73 Commits (f6e833748ba00bb7d6135fd6fae32fd88967bae7)

Author	SHA1	Message	Date
Josh Bleecher Snyder	8a3d52e882	wgengine/magicsock: use mono.Time ... magicsock makes multiple calls to Now per packet. Move to mono.Now. Changing some of the calls to use package mono has a cascading effect, causing non-per-packet call sites to also switch. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
julianknodt	1bb6abc604	net/portmapper: add upnp port mapping ... Add in UPnP portmapping, using goupnp library in order to get the UPnP client and run the portmapping functions. This rips out anywhere where UPnP used to be in portmapping, and has a flow separate from PMP and PCP. RELNOTE=portmapper now supports UPnP mappings Fixes #682 Updates #2109 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Denton Gentry	e28bc49e5f	netns_linux: remove special handling for tests. ... With netns handling localhost now, existing tests no longer need special handling. The tests set up their connections to localhost, and the connections work without fuss. Remove the special handling for tests. Also remove the hostinfo.TestCase support, since this was the only use of it. It can be added back later if really needed, but it would be better to try to make tests work without special cases. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Denton Gentry	d2480fd508	net/netns: support !CAP_NET_ADMIN ... netns_linux checked whether "ip rule" could run to determine whether to use SO_MARK for network namespacing. However in Linux environments which lack CAP_NET_ADMIN, such as various container runtimes, the "ip rule" command succeeds but SO_MARK fails due to lack of permission. SO_BINDTODEVICE would work in these environments, but isn't tried. In addition to running "ip rule" check directly whether SO_MARK works or not. Among others, this allows Microsoft Azure App Service and AWS App Runner to work. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	1cedd944cf	cmd/tailscale/cli: diagnose missing tailscaled on 'up' ... Fixes #2029 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
julianknodt	506c2fe8e2	cmd/tailscale: make netcheck use active DERP map, delete static copy ... After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
julianknodt	148602a89a	derp,cmd/derper: allow server to verify clients ... This adds a flag to the DERP server which specifies to verify clients through a local tailscaled. It is opt-in, so should not affect existing clients, and is mainly intended for users who want to run their own DERP servers. It assumes there is a local tailscaled running and will attempt to hit it for peer status information. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
Denton Gentry	ad288baaea	net/interfaces: use IPv4 link local if nothing better ... The only connectivity an AWS Lambda container has is an IPv4 link-local 169.254.x.x address using NAT: 12: vtarget_1@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 7e:1c:3f:00:00:00 brd ff:ff:ff:ff:ff:ff link-netnsid 1 inet 169.254.79.1/32 scope global vtarget_1 valid_lft forever preferred_lft forever If there are no other IPv4/v6 addresses available, and we are running in AWS Lambda, allow IPv4 169.254.x.x addresses to be used. ---- Similarly, a Google Cloud Run container's only connectivity is a Unique Local Address fddf:3978:feb1:d745::c001/128. If there are no other addresses available then allow IPv6 Unique Local Addresses to be used. We actually did this in an earlier release, but now refactor it to work the same way as the IPv4 link-local support is being done. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Maisem Ali	f944614c5c	cmd/tailscale/web: add support for QNAP ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	95e296fd96	cmd/tailscale/web: restrict web access to synology admins. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	a86a0361a7	go.mod: upgrade all deps ... At the start of a dev cycle we'll upgrade all dependencies. Done with: $ for Dep in $(cat go.mod | perl -ne '/(\S+) v/ and print "$1\n"'); do go get $Dep@upgrade; done Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	5666663370	net/packet: use netaddr AppendTo methods ... This lets us remote the types/strbuilder package, which had only a single user. And it's faster. name old time/op new time/op delta String/tcp4-8 175ns ± 0% 58ns ± 1% -66.95% (p=0.000 n=10+9) String/tcp6-8 226ns ± 1% 136ns ± 1% -39.85% (p=0.000 n=10+10) String/udp4-8 175ns ± 1% 58ns ± 1% -67.01% (p=0.000 n=10+9) String/udp6-8 230ns ± 1% 140ns ± 0% -39.32% (p=0.000 n=10+9) String/icmp4-8 164ns ± 0% 50ns ± 1% -69.89% (p=0.000 n=10+10) String/icmp6-8 217ns ± 1% 129ns ± 0% -40.46% (p=0.000 n=10+10) String/igmp-8 196ns ± 0% 56ns ± 1% -71.32% (p=0.000 n=10+10) String/unknown-8 2.06ns ± 1% 2.06ns ± 2% ~ (p=0.985 n=10+10) name old alloc/op new alloc/op delta String/tcp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/tcp6-8 168B ± 0% 96B ± 0% -42.86% (p=0.000 n=10+10) String/udp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/udp6-8 168B ± 0% 96B ± 0% -42.86% (p=0.000 n=10+10) String/icmp4-8 32.0B ± 0% 32.0B ± 0% ~ (all equal) String/icmp6-8 104B ± 0% 64B ± 0% -38.46% (p=0.000 n=10+10) String/igmp-8 48.0B ± 0% 48.0B ± 0% ~ (all equal) String/unknown-8 0.00B 0.00B ~ (all equal) name old allocs/op new allocs/op delta String/tcp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/tcp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/udp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/udp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/icmp4-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/icmp6-8 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10) String/igmp-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) String/unknown-8 0.00 0.00 ~ (all equal) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	ca65c6cbdb	cmd/tailscale: make 'file cp' have better error messages on bad targets ... Say when target isn't owned by current user, and when target doesn't exist in netmap. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Avery Pennarun	19c3e6cc9e	types/logger: rate limited: more hysteresis, better messages. ... - Switch to our own simpler token bucket, since x/time/rate is missing necessary stuff (can't provide your own time func; can't check the current bucket contents) and it's overkill anyway. - Add tests that actually include advancing time. - Don't remove the rate limit on a message until there's enough room to print at least two more of them. When we do, we'll also print how many we dropped, as a contextual reminder that some were previously lost. (This is more like how the Linux kernel does it.) - Reformat the [RATE LIMITED] messages to be shorter, and to not corrupt original message. Instead, we print the message, then print its format string. - Use %q instead of \"%s\", for more accurate parsing later, if the format string contained quotes. Fixes #1772 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Brad Fitzpatrick	8554694616	cmd/tailscale: add 'tailscale file get' subcommand ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5ecc7c7200	cmd/tailscale: make the new 'up' errors prettier and more helpful ... Fixes #1746 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	db5e269463	client/tailscale/apitype: move local API types to new apitype package ... They were scattered/duplicated in misc places before. It can't be in the client package itself for circular dep reasons. This new package is basically tailcfg but for localhost communications, instead of to control. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9972c02b60	cmd/tailscale/cli: don't let up change prefs based on implicit flag values ... This changes the behavior of "tailscale up". Previously "tailscale up" always did a new Start and reset all the settings. Now "tailscale up" with no flags just brings the world [back] up. (The opposite of "tailscale down"). But with flags, "tailscale up" now only is allowed to change preferences if they're explicitly named in the flags. Otherwise it's an error. Or you need to use --reset to explicitly nuke everything. RELNOTE=tailscale up change Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	50b309c1eb	ipn/localapi, cmd/tailscale: add API to get prefs, CLI debug command to show ... Updates #1436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	f0863346c2	cmd/tailscale: add web subcommand ... Used as an app frontend UI on Synology. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	01b90df2fa	net/packet, wgengine/filter: support SCTP ... Add proto to flowtrack.Tuple. Add types/ipproto leaf package to break a cycle. Server-side ACL work remains. Updates #1516 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0406a7436a	cmd/tailscale/cli: use double hypens, make default usage func more clear ... Mash up some code from ffcli and std's flag package to make a default usage func that's super explicit for those not familiar with the Go style flags. Only show double hyphens in usage text (but still accept both), and show default values, and only show the proper usage of boolean flags. Fixes #1353 Fixes #1529 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0a02aaf813	control, ipn, tailcfg: remove golang.org/x/oauth2 dep, add tailcfg.Oauth2Token ... golang.org/x/oauth2 pulls in App Engine and grpc module dependencies, screwing up builds that depend on this module. Some background on the problem: https://go.googlesource.com/proposal/+/master/design/36460-lazy-module-loading.md Fixes tailscale/corp#1471 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aleksandar Pesic	7b57310966	net/interfaces: use windows API to get the default route instead of parsing `route print` output ... Fixes: #1470 Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>	3 years ago
Brad Fitzpatrick	44ab0acbdb	net/portmapper, wgengine/monitor: cache gateway IP info until link changes ... Cuts down allocs & CPU in steady state (on regular STUN probes) when network is unchanging. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	bc159dc689	cmd/tailscale: fix depaware.txt ... git fail. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	03c344333e	cmd/tailscale: remove Windows console fixing ... Not needed, as we don't build this as a GUI app ever. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c64bd587ae	net/portmapper: add NAT-PMP client, move port mapping service probing ... * move probing out of netcheck into new net/portmapper package * use PCP ANNOUNCE op codes for PCP discovery, rather than causing short-lived (sub-second) side effects with a 1-second-expiring map + delete. * track when we heard things from the router so we can be less wasteful in querying the router's port mapping services in the future * use portmapper from magicsock to map a public port Fixes #1298 Fixes #1080 Fixes #1001 Updates #864 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	86d3a6c9a6	Switch to Go 1.16. ... Fixes #1370 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	dec01ef22b	safesocket: make ConnectDefault use paths pkg, fixing tailscaled-on-macOS ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	52e24aa966	net/{interfaces,ns}: add tailscaled-mode darwin routing looping prevention ... Fixes #1331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1e7a35b225	types/netmap: split controlclient.NetworkMap off into its own leaf package ... Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ddfcc4326c	types/persist: split controlclient.Persist into a small leaf package ... This one alone doesn't modify the global dependency map much (depaware.txt if anything looks slightly worse), but it leave controlclient as only containing NetworkMap: bradfitz@tsdev:~/src/tailscale.com/ipn$ grep -F "controlclient." *.go backend.go: NetMap *controlclient.NetworkMap // new netmap received fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) fake_test.go: b.notify(Notify{NetMap: &controlclient.NetworkMap{}}) handle.go: netmapCache *controlclient.NetworkMap handle.go:func (h *Handle) NetMap() *controlclient.NetworkMap { Once that goes into a leaf package, then ipn doesn't depend on controlclient at all, and then the client gets smaller. Updates #1278	3 years ago
Brad Fitzpatrick	6064b6ff47	wgengine/wgcfg/nmcfg: split control/controlclient/netmap.go into own package ... It couldn't move to ipnlocal due to test dependency cycles. Updates #1278 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	b9c2231fdf	ipn: program exit node into the data plane according to user pref. ... Part of #1153, #1154. Fixes #1224. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	aa6856a9eb	wgengine: adapt to wireguard-go changes ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	d76334d2f0	ipn: split LocalBackend off into new ipn/ipnlocal package ... And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6254efb9ef	cmd/tailscale{,d}: move debug subcommand to tailscaled ... Work on reducing the size of the tailscale binary, which is currently pulling in most of the same code as tailscaled. Updates #1181	3 years ago
Josh Bleecher Snyder	fe7c3e9c17	all: move wgcfg from wireguard-go ... This is mostly code movement from the wireguard-go repo. Most of the new wgcfg package corresponds to the wireguard-go wgcfg package. wgengine/wgcfg/device{_test}.go was device/config{_test}.go. There were substantive but simple changes to device_test.go to remove internal package device references. The API of device.Config (now wgcfg.DeviceConfig) grew an error return; we previously logged the error and threw it away. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	d5baeeed5c	wgengine: use Tailscale-style peer identifiers in logs ... Rewrite log lines on the fly, based on the set of known peers. This enables us to use upstream wireguard-go logging, but maintain the Tailscale-style peer public key identifiers that the rest of our systems (and people) expect. Fixes #1183 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	9541886856	wgengine/magicsock: disable regular STUNs for all platforms by default ... Reduces background CPU & network. Updates #1034 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	654b5f1570	all: convert from []wgcfg.Endpoint to string ... This eliminates a dependency on wgcfg.Endpoint, as part of the effort to eliminate our wireguard-go fork. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Anderson	9abcb18061	wgengine/magicsock: import more of wireguard-go, update docstrings. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	22507adf54	wgengine/magicsock: stop depending on UpdateDst in legacy codepaths. ... This makes connectivity between ancient and new tailscale nodes slightly worse in some cases, but only in cases where the ancient version would likely have failed to get connectivity anyway. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	85e54af0d7	wgengine: on TCP connect fail/timeout, log some clues about why it failed ... So users can see why things aren't working. A start. More diagnostics coming. Updates #1094	3 years ago
Brad Fitzpatrick	f85769b1ed	wgengine/magicsock: drop netaddr.IPPort cache ... netaddr.IP no longer allocates, so don't need a cache or all its associated code/complexity. This totally removes groupcache/lru from the deps. Also go mod tidy.	3 years ago
Brad Fitzpatrick	a80446c026	Update depaware (removes lru from wgengine/filter)	3 years ago
Brad Fitzpatrick	5efb0a8bca	cmd/tailscale: change formatting of "tailscale status" ... * show DNS name over hostname, removing domain's common MagicDNS suffix. only show hostname if there's no DNS name. but still show shared devices' MagicDNS FQDN. * remove nerdy low-level details by default: endpoints, DERP relay, public key. They're available in JSON mode still for those who need them. * only show endpoint or DERP relay when it's active with the goal of making debugging easier. (so it's easier for users to understand what's happening) The asterisks are gone. * remove Tx/Rx numbers by default for idle peers; only show them when there's traffic. * include peers' owner login names * add CLI option to not show peers (matching --self=true, --peers= also defaults to true) * sort by DNS/host name, not public key * reorder columns	3 years ago
Josh Bleecher Snyder	1271e135cd	wgengine/tstun: initialize wireguard-go TUN parameters ... This will enable us to remove the corresponding code from our fork of wireguard-go. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	56a7652dc9	wgkey: new package ... This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago