summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2023-05-02Remove loopback for tcpmarwan/tmpMarwan Sulaiman1-4/+0
2023-04-29temporary pidMarwan Sulaiman3-6/+14
2023-04-24net/packet: add NAT support for DCCP and GREMaisem Ali3-8/+50
Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-24ipn/store/awsstore: persist state with intelligent tieringMarwan Sulaiman1-2/+13
Fixes #6784 This PR makes it so that we can persist the tailscaled state with intelligent tiering which increases the capacity from 4kb to 8kb Signed-off-by: Marwan Sulaiman <marwan@tailscale.com>
2023-04-22net/netcheck: fix crash when IPv6 kinda but not really worksBrad Fitzpatrick1-0/+11
Looks like on some systems there's an IPv6 address, but then opening a IPv6 UDP socket fails later. Probably some firewall. Tolerate it better and don't crash. To repro: check the "udp6" to something like "udp7" (something that'll fail) and run "go run ./cmd/tailscale netcheck" on a machine with active IPv6. It used to crash and now it doesn't. Fixes #7949 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-04-22ssh/tailssh: handle dialing multiple recorders and failing openMaisem Ali3-72/+255
This adds support to try dialing out to multiple recorders each with a 5s timeout and an overall 30s timeout. It also starts respecting the actions `OnRecordingFailure` field if set, if it is not set it fails open. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-22tailcfg: add SSHRecorderFailureAction and SSHRecordingFailureNotifyRequestMaisem Ali3-1/+68
This allows control to specify how to handle situations where the recorder isn't available. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-21go.mod.sri: update SRI hash for go.mod changesFlakes Updater3-3/+3
Signed-off-by: Flakes Updater <noreply@tailscale.com>
2023-04-21tailcfg: add CanPort80 field to DERPNodeAndrew Dunham3-0/+7
A follow-up PR will start using this field after we set it in our production DERPMap. Updates #7925 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Idb41b79e6055dddb8944f79d91ad4a186ace98c7
2023-04-21net/tstun: add tests for captureHookAndrew Dunham2-8/+115
Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I630f852d9f16c951c721b34f2bc4128e68fe9475
2023-04-20scripts/installer: add Deepin, RisiOS.Denton Gentry1-1/+10
Fixes https://github.com/tailscale/tailscale/issues/7862 Fixes https://github.com/tailscale/tailscale/issues/7899 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2023-04-20all: avoid repeated default interface lookupsMihai Parparita50-126/+242
On some platforms (notably macOS and iOS) we look up the default interface to bind outgoing connections to. This is both duplicated work and results in logspam when the default interface is not available (i.e. when a phone has no connectivity, we log an error and thus cause more things that we will try to upload and fail). Fixed by passing around a netmon.Monitor to more places, so that we can use its cached interface state. Fixes #7850 Updates #7621 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-20log/sockstatlog: bump logInterval to 10 secondsWill Norris1-2/+2
We are seeing indications that some devices are still getting into an upload loop. Bump logInterval in case these devices are on slow connections that are taking more than 3 seconds to uploads sockstats. Updates #7719 Signed-off-by: Will Norris <will@tailscale.com>
2023-04-20all: move network monitoring from wgengine/monitor to net/netmonMihai Parparita51-270/+266
We're using it in more and more places, and it's not really specific to our use of Wireguard (and does more just link/interface monitoring). Also removes the separate interface we had for it in sockstats -- it's a small enough package (we already pull in all of its dependencies via other paths) that it's not worth the extra complexity. Updates #7621 Updates #7850 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-20ipn/localapi: also verify STUN queries work in 'debug derp'Andrew Dunham1-1/+97
Updates #6526 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I274b7ed53ee0be3fb94fdb00cafe06a1d676e1cf
2023-04-19safesocket: enable test to run on Windows unpriviligedJames Tucker3-4/+28
I manually tested that the code path that relaxes pipe permissions is not executed when run with elevated priviliges, and the test also passes in that case. Updates #7876 Signed-off-by: James Tucker <jftucker@gmail.com>
2023-04-19syncs: relax TestWatchMultipleValues timing on WindowsJames Tucker1-4/+7
The test is re-enabled for Windows with a relaxed time assertion. On Windows the runtime poller currently does not have sufficient resolution to meet the normal requirements for this test. See https://github.com/golang/go/issues/44343 for background. Updates #7876 Signed-off-by: James Tucker <jftucker@gmail.com>
2023-04-19ci: add more lints (#7909)Andrew Dunham9-40/+63
This is a follow-up to #7905 that adds two more linters and fixes the corresponding findings. As per the previous PR, this only flags things that are "obviously" wrong, and fixes the issues found. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8739bdb7bc4f75666a7385a7a26d56ec13741b7c
2023-04-19.github: Bump ruby/action-slack from 3.0.0 to 3.2.1dependabot[bot]1-1/+1
Bumps [ruby/action-slack](https://github.com/ruby/action-slack) from 3.0.0 to 3.2.1. - [Release notes](https://github.com/ruby/action-slack/releases) - [Commits](https://github.com/ruby/action-slack/compare/v3.0.0...v3.2.1) --- updated-dependencies: - dependency-name: ruby/action-slack dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2023-04-19.github: Bump peter-evans/create-pull-request from 4.2.4 to 5.0.0dependabot[bot]2-2/+2
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 4.2.4 to 5.0.0. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](https://github.com/peter-evans/create-pull-request/compare/38e0b6e68b4c852a5500a94740f0e535e0d7ba54...5b4a9f6a9e2af26e5f02351490b90d01eb8ec1e5) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2023-04-19licenses: update win/apple licensesLicense Updater2-9/+9
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2023-04-19ipn/ipnlocal: handle masquerade addresses in PeerAPIMaisem Ali2-3/+20
Without this, the peer fails to do anything over the PeerAPI if it has a masquerade address. ``` Apr 19 13:58:15 hydrogen tailscaled[6696]: peerapi: invalid request from <ip>:58334: 100.64.0.1/32 not found in self addresses ``` Updates #8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-19net/tsdial: do not use proxies when dialing out to PeerAPIMaisem Ali1-0/+2
Found this when adding a test that does a ping over PeerAPI. Our integration tests set up a trafficTrap to ensure that tailscaled does not call out to the internet, and it does so via a HTTP_PROXY. When adding a test for pings over PeerAPI, it triggered the trap and investigation lead to the realization that we were not removing the Proxy when trying to dial out to the PeerAPI. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-19net/sockstats: expose debug infoMihai Parparita6-21/+88
Exposes some internal state of the sockstats package via the C2N and PeerAPI endpoints, so that it can be used for debugging. For now this includes the estimated radio on percentage and a second-by-second view of the times the radio was active. Also fixes another off-by-one error in the radio on percentage that was leading to >100% values (if n seconds have passed since we started to monitor, there may be n + 1 possible seconds where the radio could have been on). Updates tailscale/corp#9230 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-19net/sockstats: fix calculation of radio power usageWill Norris2-7/+19
When splitting the radio monitor usage array, we were splitting at now % 3600 to get values into chronological order. This caused the value for the final second to be included at the beginning of the ordered slice rather than the end. If there was activity during that final second, an extra five seconds of high power usage would get recorded in some cases. This could result in a final calculation of greater than 100% usage. This corrects that by splitting values at (now+1 % 3600). This also simplifies the percentage calculation by always rounding values down, which is sufficient for our usage. Signed-off-by: Will Norris <will@tailscale.com>
2023-04-19licenses: update tailscale{,d} licensesLicense Updater1-6/+6
Signed-off-by: License Updater <noreply@tailscale.com>
2023-04-18net/netns: don't log errors when we can't get the default route on DarwinMihai Parparita2-2/+11
It's somewhat common (e.g. when a phone has no reception), and leads to lots of logspam. Updates #7850 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-17various: add golangci-lint, fix issues (#7905)Andrew Dunham34-269/+529
This adds an initial and intentionally minimal configuration for golang-ci, fixes the issues reported, and adds a GitHub Action to check new pull requests against this linter configuration. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8f38fbc315836a19a094d0d3e986758b9313f163
2023-04-17net/connstats: exclude traffic with internal Tailscale service (#7904)Joe Tsai1-0/+15
Exclude traffic with 100.100.100.100 (for IPv4) and with fd7a:115c:a1e0::53 (for IPv6) since this traffic with the Tailscale service running locally on the node. This traffic never left the node. It also happens to be a high volume amount of traffic since DNS requests occur over UDP with each request coming from a unique port, thus resulting in many discrete traffic flows. Fixes tailscale/corp#10554 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2023-04-17net/dnsfallback: more explicitly pass through logf functionMihai Parparita8-66/+20
Redoes the approach from #5550 and #7539 to explicitly pass in the logf function, instead of having global state that can be overridden. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-17.github: Bump actions/setup-go from 3 to 4dependabot[bot]1-1/+1
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3 to 4. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v3...v4) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2023-04-17wgengine/monitor: add --monitor-duration flag to opt-in TestMonitorModeBrad Fitzpatrick1-2/+26
TestMonitorMode skips by default, without the --monitor flag, and then it previously ran forever. This adds an option --monitor-duration flag that defaults to zero (run forever) but if non-zero bounds how long the tests runs. This means you can then also use e.g. `go test --cpuprofile` and capture a CPU/mem profile for a minute or two. Updates #7621 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-04-17net/interfaces: cache "home" router lookup on big Linux routersBrad Fitzpatrick1-1/+16
This is a continuation of the earlier 2a67beaacf but more aggressive; this now remembers that we failed to find the "home" router IP so we don't try again later on the next call. Updates #7621 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-04-17net/netcheck: reenable TestNodeAddrResolve on WindowsJames Tucker1-3/+28
Updates #7876 Co-authored-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: James Tucker <james@tailscale.com> Change-Id: Idb2e6cc2edf6ca123b751d6c8f8729b0cba86023
2023-04-17wgengine/magicsock: keep advertising endpoints after we stop discovering themAndrew Dunham2-0/+212
Previously, when updating endpoints we would immediately stop advertising any endpoint that wasn't discovered during determineEndpoints. This could result in, for example, a case where we performed an incremental netcheck, didn't get any of our three STUN packets back, and then dropped our STUN endpoint from the set of advertised endpoints... which would result in clients falling back to a DERP connection until the next call to determineEndpoints. Instead, let's cache endpoints that we've discovered and continue reporting them to clients until a timeout expires. In the above case where we temporarily don't have a discovered STUN endpoint, we would continue reporting the old value, then re-discover the STUN endpoint again and continue reporting it as normal, so clients never see a withdrawal. Updates tailscale/coral#108 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I42de72e7418ab328a6c732bdefc74549708cf8b9
2023-04-16wgengine/magicsock: update comments on what implements conn.BindBrad Fitzpatrick1-5/+23
The comment still said *magicsock.Conn implemented wireguard-go conn.Bind. That wasn't accurate anymore. A doc #cleanup. Change-Id: I7fd003b939497889cc81147bfb937b93e4f6865c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-04-15wgengine/magicsock, types/nettype, etc: finish ReadFromUDPAddrPort netip ↵Brad Fitzpatrick8-54/+48
migration So we're staying within the netip.Addr/AddrPort consistently and avoiding allocs/conversions to the legacy net addr types. Updates #5162 Change-Id: I59feba60d3de39f773e68292d759766bac98c917 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-04-15wgengine/magicsock, etc: remove mostly unused WriteTo methodsBrad Fitzpatrick3-23/+19
Updates #2331 Updates #5162 Change-Id: I8291884425481eeaedde38a54adfd8ed7292a497 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-04-15net/netcheck: remove unused method from interfaceBrad Fitzpatrick1-1/+0
Updates #2331 Updates #5162 Change-Id: I77ff956c2d59bde611d47523659a07afb4a6da2d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-04-14wgengine/magicsock: reenable magicsock tests on WindowsJames Tucker1-18/+0
These tests are passing locally and on CI. They had failed earlier in the day when first fixing up CI, and it is not immediately clear why. I have cycled IPv6 support locally, but this should not have a substantial effect. Updates #7876 Signed-off-by: James Tucker <jftucker@gmail.com>
2023-04-14tsnet: disable TestLoopbackSOCKS5 on WindowsJames Tucker1-0/+5
This test is not regularly passing on CI, but seems to pass reliably locally. Needs deeper debugging. Updates #7876 Signed-off-by: James Tucker <jftucker@gmail.com>
2023-04-14.github/workflows: add artifact caching and remove double build on raceJames Tucker1-11/+55
Go artifact caching will help provided that the cache remains small enough - we can reuse the strategy from the Windows build where we only cache and pull the zips, but let go(1) do the many-file unpacking as it does so faster. The race matrix was building once without race, then running all the tests with race, so change the matrix to incldue a `buildflags` parameter and use that both in the build and test steps. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>
2023-04-14util/set: move Slice type from corp to ossAndrew Dunham2-0/+125
This is an exact copy of the files misc/set/set{,_test}.go from tailscale/corp@a5415daa9ca80ce9b798cd80148e4bc8818f8e15, plus the license headers. For use in #7877 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I712d09c6d1a180c6633abe3acf8feb59b27e2866
2023-04-14.github/workflows: reenable Windows CI, disable broken testsJames Tucker6-1/+55
We accidentally switched to ./tool/go in 4022796484db7f44f0a8598ed9a5d880d1a5b6ae which resulted in no longer running Windows builds, as this is attempting to run a bash script. I was unable to quickly fix the various tests that have regressed, so instead I've added skips referencing #7876, which we need to back and fix. Updates #7262 Updates #7876 Signed-off-by: James Tucker <james@tailscale.com>
2023-04-14api.md: update example auth key valueWill Norris1-3/+3
example was missing the "-auth" type in the key prefix, which all new keys now contain. Also update key ID to match the full key, and fix indenting of closing braces. Signed-off-by: Will Norris <will@tailscale.com>
2023-04-14wgengine/magicsock: factor out receiveIPv4 & receiveIPv6 common codeBrad Fitzpatrick2-73/+55
Updates #2331 Change-Id: I801df38b217f5d17203e8dc3b8654f44747e0f4b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-04-14net/art: skip tests on CI for nowBrad Fitzpatrick1-0/+19
To get the tree green again for other people. Updates #7866 Change-Id: Ibdad2e1408e5f0c97e49a148bfd77aad17c2c5e5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-04-14net/netcheck: use dnscache.Resolver when resolving DERP IPsAndrew Dunham4-5/+110
This also adds a bunch of tests for this function to ensure that we're returning the proper IP(s) in all cases. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I0d9d57170dbab5f2bf07abdf78ecd17e0e635399
2023-04-13tailcfg: make SelfNodeV4MasqAddrForThisPeer a pointerMaisem Ali11-22/+38
This makes `omitempty` actually work, and saves bytes in each map response. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-13net/art: disable the IPv6 100k routes benchmark.David Anderson1-1/+9
At the current unoptimized memory utilization of the various data structures, 100k IPv6 routes consumes in the ballpark of 3-4GiB, which risks OOMing our 386 test machine. Until we have the optimizations to (drastically) reduce that consumption, skip the test that bloats too much for 32-bit machines. Signed-off-by: David Anderson <danderson@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.