138 Commits (dfbde3d3aaedbe04510d780d071a200004bd53fe)

Author	SHA1	Message	Date
Dmytro Shynkevych	218de6d530	ipn: load hostname in Start. ... This prevents hostname being forced to os.Hostname despite override when control is contacted for the first time after starting tailscaled. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	de11f90d9d	ipn: remove unused parameter to func LoadPrefs, fix godoc subject	4 years ago
Brad Fitzpatrick	7ba148e54e	cmd/tailscale: make tailscale status -active also filter in -json mode	4 years ago
Dmytro Shynkevych	d9ac2ada45	ipn: add self to dns map ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Dmytro Shynkevych	30bbbe9467	wgengine/router: dns: unify on *BSD, multimode on Linux, Magic DNS (#536) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Elias Naur	6e8f0860af	ipn: add Login backend command for sign-in with token ... The StartLoginInteractive command is for delegating the sign-in flow to a browser. The Android Gooogle Sign-In SDK inverts the flow by giving the client ID tokens. Add a new backend command for accepting such tokens by exposing the existing controlclient.Client.Login support for OAuth2 tokens. Introduce a custom TokenType to distinguish ID tokens from other OAuth2 tokens. Signed-off-by: Elias Naur <mail@eliasnaur.com>	4 years ago
Dmytro Shynkevych	61abab999e	cmd/tailscaled: graceful shutdown (#534) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	a8b95571fb	ipn, control/controlclient: fix some data races ... More remain. Fixes tailscale/corp#432	4 years ago
Dmytro Shynkevych	67ebba90e1	tsdns: dual resolution mode, IPv6 support (#526) ... This change adds to tsdns the ability to delegate lookups to upstream nameservers. This is crucial for setting Magic DNS as the system resolver. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	6196b7e658	wgengine/magicsock: change API to not permit disco key changes ... Generate the disco key ourselves and give out the public half instead. Fixes #525	4 years ago
Brad Fitzpatrick	a975e86bb8	wgengine/magicsock: add new endpoint type used for discovery-supporting peers ... This adds a new magicsock endpoint type only used when both sides support discovery (that is, are advertising a discovery key). Otherwise the old code is used. So far the new code only communicates over DERP as proof that the new code paths are wired up. None of the actually discovery messaging is implemented yet. Support for discovery (generating and advertising a key) are still behind an environment variable for now. Updates #483	4 years ago
Brad Fitzpatrick	fe50cd0c48	ipn, wgengine: plumb NetworkMap down to magicsock ... Now we can have magicsock make decisions based on tailcfg.Debug settings sent by the server. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	5bc29e7388	ipn: add missing locking in LocalBackend.NetMap ... Looks like it's only used by tests.	4 years ago
Brad Fitzpatrick	666d404066	ipn: put discovery key generation behind an environment flag for now ... Later we'll want to use the presence of a discovery key as a signal that the node knows how to participate in discovery. Currently the code generates keys and sends them to the control server but doesn't do anything with them, which is a bad state to stay in lest we release this code and end up with nodes in the future that look like they're functional with the new discovery protocol but aren't. So for now, make this opt-in as a debug option for now, until the rest of it is in. Updates #483	4 years ago
Dmytro Shynkevych	00ca17edf4	ipn: fix race in enterState ... Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	53fb25fc2f	all: generate discovery key, plumb it around ... Not actually used yet. Updates #483	4 years ago
David Anderson	0ecaf7b5ed	control/controlclient: make netmap generation use rate-limited logger.	4 years ago
Dmytro Shynkevych	c12d87c54b	Fix concurrency issues in controlclient, ipn, types/logger (#456) ... Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	07e02ec9d3	wgengine/tsdns: add test and prevent useless updates (#449) ... Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Dmytro Shynkevych	511840b1f6	tsdns: initial implementation of a Tailscale DNS resolver (#396) ... Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	5 years ago
Elias Naur	364a8508b2	ipn: add Hostname override to Prefs ... Overriding the hostname is required for Android, where os.Hostname is often just "localhost". Updates #409 Signed-off-by: Elias Naur <mail@eliasnaur.com>	5 years ago
Avery Pennarun	f0b6ba78e8	wgengine: don't pass nil router.Config objects. ... These are hard for swift to decode in the iOS app. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Brad Fitzpatrick	004780b312	ipn: restore LiveDERPs assignment in LocalBackend.parseWgStatus ... Updates #421 (likely fixes it; need to do an iOS build to be sure)	5 years ago
Avery Pennarun	34c30eaea0	router_linux: use only baseline 'ip rule' features that exist in old kernels. ... This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
David Anderson	2b74236567	ipn: move e2e_test back to corp repo. ... It depends on corp things, so can't run here anyway. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Brad Fitzpatrick	e6b84f2159	all: make client use server-provided DERP map, add DERP region support ... Instead of hard-coding the DERP map (except for cmd/tailscale netcheck for now), get it from the control server at runtime. And make the DERP map support multiple nodes per region with clients picking the first one that's available. (The server will balance the order presented to clients for load balancing) This deletes the stunner package, merging it into the netcheck package instead, to minimize all the config hooks that would've been required. Also fix some test flakes & races. Fixes #387 (Don't hard-code the DERP map) Updates #388 (Add DERP region support) Fixes #399 (wgengine: flaky tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	e8b3a5e7a1	wgengine/filter: implement a destination IP pre-filter. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	3ed2124356	ipn: Resolve some resource leaks in test. ... Updates tailscale/corp#255. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	ea8f92b312	ipn/local: get rid of some straggling calls to the log module. ... Use b.logf() instead. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
David Anderson	c97c45f268	ipn: sprinkle documentation and clarity rewrites through LocalBackend. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Wendi Yu	bb55694c95	wgengine: log node IDs when peers are added/removed (#381) ... Also stop logging data sent/received from nodes we're not connected to (ie all those `x`s being logged in the `peers: ` line) Signed-off-by: Wendi <wendi.yu@yahoo.ca>	5 years ago
David Anderson	0fe262f093	ipn: plumb NetfilterMode all the way out to the CLI. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	292606a975	wgengine/router: support multiple levels of netfilter involvement. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	08acb502e5	Add tstest.PanicOnLog(), and fix various problems detected by this. ... If a test calls log.Printf, 'go test' horrifyingly rearranges the output to no longer be in chronological order, which makes debugging virtually impossible. Let's stop that from happening by making log.Printf panic if called from any module, no matter how deep, during tests. This required us to change the default error handler in at least one http.Server, as well as plumbing a bunch of logf functions around, especially in magicsock and wgengine, but also in logtail and backoff. To add insult to injury, 'go test' also rearranges the output when a parent test has multiple sub-tests (all the sub-test's t.Logf is always printed after all the parent tests t.Logf), so we need to screw around with a special Logf that can point at the "current" t (current_t.Logf) in some places. Probably our entire way of using subtests is wrong, since 'go test' would probably like to run them all in parallel if you called t.Parallel(), but it definitely can't because the're all manipulating the shared state created by the parent test. They should probably all be separate toplevel tests instead, with common setup/teardown logic. But that's a job for another time. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
David Anderson	9ccbcda612	wgengine/router: rename config.Settings to config.Config, make pointer. ... Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	72cae5504c	wgengine: generate and plumb router.Settings in from ipn. ... This saves a layer of translation, and saves us having to pass in extra bits and pieces of the netmap and prefs to wgengine. Now it gets one Wireguard config, and one OS network stack config. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Wendi Yu	3663797815	Reduce logspam from node with no peers ... Signed-off-by: Wendi Yu <wendi.yu@yahoo.ca>	5 years ago
David Anderson	bfdc8175b1	wgengine/router: add a setting to disable SNAT for subnet routes. ... Part of #320. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
David Anderson	89af51b84d	wgengine: plumb locally advertised subnet routes. ... With this change, advertising subnet routes configures the firewall correctly. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	9d1f48032a	cmd/tailscale: add --advertise-tags option. ... These will be used for dynamically changing the identity of a node, so its ACL rights can be different from your own. Note: Not all implemented yet on the server side, but we need this so we can request the tagged rights in the first place. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	d6c34368e8	ipn/local: differentiate Shields Up from Uninitialized in logs. ... We were printing "Shields Up" when the netmap wasn't initialized yet, which while technically effectively true, turned out to be confusing when trying to debug things. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	ced9b4008a	ipn: clear the hostinfo.Services list when prefs.ShieldsUp==true. ... When shields are up, no services are available to connect to, so hide them all. This will also help them disappear from the UI menu on other nodes. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	d7429b9a8d	Add prefs.ShieldsUp and --shields-up option. ... This sets a default packet filter that blocks all incoming requests, giving end users more control over who can get into their machine, even if the admin hasn't set any central ACLs. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Brad Fitzpatrick	f4c7eb8c44	ipn: revert part of 18017f7630 ... In retrospect I don't trust it and I'm afraid might've caused some Mac flakiness. I'd like more tests here before I work on this. Updates #288	5 years ago
Brad Fitzpatrick	18017f7630	ipn, wgengine/magicsock: be more idle when in Stopped state with no peers ... (Previously as #288, but with some more.) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	45f2b53aca	all: remove unnecessary trailing newlines in format patterns for consistency ... And document on logger.Logf that it's unnecessary.	5 years ago
Brad Fitzpatrick	3a3b64301e	wgengine: quiet some engine reconfig logging, make more consistent ... Updates #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	b24029717b	ipn: outdent some code in if that's statically always true	5 years ago
David Crawshaw	1747d099e9	ipn: add auth key ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	8ca796d144	ipn, ipn/policy: filter portlist to a short list of "interesting" ports ... Adds new package ipn/policy to be shared between node client & control server. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	a4ef345737	cmd/tailscale: add status subcommand ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	322499473e	cmd/tailscaled, wgengine, ipn: add /debug/ipn handler with world state ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Avery Pennarun	f53e78e0d5	wgengine: don't lose filter state on filter reconfig. ... We were abandoning the UDP port LRU every time we got a new packet filter from tailcontrol, which caused return packets to suddenly stop arriving.	5 years ago
Avery Pennarun	4336de0d98	ipn/local: don't print packet filter every single time. ... It's extremely noisy right now for domains with complex ACLs.	5 years ago
Brad Fitzpatrick	7740cbd8d9	ipn: call SetNetInfoCallback later, in Start ... It was being called back into ultimately from magicsock before there was a control client. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	51b669e4bd	ipn: skip tailscaled UDP ports in service list	5 years ago
David Crawshaw	addbdce296	wgengine, ipn: include number of active DERPs in status ... Use this when making the ipn state transition from Starting to Running. This way a network of quiet nodes with no active handshaking will still transition to Active. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	120273d7f6	portlist: document, clean up, fix an open fd spike, optimize a bit ... I noticed portlist when looking at some profiles and hadn't looked at the code much before. This is a first pass over it. It allocates a fair bit. More love remains, but this does a bit: name old time/op new time/op delta GetList-8 9.92ms ± 8% 9.64ms ±12% ~ (p=0.247 n=10+10) name old alloc/op new alloc/op delta GetList-8 931kB ± 0% 869kB ± 0% -6.70% (p=0.000 n=10+10) name old allocs/op new allocs/op delta GetList-8 4.59k ± 0% 3.69k ± 1% -19.71% (p=0.000 n=10+10) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	42e98d4edc	Quiet two little log annoyances.	5 years ago
David Anderson	aeb88864e0	ipn: don't clobber netinfo in Start().	5 years ago
Avery Pennarun	b4897e7de8	controlclient/netmap: write our own b.ConciseDiffFrom(a) function. ... This removes the need for go-cmp, which is extremely bloaty so we had to leave it out of iOS. As a result, we had also left it out of macOS, and so we didn't print netmap diffs at all on darwin-based platforms. Oops. As a bonus, the output format of the new function is way better. Minor oddity: because I used the dumbest possible diff algorithm, the sort order is a bit dumb. We print all "removed" lines and then print all "added" lines, rather than doing the usual diff-like thing of interspersing them. This probably doesn't matter (maybe it's an improvement).	5 years ago
David Crawshaw	57f220656c	ipn: search for ErrStateNotExist with errors.Is ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	eac62ec5ff	ipn, wgengine/magicsock: add ipn.Prefs.DisableDERP bool ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	b27d4c017a	magicsock, wgengine, ipn, controlclient: plumb regular netchecks to map poll ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	657f9593ae	Reduce some logspam.	5 years ago
David Crawshaw	d133339216	ipn: always guard LocalBackend.prefs with mu ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	bcf3719b9e	netcheck: add hairpinning detection ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Crawshaw	cdc10b74f1	ipn: always guard LocalBackend.endpoints with mu ... For #112 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
David Crawshaw	3425d8d84f	ipn: always guard LocalBackend.engineStatus with mu ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
David Crawshaw	e7cdc11654	ipn: always guard LocalBackend.netMapCache with mu ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	5 years ago
Brad Fitzpatrick	25797c8c2a	all: rename deep "Copy" methods to conventional Go name "Clone"	5 years ago
Brad Fitzpatrick	14559340ee	Start of netcheck package & including network state in Hostinfo. ... * adds new packet "netcheck" to do the checking of UDP, IPv6, and nearest DERP server, and the Report type for all that (and more in the future, probably pulling in danderson's natprobe) * new tailcfg.NetInfo type * cmd/tailscale netcheck subcommand (tentative name, likely to change/move) to print out the netcheck.Report. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	eefafad9f8	ipn: fix some mutex/ownership issues ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	3988ddc85d	types/logger: add WithPrefix, use it in two places ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	758744a4e3	Fix some Hostinfo value usages from the previous commit.	5 years ago
Brad Fitzpatrick	d8de11a01b	control: make Hostinfo accessed by pointer ... Fix potential races in copying aliased slices by value. Also few little doc updates. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	367ffde21a	ipn: misc cleanup ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	c47f907a27	ipn: use *Prefs rather than Prefs throughout. ... Prefs has become a heavy object with non-memcpy copy semantics. We should not pass such a thing by value. Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
David Anderson	0c55777fed	ipn: temporary support for loading legacy relaynode configs. ... Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
David Anderson	cf1e386cbd	ipn: move Options.ServerURL into Prefs. ... We can't rely on a frontend to provide a control server URL, so this naturally belongs in server-persisted state. Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
David Anderson	47da432991	ipn: handle advertised routes provided by frontend. ... Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
Brad Fitzpatrick	2896be60db	Move "logger" package to under types, now that we have it. ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	747c7d7ce2	types/empty: add Message, stop using mysterious *struct{} ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	5f45b7c765	ipn: make LocalBackend.loadStateWithLock easier to follow. ... Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
David Anderson	5bc632271b	Introduce a state store to LocalBackend. ... The store is passed-in by callers of NewLocalBackend and ipnserver.Run, but currently all callers are hardcoded to an in-memory store. The store is unused. Signed-Off-By: David Anderson <dave@natulte.net>	5 years ago
David Anderson	21280ca2d1	Make ipn.Options.Prefs a pointer. ... This is a prelude to making it truly optional, once state management has moved into the backend. For now though, it's still required. This change is just isolating the bubbling-up of the pointerification into other layers. Signed-Off-By: David Anderson <dave@natulte.net>	5 years ago
David Anderson	f6f154193f	Remove LoginFlags from Backend options. ... - It was only used in one currently-unused client. - It's an imperative command, not a configuration setting. - The LoginFlags stuff in controlclient feels like it needs a refactor anyway. I'll put this logic back once ipnd owns its state and Backend commands reflect that. Signed-Off-By: David Anderson <dave@natulte.net>	5 years ago
Earl Lee	a8d8b8719a	Move Linux client & common packages into a public repo.	5 years ago