655 Commits (f304a45481b3721527b352a4648c2ecad941b9ff)

Author	SHA1	Message	Date
Brad Fitzpatrick	f304a45481	wgengine/monitor: add skipped failing test for Darwin route message bug ... Updates #1416 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	31721759f3	wgengine/monitor: don't return nil, nil in darwin monitor ... We used to allow that, but now it just crashes. Separately I need to figure out why it got into this path at all, which is #1416. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	b89c757817	wgengine/tsdns: explicitly reject .onion lookups ... Tor has a location-hidden service feature that enables users to host services from inside the Tor network. Each of these gets a unique DNS name that ends with .onion. As it stands now, if a misbehaving application somehow manages to make a .onion DNS request to our DNS server, we will forward that to the DNS server, which could leak that to malicious third parties. See the recent bug Brave had with this[1] for more context. RFC 7686 suggests that name resolution APIs and libraries MUST respond with NXDOMAIN unless they can actually handle Tor lookups. We can't handle .onion lookups, so we reject them. [1]: https://twitter.com/albinowax/status/1362737949872431108 Fixes tailscale/corp#1351 Signed-off-by: Christine Dodrill <xe@tailscale.com>	4 years ago
Brad Fitzpatrick	24fa616e73	wgengine/monitor: make Darwin monitor shut down cleanly, add test ... Don't use os.NewFile or (*os.File).Close on the AF_ROUTE socket. It apparently does weird things to the fd and at least doesn't seem to close it. Just use the unix package. The test doesn't actually fail reliably before the fix, though. It was an attempt. But this fixes the integration tests. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	487c520109	wgengine: fix bug from earlier commit ... Commit e3df29d488 introduced this bug where the interfaces-were-changed-or-not bit got lost. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	793cb131f0	wgengine/router: toggle killswitch when using default routes on windows. ... Fixes #1398. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	e3df29d488	wgengine{,/monitor}: move interface state fetching/comparing to monitor ... Gets it out of wgengine so the Engine isn't responsible for being a callback registration hub for it. This also removes the Engine.LinkChange method, as it's no longer necessary. The monitor tells us about changes; it doesn't seem to need any help. (Currently it was only used by Swift, but as of 14dc790137 we just do the same from Go) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a038e8690c	wgengine/netstack: fix 32-bit build broken from prior commit ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	38dc6fe758	cmd/tailscaled, wgengine: remove --fake, replace with netstack ... And add a --socks5-server flag. And fix a race in SOCKS5 replies where the response header was written concurrently with the copy from the backend. Co-authored with Naman Sood. Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d74cddcc56	wgengine/netstack: add Magic DNS + DNS resolution to SOCKS5 dialing ... Updates #707 Updates #504 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	34188d93d4	wgengine/monitor: start moving interface state accessor into monitor ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	14dc790137	wgengine/monitor: make the darwin link monitor work in the sandbox too ... Previously tailscaled on macOS was running "/sbin/route monitor" as a child process, but child processes aren't allowed in the Network Extension / App Store sandbox. Instead, just do what "/sbin/route monitor" itself does: unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, 0) and read that. We also parse it now, but don't do anything with the parsed results yet. We will over time, as we have with Linux netlink messages over time. Currently any message is considered a signal to poll and see what changed. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	a55a03d5ff	wgengine: let LinkMonitor be passed in to NewUserspaceEngine ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	ee6475a44d	wgengine: unify NewUserspaceEngine, NewUserspaceEngineAdvanced ... Also rename EngineConfig to Config to avoid wgengine.EngineConfig stutter. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	dda03a911e	wgengine/monitor: change API to permit multiple independent callbakcks ... Currently it assumes exactly 1 registered callback. This changes it to support 0, 1, or more than 1. This is a step towards plumbing wgengine/monitor into more places (and moving some of wgengine's interface state fetching into monitor in a later step) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	0eea490724	wgengine: also close link monitor on NewUserspaceEngineAdvanced error ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Naman Sood	fec9dcbda1	wgengine/netstack: start SOCKS5 server in netstack mode ... Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Naman Sood	517c90d7e5	wgengine, cmd/tailscaled: refactor netstack, forward TCP to hello as demo (#1301) ... Updates #707 Updates #504 Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago
Aleksandar Pesic	daf6de4f14	wgengine: make NewUserspaceEngine wait for TUN interface to be up on Windows ... Updates #474 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	4 years ago
Brad Fitzpatrick	ea3715e3ce	wgengine/magicsock: remove TODO about endpoints-over-DERP ... It was done in Tailscale 1.4 with CallMeMaybe disco messages containing endpoints. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	54d7070121	wgengine/router: correctly read IPv6 routes when diffing. ... Fixes #1185. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	2404c0ffad	ipn/ipnlocal: only filter out default routes when computing the local wg config. ... UIs need to see the full unedited netmap in order to know what exit nodes they can offer to the user. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	e9e4f1063d	wgengine/magicsock: fix discoEndpoint caching bug when a node key changes ... Fixes #1391 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	c64bd587ae	net/portmapper: add NAT-PMP client, move port mapping service probing ... * move probing out of netcheck into new net/portmapper package * use PCP ANNOUNCE op codes for PCP discovery, rather than causing short-lived (sub-second) side effects with a 1-second-expiring map + delete. * track when we heard things from the router so we can be less wasteful in querying the router's port mapping services in the future * use portmapper from magicsock to map a public port Fixes #1298 Fixes #1080 Fixes #1001 Updates #864 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	d038a5295d	wgengine/wglog: drop 1/s "interface is up" messages. ... Fixes #1388. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	188bb14269	wgengine: consistently close things when NewUserspaceEngineAdvanced errors ... Fixes #1363 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	6e42430ad8	wgengine/monitor: don't log any single-IP routes added to the tailscale table. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	df5adb2e23	wgengine/monitor: on linux, also monitor for IPv6 changes. ... Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b83c273737	wgengine/filter: use IPSet for localNets instead of prefixes. ... Part of #1177, preparing for doing fancier set operations on the allowed local nets. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	fd8e070d01	health, control/controlclient, wgengine: report when router unhealthy ... Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	2d96215d97	wgengine/router: make Linux delRoute idempotent, cidrDiff fail late as possible ... This makes cidrDiff do as much as possible before failing, and makes a delete of an already-deleted rule be a no-op. We should never do this ourselves, but other things on the system can, and this should help us recover a bit. Also adds the start of root-requiring tests. TODO: hook into wgengine/monitor and notice when routes are changed behind our back, and invalidate our routes map and re-read from kernel (via the ip command) at least on the next reconfig call. Updates tailscale/corp#1338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	96a488e37e	wgengine/router: simplify func normalizeCIDR using netaddr method	4 years ago
Brad Fitzpatrick	d98ef5699d	wgengine/filter: remove redundant code ... no generated code change.	4 years ago
Brad Fitzpatrick	65815cc1ac	wgengine/tsdns: skip test that requires local IPv6 when IPv6 unavailable ... Fixes #1292 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	36189e2704	wgengine/monitor: prevent shutdown hang in darwin link monitor	4 years ago
Brad Fitzpatrick	bbb4631e04	safesocket, wgengine: add some darwin failure diagnostic hints	4 years ago
Brad Fitzpatrick	4f7d60ad42	wgengine/monitor: add a darwin implementation for tailscaled mode ... Tangentially related to #987, #177, #594, #925, #505 Motivated by rebooting a launchd-controlled tailscaled and it going into SetNetworkUp(false) mode immediately because there really is no network up at system boot, but then it got stuck in that paused state forever, without a monitor implementation.	4 years ago
Josh Bleecher Snyder	c7e5ab8094	wgengine/magicsock: retry and re-send packets in TestTwoDevicePing ... When a handshake race occurs, a queued data packet can get lost. TestTwoDevicePing expected that the very first data packet would arrive. This caused occasional flakes. Change TestTwoDevicePing to repeatedly re-send packets and succeed when one of them makes it through. This is acceptable (vs making WireGuard not drop the packets) because this only affects communication with extremely old clients. And those extremely old clients will eventually connect, because the kernel will retry sends on timeout. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	1632f9fd6b	wgengine/magicsock: reduce log spam during tests ... Only do the type assertion to *net.UDPAddr when addr is non-nil. This prevents a bunch of log spam during tests.	4 years ago
Josh Bleecher Snyder	88586ec4a4	wgengine/magicsock: remove an alloc from ReceiveIPvN ... We modified the standard net package to not allocate a *net.UDPAddr during a call to (*net.UDPConn).ReadFromUDP if the caller's use of the *net.UDPAddr does not cause it to escape. That is https://golang.org/cl/291390. This is the companion change to magicsock. There are two changes required. First, call ReadFromUDP instead of ReadFrom, if possible. ReadFrom returns a net.Addr, which is an interface, which always allocates. Second, reduce the lifetime of the returned *net.UDPAddr. We do this by immediately converting it into a netaddr.IPPort. We left the existing RebindingUDPConn.ReadFrom method in place, as it is required to satisfy the net.PacketConn interface. With the upstream change and both of these fixes in place, we have removed one large allocation per packet received. name old time/op new time/op delta ReceiveFrom-8 16.7µs ± 5% 16.4µs ± 8% ~ (p=0.310 n=5+5) name old alloc/op new alloc/op delta ReceiveFrom-8 112B ± 0% 64B ± 0% -42.86% (p=0.008 n=5+5) name old allocs/op new allocs/op delta ReceiveFrom-8 3.00 ± 0% 2.00 ± 0% -33.33% (p=0.008 n=5+5) Co-authored-by: Sonia Appasamy <sonia@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	0c673c1344	wgengine/magicsock: unify on netaddr types in addrSet ... addrSet maintained duplicate lists of netaddr.IPPorts and net.UDPAddrs. Unify to use the netaddr type only. This makes (*Conn).ReceiveIPvN a bit uglier, but that'll be cleaned up in a subsequent commit. This is preparatory work to remove an allocation from ReceiveIPv4. Co-authored-by: Sonia Appasamy <sonia@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Josh Bleecher Snyder	4cd9218351	wgengine/magicsock: prevent logging while running benchmarks ... Co-authored-by: Sonia Appasamy <sonia@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	88ab0173a7	wgengine/router: fix BSD router to support multiple local addrs, IPv6 ... Fixes #1201	4 years ago
Brad Fitzpatrick	917307a90c	wgengine/tstun: reply to MagicDNS pings ... Fixes #849 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Josh Bleecher Snyder	635e4c7435	wgengine/magicsock: increase legacy ping timeout again ... I based my estimation of the required timeout based on locally observed behavior. But CI machines are worse than my local machine. 16s was enough to reduce flakiness but not eliminate it. Bump it up again. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
Brad Fitzpatrick	1ec64bc94d	wgengine/router: add another Windows firewall rule to allow incoming UDP ... Based on @sailorfrag's research. Fixes #1312 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	7e201806b1	wgengine/magicsock: reconnect to DERP home after network comes back up ... Updates #1310	4 years ago
Brad Fitzpatrick	cbd6224ca4	wgengine/winnet: don't build on non-windows ... It only affects 'go install ./...', etc, and only on darwin/arm64 (M1 Macs) where the go-ole package doesn't compile. No need to build it. Updates #943	4 years ago
Brad Fitzpatrick	9b4e50cec0	wgengine/magicsock: fix typo in comment	4 years ago
Naman Sood	07c3df13c6	wgengine/tstun: inform userspaceEngine about injected outbound packets in tundev ... Signed-off-by: Naman Sood <mail@nsood.in>	4 years ago