You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/ipn/ipnlocal
Brad Fitzpatrick bd90781b34 ipn/ipnlocal, wgengine/netstack: use netstack for peerapi server
We're finding a bunch of host operating systems/firewalls interact poorly
with peerapi. We either get ICMP errors from the host or users need to run
commands to allow the peerapi port:

https://github.com/tailscale/tailscale/issues/3842#issuecomment-1025133727

... even though the peerapi should be an internal implementation detail.

Rather than fight the host OS & firewalls, this change handles the
server side of peerapi entirely in netstack (except on iOS), so it
never makes its way to the host OS where it might be messed with. Two
main downsides are:

1) netstack isn't as fast, but we don't really need speed for peerapi.
   And actually, with fewer trips to/from the kernel, we might
   actually make up for some of the netstack performance loss by
   staying in userspace.

2) tcpdump / Wireshark etc packet captures will no longer see the peerapi
   traffic. Oh well. Crawshaw's been wanting to add packet capture server
   support to tailscaled, so we'll probably do that sooner now.

A future change might also then use peerapi for the client-side
(except on iOS).

Updates #3842 (probably fixes, as well as many exit node issues I bet)

Change-Id: Ibc25edbb895dc083d1f07bd3cab614134705aa39
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
3 years ago
..
dnsconfig_test.go ipnlocal, net/{dns,tsaddr,tstun}, wgengine: support MagicDNS on IPv6 3 years ago
local.go ipn/ipnlocal, wgengine/netstack: use netstack for peerapi server 3 years ago
local_test.go ipn/ipnlocal: make TestShrinkDefaultRoute hermetic 3 years ago
loglines_test.go net/tsdial: move more weirdo dialing into new tsdial package, plumb 3 years ago
peerapi.go ipn/ipnlocal, wgengine/netstack: use netstack for peerapi server 3 years ago
peerapi_h2c.go ipn/ipnlocal: add HTTP/2 h2c server support to peerapi on non-mobile platforms 3 years ago
peerapi_macios_ext.go net/tsdial: move macOS/iOS peerapi sockopt logic from LocalBackend 3 years ago
peerapi_test.go ipn/ipnlocal: run peerapi even if Taildrop storage not configured 3 years ago
state_test.go ipn/ipnlocal: deflake (mostly) TestStateMachine 3 years ago