summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2021-06-30debug nixos buildXe/debug-nixos-buildChristine Dodrill2-4/+14
Signed-off-by: Christine Dodrill <xe@tailscale.com>
2021-06-30experimental VM test: add -vChristine Dodrill1-1/+1
Apparently if you don't add -v the tests don't report anything useful when they break. Joy. Signed-Off-By: Christine Dodrill <xe@tailscale.com>
2021-06-29wgengine/router_windows: support toggling local lan access when usingMaisem Ali3-44/+77
exit nodes. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-06-29cmd/tailscale/cli: accept login server synonymDavid Crawshaw2-0/+29
Fixes #2272 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-28cmd/tailscale: add debug flag to dump derp mapjulianknodt1-0/+14
This adds a flag in tailscale debug for dumping the derp map to stdout. Fixes #2249. Signed-off-by: julianknodt <julianknodt@gmail.com>
2021-06-28control/controlclient: add debug knob to force node to only IPv6 self addrBrad Fitzpatrick1-1/+20
Updates #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-28wgengine/netstack: make SOCKS5 resolve names to IPv6 if self node when no IPv4Brad Fitzpatrick2-3/+127
For instance, ephemeral nodes with only IPv6 addresses can now SOCKS5-dial out to names like "foo" and resolve foo's IPv6 address rather than foo's IPv4 address and get a "no route" (*tcpip.ErrNoRoute) error from netstack's dialer. Per https://github.com/tailscale/tailscale/issues/2268#issuecomment-870027626 which is only part of the isuse. Updates #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-28net/dns: set WSL /etc/resolv.confDavid Crawshaw5-15/+325
We also have to make a one-off change to /etc/wsl.conf to stop every invocation of wsl.exe clobbering the /etc/resolv.conf. This appears to be a safe change to make permanently, as even though the resolv.conf is constantly clobbered, it is always the same stable internal IP that is set as a nameserver. (I believe the resolv.conf clobbering predates the MS stub resolver.) Tested on WSL2, should work for WSL1 too. Fixes #775 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-28net/dns: factor directManager out over an FS interfaceDavid Crawshaw6-44/+179
This is preliminary work for using the directManager as part of a wslManager on windows, where in addition to configuring windows we'll use wsl.exe to edit the linux file system and modify the system resolv.conf. The pinholeFS is a little funky, but it's designed to work through simple unix tools via wsl.exe without invoking bash. I would not have thought it would stand on its own like this, but it turns out it's useful for writing a test for the directManager. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-28cmd/tailscale: make netcheck use active DERP map, delete static copyjulianknodt10-108/+112
After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>
2021-06-28net/socks5/tssocks: add a SOCKS5 dialer type, method-ifying codeBrad Fitzpatrick1-27/+46
https://twitter.com/bradfitz/status/1409605220376580097 Prep for #1970, #2264, #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-28net/socks5/tssocks: add new package, move SOCKS5 glue out of tailscaledBrad Fitzpatrick4-38/+74
Prep for #1970, #2264, #2268 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-28tstest/integration: always run SOCK5 server, parse out its listening addressBrad Fitzpatrick1-1/+92
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-28controlclient: log server key and URLDavid Crawshaw1-0/+1
Turns out we never reliably log the control plane URL a client connects to. Do it here, and include the server public key, which might inadvertently tell us something interesting some day. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-28ipn, etc: use controlplane.tailscale.comDavid Crawshaw4-8/+8
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-28cmd/tailscaled: log SOCKS5 port when port 0 requestedBrad Fitzpatrick1-0/+5
Part of #2158 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-28integration vm tests: run on every commit to main (#2159)Christine Dodrill1-6/+17
This is an experiment to see how often this test would fail if we run it on every commit. This depends on #2145 to fix a flaky part of the test. Signed-off-by: Christine Dodrill <xe@tailscale.com>
2021-06-28tstest/integration/vms: build and run NixOS (#2190)Christine Dodrill4-15/+250
Okay, so, at a high level testing NixOS is a lot different than other distros due to NixOS' determinism. Normally NixOS wants packages to be defined in either an overlay, a custom packageOverrides or even yolo-inline as a part of the system configuration. This is going to have us take a different approach compared to other distributions. The overall plan here is as following: 1. make the binaries as normal 2. template in their paths as raw strings to the nixos system module 3. run `nixos-generators -f qcow -o $CACHE_DIR/tailscale/nixos/version -c generated-config.nix` 4. pass that to the steps that make the virtual machine It doesn't really make sense for us to use a premade virtual machine image for this as that will make it harder to deterministically create the image. Nix commands generate a lot of output, so their output is hidden behind the `-verbose-nix-output` flag. This unfortunately makes this test suite have a hard dependency on Nix/NixOS, however the test suite has only ever been run on NixOS (and I am not sure if it runs on other distros at all), so this probably isn't too big of an issue. Signed-off-by: Christine Dodrill <xe@tailscale.com>
2021-06-27net/dns/resolver: fmt itemjulianknodt1-1/+1
This has been bothering me for a while, but everytime I run format from the root directory it also formats this file. I didn't want to add it to my other PRs but it's annoying to have to revert it every time. Signed-off-by: julianknodt <julianknodt@gmail.com>
2021-06-27net/dnsfallback: don't depend on derpmap.ProdBrad Fitzpatrick5-4/+269
Move derpmap.Prod to a static JSON file (go:generate'd) instead, to make its role explicit. And add a TODO about making dnsfallback use an update-over-time DERP map file instead of a baked-in one. Updates #1264 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-25tstest/integration/vms: add in-process DERP server (#2108)Christine Dodrill3-59/+68
Previously this test would reach out to the public DERP servers in order to help machines connect with eachother. This is not ideal given our plans to run these tests completely disconnected from the internet. This patch introduces an in-process DERP server running on its own randomly assigned HTTP port. Updates #1988 Signed-off-by: Christine Dodrill <xe@tailscale.com>
2021-06-25tstest/integration/vms: fix flake when testing (#2145)Christine Dodrill1-9/+56
Occasionally the test framework would fail with a timeout due to a virtual machine not phoning home in time. This seems to be happen whenever qemu can't bind the VNC or SSH ports for a virtual machine. This was fixed by taking the following actions: 1. Don't listen on VNC unless the `-use-vnc` flag is passed, this removes the need to listen on VNC at all in most cases. The option to use VNC is still left in for debugging virtual machines, but removing this makes it easier to deal with (VNC uses this odd system of "displays" that are mapped to ports above 5900, and qemu doesn't offer a decent way to use a normal port number, so we just disable VNC by default as a compromise). 2. Use a (hopefully) inactive port for SSH. In an ideal world I'd just have the VM's SSH port be exposed via a Unix socket, however the QEMU documentation doesn't really say if you can do this or not. While I do more research, this stopgap will have to make do. 3. Strictly tie more VM resource lifetimes to the tests themselves. Previously the disk image layers for virtual machines were only cleaned up at the end of the test and existed in the parent test-scoped temporary folder. This can make your tmpfs run out of space, which is not ideal. This should minimize the use of temporary storage as much as I know how to. 4. Strictly tie the qemu process lifetime to the lifetime of the test using testing.T#Cleanup. Previously it used a defer statement to clean up the qemu process, however if the tests timed out this defer was not run. This left around an orphaned qemu process that had to be killed manually. This change ensures that all qemu processes exit when their relevant tests finish. Signed-off-by: Christine Dodrill <xe@tailscale.com>
2021-06-25types/logger: fix deadlock RateLimitedFn reentrancyBrad Fitzpatrick2-5/+21
Fix regression from 19c3e6cc9e9c8371f2aea1c8a19fe1e455038b0b which made the locking coarser. Found while debugging #2245, which ended up looking like a tswin/Windows issue where Crawshaw had blocked cmd.exe's output. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-25wgengine/filter: add a debug flag for filter logs (#2241)Christine Dodrill1-0/+14
This uses a debug envvar to optionally disable filter logging rate limits by setting the environment variable TS_DEBUG_FILTER_RATE_LIMIT_LOGS to "all", and if it matches, the code will effectively disable the limits on the log rate by setting the limit to 1 millisecond. This should make sure that all filter logs will be captured. Signed-off-by: Christine Dodrill <xe@tailscale.com>
2021-06-25net/dns: remove ref to managerImplDavid Crawshaw2-3/+2
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-25net/dns/resolver: clamp EDNS sizeAdrian Dewhurst3-81/+287
This change (subject to some limitations) looks for the EDNS OPT record in queries and responses, clamping the size field to fit within our DNS receive buffer. If the size field is smaller than the DNS receive buffer then it is left unchanged. I think we will eventually need to transition to fully processing the DNS queries to handle all situations, but this should cover the most common case. Mostly fixes #2066 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>
2021-06-24VERSION.txt: this is v1.11.0.David Anderson1-1/+1
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-06-24derp,cmd/derper: allow server to verify clientsjulianknodt4-4/+28
This adds a flag to the DERP server which specifies to verify clients through a local tailscaled. It is opt-in, so should not affect existing clients, and is mainly intended for users who want to run their own DERP servers. It assumes there is a local tailscaled running and will attempt to hit it for peer status information. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>
2021-06-24wgengine: make dnsIPsOverTailscale also consider DefaultResolversBrad Fitzpatrick1-1/+6
Found during a failed experiment debugging something on Android. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-24net/netns: add Android implementation, allowing registration of JNI hookBrad Fitzpatrick2-0/+66
Updates #2102 Updates #1809 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-23wgengine/netstack: add Impl.DialContextUDPBrad Fitzpatrick1-0/+24
Unused so far, but eventually we'll want this for SOCKS5 UDP binds (we currently only do TCP with SOCKS5), and also for #2102 for forwarding MagicDNS upstream to Tailscale IPs over netstack. Updates #2102 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-23net/socks5: fix a typoBrad Fitzpatrick1-1/+1
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-23net/dns: always proxy through quad-100 on windows 8.1.David Anderson1-15/+9
Windows 8.1 incorrectly handles search paths on an interface with no associated resolver, so we have to provide a full primary DNS config rather than use Windows 8.1's nascent-but-present NRPT functionality. Fixes #2237. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-06-23net/dns{,/resolver}: refactor DNS forwarder, send out of right link on macOS/iOSBrad Fitzpatrick10-491/+521
Fixes #2224 Fixes tailscale/corp#2045 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-23tailcfg/derpmap: add flag to omit ts's derpsjulianknodt2-1/+6
This adds a flag to derp maps which specifies that default Tailscale DERP servers should not be used. If true and there are entries in this map, it indicates that the entries in this map should take precedent and not hit any of tailscale's DERP servers. This change is backwards compatible, as the default behavior should be false. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>
2021-06-23Merge pull request #2227 from tailscale/jknodt/clonerJulian Knodt3-12/+115
cmd/cloner: support maps with clone ptrs
2021-06-23wgengine: randomize client port if netmap says toDavid Crawshaw6-17/+92
For testing out #2187 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-23magicsock: add SetPreferredPort methodDavid Crawshaw1-33/+71
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-23syncs: add AtomicUint32David Crawshaw1-0/+11
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-23net/dns/resolver: skip test on macOSBrad Fitzpatrick1-0/+4
Fixes #2229 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-22cmd/cloner: support maps with clone ptrsjulianknodt3-12/+115
In order to clone DERPMaps, it was necessary to extend the cloner so that it supports nested pointers inside of maps which are also cloneable. This also adds cloning for DERPRegions and DERPNodes because they are on DERPMap's maps. Signed-off-by: julianknodt <julianknodt@gmail.com>
2021-06-22staticcheck.conf: remove unnecessary warningDavid Crawshaw1-1/+1
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-22tailcfg: add Debug.RandomizeClientPortBrad Fitzpatrick1-0/+5
Not yet used. Updates #2187 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-22go.mod: update netstackBrad Fitzpatrick3-11/+12
Fixes a atomic alignment crash on 32-bit machines. Fixes #2129 Fixes tailscale/tailscale-synology#66 (same) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-22tstest/integration: fix a raceBrad Fitzpatrick1-4/+18
Noticed on a CI failure. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-18net/interfaces: use IPv4 link local if nothing betterDenton Gentry3-10/+60
The only connectivity an AWS Lambda container has is an IPv4 link-local 169.254.x.x address using NAT: 12: vtarget_1@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 7e:1c:3f:00:00:00 brd ff:ff:ff:ff:ff:ff link-netnsid 1 inet 169.254.79.1/32 scope global vtarget_1 valid_lft forever preferred_lft forever If there are no other IPv4/v6 addresses available, and we are running in AWS Lambda, allow IPv4 169.254.x.x addresses to be used. ---- Similarly, a Google Cloud Run container's only connectivity is a Unique Local Address fddf:3978:feb1:d745::c001/128. If there are no other addresses available then allow IPv6 Unique Local Addresses to be used. We actually did this in an earlier release, but now refactor it to work the same way as the IPv4 link-local support is being done. Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2021-06-18derp: fix traffic handler peer addressesjulianknodt1-8/+1
Before it was using the local address and port, so fix that. The fields in the response from `ss` are: State, Recv-Q, Send-Q, Local Address:Port, Peer Address:Port, Process Signed-off-by: julianknodt <julianknodt@gmail.com>
2021-06-18staticcheck.conf: turn off noisy lint errorsDavid Crawshaw16-28/+20
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-18derp: add debug traffic handlerjulianknodt4-25/+147
This adds a handler on the DERP server for logging bytes send and received by clients of the server, by holding open a connection and recording if there is a difference between the number of bytes sent and received. It sends a JSON marshalled object if there is an increase in the number of bytes. Signed-off-by: julianknodt <julianknodt@gmail.com>
2021-06-18tstest/integration: fix race flakeBrad Fitzpatrick2-4/+23
Fixes #2172 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.