summaryrefslogtreecommitdiffhomepage
path: root/control
AgeCommit message (Collapse)AuthorFilesLines
2022-03-17all: use any instead of interface{}Josh Bleecher Snyder2-6/+6
My favorite part of generics. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-03-16go.mod: update to latest certstoreJosh Bleecher Snyder3-6/+6
It includes a fix to allow us to use Go 1.18. We can now remove our Tailscale-only build tags. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-03-16control/controlclient: only build certstore-related code with the Tailscale ↵Josh Bleecher Snyder3-6/+6
Go toolchain The certstore code is impacted by golang/go#51726. The Tailscale Go toolchain fork contains a temporary workaround, so it can compile it. Once the upstream toolchain can compile certstore, presumably in Go 1.18.1, we can revert this change. Note that depaware runs with the upstream toolchain. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-03-10ssh/tailssh, ipnlocal, controlclient: fetch next SSHAction from networkBrad Fitzpatrick3-0/+17
Updates #3802 Change-Id: I08e98805ab86d6bbabb6c365ed4526f54742fd8e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-10control/controlclient: proactively close TLS connection after /key fetchBrad Fitzpatrick1-0/+8
When using Noise. Updates #3488 Change-Id: I1049963763075a15b72fd8065dcf44a9cf37975f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-09control/controlclient, localapi: shorten expiry time via localapi (#4112)Nick O'Neill3-2/+27
Signed-off-by: Nick O'Neill <nick@tailscale.com>
2022-03-09control/controlbase: make Conn.Write return consumed bytesMaisem Ali1-5/+3
Currently `Write` returns the number of ciphertext bytes written. According to the docs for io.Writer, Write should return the amount of bytes consumed from the input. ``` // Write writes len(p) bytes from p to the underlying data stream. // It returns the number of bytes written from p (0 <= n <= len(p)) // and any error encountered that caused the write to stop early. // Write must return a non-nil error if it returns n < len(p). // Write must not modify the slice data, even temporarily. Write(p []byte) (n int, err error) ``` Fixes #4126 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-09control/controlclient: make MapRequests go over noise.Maisem Ali1-10/+32
Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-08control/controlclient: call direct.Close after map requests are completeMaisem Ali1-3/+3
This was causing a flake in another repo. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-08control/controlclient: make Auto.Shutdown call Direct.CloseMaisem Ali1-0/+4
Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-08control/controlclient: make RegisterRequest go over NoiseMaisem Ali1-17/+49
Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-08control/controlclient: fix Noise HTTP/2 regression from earlier commitBrad Fitzpatrick1-0/+9
Fix regression from 21069124db caught by tests in another repo. The HTTP/2 Transport that was being returned had a ConnPool that never dialed. Updates #3488 Change-Id: I3184d6393813448ae143d37ece14eb732334c05f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-08control/controlclient: fix the Noise HTTP/2 timeout configBrad Fitzpatrick1-6/+15
We want to close the connection after a minute of inactivity, not heartbeat once a minute to keep it alive forever. Updates #3488 Change-Id: I4b5275e8d1f2528e13de2d54808773c70537db91 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-07control/controlclient: make SetDNS attempt to go over Noise firstMaisem Ali1-1/+43
Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-07tailcfg: add SetDNSResponseMaisem Ali1-1/+1
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-07control/controlclient: add Noise clientMaisem Ali2-0/+191
Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-07control/controlclient: start fetching the server noise keyMaisem Ali1-15/+29
Updates #3488 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-06tailcfg: rename map request version to "capability version"Brad Fitzpatrick1-2/+2
And add a CapabilityVersion type, primarily for documentation. This makes MapRequest.Version, RegisterRequest.Version, and SetDNSRequest.Version all use the same version, which will avoid confusing in the future if Register or SetDNS ever changed their semantics on Version change. (Currently they're both always 1) This will requre a control server change to allow a SetDNSRequest.Version value other than 1 to be deployed first. Change-Id: I073042a216e0d745f52ee2dbc45cf336b9f84b7c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-02-26controlhttp: add some docs, change Dial's path from /switch to /ts2021Brad Fitzpatrick1-4/+15
When I deployed server-side changes, I put the upgrade handler at /ts2021 instead of /switch. We could move the server to /switch, but ts2021 seems more specific and better, but I don't feel strongly. Updates #3488 Change-Id: Ifbf8ea60a815fd2fa1bfbe1b7af1ac2a27218354 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-02-18control/controlclient: use structured logging for MapResponse.ControlTimeJosh Bleecher Snyder1-1/+1
Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-02-18tailcfg: make MapResponse.ControlTime a pointerJosh Bleecher Snyder1-1/+1
Otherwise omitempty doesn't work. This is wire-compatible with a non-pointer type, so switching is safe, now and in the future. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-02-16tailcfg: add MapResponse.ControlTime fieldJosh Bleecher Snyder1-0/+3
And log it when provided in map responses. The test uses the date on which I joined Tailscale. :) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-02-16tailcfg: make Node.Hostinfo a HostinfoViewMaisem Ali1-1/+3
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-02-15tailcfg: add start of SSH policy to be sent from control plane to nodesBrad Fitzpatrick1-0/+5
Updates #3802 Change-Id: Iec58f35d445aaa267d0f7e7e2f30c049c1df4c0e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-02-12control/controlclient: remove dummy endpoint in endpoint stripping modeBrad Fitzpatrick1-4/+1
The TODO is done. Magicsock doesn't require any endpoints to create an *endpoint now. Verified both in code and empirically: I can use the env knob and access everything. Change-Id: I4fe7ed5b11c5c5e94b21ef3d77be149daeab998a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-02-12all: adjust some log verbosityBrad Fitzpatrick2-12/+12
Updates #1548 Change-Id: Ia55f1b5dc7dfea09a08c90324226fb92cd10fa00 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-02-11control/controlclient: select newer certificateAdrian Dewhurst2-5/+267
If multiple certificates match when selecting a certificate, use the one issued the most recently (as determined by the NotBefore timestamp). This also adds some tests for the function that performs that comparison. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>
2022-02-07control/controlclient: turn off Go's implicit compressionBrad Fitzpatrick1-0/+4
We don't use it anyway, so be explicit that we're not using it. Change-Id: Iec953271ef0169a2e227811932f5b65b479624af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-24envknob: add new package for all the strconv.ParseBool(os.Getenv(..))Brad Fitzpatrick3-28/+12
A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-17control/controlhttp: package to get a controlbase.Conn over HTTP(S).David Anderson3-0/+735
Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-17control/controlbase: enable asynchronous client handshaking.David Anderson5-35/+84
With this change, the client can obtain the initial handshake message separately from the rest of the handshake, for embedding into another protocol. This enables things like RTT reduction by stuffing the handshake initiation message into an HTTP header. Similarly, the server API optionally accepts a pre-read Noise initiation message, in addition to reading the message directly off a net.Conn. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-17control/controlbase: rename from control/noise.David Anderson7-7/+7
Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-12-01control/noise: clean up resources in TestNoReuseJosh Bleecher Snyder1-0/+3
Close the server and client. Without this, we leak system threads. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-29control/controlclient: stop logging about goal.url invariantJosh Bleecher Snyder1-5/+3
This isn't the ideal solution, but it's good enough for now. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-18net/netns: thread logf into control functionsJosh Bleecher Snyder1-1/+1
So that darwin can log there without panicking during tests. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-16netcheck, controlclient, magicsock: add more metricsBrad Fitzpatrick1-1/+43
Updates #3307 Change-Id: Ibb33425764a75bde49230632f1b472f923551126 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-10control/noise: make Conn.readNLocked less surprising.David Anderson1-3/+2
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: factor out nonce checking and incrementing into a type.David Anderson1-18/+19
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: make message headers match the specification.David Anderson5-91/+65
Only the initiation message should carry a protocol version, all others are just type+len. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: don't panic when handling ciphertext.David Anderson1-2/+3
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: stop using poly1305 package constants.David Anderson3-7/+5
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: use key.Machine{Public,Private} as appropriate.David Anderson7-119/+87
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: don't cache mixer, just rebuild a BLAKE2s each time.David Anderson1-11/+5
This should optimize out fine, and readability is preferable to performance here. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: add singleUseCHP, use it to simplify nonce/key tracking in ↵David Anderson1-58/+70
handshake. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: review fixupsDavid Anderson4-88/+146
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: adjust implementation to match revised spec.David Anderson6-90/+300
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: include the protocol version in the Noise prologue.David Anderson2-5/+9
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: fix typo in docstring.David Anderson1-1/+1
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: remove allocations in the encrypt and decrypt paths.David Anderson1-22/+27
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-10control/noise: implement the base transport for the 2021 control protocol.David Anderson6-0/+2033
Signed-off-by: David Anderson <danderson@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.