611 Commits (f6642e0ece20e59e29a076d500d0edf03122d2d1)

Author	SHA1	Message	Date
Brad Fitzpatrick	486059589b	all: gofmt -w -s (simplify) tests ... And it updates the build tag style on a couple files. Change-Id: I84478d822c8de3f84b56fa1176c99d2ea5083237 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cced414c7d	net/dns/resolver: add Windows ExitDNS service support, using net package ... Updates #1713 Updates #835 Change-Id: Ia71e96d0632c2d617b401695ad68301b07c1c2ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	63cd581c3f	safesocket: add ConnectionStrategy, provide control over fallbacks ... fee2d9fad added support for cmd/tailscale to connect to IPNExtension. It came in two parts: If no socket was provided, dial IPNExtension first, and also, if dialing the socket failed, fall back to IPNExtension. The second half of that support caused the integration tests to fail when run on a machine that was also running IPNExtension. The integration tests want to wait until the tailscaled instances that they spun up are listening. They do that by dialing the new instance. But when that dial failed, it was falling back to IPNExtension, so it appeared (incorrectly) that tailscaled was running. Hilarity predictably ensued. If a user (or a test) explicitly provides a socket to dial, it is a reasonable assumption that they have a specific tailscaled in mind and don't want to fall back to IPNExtension. It is certainly true of the integration tests. Instead of adding a bool to Connect, split out the notion of a connection strategy. For now, the implementation remains the same, but with the details hidden a bit. Later, we can improve that. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	7b9c7bc42b	ipn/ipnstate: remove old deprecated TailAddr IPv4-only field ... It's been a bunch of releases now since the TailscaleIPs slice replacement was added. Change-Id: I3bd80e1466b3d9e4a4ac5bedba8b4d3d3e430a03 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	878a20df29	net/dns: add GetBaseConfig to CallbackRouter. ... Allow users of CallbackRouter to supply a GetBaseConfig implementation. This is expected to be used on Android, which currently lacks both a) platform support for Split-DNS and b) a way to retrieve the current DNS servers. iOS/macOS also use the CallbackRouter but have platform support for SplitDNS, so don't need getBaseConfig. Updates https://github.com/tailscale/tailscale/issues/2116 Updates https://github.com/tailscale/tailscale/issues/988 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	c0701b130d	ipn/ipnstate, cmd/tailscale: add Online bool to tailscale status & --json ... Fixes #3533 Change-Id: I2f6f0d712cf3f987fba1c15be74cdb5c8d565f04 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Todd Neal	c18dc57861	ipn/{ipnserver,ipnlocal}: support incoming Taildrop on TrueNAS ... Signed-off-by: Todd Neal <todd@tneal.org>	3 years ago
Brad Fitzpatrick	d3d503d997	ipn/ipnlocal: add HTTP/2 h2c server support to peerapi on non-mobile platforms ... To make ExitDNS cheaper. Might not finish client-side support in December before 1.20, but at least server support can start rolling out ahead of clients being ready for it. Tested with curl against peerapi. Updates #1713 Change-Id: I676fed5fb1aef67e78c542a3bc93bddd04dd11fe Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	abc00e9c8d	ipn/{ipnserver,ipnlocal}: support incoming Taildrop on Synology ... If the user has a "Taildrop" shared folder on startup and the "tailscale" system user has read/write access to it, then the user can "tailscale file cp" to their NAS. Updates #2179 (would be fixes, but not super ideal/easy yet) Change-Id: I68e59a99064b302abeb6d8cc84f7d2a09f764990 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9c5c9d0a50	ipn/ipnlocal, net/tsdial: make SOCKS/HTTP dials use ExitDNS ... And simplify, unexport some tsdial/netstack stuff in the the process. Fixes #3475 Change-Id: I186a5a5cbd8958e25c075b4676f7f6e70f3ff76e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9f6249b26d	ipn/policy: treat DNS service as interesting so it's not filtered out ... The control plane is currently still eating it. Updates #1713 Change-Id: I66a0698599d6794ab1302f9585bf29e38553c884 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	adc5997592	net/tsdial: give netstack a Dialer, start refactoring name resolution ... This starts to refactor tsdial.Dialer's name resolution to have different stages: in-memory MagicDNS vs system resolution. A future change will plug in ExitDNS resolution. This also plumbs a Dialer into netstack and unexports the dnsMap internals. And it removes some of the async AddNetworkMapCallback usage and replaces it with synchronous updates of the Dialer's netmap from LocalBackend, since the LocalBackend has the Dialer too. Updates #3475 Change-Id: Idcb7b1169878c74f0522f5151031ccbc49fe4cb4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	43983a4a3b	ipn/ipnlocal: run peerapi even if Taildrop storage not configured ... Change-Id: I77f9ecbe4617d01d13aa1127fa59c83f2aa3e1b8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	44d0c1ab06	ipn/ipnlocal: resolve exit node IP to ID at EditPrefs time. ... Without this, enabling an exit node immediately blackholes all traffic, but doesn't correctly let it flow to the exit node until the next netmap update. Fixes #3447 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	ad3d6e31f0	net/tsdial: move macOS/iOS peerapi sockopt logic from LocalBackend ... Change-Id: I812cae027c40c70cdc701427b1a1850cd9bcd60c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c7fb26acdb	net/tsdial: also plumb TUN name and monitor into tsdial.Dialer ... In prep for moving stuff out of LocalBackend. Change-Id: I9725aa9c3ebc7275f8c40e040b326483c0340127 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c37af58ea4	net/tsdial: move more weirdo dialing into new tsdial package, plumb ... Not done yet, but this move more of the outbound dial special casing from random packages into tsdial, which aspires to be the one unified place for all outbound dialing shenanigans. Then this plumbs it all around, so everybody is ultimately holding on to the same dialer. As of this commit, macOS/iOS using an exit node should be able to reach to the exit node's DoH DNS proxy over peerapi, doing the sockopt to stay within the Network Extension. A number of steps remain, including but limited to: * move a bunch more random dialing stuff * make netstack-mode tailscaled be able to use exit node's DNS proxy, teaching tsdial's resolver to use it when an exit node is in use. Updates #1713 Change-Id: I1e8ee378f125421c2b816f47bc2c6d913ddcd2f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3ae6f898cf	ipn/ipnlocal, net/dns/resolver: use exit node's DoH proxy when available ... Updates #1713 Change-Id: I3695a40ec12d2b4e6dac41cf4559daca6dddd68e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	16abd7e07c	ipn/ipnlocal: fix Content-Length in DoH DNS proxy response ... Updates #1713 Change-Id: I912d90383b751ad97b32bcec55e8fedbcf4d3db8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2a95ee4680	cmd/tailscale, ipn/ipnstate: note which nodes are exit nodes in status ... Fixes #3446 Change-Id: Ib41d588e7fa434c02d134fa449f85b0e15083683 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3181bbb8e4	cmd/tailscale: make file cp send files via tailscaled localapi ... So Taildrop sends work even if the local tailscaled is running in netstack mode, as it often is on Synology, etc. Updates #2179 (which is primarily about receiving, but both important) Change-Id: I9bd1afdc8d25717e0ab6802c7cf2f5e0bd89a3b2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b811a316bc	tailcfg, ipn/ipnlocal: advertise a Service when exit node DNS proxy available ... Updates #1713 Change-Id: I20c8e2ad1062d82ef17363414e372133f4c7181e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	135580a5a8	tailcfg, ipn/ipnlocal, net/dns: forward exit node DNS on Unix to system DNS ... Updates #1713 Change-Id: I4c073fec0992d9e01a9a4ce97087d5af0efdc68d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c2efe46f72	ipn/ipnlocal: restrict exit node DoH server based on ACL'ed packet filter ... Don't be a DoH DNS server to peers unless the Tailnet admin has permitted that peer autogroup:internet access. Updates #1713 Change-Id: Iec69360d8e4d24d5187c26904b6a75c1dabc8979 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Thomas Weiß	f8cef1ba08	ipn/store/aws: support using sub-paths in parameters ... Fixes #3431 Signed-off-by: Thomas Weiß <panos@unbunt.org>	3 years ago
David Anderson	097602b3ca	ipn/ipnlocal: warn more precisely about IP forwarding issues on linux. ... If IP forwarding is disabled globally, but enabled per-interface on all interfaces, don't complain. If only some interfaces have forwarding enabled, warn that some subnet routing/exit node traffic may not work. Fixes #1586 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	33c541ae30	ipn/ipnlocal: populate self status from netmap in ipnlocal, not magicsock. ... Fixes #1933 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	25525b7754	net/dns/resolver, ipn/ipnlocal: wire up peerapi DoH server to DNS forwarder ... Updates #1713 Change-Id: Ia4ed9d8c9cef0e70aa6d30f2852eaab80f5f695a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	955aa188b3	ipn/ipnlocal: fix logging ... We were missing an argument here. Also, switch to %q, in case anything weird is happening with these strings. Updates tailscale/corp#461 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	283ae702c1	ipn/ipnlocal: start adding DoH DNS server to peerapi when exit node ... Updates #1713 Change-Id: I8d9c488f779e7acc811a9bc18166a2726198a429 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	027b46d0c1	ipn/ipnstate: clarify PeerStatusLite.LastHandshake ... And document the other fields, as long as we're here. Updates #1182 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	4a59a2781a	ipn/ipnlocal: export client metrics over peerapi to owner ... Updates #3307 Change-Id: I41b1f3c16af5f385575e8d6cea70ae8386504dd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	57b039c51d	util/clientmetrics: add new package to add metrics to the client ... And annotate magicsock as a start. And add localapi and debug handlers with the Prometheus-format exporter. Updates #3307 Change-Id: I47c5d535fe54424741df143d052760387248f8d3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	d6dde5a1ac	ipn/ipnlocal: handle key extensions after key has already expired ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	87137405e5	ipn/ipnserver: grant js/wasm all localapi permissions ... Updates #3157 Change-Id: I3b63762583a4d655eac33ce3dfda37a1f5135a57 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	01bd789c26	ipn/ipnserver: add Server.LocalBackend accessor ... Was done as part of e6fbc0cd54 for ssh work, but wasn't committed yet. Including it here both to minimize the ssh diff size, and because I need it for a separate change. Change-Id: If6eb54a2ca7150ace96488ed14582c2c05ca3422 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e6fbc0cd54	cmd/tailscaled, ipn/ipnserver: refactor ipnserver ... More work towards removing the massive ipnserver.Run and ipnserver.Options and making composable pieces. Work remains. (The getEngine retry loop on Windows complicates things.) For now some duplicate code exists. Once the Windows side is fixed to either not need the retry loop or to move the retry loop into a custom wgengine.Engine wrapper, then we can unify tailscaled_windows.go too. Change-Id: If84d16e3cd15b54ead3c3bb301f27ae78d055f80 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	337757a819	ipn/ipnlocal, control/controlclient: don't propagate all map errors to UI ... Fixes regression from 81cabf48ec which made all map errors be sent to the frontend UI. Fixes #3230 Change-Id: I7f142c801c7d15e268a24ddf901c3e6348b6729c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	0532eb30db	all: replace tailcfg.DiscoKey with key.DiscoPublic. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	649f7556e8	cmd/tailscaled, ipn: add tailscaled --statedir flag for var directory ... Fixes #2932 Change-Id: I1aa2b323ad542386d140f8336bcc4dcbb8310bd0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c7bff35fee	ipn/ipnlocal: add owner-only debug handler to get process env ... For debugging Synology. Like the existing goroutines handler, in that it's owner-only. Change-Id: I852f0626be8e1c0b6794c1e062111d14adc3e6ac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	3fd5f4380f	util/multierr: new package ... github.com/go-multierror/multierror served us well. But we need a few feature from it (implement Is), and it's not worth maintaining a fork of such a small module. Instead, I did a clean room implementation inspired by its API. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Anderson	7e6a1ef4f1	tailcfg: use key.NodePublic in wire protocol types. ... Updates #3206. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	7e8d5ed6f3	ipn: use key.NodePublic instead of tailcfg.NodeKey ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	c17250cee2	ipn/ipnstate: use key.NodePublic instead of tailcfg.NodeKey. ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	418adae379	various: use NodePublic.AsNodeKey() instead of tailcfg.NodeKeyFromNodePublic() ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	eeb97fd89f	various: remove remaining uses of key.NewPrivate. ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	429632d32c	ipn/ipnlocal: treat js/wasm interative logins as ephemeral for now ... At least until js/wasm starts using browser LocalStorage or something. But for the foreseeable future, any login from a browser should be considered ephemeral as the tab can close at any time and lose the wireguard key, never to be seen again. Updates #3157 Change-Id: I6c410d86dc7f9f233c3edd623313d9dee2085aac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	c1d009b9e9	ipn/ipnstate: use key.NodePublic instead of the generic key.Public. ... Updates #3206. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	96ad68c5d6	ipn: remove mention of wgkey in comment. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	0c546a28ba	types/persist: use new node key type. ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	22dbaa0894	ipn/ipnserver: add New, Server.Server ... Change-Id: I1dc85a5131b9a628d7fc780fde7103492cd3f1f8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d381bc2b6c	ipn/ipnserver: move the unserved connection logic to a Listener ... So future refactors can only deal with a net.Listener and be unconcerned with their caller's (Windows-specific) struggles. Change-Id: I0af588b9a769ab65c59b0bd21f8a0c99abfa1784 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c23a378f63	ipn/ipnserver: start refactoring ipnserver.Run into smaller pieces ... I'll keep ipnserver.Run for compatibility, but it'll be a wrapper around several smaller pieces. (more testable too) For now, start untangling some things in preparation. Plan is to have to have a constructor for the just-exported ipnserver.Server type that takes a LocalBackend and can accept (in a new method) on a provided listener. Change-Id: Ide73aadaac1a82605c97a2af1321d0d8f60b2a8c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	869999955d	ipn/ipnserver: export server type as Server ... It's all opaque, there's no constructor, and no exported methods, so it's useless at this point, but this is one small refactoring step. Change-Id: Id961e8880cf0c84f1a0a989eefff48ecb3735add Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	81cabf48ec	control/controlclient,tailcfg: propagate registration errors to the frontend ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Aaron Klotz	6425f497b1	ipn/ipnserver paths: add paths.LegacyStateFilePath ... Moving this information into a centralized place so that it is accessible to code in subsequent commits. Updates #3011 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Joe Tsai	9af27ba829	cmd/cloner: mangle "go:generate" in cloner.go ... The "go generate" command blindly looks for "//go:generate" anywhere in the file regardless of whether it is truly a comment. Prevent this false positive in cloner.go by mangling the string to look less like "//go:generate". Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Maisem Ali	c6d3f622e9	ipn/ipnlocal: use netaddr.IPSetBuilder when constructing list of interface IPPrefixes. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	ddf3394b40	ipn/ipnlocal: don't try to block localhost traffic when using exit nodes ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	751c42c097	ipn: fix formatting of ExitNodeIP in MaskedPrefs ... %#v on a netaddr.IP showed the netaddr.IP innards. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
nicksherron	f01ff18b6f	all: fix spelling mistakes ... Signed-off-by: nicksherron <nsherron90@gmail.com>	3 years ago
Maxime VISONNEAU	4528f448d6	ipn/store/aws, cmd/tailscaled: add AWS SSM ipn.StateStore implementation ... From https://github.com/tailscale/tailscale/pull/1919 with edits by bradfitz@. This change introduces a new storage provider for the state file. It allows users to leverage AWS SSM parameter store natively within tailscaled, like: $ tailscaled --state=arn:aws:ssm:eu-west-1:123456789:parameter/foo Known limitations: - it is not currently possible to specific a custom KMS key ID RELNOTE=tailscaled on Linux supports using AWS SSM for state Edits-By: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maxime VISONNEAU <maxime.visonneau@gmail.com>	3 years ago
Brad Fitzpatrick	cb4a2c00d1	ipn: remove unused Prefs.OSVersion and Prefs.DeviceModel ... iOS and Android no longer use these. They both now (as of today) use the hostinfo.SetFoo setters instead. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	67e5fabdbd	hostinfo, ipn/ipnlocal: add SetPackage, remove ipnlocal hacks ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	81269fad28	hostinfo: add SetOSVersion like SetDeviceModel, deprecate ipn.Prefs way ... Turns out the iOS client has been only sending the OS version it first started at. This whole hostinfo-via-prefs mechanism was never a good idea. Start removing it. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	22a1a5d7cf	ipn/ipnlocal: for IPv6-only nodes, publish IPv6 MagicDNS records of peers ... See https://github.com/tailscale/tailscale/issues/2970#issuecomment-931885268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6d43cbc325	ipn/ipnlocal: make sure mobile clients don't use the old control server URL ... The new frontends are better for battery. Updates #2442 Updates tailscale/corp#2750 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	173bbaa1a1	all: disable TCP keep-alives on iOS/Android ... Updates #2442 Updates tailscale/corp#2750 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3b3994f0db	ipn{,/localapi,ipnlocal}: infer cert dir from state file location ... This fixes "tailscale cert" on Synology where the var directory is typically like /volume2/@appdata/Tailscale, or any other tailscaled user who specifies a non-standard state file location. This is a interim fix on the way to #2932. Fixes #2927 Updates #2932 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3a72ebb109	ipn: test TestFileStore in a fresh subdirectory ... Fixes #2923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Klotz	21e9f98fc1	ipn, paths: unconditionally attempt to set state dir perms, but only if the state dir is ours ... We unconditionally set appropriate perms on the statefile dir. We look at the basename of the statefile dir, and if it is "tailscale", then we set perms as appropriate. Fixes #2925 Updates #2856 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	efb84ca60d	ipn/localapi, cmd/tailscale: add CPU & memory profile support, debug command ... This was already possible on Linux if you ran tailscaled with --debug (which runs net/http/pprof), but it requires the user have the Go toolchain around. Also, it wasn't possible on macOS, as there's no way to run the IPNExtension with a debug server (it doesn't run tailscaled). And on Windows it's super tedious: beyond what users want to do or what we want to explain. Instead, put it in "tailscale debug" so it works and works the same on all platforms. Then we can ask users to run it when we're debugging something and they can email us the output files. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	1eabb5b2d9	ipn: don't log IPN messages that may contain an authkey. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Aaron Klotz	9ebb5d4205	ipn, paths: ensure that the state directory for Windows has the correct perms ... ProgramData has a permissive ACL. For us to safely store machine-wide state information, we must set a more restrictive ACL on our state directory. We set the ACL so that only talescaled's user (ie, LocalSystem) and the Administrators group may access our directory. We must include Administrators to ensure that logs continue to be easily accessible; omitting that group would force users to use special tools to log in interactively as LocalSystem, which is not ideal. (Note that the ACL we apply matches the ACL that was used for LocalSystem's AppData\Local). There are two cases where we need to reset perms: One is during migration from the old location to the new. The second case is for clean installations where we are creating the file store for the first time. Updates #2856 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	7d8227e7a6	logpolicy: don't use C:\ProgramData use for tailscale-ipn GUI's log dir ... tailscale-ipn.exe (the GUI) shouldn't use C:\ProgramData. Also, migrate the earlier misnamed wg32/wg64 conf files if they're present. (That was stopped in 2db877caa3, but the files exist from fresh 1.14 installs) Updates #2856 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	280c84e46a	ipn/ipnserver, paths, logpolicy: move Window config files out of %LocalAppData% ... C:\WINDOWS\system32\config\systemprofile\AppData\Local\ is frequently cleared for almost any reason: Windows updates, System Restore, even various System Cleaner utilities. The server-state.conf file in AppData\Local could be deleted at any time, which would break login until the node is removed from the Admin Panel allowing it to create a new key. Carefully copy any AppData state to ProgramData at startup. If copying the state fails, continue to use AppData so at least there will be connectivity. If there is no state, use ProgramData. We also migrate the log.conf file. Very old versions of Tailscale named the EXE tailscale-ipn, so the log conf was tailscale-ipn.log.conf and more recent versions preserved this filename and cmdName in logs. In this migration we always update the filename to c:\ProgramData\Tailscale\tailscaled.log.conf Updates https://github.com/tailscale/tailscale/issues/2856 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	aae622314e	tailcfg, health: add way for control plane to add problems to health check ... So if the control plane knows that something's broken about the node, it can include problem(s) in MapResponse and "tailscale status" will show it. (and GUIs in the future, as it's in ipnstate.Status/JSON) This also bumps the MapRequest.Version, though it's not strictly required. Doesn't hurt. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	d5ab18b2e6	cmd/cloner: add Clone context to regen struct assignments ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	07c09f470d	ipn/ipnlocal: do not shut down the backend halfway through TestStateMachine ... LocalBackend.Shutdown's docs say: > The backend can no longer be used after Shutdown returns. Nevertheless, TestStateMachine blithely calls Shutdown, talks some smack, and continues on, expecting things to work. Other uses of Shutdown in the codebase are as intended. Things mostly kinda work anyway, except that the wgengine.Engine has been shut down, so calls to Reconfig fail. Those get logged: > local.go:603: wgengine status error: engine closing; no status but otherwise ignored. However, the Reconfig failure caused one fewer call to pause/unpause than normal. Now the assertCalls lines match the equivalent ones earlier in the test. I don't see an obvious correct replacement for Shutdown in the context of this test; I'm not sure entirely what it is trying to accomplish. It is possible that many of the tests remaining after the prior call to Shutdown are now extraneous. They don't harm anything, though, so err on the side of safety and leave them for now. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	f834a4ade5	ipn/ipnlocal: fix minor typo in comment ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	221cc5f8f2	ipn/ipnlocal: reduce line noise in tests ... Use helpers and variadic functions to make the call sites a lot easier to read, since they occur a lot. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	45d3174c0d	ipn/ipnlocal: add LocalBackend.broadcastStatusChanged ... To reduce repetition. Also, document why we acquire the lock. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	b7ede14396	Revert "ipn/ipnlocal: remove locks around sync.Cond.Broadcast call" ... Reason for revert: Causes ipnlocal tests to deadlock intermittently. This reverts commit 1b15349e01. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	3ea8cf9c62	ipn/ipnlocal: use quicktest.IsNotNil in tests ... This didn't exist when the test was written. Now it does (frankban/quicktest#94); use it. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	1b15349e01	ipn/ipnlocal: remove locks around sync.Cond.Broadcast call ... They are unnecessary. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	3b58c118dd	ipn/ipnlocal: inline LocalBackend.getEngineStatus ... For uniformity. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	0f4c0e558b	ipn/ipnlocal: use a switch statement instead of an else-if chain ... For clarity. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	7421ba91ec	ipn/ipnlocal: only call UpdateEndpoints when the endpoints change ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	b681edc572	ipn/ipnlocal: add failing test ... Concurrent calls to LocalBackend.setWgengineStatus could result in some of the status updates being dropped. This was exacerbated by 92077ae78c, which increases the probability of concurrent status updates, causing test failures (tailscale/corp#2579). It's going to take a bit of work to fix this test. The ipnlocal state machine is difficult to reason about, particularly in the face of concurrency. We could fix the test trivially by throwing a new mutex around setWgengineStatus to serialize calls to it, but I'd like to at least try to do better than cosmetics. In the meantime, commit the test. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	7693d36aed	all: close fake userspace engines when tests complete ... We were leaking FDs. In a few places, switch from defer to t.Cleanup. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	4bbf5a8636	cmd/cloner: reduce diff noise when changing command ... Spelling out the command to run for every type means that changing the command makes for a large, repetitive diff. Stop doing that. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	640134421e	all: update tests to use tstest.MemLogger ... And give MemLogger a mutex, as one caller had, which does match the logf contract better. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	48933b0382	ipn/ipnlocal: flesh out the dnsConfigForNetmap tests ... Follow-up to #2805 and #2806 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7fe6ecf165	ipn/ipnlocal: add MagicDNS records for IPv6-only nodes ... Updates #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	90b0cd0c51	ipn/ipnlocal: start adding some netmap to DNS config tests ... Follow-up to #2805 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	30a614f9b9	ipn/ipnlocal: return early, outdent a bunch in dnsConfigForNetmap ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2bb0eb5f7e	ipn/ipnlocal: pull out dns.Config construction to its own func ... In prep for other bug fixes & tests. It's hard to test when it was intermingled into LocalBackend.authReconfig. Now it's a pure function. And rename variable 'uc' (user config?) to the since idiomatic 'prefs'. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	9502b515f1	net/dns: replace resolver IPs with type for DoH ... We currently plumb full URLs for DNS resolvers from the control server down to the client. But when we pass the values into the net/dns package, we throw away any URL that isn't a bare IP. This commit continues the plumbing, and gets the URL all the way to the built in forwarder. (It stops before plumbing URLs into the OS configurations that can handle them.) For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	7bfd4f521d	cmd/tailscale: fix "tailscale ip $self-host-hostname" ... And in the process, fix the related confusing error messages from pinging your own IP or hostname. Fixes #2803 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago