summaryrefslogtreecommitdiffhomepage
path: root/wgengine/netstack/netstack.go
AgeCommit message (Collapse)AuthorFilesLines
2022-09-21wgengine/netstack: always respond to 4via6 echo requests (#5712)Andrew Dunham1-19/+35
As the comment in the code says, netstack should always respond to ICMP echo requests to a 4via6 address, even if the netstack instance isn't normally processing subnet traffic. Follow-up to #5709 Change-Id: I504d0776c5824071b2a2e0e687bc33e24f6c4746 Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-21wgengine/netstack: handle 4via6 packets when pinging (#5709)Andrew Dunham1-2/+43
Change-Id: Ib6ebbaa11219fb91b550ed7fc6ede61f83262e89 Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-15envknob: support changing envknobs post-initBrad Fitzpatrick1-9/+9
Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-06wgengine/netstack: only accept connection after dialing (#5503)Andrew Dunham1-34/+84
If we accept a forwarded TCP connection before dialing, we can erroneously signal to a client that we support IPv6 (or IPv4) without that actually being possible. Instead, we only complete the client's TCP handshake after we've dialed the outbound connection; if that fails, we respond with a RST. Updates #5425 (maybe fixes!) Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-08-04all: use syncs.AtomicValueMaisem Ali1-2/+2
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-08-02all: migrate code from netaddr.FromStdAddr to Go 1.18Brad Fitzpatrick1-4/+17
With caveat https://github.com/golang/go/issues/53607#issuecomment-1203466984 that then requires a new wrapper. But a simpler one at least. Updates #5162 Change-Id: I0a5265065bfcd7f21e8dd65b2bd74cae90d76090 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-02all: migrate more code code to net/netip directlyBrad Fitzpatrick1-3/+4
Instead of going through the tailscale.com/net/netaddr transitional wrappers. Updates #5162 Change-Id: I3dafd1c2effa1a6caa9b7151ecf6edd1a3fda3dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25all: convert more code to use net/netip directlyBrad Fitzpatrick1-24/+25
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25net/netaddr: start migrating to net/netip via new netaddr adapter packageBrad Fitzpatrick1-25/+25
Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-21go.mod: bump gvisor.dev/gvisorMaisem Ali1-6/+5
Pick up https://github.com/google/gvisor/pull/7787 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-06-28wgengine/netstack: close ipstack when netstack.Impl is closedkylecarbs1-0/+1
Fixes netstack.Impl leaking goroutines after shutdown. Signed-off-by: kylecarbs <kyle@carberry.com>
2022-06-02wgengine/netstack: replace a 1500 with a const + docBrad Fitzpatrick1-1/+6
Per post-submit code review feedback of 1336fb740b7f from @maisem. Change-Id: Ic5c16306cbdee1029518448642304981f77ea1fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-06-01wgengine/netstack: make netstack MTU be 1280 alsoBrad Fitzpatrick1-2/+2
Updates #3878 Change-Id: I1850085b32c8a40d85607b4ad433622c97d96a8d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-05-20wgengine/netstack: handle multiple magicDNS queries per UDP socket (#4708)Tom1-11/+26
Fixes: #4686 Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-05-06wgengine/netstack, ipn/ipnlocal: serve http://100.100.100.100/Brad Fitzpatrick1-0/+5
For future stuff. Change-Id: I64615b8b2ab50b57e4eef1ca66fa72e3458cb4a9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-05-05net/dns, wgengine: implement DNS over TCP (#4598)Tom1-0/+18
* net/dns, wgengine: implement DNS over TCP Signed-off-by: Tom DNetto <tom@tailscale.com> * wgengine/netstack: intercept only relevant port/protocols to quad-100 Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-05-04*: use WireGuard where logged, printed or namedJames Tucker1-1/+1
Signed-off-by: James Tucker <james@tailscale.com>
2022-04-30net/tstun,wgengine/{.,netstack}: handle UDP magicDNS traffic in netstackTom DNetto1-9/+119
This change wires netstack with a hook for traffic coming from the host into the tun, allowing interception and handling of traffic to quad-100. With this hook wired, magicDNS queries over UDP are now handled within netstack. The existing logic in wgengine to handle magicDNS remains for now, but its hook operates after the netstack hook so the netstack implementation takes precedence. This is done in case we need to support platforms with netstack longer than expected. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-04-30cmd/tailscaled,ipn/ipnlocal,wgengine/...: pass dns.Manager into netstackTom DNetto1-1/+4
Needed for a following commit which moves magicDNS handling into netstack. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-04-26wgengine/netstack: always set TCP keepaliveJames Tucker1-0/+15
Setting keepalive ensures that idle connections will eventually be closed. In userspace mode, any application configured TCP keepalive is effectively swallowed by the host kernel, and is not easy to detect. Failure to close connections when a peer tailscaled goes offline or restarts may result in an otherwise indefinite connection for any protocol endpoint that does not initiate new traffic. This patch does not take any new opinion on a sensible default for the keepalive timers, though as noted in the TODO, doing so likely deserves further consideration. Update #4522 Signed-off-by: James Tucker <james@tailscale.com>
2022-04-15ssh/tailssh: make the SSH server a singleton, register with LocalBackendBrad Fitzpatrick1-3/+2
Remove the weird netstack -> tailssh dependency and instead have tailssh register itself with ipnlocal when linked. This makes tailssh.server a singleton, so we can have a global map of all sessions. Updates #3802 Change-Id: Iad5caec3a26a33011796878ab66b8e7b49339f29 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-15tailcfg, ssh/tailssh: optionally support SSH public keys in wire policyBrad Fitzpatrick1-2/+0
And clean up logging. Updates #3802 Change-Id: I756dc2d579a16757537142283d791f1d0319f4f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-11net/tsaddr, wgengine/netstack: add IPv6 range that forwards to site-relative ↵Brad Fitzpatrick1-0/+14
IPv4 This defines a new magic IPv6 prefix, fd7a:115c:a1e0:b1a::/64, a subset of our existing /48, where the final 32 bits are an IPv4 address, and the middle 32 bits are a user-chosen "site ID". (which must currently be 0000:00xx; the top 3 bytes must be zero for now) e.g., I can say my home LAN's "site ID" is "0000:00bb" and then advertise its 10.2.0.0/16 IPv4 range via IPv6, like: tailscale up --advertise-routes=fd7a:115c:a1e0:b1a::bb:10.2.0.0/112 (112 being /128 minuse the /96 v6 prefix length) Then people in my tailnet can: $ curl '[fd7a:115c:a1e0:b1a::bb:10.2.0.230]' <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" .... Updates #3616, etc RELNOTE=initial support for TS IPv6 addresses to route v4 "via" specific nodes Change-Id: I9b49b6ad10410a24b5866b9fbc69d3cae1f600ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-07wgengine/netstack: disable refsvfs2 leak tracking (#4378)James Tucker1-0/+16
In addition an envknob (TS_DEBUG_NETSTACK_LEAK_MODE) now provides access to set leak tracking to more useful values. Fixes #4309 Signed-off-by: James Tucker <james@tailscale.com>
2022-03-26net/packet, wgengine/netstack: remove workaround for old gvisor ECN bugBrad Fitzpatrick1-1/+0
Fixes #2642 Change-Id: Ic02251d24a4109679645d1c8336e0f961d0cce13 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-21wgengine: inject packetbuffers rather than bytes (#4220)James Tucker1-8/+5
Plumb the outbound injection path to allow passing netstack PacketBuffers down to the tun Read, where they are decref'd to enable buffer re-use. This removes one packet alloc & copy, and reduces GC pressure by pooling outbound injected packets. Fixes #2741 Signed-off-by: James Tucker <james@tailscale.com>
2022-02-15ssh/tailssh: move SSH code from wgengine/netstack to this new packageBrad Fitzpatrick1-12/+11
Still largely incomplete, but in a better home now. Updates #3802 Change-Id: I46c5ffdeb12e306879af801b06266839157bc624 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-31ipn/ipnlocal, wgengine/netstack: use netstack for peerapi serverBrad Fitzpatrick1-3/+40
We're finding a bunch of host operating systems/firewalls interact poorly with peerapi. We either get ICMP errors from the host or users need to run commands to allow the peerapi port: https://github.com/tailscale/tailscale/issues/3842#issuecomment-1025133727 ... even though the peerapi should be an internal implementation detail. Rather than fight the host OS & firewalls, this change handles the server side of peerapi entirely in netstack (except on iOS), so it never makes its way to the host OS where it might be messed with. Two main downsides are: 1) netstack isn't as fast, but we don't really need speed for peerapi. And actually, with fewer trips to/from the kernel, we might actually make up for some of the netstack performance loss by staying in userspace. 2) tcpdump / Wireshark etc packet captures will no longer see the peerapi traffic. Oh well. Crawshaw's been wanting to add packet capture server support to tailscaled, so we'll probably do that sooner now. A future change might also then use peerapi for the client-side (except on iOS). Updates #3842 (probably fixes, as well as many exit node issues I bet) Change-Id: Ibc25edbb895dc083d1f07bd3cab614134705aa39 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-26go.mod: bump netstack, switch to upstream netstackBrad Fitzpatrick1-15/+14
Now that Go 1.17 has module graph pruning (https://go.dev/doc/go1.17#go-command), we should be able to use upstream netstack without breaking our private repo's build that then depends on the tailscale.com Go module. This is that experiment. Updates #1518 (the original bug to break out netstack to own module) Updates #2642 (this updates netstack, but doesn't remove workaround) Change-Id: I27a252c74a517053462e5250db09f379de8ac8ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-24wgengine/netstack: add an SSH server experimentBrad Fitzpatrick1-4/+41
Disabled by default. To use, run tailscaled with: TS_SSH_ALLOW_LOGIN=you@bar.com And enable with: $ TAILSCALE_USE_WIP_CODE=true tailscale up --ssh=true Then ssh [any-user]@[your-tailscale-ip] for a root bash shell. (both the "root" and "bash" part are temporary) Updates #3802 Change-Id: I268f8c3c95c8eed5f3231d712a5dc89615a406f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-24envknob: add new package for all the strconv.ParseBool(os.Getenv(..))Brad Fitzpatrick1-1/+2
A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-19wgengine/netstack: clear TCP ECN bits before giving to gvisorBrad Fitzpatrick1-0/+1
Updates #2642 Change-Id: Ic219442a2656dd9dc99ae1dd91e907fd3d924987 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-19wgengine/netstack: add a missing refcount decrement after packet injectionBrad Fitzpatrick1-0/+1
Fixes #3762 Updates #3745 (probably fixes?) Change-Id: I1d3f0590fd5b8adfbc9110bc45ff717bb9e79aae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-19wgengine/netstack: add an Impl.Close method for testsBrad Fitzpatrick1-8/+20
Change-Id: Idbb3fd6d749d3e4effdf96de77a1106584822fef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-18wgengine/netstack: add missing error logging in a RST caseBrad Fitzpatrick1-2/+3
Updates #2642 Change-Id: I9f2f8fd28fc980208b0739eb9caf9db7b0977c09 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-18wgengine/netstack: fix netstack ping timeout on darwinBrad Fitzpatrick1-1/+14
-W is milliseconds on darwin, not seconds, and empirically it's milliseconds after a 1 second base. Change-Id: I2520619e6699d9c505d9645ce4dfee4973555227 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-12wgengine/netstack: make userspace ping work when tailscaled has CAP_NET_RAWBrad Fitzpatrick1-2/+19
Updates #3710 Change-Id: Ief56c7ac20f5f09a2f940a1906b9efbf1b0d6932 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-07wgengine/netstack: fake pings through netstack on Android tooBrad Fitzpatrick1-0/+6
Every OS ping binary is slightly different. Adjust for Android's. Updates #1738 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-06wgengine/netstack: add env knob to turn on netstack debug logsBrad Fitzpatrick1-3/+9
Except for the super verbose packet-level dumps. Keep those disabled by default with a const. Updates #2642 Change-Id: Ia9eae1677e8b3fe6f457a59e44896a335d95d547 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-12-16wgengine/netstack: don't remove 255.255.255.255/32 from netstackBrad Fitzpatrick1-1/+10
The intent of the updateIPs code is to add & remove IP addresses to netstack based on what we get from the netmap. But netstack itself adds 255.255.255.255/32 apparently and we always fight it (and it adds it back?). So stop fighting it. Updates #2642 (maybe fixes? maybe.) Change-Id: I37cb23f8e3f07a42a1a55a585689ca51c2be7c60 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-12-15ipn/ipnlocal: clear magicsock's netmap on logoutJosh Bleecher Snyder1-7/+9
magicsock was hanging onto its netmap on logout, which caused tailscale status to display partial information about a bunch of zombie peers. After logout, there should be no peers. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-12-15wgengine/netstack: remove some logging on forwarding connectionsBrad Fitzpatrick1-2/+6
Change-Id: Ib1165b918cd5da38583f8e7d4be8cda54af3c81d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-12-09wgengine/netstack: in netstack/hybrid mode, fake ICMP using ping commandBrad Fitzpatrick1-0/+61
Change-Id: I42cb4b9b326337f4090d9cea532230e36944b6cb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-12-03ipn/ipnlocal, net/tsdial: make SOCKS/HTTP dials use ExitDNSBrad Fitzpatrick1-16/+8
And simplify, unexport some tsdial/netstack stuff in the the process. Fixes #3475 Change-Id: I186a5a5cbd8958e25c075b4676f7f6e70f3ff76e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-12-02net/tsdial: give netstack a Dialer, start refactoring name resolutionBrad Fitzpatrick1-20/+9
This starts to refactor tsdial.Dialer's name resolution to have different stages: in-memory MagicDNS vs system resolution. A future change will plug in ExitDNS resolution. This also plumbs a Dialer into netstack and unexports the dnsMap internals. And it removes some of the async AddNetworkMapCallback usage and replaces it with synchronous updates of the Dialer's netmap from LocalBackend, since the LocalBackend has the Dialer too. Updates #3475 Change-Id: Idcb7b1169878c74f0522f5151031ccbc49fe4cb4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-30net/tsdial: start of new package to unify all outbound dialing complexityBrad Fitzpatrick1-95/+3
For now this just deletes the net/socks5/tssocks implementation (and the DNSMap stuff from wgengine/netstack) and moves it into net/tsdial. Then initialize a Dialer early in tailscaled, currently only use for the outbound and SOCKS5 proxies. It will be plumbed more later. Notably, it needs to get down into the DNS forwarder for exit node DNS forwading in netstack mode. But it will also absorb all the peerapi setsockopt and netns Dial and tlsdial complexity too. Updates #1713 Change-Id: Ibc6d56ae21a22655b2fa1002d8fc3f2b2ae8b6df Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-21go.mod: bump inet.af/netstackBrad Fitzpatrick1-9/+24
Updates #2642 (I'd hoped, but doesn't seem to fix it) Change-Id: Id54af7c90a1206bc7018215957e20e954782b911 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-01cmd/tailscaled, wgengine/netstack: always wire up netstackBrad Fitzpatrick1-16/+41
Even if not in use. We plan to use it for more stuff later. (not for iOS or macOS-GUIs yet; only tailscaled) Change-Id: Idaef719d2a009be6a39f158fd8f57f8cca68e0ee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-09-28wgengine/netstack: include DNS.ExtraRecords in DNSMapBrad Fitzpatrick1-0/+10
So SOCKS5 dialer can dial HTTPS cert names, for instance. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-08-27wgengine/netstack: clarify a commentBrad Fitzpatrick1-6/+8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.