summaryrefslogtreecommitdiffhomepage
path: root/control
AgeCommit message (Collapse)AuthorFilesLines
2022-09-24control/controlclient: stop restarting map polls on health changeBrad Fitzpatrick2-9/+33
At some point we started restarting map polls on health change, but we don't remember why. Maybe it was a desperate workaround for something. I'm not sure it ever worked. Rather than have a haunted graveyard, remove it. In its place, though, and somewhat as a safety backup, send those updates over the HTTP/2 noise channel if we have one open. Then if there was a reason that a map poll restart would help we could do it server-side. But mostly we can gather error stats and show machine-level health info for debugging. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-23control/controlclient: add a noiseClient.post helper methodBrad Fitzpatrick2-6/+17
In prep for a future change that would've been very copy/paste-y. And because the set-dns call doesn't currently use a context, so timeouts/cancelations are plumbed. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-23tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan ↵Andrew Dunham5-16/+559
field (#5648) * tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan field This field allows the control server to provide explicit information about how to connect to it; useful if the client's link status can change after the initial connection, or if the DNS settings pushed by the control server break future connections. Change-Id: I720afe6289ec27d40a41b3dcb310ec45bd7e5f3e Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-21control/controlclient,ipn/ipnlocal: wire tka enable/disableTom DNetto2-0/+19
Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-16control/controlhttp: move Dial options into options struct (#5661)Andrew Dunham5-55/+132
This turns 'dialParams' into something more like net.Dialer, where configuration fields are public on the struct. Split out of #5648 Change-Id: I0c56fd151dc5489c3c94fb40d18fd639e06473bc Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-15refactor: move from io/ioutil to io and os packagesEng Zer Jun1-8/+7
The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
2022-09-15cmd/derper, control/controlhttp: disable WebSocket compressionMihai Parparita1-0/+6
The data that we send over WebSockets is encrypted and thus not compressible. Additionally, Safari has a broken implementation of compression (see nhooyr/websocket#218) that makes enabling it actively harmful. Fixes tailscale/corp#6943 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-15envknob: support changing envknobs post-initBrad Fitzpatrick3-26/+24
Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-13cmd/tailscaled, tailcfg, hostinfo: add flag to disable logging + supportBrad Fitzpatrick1-0/+1
As noted in #5617, our documented method of blocking log.tailscale.io DNS no longer works due to bootstrap DNS. Instead, provide an explicit flag (--no-logs-no-support) and/or env variable (TS_NO_LOGS_NO_SUPPORT=true) to explicitly disable logcatcher uploads. It also sets a bit on Hostinfo to say that the node is in that mode so we can end any support tickets from such nodes more quickly. This does not yet provide an easy mechanism for users on some platforms (such as Windows, macOS, Synology) to set flags/env. On Linux you'd used /etc/default/tailscaled typically. Making it easier to set flags for other platforms is tracked in #5114. Fixes #5617 Fixes tailscale/corp#1475 Change-Id: I72404e1789f9e56ec47f9b7021b44c025f7a373a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-29tailcfg, control/controlclient, ipn/ipnlocal: add c2n (control-to-node) systemBrad Fitzpatrick1-2/+64
This lets the control plane can make HTTP requests to nodes. Then we can use this for future things rather than slapping more stuff into MapResponse, etc. Change-Id: Ic802078c50d33653ae1f79d1e5257e7ade4408fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-22control/controlclient,tailcfg: [capver 40] create KeySignature field in ↵Tom DNetto2-0/+17
tailcfg.Node We calve out a space to put the node-key signature (used on tailnets where network lock is enabled). Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-08-15cmd/tailscale/cli: fix build breakMaisem Ali1-8/+3
Accidental break from 64d482ff482b6a616d7f24f939dbc5093d93909b. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-08-15Allow any port for HTTPS when using Noise over TLSJuan Font Alonso3-19/+26
Signed-off-by: Juan Font Alonso <juanfontalonso@gmail.com>
2022-08-11tailcfg, control/controlclient: add PingRequest.URLIsNoise [capver 38]Brad Fitzpatrick1-6/+15
Change-Id: I19bb63b6d99e96b2f9fd2c440afcc31d38137ded Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-09tailcfg, control/controlclient: make Debug settings sticky in a map session ↵Brad Fitzpatrick3-18/+209
[capver 37] Fixes #4843 Change-Id: I3accfd91be474ac745cb47f5d6e866c37d5c5d2d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-04all: use syncs.AtomicValueMaisem Ali1-16/+7
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-08-04syncs, all: move to using Go's new atomic types instead of oursBrad Fitzpatrick1-4/+5
Fixes #5185 Change-Id: I850dd532559af78c3895e2924f8237ccc328449d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-03all: use atomic.PointerMaisem Ali1-2/+2
Also add some missing docs. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-08-03control/controlclient: fix crash in tests elsewhere when GetNLPublicKey is nilBrad Fitzpatrick1-5/+11
4001d0bf256 caused tests in another repo to fail with a crash, calling a nil func. This might not be the right fix, but fixes the build. Change-Id: I67263f883c298f307abdd22bc2a30b3393f062e6 Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-03assorted: plumb tka initialization & network-lock key into tailscaledTom DNetto1-0/+9
- A network-lock key is generated if it doesn't already exist, and stored in the StateStore. The public component is communicated to control during registration. - If TKA state exists on the filesystem, a tailnet key authority is initialized (but nothing is done with it for now). Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-08-02control/controlclient, tailcfg: add 6 more patchable Node fields [capver 36]Brad Fitzpatrick2-1/+117
Change-Id: Iae997a9a98a5dd841bc41fa91227d5a7dd476a25 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25all: convert more code to use net/netip directlyBrad Fitzpatrick3-8/+8
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25net/netaddr: start migrating to net/netip via new netaddr adapter packageBrad Fitzpatrick3-5/+5
Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-20tailcfg, control/controlclient: add tailcfg.PeersChangedPatch [capver 33]Brad Fitzpatrick2-1/+68
This adds a lighter mechanism for endpoint updates from control. Change-Id: If169c26becb76d683e9877dc48cfb35f90cc5f24 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-19tailcfg: remove old DNS fieldsBrad Fitzpatrick1-6/+0
The control plane server doesn't send these to modern clients so we don't need them in the tree. The server has its own serialization code to generate legacy MapResponses when needed. Change-Id: Idd1e5d96ddf9d4306f2da550d20b77f0c252817a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-06-19control/controlclient, ipn/ipnlocal: remove Client.SetExpirySooner, fix raceBrad Fitzpatrick1-4/+0
Client.SetExpirySooner isn't part of the state machine. Remove it from the Client interface. And fix a use of LocalBackend.cc without acquiring the lock that guards that field. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-06-19control/controlclient: remove Client.SetStatusFuncBrad Fitzpatrick3-30/+28
It can't change at runtime. Make it an option. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-06-19control/controlclient, ipn/ipnlocal: remove some Client methodsBrad Fitzpatrick1-7/+0
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-06-19control/controlclient, types/netmap: remove unused LocalPort fieldBrad Fitzpatrick4-34/+15
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-06-19control/controlclient: start simplifying netmap fetch APIsBrad Fitzpatrick2-19/+29
Step 1 of many, cleaning up the direct/auto client & restarting map requests that leads to all the unnecessary map requests. Updates tailscale/corp#5761 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-06-17control/controlclient, net/dnscache: use typed singleflight forkBrad Fitzpatrick1-6/+5
Change-Id: I12be4c5a91ae3a812fe88d9b2d15526fdbb5a921 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-06-08control/controlhttp: use secure WebSockets protocol by defaultMihai Parparita1-4/+10
Forcing the insecure protocol (and perserving the port number) is only desired for localhost testing, in prod we need to use wss:// to avoid mixed-content errors. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-06-07net/wsconn: remove homegrown wrapper for turning a websocket.Conn into a ↵Mihai Parparita2-4/+2
net.Conn The one from the nhooyr/websocket package seems to work equally well. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-06-06cmd/controlclient: wire up PingRequest peerapi pings tooBrad Fitzpatrick1-11/+15
Updates tailscale/corp#754 Change-Id: I61ac3fc44783b54bd02455bcb0baf19159b7a9d2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-06-03cmd/tailscale: surface authentication errors in status.Health (#4748)Jordan Whited1-0/+4
Fixes #3713 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2022-06-02control/controlhttp: allow client and server to communicate over WebSocketsMihai Parparita5-21/+123
We can't do Noise-over-HTTP in Wasm/JS (because we don't have bidirectional communication), but we should be able to do it over WebSockets. Reuses derp WebSocket support that allows us to turn a WebSocket connection into a net.Conn. Updates #3157 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-05-20control/controlclient: avoid Noise protocol for js/wasm for nowBrad Fitzpatrick1-0/+6
Updates #3157 Change-Id: I04accc09783a68257d28cadde5818bf0724a8013 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-05-03control/controlclient: store netinfo and hostinfo separatelyMaisem Ali4-27/+30
Currently, when SetNetInfo is called it sets the value on hostinfo.NetInfo. However, when SetHostInfo is called it overwrites the hostinfo field which may mean it also clears out the NetInfo it had just received. This commit stores NetInfo separately and combines it into Hostinfo as needed so that control is always notified of the latest values. Also, remove unused copies of Hostinfo from ipn.Status and controlclient.Auto. Updates #tailscale/corp#4824 (maybe fixes) Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-05-03wgengine, net/packet, cmd/tailscale: add ICMP echoJames Tucker1-9/+8
Updates tailscale/corp#754 Signed-off-by: James Tucker <james@tailscale.com>
2022-04-28control/controlhttp: don't assume port 80 upgrade response will workBrad Fitzpatrick2-48/+106
Just because we get an HTTP upgrade response over port 80, don't assume we'll be able to do bi-di Noise over it. There might be a MITM corp proxy or anti-virus/firewall interfering. Do a bit more work to validate the connection before proceeding to give up on the TLS port 443 dial. Updates #4557 (probably fixes) Change-Id: I0e1bcc195af21ad3d360ffe79daead730dfd86f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-27net/tsdial: add SystemDial as a wrapper on netns.DialMaisem Ali5-14/+23
The connections returned from SystemDial are automatically closed when there is a major link change. Also plumb through the dialer to the noise client so that connections are auto-reset when moving from cellular to WiFi etc. Updates #3363 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-27control/controlhttp: start port 443 fallback sooner if 80's stuckBrad Fitzpatrick1-31/+82
Fixes #4544 Change-Id: I39877e71915ad48c6668351c45cd8e33e2f5dbae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-26control/controlclient: fix log print with always-empty keyBrad Fitzpatrick1-1/+1
In debugging #4541, I noticed this log print was always empty. The value printed was always zero at this point. Updates #4541 Change-Id: I0eef60c32717c293c1c853879446be65d9b2cef6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-21util/mak: move tailssh's mapSet into a new package for reuse elsewhereBrad Fitzpatrick1-4/+2
Change-Id: Idfe95db82275fd2be6ca88f245830731a0d5aecf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-18tailcfg, logtail: provide Debug bit to disable logtailBrad Fitzpatrick1-0/+4
For people running self-hosted control planes who want a global opt-out knob instead of running their own logcatcher. Change-Id: I7f996c09f45850ff77b58bfd5a535e197971725a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-15tailcfg, control/controlclient: TSMP & disco pingsJames Tucker2-34/+46
tailcfg.PingResponse formalizes the TSMP & disco response message, and controlclient is wired to send POST responses containing tailcfg.PingResponse for TSMP and disco PingRequests. Updates tailscale/corp#754 Signed-off-by: James Tucker <james@tailscale.com>
2022-04-07control/controlbase: don't enforce a max protocol version at handshake time.David Anderson6-28/+18
Doing so makes development unpleasant, because we have to first break the client by bumping to a version the control server rejects, then upgrade the control server to make it accept the new version. This strict rejection at handshake time is only necessary if we want to blocklist some vulnerable protocol versions in the future. So, switch to a default-permissive stance: until we have such a version that we have to eagerly block early, we'll accept whatever version the client presents, and leave it to the user of controlbase.Conn to make decisions based on that version. Noise still enforces that the client and server *agree* on what protocol version is being used, and the control server still has the option to finish the handshake and then hang up with an in-noise error, rather than abort at the handshake level. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-04-07control/controlbase: make the protocol version number selectable.David Anderson10-44/+98
This is so that we can plumb our client capability version through the protocol as the Noise version. The capability version increments more frequently than strictly required (the Noise version only needs to change when cryptographically-significant changes are made to the protocol, whereas the capability version also indicates changes in non-cryptographically-significant parts of the protocol), but this gives us a safe pre-auth way to determine if the client supports future protocol features, while still relying on Noise's strong assurance that the client and server have agreed on the same version. Currently, the server executes the same protocol regardless of the version number, and just presents the version to the caller so they can do capability-based things in the upper RPC protocol. In future, we may add a ratchet to disallow obsolete protocols, or vary the Noise handshake behavior based on requested version. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-03-28net/netutil: add CheckIPForwardingLinux (#4301)Maisem Ali1-81/+9
Combine the code between `LocalBackend.CheckIPForwarding` and `controlclient.ipForwardingBroken`. Fixes #4300 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-24net/netutil: move some net utils from control/controlhttp to netutilBrad Fitzpatrick2-42/+4
In prep for reuse elsewhere. Change-Id: I1b804edf76ac66b9108e6f434e77eab7a7472d69 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.