webnet/tailscale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
10,082 Commits 3 Branches 0 Tags
8d875a301c8bdaceb5814eab100a90cb725b2018
Commit Graph
1949 Commits
Author SHA1 Message Date
Brad Fitzpatrick 4ed6b62c7a ipn/ipnlocal: refactor to unindent a bit 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-31 16:03:23 -07:00
Brad Fitzpatrick 1f583a895e ipn/ipnlocal: stop sending machine key to frontends 
We were going to remove this in Tailscale 1.3 but forgot.

This means Tailscale 1.8 users won't be able to downgrade to Tailscale
1.0, but that's fine.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-31 15:51:51 -07:00
Maisem AliandMaisem Ali db13b2d0c8 cmd/tailscale, ipn/localapi: add "tailscale bugreport" subcommand 
Adding a subcommand which prints and logs a log marker. This should help
diagnose any issues that users face.

Fixes #1466

Signed-off-by: Maisem Ali <maisem@tailscale.com>
 2021-03-31 15:19:51 -07:00
Brad Fitzpatrick c3bee0b722 ipn/ipnlocal: make peerapi work on iOS again 
It didn't have a storage directory.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-31 14:09:06 -07:00
Brad Fitzpatrick 1bd14a072c cmd/tailscale, ipn/localapi: move IP forwarding check to tailscaled, API 
Instead of having the CLI check whether IP forwarding is enabled, ask
tailscaled. It has a better idea. If it's netstack, for instance, the
sysctl values don't matter. And it's possible that only the daemon has
permission to know.

Fixes #1626

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-31 12:09:16 -07:00
Brad Fitzpatrick a998fe7c3d control/controlclient: support lazy machine key generation 
It's not done in the caller yet, but the controlclient does it now.

Updates #1573

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-31 08:52:57 -07:00
Brad Fitzpatrick cf2beafbcd ipn/ipnlocal: on Windows peerapi bind failures, try again on link change 
Updates #1620

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-30 13:49:37 -07:00
Brad Fitzpatrick 6d1a9017c9 ipn/{ipnlocal,localapi}, client/tailscale: add file get/delete APIs 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-30 12:56:51 -07:00
Brad FitzpatrickandBrad Fitzpatrick 672b9fd4bd ipn{,/ipnlocal}: set new Notify.FilesWaiting when server has file(s) 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-30 11:36:12 -07:00
Brad Fitzpatrick f01091babe ipn/ipnlocal: make peerapi work in netstack mode 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-30 09:55:01 -07:00
Brad Fitzpatrick 41e4e02e57 net/{packet,tstun}: send peerapi port in TSMP pongs 
For discovery when an explicit hostname/IP is known. We'll still
also send it via control for finding peers by a list.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-29 15:18:23 -07:00
Brad Fitzpatrick 9659ab81e0 ipn/ipnlocal: send peerapi port(s) in Hostinfo.Services 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-29 12:51:19 -07:00
Brad Fitzpatrick 35596ae5ce ipn/ipnlocal: push down a user-specific root dir to peerapi handler 
And add a put handler.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-29 11:33:35 -07:00
Brad Fitzpatrick f26dfd054a ipn/ipnlocal: rename/document peerapi stuff a bit, pass self identity 
So handlers can vary based on whether owner of peer matches owner of
local node.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-26 21:36:39 -07:00
Brad Fitzpatrick 1642dfdb07 ipn/ipnlocal: get peerapi ~working in macOS/iOS NetworkExtension sandbox 
IPv4 and IPv6 both work remotely, but IPv6 doesn't yet work from the
machine itself due to routing mysteries.

Untested yet on iOS, but previous prototype worked on iOS, so should
work the same.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-26 13:46:01 -07:00
Brad Fitzpatrick 5a62aa8047 ipn/ipnlocal: pass down interface state to peerapi ListenConfig hook 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-26 09:11:48 -07:00
David AndersonandDave Anderson 9f7f2af008 wgengine/router/dns: move to net/dns. 
Preparation for merging the APIs and whatnot.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-25 16:25:30 -07:00
David AndersonandDave Anderson 8432999835 Move wgengine/tsdns to net/dns. 
Straight move+fixup, no other changes. In prep for merging with
wgengine/router/dns.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-25 16:25:30 -07:00
Brad FitzpatrickandBrad Fitzpatrick 81143b6d9a ipn/ipnlocal: start of peerapi between nodes 
Also some necessary refactoring of the ipn/ipnstate too.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-25 16:00:35 -07:00
Brad FitzpatrickandBrad Fitzpatrick 2384c112c9 net/packet, wgengine/{filter,tstun}: add TSMP ping 
Fixes #1467

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-24 09:50:01 -07:00
David AndersonandDave Anderson 8c0a0450d9 ipn/ipnlocal: allow client access to exit node's public IPs. 
"public IP" is defined as an IP address configured on the exit node
itself that isn't in the list of forbidden ranges (RFC1918, CGNAT,
Tailscale).

Fixes #1522.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-19 11:54:15 -07:00
Brad FitzpatrickandBrad Fitzpatrick 0a02aaf813 control, ipn, tailcfg: remove golang.org/x/oauth2 dep, add tailcfg.Oauth2Token 
golang.org/x/oauth2 pulls in App Engine and grpc module dependencies,
screwing up builds that depend on this module.

Some background on the problem:
https://go.googlesource.com/proposal/+/master/design/36460-lazy-module-loading.md

Fixes tailscale/corp#1471

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-19 10:40:48 -07:00
Brad Fitzpatrick 439d70dce2 cmd/tailscale, ipn/localapi: get daemon version from localapi status 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-18 21:14:10 -07:00
Brad Fitzpatrick d0dffe33c0 cmd/tailscale, ipn/localapi: use localapi for status, not IPN acrobatics 
Yay simpler code.

Tested on Linux, macOS and Windows.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-18 19:51:02 -07:00
Brad Fitzpatrick 27c4dd9a97 Revert "cmd/tailscaled, ipn/{ipnlocal,ipnserver}: let netstack get access to LocalBackend" 
This reverts commit 2bc518dcb2.

@namansood didn't end up needing it in his 770aa71ffb.
 2021-03-16 12:33:13 -07:00
Brad FitzpatrickandBrad Fitzpatrick 9eb65601ef health, ipn/ipnlocal: track, log overall health 
Updates #1505

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-16 09:12:39 -07:00
Brad Fitzpatrick ba8c6d0775 health, controlclient, ipn, magicsock: tell health package state of things 
Not yet checking anything. Just plumbing states into the health package.

Updates #1505

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-15 15:20:55 -07:00
Naman Sood 770aa71ffb client, cmd/hello, ipn, wgengine: fix whois for netstack-forwarded connections 
Updates #504

Updates #707

Signed-off-by: Naman Sood <mail@nsood.in>
 2021-03-15 18:14:09 -04:00
Brad FitzpatrickandBrad Fitzpatrick 2bc518dcb2 cmd/tailscaled, ipn/{ipnlocal,ipnserver}: let netstack get access to LocalBackend 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-15 09:31:25 -07:00
David CrawshawandDavid Crawshaw bdb91a20eb ipnstate, ipnlocal: add AuthURL to status 
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
 2021-03-12 08:07:20 -08:00
David Anderson d79a2f3809 wgengine/filter: only log packets to/from non-default routes. 
Fixes tailscale/corp#1429.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-09 16:24:09 -08:00
Brad Fitzpatrick 43b30e463c ipn/ipnserver: refactor permissions checks a bit, document more, fix Windows 
Windows was only running the localapi on the debug port which was a
stopgap at the time while doing peercreds work. Removed that, and
wired it up correctly, with some more docs.

More clean-up to do after 1.6, moving the localhost TCP auth code into
the peercreds package. But that's too much for now, so the docs will
have to suffice, even if it's at a bit of an awkward stage with the
newly-renamed "NotWindows" field, which still isn't named well, but
it's better than its old name of "Unknown" which hasn't been accurate
since unix sock peercreds work anyway.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-05 21:46:32 -08:00
Brad Fitzpatrick a4b585947d ipn/localapi, client/tailscale: add a goroutine dump handler 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-05 12:14:24 -08:00
Brad Fitzpatrick 1ca3e739f7 ipn/ipnserver: set PermitWrite on localapi handler 
The TODO was easy now with peerCreds and the isReadonlyConn func.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-05 12:14:24 -08:00
Brad Fitzpatrick affd859121 ipn/ipnlocal, control/controlclient: propagate link monitor to controlclient 
Don't use it yet, but get it down there.

Updates #1455

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-04 20:11:55 -08:00
Brad FitzpatrickandBrad Fitzpatrick 82edf94df7 ipn/ipnlocal: make IPv6 OS routes be a single /48 for our ULA space 
And if we have over 10,000 CGNAT routes, just route the entire
CGNAT range. (for the hello test server)

Fixes #1450

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-04 13:37:05 -08:00
Brad FitzpatrickandBrad Fitzpatrick 15b6969a95 ipn/ipnserver: grant client r/w access if peer uid matches tailscaled 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-02 12:34:11 -08:00
Brad FitzpatrickandBrad Fitzpatrick be779b3587 safesocket, ipn/ipnserver: unify peercred info, fix bug on FreeBSD etc 
FreeBSD wasn't able to run "tailscale up" since the recent peercred
refactoring.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-02 11:23:26 -08:00
Brad Fitzpatrick 625c413508 ipn/ipnlocal: fix another regression from link monitoring refactor 
Prior to e3df29d488, the Engine.SetLinkChangeCallback fired
immediately, even if there was no change. The ipnlocal code apparently
depended on that, and it broke integration tests (which live in
another repo). So mimic the old behavior and call the ipnlocal
callback immediately at init.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-01 20:45:30 -08:00
David AndersonandDave Anderson f647e3daaf ipn/ipnlocal: transform default routes into "all but LAN" routes. 
Fixes #1177.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-03-01 18:47:43 -08:00
Brad Fitzpatrick e3df29d488 wgengine{,/monitor}: move interface state fetching/comparing to monitor 
Gets it out of wgengine so the Engine isn't responsible for being a
callback registration hub for it.

This also removes the Engine.LinkChange method, as it's no longer
necessary.  The monitor tells us about changes; it doesn't seem to
need any help. (Currently it was only used by Swift, but as of
14dc790137 we just do the same from Go)

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-01 13:01:08 -08:00
Brad Fitzpatrick 38dc6fe758 cmd/tailscaled, wgengine: remove --fake, replace with netstack 
And add a --socks5-server flag.

And fix a race in SOCKS5 replies where the response header was written
concurrently with the copy from the backend.

Co-authored with Naman Sood.

Updates #707
Updates #504

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-03-01 11:09:19 -08:00
David Anderson 360095cd34 ipn: add tests for exit node pretty printing. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-24 21:18:35 -08:00
David Anderson 8ee1cb6156 ipn/ipnlocal: mark findExitNodeID as requiring mutex. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-24 21:18:33 -08:00
David AndersonandDave Anderson abfd73f569 ipn: print currently selected exit route in Prefs.String(). 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-24 20:41:56 -08:00
David AndersonandDave Anderson 2404c0ffad ipn/ipnlocal: only filter out default routes when computing the local wg config. 
UIs need to see the full unedited netmap in order to know what exit nodes they
can offer to the user.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-24 20:41:56 -08:00
Brad FitzpatrickandBrad Fitzpatrick f11952ad7f ipn/ipnserver: fix Windows connection auth regression 
Regression from code movement in d3efe8caf6

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-02-23 13:27:04 -08:00
David AndersonandDave Anderson b83c273737 wgengine/filter: use IPSet for localNets instead of prefixes. 
Part of #1177, preparing for doing fancier set operations on
the allowed local nets.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-02-22 14:51:22 -08:00
Sonia AppasamyandGitHub 76fb27bea7 dnsname,tailcfg: add hostname sanitation logic to node display names (#1304) 
Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
 2021-02-18 17:15:38 -05:00
Brad Fitzpatrick 7038c09bc9 ipn/ipnserver: on darwin, let users who are admins use CLI without sudo 
Tangentially related to #987, #177, #594, #925, #505

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
 2021-02-16 21:09:27 -08:00