPrefs. Furthering that complication didn't seem like a good idea. So, changing the NewPrefs defaults is too invasive at this stage of the release, as is removing the NewPrefs func entirely. Instead, tweak slightly the semantics of the ipn.Prefs.ControlURL field. This now defines that a ControlURL of the empty string means both "we're uninitialized" and also "just use the default". Then, once we have the "empty-string-means-unintialized" semantics, use that to suppress "tailscale up"'s recent implicit-setting-revert checking safety net, if we've never initialized Tailscale yet. And update/add tests. Fixes #1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b993d9802a	ipn/ipnlocal, etc: require file sharing capability to send/recv files ... tailscale/corp#1582 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d6a95d807a	ipn/ipnlocal: advertise netstack to control server ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	762180595d	ipn/ipnstate: add PeerStatus.TailscaleIPs slice, deprecate TailAddr ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	34d2f5a3d9	tailcfg: add Endpoint, EndpointType, MapRequest.EndpointType ... Track endpoints internally with a new tailcfg.Endpoint type that includes a typed netaddr.IPPort (instead of just a string) and includes a type for how that endpoint was discovered (STUN, local, etc). Use []tailcfg.Endpoint instead of []string internally. At the last second, send it to the control server as the existing []string for endpoints, but also include a new parallel MapRequest.EndpointType []tailcfg.EndpointType, so the control server can start filtering out less-important endpoint changes from new-enough clients. Notably, STUN-discovered endpoints can be filtered out from 1.6+ clients, as they can discover them amongst each other via CallMeMaybe disco exchanges started over DERP. And STUN endpoints change a lot, causing a lot of MapResposne updates. But portmapped endpoints are worth keeping for now, as they they work right away without requiring the firewall traversal extra RTT dance. End result will be less control->client bandwidth. (despite negligible increase in client->control bandwidth) Updates tailscale/corp#1543 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b91f3c4191	ipn/ipnlocal: fix peerapi printf arg mismatch ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	db5e269463	client/tailscale/apitype: move local API types to new apitype package ... They were scattered/duplicated in misc places before. It can't be in the client package itself for circular dep reasons. This new package is basically tailcfg but for localhost communications, instead of to control. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	1b9d8771dc	ipn/ipnlocal,wgengine/router,cmd/tailscale: add flag to allow local lan access when routing traffic via an exit node. ... For #1527 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	8e75c8504c	ipn/ipnlocal: in direct file mode, don't readdir ... And don't even allow attempts at Open/Delete. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9972c02b60	cmd/tailscale/cli: don't let up change prefs based on implicit flag values ... This changes the behavior of "tailscale up". Previously "tailscale up" always did a new Start and reset all the settings. Now "tailscale up" with no flags just brings the world [back] up. (The opposite of "tailscale down"). But with flags, "tailscale up" now only is allowed to change preferences if they're explicitly named in the flags. Otherwise it's an error. Or you need to use --reset to explicitly nuke everything. RELNOTE=tailscale up change Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f5742b0647	ipn/ipnlocal: add LocalBackend.SetDirectFileRoot ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4c3f7c06fc	ipn/ipnlocal: be consistent in not logging when no notify registered ... Some paths already didn't. And in the future I hope to shut all the notify funcs down end-to-end when nothing is connected (as in the common case in tailscaled). Then we can save some JSON encoding work. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7c0e58c537	ipn/ipnlocal: remove redundant notify nil check ... send does it. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	00d641d9fc	ipn/localapi: move EditPrefs to localapi ... Follow-up/revision to recent 53cfff109b which added EditPrefs. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	1a371b93be	util/dnsname: add FQDN type, use throughout codebase. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	3167e55ddf	ipn/{ipnlocal,localapi}, cmd/tailscale: add logout command ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	11127666b2	ipn/ipnlocal: fix deadlock from 227f73284 ... Sigh. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	227f73284f	ipn/ipnlocal: eagerly announce peerapi service(s) on change ... We were previously only doing it as a side effect of the port poller, which doesn't run on e.g. iOS. Updates tailscale/corp#1559	3 years ago
Brad Fitzpatrick	fe23506471	ipn/ipnlocal: avoid unneeded initPeerAPIListener work if no changes ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	20e7646b8d	ipn/ipnlocal: always set Notify.FilesWaiting, set IncomingFiles non-nil when empty	3 years ago
Brad Fitzpatrick	6d01d3bece	ipn/ipnlocal: provide IPN bus updates as files arrive ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	2f398106e2	ipn/ipnlocal: allow setting MagicDNS without DefaultResolvers. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	fad21af01c	tailcfg: add DNS routes and advanced resolver config. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	a9a3d3b4c1	ipn/ipnlocal: don't filter by time in FileTargets ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	71432c6449	ipn/ipnlocal: some more variable renames ... Missed in earlier commit. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e86b7752ef	ipn/ipnlocal: rename some variables to be consistent ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	da4cc8bbb4	net/dns: handle all possible translations of high-level DNS config. ... With this change, all OSes can sort-of do split DNS, except that the default upstream is hardcoded to 8.8.8.8 pending further plumbing. Additionally, Windows 8-10 can do split DNS fully correctly, without the 8.8.8.8 hack. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	939861773d	net/tstun: accept peerapi connections through the filter ... Fixes tailscale/corp#1545 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	950fc28887	ipn, paths, cmd/tailscaled: remove LegacyConfigPath, relaynode migration ... It is time. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago