summaryrefslogtreecommitdiffhomepage
path: root/net
AgeCommit message (Collapse)AuthorFilesLines
2025-06-19tstest/tlstest: simplify, don't even bake in any keysBrad Fitzpatrick1-8/+5
I earlier thought this saved a second of CPU even on a fast machine, but I think when I was previously measuring, I still had a 4096 bit RSA key being generated in the code I was measuring. Measuring again for this, it's plenty fast. Prep for using this package more, for derp, etc. Updates #16315 Change-Id: I4c9008efa9aa88a3d65409d6ffd7b3807f4d75e9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-06-18net/tlsdial: fix TLS cert validation of HTTPS proxiesBrad Fitzpatrick6-38/+145
If you had HTTPS_PROXY=https://some-valid-cert.example.com running a CONNECT proxy, we should've been able to do a TLS CONNECT request to e.g. controlplane.tailscale.com:443 through that, and I'm pretty sure it used to work, but refactorings and lack of integration tests made it regress. It probably regressed when we added the baked-in LetsEncrypt root cert validation fallback code, which was testing against the wrong hostname (the ultimate one, not the one which we were being asked to validate) Fixes #16222 Change-Id: If014e395f830e2f87f056f588edacad5c15e91bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-06-18net/*: remove Windows exceptions for when Resolver.PreferGo didn't workBrad Fitzpatrick3-17/+1
Resolver.PreferGo didn't used to work on Windows. It was fixed in 2022, though. (https://github.com/golang/go/issues/33097) Updates #5161 Change-Id: I4e1aeff220ebd6adc8a14f781664fa6a2068b48c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-06-16scripts/check_license_headers.sh: delete, rewrite as a Go testBrad Fitzpatrick1-0/+1
Updates tailscale/corp#29650 Change-Id: Iad4e4ccd9d68ebb1d1a12f335cc5295d0bd05b60 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-06-13net/packet: cleanup IPv4 fragment guardsJames Tucker4-10/+149
The first packet fragment guard had an additional guard clause that was incorrectly comparing a length in bytes to a length in octets, and was also comparing what should have been an entire IPv4 through transport header length to a subprotocol payload length. The subprotocol header size guards were otherwise protecting against short transport headers, as is the conservative non-first fragment minimum offset size. Add an explicit disallowing of fragmentation for TSMP for the avoidance of doubt. Updates #cleanup Updates #5727 Signed-off-by: James Tucker <james@tailscale.com>
2025-06-13net/netcheck: preserve live home DERP through packet lossJames Tucker2-14/+58
During a short period of packet loss, a TCP connection to the home DERP may be maintained. If no other regions emerge as winners, such as when all regions but one are avoided/disallowed as candidates, ensure that the current home region, if still active, is not dropped as the preferred region until it has failed two keepalives. Relatedly apply avoid and no measure no home to ICMP and HTTP checks as intended. Updates tailscale/corp#12894 Updates tailscale/corp#29491 Signed-off-by: James Tucker <james@tailscale.com>
2025-06-12feature/relayserver,net/{netcheck,udprelay}: implement addr discovery (#16253)Jordan Whited3-40/+168
The relay server now fetches IPs from local interfaces and external perspective IP:port's via netcheck (STUN). Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-05net/packet: fix Parsed docs (#16200)Jordan Whited1-3/+4
Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-29net/tshttpproxy: fix WDAP/PAC proxy detection on Win10 1607 and earlierNick Khyl1-8/+20
Using WINHTTP_AUTOPROXY_ALLOW_AUTOCONFIG on Windows versions older than Windows 10 1703 (build 15063) is not supported and causes WinHttpGetProxyForUrl to fail with ERROR_INVALID_PARAMETER. This results in failures reaching the control on environments where a proxy is required. We use wingoes version detection to conditionally set the WINHTTP_AUTOPROXY_ALLOW_AUTOCONFIG flag on Windows builds greater than 15063. While there, we also update proxy detection to use WINHTTP_AUTO_DETECT_TYPE_DNS_A, as DNS-based proxy discovery might be required with Active Directory and in certain other environments. Updates tailscale/corp#29168 Fixes #879 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-28net/dns: cache dns.Config for reuse when compileConfig fails (#16059)Jonathan Nobels4-61/+76
fixes tailscale/corp#25612 We now keep track of any dns configurations which we could not compile. This gives RecompileDNSConfig a configuration to attempt to recompile and apply when the OS pokes us to indicate that the interface dns servers have changed/updated. The manager config will remain unset until we have the required information to compile it correctly which should eliminate the problematic SERVFAIL responses (especially on macOS 15). This also removes the missingUpstreamRecovery func in the forwarder which is no longer required now that we have proper error handling and recovery manager and the client. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2025-05-19cmd/derper, net/tlsdial: fix client's self-signed cert validationBrad Fitzpatrick1-24/+34
This fixes the implementation and test from #15208 which apparently never worked. Ignore the metacert when counting the number of expected certs presented. And fix the test, pulling out the TLSConfig setup code into something shared between the real cmd/derper and the test. Fixes #15579 Change-Id: I90526e38e59f89b480629b415f00587b107de10a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-12net/dns,docs/windows/policy,util/syspolicy: register Tailscale IP addresses ↵Nick Khyl1-12/+71
in AD DNS if required by policy In this PR, we make DNS registration behavior configurable via the EnableDNSRegistration policy setting. We keep the default behavior unchanged, but allow admins to either enforce DNS registration and dynamic DNS updates for the Tailscale interface, or prevent Tailscale from modifying the settings configured in the network adapter's properties or by other means. Updates #14917 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-12net/udprelay{/endpoint}: move ServerEndpoint tests (#15949)Jordan Whited2-97/+110
Commit 0841477 moved ServerEndpoint to an independent package. Move its tests over as well. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-09net/tsdial: update (*Dialer).SetRoutes() to log the size of the resulting ↵Nick Khyl2-9/+8
bart.Table Updates #12027 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-09ipn/ipnlocal,net/dns/resolver: use the user dialer and routes for DNS ↵Nick Khyl1-11/+31
forwarding by default, except on iOS and Android In this PR, we make the "user-dial-routes" behavior default on all platforms except for iOS and Android. It can be disabled by setting the TS_DNS_FORWARD_USE_ROUTES envknob to 0 or false. Updates #12027 Updates #13837 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-09net/udprelay{/endpoint}, all: move ServerEndpoint to independent pkg (#15934)Jordan Whited3-67/+84
ServerEndpoint will be used within magicsock and potentially elsewhere, which should be possible without needing to import the server implementation itself. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-07all: remove non-applicable "linux" deps on AndroidBrad Fitzpatrick3-2/+4
Updates #12614 Change-Id: I0e2a18eca3515d3d6206c059110556d2bbbb0c5c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-07net/dns: don't link dbus, gonotify on AndroidBrad Fitzpatrick9-6/+12
Android is Linux, but doesn't use Linux DNS managers (or D-Bus). Updates #12614 Change-Id: I487802ac74a259cd5d2480ac26f7faa17ca8d1c3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-25net/portmapper: fix test flakes from logging after test doneBrad Fitzpatrick4-12/+15
Fixes #15794 Change-Id: Ic22aa99acb10fdb6dc5f0b6482e722e48237703c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-25net/udprelay: change Server.AllocateEndpoint existing alloc strategy (#15792)Jordan Whited2-35/+27
The previous strategy assumed clients maintained adequate state to understand the relationship between endpoint allocation and the server it was allocated on. magicsock will not have awareness of the server's disco key pre-allocation, it only understands peerAPI address at this point. The second client to allocate on the same server could trigger re-allocation, breaking a functional relay server endpoint. If magicsock needs to force reallocation we can add opt-in behaviors for this later. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-04-23net/portmapper: fix nil pointer dereference in Client.createMappingNick Khyl1-5/+7
The EventBus in net/portmapper.Config is still optional and Client.updates can be nil. Updates #15772 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-04-17net/udprelay: change ServerEndpoint time.Duration fields to ↵Jordan Whited2-6/+103
tstime.GoDuration (#15725) tstime.GoDuration JSON serializes with time.Duration.String(), which is more human-friendly than nanoseconds. ServerEndpoint is currently experimental, therefore breaking changes are tolerable. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-04-16net/netmon: publish events to event busDavid Anderson12-22/+92
Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-16net/portmapper: fire an event when a port mapping is updated (#15371)M. J. Fromberger5-49/+114
When an event bus is configured publish an event each time a new port mapping is updated. Publication is unconditional and occurs prior to calling any callback that is registered. For now, the callback is still fired in a separate goroutine as before -- later, those callbacks should become subscriptions to the published event. For now, the event type is defined as a new type here in the package. We will want to move it to a more central package when there are subscribers. The event wrapper is effectively a subset of the data exported by the internal mapping interface, but on a concrete struct so the bus plumbing can inspect it. Updates #15160 Change-Id: I951f212429ac791223af8d75b6eb39a0d2a0053a Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-16{wgengine,util/portmapper}: add and plumb an event bus (#15359)M. J. Fromberger1-0/+10
Updates #15160 Change-Id: I2510fb4a8905fb0abe8a8e0c5b81adb15d50a6f8 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-16portmapper: update NewClient to use a Config argumentM. J. Fromberger3-27/+45
In preparation for adding more parameters (and later, moving some away), rework the portmapper constructor to accept its arguments on a Config struct rather than positionally. This is a breaking change to the function signature, but one that is very easy to update, and a search of GitHub reveals only six instances of usage outside clones and forks of Tailscale itself, that are not direct copies of the code fixed up here. While we could stub in another constructor, I think it is safe to let those folks do the update in-place, since their usage is already affected by other changes we can't test for anyway. Updates #15160 Change-Id: I9f8a5e12b38885074c98894b7376039261b43f43 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-08net/{netx,memnet},all: add netx.DialFunc, move memnet Network implBrad Fitzpatrick5-85/+98
This adds netx.DialFunc, unifying a type we have a bazillion other places, giving it now a nice short name that's clickable in editors, etc. That highlighted that my earlier move (03b47a55c7956) of stuff from nettest into netx moved too much: it also dragged along the memnet impl, meaning all users of netx.DialFunc who just wanted netx for the type definition were instead also pulling in all of memnet. So move the memnet implementation netx.Network into memnet, a package we already had. Then use netx.DialFunc in a bunch of places. I'm sure I missed some. And plenty remain in other repos, to be updated later. Updates tailscale/corp#27636 Change-Id: I7296cd4591218e8624e214f8c70dab05fb884e95 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-08tstest/nettest: pull the non-test Network abstraction out to netx packageBrad Fitzpatrick1-0/+120
We want to be able to use the netx.Network (and RealNetwork implemementation) outside of tests, without linking "testing". So split out the non-test stuff of nettest into its own package. We tend to use "foox" as the convention for things we wish were in the standard library's foo package, so "netx" seems consistent. Updates tailscale/corp#27636 Change-Id: I1911d361f4fbdf189837bf629a20f2ebfa863c44 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-07nettest, *: add option to run HTTP tests with in-memory networkBrad Fitzpatrick1-4/+18
To avoid ephemeral port / TIME_WAIT exhaustion with high --count values, and to eventually detect leaked connections in tests. (Later the memory network will register a Cleanup on the TB to verify that everything's been shut down) Updates tailscale/corp#27636 Change-Id: Id06f1ae750d8719c5a75d871654574a8226d2733 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-03net/tstun: don't try to set link attributes on androidDavid Anderson2-1/+3
Android >= 14 forbids the use of netlink sockets. Fixes #9836 Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-03net/routetable: don't try to fetch the route table on androidDavid Anderson2-2/+2
Android >=14 forbids the use of netlink sockets, and in some configurations can kill apps that try. Fixes #9836 Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-02all: use network less when running in v86 emulatorBrad Fitzpatrick1-1/+15
Updates #5794 Change-Id: I1d8b005a1696835c9062545f87b7bab643cfc44d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02net/dns: add Plan 9 supportBrad Fitzpatrick4-2/+269
This requires the rsc/plan9 ndb DNS changes for now: https://9fans.topicbox.com/groups/9fans/T9c9d81b5801a0820/ndb-suffix-specific-dns-changes https://github.com/rsc/plan9/commit/e8c148ff092a5780d04aa2fd4a07a5732207b698 https://github.com/rsc/plan9/commit/1d0642ae493bf5ce798a6aa64a745bc6316baa11 Updates #5794 Change-Id: I0e242c1fe7bb4404e23604e03a31f89f0d18e70d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02net/netcheck: avoid ICMP unimplemented log spam on Plan 9Brad Fitzpatrick1-0/+4
Updates #5794 Change-Id: Ia6b2429d57b79770e4c278f011504f726136db5b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02net/tsdial: tolerate empty default route on Plan 9Brad Fitzpatrick1-1/+1
Otherwise this was repeated closing control/derp connections all the time on netmon changes. Arguably we should do this on all platforms? Updates #5794 Change-Id: If6bbeff554235f188bab2a40ab75e08dd14746b2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02net/netmon: disable time jump monitoring on Plan 9Brad Fitzpatrick1-1/+1
Updates #5794 Change-Id: I0f96383dea2ad017988d300df723ce906debb007 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02net/tstun: add Plan 9 'tun' supportBrad Fitzpatrick2-2/+38
Updates #5794 Change-Id: I8c466cae25ae79be1097450a63e8c25c7b519331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-31net/udprelay: start of UDP relay server implementation (#15480)Jordan Whited2-0/+736
This commit implements an experimental UDP relay server. The UDP relay server leverages the Disco protocol for a 3-way handshake between client and server, along with 3 new Disco message types for said handshake. These new Disco message types are also considered experimental, and are not yet tied to a capver. The server expects, and imposes, a Geneve (Generic Network Virtualization Encapsulation) header immediately following the underlay UDP header. Geneve protocol field values have been defined for Disco and WireGuard. The Geneve control bit must be set for the handshake between client and server, and unset for messages relayed between clients through the server. Updates tailscale/corp#27101 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-03-31net/netmon: always remember ifState as old state, even on minor changesBrad Fitzpatrick1-1/+1
Otherwise you can get stuck finding minor ones nonstop. Fixes #15484 Change-Id: I7f98ac338c0b32ec1b9fdc47d053207b5fc1bf23 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-31net/netcheck: use NoMeasureNoHome in another spotBrad Fitzpatrick1-1/+4
It only affected js/wasm and tamago. Updates tailscale/corp#24697 Change-Id: I8fd29323ed9b663fe3fd8d4a86f26ff584a3e134 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-27net/dns: add debug envknob to enable dual stack MagicDNSBrad Fitzpatrick2-5/+24
Updates #15404 Change-Id: Ic754cc54113b1660b7071b40babb9d3c0e25b2e1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-24net/netmon: use Monitor's tsIfName if set by SetTailscaleInterfaceNameBrad Fitzpatrick3-8/+10
Currently nobody calls SetTailscaleInterfaceName yet, so this is a no-op. I checked oss, android, and the macOS/iOS client. Nobody calls this, or ever did. But I want to in the future. Updates #15408 Updates #9040 Change-Id: I05dfabe505174f9067b929e91c6e0d8bc42628d7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-24net/netmon: unexport GetStateBrad Fitzpatrick3-3/+3
Baby step towards #15408. Updates #15408 Change-Id: I11fca6e677af2ad2f065d83aa0d83550143bff29 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-19net/dns: expose a function for recompiling the DNS configuration (#15346)Jonathan Nobels1-8/+28
updates tailscale/corp#27145 We require a means to trigger a recompilation of the DNS configuration to pick up new nameservers for platforms where we blend the interface nameservers from the OS into our DNS config. Notably, on Darwin, the only API we have at our disposal will, in rare instances, return a transient error when querying the interface nameservers on a link change if they have not been set when we get the AF_ROUTE messages for the link update. There's a corresponding change in corp for Darwin clients, to track the interface namservers during NEPathMonitor events, and call this when the nameservers change. This will also fix the slightly more obscure bug of changing nameservers while tailscaled is running. That change can now be reflected in magicDNS without having to stop the client. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2025-03-13net/packet: implement Geneve header serialization (#15301)Jordan Whited2-0/+136
Updates tailscale/corp#27100 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-03-12net/netmon, wgengine/magicsock: be quieter with portmapper logsAndrew Dunham2-0/+120
This adds a new helper to the netmon package that allows us to rate-limit log messages, so that they only print once per (major) LinkChange event. We then use this when constructing the portmapper, so that we don't keep spamming logs forever on the same network. Updates #13145 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6e7162509148abea674f96efd76be9dffb373ae4
2025-03-07tailcfg: add DERPRegion.NoMeasureNoHome, deprecate+document Avoid [cap 115]Brad Fitzpatrick3-5/+9
Fixes tailscale/corp#24697 Change-Id: Ib81994b5ded3dc87a1eef079eb268906a2acb3f8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-07net/portmapper: retry UPnP when we get an "Invalid Args"Andrew Dunham2-2/+110
We previously retried getting a UPnP mapping when the device returned error code 725, "OnlyPermanentLeasesSupported". However, we've seen devices in the wild also return 402, "Invalid Args", when given a lease duration. Fall back to the no-duration mapping method in these cases. Updates #15223 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6a25007c9eeac0dac83750dd3ae9bfcc287c8fcf
2025-03-07cmd/derper, derp/derphttp: support, generate self-signed IP address certsBrad Fitzpatrick1-0/+41
For people who can't use LetsEncrypt because it's banned. Per https://github.com/tailscale/tailscale/issues/11776#issuecomment-2520955317 This does two things: 1) if you run derper with --certmode=manual and --hostname=$IP_ADDRESS we previously permitted, but now we also: * auto-generate the self-signed cert for you if it doesn't yet exist on disk * print out the derpmap configuration you need to use that self-signed cert 2) teaches derp/derphttp's derp dialer to verify the signature of self-signed TLS certs, if so declared in the existing DERPNode.CertName field, which previously existed for domain fronting, separating out the dial hostname from how certs are validates, so it's not overloaded much; that's what it was meant for. Fixes #11776 Change-Id: Ie72d12f209416bb7e8325fe0838cd2c66342c5cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-02-19various: disable MPTCP when setting TCP_USER_TIMEOUT sockopt (#15063)Andrew Lytvynov1-2/+7
There's nothing about it on https://github.com/multipath-tcp/mptcp_net-next/issues/ but empirically MPTCP doesn't support this option on awly's kernel 6.13.2 and in GitHub actions. Updates #15015 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.