summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2021-05-06tailcfg: ping request notes WIPbradfitz/ping_notesBrad Fitzpatrick1-0/+18
2021-05-06wgengine/netstack: avoid delivering incoming packets to both netstack + hostBrad Fitzpatrick1-1/+8
The earlier eb06ec172f1d984bb87c589da1dd2d3f15dc6d82 fixed the flaky SSH issue (tailscale/corp#1725) by making sure that packets addressed to Tailscale IPs in hybrid netstack mode weren't delivered to netstack, but another issue remained: All traffic handled by netstack was also potentially being handled by the host networking stack, as the filter hook returned "Accept", which made it keep processing. This could lead to various random racey chaos as a function of OS/firewalls/routes/etc. Instead, once we inject into netstack, stop our caller's packet processing. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-06net/tstun: fix TUN log spam when ACLs drop a packetBrad Fitzpatrick2-9/+21
Whenever we dropped a packet due to ACLs, wireguard-go was logging: Failed to write packet to TUN device: packet dropped by filter Instead, just lie to wireguard-go and pretend everything is okay. Fixes #1229 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-05cmd/tailscale: fix tailscale up --advertise-exit-node validationBrad Fitzpatrick2-6/+117
Fixes #1859 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-05wgengine: fix pendopen debug to not track SYN+ACKs, show Node.Online stateBrad Fitzpatrick1-4/+23
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-05version: bump dateBrad Fitzpatrick1-1/+1
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-05wgengine/netstack: don't pass non-subnet traffic to netstack in hybrid modeBrad Fitzpatrick2-3/+24
Fixes tailscale/corp#1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-05net/tsaddr: add NewContainsIPFunc (move from wgengine)Brad Fitzpatrick3-24/+78
I want to use this from netstack but it's not exported. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-05types/logger: add key grinder stats lines to rate-limiting exemption listJosh Bleecher Snyder3-8/+42
Updates #1749 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-05-04types/logger: fix rate limiter allowlistJosh Bleecher Snyder1-1/+1
Upstream wireguard-go renamed the interface method from CreateEndpoint to ParseEndpoint. I updated the log call site but not the allowlist. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04workflows: execute benchmarksJosh Bleecher Snyder5-6/+12
#1817 removed the only place in our CI where we executed our benchmark code. Fix that by executing it everywhere. The benchmarks are generally cheap and fast, so this should add minimal overhead. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04cmd/tailscale: gofmtBrad Fitzpatrick1-2/+2
From 6d10655dc3887f1a161015514a8555c175802b4d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-04workflows: run staticcheck on more platformsJosh Bleecher Snyder1-3/+15
To prevent issues like #1786, run staticcheck on the primary GOOSes: linux, mac, and windows. Windows also has a fair amount of GOARCH-specific code. If we ever have GOARCH staticcheck failures on other GOOSes, we can expand the test matrix further. This requires installing the staticcheck binary so that we can execute it with different GOOSes. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04ipnlocal: accept a new opts.UpdatePrefs field.Avery Pennarun4-3/+45
This is needed because the original opts.Prefs field was at some point subverted for use in frontend->backend state migration for backward compatibility on some platforms. We still need that feature, but we also need the feature of providing the full set of prefs from `tailscale up`, *not* including overwriting the prefs.Persist keys, so we can't use the original field from `tailscale up`. `tailscale up` had attempted to compensate for that by doing SetPrefs() before Start(), but that violates the ipn.Backend contract, which says you should call Start() before anything else (that's why it's called Start()). As a result, doing SetPrefs({ControlURL=..., WantRunning=true}) would cause a connection to the *previous* control server (because WantRunning=true), and then connect to the *new* control server only after running Start(). This problem may have been avoided before, but only by pure luck. It turned out to be relatively harmless since the connection to the old control server was immediately closed and replaced anyway, but it created a race condition that could have caused spurious notifications or rejected keys if the server responded quickly. As already covered by existing TODOs, a better fix would be to have Start() get out of the business of state migration altogether. But we're approaching a release so I want to make the minimum possible fix. Fixes #1840. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-05-04cmd/tailscale/cli: fix running from XcodeJosh Bleecher Snyder1-0/+8
We were over-eager in running tailscale in GUI mode. f42ded7acf63e2f3711f6512b701ddeac0e2d7a6 fixed that by checking for a variety of shell-ish env vars and using those to force us into CLI mode. However, for reasons I don't understand, those shell env vars are present when Xcode runs Tailscale.app on my machine. (I've changed no configs, modified nothing on a brand new machine.) Work around that by adding an additional "only in GUI mode" check. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04ipn/ipnlocal: update peerapi logging of received PUTsBrad Fitzpatrick1-1/+3
Clarify direction and add duration. (per chat with Avery) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-04syncs: stop running TestWatchMultipleValues on CIJosh Bleecher Snyder1-3/+2
It's flaky, and not just on Windows. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04ipn/ipnlocal: redact more errorsBrad Fitzpatrick1-7/+12
Updates tailscale/corp#1636 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-04wgengine/router: use net.IP.Equal instead of bytes.Equal to compare IPsJosh Bleecher Snyder1-2/+2
Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04safesocket: delete unused functionJosh Bleecher Snyder1-4/+0
Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04wgengine/router: remove unused fieldJosh Bleecher Snyder1-9/+0
Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04portlist: suppress staticcheck errorJosh Bleecher Snyder1-1/+1
Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04net/tstun: remove unnecessary break statementJosh Bleecher Snyder1-1/+0
Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04logtail/filch: add staticcheck annotationJosh Bleecher Snyder1-0/+1
To work around a staticcheck bug when running with GOOS=windows. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04all: use lower-case letters at the start of error messageJosh Bleecher Snyder2-3/+3
Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-04cmd/tailscale: fail if tailscaled closes the IPN connectionBrad Fitzpatrick3-7/+18
I was going to write a test for this using the tstest/integration test stuff, but the testcontrol implementation isn't quite there yet (it always registers nodes and doesn't provide AuthURLs). So, manually tested for now. Fixes #1843 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-03tstest/integration: misc cleanupsBrad Fitzpatrick1-28/+51
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-03tstest/integration: add testNode.AwaitListening, DERP+STUN, improve proxy trapBrad Fitzpatrick2-27/+132
Updates #1840
2021-05-03cmd/tailscale/cli: don't report outdated auth URL to web UIDavid Crawshaw1-6/+40
This brings the web 'up' logic into line with 'tailscale up'. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-05-03cmd/tailscale/cli: skip new tab on web loginDavid Crawshaw1-125/+118
It doesn't work properly. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-05-03paths: add synology socket pathDavid Crawshaw1-0/+7
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-05-03wgenengine/magicsock: delete cursed testsJosh Bleecher Snyder1-152/+0
Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-03cmd/tailscale: make 'file cp' have better error messages on bad targetsBrad Fitzpatrick2-3/+29
Say when target isn't owned by current user, and when target doesn't exist in netmap. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-03ipn/ipnlocal: switch from testify to quicktestJosh Bleecher Snyder3-144/+138
Per discussion, we want to have only one test assertion library, and we want to start by exploring quicktest. This was a mostly mechanical translation. I think we could make this nicer by defining a few helper closures at the beginning of the test. Later. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-03cmd/tailscale: make pref-revert checks ignore OS-irrelevant prefsBrad Fitzpatrick2-9/+63
This fixes #1833 in two ways: * stop setting NoSNAT on non-Linux. It only matters on Linux and the flag is hidden on non-Linux, but the code was still setting it. Because of that, the new pref-reverting safety checks were failing when it was changing. * Ignore the two Linux-only prefs changing on non-Linux. Fixes #1833 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-03cmd/tailscale: pull out, parameterize up FlagSet creation for testsBrad Fitzpatrick3-21/+44
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-30tstest/integration: start factoring test types out to clean things upBrad Fitzpatrick1-41/+136
To enable easy multi-node testing (including inter-node traffic) later. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-30cmd/tailscale/cli: add test to catch ipn.Pref additionsBrad Fitzpatrick1-0/+24
2021-04-30cmd/tailscale/cli/up: "LoggedOut" pref is implicit.Avery Pennarun2-0/+27
There's no need to warn that it was not provided on the command line after doing a sequence of up; logout; up --args. If you're asking for tailscale to be up, you always mean that you prefer LoggedOut to become false. Fixes #1828 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-04-30wgengine/wglog: improve wireguard-go logging rate limitingJosh Bleecher Snyder2-34/+54
Prior to wireguard-go using printf-style logging, all wireguard-go logging occurred using format string "%s". We fixed that but continued to use %s when we rewrote peer identifiers into Tailscale style. This commit removes that %sl, which makes rate limiting work correctly. As a happy side-benefit, it should generate less garbage. Instead of replacing all wireguard-go peer identifiers that might occur anywhere in a fully formatted log string, assume that they only come from args. Check all args for things that look like *device.Peers and replace them with appropriately reformatted strings. There is a variety of ways that this could go wrong (unusual format verbs or modifiers, peer identifiers occurring as part of a larger printed object, future API changes), but none of them occur now, are likely to be added, or would be hard to work around if they did. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-04-30wgengine/wglog: delay formattingJosh Bleecher Snyder1-5/+4
The "stop phrases" we use all occur in wireguard-go in the format string. We can avoid doing a bunch of fmt.Sprintf work when they appear. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-04-30ipn/ipnlocal: remove NewLocalBackendWithClientGenBrad Fitzpatrick2-21/+35
This removes the NewLocalBackendWithClientGen constructor added in b4d04a065fd384ca7f57891a2bb87e1ff5205fb6 and instead adds LocalBackend.SetControlClientGetterForTesting, mirroring LocalBackend.SetHTTPTestClient. NewLocalBackendWithClientGen was weird in being exported but taking an unexported type. This was noted during code review: https://github.com/tailscale/tailscale/pull/1818#discussion_r623155669 which ended in: "I'll leave it for y'all to clean up if you find some way to do it elegantly." This is more idiomatic. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-30ipnlocal: don't pause the controlclient until we get at least one netmap.apenwarr/statefixAvery Pennarun3-4/+10
Without this, macOS would fail to display its menu state correctly if you started it while !WantRunning. It relies on the netmap in order to show the logged-in username. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-04-30ipn: !WantRunning + !LoggedOut should not be idle on startup.Avery Pennarun2-21/+26
There was logic that would make a "down" tailscale backend (ie. !WantRunning) refuse to do any network activity. Unfortunately, this makes the macOS and iOS UI unable to render correctly if they start while !WantRunning. Now that we have Prefs.LoggedOut, use that instead. So `tailscale down` will still allow the controlclient to connect its authroutine, but pause the maproutine. `tailscale logout` will entirely stop all activity. This new behaviour is not obviously correct; it's a bit annoying that `tailsale down` doesn't terminate all activity like you might expect. Maybe we should redesign the UI code to render differently when disconnected, and then revert this change. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-04-30ipnlocal: setting WantRunning with EditPrefs was special.Avery Pennarun2-31/+38
EditPrefs should be just a wrapper around the action of changing prefs, but someone had added a side effect of calling Login() sometimes. The side effect happened *after* running the state machine, which would sometimes result in us going into NeedsLogin immediately before calling cc.Login(). This manifested as the macOS app not being able to Connect if you launched it with LoggedOut=false and WantRunning=false. Trying to Connect() would sent us to the NeedsLogin state instead. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-04-30Add prefs.LoggedOut to fix several state machine bugs.Avery Pennarun5-68/+118
Fixes: tailscale/corp#1660 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-04-30ipn/ipnlocal: some state_test cleanups.Avery Pennarun1-12/+38
This doesn't change the actual functionality. Just some additional comments and fine tuning. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-04-30ipnlocal: fix deadlock when calling Shutdown() from Start().Avery Pennarun1-0/+2
Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-04-30Revert "ipn/ipnlocal: be authoritative for the entire MagicDNS record tree."Avery Pennarun1-6/+0
Unfortunately this broke MagicDNS almost entirely. Updates: tailscale/corp#1706 This reverts commit 1d7e7b49eb8e16c31e41420deff527671a87dc0c.
2021-04-29tstest/integration/testcontrol: add start of test control serverBrad Fitzpatrick2-9/+573
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.