summaryrefslogtreecommitdiffhomepage
path: root/ipn
AgeCommit message (Collapse)AuthorFilesLines
2021-08-06types/dnstype: introduce new package for ResolverDavid Crawshaw1-2/+3
So the type can be used in net/dns without introducing a tailcfg dependency. For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-08-05all: gofmt with Go 1.17Josh Bleecher Snyder1-0/+1
This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-08-04ipn/ipnstate: move tailscale status "active" determination to tailscaledBrad Fitzpatrick1-6/+13
Fixes #2579 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-29ipnlocal: allow access to guest VMs/containers while using an exit nodeDavid Crawshaw1-7/+48
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-07-29wgengine/magicsock: use mono.TimeJosh Bleecher Snyder1-3/+4
magicsock makes multiple calls to Now per packet. Move to mono.Now. Changing some of the calls to use package mono has a cascading effect, causing non-per-packet call sites to also switch. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-07-28ipn/ipnlocal: add URL to IP forwarding error messageBrad Fitzpatrick1-3/+4
Updates #606 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-26ipn/ipnlocal: populate Hostinfo.Package on AndroidBrad Fitzpatrick1-0/+12
Fixes tailscale/corp#2266 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-20util/deephash: make hash type opaqueJoe Tsai1-2/+2
The fact that Hash returns a [sha256.Size]byte leaks details about the underlying hash implementation. This could very well be any other hashing algorithm with a possible different block size. Abstract this implementation detail away by declaring an opaque type that is comparable. While we are changing the signature of UpdateHash, rename it to just Update to reduce stutter (e.g., deephash.Update). Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2021-07-19ipn/ipnlocal: fix 'tailscale up' on Windows without GUIBrad Fitzpatrick1-2/+2
With this, I can now: * install Tailscale * stop the GUI * net stop Tailscale * net start Tailscale * tailscale up --unattended (where the middle three steps simulate what would happen on a Windows Server Core machine without a GUI) Fixes #2137 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-17ipn/ipnlocal: make state_test catch the bug fixed by #2445Avery Pennarun1-13/+40
Updates #2434 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-07-17ipn/ipnlocal: stay out of map poll when downBrad Fitzpatrick2-32/+31
Fixes #2434 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-13ipn/localapi: fix inability to receive taildrop files w/ escaped namesBrad Fitzpatrick1-1/+1
The localapi was double-unescaping: once by net/http populating the URL, and once by ourselves later. We need to start with the raw escaped URL if we're doing it ourselves. Started to write a test but it got invasive. Will have to add those tests later in a commit that's not being cherry-picked to a release branch. Fixes #2288 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-13ipn/ipnlocal: save prefs to disk on UpdatePrefsBrad Fitzpatrick1-0/+6
Regression from 6d10655dc3887f1a161015514a8555c175802b4d, which added UpdatePrefs but didn't write it out to disk. I'd planned on adding tests to state_test.go which is why I'd earlier added 46896a93118d0eecbacb4255da2df0349da9b409 to prepare for making such persistence tests easier to write, but turns out state_test.go didn't even test UpdatePrefs, so I'm staying out of there. Instead, this is tested using integration tests. Fixes #2321 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-13ipn: another controlplane synonymDavid Crawshaw2-2/+18
This one doesn't bother me so much, as long term we want a synonym here. Fixes #2384 Fixes #2386 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-07-12ipn/ipnlocal: start to test whether all state transitions save prefs to diskBrad Fitzpatrick1-1/+32
Updates #2321 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-11ipn: remove an unnecessary lazy map init on read pathBrad Fitzpatrick1-3/+0
It's okay to read from a nil map. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-06ipnlocal: move log line inside if statementDavid Crawshaw1-1/+1
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-07-02util/deephash: move internal/deephash to util/deephashBrad Fitzpatrick1-1/+1
No code changes. Just a minor package doc addition about lack of API stability.
2021-07-01ipn/ipnlocal: fix data raceJosh Bleecher Snyder1-1/+1
We can't access b.netMap without holding b.mu. We already grabbed it earlier in the function with the lock held. Introduced in Nov 2020 in 7ea809897df1764ea420be2ff6ae58459b0e6902. Discovered during stress testing. Apparently it's a pretty rare? Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-06-29wgengine/router_windows: support toggling local lan access when usingMaisem Ali1-1/+1
exit nodes. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-06-28cmd/tailscale: make netcheck use active DERP map, delete static copyjulianknodt2-0/+23
After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>
2021-06-28ipn, etc: use controlplane.tailscale.comDavid Crawshaw2-6/+6
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-23net/dns{,/resolver}: refactor DNS forwarder, send out of right link on macOS/iOSBrad Fitzpatrick1-34/+5
Fixes #2224 Fixes tailscale/corp#2045 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-23wgengine: randomize client port if netmap says toDavid Crawshaw1-3/+3
For testing out #2187 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-18staticcheck.conf: turn off noisy lint errorsDavid Crawshaw3-7/+1
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-16tailcfg: add DNSConfig.ExtraRecordsBrad Fitzpatrick1-0/+19
Updates #1748 Updates #1235 Updates #2055 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-16ipn/ipnlocal: support exit node local access switching on darwin.Maisem Ali1-1/+1
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-06-15tailcfg: add DNSConfig.CertDomainsBrad Fitzpatrick2-0/+8
Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-14ipn/ipnlocal: retry peerapi listen on Android, like we do on WindowsBrad Fitzpatrick1-4/+10
Updates #1960 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-10cmd/tailscale/web: add support for QNAPMaisem Ali1-38/+20
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-06-07ipn/{ipnlocal,localapi}, control/controlclient: add SetDNS localapiBrad Fitzpatrick3-0/+61
Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-03ipn/ipnlocal: avoid initPeerAPIListener crash on certain concurrent actionsBrad Fitzpatrick1-0/+9
We were crashing on in initPeerAPIListener when called from authReconfig when b.netMap is nil. But authReconfig already returns before the call to initPeerAPIListener when b.netMap is nil, but it releases the b.mu mutex before calling initPeerAPIListener which reacquires it and assumes it's still nil. The only thing that can be setting it to nil is setNetMapLocked, which is called by ResetForClientDisconnect, Logout/logout, or Start, all of which can happen during an authReconfig. So be more defensive. Fixes #1996 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-03net/{interfaces,netns}: change which build tag means mac/ios Network/System ↵Brad Fitzpatrick1-1/+1
Extension We used to use "redo" for that, but it was pretty vague. Also, fix the build tags broken in interfaces_default_route_test.go from a9745a0b684bb92ccb1965709adea6e9a98c0cd6, moving those Linux-specific tests to interfaces_linux_test.go. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-02go.mod: update netaddrBrad Fitzpatrick1-4/+5
Involves minor IPSetBuilder.Set API change. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-31ipnlocal: in Start() fast path, don't forget to send Prefs.Avery Pennarun2-4/+2
The resulting empty Prefs had AllowSingleHosts=false and Routeall=false, so that on iOS if you did these steps: - Login and leave running - Terminate the frontend - Restart the frontend (fast path restart, missing prefs) - Set WantRunning=false - Set WantRunning=true ...then you would have Tailscale running, but with no routes. You would also accidentally disable the ExitNodeID/IP prefs (symptom: the current exit node setting didn't appear in the UI), but since nothing else worked either, you probably didn't notice. The fix was easy enough. It turns out we already knew about the problem, so this also fixes one of the BUG entries in state_test. Fixes: #1918 (BUG-1) and some as-yet-unreported bugs with exit nodes. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-05-31ipnlocal: don't assume NeedsLogin immediately after StartLogout().Avery Pennarun2-12/+23
Previously, there was no server round trip required to log out, so when you asked ipnlocal to Logout(), it could clear the netmap immediately and switch to NeedsLogin state. In v1.8, we added a true Logout operation. ipn.Logout() would trigger an async cc.StartLogout() and *also* immediately switch to NeedsLogin. Unfortunately, some frontends would see NeedsLogin and immediately trigger a new StartInteractiveLogin() operation, before the controlclient auth state machine actually acted on the Logout command, thus accidentally invalidating the entire logout operation, retaining the netmap, and violating the user's expectations. Instead, add a new LogoutFinished signal from controlclient (paralleling LoginFinished) and, upon starting a logout, don't update the ipn state machine until it's received. Updates: #1918 (BUG-2) Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-05-27ipn/ipnlocal: ignore NetfilterMode pref on SynologyBrad Fitzpatrick1-0/+7
On clean installs we didn't set use iptables, but during upgrades it looks like we could use old prefs that directed us to go into the iptables paths that might fail on Synology. Updates #1995 Fixes tailscale/tailscale-synology#57 (I think) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-24paths: generalize IOSSharedDir to cover AndroidElias Naur1-3/+4
Also fix an error message while here. Signed-off-by: Elias Naur <mail@eliasnaur.com>
2021-05-20ipn/ipnlocal: initialize DNS config maps unconditionally.David Anderson1-5/+4
Fixes #1963. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-05-19ipn: allow b to be nil in NewBackendServerDavid Crawshaw2-1/+17
A couple of code paths in ipnserver use a NewBackendServer with a nil backend just to call the callback with an encapsulated error message. This covers a panic case seen in logs. For #1920 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-05-18net/dns: replace AuthoritativeSuffixes with nil Route entries.David Anderson1-4/+3
This leads to a cleaner separation of intent vs. implementation (Routes is now the only place specifying who handles DNS requests), and allows for cleaner expression of a configuration that creates MagicDNS records without serving them to the OS. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-05-18net/dns: always offer MagicDNS records at 100.100.100.100.David Anderson1-30/+38
Fixes #1886. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-05-16all: adapt to opaque netaddr typesJosh Bleecher Snyder4-39/+33
This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-05-12ipnlocal: fix switching users while logged in + Stopped.Avery Pennarun2-72/+125
This code path is very tricky since it was originally designed for the "re-authenticate to refresh my keys" use case, which didn't want to lose the original session even if the refresh cycle failed. This is why it acts differently from the Logout(); Login(); case. Maybe that's too fancy, considering that it probably never quite worked at all, for switching between users without logging out first. But it works now. This was more invasive than I hoped, but the necessary fixes actually removed several other suspicious BUG: lines from state_test.go, so I'm pretty confident this is a significant net improvement. Fixes tailscale/corp#1756. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-05-12ipnlocal: fix deadlock in RequestEngineStatusAndWait() error path.Avery Pennarun1-0/+8
If the engine was shutting down from a previous session (e.closing=true), it would return an error code when trying to get status. In that case, ipnlocal would never unblock any callers that were waiting on the status. Not sure if this ever happened in real life, but I accidentally triggered it while writing a test. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-05-11internal/deephash: rename from deepprintBrad Fitzpatrick1-2/+2
Yes, it printed, but that was an implementation detail for hashing. And coming optimization will make it print even less. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-10ipn{,/ipnserver}: delay JSON marshaling of ipn.NotifiesBrad Fitzpatrick3-20/+51
If nobody is connected to the IPN bus, don't burn CPU & waste allocations (causing more GC) by encoding netmaps for nobody. This will notably help hello.ipn.dev. Updates tailscale/corp#1773 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-07ipn/{ipnlocal,ipnstate}: add PeerStatus.ID stable ID to status --json outputBrad Fitzpatrick2-0/+8
Needed for the "up checker" to map back from exit node stable IDs (the ipn.Prefs.ExitNodeID) back to an IP address in error messages. But also previously requested so people can use it to then make API calls. The upcoming "tailscale admin" subcommand will probably need it too. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-05types/logger: add key grinder stats lines to rate-limiting exemption listJosh Bleecher Snyder1-6/+27
Updates #1749 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-05-04ipnlocal: accept a new opts.UpdatePrefs field.Avery Pennarun3-1/+44
This is needed because the original opts.Prefs field was at some point subverted for use in frontend->backend state migration for backward compatibility on some platforms. We still need that feature, but we also need the feature of providing the full set of prefs from `tailscale up`, *not* including overwriting the prefs.Persist keys, so we can't use the original field from `tailscale up`. `tailscale up` had attempted to compensate for that by doing SetPrefs() before Start(), but that violates the ipn.Backend contract, which says you should call Start() before anything else (that's why it's called Start()). As a result, doing SetPrefs({ControlURL=..., WantRunning=true}) would cause a connection to the *previous* control server (because WantRunning=true), and then connect to the *new* control server only after running Start(). This problem may have been avoided before, but only by pure luck. It turned out to be relatively harmless since the connection to the old control server was immediately closed and replaced anyway, but it created a race condition that could have caused spurious notifications or rejected keys if the server responded quickly. As already covered by existing TODOs, a better fix would be to have Start() get out of the business of state migration altogether. But we're approaching a release so I want to make the minimum possible fix. Fixes #1840. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.