150 Commits (edf64e09010cf986f15936c14481fb5f6bd16b25)

Author	SHA1	Message	Date
Brad Fitzpatrick	b560386c1a	net/packet, wgengine, tstun: add inter-node TSMP protocol for connect errors ... This adds a new IP Protocol type, TSMP on protocol number 99 for sending inter-tailscale messages over WireGuard, currently just for why a peer rejects TCP SYNs (ACL rejection, shields up, and in the future: nothing listening, something listening on that port but wrong interface, etc) Updates #1094 Updates tailscale/corp#1185 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Sonia Appasamy	024671406b	ipn: only send services in Hostinfo if Tailnet has opted-in to services collection (#1107) ... Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	4 years ago
Brad Fitzpatrick	5efb0a8bca	cmd/tailscale: change formatting of "tailscale status" ... * show DNS name over hostname, removing domain's common MagicDNS suffix. only show hostname if there's no DNS name. but still show shared devices' MagicDNS FQDN. * remove nerdy low-level details by default: endpoints, DERP relay, public key. They're available in JSON mode still for those who need them. * only show endpoint or DERP relay when it's active with the goal of making debugging easier. (so it's easier for users to understand what's happening) The asterisks are gone. * remove Tx/Rx numbers by default for idle peers; only show them when there's traffic. * include peers' owner login names * add CLI option to not show peers (matching --self=true, --peers= also defaults to true) * sort by DNS/host name, not public key * reorder columns	4 years ago
Brad Fitzpatrick	b5129dadfd	ipn: fix buggy-looking format string in error log ... On shutdown, logs showed: wgengine status error: &errors.errorString{s:"engine closing; no status"}	4 years ago
Brad Fitzpatrick	e8ae355bb8	ipn: delete domainsForProxying, require explicit DNS search domains (mapver 9) (#1078) ... Previously the client had heuristics to calculate which DNS search domains to set, based on the peers' names. Unfortunately that prevented us from doing some things we wanted to do server-side related to node sharing. So, bump MapRequest.Version to 9 to signal that the client only uses the explicitly configured DNS search domains and doesn't augment it with its own list. Updates tailscale/corp#1026 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package ... This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints ... Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	294ceb513c	ipn, wgengine/magicsock: fix `tailscale status` display. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Christine Dodrill	2485faf69a	Merge branch 'main' into report-status-systemd	4 years ago
Christine Dodrill	7ea809897d	ipn/ipnserver: enable systemd-notify support ... Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>	4 years ago
Josh Bleecher Snyder	a6cad71fb2	go.mod: upgrade staticcheck to 0.1.0 ... Also run go.mod and fix some staticcheck warnings. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	dfbde3d3aa	ipn: pass through the prefix length from control. ... Control sets this to /32 for IPv4 and /128 for IPv6. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	c0af7deb86	tailcfg, cmd/tailscale: add Hostinfo.ShareeNode, hide in "tailscale status"	4 years ago
Sonia Appasamy	0710fca0cd	tailcfg: include ShieldsUp in HostInfo	4 years ago
Brad Fitzpatrick	19b0cfe89e	all: prepare for GOOS=ios in Go 1.16 ... Work with either way for now on iOS (darwin/arm64 vs ios/arm64). In February when Go 1.16 comes out we'll have a universal binary for darwin/arm64 (macOS) and will drop support for Go 1.15 and its darwin/amd64 meaning iOS. (it'll mean macOS). Context: * https://tip.golang.org/doc/go1.16#darwin * https://github.com/golang/go/issues/38485 * https://github.com/golang/go/issues/42100	4 years ago
Brad Fitzpatrick	d21956436a	ipn, tailcfg: change Windows subnet disabling behavior w/ WPAD ... In 1.0, subnet relays were not specially handled when WPAD+PAC was present on the network. In 1.2, on Windows, subnet relays were disabled if WPAD+PAC was present. That was what some users wanted, but not others. This makes it configurable per domain, reverting back to the 1.0 default state of them not being special. Users who want that behavior can then enable it. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	76d99cf01a	wgengine/filter: remove the Matches type. ... It only served to obscure the underlying slice type without adding much value. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b3634f020d	wgengine/filter: use netaddr types in public API. ... We still use the packet.* alloc-free types in the data path, but the compilation from netaddr to packet happens within the filter package. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	4f4e84236a	ipn: clean up Prefs logging at start ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	6bcb466096	ipn: disambiguate how machine key was initialized ... Seeing "frontend-provided legacy machine key" was weird (and not quite accurate) on Linux machines where it comes from the _daemon key's persist prefs, not the "frontend". Make the log message distinguish between the cases. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	07b6ffd55c	ipn: only use Prefs, not computed stateKey, to determine server mode ... When the service was running without a client (e.g. after a reboot) and then the owner logs in and the GUI attaches, the computed state key changed to "" (driven by frontend prefs), and then it was falling out of server mode, despite the GUI-provided prefs still saying it wanted server mode. Also add some logging. And remove a scary "Access denied" from a user-visible error, making the two possible already-in-use error messages consistent with each other.	4 years ago
Brad Fitzpatrick	20a357b386	ipn, ipn/ipnserver: add IPN state for server in use, handle explicitly ... On Windows, we were previously treating a server used by different users as a fatal error, which meant the second user (upon starting Tailscale, explicitly or via Start Up programs) got an invasive error message dialog. Instead, give it its own IPN state and change the Notify.ErrMessage to be details in that state. Then the Windows GUI can be less aggresive about that happening. Also, * wait to close the IPN connection until the server ownership state changes so the GUI doesn't need to repeatedly reconnect to discover changes. * fix a bug discovered during testing: on system reboot, the ipnserver's serverModeUser was getting cleared while the state transitioned from Unknown to Running. Instead, track 'inServerMode' explicitly and remove the old accessor method which was error prone. * fix a rare bug where the client could start up and set the server mode prefs in its Start call and we wouldn't persist that to the StateStore storage's prefs start key. (Previously it was only via a prefs toggle at runtime)	4 years ago
Brad Fitzpatrick	cc3259f8d9	ipn: fix crash generating machine key on new installs ... Regression from d6ad41dcea (for #732). Probably also means eab6e9ea4e was unnecessary, but it's fine. Fixes #887	4 years ago
Brad Fitzpatrick	01ee638cca	Change some os.IsNotExist to errors.Is(err, os.ErrNotExist) for non-os errors. ... os.IsNotExist doesn't unwrap errors. errors.Is does. The ioutil.ReadFile ones happened to be fine but I changed them so we're consistent with the rule: if the error comes from os, you can use os.IsNotExist, but from any other package, use errors.Is. (errors.Is always would also work, but not worth updating all the code) The motivation here was that we were logging about failure to migrate legacy relay node prefs file on startup, even though the code tried to avoid that. See golang/go#41122	4 years ago
Elias Naur	eab6e9ea4e	ipn: don't temporarilySetMachineKeyInPersist for Android clients ... Without this change, newly installed Android clients crash on startup with panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x9881b9f8] goroutine 29 [running]: tailscale.com/ipn.(*LocalBackend).initMachineKeyLocked.func1(0x50cb1b9c, 0x503c9a00) /home/elias/proj/tailscale/ipn/local.go:711 +0x2c tailscale.com/ipn.(*LocalBackend).initMachineKeyLocked(0x503c9a00, 0x0, 0x0) /home/elias/proj/tailscale/ipn/local.go:736 +0x728 tailscale.com/ipn.(*LocalBackend).loadStateLocked(0x503c9a00, 0x988be40e, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0) /home/elias/proj/tailscale/ipn/local.go:817 +0x1e8 tailscale.com/ipn.(*LocalBackend).Start(0x503c9a00, 0x0, 0x0, 0x988be40e, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, ...) /home/elias/proj/tailscale/ipn/local.go:412 +0x200 main.(*backend).Start(...) /home/elias/proj/tailscale-android/cmd/tailscale/backend.go:116 main.(*App).runBackend.func3(0x50106340, 0x5000c060, 0x50d9a280) /home/elias/proj/tailscale-android/cmd/tailscale/main.go:169 +0x90 created by main.(*App).runBackend /home/elias/proj/tailscale-android/cmd/tailscale/main.go:168 +0x27c Signed-off-by: Elias Naur <mail@eliasnaur.com>	4 years ago
Brad Fitzpatrick	2b819ab38c	ipn: don't log redundant peer stats so often ... It was especially bad on our GUI platforms with a frontend that polls it. No need to log it every few seconds if it's unchanged. Make it slightly less allocate-y while I'm here.	4 years ago
David Anderson	54e6c3a290	version: use OSS repo's version when building. ... When building with redo, also include the git commit hash from the proprietary repo, so that we have a precise commit that identifies all build info (including Go toolchain version). Add a top-level build script demonstrating to downstream distros how to burn the right information into builds. Adjust `tailscale version` to print commit hashes when available. Fixes #841. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	d6ad41dcea	ipn: send machine key to clients so they can downgrade to 1.0.x if needed ... Fixes #732 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	e72f480d22	ipn: convert an int to a bool	4 years ago
Brad Fitzpatrick	999bc93a4d	ipn: log active account on change ... Updates tailscale/corp#461	4 years ago
Brad Fitzpatrick	66d196326f	ipn: rename 'new' variable to 'newp' ... Both to avoid shadowing new and because new is a little vague for such a long method handling multiple new & old things.	4 years ago
Brad Fitzpatrick	6b1d2a5630	ipn: don't set DebugFlags to len 1 slice of empty string [""] ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	62d941dc26	tailcfg: add a DebugFlags field for experiments and debugging. ... Also replaces the IPv6Overlay bool with use of DebugFlags, since it's currently an experimental configuration. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	1fd9958e9d	ipn: wait for initial portpoll result before starting controlclient ... We were creating the controlclient and starting the portpoll concurrently, which frequently resulted in the first controlclient connection being canceled by the firsdt portpoll result ~milliseconds later, resulting in another HTTP request. Instead, wait a bit for the first portpoll result so it's much less likely to interrupt our controlclient connection. Updates tailscale/corp#557	4 years ago
Brad Fitzpatrick	515866d7c6	ipn, ipnserver, cmd/tailscale: add "server mode" support on Windows ... This partially (but not yet fully) migrates Windows to tailscaled's StateStore storage system. This adds a new bool Pref, ForceDaemon, defined as: // ForceDaemon specifies whether a platform that normally // operates in "client mode" (that is, requires an active user // logged in with the GUI app running) should keep running after the // GUI ends and/or the user logs out. // // The only current applicable platform is Windows. This // forced Windows to go into "server mode" where Tailscale is // running even with no users logged in. This might also be // used for macOS in the future. This setting has no effect // for Linux/etc, which always operate in daemon mode. Then, when ForceDaemon becomes true, we now write use the StateStore to track which user started it in server mode, and store their prefs under that key. The ipnserver validates the connections/identities and informs that LocalBackend which userid is currently in charge. The GUI can then enable/disable server mode at runtime, without using the CLI. But the "tailscale up" CLI was also fixed, so Windows users can use authkeys or ACL tags, etc. Updates #275	4 years ago
Brad Fitzpatrick	6ee219a25d	ipn, wgengine, magicsock, tsdns: be quieter and less aggressive when offline ... If no interfaces are up, calm down and stop spamming so much. It was noticed as especially bad on Windows, but probably was bad everywhere. I just have the best network conditions testing on a Windows VM. Updates #604	4 years ago
Brad Fitzpatrick	587bdc4280	ipn, wgengine: disable subnet routes if network has PAC configuration ... Not configurable yet. Updates tailscale/corp#653 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	12e28aa87d	ipn: on transition from no PAC to PAC, reset state ... So previous routes aren't shadowing resources that the operating system might need (Windows Domain Controller, DNS server, corp HTTP proxy, WinHTTP fetching the PAC file itself, etc). This effectively detects when we're transitioning from, say, public wifi to corp wifi and makes Tailscale remove all its routes and stops its TCP connections and tries connecting to everything anew. Updates tailscale/corp#653	4 years ago
Brad Fitzpatrick	b5a3850d29	control/controlclient, ipn: store machine key separately from user prefs/persist ... Updates #610 (fixes after some win/xcode changes in a separate repo)	4 years ago
Brad Fitzpatrick	c8f257df00	Revert "all: keep UserProfiles a slice instead of a map for longer" ... This reverts commit e5894aba42. Breaks macOS/iOS build. Reverting per chat with Josh; he'll fix later today.	4 years ago
Josh Bleecher Snyder	e5894aba42	all: keep UserProfiles a slice instead of a map for longer ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	3bdcfa7193	ipn: remove DisableDERP pref ... We depend on DERP for NAT traversal now[0] so disabling it entirely can't work. What we'll do instead in the future is let people specify alternate/additional DERP servers. And perhaps in the future we could also add a pref for nodes to say when they expect to never need/want to use DERP for data (but allow it for NAT traversal communication). But this isn't the right pref and it doesn't work, so delete it. Fixes #318 [0] https://tailscale.com/blog/how-nat-traversal-works/	4 years ago
Brad Fitzpatrick	c41947903a	ipn: don't log if legacy prefs don't exist (the normal case these days)	4 years ago
Brad Fitzpatrick	96fd20e3c0	ipn: bail out a bit earlier when a peer doesn't have a DNS name ... It's properly handled later in tsdns.NewMap anyway, but there's work done in the meantime that can be skipped when a peer lacks a DNS name. It's also more clear that it's okay for it to be blank.	4 years ago
David Anderson	8f5b52e571	net/netns: add windows support. ... Also remove rebinding logic from the windows router. Magicsock will instead rebind based on link change signals. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	3af64765fd	ipn: fix Windows crash from improperly strict assertion	4 years ago
Brad Fitzpatrick	9b07517f18	wgengine: add Engine.SetLinkChangeCallback ... Start of making the IPN state machine react to link changes and down its DNS & routes if necessary to unblock proxy resolution (e.g. for transitioning from public to corp networks where the corp network has mandatory proxies and WPAD PAC files that can't be resolved while using the DNS/routes configured previously) This change should be a no-op. Just some callback plumbing.	4 years ago
Brad Fitzpatrick	5acbb149a2	ipn/ipnstate: include DNSName in tailscale status --json output	4 years ago
Brad Fitzpatrick	483141094c	cmd/tailscale/cli: add basic 'down' subcommand ... RELNOTE=yes	4 years ago