243 Commits (e37ea8083c78d7f230cbd9927cfc97c1f91ac355)

Author	SHA1	Message	Date
Brad Fitzpatrick	f4ff26f577	types/pad32: delete package ... Use Go 1.19's new 64-bit alignment ~hidden feature instead. Fixes #5356 Change-Id: Ifcbcb115875a7da01df3bc29e9e7feadce5bc956 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	9d04ffc782	net/wsconn: add back custom wrapper for turning a websocket.Conn into a net.Conn ... We removed it in #4806 in favor of the built-in functionality from the nhooyr.io/websocket package. However, it has an issue with deadlines that has not been fixed yet (see nhooyr/websocket#350). Temporarily go back to using a custom wrapper (using the fix from our fork) so that derpers will stop closing connections too aggressively. Updates #5921 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Andrew Dunham	64ea60aaa3	derp: add TCP RTT metric on Linux (#5949) ... Periodically poll the TCP RTT metric from all open TCP connections and update a (bucketed) histogram metric. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6214902196b05bf7829c9d0ea501ce0e13d984cf	2 years ago
Mihai Parparita	b2855cfd86	derp/derphttp: fix nil pointer dereference when closing a netcheck client ... NewNetcheckClient only initializes a subset of fields of derphttp.Client, and the Close() call added by #5707 was result in a nil pointer dereference. Make Close() safe to call when using NewNetcheckClient() too. Fixes #5919 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Josh Soref	d4811f11a0	all: fix spelling mistakes ... Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>	2 years ago
Eng Zer Jun	f0347e841f	refactor: move from io/ioutil to io and os packages ... The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	2 years ago
Mihai Parparita	027111fb5a	derp: update DERP acronym expansion ... Makes the package description consistent with other documentation. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	74674b110d	envknob: support changing envknobs post-init ... Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	a9f6cd41fd	all: use syncs.AtomicValue ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	4950fe60bd	syncs, all: move to using Go's new atomic types instead of ours ... Fixes #5185 Change-Id: I850dd532559af78c3895e2924f8237ccc328449d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	116f55ff66	all: gofmt for Go 1.19 ... Updates #5210 Change-Id: Ib02cd5e43d0a8db60c1f09755a8ac7b140b670be Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a12aad6b47	all: convert more code to use net/netip directly ... perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6a396731eb	all: use various net/netip parse funcs directly ... Mechanical change with perl+goimports. Changed {Must,}Parse{IP,IPPrefix,IPPort} to their netip variants, then goimports -d . Finally, removed the net/netaddr wrappers, to prevent future use. Updates #5162 Change-Id: I59c0e38b5fbca5a935d701645789cddf3d7863ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7eaf5e509f	net/netaddr: start migrating to net/netip via new netaddr adapter package ... Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Charlotte Brandhorst-Satzkorn	4c0feba38e	derp: plumb '/derp' request context through (#5083) ... This change is required to implement tracing for derp. Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	2 years ago
Brad Fitzpatrick	931f18b575	derp: add missing docs on clientInfo.Version ... It's not the Tailscale version. Change-Id: Icfbd5ff36300b2125b19cd2fa6caa22876965317 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	edc90ebc61	net/wsconn: remove homegrown wrapper for turning a websocket.Conn into a net.Conn ... The one from the nhooyr/websocket package seems to work equally well. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	a9f32656f5	control/controlhttp: allow client and server to communicate over WebSockets ... We can't do Noise-over-HTTP in Wasm/JS (because we don't have bidirectional communication), but we should be able to do it over WebSockets. Reuses derp WebSocket support that allows us to turn a WebSocket connection into a net.Conn. Updates #3157 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
James Tucker	f9e86e64b7	*: use WireGuard where logged, printed or named ... Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Tom DNetto	c8f4dfc8c0	derp/derphttp,net/netcheck: improve netcheck behavior under MITM proxies ... In cases where tailscale is operating behind a MITM proxy, we need to consider that a lot more of the internals of our HTTP requests are visible and may be used as part of authorization checks. As such, we need to 'behave' as closely as possible to ideal. - Some proxies do authorization or consistency checks based the on Host header or HTTP URI, instead of just the IP/hostname/SNI. As such, we need to construct a `*http.Request` with a valid URI everytime HTTP is going to be used on the wire, even if its over TLS. Aside from the singular instance in net/netcheck, I couldn't find anywhere else a http.Request was constructed incorrectly. - Some proxies may deny requests, typically by returning a 403 status code. We should not consider these requests as a valid latency check, so netcheck semantics have been updated to consider >299 status codes as a failed probe. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Maisem Ali	9f604f2bd3	derp: add (*Server).IsClientConnectedForTest func. (#4331) ... This allows tests to verfiy that a DERP connection was actually established. Related to #4326 Updates tailscale/corp#2579 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	18818763d1	derp: set Basic Constraints on metacert ... See https://github.com/golang/go/issues/51759#issuecomment-1071147836 Once we deploy this, tailscaled should work again for macOS users with Go 1.18. Updates golang/go#51759 Change-Id: I869b6ddc556a2de885e96ccf9f335dfc8f6f6a7e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	0868329936	all: use any instead of interface{} ... My favorite part of generics. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	730aa1c89c	derp/derphttp, wgengine/magicsock: prefer IPv6 to DERPs when IPv6 works ... Fixes #3838 Change-Id: Ie47a2a30c7e8e431512824798d2355006d72fb6a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	70d71ba1e7	cmd/derpprobe: check derper TLS certs too ... Change-Id: If8c48e012b294570ebbb1a46bacdc58fafbfbcc5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) ... A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2aeb93003f	derp: add metrics to server got pings, sent pongs ... Updates #3652 Change-Id: I1d350bcaee39ea36b0c71912028624d18fb541b4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2c94e3c4ad	wgengine/magicsock: don't unconditionally close DERP connections on rebind ... Only if the source address isn't on the currently active interface or a ping of the DERP server fails. Updates #3619 Change-Id: I6bf06503cff4d781f518b437c8744ac29577acc8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	63d9c7b9b3	derp: add Client.LocalAddr method ... So magicsock can later ask a DERP connection whether its source IP would've changed if it reconnected. Updates #3619 Change-Id: Ibc8810340c511d6786b60c78c1a61c09f5800e40 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	535b925d1b	derp/derphttp: add Client.Ping, SendPing methods ... Continuing work in 434af15a04, to make it possible for magicsock to probe whether a DERP server is still there. Updates #3619 Change-Id: I366a77c27e93b876734e64f445b85ef01eb590f2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	434af15a04	derp: support client->server ping (and server->client pong) ... In prep for a future change to have client ping derp connections when their state is questionable, rather than aggressively tearing them down and doing a heavy reconnect when their state is unknown. We already support ping/pong in the other direction (servers probing clients) so we already had the two frame types, but I'd never finished this direction. Updates #3619 Change-Id: I024b815d9db1bc57c20f82f80f95fb55fc9e2fcc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	758c37b83d	net/netns: thread logf into control functions ... So that darwin can log there without panicking during tests. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Anderson	84c3a09a8d	types/key: export constants for key size, not a method. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	c1d009b9e9	ipn/ipnstate: use key.NodePublic instead of the generic key.Public. ... Updates #3206. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	1f06f77dcb	derp: remove package shadowing of types/key. ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	37c150aee1	derp: use new node key type. ... Update #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	eebe7afad7	derp/derphttp: only log about a weird upgrade if any was specified ... Otherwise random browser requests to /derp cause log spam. Change-Id: I7bdf991d2106f0323868e651156c788a877a90d5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	505f844a43	cmd/derper, derp/derphttp: add websocket support ... Updates #3157 Change-Id: I337a919a3b350bc7bd9af567b49c4d5d6616abdd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7cf8ec8108	net/tlsdial: bake in LetsEncrypt's ISRG Root X1 root ... We still try the host's x509 roots first, but if that fails (like if the host is old), we fall back to using LetsEncrypt's root and retrying with that. tlsdial was used in the three main places: logs, control, DERP. But it was missing in dnsfallback. So added it there too, so we can run fine now on a machine with no DNS config and no root CAs configured. Also, move SSLKEYLOGFILE support out of DERP. tlsdial is the logical place for that support. Fixes #1609 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	73f177e4d5	derp: throttle client sends if server advertises rate limits ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	3759fb8987	derp: deflake TestSendFreeze ... On about 1 out of 500 runs, TestSendFreeze failed: derp_test.go:416: bob: unexpected message type derp.PeerGoneMessage Closing alice before bob created a race. If bob closed promptly, the test passed. If bob closed slowly, and alice's disappearance caused bob to receive a PeerGoneMessage before closing, the test failed. Deflake the test by closing bob first. With this fix, the test passed 12,000 times locally. Fixes #2668 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	fc160f80ee	metrics: move currentFDs code to the metrics package ... Updates #2784 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a59b389a6a	derp: add new health update and server restarting frame types ... Updates #2756 Updates #2746 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	73280595a8	derp: accept dup clients without closing prior's connection ... A public key should only have max one connection to a given DERP node (or really: one connection to a node in a region). But if people clone their machine keys (e.g. clone their VM, Raspbery Pi SD card, etc), then we can get into a situation where a public key is connected multiple times. Originally, the DERP server handled this by just kicking out a prior connections whenever a new one came. But this led to reconnect fights where 2+ nodes were in hard loops trying to reconnect and kicking out their peer. Then a909d37a59 tried to add rate limiting to how often that dup-kicking can happen, but empirically it just doesn't work and ~leaks a bunch of goroutines and TCP connections, tying them up for hour+ while more and more accumulate and waste memory. Mostly because we were doing a time.Sleep forever while not reading from their TCP connections. Instead, just accept multiple connections per public key but track which is the most recent. And if two both are writing back & forth, then optionally disable them both. That last part is only enabled in tests for now. The current default policy is just last-sender-wins while we gather the next round of stats. Updates #2751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ffd22050c0	derp: export current file descriptor metric	3 years ago
slowy07	ac0353e982	fix: typo spelling grammar ... Signed-off-by: slowy07 <slowy.arfy@gmail.com>	3 years ago
Brad Fitzpatrick	f35b8c3ead	derp: fix meshing accounting edge case bug ... If a peer is connected to multiple nodes in a region (so multiForwarder is in use) and then a node restarts and re-sends all its additions, this bug about whether an element is in the multiForwarder could cause a one-time flip in the which peer node we forward to. Note a huge deal, but not written as intended. Thanks to @lewgun for the bug report in #2141. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fd7b738e5b	derp: use pad32 package for padding, reduce duplication ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7298e777d4	derp: reduce server memory by 30% by removing persistent bufio.Writer ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b622c60ed0	derp,wgengine/magicsock: don't assume stringer is in $PATH for go:generate ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e422e9f4c9	cmd/derper: mesh over VPC network ... Updates #2414 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e299300b48	net/dnscache: cache all IPs per hostname ... Not yet used in the dialer, but plumbed around. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a909d37a59	derp: rate limit how often same-key clients can kick each other off server ... Updates #392 Updates #506 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	4dbbd0aa4a	cmd/addlicense: add command to add licenseheaders to generated code ... And use it to make our stringer invocations match the existing code. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	0ec9040c5e	scripts: remove special case for _strings.go files in check license headers ... And add a license header for derp/dropreason_string.go to make it happy. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
maddie	d976a84d7e	derp: allow self node when verifying clients ... Fixes #2408 Signed-off-by: Maddie Zhan <maddie.zhan@cynovan.com>	3 years ago
Brad Fitzpatrick	05da2691a5	cmd/derper/derpprobe: add derp prober ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4c0494185b	derp: remove "fine for now" intentional slow memory leak from derp server ... It was once believed that it might be useful. It wasn't. We never used it. Remove it so we don't slowly leak memory. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	d98829583a	derp: use a dedicated queue for disco traffic. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	67158549ab	derp: actually export the new drop counter. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	36492ace9d	derp: add counters to track the type of dropped packets. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	7e7c4c1bbe	tailcfg: break DERPNode.DERPTestPort into DERPPort & InsecureForTests ... The DERPTestPort int meant two things before: which port to use, and whether to disable TLS verification. Users would like to set the port without disabling TLS, so break it into two options. Updates #1264 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	506c2fe8e2	cmd/tailscale: make netcheck use active DERP map, delete static copy ... After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	148602a89a	derp,cmd/derper: allow server to verify clients ... This adds a flag to the DERP server which specifies to verify clients through a local tailscaled. It is opt-in, so should not affect existing clients, and is mainly intended for users who want to run their own DERP servers. It assumes there is a local tailscaled running and will attempt to hit it for peer status information. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	3687e5352b	derp: fix traffic handler peer addresses ... Before it was using the local address and port, so fix that. The fields in the response from `ss` are: State, Recv-Q, Send-Q, Local Address:Port, Peer Address:Port, Process Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	3728634af9	derp: add debug traffic handler ... This adds a handler on the DERP server for logging bytes send and received by clients of the server, by holding open a connection and recording if there is a difference between the number of bytes sent and received. It sends a JSON marshalled object if there is an increase in the number of bytes. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	fe54721e31	derp: add pkt queue latency timer ... It would be useful to know the time that packets spend inside of a queue before they are sent off, as that can be indicative of the load the server is handling (and there was also an existing TODO). This adds a simple exponential moving average metric to track the average packet queue duration. Changes during review: Add CAS loop for recording queue timing w/ expvar.Func, rm snake_case, annotate in milliseconds, convert Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	3d4d97601a	derp/derpmap: add São Paulo (derp11) ... Updates #1499	4 years ago
Maisem Ali	4d142ebe06	derp: handle net.ErrClosed in TestSendFreeze ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	ab2a8a7493	derp: return keep-alive message up to callers ... To be used by health checking, which wants to see activity, even if idle. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c81814e4f8	derp{,/derphttp},magicsock: tell DERP server when ping acks can be expected ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	79d8288f0a	wgengine/magicsock, derp, derp/derphttp: respond to DERP server->client pings ... No server support yet, but we want Tailscale 1.6 clients to be able to respond to them when the server can do it. Updates #1310 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ca51529b81	derp/derphttp: return nicer errors from Recv on Close	4 years ago
Brad Fitzpatrick	741d654aa3	derp/derphttp: add a context and infoLogger option to RunWatchConnectionLoop	4 years ago
Brad Fitzpatrick	66be052a70	net/dnscache: work on IPv6-only hosts (again) ... This fixes the regression where we had stopped working on IPv6-only hosts. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	54e6c3a290	version: use OSS repo's version when building. ... When building with redo, also include the git commit hash from the proprietary repo, so that we have a precise commit that identifies all build info (including Go toolchain version). Add a top-level build script demonstrating to downstream distros how to burn the right information into builds. Adjust `tailscale version` to print commit hashes when available. Fixes #841. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	1e0be5a458	tshttp, derphttp: send Proxy-Authorization, not Authorization, to proxies ... Whoops. But weirdly, sending Authorization sometimes worked?	4 years ago
Brad Fitzpatrick	28f9cd06f5	tshttpproxy, controlclient, derphttp, logpolicy: send Negotiate auth to proxies ... For Windows only, and only when built with Tailscale's Go tree. Updates tailscale/corp#583	4 years ago
Brad Fitzpatrick	169ff22a84	derp: set NotBefore and NotAfter in DERP server's metacert ... Fixes regression from e415991256 that only affected Windows users because Go only on Windows delegates x509 cert validation to the OS and Windows as unhappy with our "metacert" lacking NotBefore and NotAfter. Fixes #705	4 years ago
Brad Fitzpatrick	e415991256	derp, derp/derphttp: remove one RTT from DERP setup ... * advertise server's DERP public key following its ServerHello * have client look for that DEPR public key in the response PeerCertificates * let client advertise it's going into a "fast start" mode if it finds it * modify server to support that fast start mode, just not sending the HTTP response header Cuts down another round trip, bringing the latency of being able to write our first DERP frame from SF to Bangalore from ~725ms (3 RTT) to ~481ms (2 RTT: TCP and TLS). Fixes #693 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	9cb2df4ddd	derp/derpmap: add London, Dallas, Seattle	4 years ago
Brad Fitzpatrick	805850add9	derp: remove JSON struct tags in comments ... They don't work in comments. Added a test too to show that there's no change in behavior. (It does case insensitive matching on parse anyway)	4 years ago
Brad Fitzpatrick	287522730d	derp/derphttp: support standard-ish SSLKEYLOGFILE environment variable ... For debugging.	4 years ago
Brad Fitzpatrick	c5eb57f4d6	net/tshttpproxy: new package, support WPAD/PAC proxies on Windows ... Updates tailscale/corp#553 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	93ffc565e5	derp: remove protocol version 1 support ... It hasn't existed for a long time and there are no current users. Fixes #199	4 years ago
Brad Fitzpatrick	6b80bcf112	derp: remove a client round-trip waiting on serverInfo ... It just has a version number in it and it's not really needed. Instead just return it as a normal Recv message type for those that care (currently only tests). Updates #150 (in that it shares the same goal: initial DERP latency) Updates #199 (in that it removes some DERP versioning)	4 years ago
Brad Fitzpatrick	e64ab89712	derp/derpmap: add Bangalore and Tokyo	4 years ago
Brad Fitzpatrick	80d0b88a89	derp/derpmap: fix constructor argument order ... Fix of 3e2bfe48c3	4 years ago
Ross Zurowski	3e2bfe48c3	derpmap: add full region name ... We're beginning to reference DERP region names in the admin UI, so it's best to consolidate this information in our DERP map. Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	4 years ago
Josh Bleecher Snyder	062bd67d3b	derp: use rand instead of crypto/rand to generate jitter ... We don't need crypto/rand. Let the OS keep its entropy bits. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
David Anderson	37c19970b3	derp: add a debug option to verbosely log drops to a destination. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	909c165382	derp: remove two key.Public allocations ... Reading and writing a [32]byte key to a bufio.Reader/bufio.Writer can easily by done without allocating. Do so. It is slower; on my machine, it adds about 100ns per read/write. However, the overall request takes a minimum of several µs, and it cuts allocations meaningfully, so it is probably worth it. name old time/op new time/op delta SendRecv/msgsize=10-8 9.21µs ± 9% 9.08µs ± 8% ~ (p=0.250 n=15+15) SendRecv/msgsize=100-8 6.51µs ± 9% 6.60µs ± 7% ~ (p=0.259 n=15+13) SendRecv/msgsize=1000-8 7.24µs ±13% 7.61µs ±36% ~ (p=1.000 n=11+15) SendRecv/msgsize=10000-8 19.5µs ±15% 19.9µs ±25% ~ (p=0.890 n=14+15) name old speed new speed delta SendRecv/msgsize=10-8 1.09MB/s ± 8% 1.10MB/s ± 8% ~ (p=0.286 n=15+15) SendRecv/msgsize=100-8 15.4MB/s ± 8% 15.1MB/s ± 6% ~ (p=0.129 n=15+12) SendRecv/msgsize=1000-8 139MB/s ±15% 135MB/s ±28% ~ (p=1.000 n=11+15) SendRecv/msgsize=10000-8 516MB/s ±17% 506MB/s ±21% ~ (p=0.880 n=14+15) name old alloc/op new alloc/op delta SendRecv/msgsize=10-8 170B ± 1% 108B ± 1% -36.63% (p=0.000 n=15+15) SendRecv/msgsize=100-8 265B ± 1% 203B ± 1% -23.34% (p=0.000 n=15+15) SendRecv/msgsize=1000-8 1.18kB ± 1% 1.12kB ± 0% -5.31% (p=0.000 n=14+14) SendRecv/msgsize=10000-8 18.8kB ± 2% 18.8kB ± 2% ~ (p=0.443 n=12+12) name old allocs/op new allocs/op delta SendRecv/msgsize=10-8 4.00 ± 0% 2.00 ± 0% -50.00% (p=0.000 n=15+15) SendRecv/msgsize=100-8 4.00 ± 0% 2.00 ± 0% -50.00% (p=0.000 n=15+15) SendRecv/msgsize=1000-8 4.00 ± 0% 2.00 ± 0% -50.00% (p=0.000 n=15+15) SendRecv/msgsize=10000-8 5.00 ± 0% 3.00 ± 0% -40.00% (p=0.000 n=13+14) Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Brad Fitzpatrick	75225368a4	derp: fix 32-bit struct field alignment	4 years ago
David Anderson	15949ad77d	derp: export the new expvar.	4 years ago
David Anderson	13661e195a	derp: rename "wireguard" packet type to "other". ... Strictly speaking, we don't know that it's a wireguard packet, just that it doesn't look like a disco packet. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1b5b59231b	derp: break down received packets by kind (disco vs. wireguard). ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	e577303dc7	derp: make writeUint32 and readUint32 not allocate ... The allocations are small, but they're easy enough to avoid. And it removes some clutter from the pprof output. name old time/op new time/op delta SendRecv/msgsize=10-8 10.1µs ± 9% 9.7µs ± 7% -3.45% (p=0.035 n=14+14) SendRecv/msgsize=100-8 8.12µs ± 7% 7.38µs ± 9% -9.02% (p=0.000 n=15+15) SendRecv/msgsize=1000-8 9.51µs ±25% 8.76µs ±22% ~ (p=0.202 n=15+15) SendRecv/msgsize=10000-8 21.1µs ±25% 19.9µs ±14% ~ (p=0.270 n=15+14) WriteUint32-8 25.1ns ± 4% 21.3ns ±12% -15.01% (p=0.000 n=14+14) ReadUint32-8 35.4ns ± 4% 21.9ns ± 4% -38.06% (p=0.000 n=15+15) name old alloc/op new alloc/op delta SendRecv/msgsize=10-8 182B ± 2% 169B ± 1% -7.22% (p=0.000 n=15+13) SendRecv/msgsize=100-8 282B ± 1% 265B ± 1% -5.85% (p=0.000 n=15+15) SendRecv/msgsize=1000-8 1.19kB ± 1% 1.18kB ± 0% -1.26% (p=0.000 n=14+15) SendRecv/msgsize=10000-8 19.3kB ± 4% 18.7kB ± 4% -3.44% (p=0.006 n=12+12) WriteUint32-8 4.00B ± 0% 0.00B -100.00% (p=0.000 n=15+15) ReadUint32-8 4.00B ± 0% 0.00B -100.00% (p=0.000 n=15+15) name old allocs/op new allocs/op delta SendRecv/msgsize=10-8 8.00 ± 0% 4.00 ± 0% -50.00% (p=0.000 n=15+15) SendRecv/msgsize=100-8 8.00 ± 0% 4.00 ± 0% -50.00% (p=0.000 n=15+15) SendRecv/msgsize=1000-8 8.00 ± 0% 4.00 ± 0% -50.00% (p=0.000 n=15+15) SendRecv/msgsize=10000-8 8.47 ±17% 5.00 ± 0% -40.94% (p=0.000 n=15+14) WriteUint32-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=15+15) ReadUint32-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=15+15) Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Josh Bleecher Snyder	355c6296f0	derp: add readUint32 and writeUint32 benchmarks ... These aren't particularly performance critical, but since I have an optimization pending for them, it's worth having a corresponding benchmark. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Josh Bleecher Snyder	d65e2632ab	derp: add basic benchmark ... This benchmark is far from perfect: It mixes together client and server. Still, it provides a starting point for easy profiling. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Josh Bleecher Snyder	b23f2263c1	derp: add server version to /debug, expvars ... This will make it easier for a human to tell what version is deployed, for (say) correlating line numbers in profiles or panics to corresponding source code. It'll also let us observe version changes in prometheus. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago