summaryrefslogtreecommitdiffhomepage
path: root/wgengine
AgeCommit message (Collapse)AuthorFilesLines
2025-06-19Revert "types/netmap,wgengine/magicsock: propagate CapVer to ↵Jordan Whited1-4/+0
magicsock.endpoint (#16244)" (#16322) This reverts commit 6a93b17c8cafc1d8e1c52e133511e52ed9086355. The reverted commit added more complexity than it was worth at the current stage. Handling delta CapVer changes requires extensive changes to relayManager datastructures in order to also support delta updates of relay servers. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-18ipn/ipnlocal,wgengine{/magicsock}: replace SetNetworkMap with eventbus (#16299)Jordan Whited3-99/+125
Same with UpdateNetmapDelta. Updates tailscale/corp#27502 Updates #15160 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-16ipn/ipnlocal,wgengine/magicsock: use eventbus for node & filter updates (#16271)Jordan Whited1-11/+54
nodeBackend now publishes filter and node changes to eventbus topics that are consumed by magicsock.Conn Updates tailscale/corp#27502 Updates tailscale/corp#29543 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-10types/netmap,wgengine/magicsock: propagate CapVer to magicsock.endpoint (#16244)Jordan Whited2-0/+11
This enables us to mark nodes as relay capable or not. We don't actually do that yet, as we haven't established a relay CapVer. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-09wgengine/magicsock: don't cancel in-progress relayManager work (#16233)Jordan Whited1-32/+30
It might complete, interrupting it reduces the chances of establishing a relay path. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-09wgengine/relaymanager: don't start runLoop() on init() (#16231)Jordan Whited1-1/+1
This is simply for consistency with relayManagerInputEvent(), which should be the sole launcher of runLoop(). Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-09wgengine/magicsock: enable setting relay epAddr's as bestAddr (#16229)Jordan Whited5-61/+212
relayManager can now hand endpoint a relay epAddr for it to consider as bestAddr. endpoint and Conn disco ping/pong handling are now VNI-aware. Updates tailscale/corp#27502 Updates tailscale/corp#29422 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-06wgengine/magicsock: make endpoint.bestAddr Geneve-aware (#16195)Jordan Whited14-386/+604
This commit adds a new type to magicsock, epAddr, which largely ends up replacing netip.AddrPort in packet I/O paths throughout, enabling Geneve encapsulation over UDP awareness. The conn.ReceiveFunc for UDP has been revamped to fix and more clearly distinguish the different classes of packets we expect to receive: naked STUN binding messages, naked disco, naked WireGuard, Geneve-encapsulated disco, and Geneve-encapsulated WireGuard. Prior to this commit, STUN matching logic in the RX path could swallow a naked WireGuard packet if the keypair index, which is randomly generated, happened to overlap with a subset of the STUN magic cookie. Updates tailscale/corp#27502 Updates tailscale/corp#29326 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-06wgengine/magicsock: fix bpf fragmentation jump offsets (#16204)Claus Lensbøl2-2/+78
Fragmented datagrams would be processed instead of being dumped right away. In reality, thse datagrams would be dropped anyway later so there should functionally not be any change. Additionally, the feature is off by default. Closes #16203 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2025-06-02go.mod,wgengine/magicsock: update wireguard-go (#16148)Jordan Whited8-32/+40
Our conn.Bind implementation is updated to make Send() offset-aware for future VXLAN/Geneve encapsulation support. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-28wgengine/magicsock: implement relayManager endpoint probing (#16029)Jordan Whited4-126/+215
relayManager is responsible for disco ping/pong probing of relay endpoints once a handshake is complete. Future work will enable relayManager to set a relay endpoint as the best UDP path on an endpoint if appropriate. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-20wgengine/magicsock: fix outdated heartbeat comment (#16023)Jordan Whited1-1/+1
heartbeatInterval is currently 3s. Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-19wgengine/magicsock: introduce virtualNetworkID type (#16021)Jordan Whited4-14/+100
This type improves code clarity and reduces the chance of heap alloc as we pass it as a non-pointer. VNI being a 3-byte value enables us to track set vs unset via the reserved/unused byte. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-19wgengine/magicsock: fix pong handling 'EndpointChange' reporting (#16018)Jordan Whited1-4/+4
Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-16wgengine/magicsock: add missing logf arg (#15995)Jordan Whited1-1/+1
Also, add the short version of the node key in parens to match existing patterns. Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-16wgengine/magicsock: implement relayManager handshaking (#15977)Jordan Whited4-55/+393
CallMeMaybeVia reception and endpoint allocation have been collapsed to a single event channel. discoInfo caching for active relay handshakes is now implemented. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-12ipn/ipnlocal,wgengine: move (*tsdial.Dialer).SetRoutes() calls from ↵Nick Khyl1-0/+11
LocalBackend to userspaceEngine This avoids reconfiguring the dialer unless the router config has changed. Updates #12027 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-12util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896)Irbe Krumina1-0/+8
Add new rules to update DNAT rules for Kubernetes operator's HA ingress where it's expected that rules will be added/removed frequently (so we don't want to keep old rules around or rewrite existing rules unnecessarily): - allow deleting DNAT rules using metadata lookup - allow inserting DNAT rules if they don't already exist (using metadata lookup) Updates tailscale/tailscale#15895 Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: chaosinthecrd <tom@tmlabs.co.uk>
2025-05-09wgengine/magicsock: re-shape relayManager to use an event loop (#15935)Jordan Whited4-20/+300
The event loop removes the need for growing locking complexities and synchronization. Now we simply use channels. The event loop only runs while there is active work to do. relayManager remains no-op inside magicsock for the time being. endpoints are never 'relayCapable' and therefore endpoint & Conn will not feed CallMeMaybeVia or allocation events into it. A number of relayManager events remain unimplemented, e.g. CallMeMaybeVia reception and relay handshaking. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-02wgengine/magicsock: shape relayManager and CallMeMaybeVia handling (#15864)Jordan Whited2-26/+93
relayManager will eventually be responsible for handling the allocation and handshaking of UDP relay server endpoints. relay servers are endpoint-independent, and Conn must already maintain handshake state for all endpoints. This justifies a new data structure to fill these roles. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-02wgengine/magicsock: implement more relay handshake disco handling (#15856)Jordan Whited1-16/+55
Conn.handleDiscoMessage() now makes a distinction between relay handshake disco messages and peer disco messages. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-04-30wgengine/magicsock: fix discoInfo leak (#15845)Jordan Whited1-20/+27
Conn.sendDiscoMessage() now verifies if the destination disco key is associated with any known peer(s) in a thread-safe manner. Updates #15844 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-04-30wgengine/magicsock: start to make disco reception Geneve aware (#15832)Jordan Whited2-11/+215
Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-04-28wgengine/magicsock: support Geneve-encap'd Disco transmission (#15811)Jordan Whited2-6/+43
Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-04-16wgengine/magicsock: subscribe to portmapper updatesM. J. Fromberger1-1/+30
When an event bus is plumbed in, use it to subscribe and react to port mapping updates instead of using the client's callback mechanism. For now, the callback remains available as a fallback when an event bus is not provided. Updates #15160 Change-Id: I026adca44bf6187692ee87ae8ec02641c12f7774 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-16net/netmon: publish events to event busDavid Anderson7-12/+50
Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-16all: update the tsd.System constructor name (#15372)M. J. Fromberger3-6/+6
Replace NewSystemWithEventBus with plain NewSystem, and update all usage. See https://github.com/tailscale/tailscale/pull/15355#discussion_r2003910766 Updates #15160 Change-Id: I64d337f09576b41d9ad78eba301a74b9a9d6ebf4 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-16{wgengine,util/portmapper}: add and plumb an event bus (#15359)M. J. Fromberger2-2/+14
Updates #15160 Change-Id: I2510fb4a8905fb0abe8a8e0c5b81adb15d50a6f8 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-16portmapper: update NewClient to use a Config argumentM. J. Fromberger1-1/+7
In preparation for adding more parameters (and later, moving some away), rework the portmapper constructor to accept its arguments on a Config struct rather than positionally. This is a breaking change to the function signature, but one that is very easy to update, and a search of GitHub reveals only six instances of usage outside clones and forks of Tailscale itself, that are not direct copies of the code fixed up here. While we could stub in another constructor, I think it is safe to let those folks do the update in-place, since their usage is already affected by other changes we can't test for anyway. Updates #15160 Change-Id: I9f8a5e12b38885074c98894b7376039261b43f43 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-16wgengine: plumb an event bus into the userspace engineM. J. Fromberger4-5/+20
Updates #15160 Change-Id: Ia695ccdddd09cd950de22abd000d4c531d6bf3c8 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-16all: construct new System values with an event bus pre-populatedM. J. Fromberger2-2/+2
Although, at the moment, we do not yet require an event bus to be present, as we start to add more pieces we will want to ensure it is always available. Add a new constructor and replace existing uses of new(tsd.System) throughout. Update generated files for import changes. Updates #15160 Change-Id: Ie5460985571ade87b8eac8b416948c7f49f0f64b Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-14wgengine/netstack: revert cubic cc to reno cc (#15677)Jordan Whited1-3/+8
Updates google/gvisor#11632 Updates tailscale/corp#27717 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-04-10Revert "ipn/ipnstate: add home DERP to tailscale status JSON"Brad Fitzpatrick1-8/+4
This reverts commit 476a4c6ff174d46ce3b125c018c07c43713e1c10. Reason: redundant with `tailscale status --json | jq '.Self.Relay'` which we all forgot about. Whoops. Updates #15625
2025-04-10ipn/ipnstate: add home DERP to tailscale status JSONBrad Fitzpatrick1-4/+8
Fixes #15625 Change-Id: Ic20dad2dab4ac52c666057845bdc3cf5c0ffcd8f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-08net/{netx,memnet},all: add netx.DialFunc, move memnet Network implBrad Fitzpatrick2-3/+5
This adds netx.DialFunc, unifying a type we have a bazillion other places, giving it now a nice short name that's clickable in editors, etc. That highlighted that my earlier move (03b47a55c7956) of stuff from nettest into netx moved too much: it also dragged along the memnet impl, meaning all users of netx.DialFunc who just wanted netx for the type definition were instead also pulling in all of memnet. So move the memnet implementation netx.Network into memnet, a package we already had. Then use netx.DialFunc in a bunch of places. I'm sure I missed some. And plenty remain in other repos, to be updated later. Updates tailscale/corp#27636 Change-Id: I7296cd4591218e8624e214f8c70dab05fb884e95 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-03wgengine/router: default to a fake router on androidDavid Anderson2-0/+31
The regular android app constructs its own wgengine with additional FFI shims, so this default codepath only affects other handcrafted buids like tsnet, which do not let the caller customize the innards of wgengine. Android >=14 forbids the use of netlink sockets, which makes the standard linux router fail to initialize. Fixes #9836 Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-02all: use network less when running in v86 emulatorBrad Fitzpatrick1-2/+4
Updates #5794 Change-Id: I1d8b005a1696835c9062545f87b7bab643cfc44d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02wgengine/router: add Plan 9 implementationBrad Fitzpatrick2-1/+157
Updates #5794 Change-Id: Ib78a3ea971a2374d405b024ab88658ec34be59a6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02wgengine/magicsock: avoid some log spam on Plan 9Brad Fitzpatrick1-0/+4
Updates #5794 Change-Id: I12e8417ebd553f9951690c388fbe42228f8c9097 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02net/tstun: add Plan 9 'tun' supportBrad Fitzpatrick1-0/+11
Updates #5794 Change-Id: I8c466cae25ae79be1097450a63e8c25c7b519331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-01wgengine: return explicit lo0 for loopback addrs on sandboxed macOS (#15493)Jonathan Nobels1-0/+6
fixes tailscale/corp#27506 The source address link selection on sandboxed macOS doesn't deal with loopback addresses correctly. This adds an explicit check to ensure we return the loopback interface for loopback addresses instead of the default empty interface. Specifically, this allows the dns resolver to route queries to a loopback IP which is a common tactic for local DNS proxies. Tested on both macos, macsys and tailscaled. Forwarded requests to 127/8 all bound to lo0. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2025-03-12net/netmon, wgengine/magicsock: be quieter with portmapper logsAndrew Dunham1-1/+11
This adds a new helper to the netmon package that allows us to rate-limit log messages, so that they only print once per (major) LinkChange event. We then use this when constructing the portmapper, so that we don't keep spamming logs forever on the same network. Updates #13145 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6e7162509148abea674f96efd76be9dffb373ae4
2025-03-11tsnet,wgengine: fix src to primary Tailscale IP for TCP dialsFran Bull1-0/+43
Ensure that the src address for a connection is one of the primary addresses assigned by Tailscale. Not, for example, a virtual IP address. Updates #14667 Signed-off-by: Fran Bull <fran@tailscale.com>
2025-03-07wgengine/magicsock: use learned DERP route as send path of last resortBrad Fitzpatrick2-3/+31
If we get a packet in over some DERP and don't otherwise know how to reply (no known DERP home or UDP endpoint), this makes us use the DERP connection on which we received the packet to reply. This will almost always be our own home DERP region. This is particularly useful for large one-way nodes (such as hello.ts.net) that don't actively reach out to other nodes, so don't need to be told the DERP home of peers. They can instead learn the DERP home upon getting the first connection. This can also help nodes from a slow or misbehaving control plane. Updates tailscale/corp#26438 Change-Id: I6241ec92828bf45982e0eb83ad5c7404df5968bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-02-06wgengine/netstack: respond to service IPs in Linux tun modeAdrian Dewhurst1-5/+17
When in tun mode on Linux, AllowedIPs are not automatically added to netstack because the kernel is responsible for handling subnet routes. This ensures that virtual IPs are always added to netstack. When in tun mode, pings were also not being handled, so this adds explicit support for ping as well. Fixes tailscale/corp#26387 Change-Id: I6af02848bf2572701288125f247d1eaa6f661107 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>
2025-02-06go.mod,wgengine/netstack: use cubic congestion control, bump gvisorJames Tucker1-0/+5
Cubic performs better than Reno in higher BDP scenarios, and enables the use of the hystart++ implementation contributed by Coder. This improves throughput on higher BDP links with a much faster ramp. gVisor is bumped as well for some fixes related to send queue processing and RTT tracking. Updates #9707 Updates #10408 Updates #12393 Updates tailscale/corp#24483 Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>
2025-02-06wgengine/netstack: block link writes when full rather than dropJames Tucker1-22/+27
Originally identified by Coder and documented in their blog post, this implementation differs slightly as our link endpoint was introduced for a different purpose, but the behavior is the same: apply backpressure rather than dropping packets. This reduces the negative impact of large packet count bursts substantially. An alternative would be to swell the size of the channel buffer substantially, however that's largely just moving where buffering occurs and may lead to reduced signalling back to lower layer or upstream congestion controls. Updates #9707 Updates #10408 Updates #12393 Updates tailscale/corp#24483 Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>
2025-02-06wgengine/netstack: disable RACK on all platformsJames Tucker1-10/+8
The gVisor RACK implementation appears to perfom badly, particularly in scenarios with higher BDP. This may have gone poorly noticed as a result of it being gated on SACK, which is not enabled by default in upstream gVisor, but itself has a higher positive impact on performance. Both the RACK and DACK implementations (which are now one) have overlapping non-completion of tasks in their work streams on the public tracker. Updates #9707 Signed-off-by: James Tucker <james@tailscale.com>
2025-02-03wgengine/wgcfg/nmcfg: coalesce, limit some debug logsBrad Fitzpatrick1-6/+14
Updates #14881 Change-Id: I708d29244fe901ab037203a5d7c2cae3c77e4c78 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-24feature/capture: move packet capture to feature/*, out of iOS + CLIBrad Fitzpatrick6-417/+8
We had the debug packet capture code + Lua dissector in the CLI + the iOS app. Now we don't, with tests to lock it in. As a bonus, tailscale.com/net/packet and tailscale.com/net/flowtrack no longer appear in the CLI's binary either. A new build tag ts_omit_capture disables the packet capture code and was added to build_dist.sh's --extra-small mode. Updates #12614 Change-Id: I79b0628c0d59911bd4d510c732284d97b0160f10 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.