summaryrefslogtreecommitdiffhomepage
path: root/control/controlknobs/controlknobs.go
AgeCommit message (Collapse)AuthorFilesLines
2024-09-16ipnlocal: support automatic exit node disablement when captive portal detectedangott/captive-exit-node-disablementAndrea Gottardo1-0/+7
2024-07-26health: introduce captive-portal-detected Warnable (#12707)Andrea Gottardo1-0/+7
Updates tailscale/tailscale#1634 This PR introduces a new `captive-portal-detected` Warnable which is set to an unhealthy state whenever a captive portal is detected on the local network, preventing Tailscale from connecting. ipn/ipnlocal: fix captive portal loop shutdown Change-Id: I7cafdbce68463a16260091bcec1741501a070c95 net/captivedetection: fix mutex misuse ipn/ipnlocal: ensure that we don't fail to start the timer Change-Id: I3e43fb19264d793e8707c5031c0898e48e3e7465 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-07-12wgengine/magicsock: use wireguard-go/conn.PeerAwareEndpointBrad Fitzpatrick1-0/+7
If we get an non-disco presumably-wireguard-encrypted UDP packet from an IP:port we don't recognize, rather than drop the packet, give it to WireGuard anyway and let WireGuard try to figure out who it's from and tell us. This uses the new hook added in https://github.com/tailscale/wireguard-go/pull/27 Updates tailscale/corp#20732 Change-Id: I5c61a40143810592f9efac6c12808a87f924ecf2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-07-06control/controlknobs,tailcfg,wgengine/magicsock: remove DRPO shutoff switchBrad Fitzpatrick1-7/+0
The DERP Return Path Optimization (DRPO) is over four years old (and on by default for over two) and we haven't had problems, so time to remove the emergency shutoff code (controlknob) which we've never used. The controlknobs are only meant for new features, to mitigate risk. But we don't want to keep them forever, as they kinda pollute the code. Updates #150 Change-Id: If021bc8fd1b51006d8bddd1ffab639bb1abb0ad1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-06-14various: create a catch-all NRPT rule when "Override local DNS" is enabled ↵Nick Khyl1-0/+12
on Windows Without this rule, Windows 8.1 and newer devices issue parallel DNS requests to DNS servers associated with all network adapters, even when "Override local DNS" is enabled and/or a Mullvad exit node is being used, resulting in DNS leaks. This also adds "disable-local-dns-override-via-nrpt" nodeAttr that can be used to disable the new behavior if needed. Fixes tailscale/corp#20718 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-06-06tailcfg,net/dns: add controlknob to disable battery split DNS on iOS (#12346)Andrea Gottardo1-32/+44
Updates corp#15802. Adds the ability for control to disable the recently added change that uses split DNS in more cases on iOS. This will allow us to disable the feature if it leads to regression in production. We plan to remove this knob once we've verified that the feature works properly. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-05-06net/dns/resolver, control/controlknobs, tailcfg: use UserDial instead of ↵Nick Khyl1-0/+8
SystemDial to dial DNS servers Now that tsdial.Dialer.UserDial has been updated to honor the configured routes and dial external network addresses without going through Tailscale, while also being able to dial a node/subnet router on the tailnet, we can start using UserDial to forward DNS requests. This is primarily needed for DNS over TCP when forwarding requests to internal DNS servers, but we also update getKnownDoHClientForProvider to use it. Updates tailscale/corp#18725 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-04-29appc: add flag shouldStoreRoutes and controlknob for itFran Bull1-0/+7
When an app connector is reconfigured and domains to route are removed, we would like to no longer advertise routes that were discovered for those domains. In order to do this we plan to store which routes were discovered for which domains. Add a controlknob so that we can enable/disable the new behavior. Updates #11008 Signed-off-by: Fran Bull <fran@tailscale.com>
2024-03-24all: deprecate Node.Capabilities (more), remove PeerChange.Capabilities ↵Brad Fitzpatrick1-6/+2
[capver 89] First we had Capabilities []string. Then https://tailscale.com/blog/acl-grants (#4217) brought CapMap, a superset of Capabilities. Except we never really finished the transition inside the codebase to go all-in on CapMap. This does so. Notably, this coverts Capabilities on the wire early to CapMap internally so the code can only deal in CapMap, even against an old control server. In the process, this removes PeerChange.Capabilities support, which no known control plane sent anyway. They can and should use PeerChange.CapMap instead. Updates #11508 Updates #4217 Change-Id: I872074e226b873f9a578d9603897b831d50b25d9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-01-23wgengine/magicsock: implement probing of UDP path lifetime (#10844)Jordan Whited1-0/+7
This commit implements probing of UDP path lifetime on the tail end of an active direct connection. Probing configuration has two parts - Cliffs, which are various timeout cliffs of interest, and CycleCanStartEvery, which limits how often a probing cycle can start, per-endpoint. Initially a statically defined default configuration will be used. The default configuration has cliffs of 10s, 30s, and 60s, with a CycleCanStartEvery of 24h. Probing results are communicated via clientmetric counters. Probing is off by default, and can be enabled via control knob. Probing is purely informational and does not yet drive any magicsock behaviors. Updates #540 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-01-04ipn/ipnlocal: refresh node key without blocking if cap enabled (#10529)James 'zofrex' Sanderson1-0/+8
Updates tailscale/corp#16016 Signed-off-by: James Sanderson <jsanderson@tailscale.com> Co-authored-by: Maisem Ali <maisem@tailscale.com>
2023-12-05linuxfw,wgengine/route,ipn: add c2n and nodeattrs to control linux netfilterNaman Sood1-0/+14
Updates tailscale/corp#14029. Signed-off-by: Naman Sood <mail@nsood.in>
2023-11-13control/controlknobs,wgengine/magicsock: implement SilentDisco toggle (#10195)Jordan Whited1-0/+7
This change exposes SilentDisco as a control knob, and plumbs it down to magicsock.endpoint. No changes are being made to magicsock.endpoint disco behavior, yet. Updates #540 Signed-off-by: Jordan Whited <jordan@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-09-25net/dns: retry forwarder requests over TCPAndrew Dunham1-16/+23
We weren't correctly retrying truncated requests to an upstream DNS server with TCP. Instead, we'd return a truncated request to the user, even if the user was querying us over TCP and thus able to handle a large response. Also, add an envknob and controlknob to allow users/us to disable this behaviour if it turns out to be buggy (✨ DNS ✨). Updates #9264 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ifb04b563839a9614c0ba03e9c564e8924c1a2bfd
2023-09-21control,tailcfg,wgengine/magicsock: add nodeAttr to enable/disable peer MTUVal1-0/+6
Add a nodeAttr to enable/disable peer path MTU discovery. Updates #311 Signed-off-by: Val <valerie@tailscale.com>
2023-09-18tailcfg: add NodeCapMapMaisem Ali1-26/+18
Like PeerCapMap, add a field to `tailcfg.Node` which provides a map of Capability to raw JSON messages which are deferred to be parsed later by the application code which cares about the specific capabilities. This effectively allows us to prototype new behavior without having to commit to a schema in tailcfg, and it also opens up the possibilities to develop custom behavior in tsnet applications w/o having to plumb through application specific data in the MapResponse. Updates #4217 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-09-17tailcfg: define a type for NodeCapabilityMaisem Ali1-1/+1
Instead of untyped string, add a type to identify these. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-09-12control/controlknobs: move more controlknobs code from controlclientBrad Fitzpatrick1-0/+45
Updates #cleanup Change-Id: I2b8b6ac97589270f307bfb20e33674894ce873b5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-09-12control/controlclient, types/netmap: start plumbing delta netmap updatesBrad Fitzpatrick1-0/+6
Currently only the top four most popular changes: endpoints, DERP home, online, and LastSeen. Updates #1909 Change-Id: I03152da176b2b95232b56acabfb55dcdfaa16b79 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-09-12ipn/ipnlocal: fix missing controlknobs.Knobs plumbingBrad Fitzpatrick1-0/+16
I missed connecting some controlknobs.Knobs pieces in 4e91cf20a854 resulting in that breaking control knobs entirely. Whoops. The fix in ipn/ipnlocal (where it makes a new controlclient) but to atone, I also added integration tests. Those integration tests use a new "tailscale debug control-knobs" which by itself might be useful for future debugging. Updates #9351 Change-Id: Id9c89c8637746d879d5da67b9ac4e0d2367a3f0d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-09-11control/controlknobs: move ForceBackgroundSTUN to controlknobs.KnobsBrad Fitzpatrick1-0/+4
This is both more efficient (because the knobs' bool is only updated whenever Node is changed, rarely) and also gets us one step closer to removing a case of storing a netmap.NetworkMap in magicsock. (eventually we want to phase out much of the use of that type internally) Updates #1909 Change-Id: I37e81789f94133175064fdc09984e4f3a431f1a1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-09-11control/controlknobs, all: add plumbed Knobs type, not global variablesBrad Fitzpatrick1-13/+21
Previously two tsnet nodes in the same process couldn't have disjoint sets of controlknob settings from control as both would overwrite each other's global variables. This plumbs a new controlknobs.Knobs type around everywhere and hangs the knobs sent by control on that instead. Updates #9351 Change-Id: I75338646d36813ed971b4ffad6f9a8b41ec91560 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-01-27all: update copyright and license headersWill Norris1-3/+2
This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2022-09-15envknob: support changing envknobs post-initBrad Fitzpatrick1-6/+4
Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-04syncs, all: move to using Go's new atomic types instead of oursBrad Fitzpatrick1-4/+5
Fixes #5185 Change-Id: I850dd532559af78c3895e2924f8237ccc328449d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-24envknob: add new package for all the strconv.ParseBool(os.Getenv(..))Brad Fitzpatrick1-5/+2
A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-15control/{controlknobs,controlclient}: simplify knobs API, fix controlclient ↵Brad Fitzpatrick1-16/+9
crash From integration tests elsewhere: panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x70 pc=0x845c9b] goroutine 226 [running]: tailscale.com/control/controlclient.(*Direct).sendMapRequest(0xc00053e1e0, 0x16670f0, 0xc000353780, 0xffffffffffffffff, 0xc0003e5f10, 0x0, 0x0) /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/direct.go:803 +0x19bb tailscale.com/control/controlclient.(*Direct).PollNetMap(...) /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/direct.go:574 tailscale.com/control/controlclient.(*Auto).mapRoutine(0xc00052a1e0) /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/auto.go:464 +0x571 created by tailscale.com/control/controlclient.(*Auto).Start /home/runner/go/pkg/mod/tailscale.com@v1.1.1-0.20210715222212-1bb6abc604c1/control/controlclient/auto.go:151 +0x65 exit status 2 Also remove types/opt.Bool API addition which is now unnecessary. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-15net/portmapper: add upnp port mappingjulianknodt1-0/+41
Add in UPnP portmapping, using goupnp library in order to get the UPnP client and run the portmapping functions. This rips out anywhere where UPnP used to be in portmapping, and has a flow separate from PMP and PCP. RELNOTE=portmapper now supports UPnP mappings Fixes #682 Updates #2109 Signed-off-by: julianknodt <julianknodt@gmail.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.