summaryrefslogtreecommitdiffhomepage
path: root/control/controlhttp
AgeCommit message (Collapse)AuthorFilesLines
2024-11-26control/controlhttp: set *health.Tracker in testsAndrew Dunham1-0/+3
Observed during another PR: https://github.com/tailscale/tailscale/actions/runs/12040045880/job/33569141807 Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I9e0f49a35485fa2e097892737e5e3c95bf775a90
2024-11-20cmd/tailscale/cli: create netmon in debug ts2021Andrew Dunham1-0/+2
Otherwise we'll see a panic if we hit the dnsfallback code and try to call NewDialer with a nil NetMon. Updates #14161 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I81c6e72376599b341cb58c37134c2a948b97cf5f
2024-11-07derp/derphttp: don't link websockets other than on GOOS=jsBrad Fitzpatrick2-3/+4
Or unless the new "ts_debug_websockets" build tag is set. Updates #1278 Change-Id: Ic4c4f81c1924250efd025b055585faec37a5491d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-07control/controlhttp/controlhttpserver: split out Accept to its own packageBrad Fitzpatrick5-23/+46
Otherwise all the clients only using control/controlhttp for the ts2021 HTTP client were also pulling in WebSocket libraries, as the server side always needs to speak websockets, but only GOOS=js clients speak it. This doesn't yet totally remove the websocket dependency on Linux because Linux has a envknob opt-in to act like GOOS=js for manual testing and force the use of WebSockets for DERP only (not control). We can put that behind a build tag in a future change to eliminate the dep on all GOOSes. Updates #1278 Change-Id: I4f60508f4cad52bf8c8943c8851ecee506b7ebc9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-09control/controlhttp: don't link ts2021 server + websocket code on iOSBrad Fitzpatrick1-0/+2
We probably shouldn't link it in anywhere, but let's fix iOS for now. Updates #13762 Updates tailscale/corp#20099 Change-Id: Idac116e9340434334c256acba3866f02bd19827c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-02control/control{client,http}: don't noise dial localhost:443 in http-only testsBrad Fitzpatrick2-7/+23
1eaad7d3deb regressed some tests in another repo that were starting up a control server on `http://127.0.0.1:nnn`. Because there was no https running, and because of a bug in 1eaad7d3deb (which ended up checking the recently-dialed-control check twice in a single dial call), we ended up forcing only the use of TLS dials in a test that only had plaintext HTTP running. Instead, plumb down support for explicitly disabling TLS fallbacks and use it only when running in a test and using `http` scheme control plane URLs to 127.0.0.1 or localhost. This fixes the tests elsewhere. Updates #13597 Change-Id: I97212ded21daf0bd510891a278078daec3eebaa6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-02control/controlhttp: rename a param from addr to optAddr for clarityBrad Fitzpatrick1-14/+20
And update docs. Updates #cleanup Updates #13597 (tangentially; noted this cleanup while debugging) Change-Id: I62440294c78b0bb3f5673be10318dd89af1e1bfe Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-01control/controlhttp: fix connectivity on Alaska Air wifiBrad Fitzpatrick1-0/+12
Updates #13597 Change-Id: Ifbf52b93fd35d64fcf80f8fddbfd610008fd8742 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-01control/controlhttp: factor out some code in prep for future changeBrad Fitzpatrick2-12/+24
This pulls out the clock and forceNoise443 code into methods on the Dialer as cleanup in its own commit to make a future change less distracting. Updates #13597 Change-Id: I7001e57fe7b508605930c5b141a061b6fb908733 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-08-14go.{mod,sum}: migrate from nhooyr.io/websocket to github.com/coder/websocketKyle Carberry2-2/+2
Coder has just adopted nhooyr/websocket which unfortunately changes the import path. `github.com/coder/coder` imports `tailscale.com/net/wsconn` which was still pointing to `nhooyr.io/websocket`, but this change updates it. See https://coder.com/blog/websocket Updates #13154 Change-Id: I3dec6512472b14eae337ae22c5bcc1e3758888d5 Signed-off-by: Kyle Carberry <kyle@carberry.com>
2024-08-06control/controlhttp: extract the last network connectionAnton Tolchanov2-12/+60
The same context we use for the HTTP request here might be re-used by the dialer, which could result in `GotConn` being called multiple times. We only care about the last one. Fixes #13009 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-06-20control/controlclient: add more Screen Time blocking detectionBrad Fitzpatrick1-2/+3
Updates #9658 Updates #12545 Change-Id: Iec1dad354a75f145567b4055d77b1c1db27c89e2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Co-authored-by: Andrea Gottardo <andrea@gottardo.me>
2024-06-19control/controlhttp: add health warning for macOS filtering blocking ↵Brad Fitzpatrick1-1/+43
Tailscale (#12546) Updates #9658 Updates #12545 Change-Id: I6612b9b65eb193a1a651e219b5198c7c20ed94e1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Co-authored-by: Andrea Gottardo <andrea@tailscale.com>
2024-04-27net/netns, net/dns/resolver, etc: make netmon required in most placesBrad Fitzpatrick2-4/+6
The goal is to move more network state accessors to netmon.Monitor where they can be cheaper/cached. But first (this change and others) we need to make sure the one netmon.Monitor is plumbed everywhere. Some notable bits: * tsdial.NewDialer is added, taking a now-required netmon * because a tsdial.Dialer always has a netmon, anything taking both a Dialer and a NetMon is now redundant; take only the Dialer and get the NetMon from that if/when needed. * netmon.NewStatic is added, primarily for tests Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: I877f9cb87618c4eb037cee098241d18da9c01691 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-26health, all: remove health.Global, finish plumbing health.TrackerBrad Fitzpatrick2-2/+5
Updates #11874 Updates #4136 Change-Id: I414470f71d90be9889d44c3afd53956d9f26cd61 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-25tsd, ipnlocal, etc: add tsd.System.HealthTracker, start some plumbingBrad Fitzpatrick1-1/+2
This adds a health.Tracker to tsd.System, accessible via a new tsd.System.HealthTracker method. In the future, that new method will return a tsd.System-specific HealthTracker, so multiple tsnet.Servers in the same process are isolated. For now, though, it just always returns the temporary health.Global value. That permits incremental plumbing over a number of changes. When the second to last health.Global reference is gone, then the tsd.System.HealthTracker implementation can return a private Tracker. The primary plumbing this does is adding it to LocalBackend and its dozen and change health calls. A few misc other callers are also plumbed. Subsequent changes will flesh out other parts of the tree (magicsock, controlclient, etc). Updates #11874 Updates #4136 Change-Id: Id51e73cfc8a39110425b6dc19d18b3975eac75ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-16all: use Go 1.22 range-over-intBrad Fitzpatrick1-1/+1
Updates #11058 Change-Id: I35e7ef9b90e83cac04ca93fd964ad00ed5b48430 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-29net/wsconn: accept a remote addr string and plumb it throughDavid Anderson2-2/+2
This makes wsconn.Conns somewhat present reasonably when they are the client of an http.Request, rather than just put a placeholder in that field. Updates tailscale/corp#13777 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-08-09control/controlhttp: remove tstest.Clock from tests (#8830)Andrew Lytvynov1-11/+23
These specific tests rely on some timers in the controlhttp code. Without time moving forward and timers triggering, the tests fail. Updates #8587 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-08-04control: use tstime instead of time (#8595)Claire Wang3-3/+18
Updates #8587 Signed-off-by: Claire Wang <claire@tailscale.com>
2023-06-25.github: actually run tests in CIMaisem Ali1-13/+14
Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-05-01control/controlclient: use dnscache.Resolver for Noise clientAndrew Dunham2-7/+22
This passes the *dnscache.Resolver down from the Direct client into the Noise client and from there into the controlhttp client. This retains the Resolver so that it can share state across calls instead of creating a new resolver. Updates #4845 Updates #6110 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia5d6af1870f3b5b5d7dd5685d775dcf300aec7af
2023-04-20all: avoid repeated default interface lookupsMihai Parparita2-1/+6
On some platforms (notably macOS and iOS) we look up the default interface to bind outgoing connections to. This is both duplicated work and results in logspam when the default interface is not available (i.e. when a phone has no connectivity, we log an error and thus cause more things that we will try to upload and fail). Fixed by passing around a netmon.Monitor to more places, so that we can use its cached interface state. Fixes #7850 Updates #7621 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-17net/dnsfallback: more explicitly pass through logf functionMihai Parparita1-1/+1
Redoes the approach from #5550 and #7539 to explicitly pass in the logf function, instead of having global state that can be overridden. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-12net/sockstats: pass in logger to sockstats.WithSockStatsMihai Parparita1-1/+1
Using log.Printf may end up being printed out to the console, which is not desirable. I noticed this when I was investigating some client logs with `sockstats: trace "NetcheckClient" was overwritten by another`. That turns to be harmless/expected (the netcheck client will fall back to the DERP client in some cases, which does its own sockstats trace). However, the log output could be visible to users if running the `tailscale netcheck` CLI command, which would be needlessly confusing. Updates tailscale/corp#9230 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-03-12various: pass logger.Logf through to more placesAndrew Dunham1-0/+2
Updates #7537 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id89acab70ea678c8c7ff0f44792d54c7223337c6
2023-03-06sockstats: switch label to enumMihai Parparita1-1/+1
Makes it cheaper/simpler to persist values, and encourages reuse of labels as opposed to generating an arbitrary number. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-03-01sockstats: instrument networking code pathsMihai Parparita1-0/+3
Uses the hooks added by tailscale/go#45 to instrument the reads and writes on the major code paths that do network I/O in the client. The convention is to use "<package>.<type>:<label>" as the annotation for the responsible code path. Enabled on iOS, macOS and Android only, since mobile platforms are the ones we're most interested in, and we are less sensitive to any throughput degradation due to the per-I/O callback overhead (macOS is also enabled for ease of testing during development). For now just exposed as counters on a /v0/sockstats PeerAPI endpoint. We also keep track of the current interface so that we can break out the stats by interface. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-02-08control/controlhttp: don't require valid TLS cert for Noise connectionBrad Fitzpatrick3-29/+43
We don't require any cert at all for Noise-over-plaintext-port-80-HTTP, so why require a valid cert chain for Noise-over-HTTPS? The reason we use HTTPS at all is to get through firewalls that allow tcp/443 but not tcp/80, not because we need the security properties of TLS. Updates #3198 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-01-27all: update copyright and license headersWill Norris6-18/+12
This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2023-01-17control/controlhttp: add TS_FORCE_NOISE_443, TS_DEBUG_NOISE_DIAL envknobsBrad Fitzpatrick1-2/+25
Updates tailscale/docker-extension#49 Change-Id: I99a154c16c92228bfdf4d2cf6c58cda00e22d72f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-01-13control/controlhttp: fix header case-sensitivityMatthias Gabriel1-1/+2
Change-Id: I49269bc969a80382997ec5c9de33c4f56d9dc787 Signed-off-by: Matthias Gabriel <matthias.gabriel@etit.tu-chemnitz.de>
2022-11-04all: remove old +build tagsBrad Fitzpatrick1-1/+0
The //go:build syntax was introduced in Go 1.17: https://go.dev/doc/go1.17#build-lines gofmt has kept the +build and go:build lines in sync since then, but enough time has passed. Time to remove them. Done with: perl -i -npe 's,^// \+build.*\n,,' $(git grep -l -F '+build') Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-28control/controlhttp: remove ClientConn.UntrustedUpgradeHeadersBrad Fitzpatrick3-23/+11
It was just added and unreleased but we've decided to go a different route. Details are in 5e9e57ecf531f. Updates #5972 Change-Id: I49016af469225f58535f63a9b0fbe5ab6a5bf304 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-27control/controlhttp: add AcceptHTTP hook to add coalesced Server->Client writeBrad Fitzpatrick2-15/+128
New plan for #5972. Instead of sending the public key in the clear (from earlier unreleased 246274b8e91) where the client might have to worry about it being dropped or tampered with and retrying, we'll instead send it post-Noise handshake but before the HTTP/2 connection begins. This replaces the earlier extraHeaders hook with a different sort of hook that allows us to combine two writes on the wire in one packet. Updates #5972 Change-Id: I42cdf7c1859b53ca4dfa5610bd1b840c6986e09c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-18net/wsconn: add back custom wrapper for turning a websocket.Conn into a net.ConnMihai Parparita2-2/+4
We removed it in #4806 in favor of the built-in functionality from the nhooyr.io/websocket package. However, it has an issue with deadlines that has not been fixed yet (see nhooyr/websocket#350). Temporarily go back to using a custom wrapper (using the fix from our fork) so that derpers will stop closing connections too aggressively. Updates #5921 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-10-17control/controlhttp: allow setting, getting Upgrade headers in Noise upgradeBrad Fitzpatrick5-24/+63
Not currently used, but will allow us to usually remove a round-trip for a future feature. Updates #5972 Change-Id: I2770ea28e3e6ec9626d1cbb505a38ba51df7fba2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-17control/controlhttp: try to avoid flakes in TestDialPlanAndrew Dunham1-5/+18
Updates tailscale/corp#7446 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ifcf3b5176f065c2e67cbb8943f6356dea720a9c5
2022-09-26control/controlhttp: use custom port for non-localhost JS noise client ↵Mihai Parparita1-2/+4
connections Control may not be bound to (just) localhost when sharing dev servers, allow the Wasm client to connect to it in that case too. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-23tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan ↵Andrew Dunham3-9/+464
field (#5648) * tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan field This field allows the control server to provide explicit information about how to connect to it; useful if the client's link status can change after the initial connection, or if the DNS settings pushed by the control server break future connections. Change-Id: I720afe6289ec27d40a41b3dcb310ec45bd7e5f3e Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-16control/controlhttp: move Dial options into options struct (#5661)Andrew Dunham4-54/+123
This turns 'dialParams' into something more like net.Dialer, where configuration fields are public on the struct. Split out of #5648 Change-Id: I0c56fd151dc5489c3c94fb40d18fd639e06473bc Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-15cmd/derper, control/controlhttp: disable WebSocket compressionMihai Parparita1-0/+6
The data that we send over WebSockets is encrypted and thus not compressible. Additionally, Safari has a broken implementation of compression (see nhooyr/websocket#218) that makes enabling it actively harmful. Fixes tailscale/corp#6943 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-08-15cmd/tailscale/cli: fix build breakMaisem Ali1-8/+3
Accidental break from 64d482ff482b6a616d7f24f939dbc5093d93909b. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-08-15Allow any port for HTTPS when using Noise over TLSJuan Font Alonso1-9/+5
Signed-off-by: Juan Font Alonso <juanfontalonso@gmail.com>
2022-06-08control/controlhttp: use secure WebSockets protocol by defaultMihai Parparita1-4/+10
Forcing the insecure protocol (and perserving the port number) is only desired for localhost testing, in prod we need to use wss:// to avoid mixed-content errors. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-06-07net/wsconn: remove homegrown wrapper for turning a websocket.Conn into a ↵Mihai Parparita2-4/+2
net.Conn The one from the nhooyr/websocket package seems to work equally well. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-06-02control/controlhttp: allow client and server to communicate over WebSocketsMihai Parparita4-15/+123
We can't do Noise-over-HTTP in Wasm/JS (because we don't have bidirectional communication), but we should be able to do it over WebSockets. Reuses derp WebSocket support that allows us to turn a WebSocket connection into a net.Conn. Updates #3157 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-04-28control/controlhttp: don't assume port 80 upgrade response will workBrad Fitzpatrick2-48/+106
Just because we get an HTTP upgrade response over port 80, don't assume we'll be able to do bi-di Noise over it. There might be a MITM corp proxy or anti-virus/firewall interfering. Do a bit more work to validate the connection before proceeding to give up on the TLS port 443 dial. Updates #4557 (probably fixes) Change-Id: I0e1bcc195af21ad3d360ffe79daead730dfd86f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-27net/tsdial: add SystemDial as a wrapper on netns.DialMaisem Ali2-6/+7
The connections returned from SystemDial are automatically closed when there is a major link change. Also plumb through the dialer to the noise client so that connections are auto-reset when moving from cellular to WiFi etc. Updates #3363 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-27control/controlhttp: start port 443 fallback sooner if 80's stuckBrad Fitzpatrick1-31/+82
Fixes #4544 Change-Id: I39877e71915ad48c6668351c45cd8e33e2f5dbae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.