webnet/tailscale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1,984 Commits 3 Branches 0 Tags
018200aebaf77daa14bbc33c7131d9c07a3d9ee7
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
David AndersonandDave Anderson 018200aeba net/tstun: rename from net/tun. 
We depend on wireguard-go/tun, identical leaf packages can be
confusing in code.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-26 22:31:54 -07:00
David AndersonandDave Anderson 2b4bfeda1a wgengine: pass in an explicit router.Router, rather than a generator. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-26 22:01:55 -07:00
David AndersonandDave Anderson 9ea5cbf81f cmd/tailscaled: readd tun.Diagnose call, mistakenly lost during refactor. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-26 22:01:55 -07:00
David AndersonandDave Anderson 44d9929208 wgengine: remove Config.TUNName, require caller to create device. 
Also factors out device creation and associated OS workarounds to
net/tun.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-26 21:08:11 -07:00
David AndersonandDave Anderson 0a84aaca0a wgengine/router: remove unused wireguard *Device argument. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-26 19:43:13 -07:00
David Anderson 672731ac6f many: gofmt. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-25 17:41:51 -07:00
David Anderson 6521f02ff6 Move DNS flush logic to net/dns. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-25 17:40:52 -07:00
David AndersonandDave Anderson 9f7f2af008 wgengine/router/dns: move to net/dns. 
Preparation for merging the APIs and whatnot.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-25 16:25:30 -07:00
David AndersonandDave Anderson 8432999835 Move wgengine/tsdns to net/dns. 
Straight move+fixup, no other changes. In prep for merging with
wgengine/router/dns.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-25 16:25:30 -07:00
David AndersonandDave Anderson 8c0a0450d9 ipn/ipnlocal: allow client access to exit node's public IPs. 
"public IP" is defined as an IP address configured on the exit node
itself that isn't in the list of forbidden ranges (RFC1918, CGNAT,
Tailscale).

Fixes #1522.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-19 11:54:15 -07:00
David AndersonandDave Anderson 6fb5d4080c net/portmapper: silently handle PCP NOT_AUTHORIZED responses. 
Fixes #1525.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-17 19:44:35 -07:00
David Anderson 4543e4202f VERSION.txt: this is 1.7.0. 2021-03-16 19:04:55 -07:00
David Anderson 6f48a8422a version: remove version-info.sh when cleaning. 2021-03-16 16:38:19 -07:00
David Anderson 84aba349d9 Revert "wgengine/netstack: update gvisor to remove 64-bit only limitation" 
Breaks our corp repo due to gRPC dependency hell.

This reverts commit d42f8b7f9a.
 2021-03-16 15:36:06 -07:00
David Anderson 380a3526f6 cmd/tailscale/cli: warn if using subnet routing on BSD 
Fixes #1475.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-15 17:25:59 -07:00
David Anderson 1bc3c03562 control/controlclient: allow for an unset linkMon. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-11 21:21:15 -08:00
David Anderson fa6110e47b wgengine/router: don't touch interface routes 
Developed by a cast of dozens.

Fixes #1448

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-11 21:09:25 -08:00
David AndersonandDave Anderson 0b66cfe1e0 control/controlclient: report broken IP forwarding more precisely. 
IP forwarding is not required when advertising a machine's local IPs
over Tailscale.

Fixes #1435.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-11 10:49:57 -08:00
David Anderson bf0740b011 Merge branch 'main' of github.com:tailscale/tailscale into danderson/filter-privacy 2021-03-09 16:33:55 -08:00
David AndersonandDave Anderson a7f12a110a wgengine/filter: only log packets to/from non-default routes. 
Fixes tailscale/corp#1429.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-09 16:28:43 -08:00
David Anderson d79a2f3809 wgengine/filter: only log packets to/from non-default routes. 
Fixes tailscale/corp#1429.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-09 16:24:09 -08:00
David AndersonandDave Anderson 63a9adeb6c portlist: collect IPv6 listening sockets on linux. 
This is important because some of those v6 sockets are actually
dual-stacked sockets, so this is our only chance of discovering
some services.

Fixes #1443.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-04 13:52:56 -08:00
David AndersonandDave Anderson ad6edf5ecd portlist: report a better process name for .Net on linux. 
Fixes #1440.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-03 22:30:27 -08:00
David Anderson 2e347d1e10 tailcfg: tweak documentation for map version 11 
version: bump date.
 2021-03-03 15:06:35 -08:00
David Anderson ea49b1e811 tailcfg: bump map request version for v6 + default routes. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-03 12:01:15 -08:00
David AndersonandDave Anderson 1cb0ffc3ff wgengine/router: make windows gracefully handle disabled IPv4 or IPv6. 
This is necessary because either protocol can be disabled globally by a
Windows registry policy, at which point trying to touch that address
family results in "Element not found" errors. This change skips programming
address families that Windows tell us are unavailable.

Fixes #1396.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-03 11:48:17 -08:00
David Anderson 8d77dfdacb wgengine/router: add a dummy IPv6 address if needed for default routing. 
Fixes #1339

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-02 19:32:04 -08:00
David AndersonandDave Anderson 793cb131f0 wgengine/router: toggle killswitch when using default routes on windows. 
Fixes #1398.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-01 19:37:22 -08:00
David AndersonandDave Anderson ac3de93d5c tempfork/wireguard-windows/firewall: add. 
This is a fork of wireguard-windows's firewall package, with
the firewall rules adjusted to better line up with tailscale's
needs.

The package was taken from commit 3cc76ed5f222ec82748ef3bd8c41d4b059e28cdb
in our fork of wireguard-go.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-01 19:37:22 -08:00
David AndersonandDave Anderson f647e3daaf ipn/ipnlocal: transform default routes into "all but LAN" routes. 
Fixes #1177.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-01 18:47:43 -08:00
David Anderson 360095cd34 ipn: add tests for exit node pretty printing. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-24 21:18:35 -08:00
David Anderson 8ee1cb6156 ipn/ipnlocal: mark findExitNodeID as requiring mutex. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-24 21:18:33 -08:00
David AndersonandDave Anderson 54d7070121 wgengine/router: correctly read IPv6 routes when diffing. 
Fixes #1185.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-24 20:41:56 -08:00
David AndersonandDave Anderson abfd73f569 ipn: print currently selected exit route in Prefs.String(). 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-24 20:41:56 -08:00
David AndersonandDave Anderson 2404c0ffad ipn/ipnlocal: only filter out default routes when computing the local wg config. 
UIs need to see the full unedited netmap in order to know what exit nodes they
can offer to the user.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-24 20:41:56 -08:00
David Anderson ebf3f2fd9f cmd/tailscale/cli: add CLI option to offer an exit node to the tailnet. 
Finishes up linux part of #1154.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-24 11:34:06 -08:00
David AndersonandBrad Fitzpatrick d038a5295d wgengine/wglog: drop 1/s "interface is up" messages. 
Fixes #1388.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-23 09:01:58 -08:00
David Anderson 6e42430ad8 wgengine/monitor: don't log any single-IP routes added to the tailscale table. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-22 20:21:51 -08:00
David Anderson df5adb2e23 wgengine/monitor: on linux, also monitor for IPv6 changes. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-22 19:38:07 -08:00
David AndersonandDave Anderson b83c273737 wgengine/filter: use IPSet for localNets instead of prefixes. 
Part of #1177, preparing for doing fancier set operations on
the allowed local nets.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-22 14:51:22 -08:00
David Anderson e86b39b73f ipn/ipnlocal: don't short-circuit default route filtering. 
If no exit node is specified, the filter must still run to remove
offered default routes from all peers.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-05 20:33:18 -08:00
David AndersonandDave Anderson a046b48593 cmd/tailscale/cli: display currently active exit node in tailscale status. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-05 14:53:17 -08:00
David Anderson ace57d7627 wgengine/magicsock: set a dummy private key in benchmark. 
Magicsock started dropping all traffic internally when Tailscale is
shut down, to avoid spurious wireguard logspam. This made the benchmark
not receive anything. Setting a dummy private key is sufficient to get
magicsock to pass traffic for benchmarking purposes.

Fixes #1270.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-05 13:36:05 -08:00
David AndersonandDave Anderson b9c2231fdf ipn: program exit node into the data plane according to user pref. 
Part of #1153, #1154. Fixes #1224.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-05 13:07:11 -08:00
David Anderson 45fe06a89f Revert "tailcfg: remove v6-overlay debug option." 
This reverts commit da4ec54756.

Since v6 got disabled for Windows nodes, I need the debug flag back
to figure out why it was broken.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-03 16:11:56 -08:00
David AndersonandDave Anderson 267531e4f8 wgengine/router: probe better for v6 policy routing support. 
Previously we disabled v6 support if the disable_policy knob was
missing in /proc, but some kernels support policy routing without
exposing the toggle. So instead, treat disable_policy absence as a
"maybe", and make the direct `ip -6 rule` probing a bit more
elaborate to compensate.

Fixes #1241.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-01 16:12:17 -08:00
David Anderson de497358b8 cmd/tailscaled: add /run to the allowed paths for iptables. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-28 12:58:07 -08:00
David Anderson 7a16ac80b7 VERSION.txt: this is 1.5.0. 2021-01-27 18:45:22 -08:00
David AndersonandDave Anderson 692a011b54 net/interfaces: remove IsTailscaleIP, make callers use tsaddr. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-26 15:10:51 -08:00
David Anderson 9f7cbf6cf1 wgengine/filter: add a Clone method. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-22 17:31:37 -08:00
David AndersonandDave Anderson 49d00b6a28 tailcfg: add StableID to Node. #1178 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-21 13:33:19 -08:00
David Anderson ab9cccb292 cmd/tailscale/cli: require v4 and v6 default routes to be advertised together. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-19 16:49:06 -08:00
David Anderson 78338ac029 types/logger: trim spaces from the rate-limited example message. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-19 16:48:44 -08:00
David Anderson da4ec54756 tailcfg: remove v6-overlay debug option. 
It's about to become a no-op in control.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-18 17:47:23 -08:00
David Anderson 9936cffc1a wgengine: correctly track all node IPs in lazy config. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-18 13:32:16 -08:00
David Anderson e23b4191c4 wgengine/magicsock: disable legacy networking everywhere except TwoDevicePing. 
TwoDevicePing is explicitly testing the behavior of the legacy codepath, everything
else is happy to assume that code no longer exists.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-15 16:02:31 -08:00
David Anderson 0733c5d2e0 wgengine/magicsock: disable legacy behavior in a few more tests. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-15 15:57:41 -08:00
David Anderson 57d95dd005 wgengine/magicsock: default legacy networking to off for some tests. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-15 15:54:45 -08:00
David AndersonandDave Anderson a2463e8948 wgengine/magicsock: add an option to disable legacy peer handling. 
Used in tests to ensure we're not relying on behavior we're going
to remove eventually.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-15 15:01:33 -08:00
David AndersonandDave Anderson d456bfdc6d wgengine/magicsock: fix BenchmarkReceiveFrom. 
Previously, this benchmark relied on behavior of the legacy
receive codepath, which I changed in 22507adf. With this
change, the benchmark instead relies on the new active discovery
path.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-15 15:01:33 -08:00
David Anderson 01e8b7fb7e go.mod: bump wireguard-go version. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-15 10:53:49 -08:00
David AndersonandDave Anderson 9abcb18061 wgengine/magicsock: import more of wireguard-go, update docstrings. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-14 12:56:48 -08:00
David AndersonandDave Anderson 22507adf54 wgengine/magicsock: stop depending on UpdateDst in legacy codepaths. 
This makes connectivity between ancient and new tailscale nodes slightly
worse in some cases, but only in cases where the ancient version would
likely have failed to get connectivity anyway.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-01-14 12:56:48 -08:00
David Anderson 86fe22a1b1 Update netaddr, and adjust wgengine/magicsock due to API change. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-30 17:36:03 -08:00
David AndersonandBrad Fitzpatrick cb96b14bf4 net/packet: remove the custom IP4/IP6 types in favor of netaddr.IP. 
Upstream netaddr has a change that makes it alloc-free, so it's safe to
use in hot codepaths. This gets rid of one of the many IP types in our
codebase.

Performance is currently worse across the board. This is likely due in
part to netaddr.IP being a larger value type (4b -> 24b for IPv4,
16b -> 24b for IPv6), and in other part due to missing low-hanging fruit
optimizations in netaddr. However, the regression is less bad than
it looks at first glance, because we'd micro-optimized packet.IP* in
the past few weeks. This change drops us back to roughly where we
were at the 1.2 release, but with the benefit of a significant
code and architectural simplification.

name                   old time/op    new time/op    delta
pkg:tailscale.com/net/packet goos:linux goarch:amd64
Decode/tcp4-8            12.2ns ± 5%    29.7ns ± 2%  +142.32%  (p=0.008 n=5+5)
Decode/tcp6-8            12.6ns ± 3%    65.1ns ± 2%  +418.47%  (p=0.008 n=5+5)
Decode/udp4-8            11.8ns ± 3%    30.5ns ± 2%  +157.94%  (p=0.008 n=5+5)
Decode/udp6-8            27.1ns ± 1%    65.7ns ± 2%  +142.36%  (p=0.016 n=4+5)
Decode/icmp4-8           24.6ns ± 2%    30.5ns ± 2%   +23.65%  (p=0.016 n=4+5)
Decode/icmp6-8           22.9ns ±51%    65.5ns ± 2%  +186.19%  (p=0.008 n=5+5)
Decode/igmp-8            18.1ns ±44%    30.2ns ± 1%   +66.89%  (p=0.008 n=5+5)
Decode/unknown-8         20.8ns ± 1%    10.6ns ± 9%   -49.11%  (p=0.016 n=4+5)
pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64
Filter/icmp4-8           30.5ns ± 1%    77.9ns ± 3%  +155.01%  (p=0.008 n=5+5)
Filter/tcp4_syn_in-8     43.7ns ± 3%   123.0ns ± 3%  +181.72%  (p=0.008 n=5+5)
Filter/tcp4_syn_out-8    24.5ns ± 2%    45.7ns ± 6%   +86.22%  (p=0.008 n=5+5)
Filter/udp4_in-8         64.8ns ± 1%   210.0ns ± 2%  +223.87%  (p=0.008 n=5+5)
Filter/udp4_out-8         119ns ± 0%     278ns ± 0%  +133.78%  (p=0.016 n=4+5)
Filter/icmp6-8           40.3ns ± 2%   204.4ns ± 4%  +407.70%  (p=0.008 n=5+5)
Filter/tcp6_syn_in-8     35.3ns ± 3%   199.2ns ± 2%  +464.95%  (p=0.008 n=5+5)
Filter/tcp6_syn_out-8    32.8ns ± 2%    81.0ns ± 2%  +147.10%  (p=0.008 n=5+5)
Filter/udp6_in-8          106ns ± 2%     290ns ± 2%  +174.48%  (p=0.008 n=5+5)
Filter/udp6_out-8         184ns ± 2%     314ns ± 3%   +70.43%  (p=0.016 n=4+5)
pkg:tailscale.com/wgengine/tstun goos:linux goarch:amd64
Write-8                  9.02ns ± 3%    8.92ns ± 1%      ~     (p=0.421 n=5+5)

name                   old alloc/op   new alloc/op   delta
pkg:tailscale.com/net/packet goos:linux goarch:amd64
Decode/tcp4-8             0.00B          0.00B           ~     (all equal)
Decode/tcp6-8             0.00B          0.00B           ~     (all equal)
Decode/udp4-8             0.00B          0.00B           ~     (all equal)
Decode/udp6-8             0.00B          0.00B           ~     (all equal)
Decode/icmp4-8            0.00B          0.00B           ~     (all equal)
Decode/icmp6-8            0.00B          0.00B           ~     (all equal)
Decode/igmp-8             0.00B          0.00B           ~     (all equal)
Decode/unknown-8          0.00B          0.00B           ~     (all equal)
pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64
Filter/icmp4-8            0.00B          0.00B           ~     (all equal)
Filter/tcp4_syn_in-8      0.00B          0.00B           ~     (all equal)
Filter/tcp4_syn_out-8     0.00B          0.00B           ~     (all equal)
Filter/udp4_in-8          0.00B          0.00B           ~     (all equal)
Filter/udp4_out-8         16.0B ± 0%     64.0B ± 0%  +300.00%  (p=0.008 n=5+5)
Filter/icmp6-8            0.00B          0.00B           ~     (all equal)
Filter/tcp6_syn_in-8      0.00B          0.00B           ~     (all equal)
Filter/tcp6_syn_out-8     0.00B          0.00B           ~     (all equal)
Filter/udp6_in-8          0.00B          0.00B           ~     (all equal)
Filter/udp6_out-8         48.0B ± 0%     64.0B ± 0%   +33.33%  (p=0.008 n=5+5)

name                   old allocs/op  new allocs/op  delta
pkg:tailscale.com/net/packet goos:linux goarch:amd64
Decode/tcp4-8              0.00           0.00           ~     (all equal)
Decode/tcp6-8              0.00           0.00           ~     (all equal)
Decode/udp4-8              0.00           0.00           ~     (all equal)
Decode/udp6-8              0.00           0.00           ~     (all equal)
Decode/icmp4-8             0.00           0.00           ~     (all equal)
Decode/icmp6-8             0.00           0.00           ~     (all equal)
Decode/igmp-8              0.00           0.00           ~     (all equal)
Decode/unknown-8           0.00           0.00           ~     (all equal)
pkg:tailscale.com/wgengine/filter goos:linux goarch:amd64
Filter/icmp4-8             0.00           0.00           ~     (all equal)
Filter/tcp4_syn_in-8       0.00           0.00           ~     (all equal)
Filter/tcp4_syn_out-8      0.00           0.00           ~     (all equal)
Filter/udp4_in-8           0.00           0.00           ~     (all equal)
Filter/udp4_out-8          1.00 ± 0%      1.00 ± 0%      ~     (all equal)
Filter/icmp6-8             0.00           0.00           ~     (all equal)
Filter/tcp6_syn_in-8       0.00           0.00           ~     (all equal)
Filter/tcp6_syn_out-8      0.00           0.00           ~     (all equal)
Filter/udp6_in-8           0.00           0.00           ~     (all equal)
Filter/udp6_out-8          1.00 ± 0%      1.00 ± 0%      ~     (all equal)

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-22 14:44:36 -08:00
David Anderson ca676ea645 tailcfg: introduce map version 8, for clients that support v6 node config. 
For now, the server will only send v6 configuration to mapversion 8 clients
as part of an early-adopter program, while we verify that the functionality
is robust.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-19 18:28:27 -08:00
David Anderson 03a039d48d go.mod: bump wireguard-go version. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-19 17:26:05 -08:00
David Anderson f5e33ad761 go.mod: update inet.af/netaddr, go mod tidy. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-19 14:01:43 -08:00
David AndersonandDave Anderson 89be4037bb control/controlclient: report broken routing for v4 and v6. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-19 13:50:44 -08:00
David AndersonandDave Anderson baa7937998 net/interfaces: return IPv6 addresses from LocalAddresses. 
In practice, we already provide IPv6 endpoint addresses via netcheck,
and that address is likely to match a local address anyway (i.e. no NAT66).
The comment at that piece of the code mentions needing to figure out a
good priority ordering, but that only applies to non-active-discovery
clients, who already don't do anything with IPv6 addresses.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-19 13:50:44 -08:00
David AndersonandDave Anderson 294ceb513c ipn, wgengine/magicsock: fix tailscale status display. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-19 13:50:44 -08:00
David AndersonandDave Anderson 891110e64c wgengine: expand lazy config to work with dual-stacked peers. 
Lazy wg configuration now triggers if a peer has only endpoint
addresses (/32 for IPv4, /128 for IPv6). Subnet routers still
trigger eager configuration to avoid the need for a CIDR match
in the hot packet path.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-19 13:50:44 -08:00
David AndersonandDave Anderson aa353b8d0f net/packet: add an IP6 constructor from a raw byte array. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-19 13:50:44 -08:00
David AndersonandDave Anderson c8c493f3d9 wgengine/magicsock: make ReceiveIPv4 a little easier to follow. 
The previous code used a lot of whole-function variables and shared
behavior that only triggered based on prior action from a single codepath.
Instead of that, move the small amounts of "shared" code into each switch
case.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-18 01:15:53 -08:00
David AndersonandDave Anderson 0ad109f63d wgengine/magicsock: move legacy endpoint creation into legacy.go. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-18 01:15:53 -08:00
David AndersonandDave Anderson f873da5b16 wgengine/magicsock: move more legacy endpoint handling. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-18 01:15:53 -08:00
David AndersonandDave Anderson 58fcd103c4 wgengine/magicsock: move legacy sending code to legacy.go. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-18 01:15:53 -08:00
David AndersonandDave Anderson 65ae66260f wgengine/magicsock: unexport AddrSet. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-18 01:15:53 -08:00
David AndersonandDave Anderson c9b9afd761 wgengine/magicsock: move most legacy nat traversal bits to another file. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-18 01:15:53 -08:00
David AndersonandBrad Fitzpatrick 554a20becb wgengine/magicsock: only log about lazy config when actually doing lazy config. 
Before, tailscaled would log every 10 seconds when the periodic noteRecvActivity
call happens. This is noisy, but worse it's misleading, because the message
suggests that the disco code is starting a lazy config run for a missing peer,
whereas in fact it's just an internal piece of keepalive logic.

With this change, we still log when going from 0->1 tunnel for the peer, but
not every 10s thereafter.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-17 12:11:36 -08:00
David Anderson 9cee0bfa8c wgengine/magicsock: sprinkle more docstrings. 
Magicsock is too damn big, but this might help me page it back
in faster next time.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-14 23:59:17 -08:00
David AndersonandDave Anderson 57cd7738c2 tsweb: add an endpoint to manually trigger a GC. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-08 16:49:42 -08:00
David Anderson be6fe393c5 wgengine: don't try pinging IPv6 addresses in legacy pinger. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-01 20:09:32 -08:00
David Anderson dfbde3d3aa ipn: pass through the prefix length from control. 
Control sets this to /32 for IPv4 and /128 for IPv6.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-12-01 20:09:16 -08:00
David Anderson 4c8ccd6dd6 tailcfg: document new debug flag. 2020-12-01 18:17:09 -08:00
David Anderson 3c508a58cc wgengine/filter: don't filter GCP DNS. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-16 14:08:27 -08:00
David Anderson 2eb474dd8d wgengine/filter: add test cases for len(dsts) > 1. 
While the code was correct, I broke it during a refactoring and
tests didn't detect it. This fixes that glitch.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-12 21:41:52 -08:00
David Anderson ce45f4f3ff wgengine/filter: inline ip6InList into match. 
matchIPsOnly gets 5% slower when inlining, despite significantly reduced
memory ops and slightly tighter code.

Part of #19.

Filter/tcp6_syn_in-8     45.5ns ± 1%    42.4ns ± 2%   -6.86%  (p=0.000 n=10+10)
Filter/udp6_in-8          107ns ± 2%      94ns ± 2%  -11.50%  (p=0.000 n=9+10)

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-12 21:41:47 -08:00
David Anderson 3fdae12f0c wgengine/filter: eliminate unnecessary memory loads. 
Doesn't materially affect benchmarks, but shrinks match6 by 30 instructions
and halves memory loads.

Part of #19.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-12 21:41:40 -08:00
David Anderson 5062131aad wgengine/filter: treat * as both a v4 and v6 wildcard. 
Part of #19.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-12 21:41:29 -08:00
David Anderson 2d604b3791 net/packet: represent IP6 as two uint64s. 
For the operations we perform on these types (mostly net6.Contains),
this encoding is much faster.

Part of #19.

name                   old time/op    new time/op    delta
Filter/icmp4-8           27.5ns ± 1%    28.0ns ± 2%   +1.89%  (p=0.016 n=5+5)
Filter/tcp4_syn_in-8     38.8ns ± 2%    38.3ns ± 1%   -1.24%  (p=0.024 n=5+5)
Filter/tcp4_syn_out-8    27.6ns ±12%    24.6ns ± 1%     ~     (p=0.063 n=5+5)
Filter/udp4_in-8         71.5ns ± 5%    65.9ns ± 1%   -7.94%  (p=0.008 n=5+5)
Filter/udp4_out-8         132ns ±13%     119ns ± 1%  -10.29%  (p=0.008 n=5+5)
Filter/icmp6-8            169ns ±10%      54ns ± 1%  -68.35%  (p=0.008 n=5+5)
Filter/tcp6_syn_in-8      149ns ± 6%      43ns ± 1%  -71.11%  (p=0.008 n=5+5)
Filter/tcp6_syn_out-8    37.7ns ± 4%    24.3ns ± 3%  -35.51%  (p=0.008 n=5+5)
Filter/udp6_in-8          179ns ± 5%     103ns ± 1%  -42.75%  (p=0.008 n=5+5)
Filter/udp6_out-8         156ns ± 3%     191ns ± 1%  +22.54%  (p=0.008 n=5+5)

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-12 21:41:21 -08:00
David Anderson 04ff3c91ee wgengine/filter: add full IPv6 support. 
Part of #19.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-12 21:41:15 -08:00
David AndersonandDave Anderson a664aac877 wgengine/router: disable IPv6 if v6 policy routing is unavailable. 
Fixes #895.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-11 15:31:15 -08:00
David Anderson a38e28da07 net/packet: documentation pass. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-10 22:29:00 -08:00
David Anderson c2cc3acbaf net/packet: remove NewIP, offer only a netaddr constructor. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-10 22:03:47 -08:00
David Anderson d7ee3096dd net/packet: documentation cleanups. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-10 21:12:55 -08:00
David AndersonandDave Anderson 9ef39af2f2 net/packet: fix panic on invalid IHL field. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-10 20:23:54 -08:00
David AndersonandDave Anderson 22bf48f37c net/packet: remove {get,put}{16,32} indirection to encoding/binary. 
name              old time/op    new time/op    delta
Decode/tcp4-8       28.8ns ± 2%    13.1ns ± 4%  -54.44%  (p=0.008 n=5+5)
Decode/tcp6-8       20.6ns ± 1%    12.6ns ± 2%  -38.72%  (p=0.008 n=5+5)
Decode/udp4-8       28.2ns ± 1%    12.1ns ± 4%  -57.01%  (p=0.008 n=5+5)
Decode/udp6-8       20.0ns ± 6%    12.1ns ± 2%  -39.38%  (p=0.008 n=5+5)
Decode/icmp4-8      21.7ns ± 2%    11.5ns ± 1%  -47.01%  (p=0.008 n=5+5)
Decode/icmp6-8      14.1ns ± 2%    11.8ns ± 4%  -16.60%  (p=0.008 n=5+5)
Decode/unknown-8    9.43ns ± 2%    9.30ns ± 3%     ~     (p=0.222 n=5+5)

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-10 20:23:54 -08:00
David AndersonandDave Anderson 55b1221db2 net/packet: support full IPv6 decoding. 
The packet filter still rejects all IPv6, but decodes enough from v6
packets to do something smarter in a followup.

name              time/op
Decode/tcp4-8     28.8ns ± 2%
Decode/tcp6-8     20.6ns ± 1%
Decode/udp4-8     28.2ns ± 1%
Decode/udp6-8     20.0ns ± 6%
Decode/icmp4-8    21.7ns ± 2%
Decode/icmp6-8    14.1ns ± 2%
Decode/unknown-8  9.43ns ± 2%

Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-10 20:23:54 -08:00
David AndersonandDave Anderson 89894c6930 net/packet: add IPv6 source and destination IPs to Parsed. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2020-11-10 20:23:54 -08:00