summaryrefslogtreecommitdiffhomepage
path: root/net
AgeCommit message (Collapse)AuthorFilesLines
2021-05-16all: adapt to opaque netaddr typesJosh Bleecher Snyder12-92/+91
This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w*(.*)\.Port = (.*) -> $1 = $1.WithPort($2) \w*(.*)\.IP = (.*) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-05-10net/dns: don't use interfaces.Tailscale to find the tailscale interface index.David Anderson2-32/+21
interfaces.Tailscale only returns an interface if it has at least one Tailscale IP assigned to it. In the resolved DNS manager, when we're called upon to tear down DNS config, the interface no longer has IPs. Instead, look up the interface index on construction and reuse it throughout the daemon lifecycle. Fixes #1892. Signed-off-by: David Anderson <dave@natulte.net>
2021-05-10net/interface: remove darwin fetchRoutingTable workaroundBrad Fitzpatrick1-26/+2
Fixed upstream. Bump dep. Updates #1345 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-06Revert "net/dns: set IPv4 auto mode in NM, so it lets us set DNS."David Anderson1-22/+12
This reverts commit 7d16c8228bcf70a3b82afe994e8c5fa42057c5f3. I have no idea how I ended up here. The bug I was fixing with this change fails to reproduce on Ubuntu 18.04 now, and this change definitely does break 20.04, 20.10, and Debian Buster. So, until we can reliably reproduce the problem this was meant to fix, reverting. Part of #1875 Signed-off-by: David Anderson <dave@natulte.net>
2021-05-06net/dns: log the correct error when NM Reapply fails.David Anderson1-1/+1
Found while debugging #1870. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-05-06net/dns: set IPv4 auto mode in NM, so it lets us set DNS.David Anderson1-12/+22
Part of #1870. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-05-06net/dns: don't try to configure LLMNR or mdns in NetworkManager.David Anderson1-3/+6
Fixes #1870. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-05-06net/tstun: fix TUN log spam when ACLs drop a packetBrad Fitzpatrick2-9/+21
Whenever we dropped a packet due to ACLs, wireguard-go was logging: Failed to write packet to TUN device: packet dropped by filter Instead, just lie to wireguard-go and pretend everything is okay. Fixes #1229 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-05net/tsaddr: add NewContainsIPFunc (move from wgengine)Brad Fitzpatrick2-0/+76
I want to use this from netstack but it's not exported. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-05-04net/tstun: remove unnecessary break statementJosh Bleecher Snyder1-1/+0
Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-05-03tstest/integration: add testNode.AwaitListening, DERP+STUN, improve proxy trapBrad Fitzpatrick1-3/+3
Updates #1840
2021-04-29net/dns: add GOOS build tagsJosh Bleecher Snyder4-0/+8
Fixes #1786 Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-04-29net/dns: stop NetworkManager breaking v6 connectivity when setting DNS.David Anderson1-0/+20
Tentative fix for #1699 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-29net/interfaces: return all Tailscale addresses from Tailscale().David Anderson1-2/+6
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-27net/dns: on windows, skip site-local v6 resolvers.David Anderson1-15/+45
Further refinement for tailscale/corp#1662. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-26net/tstun: split TUN events channel into up/down and MTUJosh Bleecher Snyder1-1/+51
We had a long-standing bug in which our TUN events channel was being received from simultaneously in two places. The first is wireguard-go. At wgengine/userspace.go:366, we pass e.tundev to wireguard-go, which starts a goroutine (RoutineTUNEventReader) that receives from that channel and uses events to adjust the MTU and bring the device up/down. At wgengine/userspace.go:374, we launch a goroutine that receives from e.tundev, logs MTU changes, and triggers state updates when up/down changes occur. Events were getting delivered haphazardly between the two of them. We don't really want wireguard-go to receive the up/down events; we control the state of the device explicitly by calling device.Up. And the userspace.go loop MTU logging duplicates logging that wireguard-go does when it received MTU updates. So this change splits the single TUN events channel into up/down and other (aka MTU), and sends them to the parties that ought to receive them. I'm actually a bit surprised that this hasn't caused more visible trouble. If a down event went to wireguard-go but the subsequent up event went to userspace.go, we could end up with the wireguard-go device disappearing. I believe that this may also (somewhat accidentally) be a fix for #1790. Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2021-04-26net/dns: work around WSL DNS implementation flaws.David Anderson2-2/+29
Fixes tailscale/corp#1662 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-26wgengine/bench: speed test for channels, sockets, and wireguard-go.Avery Pennarun1-1/+1
This tries to generate traffic at a rate that will saturate the receiver, without overdoing it, even in the event of packet loss. It's unrealistically more aggressive than TCP (which will back off quickly in case of packet loss) but less silly than a blind test that just generates packets as fast as it can (which can cause all the CPU to be absorbed by the transmitter, giving an incorrect impression of how much capacity the total system has). Initial indications are that a syscall about every 10 packets (TCP bulk delivery) is roughly the same speed as sending every packet through a channel. A syscall per packet is about 5x-10x slower than that. The whole tailscale wireguard-go + magicsock + packet filter combination is about 4x slower again, which is better than I thought we'd do, but probably has room for improvement. Note that in "full" tailscale, there is also a tundev read/write for every packet, effectively doubling the syscall overhead per packet. Given these numbers, it seems like read/write syscalls are only 25-40% of the total CPU time used in tailscale proper, so we do have significant non-syscall optimization work to do too. Sample output: $ GOMAXPROCS=2 go test -bench . -benchtime 5s ./cmd/tailbench goos: linux goarch: amd64 pkg: tailscale.com/cmd/tailbench cpu: Intel(R) Core(TM) i7-4785T CPU @ 2.20GHz BenchmarkTrivialNoAlloc/32-2 56340248 93.85 ns/op 340.98 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivialNoAlloc/124-2 57527490 99.27 ns/op 1249.10 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivialNoAlloc/1024-2 52537773 111.3 ns/op 9200.39 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivial/32-2 41878063 135.6 ns/op 236.04 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivial/124-2 41270439 138.4 ns/op 896.02 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTrivial/1024-2 36337252 154.3 ns/op 6635.30 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkBlockingChannel/32-2 12171654 494.3 ns/op 64.74 MB/s 0 %lost 1791 B/op 0 allocs/op BenchmarkBlockingChannel/124-2 12149956 507.8 ns/op 244.17 MB/s 0 %lost 1792 B/op 1 allocs/op BenchmarkBlockingChannel/1024-2 11034754 528.8 ns/op 1936.42 MB/s 0 %lost 1792 B/op 1 allocs/op BenchmarkNonlockingChannel/32-2 8960622 2195 ns/op 14.58 MB/s 8.825 %lost 1792 B/op 1 allocs/op BenchmarkNonlockingChannel/124-2 3014614 2224 ns/op 55.75 MB/s 11.18 %lost 1792 B/op 1 allocs/op BenchmarkNonlockingChannel/1024-2 3234915 1688 ns/op 606.53 MB/s 3.765 %lost 1792 B/op 1 allocs/op BenchmarkDoubleChannel/32-2 8457559 764.1 ns/op 41.88 MB/s 5.945 %lost 1792 B/op 1 allocs/op BenchmarkDoubleChannel/124-2 5497726 1030 ns/op 120.38 MB/s 12.14 %lost 1792 B/op 1 allocs/op BenchmarkDoubleChannel/1024-2 7985656 1360 ns/op 752.86 MB/s 13.57 %lost 1792 B/op 1 allocs/op BenchmarkUDP/32-2 1652134 3695 ns/op 8.66 MB/s 0 %lost 176 B/op 3 allocs/op BenchmarkUDP/124-2 1621024 3765 ns/op 32.94 MB/s 0 %lost 176 B/op 3 allocs/op BenchmarkUDP/1024-2 1553750 3825 ns/op 267.72 MB/s 0 %lost 176 B/op 3 allocs/op BenchmarkTCP/32-2 11056336 503.2 ns/op 63.60 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTCP/124-2 11074869 533.7 ns/op 232.32 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkTCP/1024-2 8934968 671.4 ns/op 1525.20 MB/s 0 %lost 0 B/op 0 allocs/op BenchmarkWireGuardTest/32-2 1403702 4547 ns/op 7.04 MB/s 14.37 %lost 467 B/op 3 allocs/op BenchmarkWireGuardTest/124-2 780645 7927 ns/op 15.64 MB/s 1.537 %lost 420 B/op 3 allocs/op BenchmarkWireGuardTest/1024-2 512671 11791 ns/op 86.85 MB/s 0.5206 %lost 411 B/op 3 allocs/op PASS ok tailscale.com/wgengine/bench 195.724s Updates #414. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2021-04-23net/dns: work around new NetworkManager in other selection paths.David Anderson1-4/+24
Further bits of #1788 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-23net/dns: don't use NM+resolved for NM >=1.26.6.David Anderson1-1/+48
NetworkManager fixed the bug that forced us to use NetworkManager if it's programming systemd-resolved, and in the same release also made NetworkManager ignore DNS settings provided for unmanaged interfaces... Which breaks what we used to do. So, with versions 1.26.6 and above, we MUST NOT use NetworkManager to indirectly program systemd-resolved, but thankfully we can talk to resolved directly and get the right outcome. Fixes #1788 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-23net/interfaces: work around race fetching routing tableBrad Fitzpatrick2-2/+41
Fixes #1345 Updates golang/go#45736 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-22net/dns/resolver: remove unnecessary/racy WaitGroup.David Anderson1-17/+4
Fixes #1663 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-20net/dns: fix resolved match domains when no nameservers are provided.David Anderson1-1/+1
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-20net/dns: correctly capture all traffic in non-split configs.David Anderson1-2/+23
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-20net/dns: remove config in openresolv when given an empty DNS config.David Anderson1-6/+14
Part of #1720. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-20net/dns: make debian_resolvconf correctly clear DNS configs.David Anderson3-16/+33
More of #1720. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-20net/dns: restore resolv.conf when given an empty config in directManager.David Anderson1-5/+43
Fixes #1720. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-20net/dns: remove ForceSplitDNSForTesting.David Anderson1-17/+0
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-19net/tsaddr: expand ephemeral nodes range to /64Naman Sood1-2/+2
Signed-off-by: Naman Sood <mail@nsood.in>
2021-04-16net/tsaddr: add new IP range for ephemeral nodes in Tailscale ULA (#1715)Naman Sood1-0/+12
Signed-off-by: Naman Sood <mail@nsood.in>
2021-04-14net/dns: add debugging traces to DNS manager selection on linux.David Anderson2-2/+38
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-14net/dns: fix inverted test for NetworkManager.David Anderson1-1/+1
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-14net/dns: error out on linux if /etc/resolv.conf can't be read.David Anderson1-0/+3
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-14net/dns: fix freebsd DNS manager selection.David Anderson3-38/+46
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-14stun fuzzer: Small fixAdamKorcz1-1/+1
Signed-off-by: AdamKorcz <adam@adalogics.com>
2021-04-13net/dns: fix FreeBSD buildBrad Fitzpatrick1-0/+5
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-13net/dns: fix staticheck.David Anderson2-75/+0
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-13net/dns: implement correct manager detection on linux.David Anderson3-6/+189
Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-13net/dns: fix NM's GetBaseConfig when no configs exist.David Anderson1-0/+4
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-13net/dns: refactor dbus connection setup in resolved manager.David Anderson1-46/+25
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-12net/dns: return error from NewOSManager, use it to initialize NM.David Anderson13-47/+50
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-12net/dns: support split and unsplit DNS in NetworkManager.David Anderson1-2/+124
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-11net/dns: fix up NetworkManager configurator a bit.David Anderson1-26/+36
Clear LLMNR and mdns flags, update reasoning for our settings, and set our override priority harder than before when we want to be primary resolver. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-11net/dns: set resolved DefaultRoute setting according to split-dns mode.David Anderson1-0/+4
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-11net/dns: fix staticcheck errors.David Anderson2-13/+15
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-11net/dns: pacify staticcheck for nowBrad Fitzpatrick1-0/+1
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-11net/dns: support split DNS in systemd-resolved.David Anderson2-16/+73
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-11net/dns: improve NetworkManager detection, using more DBus.David Anderson2-7/+35
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-10net/dns: rename resolvconf.go to debian_resolvconf.go.David Anderson5-191/+185
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-04-10net/dns: also include 'tail' and 'base' files when fixing up resolv.conf.David Anderson1-0/+8
Signed-off-by: David Anderson <danderson@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.