tailscale

Commit Graph

Author	SHA1	Message	Date
Tom DNetto	c8f4dfc8c0	derp/derphttp,net/netcheck: improve netcheck behavior under MITM proxies In cases where tailscale is operating behind a MITM proxy, we need to consider that a lot more of the internals of our HTTP requests are visible and may be used as part of authorization checks. As such, we need to 'behave' as closely as possible to ideal. - Some proxies do authorization or consistency checks based the on Host header or HTTP URI, instead of just the IP/hostname/SNI. As such, we need to construct a `*http.Request` with a valid URI everytime HTTP is going to be used on the wire, even if its over TLS. Aside from the singular instance in net/netcheck, I couldn't find anywhere else a http.Request was constructed incorrectly. - Some proxies may deny requests, typically by returning a 403 status code. We should not consider these requests as a valid latency check, so netcheck semantics have been updated to consider >299 status codes as a failed probe. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Josh Bleecher Snyder	0868329936	all: use any instead of interface{} My favorite part of generics. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7d9b1de3aa	netcheck,portmapper,magicsock: ignore some UDP write errors on Linux Treat UDP send EPERM errors as a lost UDP packet, not something super fatal. That's just the Linux firewall preventing it from going out. And add a leaf package net/neterror for that (and future) policy that all three packages can share, with tests. Updates #3619 Change-Id: Ibdb838c43ee9efe70f4f25f7fc7fdf4607ba9c1d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	758c37b83d	net/netns: thread logf into control functions So that darwin can log there without panicking during tests. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	24ea365d48	netcheck, controlclient, magicsock: add more metrics Updates #3307 Change-Id: Ibb33425764a75bde49230632f1b472f923551126 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b0b0a80318	net/netcheck: implement netcheck for js/wasm clients And the derper change to add a CORS endpoint for latency measurement. And a little magicsock change to cut down some log spam on js/wasm. Updates #3157 Change-Id: I5fd9e6f5098c815116ddc8ac90cbcd0602098a48 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a8e2cceefd	net/netcheck: hard-code preferred DERP region 900 on js/wasm for now See TODO in code. Updates #3157 Change-Id: I3a14dd2cf51d3c21336bb357af5abc362a079ff4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	5d6198adee	netcheck: don't log ErrGatewayRange "skipping portmap; gateway range likely lacks support" is really spammy on cloud systems, and not very useful in debugging. Fixes https://github.com/tailscale/tailscale/issues/3034 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Avery Pennarun	0d4a0bf60e	magicsock: if STUN failed to send before, rebind before STUNning again. On iOS (and possibly other platforms), sometimes our UDP socket would get stuck in a state where it was bound to an invalid interface (or no interface) after a network reconfiguration. We can detect this by actually checking the error codes from sending our STUN packets. If we completely fail to send any STUN packets, we know something is very broken. So on the next STUN attempt, let's rebind the UDP socket to try to correct any problems. This fixes a problem where iOS would sometimes get stuck using DERP instead of direct connections until the backend was restarted. Fixes #2994 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
slowy07	ac0353e982	fix: typo spelling grammar Signed-off-by: slowy07 <slowy.arfy@gmail.com>	3 years ago
Brad Fitzpatrick	1ae35b6c59	net/{interfaces,netcheck}: rename some fields, funcs Split out of Denton's #2164, to make that diff smaller to review. This change has no behavior changes. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w(.)\.Port = (.) -> $1 = $1.WithPort($2) \w(.)\.IP = (.) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	c6358f2247	net/netcheck: add a few more STUN retries for prior DERP home For #1310, maybe. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	0a84359d2d	tailcfg, net/netcheck: let control mark "Avoid" bit on DERP regions So a region can be used if needed, but won't be STUN-probed or used as its home. This gives us another possible debugging mechanism for #1310, or can be used as a short-term measure against DERP flip-flops for people equidistant between regions if our hysteresis still isn't good enough. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c64bd587ae	net/portmapper: add NAT-PMP client, move port mapping service probing * move probing out of netcheck into new net/portmapper package * use PCP ANNOUNCE op codes for PCP discovery, rather than causing short-lived (sub-second) side effects with a 1-second-expiring map + delete. * track when we heard things from the router so we can be less wasteful in querying the router's port mapping services in the future * use portmapper from magicsock to map a public port Fixes #1298 Fixes #1080 Fixes #1001 Updates #864 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Denton Gentry	ac42757cd7	netcheck: use reflect in sortRegions test. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Denton Gentry	43e060b0e5	netcheck: test sortRegions Signed-off-by: Denton Gentry <dgentry@tailscale.com>	4 years ago
Brad Fitzpatrick	676b5b7946	net/netcheck: improve the preferred DERP hysteresis Users in Amsterdam (as one example) were flipping back and forth between equidistant London & Frankfurt relays too much. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	08f94b3b50	net/netcheck: fix offset of unspecified address in PCP request packet Fixes #810	4 years ago
Brad Fitzpatrick	05e5233e07	net/netcheck: don't send flood of PCP unmap requests to router Updates #810	4 years ago
Brad Fitzpatrick	97e82c6cc0	net/netcheck: remove unused DNSCache from netcheck It's easy to add back later if/when the TODO is implemented.	4 years ago
Brad Fitzpatrick	7ac91c15bd	net/netcheck: fix tests on Windows Updates #50	4 years ago
Brad Fitzpatrick	fd2a30cd32	wgengine/magicsock: make test pass on Windows and without firewall dialog box Updates #50	4 years ago
Brad Fitzpatrick	40e12c17ec	net/netcheck: remove mistaken double Mutex.Unlock in error path Thanks to @dotaheor for noticing. Fixes #751	4 years ago
Brad Fitzpatrick	1e562886f5	net/netcheck: in verbose mode, probe all regions So 'tailscale netcheck --verbose' shows all regions' latencies.	4 years ago
David Anderson	a2b4ad839b	net/netcheck: lower the hairpin check timeout to 100ms. This single check is the long pole for netcheck, and significantly slows down magicsock tests. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	25288567ec	net/netcheck: centralize all clock values in one place. This makes it easier to see how long a netcheck might take, and what the slow bits might be. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	10ac066013	all: fix vet warnings	4 years ago
Brad Fitzpatrick	6c74065053	wgengine/magicsock, tstest/natlab: start hooking up natlab to magicsock Also adds ephemeral port support to natlab. Work in progress. Pairing with @danderson.	4 years ago
Brad Fitzpatrick	ecf5d69c7c	net/netcheck: add missing comment asked for in earlier code review	4 years ago
Brad Fitzpatrick	5c6d8e3053	netcheck, tailcfg, interfaces, magicsock: survey UPnP, NAT-PMP, PCP Don't do anything with UPnP, NAT-PMP, PCP yet, but see how common they are in the wild. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	cf74e9039e	net/netcheck: add an informative payload in the netcheck UDP helper packets Per comment from @normanr: `0a5ab533c1 (r40401954)` Updates #188	4 years ago
Brad Fitzpatrick	0a5ab533c1	net/netcheck: send dummy packet out to help airport extreme in hairpin check At least the Apple Airport Extreme doesn't allow hairpin sends from a private socket until it's seen traffic from that src IP:port to something else out on the internet. See https://github.com/tailscale/tailscale/issues/188#issuecomment-600728643 And it seems that even sending to a likely-filtered RFC 5737 documentation-only IPv4 range is enough to set up the mapping. So do that for now. In the future we might want to classify networks that do and don't require this separately. But for now help it. I've confirmed that this is enough to fix the hairpin check on Avery's home network, even using the RFC 5737 IP. Fixes #188	4 years ago
Brad Fitzpatrick	2d6e84e19e	net/netcheck, wgengine/magicsock: replace more UDPAddr with netaddr.IPPort	4 years ago
Brad Fitzpatrick	deb113838e	net/netcheck: use logger.ArgWriter in logConciseReport, fix comma bug, add tests	4 years ago
Brad Fitzpatrick	becce82246	net/netns, misc tests: remove TestOnlySkipPrivilegedOps, argv checks The netns UID check is sufficient for now. We can do something else later if/when needed.	4 years ago
Brad Fitzpatrick	7f68e097dd	net/netcheck: fix HTTPS fallback bug from earlier today My earlier `3fa58303d0` tried to implement the net/http.Tranhsport.DialTLSContext hook, but I didn't return a *tls.Conn, so we ended up sending a plaintext HTTP request to an HTTPS port. The response ended up being Go telling as such, not the /derp/latency-check handler's response (which is currently still a 404). But we didn't even get the 404. This happened to work well enough because Go's built-in error response was still a valid HTTP response that we can measure for timing purposes, but it's not a great answer. Notably, it means we wouldn't be able to get a future handler to run server-side and count those latency requests.	4 years ago
David Anderson	5114df415e	net/netns: set the bypass socket mark on linux. This allows tailscaled's own traffic to bypass Tailscale-managed routes, so that things like tailscale-provided default routes don't break tailscaled itself. Progress on #144. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	3fa58303d0	netcheck: address some HTTP fallback measurement TODOs	4 years ago
Brad Fitzpatrick	7247e896b5	net/netcheck: add Report.IPv4 and another TODO	4 years ago
Brad Fitzpatrick	9e3ad4f79f	net/netns: add package for start of network namespace support And plumb in netcheck STUN packets. TODO: derphttp, logs, control. Updates #144 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	0245bbe97b	Make netcheck handle v6-only interfaces better, faster. Also: * add -verbose flag to cmd/tailscale netcheck * remove some API from the interfaces package * convert some of the interfaces package to netaddr.IP * don't even send IPv4 probes on machines with no IPv4 (or only v4 loopback) * and once three regions have replied, stop waiting for other probes at 2x the slowest duration. Updates #376	4 years ago
Avery Pennarun	7cd9ff3dde	net/netcheck: fix race condition initializting RegionLatency maps. Under some conditions, code would try to look things up in the maps before the first call to updateLatency. I don't see any reason to delay initialization of the maps, so let's just init them right away when creating the Report instance. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Brad Fitzpatrick	b0c10fa610	stun, netcheck: move under net	5 years ago

1 2

96 Commits (ec5c41addc03bf4392b8d854bf71a320d0f7d3ae)