summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2020-05-30wgengine: ensure pingers are gone before returning from Closecrawshaw/pinger2David Crawshaw1-38/+76
We canceled the pingers in Close, but didn't wait around for their goroutines to be cleaned up. This caused the ipn/e2e_test to catch pingers in its resource leak check. This commit introduces an object, but also simplifies the semantics around the pinger's cancel functions. They no longer need to be called while holding the mutex. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-05-29ipn: restore LiveDERPs assignment in LocalBackend.parseWgStatusBrad Fitzpatrick1-0/+1
Updates #421 (likely fixes it; need to do an iOS build to be sure)
2020-05-29control/controlclient: use netns package to dial connections.David Anderson1-0/+3
Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-29logpolicy: remove deprecated DualStack directive.David Anderson1-1/+0
Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-28logpolicy: use netns for dialing log.tailscale.io.David Anderson1-5/+5
2020-05-28derp/derphttp: make DERP client use netns for dial-outs.David Anderson2-2/+10
2020-05-28net/netns: add package for start of network namespace supportBrad Fitzpatrick3-7/+44
And plumb in netcheck STUN packets. TODO: derphttp, logs, control. Updates #144 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-05-28wgengine/magicsock: don't report v4 localhost addresses on IPv6-only systemsBrad Fitzpatrick1-2/+3
Updates #376
2020-05-28wgengine/router: make runner.go linux-only for now.David Anderson1-0/+2
Otherwise, staticcheck complains that these functions are unused and unexported on macOS. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-28Revert "control/controlclient: use "getprop net.hostname" for Android hostname"Brad Fitzpatrick1-23/+1
This reverts commit afb9c6a6abc9fa5a26200cc36d1ffc947b8b9e89. Doesn't work. See: https://github.com/tailscale/tailscale/issues/409#issuecomment-635241550 Looks pretty dire: https://medium.com/capital-one-tech/how-to-get-an-android-device-nickname-d5eab12f4ced Updates #409
2020-05-28Make netcheck handle v6-only interfaces better, faster.Brad Fitzpatrick4-65/+152
Also: * add -verbose flag to cmd/tailscale netcheck * remove some API from the interfaces package * convert some of the interfaces package to netaddr.IP * don't even send IPv4 probes on machines with no IPv4 (or only v4 loopback) * and once three regions have replied, stop waiting for other probes at 2x the slowest duration. Updates #376
2020-05-28Bump inet.af/netaddr dep for FromStdIP behavior change I want to depend on.Brad Fitzpatrick2-1/+3
2020-05-28tempfork/internal/testenv: removeBrad Fitzpatrick1-160/+0
It was for our x509 fork and no longer needed. (x509 changes went into our Go fork instead)
2020-05-28cmd/tailscale: add netcheck flags for incremental reports, JSON outputBrad Fitzpatrick1-2/+53
2020-05-28router_linux: work around terrible bugs in old iptables-compat versions.Avery Pennarun1-7/+73
Specifically, this sequence: iptables -N ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT iptables -A FORWARD -j ts-forward doesn't work on Debian-9-using-nftables, but this sequence: iptables -N ts-forward iptables -A FORWARD -j ts-forward iptables -A ts-forward -m mark --mark 0x10000 -j ACCEPT does work. I'm sure the reason why is totally fascinating, but it's an old version of iptables and the bug doesn't seem to exist on modern nftables, so let's refactor our code to add rules in the always-safe order and pretend this never happened. Fixes #401. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28router_linux: fix behaviour when switching --netfilter-mode.Avery Pennarun2-16/+16
On startup, and when switching into =off and =nodivert, we were deleting netfilter rules even if we weren't the ones that added them. In order to avoid interfering with rules added by the sysadmin, we have to be sure to delete rules only in the case that we added them in the first place. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28router_linux: remove need for iptables.ListChains().Avery Pennarun3-93/+43
Instead of retrieving the list of chains, or the list of rules in a chain, just try deleting the ones we don't want and then adding the ones we do want. An error in flushing/deleting still means the rule doesn't exist anymore, so there was no need to check for it first. This avoids the need to parse iptables output, which avoids the need to ever call iptables -S, which fixes #403, among other things. It's also much more future proof in case the iptables command line changes. Unfortunately the iptables go module doesn't properly pass the iptables command exit code back up when doing .Delete(), so we can't correctly check the exit code there. (exit code 1 really means the rule didn't exist, rather than some other weird problem). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28router_linux: extract process runner routines into runner.go.Avery Pennarun2-76/+88
These will probably be useful across platforms. They're not really Linux-specific at all. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28router_linux: use only baseline 'ip rule' features that exist in old kernels.Avery Pennarun3-92/+225
This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28cmd/tailscale: make ip_forward warnings more actionable.Avery Pennarun1-3/+3
Let's actually list the file we checked (/proc/sys/net/ipv4/ip_forward). That gives the admin something specific to look for when they get this message. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28cmd/tailscale: be quiet when no interaction or errors are needed.Avery Pennarun1-1/+8
We would print a message about "nothing more to do", which some people thought was an error or warning. Let's only print a message after authenticating if we previously asked for interaction, and let's shorten that message to just "Success," which is what it means. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28magicsock: work around race condition initializing .Regions[].Avery Pennarun1-1/+6
Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-28net/netcheck: fix race condition initializting RegionLatency maps.Avery Pennarun2-10/+14
Under some conditions, code would try to look things up in the maps before the first call to updateLatency. I don't see any reason to delay initialization of the maps, so let's just init them right away when creating the Report instance. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-27filch_test: clarify the use of os.RemoveAll().Avery Pennarun1-13/+13
Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-27control/controlclient: use "getprop net.hostname" for Android hostnameBrad Fitzpatrick1-1/+23
Updates #409
2020-05-27ipn: move e2e_test back to corp repo.David Anderson2-309/+17
It depends on corp things, so can't run here anyway. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-27control/controlclient: move auto_test back to corp repo.David Anderson3-1373/+69
It can't run without corp stuff anyway, and makes it harder to refactor the control server.
2020-05-27tstun: tolerate zero readsDmytro Shynkevych1-12/+36
Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>
2020-05-27control/controlclient: move direct_test back to corp repo.David Anderson1-384/+0
It can only be built with corp deps anyway, and having it split from the control code makes our lives harder. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-26cmd/tailscale: expose --enable-derpDmytro Shynkevych1-0/+3
Signed-off-by: Dmytro Shynkevych <dm.shynk@gmail.com>
2020-05-25tailcfg: add MapResponse.Debug mechanism to trigger logging heap pprofBrad Fitzpatrick4-0/+102
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-05-25stun, netcheck: move under netBrad Fitzpatrick9-10/+10
2020-05-25wgengine/packet: add some tests, more docs, minor Go style, performance changesBrad Fitzpatrick3-50/+115
2020-05-25types/strbuilder: add a variant of strings.Builder that uses sync.PoolBrad Fitzpatrick2-0/+126
... and thus does not need to worry about when it escapes into unprovable fmt interface{} land. Also, add some convenience methods for efficiently writing integers.
2020-05-23all: make client use server-provided DERP map, add DERP region supportBrad Fitzpatrick20-1189/+1427
Instead of hard-coding the DERP map (except for cmd/tailscale netcheck for now), get it from the control server at runtime. And make the DERP map support multiple nodes per region with clients picking the first one that's available. (The server will balance the order presented to clients for load balancing) This deletes the stunner package, merging it into the netcheck package instead, to minimize all the config hooks that would've been required. Also fix some test flakes & races. Fixes #387 (Don't hard-code the DERP map) Updates #388 (Add DERP region support) Fixes #399 (wgengine: flaky tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-05-22wgengine/filter: implement a destination IP pre-filter.David Anderson4-32/+93
Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-22go.sum: go mod tidyBrad Fitzpatrick1-7/+2
2020-05-21ipn: Resolve some resource leaks in test.Avery Pennarun3-10/+27
Updates tailscale/corp#255. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-21ipn/local: get rid of some straggling calls to the log module.Avery Pennarun1-4/+5
Use b.logf() instead. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-20log rate limiting: reformat limiter messages, and use nonempty burst size.Avery Pennarun3-9/+11
- Reformat the warning about a message being rate limited to print the format string, rather than the formatted message. This helps give a clue what "type" of message is being limited. - Change the rate limit warning to be [RATE LIMITED] in all caps. This uses less space on each line, plus is more noticeable. - In tailscaled, change the frequency to be less often (once every 5 seconds per format string) but to allow bursts of up to 5 messages. This greatly reduces the number of messages that are rate limited during startup, but allows us to tighten the limit even further during normal runtime. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-20cmd/tailscaled: SetGCPercent() if GOGC is not set.Avery Pennarun1-0/+10
This cuts RSS from ~30MB to ~20MB on my machine, after the previous fix to get rid of unnecessary zstd buffers. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-20ipnserver and logpolicy: configure zstd with low-memory settings.Avery Pennarun2-2/+10
The compressed blobs we send back and forth are small and infrequent, which doesn't justify the 8MB * GOMAXPROCS memory that was being allocated. This was the overwhelming majority of memory use in tailscaled. On my system it goes from ~100M RSS to ~15M RSS (which is still suspiciously high, but we can worry about that more later). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-20cmd/tailscaled: eliminate unnecessary use of an init() function.Avery Pennarun1-5/+2
Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-20controlclient tests: fix more memory leaks and add resource checking.Avery Pennarun3-11/+34
I can now run these tests with -count=1000 without running out of RAM. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-19controlclient/direct: fix a race condition accessing auth keys.Avery Pennarun2-1/+7
Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-19controlclient/auto_test: don't print the s.control object.Avery Pennarun1-1/+1
This contains atomic ints that trigger a race check error if we access them non-atomically. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-19portlist: fix "readdirent: no such file or directory" errors on Linux.Avery Pennarun2-0/+20
This could happen when a process disappeared while we were reading its file descriptor list. I was able to replicate the problem by running this in another terminal: while :; do for i in $(seq 10); do /bin/true & done >&/dev/null; wait >&/dev/null; done And then running the portlist tests thousands of times. Fixes #339. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-19ipn: sprinkle documentation and clarity rewrites through LocalBackend.David Anderson2-82/+144
Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-18go.mod: bump wireguard-go version.David Anderson1-1/+1
2020-05-15go.mod: bump wireguard-go version.David Anderson1-1/+1
Signed-off-by: David Anderson <danderson@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.