summaryrefslogtreecommitdiffhomepage
path: root/wgengine/netstack/netstack.go
AgeCommit message (Collapse)AuthorFilesLines
2023-04-10wgengine/netstack: fix data-race on startupJames Tucker1-2/+2
Running tailscaled with the race detector enabled immediately fires on this field, as it is updated after first read. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>
2023-03-30envknob,net/tstun,wgengine: use TS_DEBUG_MTU consistentlyJames Tucker1-3/+2
Noted on #5915 TS_DEBUG_MTU was not used consistently everywhere. Extract the default into a function that can apply this centrally and use it everywhere. Added envknob.Lookup{Int,Uint}Sized to make it easier to keep CodeQL happy when using converted values. Updates #5915 Signed-off-by: James Tucker <james@tailscale.com>
2023-03-28wgengine/netstack: do not send packets to netstack after closeJames Tucker1-0/+8
Use the local context on Impl to check for shut down state in order to drop rather than inject packets after close has begun. Netstack sets endpoint.dispatcher to nil during shutdown. After the recent adjustment in 920ec69241930c352818b0bf3eab20e62df93ed1 we now wait for netstack to fully shutdown before we release tests. This means that we may continue to accept packets and attempt to inject them, which we must prevent in order to avoid nil pointer panic. References google/gvisor#8765 Fixes #7715 Signed-off-by: James Tucker <james@tailscale.com>
2023-03-27tsnet,wgenegine/netstack: add test and fix resource leaksMaisem Ali1-0/+1
We were not closing the http.Server and were also not waiting for netstack to fully close. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-23net/tstun: rename filterIn/filterOut methods to be more descriptiveMaisem Ali1-2/+2
Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-07tsnet: only intercept TCP flows that have listenersMaisem Ali1-10/+25
Previously, it would accept all TCP connections and then close the ones it did not care about. Make it only ever accept the connections that it cares about. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-05wgengine/netstack: add support for custom UDP flow handlersBrad Fitzpatrick1-6/+33
To be used by tsnet and sniproxy later. Updates #5871 Updates #1748 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-02-01all: use Go 1.20's bytes.CloneBrad Fitzpatrick1-2/+3
Updates #7123 Updates #6257 (more to do in other repos) Change-Id: I073e2a6d81a5d7fbecc29caddb7e057ff65239d0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-01-27all: update copyright and license headersWill Norris1-3/+2
This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2022-12-23wgengine/netstack: change netstack API to require LocalBackendClaire Wang1-7/+5
The macOS client was forgetting to call netstack.Impl.SetLocalBackend. Change the API so that it can't be started without one, eliminating this class of bug. Then update all the callers. Updates #6764 Change-Id: I2b3a4f31fdfd9fdbbbbfe25a42db0c505373562f Signed-off-by: Claire Wang <claire@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-12-22wgengine/netstack: delete some dead code, old comment, use atomic int typesBrad Fitzpatrick1-10/+5
Noticed while looking at something else; #cleanup. Change-Id: Icde7749363014eab9bebe1dd80708f5491f933d1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-12-20go.mod, etc: bump gvisorandig1-12/+9
Fixes #6554 Change-Id: Ia04ae37a47b67fa57091c9bfe1d45a1842589aa8 Signed-off-by: andig <cpuidle@gmx.de>
2022-11-09ipn/ipnlocal: add start of handling TCP proxyingBrad Fitzpatrick1-4/+9
Updates tailscale/corp#7515 Change-Id: I82d19b5864674b2169f25ec8e429f60a543e0c57 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-08wgengine/netstack: optimize shouldProcessInbound, avoiding 4via6 lookupsBrad Fitzpatrick1-2/+2
All IPv6 packets for the self address were doing netip.Prefix.Contains lookups. If if we know they're for a self address (which we already previously computed and have sitting in a bool), then they can't be for a 4via6 range. Change-Id: Iaaaf1248cb3fecec229935a80548ead0eb4cb892 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-08ipn/ipnlocal, wgengine/netstack: start handling ports for future servingbradfitz/port_interceptBrad Fitzpatrick1-3/+10
Updates tailscale/corp#7515 Change-Id: I966e936e72a2ee99be8d0f5f16872b48cc150258 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-08wgengine/netstack: fix shouldProcessInbound peerapi non-SYN handlingBrad Fitzpatrick1-15/+15
It was eating TCP packets to peerapi ports to subnet routers. Some of the TCP flow's packets went onward, some got eaten. So some TCP flows to subnet routers, if they used an unfortunate TCP port number, got broken. Change-Id: Ifea036119ccfb081f4dfa18b892373416a5239f8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-02wgengine/netstack: remove old unused handleSSH hookBrad Fitzpatrick1-4/+0
It's leftover from an earlier Tailscale SSH wiring and I forgot to delete it apparently. Change-Id: I14f071f450e272b98d90080a71ce68ba459168d1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-31wgengine/netstack: use 72h as the KeepAlive Idle time for Tailscale SSHMaisem Ali1-4/+13
Setting TCP KeepAlives for Tailscale SSH connections results in them unnecessarily disconnecting. However, we can't turn them off completely as that would mean we start leaking sessions waiting for a peer to come back which may have gone away forever (e.g. if the node was deleted from the tailnet during a session). Updates #5021 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-25wgengine/netstack: enable TCP SACK (#6066)Jordan Whited1-0/+5
TCP selective acknowledgement can improve throughput by an order of magnitude in the presence of loss. Signed-off-by: Jordan Whited <jordan@tailscale.com>
2022-09-26all: fix resource leaks with missing .Close() callsEmmanuel T Odeke1-0/+3
Fixes #5706 Signed-off-by: Emmanuel T Odeke <emmanuel@orijtech.com>
2022-09-21wgengine/netstack: always respond to 4via6 echo requests (#5712)Andrew Dunham1-19/+35
As the comment in the code says, netstack should always respond to ICMP echo requests to a 4via6 address, even if the netstack instance isn't normally processing subnet traffic. Follow-up to #5709 Change-Id: I504d0776c5824071b2a2e0e687bc33e24f6c4746 Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-21wgengine/netstack: handle 4via6 packets when pinging (#5709)Andrew Dunham1-2/+43
Change-Id: Ib6ebbaa11219fb91b550ed7fc6ede61f83262e89 Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-15envknob: support changing envknobs post-initBrad Fitzpatrick1-9/+9
Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-06wgengine/netstack: only accept connection after dialing (#5503)Andrew Dunham1-34/+84
If we accept a forwarded TCP connection before dialing, we can erroneously signal to a client that we support IPv6 (or IPv4) without that actually being possible. Instead, we only complete the client's TCP handshake after we've dialed the outbound connection; if that fails, we respond with a RST. Updates #5425 (maybe fixes!) Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-08-04all: use syncs.AtomicValueMaisem Ali1-2/+2
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-08-02all: migrate code from netaddr.FromStdAddr to Go 1.18Brad Fitzpatrick1-4/+17
With caveat https://github.com/golang/go/issues/53607#issuecomment-1203466984 that then requires a new wrapper. But a simpler one at least. Updates #5162 Change-Id: I0a5265065bfcd7f21e8dd65b2bd74cae90d76090 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-02all: migrate more code code to net/netip directlyBrad Fitzpatrick1-3/+4
Instead of going through the tailscale.com/net/netaddr transitional wrappers. Updates #5162 Change-Id: I3dafd1c2effa1a6caa9b7151ecf6edd1a3fda3dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25all: convert more code to use net/netip directlyBrad Fitzpatrick1-24/+25
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25net/netaddr: start migrating to net/netip via new netaddr adapter packageBrad Fitzpatrick1-25/+25
Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-21go.mod: bump gvisor.dev/gvisorMaisem Ali1-6/+5
Pick up https://github.com/google/gvisor/pull/7787 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-06-28wgengine/netstack: close ipstack when netstack.Impl is closedkylecarbs1-0/+1
Fixes netstack.Impl leaking goroutines after shutdown. Signed-off-by: kylecarbs <kyle@carberry.com>
2022-06-02wgengine/netstack: replace a 1500 with a const + docBrad Fitzpatrick1-1/+6
Per post-submit code review feedback of 1336fb740b7f from @maisem. Change-Id: Ic5c16306cbdee1029518448642304981f77ea1fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-06-01wgengine/netstack: make netstack MTU be 1280 alsoBrad Fitzpatrick1-2/+2
Updates #3878 Change-Id: I1850085b32c8a40d85607b4ad433622c97d96a8d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-05-20wgengine/netstack: handle multiple magicDNS queries per UDP socket (#4708)Tom1-11/+26
Fixes: #4686 Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-05-06wgengine/netstack, ipn/ipnlocal: serve http://100.100.100.100/Brad Fitzpatrick1-0/+5
For future stuff. Change-Id: I64615b8b2ab50b57e4eef1ca66fa72e3458cb4a9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-05-05net/dns, wgengine: implement DNS over TCP (#4598)Tom1-0/+18
* net/dns, wgengine: implement DNS over TCP Signed-off-by: Tom DNetto <tom@tailscale.com> * wgengine/netstack: intercept only relevant port/protocols to quad-100 Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-05-04*: use WireGuard where logged, printed or namedJames Tucker1-1/+1
Signed-off-by: James Tucker <james@tailscale.com>
2022-04-30net/tstun,wgengine/{.,netstack}: handle UDP magicDNS traffic in netstackTom DNetto1-9/+119
This change wires netstack with a hook for traffic coming from the host into the tun, allowing interception and handling of traffic to quad-100. With this hook wired, magicDNS queries over UDP are now handled within netstack. The existing logic in wgengine to handle magicDNS remains for now, but its hook operates after the netstack hook so the netstack implementation takes precedence. This is done in case we need to support platforms with netstack longer than expected. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-04-30cmd/tailscaled,ipn/ipnlocal,wgengine/...: pass dns.Manager into netstackTom DNetto1-1/+4
Needed for a following commit which moves magicDNS handling into netstack. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-04-26wgengine/netstack: always set TCP keepaliveJames Tucker1-0/+15
Setting keepalive ensures that idle connections will eventually be closed. In userspace mode, any application configured TCP keepalive is effectively swallowed by the host kernel, and is not easy to detect. Failure to close connections when a peer tailscaled goes offline or restarts may result in an otherwise indefinite connection for any protocol endpoint that does not initiate new traffic. This patch does not take any new opinion on a sensible default for the keepalive timers, though as noted in the TODO, doing so likely deserves further consideration. Update #4522 Signed-off-by: James Tucker <james@tailscale.com>
2022-04-15ssh/tailssh: make the SSH server a singleton, register with LocalBackendBrad Fitzpatrick1-3/+2
Remove the weird netstack -> tailssh dependency and instead have tailssh register itself with ipnlocal when linked. This makes tailssh.server a singleton, so we can have a global map of all sessions. Updates #3802 Change-Id: Iad5caec3a26a33011796878ab66b8e7b49339f29 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-15tailcfg, ssh/tailssh: optionally support SSH public keys in wire policyBrad Fitzpatrick1-2/+0
And clean up logging. Updates #3802 Change-Id: I756dc2d579a16757537142283d791f1d0319f4f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-11net/tsaddr, wgengine/netstack: add IPv6 range that forwards to site-relative ↵Brad Fitzpatrick1-0/+14
IPv4 This defines a new magic IPv6 prefix, fd7a:115c:a1e0:b1a::/64, a subset of our existing /48, where the final 32 bits are an IPv4 address, and the middle 32 bits are a user-chosen "site ID". (which must currently be 0000:00xx; the top 3 bytes must be zero for now) e.g., I can say my home LAN's "site ID" is "0000:00bb" and then advertise its 10.2.0.0/16 IPv4 range via IPv6, like: tailscale up --advertise-routes=fd7a:115c:a1e0:b1a::bb:10.2.0.0/112 (112 being /128 minuse the /96 v6 prefix length) Then people in my tailnet can: $ curl '[fd7a:115c:a1e0:b1a::bb:10.2.0.230]' <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" .... Updates #3616, etc RELNOTE=initial support for TS IPv6 addresses to route v4 "via" specific nodes Change-Id: I9b49b6ad10410a24b5866b9fbc69d3cae1f600ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-07wgengine/netstack: disable refsvfs2 leak tracking (#4378)James Tucker1-0/+16
In addition an envknob (TS_DEBUG_NETSTACK_LEAK_MODE) now provides access to set leak tracking to more useful values. Fixes #4309 Signed-off-by: James Tucker <james@tailscale.com>
2022-03-26net/packet, wgengine/netstack: remove workaround for old gvisor ECN bugBrad Fitzpatrick1-1/+0
Fixes #2642 Change-Id: Ic02251d24a4109679645d1c8336e0f961d0cce13 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-21wgengine: inject packetbuffers rather than bytes (#4220)James Tucker1-8/+5
Plumb the outbound injection path to allow passing netstack PacketBuffers down to the tun Read, where they are decref'd to enable buffer re-use. This removes one packet alloc & copy, and reduces GC pressure by pooling outbound injected packets. Fixes #2741 Signed-off-by: James Tucker <james@tailscale.com>
2022-02-15ssh/tailssh: move SSH code from wgengine/netstack to this new packageBrad Fitzpatrick1-12/+11
Still largely incomplete, but in a better home now. Updates #3802 Change-Id: I46c5ffdeb12e306879af801b06266839157bc624 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-31ipn/ipnlocal, wgengine/netstack: use netstack for peerapi serverBrad Fitzpatrick1-3/+40
We're finding a bunch of host operating systems/firewalls interact poorly with peerapi. We either get ICMP errors from the host or users need to run commands to allow the peerapi port: https://github.com/tailscale/tailscale/issues/3842#issuecomment-1025133727 ... even though the peerapi should be an internal implementation detail. Rather than fight the host OS & firewalls, this change handles the server side of peerapi entirely in netstack (except on iOS), so it never makes its way to the host OS where it might be messed with. Two main downsides are: 1) netstack isn't as fast, but we don't really need speed for peerapi. And actually, with fewer trips to/from the kernel, we might actually make up for some of the netstack performance loss by staying in userspace. 2) tcpdump / Wireshark etc packet captures will no longer see the peerapi traffic. Oh well. Crawshaw's been wanting to add packet capture server support to tailscaled, so we'll probably do that sooner now. A future change might also then use peerapi for the client-side (except on iOS). Updates #3842 (probably fixes, as well as many exit node issues I bet) Change-Id: Ibc25edbb895dc083d1f07bd3cab614134705aa39 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-26go.mod: bump netstack, switch to upstream netstackBrad Fitzpatrick1-15/+14
Now that Go 1.17 has module graph pruning (https://go.dev/doc/go1.17#go-command), we should be able to use upstream netstack without breaking our private repo's build that then depends on the tailscale.com Go module. This is that experiment. Updates #1518 (the original bug to break out netstack to own module) Updates #2642 (this updates netstack, but doesn't remove workaround) Change-Id: I27a252c74a517053462e5250db09f379de8ac8ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-24wgengine/netstack: add an SSH server experimentBrad Fitzpatrick1-4/+41
Disabled by default. To use, run tailscaled with: TS_SSH_ALLOW_LOGIN=you@bar.com And enable with: $ TAILSCALE_USE_WIP_CODE=true tailscale up --ssh=true Then ssh [any-user]@[your-tailscale-ip] for a root bash shell. (both the "root" and "bash" part are temporary) Updates #3802 Change-Id: I268f8c3c95c8eed5f3231d712a5dc89615a406f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.