tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	e9e4f1063d	wgengine/magicsock: fix discoEndpoint caching bug when a node key changes Fixes #1391 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c64bd587ae	net/portmapper: add NAT-PMP client, move port mapping service probing * move probing out of netcheck into new net/portmapper package * use PCP ANNOUNCE op codes for PCP discovery, rather than causing short-lived (sub-second) side effects with a 1-second-expiring map + delete. * track when we heard things from the router so we can be less wasteful in querying the router's port mapping services in the future * use portmapper from magicsock to map a public port Fixes #1298 Fixes #1080 Fixes #1001 Updates #864 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	d038a5295d	wgengine/wglog: drop 1/s "interface is up" messages. Fixes #1388. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	188bb14269	wgengine: consistently close things when NewUserspaceEngineAdvanced errors Fixes #1363 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	6e42430ad8	wgengine/monitor: don't log any single-IP routes added to the tailscale table. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	df5adb2e23	wgengine/monitor: on linux, also monitor for IPv6 changes. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b83c273737	wgengine/filter: use IPSet for localNets instead of prefixes. Part of #1177, preparing for doing fancier set operations on the allowed local nets. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	fd8e070d01	health, control/controlclient, wgengine: report when router unhealthy Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	2d96215d97	wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	96a488e37e	wgengine/router: simplify func normalizeCIDR using netaddr method	4 years ago
Brad Fitzpatrick	d98ef5699d	wgengine/filter: remove redundant code no generated code change.	4 years ago
Brad Fitzpatrick	65815cc1ac	wgengine/tsdns: skip test that requires local IPv6 when IPv6 unavailable Fixes #1292 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	36189e2704	wgengine/monitor: prevent shutdown hang in darwin link monitor	4 years ago
Brad Fitzpatrick	bbb4631e04	safesocket, wgengine: add some darwin failure diagnostic hints	4 years ago
Brad Fitzpatrick	4f7d60ad42	wgengine/monitor: add a darwin implementation for tailscaled mode Tangentially related to #987, #177, #594, #925, #505 Motivated by rebooting a launchd-controlled tailscaled and it going into SetNetworkUp(false) mode immediately because there really is no network up at system boot, but then it got stuck in that paused state forever, without a monitor implementation.	4 years ago
Josh Bleecher Snyder	c7e5ab8094	wgengine/magicsock: retry and re-send packets in TestTwoDevicePing When a handshake race occurs, a queued data packet can get lost. TestTwoDevicePing expected that the very first data packet would arrive. This caused occasional flakes. Change TestTwoDevicePing to repeatedly re-send packets and succeed when one of them makes it through. This is acceptable (vs making WireGuard not drop the packets) because this only affects communication with extremely old clients. And those extremely old clients will eventually connect, because the kernel will retry sends on timeout. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1632f9fd6b	wgengine/magicsock: reduce log spam during tests Only do the type assertion to *net.UDPAddr when addr is non-nil. This prevents a bunch of log spam during tests.	4 years ago
Josh Bleecher Snyder	88586ec4a4	wgengine/magicsock: remove an alloc from ReceiveIPvN We modified the standard net package to not allocate a net.UDPAddr during a call to (net.UDPConn).ReadFromUDP if the caller's use of the net.UDPAddr does not cause it to escape. That is https://golang.org/cl/291390. This is the companion change to magicsock. There are two changes required. First, call ReadFromUDP instead of ReadFrom, if possible. ReadFrom returns a net.Addr, which is an interface, which always allocates. Second, reduce the lifetime of the returned net.UDPAddr. We do this by immediately converting it into a netaddr.IPPort. We left the existing RebindingUDPConn.ReadFrom method in place, as it is required to satisfy the net.PacketConn interface. With the upstream change and both of these fixes in place, we have removed one large allocation per packet received. name old time/op new time/op delta ReceiveFrom-8 16.7µs ± 5% 16.4µs ± 8% ~ (p=0.310 n=5+5) name old alloc/op new alloc/op delta ReceiveFrom-8 112B ± 0% 64B ± 0% -42.86% (p=0.008 n=5+5) name old allocs/op new allocs/op delta ReceiveFrom-8 3.00 ± 0% 2.00 ± 0% -33.33% (p=0.008 n=5+5) Co-authored-by: Sonia Appasamy <sonia@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	0c673c1344	wgengine/magicsock: unify on netaddr types in addrSet addrSet maintained duplicate lists of netaddr.IPPorts and net.UDPAddrs. Unify to use the netaddr type only. This makes (*Conn).ReceiveIPvN a bit uglier, but that'll be cleaned up in a subsequent commit. This is preparatory work to remove an allocation from ReceiveIPv4. Co-authored-by: Sonia Appasamy <sonia@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	4cd9218351	wgengine/magicsock: prevent logging while running benchmarks Co-authored-by: Sonia Appasamy <sonia@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	88ab0173a7	wgengine/router: fix BSD router to support multiple local addrs, IPv6 Fixes #1201	4 years ago
Brad Fitzpatrick	917307a90c	wgengine/tstun: reply to MagicDNS pings Fixes #849 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	635e4c7435	wgengine/magicsock: increase legacy ping timeout again I based my estimation of the required timeout based on locally observed behavior. But CI machines are worse than my local machine. 16s was enough to reduce flakiness but not eliminate it. Bump it up again. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	1ec64bc94d	wgengine/router: add another Windows firewall rule to allow incoming UDP Based on @sailorfrag's research. Fixes #1312 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	7e201806b1	wgengine/magicsock: reconnect to DERP home after network comes back up Updates #1310	4 years ago
Brad Fitzpatrick	cbd6224ca4	wgengine/winnet: don't build on non-windows It only affects 'go install ./...', etc, and only on darwin/arm64 (M1 Macs) where the go-ole package doesn't compile. No need to build it. Updates #943	4 years ago
Brad Fitzpatrick	9b4e50cec0	wgengine/magicsock: fix typo in comment	4 years ago
Naman Sood	07c3df13c6	wgengine/tstun: inform userspaceEngine about injected outbound packets in tundev Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Josh Bleecher Snyder	e7caad61fb	wgengine: remove IpcGetOperation filter This was in place because retrieved allowed_ips was very expensive. Upstream changed the data structure to make them cheaper to compute. This commit is an experiment to find out whether they're now cheap enough. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	6b365b0239	wgengine/magicsock: fix DERP reader hang regression during concurrent reads Fixes #1282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	e1f773ebba	wgengine/magicsock: allow more time for pings to transit We removed the "fast retry" code from our wireguard-go fork. As a result, pings can take longer to transit when retries are required. Allow that. Fixes #1277 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	6d2b8df06d	wgengine/magicsock: add disabled failing (deadlocking) test for #1282 The fix can make this test run unconditionally. This moves code from `5c619882bc` for testability but doesn't fix it yet. The #1282 problem remains (when I wrote its wake-up mechanism, I forgot there were N DERP readers funneling into 1 UDP reader, and the code just isn't correct at all for that case). Also factor out some test helper code from BenchmarkReceiveFrom. The refactoring in magicsock.go for testability should have no behavior change.	4 years ago
Brad Fitzpatrick	1e7a35b225	types/netmap: split controlclient.NetworkMap off into its own leaf package Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6064b6ff47	wgengine/wgcfg/nmcfg: split control/controlclient/netmap.go into own package It couldn't move to ipnlocal due to test dependency cycles. Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	ace57d7627	wgengine/magicsock: set a dummy private key in benchmark. Magicsock started dropping all traffic internally when Tailscale is shut down, to avoid spurious wireguard logspam. This made the benchmark not receive anything. Setting a dummy private key is sufficient to get magicsock to pass traffic for benchmarking purposes. Fixes #1270. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	aa6856a9eb	wgengine: adapt to wireguard-go changes Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	d76334d2f0	ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	70eb05fd47	wgengine: access flow pending problem with lock held Missed review feedback from just-submitted `d37058af72`.	4 years ago
Brad Fitzpatrick	d37058af72	net/packet: add some more TSMP packet reject reasons and MaybeBroken bit Unused for now, but I want to backport this commit to 1.4 so 1.6 can start sending these and then at least 1.4 logs will stringify nicely. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f7eed25bb9	wgengine/magicsock: filter disco packets and packets when stopped from wireguard Fixes #1167 Fixes tailscale/corp#219 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	e8cd7bb66f	tstest: simplify goroutine leak tests Use tb.Cleanup to simplify both the API and the implementation. One behavior change: When the number of goroutines shrinks, don't log. I've never found these logs to be useful, and they frequently add noise. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	a2aa6cd2ed	wgengine/router: clarify disabled IPv6 message on Linux	4 years ago
David Anderson	267531e4f8	wgengine/router: probe better for v6 policy routing support. Previously we disabled v6 support if the disable_policy knob was missing in /proc, but some kernels support policy routing without exposing the toggle. So instead, treat disable_policy absence as a "maybe", and make the direct `ip -6 rule` probing a bit more elaborate to compensate. Fixes #1241. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	717c715c96	wgengine/wglog: don't log failure to send data packets Fixes #1239	4 years ago
Josh Bleecher Snyder	dd10babaed	wgenginer/magicsock: remove Addrs methods They are now unused. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	761188e5d2	wgengine/wgcfg: fix validateEndpoints of empty string Updates tailscale/corp#1238	4 years ago
Josh Bleecher Snyder	fe7c3e9c17	all: move wgcfg from wireguard-go This is mostly code movement from the wireguard-go repo. Most of the new wgcfg package corresponds to the wireguard-go wgcfg package. wgengine/wgcfg/device{_test}.go was device/config{_test}.go. There were substantive but simple changes to device_test.go to remove internal package device references. The API of device.Config (now wgcfg.DeviceConfig) grew an error return; we previously logged the error and threw it away. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	c7fc4a06da	wgengine/router: don't configure IPv6 on Linux when IPv6 is unavailable Fixes #1214 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	4d943536f1	wgengine: don't leak TUN device in NewUserspaceEngine error path Updates #1187 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	9f5b0d058f	wgengine: fix bugs from earlier fix Fixes a regression from `e970ed0995` that wasn't covered by tests in this repo. (Our end-to-end tests in another repo caught this.) Updates #1204	4 years ago

1 2 3 4 5 ...

633 Commits (e9e4f1063d84f865b263141bbbb6128b3ab7c32a)