867 Commits (e74d37d30faac42ee2baa0ebf67ecc0ed762485f)

Author	SHA1	Message	Date
Josh Bleecher Snyder	4dbbd0aa4a	cmd/addlicense: add command to add licenseheaders to generated code ... And use it to make our stringer invocations match the existing code. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	c179580599	wgengine/magicsock: add debug envvar to force all traffic over DERP ... This would have been useful during debugging DERP issues recently. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	e41193ec4d	wgengine/monitor: don't spam about Linux RTM_NEWRULE events ... The earlier 2ba36c294b started listening for ip rule changes and only cared about DELRULE events, buts its subscription included all rule events, including new ones, which meant we were then catching our own ip rule creations and logging about how they were unknown. Stop that log spam. Updates #1591 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2ba36c294b	wgengine/monitor: subscribe to Linux ip rule events, log on rule deletes ... For debugging & working on #1591 where certain versions of systemd-networkd delete Tailscale's ip rule entries. Updates #1591 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	4f4dae32dd	wgengine/magicsock: fix latent data race in test ... logBufWriter had no serialization. It just so happens that none of its users currently ever log concurrently. Make it safe for concurrent use. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
julianknodt	fb06ad19e7	wgcfg: Switch to using mem.RO ... As Brad suggested, mem.RO allows for a lot of easy perf gains. There were also some smaller changes outside of mem.RO, such as using hex.Decode instead of hex.DecodeString. ``` name old time/op new time/op delta FromUAPI-8 14.7µs ± 3% 12.3µs ± 4% -16.58% (p=0.008 n=5+5) name old alloc/op new alloc/op delta FromUAPI-8 9.52kB ± 0% 7.04kB ± 0% -26.05% (p=0.008 n=5+5) name old allocs/op new allocs/op delta FromUAPI-8 77.0 ± 0% 29.0 ± 0% -62.34% (p=0.008 n=5+5) ``` Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	d349a3231e	wgcfg: use string cut instead of string split ... Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	664edbe566	wgcfg: add benchmark for FromUAPI ... Adds a benchmark for FromUAPI in wgcfg. It appears that it's not actually that slow, the main allocations are from the scanner and new config. Updates #1912. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Brad Fitzpatrick	7e7c4c1bbe	tailcfg: break DERPNode.DERPTestPort into DERPPort & InsecureForTests ... The DERPTestPort int meant two things before: which port to use, and whether to disable TLS verification. Users would like to set the port without disabling TLS, so break it into two options. Updates #1264 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	92077ae78c	wgengine/magicsock: make portmapping async ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	700badd8f8	util/deephash: move internal/deephash to util/deephash ... No code changes. Just a minor package doc addition about lack of API stability.	3 years ago
Maisem Ali	ec52760a3d	wgengine/router_windows: support toggling local lan access when using ... exit nodes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	722859b476	wgengine/netstack: make SOCKS5 resolve names to IPv6 if self node when no IPv4 ... For instance, ephemeral nodes with only IPv6 addresses can now SOCKS5-dial out to names like "foo" and resolve foo's IPv6 address rather than foo's IPv4 address and get a "no route" (*tcpip.ErrNoRoute) error from netstack's dialer. Per https://github.com/tailscale/tailscale/issues/2268#issuecomment-870027626 which is only part of the isuse. Updates #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	506c2fe8e2	cmd/tailscale: make netcheck use active DERP map, delete static copy ... After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Christine Dodrill	59e9b44f53	wgengine/filter: add a debug flag for filter logs (#2241) ... This uses a debug envvar to optionally disable filter logging rate limits by setting the environment variable TS_DEBUG_FILTER_RATE_LIMIT_LOGS to "all", and if it matches, the code will effectively disable the limits on the log rate by setting the limit to 1 millisecond. This should make sure that all filter logs will be captured. Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Brad Fitzpatrick	c45bfd4180	wgengine: make dnsIPsOverTailscale also consider DefaultResolvers ... Found during a failed experiment debugging something on Android. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b92e2ebd24	wgengine/netstack: add Impl.DialContextUDP ... Unused so far, but eventually we'll want this for SOCKS5 UDP binds (we currently only do TCP with SOCKS5), and also for #2102 for forwarding MagicDNS upstream to Tailscale IPs over netstack. Updates #2102 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	45e64f2e1a	net/dns{,/resolver}: refactor DNS forwarder, send out of right link on macOS/iOS ... Fixes #2224 Fixes tailscale/corp#2045 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	4ce15505cb	wgengine: randomize client port if netmap says to ... For testing out #2187 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	5f8ffbe166	magicsock: add SetPreferredPort method ... Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	80a4052593	cmd/tailscale, wgengine, tailcfg: don't assume LastSeen is present [mapver 20] ... Updates #2107 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Fletcher Nichol	a49df5cfda	wgenine/router: fix OpenBSD route creation ... The route creation for the `tun` device was augmented in #1469 but didn't account for adding IPv4 vs. IPv6 routes. There are 2 primary changes as a result: * Ensure that either `-inet` or `-inet6` was used in the [`route(8)`](https://man.openbsd.org/route) command * Use either the `localAddr4` or `localAddr6` for the gateway argument depending which destination network is being added The basis for the approach is based on the implementation from `router_userspace_bsd.go`, including the `inet()` helper function. Fixes #2048 References #1469 Signed-off-by: Fletcher Nichol <fnichol@nichol.ca>	4 years ago
Josh Bleecher Snyder	e92fd19484	wgengine/wglog: match upstream wireguard-go's code for wireguardGoString ... It is a bit faster. But more importantly, it matches upstream byte-for-byte, which ensures there'll be no corner cases in which we disagree. name old time/op new time/op delta SetPeers-8 3.58µs ± 0% 3.16µs ± 2% -11.74% (p=0.016 n=4+5) name old alloc/op new alloc/op delta SetPeers-8 2.53kB ± 0% 2.53kB ± 0% ~ (all equal) name old allocs/op new allocs/op delta SetPeers-8 99.0 ± 0% 99.0 ± 0% ~ (all equal) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	a321c24667	go.mod: update netaddr ... Involves minor IPSetBuilder.Set API change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	ddf6c8c729	wgengine/magicsock: delete dead code ... Co-authored-by: Adrian Dewhurst <adrian@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1ece91cede	go.mod: upgrade wireguard-windows, de-fork wireguard-go ... Pull in the latest version of wireguard-windows. Switch to upstream wireguard-go. This requires reverting all of our import paths. Unfortunately, this has to happen at the same time. The wireguard-go change is very low risk, as that commit matches our fork almost exactly. (The only changes are import paths, CI files, and a go.mod entry.) So if there are issues as a result of this commit, the first place to look is wireguard-windows changes. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	ceaaa23962	wgengine/wglog: cache strings ... We repeat many peers each time we call SetPeers. Instead of constructing strings for them from scratch every time, keep strings alive across iterations. name old time/op new time/op delta SetPeers-8 3.58µs ± 1% 2.41µs ± 1% -32.60% (p=0.000 n=9+10) name old alloc/op new alloc/op delta SetPeers-8 2.53kB ± 0% 1.30kB ± 0% -48.73% (p=0.000 n=10+10) name old allocs/op new allocs/op delta SetPeers-8 99.0 ± 0% 16.0 ± 0% -83.84% (p=0.000 n=10+10) We could reduce alloc/op 12% and allocs/op 23% if strs had type map[string]strCache instead of map[string]*strCache, but that wipes out the execution time impact. Given that re-use is the most common scenario, let's optimize for it. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	73adbb7a78	wgengine: pass an addressable value to deephash.UpdateHash ... This makes deephash more efficient. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	8bf2a38f29	go.mod: update wireguard-go, taking control over iOS memory usage from our fork ... Our wireguard-go fork used different values from upstream for package device's memory limits on iOS. This was the last blocker to removing our fork. These values are now vars rather than consts for iOS. c27ff9b9f6 Adjust them on startup to our preferred values. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types ... This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	5b52b64094	tsnet: add Tailscale-as-a-library package ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	ebcd7ab890	wgengine: remove wireguard-go DeviceOptions ... We no longer need them. This also removes the 32 bytes of prefix junk before endpoints. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	aacb2107ae	all: add extra information to serialized endpoints ... magicsock.Conn.ParseEndpoint requires a peer's public key, disco key, and legacy ip/ports in order to do its job. We currently accomplish that by: * adding the public key in our wireguard-go fork * encoding the disco key as magic hostname * using a bespoke comma-separated encoding It's a bit messy. Instead, switch to something simpler: use a json-encoded struct containing exactly the information we need, in the form we use it. Our wireguard-go fork still adds the public key to the address when it passes it to ParseEndpoint, but now the code compensating for that is just a couple of simple, well-commented lines. Once this commit is in, we can remove that part of the fork and remove the compensating code. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
Josh Bleecher Snyder	98cae48e70	wgengine/wglog: optimize wireguardGoString ... The new code is ugly, but much faster and leaner. name old time/op new time/op delta SetPeers-8 7.81µs ± 1% 3.59µs ± 1% -54.04% (p=0.000 n=9+10) name old alloc/op new alloc/op delta SetPeers-8 7.68kB ± 0% 2.53kB ± 0% -67.08% (p=0.000 n=10+10) name old allocs/op new allocs/op delta SetPeers-8 237 ± 0% 99 ± 0% -58.23% (p=0.000 n=10+10) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	9356912053	wgengine/wglog: add BenchmarkSetPeer ... Because it showed up on hello profiles. Cycle through some moderate-sized sets of peers. This should cover the "small tweaks to netmap" and the "up/down cycle" cases. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	36a26e6a71	internal/deephash: rename from deepprint ... Yes, it printed, but that was an implementation detail for hashing. And coming optimization will make it print even less. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	773fcfd007	Revert "wgengine/bench: skip flaky test" ... This reverts commit d707e2f7e5. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	68911f6778	wgengine/bench: ignore "engine closing" errors ... On benchmark completion, we shut down the wgengine. If we happen to poll for status during shutdown, we get an "engine closing" error. It doesn't hurt anything; ignore it. Fixes tailscale/corp#1776 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	d707e2f7e5	wgengine/bench: skip flaky test ... Updates tailscale/corp#1776 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	8d2a90529e	wgengine/bench: hold lock in TrafficGen.GotPacket while calling first packet callback ... Without any synchronization here, the "first packet" callback can be delayed indefinitely, while other work continues. Since the callback starts the benchmark timer, this could skew results. Worse, if the benchmark manages to complete before the benchmark timer begins, it'll cause a data race with the benchmark shutdown performed by package testing. That is what is reported in #1881. This is a bit unfortunate, in that it means that users of TrafficGen have to be careful to keep this callback speedy and lightweight and to avoid deadlocks. Fixes #1881 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	a72fb7ac0b	wgengine/bench: handle multiple Engine status callbacks ... It is possible to get multiple status callbacks from an Engine. We need to wait for at least one from each Engine. Without limiting to one per Engine, wait.Wait can exit early or can panic due to a negative counter. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	6618e82ba2	wgengine/bench: close Engines on benchmark completion ... This reduces the speed with which these benchmarks exhaust their supply fds. Not to zero unfortunately, but it's still helpful when doing long runs. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	ddd85b9d91	wgengine/magicsock: rename discoEndpoint.wgEndpointHostPort to wgEndpoint ... Fields rename only. Part of the general effort to make our code agnostic about endpoint formatting. It's just a name, but it will soon be a misleading one; be more generic. Do this as a separate commit because it generates a lot of whitespace changes. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	e0bd3cc70c	wgengine/magicsock: use netaddr.MustParseIPPrefix ... Delete our bespoke helper. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	bc68e22c5b	all: s/CreateEndpoint/ParseEndpoint/ in docs ... Upstream wireguard-go renamed the interface method from CreateEndpoint to ParseEndpoint. I missed some comments. Fix them. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	9bce1b7fc1	wgengine/wgcfg: make device test endpoint-format-agnostic ... By using conn.NewDefaultBind, this test requires that our endpoints be comprehensible to wireguard-go. Instead, use a no-op bind that treats endpoints as opaque strings. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	73ad1f804b	wgengine/wgcfg: use autogenerated Clone methods ... Delete the manually written ones named Copy. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	a0dacba877	wgengine/magicsock: simplify legacy endpoint DstToString ... Legacy endpoints (addrSet) currently reconstruct their dst string when requested. Instead, store the dst string we were given to begin with. In addition to being simpler and cheaper, this makes less code aware of how to interpret endpoint strings. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	777c816b34	wgengine/wgcfg: return better errors from DeviceConfig, ReconfigDevice ... Prefer the error from the actual wireguard-go device method call, not {To,From}UAPI, as those tend to be less interesting I/O errors. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1f6c4ba7c3	wgengine/wgcfg: prevent ReconfigDevice from hanging on error ... When wireguard-go's UAPI interface fails with an error, ReconfigDevice hangs. Fix that by buffering the channel and closing the writer after the call. The code now matches the corresponding code in DeviceConfig, where I got it right. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago