webnet/tailscale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
3,433 Commits 3 Branches 0 Tags
9787ec6f4a3ef03ef0e6eff3697de90c9364fbe6
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
David AndersonandDave Anderson 6e584ffa33 cmd/tailscaled: allow running the SOCKS5 and HTTP proxies on the same port. 
Fixes #3248

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-29 16:49:48 -08:00
David AndersonandDave Anderson a54d13294f net/proxymux: add a listener mux that can run SOCKS and HTTP on a single socket. 
Updates #3248

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-29 16:49:48 -08:00
David AndersonandDave Anderson 097602b3ca ipn/ipnlocal: warn more precisely about IP forwarding issues on linux. 
If IP forwarding is disabled globally, but enabled per-interface on all interfaces,
don't complain. If only some interfaces have forwarding enabled, warn that some
subnet routing/exit node traffic may not work.

Fixes #1586

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-26 11:03:10 -08:00
David AndersonandDave Anderson db800ddeac cmd/derper: set Content-Security-Policy on DERPs. 
It's a basic "deny everything" policy, since DERP's HTTP
server is very uninteresting from a browser POV. But it
stops every security scanner under the sun from reporting
"dangerously configured" HTTP servers.

Updates tailscale/corp#3119

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-26 11:00:44 -08:00
David AndersonandDave Anderson 33c541ae30 ipn/ipnlocal: populate self status from netmap in ipnlocal, not magicsock. 
Fixes #1933

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-26 10:56:42 -08:00
David AndersonandDave Anderson 9a217ec841 cmd/derper: increase HSTS cache lifetime to 2 years. 
Fixes #3373.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-22 11:59:01 -08:00
David AndersonandDave Anderson 937e96f43d cmd/derper: enable HSTS when serving over HTTPS. 
Starting with a short lifetime, to verify nothing breaks.

Updates #3373

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-22 09:57:34 -08:00
David AndersonandDave Anderson 88b8a09d37 net/dns: make constants for the various DBus strings. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-19 11:09:32 -08:00
David AndersonandDave Anderson 6c82cebe57 health: add a health state for net/dns.OSConfigurator. 
Lets the systemd-resolved OSConfigurator report health changes
for out of band config resyncs.

Updates #3327

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-19 11:09:32 -08:00
David AndersonandDave Anderson 4ef3fed100 net/dns: resync config to systemd-resolved when it restarts. 
Fixes #3327

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-19 11:09:32 -08:00
David AndersonandDave Anderson cf9169e4be net/dns: remove unused Config struct element. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-19 11:09:32 -08:00
David AndersonandJosh Bleecher Snyder 41da7620af go.mod: update wireguard-go to pick up roaming toggle 
wgengine/wgcfg: introduce wgcfg.NewDevice helper to disable roaming
at all call sites (one real plus several tests).

Fixes tailscale/corp#3016.

Signed-off-by: David Anderson <danderson@tailscale.com>
Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
 2021-11-16 13:15:04 -08:00
David AndersonandDave Anderson c5d572f371 net/dns: correctly handle NetworkManager-managed DNS that points to resolved. 
Fixes #3304

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-15 12:21:25 -08:00
David AndersonandDave Anderson 5b94f67956 control/noise: make Conn.readNLocked less surprising. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson a34350ffda control/noise: factor out nonce checking and incrementing into a type. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson d3acd35a90 control/noise: make message headers match the specification. 
Only the initiation message should carry a protocol version, all
others are just type+len.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson a63c4ab378 control/noise: don't panic when handling ciphertext. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson 4004b22fe5 control/noise: stop using poly1305 package constants. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson 293431aaea control/noise: use key.Machine{Public,Private} as appropriate. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson edb33d65c3 control/noise: don't cache mixer, just rebuild a BLAKE2s each time. 
This should optimize out fine, and readability is preferable to performance
here.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson 7e9e72887c control/noise: add singleUseCHP, use it to simplify nonce/key tracking in handshake. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson cf90392174 control/noise: review fixups 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson 0b392dbaf7 control/noise: adjust implementation to match revised spec. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson 89a68a4c22 control/noise: include the protocol version in the Noise prologue. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson 5e005a658f control/noise: fix typo in docstring. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson eabca699ec control/noise: remove allocations in the encrypt and decrypt paths. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandDave Anderson da7544bcc5 control/noise: implement the base transport for the 2021 control protocol. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-10 12:13:54 -08:00
David AndersonandBrad Fitzpatrick 0532eb30db all: replace tailcfg.DiscoKey with key.DiscoPublic. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-03 14:00:16 -07:00
David Anderson 17b5782b3a types/key: delete legacy NodeKey type. 
Fixes #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-02 14:14:32 -07:00
David AndersonandDave Anderson 7e6a1ef4f1 tailcfg: use key.NodePublic in wire protocol types. 
Updates #3206.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-02 09:11:43 -07:00
David AndersonandDave Anderson 7e8d5ed6f3 ipn: use key.NodePublic instead of tailcfg.NodeKey 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-01 20:32:10 -07:00
David AndersonandDave Anderson c17250cee2 ipn/ipnstate: use key.NodePublic instead of tailcfg.NodeKey. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-01 20:32:10 -07:00
David AndersonandDave Anderson c3d7115e63 wgengine: use key.NodePublic instead of tailcfg.NodeKey. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-01 18:28:45 -07:00
David AndersonandDave Anderson 72ace0acba wgengine/magicsock: use key.NodePublic instead of tailcfg.NodeKey. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-01 18:03:48 -07:00
David Anderson d6e7cec6a7 types/netmap: use key.NodePublic instead of tailcfg.NodeKey. 
Update #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-11-01 17:07:40 -07:00
David Anderson 8d14bc32d1 tstest/integration: use key.NodePublic instead of tailcfg.NodeKey. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 17:49:16 -07:00
David Anderson 84c3a09a8d types/key: export constants for key size, not a method. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 17:39:04 -07:00
David Anderson 6422789ea0 disco: use key.NodePublic instead of tailcfg.NodeKey. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 17:39:04 -07:00
David Anderson 0fcc88873b tailcfg: remove NodeKeyFromNodePublic. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 16:35:32 -07:00
David Anderson c0ae1d2563 tailcfg: update go generate, which apparently normalizes type aliases. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 16:24:38 -07:00
David Anderson 418adae379 various: use NodePublic.AsNodeKey() instead of tailcfg.NodeKeyFromNodePublic() 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 16:19:27 -07:00
David Anderson ff16e58d23 tailcfg: move NodeKey type to types/key. 
This leaves behind a type alias and associated constructor, to allow
for gradual switchover.

Updates #3206.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 16:04:45 -07:00
David Anderson 15d329b4fa tailcfg: add marshaling round-tripping test. 
Temporary until #3206 goes away, but having changed the marshal/unmarshal
implementation I got nervous about the new one doing the correct thing.
Thankfully, the test says it does.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 15:21:41 -07:00
David Anderson 27e83402a8 cmd/tailscaled: fix depaware. 2021-10-29 15:07:13 -07:00
David Anderson b43362852c types/key: delete legacy undifferentiated key types. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 15:01:12 -07:00
David Anderson eeb97fd89f various: remove remaining uses of key.NewPrivate. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 15:01:12 -07:00
David Anderson ccd36cb5b1 wgengine: remove use of legacy key parsing helper. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 14:57:32 -07:00
David Anderson 743293d473 types/key: remove node key AsPublic/AsPrivate compat shims. 
Updates #3206.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 14:48:36 -07:00
David Anderson 2486d7cb9b tailcfg: remove use of legacy key parsing helper. 
Updates #3206.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 14:48:07 -07:00
David Anderson ef241f782e wgengine/magicsock: remove uses of tailcfg.DiscoKey. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 14:31:44 -07:00
David Anderson 073a3ec416 types/key: correct ShortString representation of DiscoPublic. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 14:31:44 -07:00
David Anderson 06dccea416 types/key: fix license header on disco files. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 13:45:49 -07:00
David Anderson 05cc2f510b types/key: new types for disco keys. 
Needed for #3206 to remove final uses of key.{Public,Private}.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 13:44:02 -07:00
David Anderson 55b6753c11 wgengine/magicsock: remove use of key.{Public,Private}. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 13:20:13 -07:00
David AndersonandDave Anderson c1d009b9e9 ipn/ipnstate: use key.NodePublic instead of the generic key.Public. 
Updates #3206.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-29 10:00:59 -07:00
David Anderson ebae0d95d0 Revert "Revert "tailcfg: remove reference to types/key.Public."" 
Updates #3206

This reverts commit ef14663934.
 2021-10-29 09:38:44 -07:00
David Anderson ef14663934 Revert "tailcfg: remove reference to types/key.Public." 
Breaks corp unit tests.

Updates #3206

This reverts commit 94f6257fde.
 2021-10-28 19:00:29 -07:00
David Anderson 94f6257fde tailcfg: remove reference to types/key.Public. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 16:16:38 -07:00
David Anderson 1f06f77dcb derp: remove package shadowing of types/key. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 16:13:28 -07:00
David Anderson 37c150aee1 derp: use new node key type. 
Update #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 16:02:11 -07:00
David Anderson 15376f975b types/wgkey: delete, no longer used. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 14:53:38 -07:00
David Anderson c41fe182f0 cmd/tailscaled: update depaware. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 14:28:59 -07:00
David Anderson 4d38194c21 control/controlclient: stop using wgkey. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 14:22:51 -07:00
David Anderson e03fda7ae6 wgengine/magicsock: remove test uses of wgkey. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 14:17:25 -07:00
David Anderson c9bf773312 wgengine/magicsock: replace use of wgkey with new node key type. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 11:21:52 -07:00
David Anderson 6e5175373e types/netmap: use new node key type. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 10:44:34 -07:00
David Anderson 96ad68c5d6 ipn: remove mention of wgkey in comment. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 10:40:44 -07:00
David Anderson bab2d92c42 tailcfg: remove use of wgkey. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 10:39:56 -07:00
David Anderson 3164c7410e wgengine/wgcfg: remove unused helper function. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 10:38:13 -07:00
David Anderson 0c546a28ba types/persist: use new node key type. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 10:29:43 -07:00
David AndersonandDave Anderson a9c78910bd wgengine/wgcfg: convert to use new node key type. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 09:39:23 -07:00
David AndersonandDave Anderson a47158e14d cmd/derper: use new node key type. 
Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 09:39:23 -07:00
David AndersonandDave Anderson bc89a796ec types/key: add a dedicated type for node keys. 
Complete with converters to all the other types that represent a
node key today, so the new type can gradually subsume old ones.

Updates #3206

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-28 09:16:39 -07:00
David AndersonandDave Anderson 060ba86baa net/portmapper: ignore IGD SSDP responses from !defaultgw 
Now that we multicast the SSDP query, we can get IGD offers from
devices other than the current device's default gateway. We don't want
to accidentally bind ourselves to those.

Updates #3197

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-27 15:34:27 -07:00
David AndersonandDave Anderson 4a65b07e34 net/portmapper: also send UPnP SSDP query to the SSDP multicast address. 
Fixes #3197

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-27 15:02:03 -07:00
David AndersonDave AndersonDenton Gentry
 		a320d70614 net/dns: fall back to copy+delete/truncate if moving to/from /etc/resolv.conf fails. 
In some containers, /etc/resolv.conf is a bind-mount from outside the container.
This prevents renaming to or from /etc/resolv.conf, because it's on a different
filesystem from linux's perspective. It also prevents removing /etc/resolv.conf,
because doing so would break the bind-mount.

If we find ourselves within this environment, fall back to using copy+delete when
renaming to /etc/resolv.conf, and copy+truncate when renaming from /etc/resolv.conf.

Fixes #3000

Co-authored-by: Denton Gentry <dgentry@tailscale.com>
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-26 09:03:37 -07:00
David AndersonandDave Anderson 04d24d3a38 net/dns: move directManager function below directManager's definition. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-26 09:03:37 -07:00
David AndersonandDave Anderson 422ea4980f net/dns: remove a tiny wrapper function that isn't contributing anything. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-26 09:03:37 -07:00
David Anderson c60806b557 scripts/installer.sh: use .asc suffix for armored debian gpg key URL. 
Fixes #2512

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-20 18:58:50 -07:00
David AndersonDave AndersonJonathan Hult
 		8e3b8dbb50 scripts/installer.sh: Correct support for Oracle Linux. 
Co-Authored-By: Jonathan Hult <jhult@mythics.com>
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-20 12:47:38 -07:00
David AndersonandDave Anderson 1b4e007425 scripts/installer.sh: use expr for regex matches. 
=~ doesn't work in posix shell, only in bash, and we don't use bash.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-19 19:33:52 -07:00
David AndersonandDave Anderson 7ce9c7ce84 scripts/installer.sh: use the appropriate apt key wrangling for the distro. 
Updates #1937

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-19 19:15:07 -07:00
David AndersonandDave Anderson 118fe105f5 scripts/installer.sh: add a few more supported distro versions. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-19 19:15:07 -07:00
David AndersonandDave Anderson b956139b0c wgengine/magicsock: track IP<>node mappings without relying on discokeys. 
Updates #3088.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-18 14:58:21 -07:00
David Anderson e7eb46bced wgengine/magicsock: add an explicit else branch to peerMap update. 
Clarifies that the replace+delete of peerinfo data is only when peerInfo
already exists.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-18 13:05:52 -07:00
David Anderson 1c56643136 disco: amplify comment that disco ping's NodeKey shouldn't be trusted by itself. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-18 13:05:52 -07:00
David AndersonandDave Anderson 2aa5df7ac1 wgengine/magicsock: document and enforce that peerInfo.ep is non-nil. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-18 10:49:24 -07:00
David AndersonandDave Anderson 521b44e653 wgengine/magicsock: move discoKey fields to the mutex-protected section. 
Fixes #3106

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-18 10:49:24 -07:00
David AndersonandDave Anderson 830f641c6b wgengine/magicsock: update discokeys on netmap change. 
Fixes #3008.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-10-06 14:52:47 -07:00
David AndersonandDave Anderson 1eabb5b2d9 ipn: don't log IPN messages that may contain an authkey. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-09-22 20:32:49 -07:00
David AndersonandDave Anderson 562622a32c .github: add dependabot config to update go.mod and github actions. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-09-22 15:35:42 -07:00
David AndersonandDave Anderson 4cf63b8df0 net/dnsfallback: update static map for new derp11. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-09-22 15:35:42 -07:00
David Anderson 18086c4cb7 go.mod: bump github.com/klauspost/compress to 1.13.6 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-09-22 15:11:25 -07:00
Dave AndersonandDave Anderson 478775de6a github: add code security scanning 2021-09-21 15:46:39 -07:00
David Anderson efe8020dfa wgengine/magicsock: fix race condition in tests. 
AFAICT this was always present, the log read mid-execution was never safe.
But it seems like the recent magicsock refactoring made the race much
more likely.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-09-05 17:42:33 -07:00
David AndersonandDave Anderson 69c897a763 net/dnsfallback: run go generate to pick up new derp9s. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-09-05 00:00:16 -07:00
David AndersonandDave Anderson bb6fdfb243 net/dns: fix the build on freebsd (missing default case in switch) 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-09-05 00:00:16 -07:00
David AndersonandDave Anderson b3b1c06b3a net/dns: only restart systemd-resolved if we changed /etc/resolv.conf. 
Reported on IRC: in an edge case, you can end up with a directManager DNS
manager and --accept-dns=false, in which case we should do nothing, but
actually end up restarting resolved whenever the netmap changes, even though
the user told us to not manage DNS.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-09-05 00:00:16 -07:00
David Anderson 10547d989d net/dns: exhaustively test DNS selection paths for linux. 
Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-09-04 23:40:48 -07:00
David Anderson c071bcda33 net/dns: relax systemd-resolved detection. 
Reported on IRC: a resolv.conf that contained two entries for
"nameserver 127.0.0.53", which defeated our "is resolved actually
in charge" check. Relax that check to allow any number of nameservers,
as long as they're all 127.0.0.53.

Signed-off-by: David Anderson <danderson@tailscale.com>
 2021-09-04 22:32:28 -07:00