634 Commits (fc2f628d4c5ef961014cd041eb01164c3d06d007)

Author	SHA1	Message	Date
Brad Fitzpatrick	a19c110dd3	envknob: track, log env knobs in use ... Fixes #3921 Change-Id: I8186053b5c09c43f0358b4e7fdd131361a6d8f2e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2db6cd1025	ipn/ipnlocal, wgengine/magicsock, logpolicy: quiet more logs ... Updates #1548 Change-Id: Ied169f872e93be2857890211f2e018307d4aeadc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	86a902b201	all: adjust some log verbosity ... Updates #1548 Change-Id: Ia55f1b5dc7dfea09a08c90324226fb92cd10fa00 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Klotz	d7962e3bcf	ipn/ipnserver, util/winutil: update workaround for os/user.LookupId failures on Windows to reject SIDs from deleted/invalid security principals. ... Our current workaround made the user check too lax, thus allowing deleted users. This patch adds a helper function to winutil that checks that the uid's SID represents a valid Windows security principal. Now if `lookupUserFromID` determines that the SID is invalid, we simply propagate the error. Updates https://github.com/tailscale/tailscale/issues/869 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	bd90781b34	ipn/ipnlocal, wgengine/netstack: use netstack for peerapi server ... We're finding a bunch of host operating systems/firewalls interact poorly with peerapi. We either get ICMP errors from the host or users need to run commands to allow the peerapi port: https://github.com/tailscale/tailscale/issues/3842#issuecomment-1025133727 ... even though the peerapi should be an internal implementation detail. Rather than fight the host OS & firewalls, this change handles the server side of peerapi entirely in netstack (except on iOS), so it never makes its way to the host OS where it might be messed with. Two main downsides are: 1) netstack isn't as fast, but we don't really need speed for peerapi. And actually, with fewer trips to/from the kernel, we might actually make up for some of the netstack performance loss by staying in userspace. 2) tcpdump / Wireshark etc packet captures will no longer see the peerapi traffic. Oh well. Crawshaw's been wanting to add packet capture server support to tailscaled, so we'll probably do that sooner now. A future change might also then use peerapi for the client-side (except on iOS). Updates #3842 (probably fixes, as well as many exit node issues I bet) Change-Id: Ibc25edbb895dc083d1f07bd3cab614134705aa39 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	857cd6c0d7	ipn/ipnstate: add TailnetName to status ... RELNOTE=tailscale status --json | jq .TailnetName Fixes tailscale/corp#3665 Change-Id: I85de027ba2781eb31ee1e0c5ab913b0dfa5b4c86 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ca774c3249	ipn/ipnserver: add TS_PERMIT_CERT_UID envknob to give webservers cert access ... So you can run Caddy etc as a non-root user and let it have access to get certs. Updates caddyserver/caddy#4541 Change-Id: Iecc5922274530e2b00ba107d4b536580f374109b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f3c0023add	wgengine/netstack: add an SSH server experiment ... Disabled by default. To use, run tailscaled with: TS_SSH_ALLOW_LOGIN=you@bar.com And enable with: $ TAILSCALE_USE_WIP_CODE=true tailscale up --ssh=true Then ssh [any-user]@[your-tailscale-ip] for a root bash shell. (both the "root" and "bash" part are temporary) Updates #3802 Change-Id: I268f8c3c95c8eed5f3231d712a5dc89615a406f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) ... A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b03170b901	ipn/ipnserver: provide means of setting debug env vars on Windows ... Fixes #3688 Change-Id: I2f88ca32bf764e2b084fe544d821c43b6a20ffa5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e68d87eb44	ipn: rename SetRunExitNode to SetAdvertiseExitNode ... From Maisem's code review feedback where he mashed the merge button by mistake. Change-Id: I55abce036a6c25dc391250514983125dda10126c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2cfc96aa90	ipn: add methods on Prefs to get/set exit node being advertised ... This code was copied in a few places (Windows, Android), so unify it and add tests. Change-Id: Id0510c0f5974761365a2045279d1fb498feca11e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3690bfecb0	ipn/ipnlocal: fix cert fetching on macOS GUI platforms ... And clarify the directory they get written to when under the sandbox. Fixes #3667 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	506c727e30	ipnlocal, net/{dns,tsaddr,tstun}, wgengine: support MagicDNS on IPv6 ... Fixes #3660 RELNOTE=MagicDNS now works over IPv6 when CGNAT IPv4 is disabled. Change-Id: I001e983df5feeb65289abe5012dedd177b841b45 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b09000ad5d	ipn/localapi: add debug handler to Rebind, ReSTUN magicsock ... And more later probably. Updates #3619 Change-Id: Ia4cba34a7c0dcce4d2eddec8aae17f32b51c207f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0aa4c6f147	net/dns/resolver: add debug HTML handler to see what DNS traffic was forwarded ... Change-Id: I6b790e92dcc608515ac8b178f2271adc9fd98f78 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ae319b4636	wgengine/magicsock: add HTML debug handler to see magicsock state ... Change-Id: Ibc46f4e9651e1c86ec6f5d139f5e9bdc7a488415 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3dedcd1640	logpolicy, ipn/ipnserver: connect to logtail via tailscaled when needed ... This is for use by the Windows GUI client to log via when an exit node is in use, so the logs don't go out via the exit node and instead go directly, like tailscaled's. The dialer tried to do that in the unprivileged GUI by binding to a specific interface, but the "Internet Kill Switch" installed by tailscaled for exit nodes precludes that from working and instead the GUI fails to dial out. So, go through tailscaled (with a CONNECT request) instead. Fixes tailscale/corp#3169 Change-Id: I17a8efdc1d4b8fed53a29d1c19995592b651b215 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	40e2b312b6	ipn/ipnserver, logpolicy: move Windows disk logging up earlier ... This moves the Windows-only initialization of the filelogger into logpolicy. Previously we only did it when babysitting the tailscaled subprocess, but this meant that log messages from the service itself never made it to disk. Examples that weren't logged to disk: * logtail unable to dial out, * DNS flush messages from the service * svc.ChangeRequest messages (#3581) This is basically the same fix as #3571 but staying in the Logf type, and avoiding build-tagged file (which wasn't quite a goal, but happened and seemed nice) Fixes #3570 Co-authored-by: Aaron Klotz <aaron@tailscale.com> Change-Id: Iacd80c4720b7218365ec80ae143339d030842702	3 years ago
Josh Bleecher Snyder	add6dc8ccc	ipn/ipnlocal: make TestShrinkDefaultRoute hermetic ... Make shrinkDefaultRoute a pure function. Instead of calling interfaceRoutes, accept that information as parameters. Hard-code those parameters in TestShrinkDefaultRoute. Fixes #3580 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	8f43ddf1a2	ipn/ipnlocal, health: populate self node's Online bit in tailscale status ... One option was to just hide "offline" in the text output, but that doesn't fix the JSON output. The next option was to lie and say it's online in the JSON (which then fixes the "offline" in the text output). But instead, this sets the self node's "Online" to whether we're in an active map poll. Fixes #3564 Change-Id: I9b379989bd14655198959e37eec39bb570fb814a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	93ae11105d	ipn/ipnlocal: clear magicsock's netmap on logout ... magicsock was hanging onto its netmap on logout, which caused tailscale status to display partial information about a bunch of zombie peers. After logout, there should be no peers. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	aac974a5e5	ipn/ipnlocal: deflake (mostly) TestStateMachine ... I'm sick of this flaking. Even if this isn't the right fix, it stops the alert fatigue. Updates #3020 Change-Id: I4001c127d78f1056302f7741adec34210a72ee61 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	486059589b	all: gofmt -w -s (simplify) tests ... And it updates the build tag style on a couple files. Change-Id: I84478d822c8de3f84b56fa1176c99d2ea5083237 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cced414c7d	net/dns/resolver: add Windows ExitDNS service support, using net package ... Updates #1713 Updates #835 Change-Id: Ia71e96d0632c2d617b401695ad68301b07c1c2ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	63cd581c3f	safesocket: add ConnectionStrategy, provide control over fallbacks ... fee2d9fad added support for cmd/tailscale to connect to IPNExtension. It came in two parts: If no socket was provided, dial IPNExtension first, and also, if dialing the socket failed, fall back to IPNExtension. The second half of that support caused the integration tests to fail when run on a machine that was also running IPNExtension. The integration tests want to wait until the tailscaled instances that they spun up are listening. They do that by dialing the new instance. But when that dial failed, it was falling back to IPNExtension, so it appeared (incorrectly) that tailscaled was running. Hilarity predictably ensued. If a user (or a test) explicitly provides a socket to dial, it is a reasonable assumption that they have a specific tailscaled in mind and don't want to fall back to IPNExtension. It is certainly true of the integration tests. Instead of adding a bool to Connect, split out the notion of a connection strategy. For now, the implementation remains the same, but with the details hidden a bit. Later, we can improve that. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	7b9c7bc42b	ipn/ipnstate: remove old deprecated TailAddr IPv4-only field ... It's been a bunch of releases now since the TailscaleIPs slice replacement was added. Change-Id: I3bd80e1466b3d9e4a4ac5bedba8b4d3d3e430a03 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	878a20df29	net/dns: add GetBaseConfig to CallbackRouter. ... Allow users of CallbackRouter to supply a GetBaseConfig implementation. This is expected to be used on Android, which currently lacks both a) platform support for Split-DNS and b) a way to retrieve the current DNS servers. iOS/macOS also use the CallbackRouter but have platform support for SplitDNS, so don't need getBaseConfig. Updates https://github.com/tailscale/tailscale/issues/2116 Updates https://github.com/tailscale/tailscale/issues/988 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	c0701b130d	ipn/ipnstate, cmd/tailscale: add Online bool to tailscale status & --json ... Fixes #3533 Change-Id: I2f6f0d712cf3f987fba1c15be74cdb5c8d565f04 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Todd Neal	c18dc57861	ipn/{ipnserver,ipnlocal}: support incoming Taildrop on TrueNAS ... Signed-off-by: Todd Neal <todd@tneal.org>	3 years ago
Brad Fitzpatrick	d3d503d997	ipn/ipnlocal: add HTTP/2 h2c server support to peerapi on non-mobile platforms ... To make ExitDNS cheaper. Might not finish client-side support in December before 1.20, but at least server support can start rolling out ahead of clients being ready for it. Tested with curl against peerapi. Updates #1713 Change-Id: I676fed5fb1aef67e78c542a3bc93bddd04dd11fe Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	abc00e9c8d	ipn/{ipnserver,ipnlocal}: support incoming Taildrop on Synology ... If the user has a "Taildrop" shared folder on startup and the "tailscale" system user has read/write access to it, then the user can "tailscale file cp" to their NAS. Updates #2179 (would be fixes, but not super ideal/easy yet) Change-Id: I68e59a99064b302abeb6d8cc84f7d2a09f764990 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9c5c9d0a50	ipn/ipnlocal, net/tsdial: make SOCKS/HTTP dials use ExitDNS ... And simplify, unexport some tsdial/netstack stuff in the the process. Fixes #3475 Change-Id: I186a5a5cbd8958e25c075b4676f7f6e70f3ff76e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	9f6249b26d	ipn/policy: treat DNS service as interesting so it's not filtered out ... The control plane is currently still eating it. Updates #1713 Change-Id: I66a0698599d6794ab1302f9585bf29e38553c884 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	adc5997592	net/tsdial: give netstack a Dialer, start refactoring name resolution ... This starts to refactor tsdial.Dialer's name resolution to have different stages: in-memory MagicDNS vs system resolution. A future change will plug in ExitDNS resolution. This also plumbs a Dialer into netstack and unexports the dnsMap internals. And it removes some of the async AddNetworkMapCallback usage and replaces it with synchronous updates of the Dialer's netmap from LocalBackend, since the LocalBackend has the Dialer too. Updates #3475 Change-Id: Idcb7b1169878c74f0522f5151031ccbc49fe4cb4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	43983a4a3b	ipn/ipnlocal: run peerapi even if Taildrop storage not configured ... Change-Id: I77f9ecbe4617d01d13aa1127fa59c83f2aa3e1b8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	44d0c1ab06	ipn/ipnlocal: resolve exit node IP to ID at EditPrefs time. ... Without this, enabling an exit node immediately blackholes all traffic, but doesn't correctly let it flow to the exit node until the next netmap update. Fixes #3447 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	ad3d6e31f0	net/tsdial: move macOS/iOS peerapi sockopt logic from LocalBackend ... Change-Id: I812cae027c40c70cdc701427b1a1850cd9bcd60c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c7fb26acdb	net/tsdial: also plumb TUN name and monitor into tsdial.Dialer ... In prep for moving stuff out of LocalBackend. Change-Id: I9725aa9c3ebc7275f8c40e040b326483c0340127 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c37af58ea4	net/tsdial: move more weirdo dialing into new tsdial package, plumb ... Not done yet, but this move more of the outbound dial special casing from random packages into tsdial, which aspires to be the one unified place for all outbound dialing shenanigans. Then this plumbs it all around, so everybody is ultimately holding on to the same dialer. As of this commit, macOS/iOS using an exit node should be able to reach to the exit node's DoH DNS proxy over peerapi, doing the sockopt to stay within the Network Extension. A number of steps remain, including but limited to: * move a bunch more random dialing stuff * make netstack-mode tailscaled be able to use exit node's DNS proxy, teaching tsdial's resolver to use it when an exit node is in use. Updates #1713 Change-Id: I1e8ee378f125421c2b816f47bc2c6d913ddcd2f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3ae6f898cf	ipn/ipnlocal, net/dns/resolver: use exit node's DoH proxy when available ... Updates #1713 Change-Id: I3695a40ec12d2b4e6dac41cf4559daca6dddd68e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	16abd7e07c	ipn/ipnlocal: fix Content-Length in DoH DNS proxy response ... Updates #1713 Change-Id: I912d90383b751ad97b32bcec55e8fedbcf4d3db8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2a95ee4680	cmd/tailscale, ipn/ipnstate: note which nodes are exit nodes in status ... Fixes #3446 Change-Id: Ib41d588e7fa434c02d134fa449f85b0e15083683 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3181bbb8e4	cmd/tailscale: make file cp send files via tailscaled localapi ... So Taildrop sends work even if the local tailscaled is running in netstack mode, as it often is on Synology, etc. Updates #2179 (which is primarily about receiving, but both important) Change-Id: I9bd1afdc8d25717e0ab6802c7cf2f5e0bd89a3b2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b811a316bc	tailcfg, ipn/ipnlocal: advertise a Service when exit node DNS proxy available ... Updates #1713 Change-Id: I20c8e2ad1062d82ef17363414e372133f4c7181e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	135580a5a8	tailcfg, ipn/ipnlocal, net/dns: forward exit node DNS on Unix to system DNS ... Updates #1713 Change-Id: I4c073fec0992d9e01a9a4ce97087d5af0efdc68d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c2efe46f72	ipn/ipnlocal: restrict exit node DoH server based on ACL'ed packet filter ... Don't be a DoH DNS server to peers unless the Tailnet admin has permitted that peer autogroup:internet access. Updates #1713 Change-Id: Iec69360d8e4d24d5187c26904b6a75c1dabc8979 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Thomas Weiß	f8cef1ba08	ipn/store/aws: support using sub-paths in parameters ... Fixes #3431 Signed-off-by: Thomas Weiß <panos@unbunt.org>	3 years ago
David Anderson	097602b3ca	ipn/ipnlocal: warn more precisely about IP forwarding issues on linux. ... If IP forwarding is disabled globally, but enabled per-interface on all interfaces, don't complain. If only some interfaces have forwarding enabled, warn that some subnet routing/exit node traffic may not work. Fixes #1586 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	33c541ae30	ipn/ipnlocal: populate self status from netmap in ipnlocal, not magicsock. ... Fixes #1933 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	25525b7754	net/dns/resolver, ipn/ipnlocal: wire up peerapi DoH server to DNS forwarder ... Updates #1713 Change-Id: Ia4ed9d8c9cef0e70aa6d30f2852eaab80f5f695a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	955aa188b3	ipn/ipnlocal: fix logging ... We were missing an argument here. Also, switch to %q, in case anything weird is happening with these strings. Updates tailscale/corp#461 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	283ae702c1	ipn/ipnlocal: start adding DoH DNS server to peerapi when exit node ... Updates #1713 Change-Id: I8d9c488f779e7acc811a9bc18166a2726198a429 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	027b46d0c1	ipn/ipnstate: clarify PeerStatusLite.LastHandshake ... And document the other fields, as long as we're here. Updates #1182 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	4a59a2781a	ipn/ipnlocal: export client metrics over peerapi to owner ... Updates #3307 Change-Id: I41b1f3c16af5f385575e8d6cea70ae8386504dd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	57b039c51d	util/clientmetrics: add new package to add metrics to the client ... And annotate magicsock as a start. And add localapi and debug handlers with the Prometheus-format exporter. Updates #3307 Change-Id: I47c5d535fe54424741df143d052760387248f8d3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	d6dde5a1ac	ipn/ipnlocal: handle key extensions after key has already expired ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	87137405e5	ipn/ipnserver: grant js/wasm all localapi permissions ... Updates #3157 Change-Id: I3b63762583a4d655eac33ce3dfda37a1f5135a57 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	01bd789c26	ipn/ipnserver: add Server.LocalBackend accessor ... Was done as part of e6fbc0cd54 for ssh work, but wasn't committed yet. Including it here both to minimize the ssh diff size, and because I need it for a separate change. Change-Id: If6eb54a2ca7150ace96488ed14582c2c05ca3422 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e6fbc0cd54	cmd/tailscaled, ipn/ipnserver: refactor ipnserver ... More work towards removing the massive ipnserver.Run and ipnserver.Options and making composable pieces. Work remains. (The getEngine retry loop on Windows complicates things.) For now some duplicate code exists. Once the Windows side is fixed to either not need the retry loop or to move the retry loop into a custom wgengine.Engine wrapper, then we can unify tailscaled_windows.go too. Change-Id: If84d16e3cd15b54ead3c3bb301f27ae78d055f80 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	337757a819	ipn/ipnlocal, control/controlclient: don't propagate all map errors to UI ... Fixes regression from 81cabf48ec which made all map errors be sent to the frontend UI. Fixes #3230 Change-Id: I7f142c801c7d15e268a24ddf901c3e6348b6729c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	0532eb30db	all: replace tailcfg.DiscoKey with key.DiscoPublic. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	649f7556e8	cmd/tailscaled, ipn: add tailscaled --statedir flag for var directory ... Fixes #2932 Change-Id: I1aa2b323ad542386d140f8336bcc4dcbb8310bd0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c7bff35fee	ipn/ipnlocal: add owner-only debug handler to get process env ... For debugging Synology. Like the existing goroutines handler, in that it's owner-only. Change-Id: I852f0626be8e1c0b6794c1e062111d14adc3e6ac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	3fd5f4380f	util/multierr: new package ... github.com/go-multierror/multierror served us well. But we need a few feature from it (implement Is), and it's not worth maintaining a fork of such a small module. Instead, I did a clean room implementation inspired by its API. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Anderson	7e6a1ef4f1	tailcfg: use key.NodePublic in wire protocol types. ... Updates #3206. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	7e8d5ed6f3	ipn: use key.NodePublic instead of tailcfg.NodeKey ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	c17250cee2	ipn/ipnstate: use key.NodePublic instead of tailcfg.NodeKey. ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	418adae379	various: use NodePublic.AsNodeKey() instead of tailcfg.NodeKeyFromNodePublic() ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	eeb97fd89f	various: remove remaining uses of key.NewPrivate. ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	429632d32c	ipn/ipnlocal: treat js/wasm interative logins as ephemeral for now ... At least until js/wasm starts using browser LocalStorage or something. But for the foreseeable future, any login from a browser should be considered ephemeral as the tab can close at any time and lose the wireguard key, never to be seen again. Updates #3157 Change-Id: I6c410d86dc7f9f233c3edd623313d9dee2085aac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	c1d009b9e9	ipn/ipnstate: use key.NodePublic instead of the generic key.Public. ... Updates #3206. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	96ad68c5d6	ipn: remove mention of wgkey in comment. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	0c546a28ba	types/persist: use new node key type. ... Updates #3206 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	22dbaa0894	ipn/ipnserver: add New, Server.Server ... Change-Id: I1dc85a5131b9a628d7fc780fde7103492cd3f1f8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d381bc2b6c	ipn/ipnserver: move the unserved connection logic to a Listener ... So future refactors can only deal with a net.Listener and be unconcerned with their caller's (Windows-specific) struggles. Change-Id: I0af588b9a769ab65c59b0bd21f8a0c99abfa1784 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c23a378f63	ipn/ipnserver: start refactoring ipnserver.Run into smaller pieces ... I'll keep ipnserver.Run for compatibility, but it'll be a wrapper around several smaller pieces. (more testable too) For now, start untangling some things in preparation. Plan is to have to have a constructor for the just-exported ipnserver.Server type that takes a LocalBackend and can accept (in a new method) on a provided listener. Change-Id: Ide73aadaac1a82605c97a2af1321d0d8f60b2a8c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	869999955d	ipn/ipnserver: export server type as Server ... It's all opaque, there's no constructor, and no exported methods, so it's useless at this point, but this is one small refactoring step. Change-Id: Id961e8880cf0c84f1a0a989eefff48ecb3735add Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	81cabf48ec	control/controlclient,tailcfg: propagate registration errors to the frontend ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Aaron Klotz	6425f497b1	ipn/ipnserver paths: add paths.LegacyStateFilePath ... Moving this information into a centralized place so that it is accessible to code in subsequent commits. Updates #3011 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Joe Tsai	9af27ba829	cmd/cloner: mangle "go:generate" in cloner.go ... The "go generate" command blindly looks for "//go:generate" anywhere in the file regardless of whether it is truly a comment. Prevent this false positive in cloner.go by mangling the string to look less like "//go:generate". Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Maisem Ali	c6d3f622e9	ipn/ipnlocal: use netaddr.IPSetBuilder when constructing list of interface IPPrefixes. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	ddf3394b40	ipn/ipnlocal: don't try to block localhost traffic when using exit nodes ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	751c42c097	ipn: fix formatting of ExitNodeIP in MaskedPrefs ... %#v on a netaddr.IP showed the netaddr.IP innards. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
nicksherron	f01ff18b6f	all: fix spelling mistakes ... Signed-off-by: nicksherron <nsherron90@gmail.com>	3 years ago
Maxime VISONNEAU	4528f448d6	ipn/store/aws, cmd/tailscaled: add AWS SSM ipn.StateStore implementation ... From https://github.com/tailscale/tailscale/pull/1919 with edits by bradfitz@. This change introduces a new storage provider for the state file. It allows users to leverage AWS SSM parameter store natively within tailscaled, like: $ tailscaled --state=arn:aws:ssm:eu-west-1:123456789:parameter/foo Known limitations: - it is not currently possible to specific a custom KMS key ID RELNOTE=tailscaled on Linux supports using AWS SSM for state Edits-By: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maxime VISONNEAU <maxime.visonneau@gmail.com>	3 years ago
Brad Fitzpatrick	cb4a2c00d1	ipn: remove unused Prefs.OSVersion and Prefs.DeviceModel ... iOS and Android no longer use these. They both now (as of today) use the hostinfo.SetFoo setters instead. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	67e5fabdbd	hostinfo, ipn/ipnlocal: add SetPackage, remove ipnlocal hacks ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	81269fad28	hostinfo: add SetOSVersion like SetDeviceModel, deprecate ipn.Prefs way ... Turns out the iOS client has been only sending the OS version it first started at. This whole hostinfo-via-prefs mechanism was never a good idea. Start removing it. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	22a1a5d7cf	ipn/ipnlocal: for IPv6-only nodes, publish IPv6 MagicDNS records of peers ... See https://github.com/tailscale/tailscale/issues/2970#issuecomment-931885268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6d43cbc325	ipn/ipnlocal: make sure mobile clients don't use the old control server URL ... The new frontends are better for battery. Updates #2442 Updates tailscale/corp#2750 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	173bbaa1a1	all: disable TCP keep-alives on iOS/Android ... Updates #2442 Updates tailscale/corp#2750 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3b3994f0db	ipn{,/localapi,ipnlocal}: infer cert dir from state file location ... This fixes "tailscale cert" on Synology where the var directory is typically like /volume2/@appdata/Tailscale, or any other tailscaled user who specifies a non-standard state file location. This is a interim fix on the way to #2932. Fixes #2927 Updates #2932 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3a72ebb109	ipn: test TestFileStore in a fresh subdirectory ... Fixes #2923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Klotz	21e9f98fc1	ipn, paths: unconditionally attempt to set state dir perms, but only if the state dir is ours ... We unconditionally set appropriate perms on the statefile dir. We look at the basename of the statefile dir, and if it is "tailscale", then we set perms as appropriate. Fixes #2925 Updates #2856 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	efb84ca60d	ipn/localapi, cmd/tailscale: add CPU & memory profile support, debug command ... This was already possible on Linux if you ran tailscaled with --debug (which runs net/http/pprof), but it requires the user have the Go toolchain around. Also, it wasn't possible on macOS, as there's no way to run the IPNExtension with a debug server (it doesn't run tailscaled). And on Windows it's super tedious: beyond what users want to do or what we want to explain. Instead, put it in "tailscale debug" so it works and works the same on all platforms. Then we can ask users to run it when we're debugging something and they can email us the output files. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	1eabb5b2d9	ipn: don't log IPN messages that may contain an authkey. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Aaron Klotz	9ebb5d4205	ipn, paths: ensure that the state directory for Windows has the correct perms ... ProgramData has a permissive ACL. For us to safely store machine-wide state information, we must set a more restrictive ACL on our state directory. We set the ACL so that only talescaled's user (ie, LocalSystem) and the Administrators group may access our directory. We must include Administrators to ensure that logs continue to be easily accessible; omitting that group would force users to use special tools to log in interactively as LocalSystem, which is not ideal. (Note that the ACL we apply matches the ACL that was used for LocalSystem's AppData\Local). There are two cases where we need to reset perms: One is during migration from the old location to the new. The second case is for clean installations where we are creating the file store for the first time. Updates #2856 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	7d8227e7a6	logpolicy: don't use C:\ProgramData use for tailscale-ipn GUI's log dir ... tailscale-ipn.exe (the GUI) shouldn't use C:\ProgramData. Also, migrate the earlier misnamed wg32/wg64 conf files if they're present. (That was stopped in 2db877caa3, but the files exist from fresh 1.14 installs) Updates #2856 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	280c84e46a	ipn/ipnserver, paths, logpolicy: move Window config files out of %LocalAppData% ... C:\WINDOWS\system32\config\systemprofile\AppData\Local\ is frequently cleared for almost any reason: Windows updates, System Restore, even various System Cleaner utilities. The server-state.conf file in AppData\Local could be deleted at any time, which would break login until the node is removed from the Admin Panel allowing it to create a new key. Carefully copy any AppData state to ProgramData at startup. If copying the state fails, continue to use AppData so at least there will be connectivity. If there is no state, use ProgramData. We also migrate the log.conf file. Very old versions of Tailscale named the EXE tailscale-ipn, so the log conf was tailscale-ipn.log.conf and more recent versions preserved this filename and cmdName in logs. In this migration we always update the filename to c:\ProgramData\Tailscale\tailscaled.log.conf Updates https://github.com/tailscale/tailscale/issues/2856 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago