summaryrefslogtreecommitdiffhomepage
path: root/ipn
AgeCommit message (Collapse)AuthorFilesLines
2020-07-24ipn: add OSVersion, DeviceModel fields to Prefs and propagate to HostinfosElias Naur3-7/+21
Needed for Android. Signed-off-by: Elias Naur <mail@eliasnaur.com>
2020-07-23control/controlclient: rename uflags, give it a type, remove dead codeBrad Fitzpatrick1-7/+7
2020-07-22ipn: load hostname in Start.Dmytro Shynkevych1-0/+3
This prevents hostname being forced to os.Hostname despite override when control is contacted for the first time after starting tailscaled. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>
2020-07-22ipn: remove unused parameter to func LoadPrefs, fix godoc subjectBrad Fitzpatrick2-5/+4
2020-07-15ipn/ipnserver: support simultaneous connectionsv0.100.0-107Brad Fitzpatrick1-68/+96
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-07-15cmd/tailscale: make tailscale status -active also filter in -json modeBrad Fitzpatrick1-1/+3
2020-07-14ipn: add self to dns mapDmytro Shynkevych1-5/+12
Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>
2020-07-14wgengine/router: dns: unify on *BSD, multimode on Linux, Magic DNS (#536)Dmytro Shynkevych1-3/+5
Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>
2020-07-14ipn: add Login backend command for sign-in with tokenElias Naur6-0/+48
The StartLoginInteractive command is for delegating the sign-in flow to a browser. The Android Gooogle Sign-In SDK inverts the flow by giving the client ID tokens. Add a new backend command for accepting such tokens by exposing the existing controlclient.Client.Login support for OAuth2 tokens. Introduce a custom TokenType to distinguish ID tokens from other OAuth2 tokens. Signed-off-by: Elias Naur <mail@eliasnaur.com>
2020-07-13cmd/tailscaled: graceful shutdown (#534)Dmytro Shynkevych2-2/+6
Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>
2020-07-09ipn: add Notify.LocalTCPPort field for macOS Network Extension to useBrad Fitzpatrick1-0/+6
We want the macOS Network Extension to share fate with the UI frontend, so we need the backend to know when the frontend disappears. One easy way to do that is to reuse the existing TCP server it's already running (for tailscale status clietns). We now tell the frontend our ephemeral TCP port number, and then have the UI connect to it, so the backend can know when it disappears. There are likely Swift ways of doing this, but I couldn't find them quickly enough, so I reached for the hammer I knew.
2020-07-08ipn, control/controlclient: fix some data racesBrad Fitzpatrick1-1/+2
More remain. Fixes tailscale/corp#432
2020-07-08ipn, ipn/ipnserver: add support for serving in error-message-only modeBrad Fitzpatrick2-5/+39
So Windows service failures can be propagated to the Windows UI client.
2020-07-07tsdns: dual resolution mode, IPv6 support (#526)Dmytro Shynkevych1-1/+1
This change adds to tsdns the ability to delegate lookups to upstream nameservers. This is crucial for setting Magic DNS as the system resolver. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>
2020-07-06wgengine/magicsock: change API to not permit disco key changesBrad Fitzpatrick1-3/+1
Generate the disco key ourselves and give out the public half instead. Fixes #525
2020-07-03cmd/tailscale: add tailscale status region name, last write, consistently starBrad Fitzpatrick1-17/+27
There's a lot of confusion around what tailscale status shows, so make it better: show region names, last write time, and put stars around DERP too if active. Now stars are always present if activity, and always somewhere.
2020-07-02smallzstd: new package that constructs zstd small encoders/decoders.David Anderson1-5/+2
It's just a config wrapper that passes "use less memory at the expense of compression" parameters by default, so that we don't accidentally construct resource-hungry (de)compressors. Also includes a benchmark that measures the memory cost of the small variants vs. the stock variants. The savings are significant on both compressors (~8x less memory) and decompressors (~1.4x less, not including the savings from the significantly smaller window on the compression side - with those savings included it's more like ~140x smaller). BenchmarkSmallEncoder-8 56174 19354 ns/op 31 B/op 0 allocs/op BenchmarkSmallEncoderWithBuild-8 2900 382940 ns/op 1746547 B/op 36 allocs/op BenchmarkStockEncoder-8 48921 25761 ns/op 286 B/op 0 allocs/op BenchmarkStockEncoderWithBuild-8 426 2630241 ns/op 13843842 B/op 124 allocs/op BenchmarkSmallDecoder-8 123814 9344 ns/op 0 B/op 0 allocs/op BenchmarkSmallDecoderWithBuild-8 41547 27455 ns/op 27694 B/op 31 allocs/op BenchmarkStockDecoder-8 129832 9417 ns/op 1 B/op 0 allocs/op BenchmarkStockDecoderWithBuild-8 25561 51751 ns/op 39607 B/op 92 allocs/op Signed-off-by: David Anderson <danderson@tailscale.com>
2020-06-29wgengine/magicsock: add new endpoint type used for discovery-supporting peersBrad Fitzpatrick1-3/+1
This adds a new magicsock endpoint type only used when both sides support discovery (that is, are advertising a discovery key). Otherwise the old code is used. So far the new code only communicates over DERP as proof that the new code paths are wired up. None of the actually discovery messaging is implemented yet. Support for discovery (generating and advertising a key) are still behind an environment variable for now. Updates #483
2020-06-25ipn, wgengine: plumb NetworkMap down to magicsockBrad Fitzpatrick1-0/+1
Now we can have magicsock make decisions based on tailcfg.Debug settings sent by the server. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-06-24ipn: add missing locking in LocalBackend.NetMapBrad Fitzpatrick1-0/+2
Looks like it's only used by tests.
2020-06-20ipn: put discovery key generation behind an environment flag for nowBrad Fitzpatrick1-3/+8
Later we'll want to use the presence of a discovery key as a signal that the node knows how to participate in discovery. Currently the code generates keys and sends them to the control server but doesn't do anything with them, which is a bad state to stay in lest we release this code and end up with nodes in the future that look like they're functional with the new discovery protocol but aren't. So for now, make this opt-in as a debug option for now, until the rest of it is in. Updates #483
2020-06-19ipn: fix race in enterStateDmytro Shynkevych1-1/+1
Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>
2020-06-19all: generate discovery key, plumb it aroundBrad Fitzpatrick1-0/+5
Not actually used yet. Updates #483
2020-06-18control/controlclient: make netmap generation use rate-limited logger.David Anderson1-1/+1
2020-06-15Fix concurrency issues in controlclient, ipn, types/logger (#456)Dmytro Shynkevych1-164/+182
Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>
2020-06-09wgengine/tsdns: add test and prevent useless updates (#449)Dmytro Shynkevych1-6/+20
Signed-Off-By: Dmytro Shynkevych <dmytro@tailscale.com>
2020-06-08tsdns: initial implementation of a Tailscale DNS resolver (#396)Dmytro Shynkevych1-0/+31
Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>
2020-06-03ipn/ipnserver: revert decoder memory limit.David Anderson1-1/+0
The zstd library treats that limit as a hard cap on decompressed size, in the mode we're using it, rather than a window size. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-06-02ipn: add Hostname override to PrefsElias Naur3-1/+19
Overriding the hostname is required for Android, where os.Hostname is often just "localhost". Updates #409 Signed-off-by: Elias Naur <mail@eliasnaur.com>
2020-05-31wgengine: don't pass nil router.Config objects.Avery Pennarun1-2/+2
These are hard for swift to decode in the iOS app. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-29ipn: restore LiveDERPs assignment in LocalBackend.parseWgStatusBrad Fitzpatrick1-0/+1
Updates #421 (likely fixes it; need to do an iOS build to be sure)
2020-05-28router_linux: use only baseline 'ip rule' features that exist in old kernels.Avery Pennarun1-6/+2
This removes the use of suppress_ifgroup and fwmark "x/y" notation, which are, among other things, not available in busybox and centos6. We also use the return codes from the 'ip' program instead of trying to parse its output. I also had to remove the previous hack that routed all of 100.64.0.0/10 by default, because that would add the /10 route into the 'main' route table instead of the new table 88, which is no good. It was a terrible hack anyway; if we wanted to capture that route, we should have captured it explicitly as a subnet route, not as part of the addr. Note however that this change affects all platforms, so hopefully there won't be any surprises elsewhere. Fixes #405 Updates #320, #144 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-27ipn: move e2e_test back to corp repo.David Anderson2-309/+17
It depends on corp things, so can't run here anyway. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-23all: make client use server-provided DERP map, add DERP region supportBrad Fitzpatrick1-2/+6
Instead of hard-coding the DERP map (except for cmd/tailscale netcheck for now), get it from the control server at runtime. And make the DERP map support multiple nodes per region with clients picking the first one that's available. (The server will balance the order presented to clients for load balancing) This deletes the stunner package, merging it into the netcheck package instead, to minimize all the config hooks that would've been required. Also fix some test flakes & races. Fixes #387 (Don't hard-code the DERP map) Updates #388 (Add DERP region support) Fixes #399 (wgengine: flaky tests) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-05-22wgengine/filter: implement a destination IP pre-filter.David Anderson1-12/+39
Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-21ipn: Resolve some resource leaks in test.Avery Pennarun3-10/+27
Updates tailscale/corp#255. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-21ipn/local: get rid of some straggling calls to the log module.Avery Pennarun1-4/+5
Use b.logf() instead. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-20ipnserver and logpolicy: configure zstd with low-memory settings.Avery Pennarun1-1/+5
The compressed blobs we send back and forth are small and infrequent, which doesn't justify the 8MB * GOMAXPROCS memory that was being allocated. This was the overwhelming majority of memory use in tailscaled. On my system it goes from ~100M RSS to ~15M RSS (which is still suspiciously high, but we can worry about that more later). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-19ipn: sprinkle documentation and clarity rewrites through LocalBackend.David Anderson2-82/+144
Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-15wgengine: log node IDs when peers are added/removed (#381)Wendi Yu2-8/+8
Also stop logging data sent/received from nodes we're not connected to (ie all those `x`s being logged in the `peers: ` line) Signed-off-by: Wendi <wendi.yu@yahoo.ca>
2020-05-14ipn: plumb NetfilterMode all the way out to the CLI.David Anderson3-38/+15
Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-14wgengine/router: support multiple levels of netfilter involvement.David Anderson3-20/+68
Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-13Add tstest.PanicOnLog(), and fix various problems detected by this.Avery Pennarun6-25/+54
If a test calls log.Printf, 'go test' horrifyingly rearranges the output to no longer be in chronological order, which makes debugging virtually impossible. Let's stop that from happening by making log.Printf panic if called from any module, no matter how deep, during tests. This required us to change the default error handler in at least one http.Server, as well as plumbing a bunch of logf functions around, especially in magicsock and wgengine, but also in logtail and backoff. To add insult to injury, 'go test' also rearranges the output when a parent test has multiple sub-tests (all the sub-test's t.Logf is always printed after all the parent tests t.Logf), so we need to screw around with a special Logf that can point at the "current" t (current_t.Logf) in some places. Probably our entire way of using subtests is wrong, since 'go test' would probably like to run them all in parallel if you called t.Parallel(), but it definitely can't because the're all manipulating the shared state created by the parent test. They should probably all be separate toplevel tests instead, with common setup/teardown logic. But that's a job for another time. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-13Merge remote-tracking branch 'origin/master' into baseAvery Pennarun1-1/+3
* origin/master: types/logger: add ArgWriter wgengine: wrap tun.Device to support filtering and packet injection (#358)
2020-05-13{ipn,control/controlclient}/tests: pass a logf function to control.New().Avery Pennarun1-1/+1
This matches the new API requirements. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-05-13wgengine: wrap tun.Device to support filtering and packet injection (#358)Dmytro Shynkevych1-1/+3
Right now, filtering and packet injection in wgengine depend on a patch to wireguard-go that probably isn't suitable for upstreaming. This need not be the case: wireguard-go/tun.Device is an interface. For example, faketun.go implements it to mock a TUN device for testing. This patch implements the same interface to provide filtering and packet injection at the tunnel device level, at which point the wireguard-go patch should no longer be necessary. This patch has the following performance impact on i7-7500U @ 2.70GHz, tested in the following namespace configuration: ┌────────────────┐ ┌─────────────────────────────────┐ ┌────────────────┐ │ $ns1 │ │ $ns0 │ │ $ns2 │ │ client0 │ │ tailcontrol, logcatcher │ │ client1 │ │ ┌─────┐ │ │ ┌──────┐ ┌──────┐ │ │ ┌─────┐ │ │ │vethc│───────┼────┼──│vethrc│ │vethrs│──────┼─────┼──│veths│ │ │ ├─────┴─────┐ │ │ ├──────┴────┐ ├──────┴────┐ │ │ ├─────┴─────┐ │ │ │10.0.0.2/24│ │ │ │10.0.0.1/24│ │10.0.1.1/24│ │ │ │10.0.1.2/24│ │ │ └───────────┘ │ │ └───────────┘ └───────────┘ │ │ └───────────┘ │ └────────────────┘ └─────────────────────────────────┘ └────────────────┘ Before: --------------------------------------------------- | TCP send | UDP send | |------------------------|------------------------| | 557.0 (±8.5) Mbits/sec | 3.03 (±0.02) Gbits/sec | --------------------------------------------------- After: --------------------------------------------------- | TCP send | UDP send | |------------------------|------------------------| | 544.8 (±1.6) Mbits/sec | 3.13 (±0.02) Gbits/sec | --------------------------------------------------- The impact on receive performance is similar. Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>
2020-05-12wgengine/router: rename config.Settings to config.Config, make pointer.David Anderson1-6/+6
Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-12wgengine: generate and plumb router.Settings in from ipn.David Anderson1-3/+58
This saves a layer of translation, and saves us having to pass in extra bits and pieces of the netmap and prefs to wgengine. Now it gets one Wireguard config, and one OS network stack config. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-05-12Reduce logspam from node with no peersWendi Yu1-1/+3
Signed-off-by: Wendi Yu <wendi.yu@yahoo.ca>
2020-05-11wgengine/router: add a setting to disable SNAT for subnet routes.David Anderson3-6/+27
Part of #320. Signed-off-by: David Anderson <danderson@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.