summaryrefslogtreecommitdiffhomepage
path: root/wgengine/netstack/netstack.go
AgeCommit message (Collapse)AuthorFilesLines
2024-02-26wgengine/netstack: add debug page for TCP forwarderandrew/netstack-forwarder-debugAndrew Dunham1-0/+35
To help in debugging issues with subnet routers in userspace mode–for example, hitting the max inflight limit. Updates tailscale/corp#12184 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Idd922f4ae37695f6598a914c2d050574755ef309
2024-02-25all: remove LenIter, use Go 1.22 range-over-int insteadBrad Fitzpatrick1-2/+2
Updates #11058 Updates golang/go#65685 Change-Id: Ibb216b346e511d486271ab3d84e4546c521e4e22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-02-12tailfs: listen for local clients only on 100.100.100.100Percy Wegmann1-2/+2
FileSystemForLocal was listening on the node's Tailscale address, which potentially exposes the user's view of TailFS shares to other Tailnet users. Remote nodes should connect to exported shares via the peerapi. This removes that code so that FileSystemForLocal is only avaialable on 100.100.100.100:8080. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-02-09tailfs: disable TailFSForLocal via policyPercy Wegmann1-0/+4
Adds support for node attribute tailfs:access. If this attribute is not present, Tailscale will not accept connections to the local TailFS server at 100.100.100.100:8080. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-02-09tailfs: clean up naming and package structurePercy Wegmann1-8/+8
- Restyles tailfs -> tailFS - Defines interfaces for main TailFS types - Moves implemenatation of TailFS into tailfsimpl package Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-02-09tailfs: initial implementationPercy Wegmann1-25/+39
Add a WebDAV-based folder sharing mechanism that is exposed to local clients at 100.100.100.100:8080 and to remote peers via a new peerapi endpoint at /v0/tailfs. Add the ability to manage folder sharing via the new 'share' CLI sub-command. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-01-19go.mod,wgengine/netstack: bump gvisorJames Tucker1-3/+3
Updates #8043 Signed-off-by: James Tucker <james@tailscale.com>
2024-01-19wgengine/netstack: expose gVisor metrics through expvarAndrew Dunham1-0/+151
When tailscaled is run with "-debug 127.0.0.1:12345", these metrics are available at: http://localhost:12345/debug/metrics Updates #8210 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I19db6c445ac1f8344df2bc1066a3d9c9030606f8
2023-11-28wgengine/netstack: disable RACK on Windows (#10402)Jordan Whited1-0/+11
Updates #9707 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2023-11-01wgengine/netstack: standardize var names in UpdateNetstackIPsMaisem Ali1-31/+37
Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-11-01wgengine/netstack: remove unnecessary map in UpdateNetstackIPsMaisem Ali1-6/+4
Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-11-01wgengine/netstack: use netip.Prefix as map keysMaisem Ali1-20/+19
Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-23wgengine/netstack: only add addresses to correct protocolsJames Tucker1-2/+6
Prior to an earlier netstack bump this code used a string conversion path to cover multiple cases of behavior seemingly checking for unspecified addresses, adding unspecified addresses to v6. The behavior is now crashy in netstack, as it is enforcing address length in various areas of the API, one in particular being address removal. As netstack is now protocol specific, we must not create invalid protocol addresses - an address is v4 or v6, and the address value contained inside must match. If a control path attempts to do something otherwise it is now logged and skipped rather than incorrect addressing being added. Fixes tailscale/corp#15377 Signed-off-by: James Tucker <james@tailscale.com>
2023-09-28wgengine/netstack: refactor address construction and conversionAndrea Barisani1-18/+14
Updates #9252 Updates #9253 Signed-off-by: Andrea Barisani <andrea@inversepath.com> Signed-off-by: James Tucker <james@tailscale.com>
2023-09-28go.mod,*: bump gvisorAndrea Barisani1-21/+18
Updates #9253 Signed-off-by: Andrea Barisani <andrea@inversepath.com> Signed-off-by: James Tucker <james@tailscale.com>
2023-09-26wgengine,net,ipn,disco: split up and define different types of MTUVal1-6/+9
Prepare for path MTU discovery by splitting up the concept of DefaultMTU() into the concepts of the Tailscale TUN MTU, MTUs of underlying network interfaces, minimum "safe" TUN MTU, user configured TUN MTU, probed path MTU to a peer, and maximum probed MTU. Add a set of likely MTUs to probe. Updates #311 Signed-off-by: Val <valerie@tailscale.com>
2023-09-26wgengine/netstack: use buffer pools for UDP packet forwardingVal1-5/+17
Use buffer pools for UDP packet forwarding to prepare for increasing the forwarded UDP packet size for peer path MTU discovery. Updates #311 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Val <valerie@tailscale.com>
2023-09-25net/dns: retry forwarder requests over TCPAndrew Dunham1-1/+1
We weren't correctly retrying truncated requests to an upstream DNS server with TCP. Instead, we'd return a truncated request to the user, even if the user was querying us over TCP and thus able to handle a large response. Also, add an envknob and controlknob to allow users/us to disable this behaviour if it turns out to be buggy (✨ DNS ✨). Updates #9264 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ifb04b563839a9614c0ba03e9c564e8924c1a2bfd
2023-09-22Revert "wgengine/netstack: use buffer pools for UDP packet forwarding"Val1-17/+5
This reverts commit fb2f3e474134302ac01b2d5a41da32883d0e1e97. Signed-off-by: Val <valerie@tailscale.com>
2023-09-22Revert "wgengine,net,ipn,disco: split up and define different types of MTU"Val1-9/+6
This reverts commit 059051c58a3ceb3dcc046a04d5e6631abd72188b. Signed-off-by: Val <valerie@tailscale.com>
2023-09-22wgengine,net,ipn,disco: split up and define different types of MTUVal1-6/+9
Prepare for path MTU discovery by splitting up the concept of DefaultMTU() into the concepts of the Tailscale TUN MTU, MTUs of underlying network interfaces, minimum "safe" TUN MTU, user configured TUN MTU, probed path MTU to a peer, and maximum probed MTU. Add a set of likely MTUs to probe. Updates #311 Signed-off-by: Val <valerie@tailscale.com>
2023-09-22wgengine/netstack: use buffer pools for UDP packet forwardingVal1-5/+17
Use buffer pools for UDP packet forwarding to prepare for increasing the forwarded UDP packet size for peer path MTU discovery. Updates #311 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Val <valerie@tailscale.com>
2023-09-18types/netmap: remove NetworkMap.{Addresses,MachineStatus}Brad Fitzpatrick1-3/+3
And convert all callers over to the methods that check SelfNode. Now we don't have multiple ways to express things in tests (setting fields on SelfNode vs NetworkMap, sometimes inconsistently) and don't have multiple ways to check those two fields (often only checking one or the other). Updates #9443 Change-Id: I2d7ba1cf6556142d219fae2be6f484f528756e3c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-09-17wgengine, proxymap: split out port mapping from Engine to new typeBrad Fitzpatrick1-5/+11
(Continuing quest to remove rando stuff from the "Engine") Updates #cleanup Change-Id: I77f39902c2194410c10c054b545d70c9744250b0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-09-12wgengine{,/netstack}: remove AddNetworkMapCallback from Engine interfaceBrad Fitzpatrick1-8/+19
It had exactly one user: netstack. Just have LocalBackend notify netstack when here's a new netmap instead, simplifying the bloated Engine interface that has grown a bunch of non-Engine-y things. (plenty of rando stuff remains after this, but it's a start) Updates #cleanup Change-Id: I45e10ab48119e962fc4967a95167656e35b141d8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-21types/netmap, all: make NetworkMap.SelfNode a tailcfg.NodeViewBrad Fitzpatrick1-3/+5
Updates #1909 Change-Id: I8c470cbc147129a652c1d58eac9b790691b87606 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-06-12ipn/ipnlocal,wgengine/netstack: move LocalBackend specifc serving logic to ↵Maisem Ali1-52/+8
LocalBackend The netstack code had a bunch of logic to figure out if the LocalBackend should handle an incoming connection and then would call the function directly on LocalBackend. Move that logic to LocalBackend and refactor the methods to return conn handlers. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-06-12wgengine/netstack: increase maxInFlightConnectionAttemptsDenton Gentry1-1/+1
Address reports of subnet router instability when running in `--tun=userspace-networking` mode. Fixes https://github.com/tailscale/corp/issues/12184 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2023-05-28wgengine/netstack: use ping6 on BSD platformsDenton Gentry1-2/+12
Various BSD-derived operating systems including macOS and FreeBSD require that ping6 be used for IPv6 destinations. The "ping" command does not understand an IPv6 destination. FreeBSD 13.x and later do handle IPv6 in the regular ping command, but also retain a ping6 command. We use ping6 on all versions of FreeBSD. Fixes https://github.com/tailscale/tailscale/issues/8225 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2023-04-10wgengine/netstack: fix data-race on startupJames Tucker1-2/+2
Running tailscaled with the race detector enabled immediately fires on this field, as it is updated after first read. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>
2023-03-30envknob,net/tstun,wgengine: use TS_DEBUG_MTU consistentlyJames Tucker1-3/+2
Noted on #5915 TS_DEBUG_MTU was not used consistently everywhere. Extract the default into a function that can apply this centrally and use it everywhere. Added envknob.Lookup{Int,Uint}Sized to make it easier to keep CodeQL happy when using converted values. Updates #5915 Signed-off-by: James Tucker <james@tailscale.com>
2023-03-28wgengine/netstack: do not send packets to netstack after closeJames Tucker1-0/+8
Use the local context on Impl to check for shut down state in order to drop rather than inject packets after close has begun. Netstack sets endpoint.dispatcher to nil during shutdown. After the recent adjustment in 920ec69241930c352818b0bf3eab20e62df93ed1 we now wait for netstack to fully shutdown before we release tests. This means that we may continue to accept packets and attempt to inject them, which we must prevent in order to avoid nil pointer panic. References google/gvisor#8765 Fixes #7715 Signed-off-by: James Tucker <james@tailscale.com>
2023-03-27tsnet,wgenegine/netstack: add test and fix resource leaksMaisem Ali1-0/+1
We were not closing the http.Server and were also not waiting for netstack to fully close. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-23net/tstun: rename filterIn/filterOut methods to be more descriptiveMaisem Ali1-2/+2
Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-07tsnet: only intercept TCP flows that have listenersMaisem Ali1-10/+25
Previously, it would accept all TCP connections and then close the ones it did not care about. Make it only ever accept the connections that it cares about. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-05wgengine/netstack: add support for custom UDP flow handlersBrad Fitzpatrick1-6/+33
To be used by tsnet and sniproxy later. Updates #5871 Updates #1748 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-02-01all: use Go 1.20's bytes.CloneBrad Fitzpatrick1-2/+3
Updates #7123 Updates #6257 (more to do in other repos) Change-Id: I073e2a6d81a5d7fbecc29caddb7e057ff65239d0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-01-27all: update copyright and license headersWill Norris1-3/+2
This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2022-12-23wgengine/netstack: change netstack API to require LocalBackendClaire Wang1-7/+5
The macOS client was forgetting to call netstack.Impl.SetLocalBackend. Change the API so that it can't be started without one, eliminating this class of bug. Then update all the callers. Updates #6764 Change-Id: I2b3a4f31fdfd9fdbbbbfe25a42db0c505373562f Signed-off-by: Claire Wang <claire@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-12-22wgengine/netstack: delete some dead code, old comment, use atomic int typesBrad Fitzpatrick1-10/+5
Noticed while looking at something else; #cleanup. Change-Id: Icde7749363014eab9bebe1dd80708f5491f933d1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-12-20go.mod, etc: bump gvisorandig1-12/+9
Fixes #6554 Change-Id: Ia04ae37a47b67fa57091c9bfe1d45a1842589aa8 Signed-off-by: andig <cpuidle@gmx.de>
2022-11-09ipn/ipnlocal: add start of handling TCP proxyingBrad Fitzpatrick1-4/+9
Updates tailscale/corp#7515 Change-Id: I82d19b5864674b2169f25ec8e429f60a543e0c57 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-08wgengine/netstack: optimize shouldProcessInbound, avoiding 4via6 lookupsBrad Fitzpatrick1-2/+2
All IPv6 packets for the self address were doing netip.Prefix.Contains lookups. If if we know they're for a self address (which we already previously computed and have sitting in a bool), then they can't be for a 4via6 range. Change-Id: Iaaaf1248cb3fecec229935a80548ead0eb4cb892 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-08ipn/ipnlocal, wgengine/netstack: start handling ports for future servingbradfitz/port_interceptBrad Fitzpatrick1-3/+10
Updates tailscale/corp#7515 Change-Id: I966e936e72a2ee99be8d0f5f16872b48cc150258 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-08wgengine/netstack: fix shouldProcessInbound peerapi non-SYN handlingBrad Fitzpatrick1-15/+15
It was eating TCP packets to peerapi ports to subnet routers. Some of the TCP flow's packets went onward, some got eaten. So some TCP flows to subnet routers, if they used an unfortunate TCP port number, got broken. Change-Id: Ifea036119ccfb081f4dfa18b892373416a5239f8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-02wgengine/netstack: remove old unused handleSSH hookBrad Fitzpatrick1-4/+0
It's leftover from an earlier Tailscale SSH wiring and I forgot to delete it apparently. Change-Id: I14f071f450e272b98d90080a71ce68ba459168d1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-31wgengine/netstack: use 72h as the KeepAlive Idle time for Tailscale SSHMaisem Ali1-4/+13
Setting TCP KeepAlives for Tailscale SSH connections results in them unnecessarily disconnecting. However, we can't turn them off completely as that would mean we start leaking sessions waiting for a peer to come back which may have gone away forever (e.g. if the node was deleted from the tailnet during a session). Updates #5021 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-25wgengine/netstack: enable TCP SACK (#6066)Jordan Whited1-0/+5
TCP selective acknowledgement can improve throughput by an order of magnitude in the presence of loss. Signed-off-by: Jordan Whited <jordan@tailscale.com>
2022-09-26all: fix resource leaks with missing .Close() callsEmmanuel T Odeke1-0/+3
Fixes #5706 Signed-off-by: Emmanuel T Odeke <emmanuel@orijtech.com>
2022-09-21wgengine/netstack: always respond to 4via6 echo requests (#5712)Andrew Dunham1-19/+35
As the comment in the code says, netstack should always respond to ICMP echo requests to a 4via6 address, even if the netstack instance isn't normally processing subnet traffic. Follow-up to #5709 Change-Id: I504d0776c5824071b2a2e0e687bc33e24f6c4746 Signed-off-by: Andrew Dunham <andrew@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.