2020-02-05 22:16:58 +00:00
|
|
|
// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
|
|
|
|
// Use of this source code is governed by a BSD-style
|
|
|
|
// license that can be found in the LICENSE file.
|
|
|
|
|
|
|
|
package wgengine
|
|
|
|
|
|
|
|
import (
|
|
|
|
"bufio"
|
2020-04-08 15:42:38 +00:00
|
|
|
"bytes"
|
2021-03-23 22:16:15 +00:00
|
|
|
crand "crypto/rand"
|
2020-05-17 16:51:38 +00:00
|
|
|
"errors"
|
2020-02-05 22:16:58 +00:00
|
|
|
"fmt"
|
2020-04-08 15:42:38 +00:00
|
|
|
"io"
|
2022-05-02 16:35:32 +00:00
|
|
|
"net"
|
2022-07-25 03:08:42 +00:00
|
|
|
"net/netip"
|
2021-04-01 16:35:41 +00:00
|
|
|
"reflect"
|
2020-04-10 20:44:08 +00:00
|
|
|
"runtime"
|
2020-02-05 22:16:58 +00:00
|
|
|
"strings"
|
|
|
|
"sync"
|
2020-06-09 18:00:48 +00:00
|
|
|
"sync/atomic"
|
2020-02-05 22:16:58 +00:00
|
|
|
"time"
|
|
|
|
|
2020-04-08 15:42:38 +00:00
|
|
|
"go4.org/mem"
|
2021-05-25 19:42:22 +00:00
|
|
|
"golang.zx2c4.com/wireguard/device"
|
|
|
|
"golang.zx2c4.com/wireguard/tun"
|
2020-06-25 18:04:52 +00:00
|
|
|
"tailscale.com/control/controlclient"
|
2022-01-24 18:52:57 +00:00
|
|
|
"tailscale.com/envknob"
|
2021-02-18 16:58:13 +00:00
|
|
|
"tailscale.com/health"
|
2020-03-26 05:57:46 +00:00
|
|
|
"tailscale.com/ipn/ipnstate"
|
2021-04-02 07:34:32 +00:00
|
|
|
"tailscale.com/net/dns"
|
2021-04-01 04:54:38 +00:00
|
|
|
"tailscale.com/net/dns/resolver"
|
2021-01-12 03:07:08 +00:00
|
|
|
"tailscale.com/net/flowtrack"
|
2020-03-13 03:10:11 +00:00
|
|
|
"tailscale.com/net/interfaces"
|
2020-11-10 00:16:04 +00:00
|
|
|
"tailscale.com/net/packet"
|
2020-07-31 20:27:09 +00:00
|
|
|
"tailscale.com/net/tsaddr"
|
2021-12-01 04:39:12 +00:00
|
|
|
"tailscale.com/net/tsdial"
|
2020-09-21 21:02:58 +00:00
|
|
|
"tailscale.com/net/tshttpproxy"
|
2021-03-27 05:14:08 +00:00
|
|
|
"tailscale.com/net/tstun"
|
2020-02-05 22:16:58 +00:00
|
|
|
"tailscale.com/tailcfg"
|
2021-07-21 19:14:04 +00:00
|
|
|
"tailscale.com/tstime/mono"
|
2021-08-03 13:56:31 +00:00
|
|
|
"tailscale.com/types/dnstype"
|
2021-03-21 04:45:47 +00:00
|
|
|
"tailscale.com/types/ipproto"
|
2020-03-26 05:57:46 +00:00
|
|
|
"tailscale.com/types/key"
|
2020-02-15 03:23:16 +00:00
|
|
|
"tailscale.com/types/logger"
|
2021-02-05 23:44:46 +00:00
|
|
|
"tailscale.com/types/netmap"
|
2021-11-17 00:01:42 +00:00
|
|
|
"tailscale.com/util/clientmetric"
|
2021-07-03 04:30:29 +00:00
|
|
|
"tailscale.com/util/deephash"
|
2022-04-22 01:49:01 +00:00
|
|
|
"tailscale.com/util/mak"
|
2020-07-29 23:14:35 +00:00
|
|
|
"tailscale.com/version"
|
2020-02-05 22:16:58 +00:00
|
|
|
"tailscale.com/wgengine/filter"
|
|
|
|
"tailscale.com/wgengine/magicsock"
|
2020-02-17 17:00:38 +00:00
|
|
|
"tailscale.com/wgengine/monitor"
|
2020-04-30 20:20:09 +00:00
|
|
|
"tailscale.com/wgengine/router"
|
2021-01-29 20:16:36 +00:00
|
|
|
"tailscale.com/wgengine/wgcfg"
|
2021-01-21 20:33:54 +00:00
|
|
|
"tailscale.com/wgengine/wglog"
|
2020-02-05 22:16:58 +00:00
|
|
|
)
|
|
|
|
|
2020-12-20 00:43:25 +00:00
|
|
|
const magicDNSPort = 53
|
|
|
|
|
2022-01-04 21:33:08 +00:00
|
|
|
var (
|
|
|
|
magicDNSIP = tsaddr.TailscaleServiceIP()
|
|
|
|
magicDNSIPv6 = tsaddr.TailscaleServiceIPv6()
|
|
|
|
)
|
2020-07-07 19:25:32 +00:00
|
|
|
|
2020-07-23 22:15:28 +00:00
|
|
|
// Lazy wireguard-go configuration parameters.
|
|
|
|
const (
|
|
|
|
// lazyPeerIdleThreshold is the idle duration after
|
|
|
|
// which we remove a peer from the wireguard configuration.
|
|
|
|
// (This includes peers that have never been idle, which
|
|
|
|
// effectively have infinite idleness)
|
|
|
|
lazyPeerIdleThreshold = 5 * time.Minute
|
2020-07-31 19:40:49 +00:00
|
|
|
|
|
|
|
// packetSendTimeUpdateFrequency controls how often we record
|
|
|
|
// the time that we wrote a packet to an IP address.
|
|
|
|
packetSendTimeUpdateFrequency = 10 * time.Second
|
|
|
|
|
|
|
|
// packetSendRecheckWireguardThreshold controls how long we can go
|
|
|
|
// between packet sends to an IP before checking to see
|
|
|
|
// whether this IP address needs to be added back to the
|
2022-05-04 19:10:17 +00:00
|
|
|
// WireGuard peer oconfig.
|
2020-07-31 19:40:49 +00:00
|
|
|
packetSendRecheckWireguardThreshold = 1 * time.Minute
|
2020-07-23 22:15:28 +00:00
|
|
|
)
|
|
|
|
|
2021-04-27 19:26:23 +00:00
|
|
|
// statusPollInterval is how often we ask wireguard-go for its engine
|
|
|
|
// status (as long as there's activity). See docs on its use below.
|
|
|
|
const statusPollInterval = 1 * time.Minute
|
|
|
|
|
2020-02-05 22:16:58 +00:00
|
|
|
type userspaceEngine struct {
|
2021-02-28 05:42:34 +00:00
|
|
|
logf logger.Logf
|
|
|
|
wgLogger *wglog.Logger //a wireguard-go logging wrapper
|
|
|
|
reqCh chan struct{}
|
|
|
|
waitCh chan struct{} // chan is closed when first Close call completes; contrast with closing bool
|
2021-07-21 19:14:04 +00:00
|
|
|
timeNow func() mono.Time
|
2021-03-27 06:13:20 +00:00
|
|
|
tundev *tstun.Wrapper
|
2021-02-28 05:42:34 +00:00
|
|
|
wgdev *device.Device
|
|
|
|
router router.Router
|
2021-06-22 20:13:59 +00:00
|
|
|
confListenPort uint16 // original conf.ListenPort
|
2021-04-03 02:24:02 +00:00
|
|
|
dns *dns.Manager
|
2021-02-28 05:42:34 +00:00
|
|
|
magicConn *magicsock.Conn
|
|
|
|
linkMon *monitor.Mon
|
2021-08-30 16:45:55 +00:00
|
|
|
linkMonOwned bool // whether we created linkMon (and thus need to close it)
|
|
|
|
linkMonUnregister func() // unsubscribes from changes; used regardless of linkMonOwned
|
|
|
|
birdClient BIRDClient // or nil
|
2020-06-09 18:00:48 +00:00
|
|
|
|
2020-08-06 21:57:03 +00:00
|
|
|
testMaybeReconfigHook func() // for tests; if non-nil, fires if maybeReconfigWireguardLocked called
|
|
|
|
|
2021-03-28 05:40:38 +00:00
|
|
|
// isLocalAddr reports the whether an IP is assigned to the local
|
2020-06-09 18:00:48 +00:00
|
|
|
// tunnel interface. It's used to reflect local packets
|
|
|
|
// incorrectly sent to us.
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
isLocalAddr atomic.Value // of func(netip.Addr)bool
|
2020-12-20 00:43:25 +00:00
|
|
|
|
2021-06-23 04:53:43 +00:00
|
|
|
// isDNSIPOverTailscale reports the whether a DNS resolver's IP
|
|
|
|
// is being routed over Tailscale.
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
isDNSIPOverTailscale atomic.Value // of func(netip.Addr)bool
|
2021-06-23 04:53:43 +00:00
|
|
|
|
2020-12-20 00:43:25 +00:00
|
|
|
wgLock sync.Mutex // serializes all wgdev operations; see lock order comment below
|
|
|
|
lastCfgFull wgcfg.Config
|
2021-08-18 22:06:40 +00:00
|
|
|
lastNMinPeers int
|
2021-07-20 05:49:51 +00:00
|
|
|
lastRouterSig deephash.Sum // of router.Config
|
|
|
|
lastEngineSigFull deephash.Sum // of full wireguard config
|
|
|
|
lastEngineSigTrim deephash.Sum // of trimmed wireguard config
|
2021-07-26 05:33:30 +00:00
|
|
|
lastDNSConfig *dns.Config
|
2022-03-16 16:46:19 +00:00
|
|
|
lastIsSubnetRouter bool // was the node a primary subnet router in the last run.
|
2021-11-02 01:21:48 +00:00
|
|
|
recvActivityAt map[key.NodePublic]mono.Time
|
|
|
|
trimmedNodes map[key.NodePublic]bool // set of node keys of peers currently excluded from wireguard config
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
sentActivityAt map[netip.Addr]*mono.Time // value is accessed atomically
|
|
|
|
destIPActivityFuncs map[netip.Addr]func()
|
2021-01-26 18:20:13 +00:00
|
|
|
statusBufioReader *bufio.Reader // reusable for UAPI
|
2021-07-21 19:14:04 +00:00
|
|
|
lastStatusPollTime mono.Time // last time we polled the engine status
|
2020-02-05 22:16:58 +00:00
|
|
|
|
2021-03-23 04:25:43 +00:00
|
|
|
mu sync.Mutex // guards following; see lock order comment below
|
|
|
|
netMap *netmap.NetworkMap // or nil
|
|
|
|
closing bool // Close was called (even if we're still closing)
|
2021-01-15 14:16:28 +00:00
|
|
|
statusCallback StatusCallback
|
2021-11-02 01:21:48 +00:00
|
|
|
peerSequence []key.NodePublic
|
tailcfg: add Endpoint, EndpointType, MapRequest.EndpointType
Track endpoints internally with a new tailcfg.Endpoint type that
includes a typed netaddr.IPPort (instead of just a string) and
includes a type for how that endpoint was discovered (STUN, local,
etc).
Use []tailcfg.Endpoint instead of []string internally.
At the last second, send it to the control server as the existing
[]string for endpoints, but also include a new parallel
MapRequest.EndpointType []tailcfg.EndpointType, so the control server
can start filtering out less-important endpoint changes from
new-enough clients. Notably, STUN-discovered endpoints can be filtered
out from 1.6+ clients, as they can discover them amongst each other
via CallMeMaybe disco exchanges started over DERP. And STUN endpoints
change a lot, causing a lot of MapResposne updates. But portmapped
endpoints are worth keeping for now, as they they work right away
without requiring the firewall traversal extra RTT dance.
End result will be less control->client bandwidth. (despite negligible
increase in client->control bandwidth)
Updates tailscale/corp#1543
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-12 20:24:29 +00:00
|
|
|
endpoints []tailcfg.Endpoint
|
2021-01-15 14:16:28 +00:00
|
|
|
pendOpen map[flowtrack.Tuple]*pendingOpenFlow // see pendopen.go
|
|
|
|
networkMapCallbacks map[*someHandle]NetworkMapCallback
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
tsIPByIPPort map[netip.AddrPort]netip.Addr // allows registration of IP:ports as belonging to a certain Tailscale IP for whois lookups
|
2022-04-22 01:49:01 +00:00
|
|
|
|
|
|
|
// pongCallback is the map of response handlers waiting for disco or TSMP
|
|
|
|
// pong callbacks. The map key is a random slice of bytes.
|
|
|
|
pongCallback map[[8]byte]func(packet.TSMPPongReply)
|
|
|
|
// icmpEchoResponseCallback is the map of reponse handlers waiting for ICMP
|
|
|
|
// echo responses. The map key is a random uint32 that is the little endian
|
|
|
|
// value of the ICMP identifer and sequence number concatenated.
|
|
|
|
icmpEchoResponseCallback map[uint32]func()
|
2020-03-25 15:40:36 +00:00
|
|
|
|
2020-08-05 23:36:53 +00:00
|
|
|
// Lock ordering: magicsock.Conn.mu, wgLock, then mu.
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
|
|
|
|
2021-03-01 18:08:53 +00:00
|
|
|
// InternalsGetter is implemented by Engines that can export their internals.
|
|
|
|
type InternalsGetter interface {
|
2022-04-14 21:55:23 +00:00
|
|
|
GetInternals() (_ *tstun.Wrapper, _ *magicsock.Conn, _ *dns.Manager, ok bool)
|
2021-03-01 18:08:53 +00:00
|
|
|
}
|
|
|
|
|
2022-04-14 21:55:23 +00:00
|
|
|
func (e *userspaceEngine) GetInternals() (_ *tstun.Wrapper, _ *magicsock.Conn, _ *dns.Manager, ok bool) {
|
|
|
|
return e.tundev, e.magicConn, e.dns, true
|
2021-03-01 18:08:53 +00:00
|
|
|
}
|
|
|
|
|
2021-11-23 05:45:34 +00:00
|
|
|
// ResolvingEngine is implemented by Engines that have DNS resolvers.
|
|
|
|
type ResolvingEngine interface {
|
|
|
|
GetResolver() (_ *resolver.Resolver, ok bool)
|
|
|
|
}
|
|
|
|
|
|
|
|
var (
|
|
|
|
_ ResolvingEngine = (*userspaceEngine)(nil)
|
|
|
|
_ ResolvingEngine = (*watchdogEngine)(nil)
|
|
|
|
)
|
|
|
|
|
|
|
|
func (e *userspaceEngine) GetResolver() (r *resolver.Resolver, ok bool) {
|
|
|
|
return e.dns.Resolver(), true
|
|
|
|
}
|
|
|
|
|
2021-08-30 16:45:55 +00:00
|
|
|
// BIRDClient handles communication with the BIRD Internet Routing Daemon.
|
|
|
|
type BIRDClient interface {
|
|
|
|
EnableProtocol(proto string) error
|
|
|
|
DisableProtocol(proto string) error
|
|
|
|
Close() error
|
|
|
|
}
|
|
|
|
|
2021-02-28 05:42:34 +00:00
|
|
|
// Config is the engine configuration.
|
|
|
|
type Config struct {
|
2021-03-29 02:25:01 +00:00
|
|
|
// Tun is the device used by the Engine to exchange packets with
|
|
|
|
// the OS.
|
|
|
|
// If nil, a fake Device that does nothing is used.
|
|
|
|
Tun tun.Device
|
|
|
|
|
2021-07-23 16:45:04 +00:00
|
|
|
// IsTAP is whether Tun is actually a TAP (Layer 2) device that'll
|
|
|
|
// require ethernet headers.
|
|
|
|
IsTAP bool
|
|
|
|
|
2022-07-21 04:38:51 +00:00
|
|
|
// IsVETh is whether Tun is actually a veth/xdp (Layer 2) device
|
|
|
|
// that will require ethernet headers.
|
|
|
|
IsVETH bool
|
|
|
|
|
2021-03-29 01:59:33 +00:00
|
|
|
// Router interfaces the Engine to the OS network stack.
|
|
|
|
// If nil, a fake Router that does nothing is used.
|
2021-03-27 04:47:28 +00:00
|
|
|
Router router.Router
|
2021-02-28 05:42:34 +00:00
|
|
|
|
2021-04-03 02:24:02 +00:00
|
|
|
// DNS interfaces the Engine to the OS DNS resolver configuration.
|
|
|
|
// If nil, a fake OSConfigurator that does nothing is used.
|
|
|
|
DNS dns.OSConfigurator
|
|
|
|
|
2021-02-28 05:48:00 +00:00
|
|
|
// LinkMonitor optionally provides an existing link monitor to re-use.
|
|
|
|
// If nil, a new link monitor is created.
|
|
|
|
LinkMonitor *monitor.Mon
|
|
|
|
|
2021-12-01 04:39:12 +00:00
|
|
|
// Dialer is the dialer to use for outbound connections.
|
|
|
|
// If nil, a new Dialer is created
|
|
|
|
Dialer *tsdial.Dialer
|
|
|
|
|
2020-06-08 22:19:26 +00:00
|
|
|
// ListenPort is the port on which the engine will listen.
|
2021-02-28 05:42:34 +00:00
|
|
|
// If zero, a port is automatically selected.
|
2020-06-08 22:19:26 +00:00
|
|
|
ListenPort uint16
|
2021-02-28 05:42:34 +00:00
|
|
|
|
2021-03-29 02:50:56 +00:00
|
|
|
// RespondToPing determines whether this engine should internally
|
|
|
|
// reply to ICMP pings, without involving the OS.
|
|
|
|
// Used in "fake" mode for development.
|
|
|
|
RespondToPing bool
|
2021-08-30 16:45:55 +00:00
|
|
|
|
|
|
|
// BIRDClient, if non-nil, will be used to configure BIRD whenever
|
|
|
|
// this node is a primary subnet router.
|
|
|
|
BIRDClient BIRDClient
|
2020-06-08 22:19:26 +00:00
|
|
|
}
|
|
|
|
|
2021-03-01 18:08:53 +00:00
|
|
|
func NewFakeUserspaceEngine(logf logger.Logf, listenPort uint16) (Engine, error) {
|
2022-05-04 19:10:17 +00:00
|
|
|
logf("Starting userspace WireGuard engine (with fake TUN device)")
|
2021-03-29 02:25:01 +00:00
|
|
|
return NewUserspaceEngine(logf, Config{
|
2021-03-29 02:50:56 +00:00
|
|
|
ListenPort: listenPort,
|
|
|
|
RespondToPing: true,
|
2021-02-28 05:42:34 +00:00
|
|
|
})
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
|
|
|
|
2021-04-01 16:35:41 +00:00
|
|
|
// NetstackRouterType is a gross cross-package init-time registration
|
|
|
|
// from netstack to here, informing this package of netstack's router
|
|
|
|
// type.
|
|
|
|
var NetstackRouterType reflect.Type
|
|
|
|
|
|
|
|
// IsNetstackRouter reports whether e is either fully netstack based
|
|
|
|
// (without TUN) or is at least using netstack for routing.
|
|
|
|
func IsNetstackRouter(e Engine) bool {
|
|
|
|
switch e := e.(type) {
|
|
|
|
case *userspaceEngine:
|
|
|
|
if reflect.TypeOf(e.router) == NetstackRouterType {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
case *watchdogEngine:
|
|
|
|
return IsNetstackRouter(e.wrap)
|
|
|
|
}
|
|
|
|
return IsNetstack(e)
|
|
|
|
}
|
|
|
|
|
2021-03-30 16:53:12 +00:00
|
|
|
// IsNetstack reports whether e is a netstack-based TUN-free engine.
|
|
|
|
func IsNetstack(e Engine) bool {
|
|
|
|
ig, ok := e.(InternalsGetter)
|
|
|
|
if !ok {
|
|
|
|
return false
|
|
|
|
}
|
2022-04-14 21:55:23 +00:00
|
|
|
tw, _, _, ok := ig.GetInternals()
|
2021-03-30 16:53:12 +00:00
|
|
|
if !ok {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
name, err := tw.Name()
|
|
|
|
return err == nil && name == "FakeTUN"
|
|
|
|
}
|
|
|
|
|
2020-04-30 20:20:09 +00:00
|
|
|
// NewUserspaceEngine creates the named tun device and returns a
|
|
|
|
// Tailscale Engine running on it.
|
2021-03-29 02:25:01 +00:00
|
|
|
func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error) {
|
2021-02-23 04:20:35 +00:00
|
|
|
var closePool closeOnErrorPool
|
|
|
|
defer closePool.closeAllIfError(&reterr)
|
|
|
|
|
2021-03-29 02:25:01 +00:00
|
|
|
if conf.Tun == nil {
|
2021-03-29 02:50:56 +00:00
|
|
|
logf("[v1] using fake (no-op) tun device")
|
2021-03-29 02:25:01 +00:00
|
|
|
conf.Tun = tstun.NewFake()
|
|
|
|
}
|
2021-03-27 04:47:28 +00:00
|
|
|
if conf.Router == nil {
|
2021-03-29 02:50:56 +00:00
|
|
|
logf("[v1] using fake (no-op) OS network configurator")
|
2021-03-29 01:59:33 +00:00
|
|
|
conf.Router = router.NewFake(logf)
|
2021-03-27 04:47:28 +00:00
|
|
|
}
|
2021-04-03 02:24:02 +00:00
|
|
|
if conf.DNS == nil {
|
|
|
|
logf("[v1] using fake (no-op) DNS configurator")
|
2021-04-12 22:51:37 +00:00
|
|
|
d, err := dns.NewNoopManager()
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
conf.DNS = d
|
2021-04-03 02:24:02 +00:00
|
|
|
}
|
2021-12-01 04:39:12 +00:00
|
|
|
if conf.Dialer == nil {
|
|
|
|
conf.Dialer = new(tsdial.Dialer)
|
|
|
|
}
|
2021-03-27 04:47:28 +00:00
|
|
|
|
2021-07-23 16:45:04 +00:00
|
|
|
var tsTUNDev *tstun.Wrapper
|
|
|
|
if conf.IsTAP {
|
|
|
|
tsTUNDev = tstun.WrapTAP(logf, conf.Tun)
|
2022-07-21 04:38:51 +00:00
|
|
|
} else if conf.IsVETH {
|
|
|
|
tsTUNDev = tstun.WrapVETH(logf, conf.Tun)
|
2021-07-23 16:45:04 +00:00
|
|
|
} else {
|
|
|
|
tsTUNDev = tstun.Wrap(logf, conf.Tun)
|
|
|
|
}
|
2021-02-28 05:42:34 +00:00
|
|
|
closePool.add(tsTUNDev)
|
2021-02-23 04:20:35 +00:00
|
|
|
|
2020-02-05 22:16:58 +00:00
|
|
|
e := &userspaceEngine{
|
2021-09-01 22:21:48 +00:00
|
|
|
timeNow: mono.Now,
|
|
|
|
logf: logf,
|
|
|
|
reqCh: make(chan struct{}, 1),
|
|
|
|
waitCh: make(chan struct{}),
|
|
|
|
tundev: tsTUNDev,
|
|
|
|
router: conf.Router,
|
|
|
|
confListenPort: conf.ListenPort,
|
|
|
|
birdClient: conf.BIRDClient,
|
2021-08-30 16:45:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if e.birdClient != nil {
|
|
|
|
// Disable the protocol at start time.
|
|
|
|
if err := e.birdClient.DisableProtocol("tailscale"); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
2021-05-05 19:58:40 +00:00
|
|
|
e.isLocalAddr.Store(tsaddr.NewContainsIPFunc(nil))
|
2021-06-23 04:53:43 +00:00
|
|
|
e.isDNSIPOverTailscale.Store(tsaddr.NewContainsIPFunc(nil))
|
2020-02-05 22:16:58 +00:00
|
|
|
|
2021-02-28 05:48:00 +00:00
|
|
|
if conf.LinkMonitor != nil {
|
|
|
|
e.linkMon = conf.LinkMonitor
|
|
|
|
} else {
|
|
|
|
mon, err := monitor.New(logf)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
closePool.add(mon)
|
|
|
|
e.linkMon = mon
|
|
|
|
e.linkMonOwned = true
|
2020-02-17 17:00:38 +00:00
|
|
|
}
|
2021-03-01 15:55:30 +00:00
|
|
|
|
2021-06-23 04:53:43 +00:00
|
|
|
tunName, _ := conf.Tun.Name()
|
2021-12-01 17:18:17 +00:00
|
|
|
conf.Dialer.SetTUNName(tunName)
|
2021-12-01 20:07:20 +00:00
|
|
|
conf.Dialer.SetLinkMonitor(e.linkMon)
|
2021-12-01 04:39:12 +00:00
|
|
|
e.dns = dns.NewManager(logf, conf.DNS, e.linkMon, conf.Dialer, fwdDNSLinkSelector{e, tunName})
|
2021-03-12 16:39:43 +00:00
|
|
|
|
2021-03-01 20:56:03 +00:00
|
|
|
logf("link state: %+v", e.linkMon.InterfaceState())
|
2021-03-01 15:55:30 +00:00
|
|
|
|
2021-03-01 20:56:03 +00:00
|
|
|
unregisterMonWatch := e.linkMon.RegisterChangeCallback(func(changed bool, st *interfaces.State) {
|
2021-02-28 03:33:21 +00:00
|
|
|
tshttpproxy.InvalidateCache()
|
2021-03-02 04:20:25 +00:00
|
|
|
e.linkChange(changed, st)
|
2021-02-28 03:33:21 +00:00
|
|
|
})
|
|
|
|
closePool.addFunc(unregisterMonWatch)
|
2021-02-28 05:42:34 +00:00
|
|
|
e.linkMonUnregister = unregisterMonWatch
|
2020-02-17 17:00:38 +00:00
|
|
|
|
tailcfg: add Endpoint, EndpointType, MapRequest.EndpointType
Track endpoints internally with a new tailcfg.Endpoint type that
includes a typed netaddr.IPPort (instead of just a string) and
includes a type for how that endpoint was discovered (STUN, local,
etc).
Use []tailcfg.Endpoint instead of []string internally.
At the last second, send it to the control server as the existing
[]string for endpoints, but also include a new parallel
MapRequest.EndpointType []tailcfg.EndpointType, so the control server
can start filtering out less-important endpoint changes from
new-enough clients. Notably, STUN-discovered endpoints can be filtered
out from 1.6+ clients, as they can discover them amongst each other
via CallMeMaybe disco exchanges started over DERP. And STUN endpoints
change a lot, causing a lot of MapResposne updates. But portmapped
endpoints are worth keeping for now, as they they work right away
without requiring the firewall traversal extra RTT dance.
End result will be less control->client bandwidth. (despite negligible
increase in client->control bandwidth)
Updates tailscale/corp#1543
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-12 20:24:29 +00:00
|
|
|
endpointsFn := func(endpoints []tailcfg.Endpoint) {
|
2020-08-25 19:14:57 +00:00
|
|
|
e.mu.Lock()
|
|
|
|
e.endpoints = append(e.endpoints[:0], endpoints...)
|
|
|
|
e.mu.Unlock()
|
|
|
|
|
2020-02-05 22:16:58 +00:00
|
|
|
e.RequestStatus()
|
|
|
|
}
|
|
|
|
magicsockOpts := magicsock.Options{
|
2020-07-23 22:15:28 +00:00
|
|
|
Logf: logf,
|
|
|
|
Port: conf.ListenPort,
|
|
|
|
EndpointsFunc: endpointsFn,
|
2020-08-25 20:21:29 +00:00
|
|
|
DERPActiveFunc: e.RequestStatus,
|
2020-07-23 22:15:28 +00:00
|
|
|
IdleFunc: e.tundev.IdleDuration,
|
2021-09-01 02:06:04 +00:00
|
|
|
NoteRecvActivity: e.noteRecvActivity,
|
2021-03-15 20:58:10 +00:00
|
|
|
LinkMonitor: e.linkMon,
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
2021-04-01 05:32:07 +00:00
|
|
|
|
2021-04-03 02:42:05 +00:00
|
|
|
var err error
|
2020-05-17 16:51:38 +00:00
|
|
|
e.magicConn, err = magicsock.NewConn(magicsockOpts)
|
2020-02-05 22:16:58 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("wgengine: %v", err)
|
|
|
|
}
|
2021-02-23 04:20:35 +00:00
|
|
|
closePool.add(e.magicConn)
|
2021-03-01 20:56:03 +00:00
|
|
|
e.magicConn.SetNetworkUp(e.linkMon.InterfaceState().AnyInterfaceUp())
|
2020-02-05 22:16:58 +00:00
|
|
|
|
2021-11-02 21:41:56 +00:00
|
|
|
tsTUNDev.SetDiscoKey(e.magicConn.DiscoPublicKey())
|
2021-09-13 21:21:40 +00:00
|
|
|
|
2021-03-29 02:50:56 +00:00
|
|
|
if conf.RespondToPing {
|
2021-03-01 18:08:53 +00:00
|
|
|
e.tundev.PostFilterIn = echoRespondToAll
|
2020-09-03 22:45:41 +00:00
|
|
|
}
|
2022-04-14 21:59:46 +00:00
|
|
|
e.tundev.PreFilterFromTunToEngine = e.handleLocalPackets
|
2020-09-03 22:45:41 +00:00
|
|
|
|
2022-01-24 18:52:57 +00:00
|
|
|
if envknob.BoolDefaultTrue("TS_DEBUG_CONNECT_FAILURES") {
|
2021-01-12 03:07:08 +00:00
|
|
|
if e.tundev.PreFilterIn != nil {
|
|
|
|
return nil, errors.New("unexpected PreFilterIn already set")
|
|
|
|
}
|
|
|
|
e.tundev.PreFilterIn = e.trackOpenPreFilterIn
|
|
|
|
if e.tundev.PostFilterOut != nil {
|
|
|
|
return nil, errors.New("unexpected PostFilterOut already set")
|
|
|
|
}
|
|
|
|
e.tundev.PostFilterOut = e.trackOpenPostFilterOut
|
|
|
|
}
|
|
|
|
|
2021-01-21 20:33:54 +00:00
|
|
|
e.wgLogger = wglog.NewLogger(logf)
|
2021-03-29 22:17:05 +00:00
|
|
|
e.tundev.OnTSMPPongReceived = func(pong packet.TSMPPongReply) {
|
2021-03-23 22:16:15 +00:00
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
2021-03-29 22:17:05 +00:00
|
|
|
cb := e.pongCallback[pong.Data]
|
|
|
|
e.logf("wgengine: got TSMP pong %02x, peerAPIPort=%v; cb=%v", pong.Data, pong.PeerAPIPort, cb != nil)
|
2021-03-23 22:16:15 +00:00
|
|
|
if cb != nil {
|
2021-03-29 22:17:05 +00:00
|
|
|
go cb(pong)
|
2021-03-23 22:16:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-04-22 01:49:01 +00:00
|
|
|
e.tundev.OnICMPEchoResponseReceived = func(p *packet.Parsed) bool {
|
|
|
|
idSeq := p.EchoIDSeq()
|
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
|
|
|
cb := e.icmpEchoResponseCallback[idSeq]
|
|
|
|
if cb == nil {
|
|
|
|
// We didn't swallow it, so let it flow to the host.
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
e.logf("wgengine: got diagnostic ICMP response %02x", idSeq)
|
|
|
|
go cb()
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
2020-05-10 22:34:16 +00:00
|
|
|
// wgdev takes ownership of tundev, will close it when closed.
|
2022-05-04 19:10:17 +00:00
|
|
|
e.logf("Creating WireGuard device...")
|
2021-11-16 19:35:25 +00:00
|
|
|
e.wgdev = wgcfg.NewDevice(e.tundev, e.magicConn.Bind(), e.wgLogger.DeviceLogger)
|
2021-02-23 04:20:35 +00:00
|
|
|
closePool.addFunc(e.wgdev.Close)
|
2021-03-24 16:41:57 +00:00
|
|
|
closePool.addFunc(func() {
|
|
|
|
if err := e.magicConn.Close(); err != nil {
|
|
|
|
e.logf("error closing magicconn: %v", err)
|
|
|
|
}
|
|
|
|
})
|
2020-02-14 23:03:25 +00:00
|
|
|
|
2020-02-05 22:16:58 +00:00
|
|
|
go func() {
|
|
|
|
up := false
|
2021-04-26 23:27:34 +00:00
|
|
|
for event := range e.tundev.EventsUpDown() {
|
2020-02-05 22:16:58 +00:00
|
|
|
if event&tun.EventUp != 0 && !up {
|
|
|
|
e.logf("external route: up")
|
|
|
|
e.RequestStatus()
|
|
|
|
up = true
|
|
|
|
}
|
|
|
|
if event&tun.EventDown != 0 && up {
|
|
|
|
e.logf("external route: down")
|
|
|
|
e.RequestStatus()
|
|
|
|
up = false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
|
2022-05-04 19:10:17 +00:00
|
|
|
e.logf("Bringing WireGuard device up...")
|
2021-10-18 17:09:51 +00:00
|
|
|
if err := e.wgdev.Up(); err != nil {
|
2021-11-19 18:33:15 +00:00
|
|
|
return nil, fmt.Errorf("wgdev.Up: %w", err)
|
2021-10-18 17:09:51 +00:00
|
|
|
}
|
2020-09-23 22:27:30 +00:00
|
|
|
e.logf("Bringing router up...")
|
2020-02-05 22:16:58 +00:00
|
|
|
if err := e.router.Up(); err != nil {
|
2021-11-19 18:33:15 +00:00
|
|
|
return nil, fmt.Errorf("router.Up: %w", err)
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
2021-02-23 04:20:35 +00:00
|
|
|
|
|
|
|
// It's a little pointless to apply no-op settings here (they
|
|
|
|
// should already be empty?), but it at least exercises the
|
2021-08-30 15:37:23 +00:00
|
|
|
// router implementation early on.
|
2020-09-23 22:27:30 +00:00
|
|
|
e.logf("Clearing router settings...")
|
2020-05-12 07:08:52 +00:00
|
|
|
if err := e.router.Set(nil); err != nil {
|
2021-11-19 18:33:15 +00:00
|
|
|
return nil, fmt.Errorf("router.Set(nil): %w", err)
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
2020-09-23 22:27:30 +00:00
|
|
|
e.logf("Starting link monitor...")
|
2020-02-17 17:00:38 +00:00
|
|
|
e.linkMon.Start()
|
2020-02-05 22:16:58 +00:00
|
|
|
|
2020-07-07 19:25:32 +00:00
|
|
|
go e.pollResolver()
|
|
|
|
|
2020-09-23 22:27:30 +00:00
|
|
|
e.logf("Engine created.")
|
2020-02-05 22:16:58 +00:00
|
|
|
return e, nil
|
|
|
|
}
|
|
|
|
|
2020-06-08 22:19:26 +00:00
|
|
|
// echoRespondToAll is an inbound post-filter responding to all echo requests.
|
2021-03-27 06:13:20 +00:00
|
|
|
func echoRespondToAll(p *packet.Parsed, t *tstun.Wrapper) filter.Response {
|
2020-06-08 22:19:26 +00:00
|
|
|
if p.IsEchoRequest() {
|
2020-11-10 09:00:35 +00:00
|
|
|
header := p.ICMP4Header()
|
2020-06-08 22:19:26 +00:00
|
|
|
header.ToResponse()
|
2020-10-06 02:41:16 +00:00
|
|
|
outp := packet.Generate(&header, p.Payload())
|
|
|
|
t.InjectOutbound(outp)
|
|
|
|
// We already responded to it, but it's not an error.
|
|
|
|
// Proceed with regular delivery. (Since this code is only
|
|
|
|
// used in fake mode, regular delivery just means throwing
|
|
|
|
// it away. If this ever gets run in non-fake mode, you'll
|
|
|
|
// get double responses to pings, which is an indicator you
|
|
|
|
// shouldn't be doing that I guess.)
|
|
|
|
return filter.Accept
|
2020-06-08 22:19:26 +00:00
|
|
|
}
|
|
|
|
return filter.Accept
|
|
|
|
}
|
|
|
|
|
2020-06-09 18:00:48 +00:00
|
|
|
// handleLocalPackets inspects packets coming from the local network
|
|
|
|
// stack, and intercepts any packets that should be handled by
|
|
|
|
// tailscaled directly. Other packets are allowed to proceed into the
|
|
|
|
// main ACL filter.
|
2021-03-27 06:13:20 +00:00
|
|
|
func (e *userspaceEngine) handleLocalPackets(p *packet.Parsed, t *tstun.Wrapper) filter.Response {
|
2022-04-14 22:17:26 +00:00
|
|
|
// Handle traffic to the service IP.
|
|
|
|
// TODO(tom): Netstack handles this when it is installed. Rip all
|
|
|
|
// this out once netstack is used on all platforms.
|
2022-07-25 03:08:42 +00:00
|
|
|
switch p.Dst.Addr() {
|
2022-04-14 22:17:26 +00:00
|
|
|
case magicDNSIP, magicDNSIPv6:
|
|
|
|
err := e.dns.EnqueuePacket(append([]byte(nil), p.Payload()...), p.IPProto, p.Src, p.Dst)
|
|
|
|
if err != nil {
|
|
|
|
e.logf("dns: enqueue: %v", err)
|
|
|
|
}
|
2021-11-17 00:01:42 +00:00
|
|
|
metricMagicDNSPacketIn.Add(1)
|
2020-07-31 20:27:09 +00:00
|
|
|
return filter.Drop
|
2020-06-09 18:00:48 +00:00
|
|
|
}
|
|
|
|
|
2021-03-28 05:40:38 +00:00
|
|
|
if runtime.GOOS == "darwin" || runtime.GOOS == "ios" {
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
isLocalAddr, ok := e.isLocalAddr.Load().(func(netip.Addr) bool)
|
2021-03-28 05:40:38 +00:00
|
|
|
if !ok {
|
|
|
|
e.logf("[unexpected] e.isLocalAddr was nil, can't check for loopback packet")
|
2022-07-25 03:08:42 +00:00
|
|
|
} else if isLocalAddr(p.Dst.Addr()) {
|
2021-03-28 05:40:38 +00:00
|
|
|
// macOS NetworkExtension directs packets destined to the
|
|
|
|
// tunnel's local IP address into the tunnel, instead of
|
|
|
|
// looping back within the kernel network stack. We have to
|
|
|
|
// notice that an outbound packet is actually destined for
|
|
|
|
// ourselves, and loop it back into macOS.
|
|
|
|
t.InjectInboundCopy(p.Buffer())
|
2021-11-17 00:01:42 +00:00
|
|
|
metricReflectToOS.Add(1)
|
2021-03-28 05:40:38 +00:00
|
|
|
return filter.Drop
|
|
|
|
}
|
2020-06-09 18:00:48 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return filter.Accept
|
|
|
|
}
|
|
|
|
|
2022-04-08 19:17:31 +00:00
|
|
|
// pollResolver reads packets from the DNS resolver and injects them inbound.
|
2022-04-14 22:17:26 +00:00
|
|
|
//
|
|
|
|
// TODO(tom): Remove this fallback path (via NextPacket()) once
|
|
|
|
// all platforms use netstack.
|
2020-07-07 19:25:32 +00:00
|
|
|
func (e *userspaceEngine) pollResolver() {
|
|
|
|
for {
|
2022-04-08 19:17:31 +00:00
|
|
|
bs, err := e.dns.NextPacket()
|
2022-05-02 16:35:32 +00:00
|
|
|
if errors.Is(err, net.ErrClosed) {
|
2020-07-07 19:25:32 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
if err != nil {
|
2021-03-25 21:50:21 +00:00
|
|
|
e.logf("dns: error: %v", err)
|
2020-07-07 19:25:32 +00:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2022-04-08 19:17:31 +00:00
|
|
|
// The leading empty space required by the semantics of
|
|
|
|
// InjectInboundDirect is allocated in NextPacket().
|
|
|
|
e.tundev.InjectInboundDirect(bs, tstun.PacketStartOffset)
|
2020-07-07 19:25:32 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-01-24 18:52:57 +00:00
|
|
|
var debugTrimWireguard = envknob.OptBool("TS_DEBUG_TRIM_WIREGUARD")
|
2020-07-29 23:14:35 +00:00
|
|
|
|
|
|
|
// forceFullWireguardConfig reports whether we should give wireguard
|
|
|
|
// our full network map, even for inactive peers
|
|
|
|
//
|
|
|
|
// TODO(bradfitz): remove this after our 1.0 launch; we don't want to
|
|
|
|
// enable wireguard config trimming quite yet because it just landed
|
|
|
|
// and we haven't got enough time testing it.
|
|
|
|
func forceFullWireguardConfig(numPeers int) bool {
|
|
|
|
// Did the user explicitly enable trimmming via the environment variable knob?
|
2022-01-24 18:52:57 +00:00
|
|
|
if b, ok := debugTrimWireguard.Get(); ok {
|
|
|
|
return !b
|
2020-07-29 23:14:35 +00:00
|
|
|
}
|
2020-08-20 20:21:25 +00:00
|
|
|
if opt := controlclient.TrimWGConfig(); opt != "" {
|
|
|
|
return !opt.EqualBool(true)
|
|
|
|
}
|
|
|
|
|
2020-07-29 23:14:35 +00:00
|
|
|
// On iOS with large networks, it's critical, so turn on trimming.
|
|
|
|
// Otherwise we run out of memory from wireguard-go goroutine stacks+buffers.
|
|
|
|
// This will be the default later for all platforms and network sizes.
|
2020-11-11 17:04:34 +00:00
|
|
|
if numPeers > 50 && version.OS() == "iOS" {
|
2020-07-29 23:14:35 +00:00
|
|
|
return false
|
|
|
|
}
|
2020-08-21 03:13:39 +00:00
|
|
|
return false
|
2020-07-29 23:14:35 +00:00
|
|
|
}
|
|
|
|
|
2020-07-23 22:15:28 +00:00
|
|
|
// isTrimmablePeer reports whether p is a peer that we can trim out of the
|
|
|
|
// network map.
|
|
|
|
//
|
2021-09-01 02:06:04 +00:00
|
|
|
// For implementation simplificy, we can only trim peers that have
|
|
|
|
// only non-subnet AllowedIPs (an IPv4 /32 or IPv6 /128), which is the
|
|
|
|
// common case for most peers. Subnet router nodes will just always be
|
|
|
|
// created in the wireguard-go config.
|
2020-07-29 23:14:35 +00:00
|
|
|
func isTrimmablePeer(p *wgcfg.Peer, numPeers int) bool {
|
|
|
|
if forceFullWireguardConfig(numPeers) {
|
|
|
|
return false
|
|
|
|
}
|
2020-12-15 10:31:33 +00:00
|
|
|
|
|
|
|
// AllowedIPs must all be single IPs, not subnets.
|
|
|
|
for _, aip := range p.AllowedIPs {
|
2020-12-24 20:33:55 +00:00
|
|
|
if !aip.IsSingleIP() {
|
2020-12-15 10:31:33 +00:00
|
|
|
return false
|
|
|
|
}
|
2020-07-23 22:15:28 +00:00
|
|
|
}
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
2021-09-01 02:06:04 +00:00
|
|
|
// noteRecvActivity is called by magicsock when a packet has been
|
|
|
|
// received for the peer with node key nk. Magicsock calls this no
|
|
|
|
// more than every 10 seconds for a given peer.
|
2021-11-02 01:21:48 +00:00
|
|
|
func (e *userspaceEngine) noteRecvActivity(nk key.NodePublic) {
|
2020-07-23 22:15:28 +00:00
|
|
|
e.wgLock.Lock()
|
|
|
|
defer e.wgLock.Unlock()
|
|
|
|
|
2021-09-01 02:06:04 +00:00
|
|
|
if _, ok := e.recvActivityAt[nk]; !ok {
|
2020-07-23 22:15:28 +00:00
|
|
|
// Not a trimmable peer we care about tracking. (See isTrimmablePeer)
|
2021-09-01 02:06:04 +00:00
|
|
|
if e.trimmedNodes[nk] {
|
|
|
|
e.logf("wgengine: [unexpected] noteReceiveActivity called on idle node %v that's not in recvActivityAt", nk.ShortString())
|
2020-08-26 19:20:09 +00:00
|
|
|
}
|
2020-07-23 22:15:28 +00:00
|
|
|
return
|
|
|
|
}
|
2020-08-06 21:57:03 +00:00
|
|
|
now := e.timeNow()
|
2021-09-01 02:06:04 +00:00
|
|
|
e.recvActivityAt[nk] = now
|
2020-07-23 22:15:28 +00:00
|
|
|
|
2021-04-27 19:26:23 +00:00
|
|
|
// As long as there's activity, periodically poll the engine to get
|
|
|
|
// stats for the far away side effect of
|
|
|
|
// ipn/ipnlocal.LocalBackend.parseWgStatusLocked to log activity, for
|
|
|
|
// use in various admin dashboards.
|
|
|
|
// This particularly matters on platforms without a connected GUI, as
|
|
|
|
// the GUIs generally poll this enough to cause that logging. But
|
|
|
|
// tailscaled alone did not, hence this.
|
|
|
|
if e.lastStatusPollTime.IsZero() || now.Sub(e.lastStatusPollTime) >= statusPollInterval {
|
|
|
|
e.lastStatusPollTime = now
|
|
|
|
go e.RequestStatus()
|
|
|
|
}
|
|
|
|
|
2020-07-23 22:15:28 +00:00
|
|
|
// If the last activity time jumped a bunch (say, at least
|
|
|
|
// half the idle timeout) then see if we need to reprogram
|
2022-05-04 19:10:17 +00:00
|
|
|
// WireGuard. This could probably be just
|
2020-07-23 22:15:28 +00:00
|
|
|
// lazyPeerIdleThreshold without the divide by 2, but
|
|
|
|
// maybeReconfigWireguardLocked is cheap enough to call every
|
|
|
|
// couple minutes (just not on every packet).
|
2021-09-01 02:06:04 +00:00
|
|
|
if e.trimmedNodes[nk] {
|
2022-05-04 19:10:17 +00:00
|
|
|
e.logf("wgengine: idle peer %v now active, reconfiguring WireGuard", nk.ShortString())
|
2020-11-16 23:17:24 +00:00
|
|
|
e.maybeReconfigWireguardLocked(nil)
|
2020-07-23 22:15:28 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-09-01 02:06:04 +00:00
|
|
|
// isActiveSinceLocked reports whether the peer identified by (nk, ip)
|
|
|
|
// has had a packet sent to or received from it since t.
|
2020-07-23 22:15:28 +00:00
|
|
|
//
|
|
|
|
// e.wgLock must be held.
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func (e *userspaceEngine) isActiveSinceLocked(nk key.NodePublic, ip netip.Addr, t mono.Time) bool {
|
2021-09-01 02:06:04 +00:00
|
|
|
if e.recvActivityAt[nk].After(t) {
|
2020-07-23 22:15:28 +00:00
|
|
|
return true
|
|
|
|
}
|
2020-12-24 20:33:55 +00:00
|
|
|
timePtr, ok := e.sentActivityAt[ip]
|
2020-07-23 22:15:28 +00:00
|
|
|
if !ok {
|
|
|
|
return false
|
|
|
|
}
|
2021-07-21 19:14:04 +00:00
|
|
|
return timePtr.LoadAtomic().After(t)
|
2020-07-23 22:15:28 +00:00
|
|
|
}
|
|
|
|
|
2020-11-16 23:17:24 +00:00
|
|
|
// discoChanged are the set of peers whose disco keys have changed, implying they've restarted.
|
|
|
|
// If a peer is in this set and was previously in the live wireguard config,
|
|
|
|
// it needs to be first removed and then re-added to flush out its wireguard session key.
|
|
|
|
// If discoChanged is nil or empty, this extra removal step isn't done.
|
|
|
|
//
|
2020-07-23 22:15:28 +00:00
|
|
|
// e.wgLock must be held.
|
2021-11-02 01:21:48 +00:00
|
|
|
func (e *userspaceEngine) maybeReconfigWireguardLocked(discoChanged map[key.NodePublic]bool) error {
|
2020-08-06 21:57:03 +00:00
|
|
|
if hook := e.testMaybeReconfigHook; hook != nil {
|
|
|
|
hook()
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-07-23 22:15:28 +00:00
|
|
|
full := e.lastCfgFull
|
2021-01-21 20:33:54 +00:00
|
|
|
e.wgLogger.SetPeers(full.Peers)
|
2020-07-23 22:15:28 +00:00
|
|
|
|
|
|
|
// Compute a minimal config to pass to wireguard-go
|
|
|
|
// based on the full config. Prune off all the peers
|
|
|
|
// and only add the active ones back.
|
|
|
|
min := full
|
2021-08-18 22:06:40 +00:00
|
|
|
min.Peers = make([]wgcfg.Peer, 0, e.lastNMinPeers)
|
2020-07-23 22:15:28 +00:00
|
|
|
|
|
|
|
// We'll only keep a peer around if it's been active in
|
|
|
|
// the past 5 minutes. That's more than WireGuard's key
|
|
|
|
// rotation time anyway so it's no harm if we remove it
|
|
|
|
// later if it's been inactive.
|
2020-08-06 21:57:03 +00:00
|
|
|
activeCutoff := e.timeNow().Add(-lazyPeerIdleThreshold)
|
2020-07-23 22:15:28 +00:00
|
|
|
|
|
|
|
// Not all peers can be trimmed from the network map (see
|
2021-09-01 02:06:04 +00:00
|
|
|
// isTrimmablePeer). For those are are trimmable, keep track of
|
|
|
|
// their NodeKey and Tailscale IPs. These are the ones we'll need
|
|
|
|
// to install tracking hooks for to watch their send/receive
|
|
|
|
// activity.
|
2021-11-02 01:21:48 +00:00
|
|
|
trackNodes := make([]key.NodePublic, 0, len(full.Peers))
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
trackIPs := make([]netip.Addr, 0, len(full.Peers))
|
2020-07-23 22:15:28 +00:00
|
|
|
|
2021-11-02 01:21:48 +00:00
|
|
|
trimmedNodes := map[key.NodePublic]bool{} // TODO: don't re-alloc this map each time
|
2020-08-26 19:20:09 +00:00
|
|
|
|
2020-11-16 23:17:24 +00:00
|
|
|
needRemoveStep := false
|
2020-07-23 22:15:28 +00:00
|
|
|
for i := range full.Peers {
|
|
|
|
p := &full.Peers[i]
|
2021-10-28 00:42:33 +00:00
|
|
|
nk := p.PublicKey
|
2020-07-29 23:14:35 +00:00
|
|
|
if !isTrimmablePeer(p, len(full.Peers)) {
|
2020-07-23 22:15:28 +00:00
|
|
|
min.Peers = append(min.Peers, *p)
|
2021-11-02 01:21:48 +00:00
|
|
|
if discoChanged[nk] {
|
2020-11-16 23:17:24 +00:00
|
|
|
needRemoveStep = true
|
|
|
|
}
|
2020-07-23 22:15:28 +00:00
|
|
|
continue
|
|
|
|
}
|
2021-11-02 01:21:48 +00:00
|
|
|
trackNodes = append(trackNodes, nk)
|
2021-01-18 21:32:16 +00:00
|
|
|
recentlyActive := false
|
|
|
|
for _, cidr := range p.AllowedIPs {
|
2022-07-25 03:08:42 +00:00
|
|
|
trackIPs = append(trackIPs, cidr.Addr())
|
|
|
|
recentlyActive = recentlyActive || e.isActiveSinceLocked(nk, cidr.Addr(), activeCutoff)
|
2021-01-18 21:32:16 +00:00
|
|
|
}
|
|
|
|
if recentlyActive {
|
2020-07-23 22:15:28 +00:00
|
|
|
min.Peers = append(min.Peers, *p)
|
2021-11-02 01:21:48 +00:00
|
|
|
if discoChanged[nk] {
|
2020-11-16 23:17:24 +00:00
|
|
|
needRemoveStep = true
|
|
|
|
}
|
2020-08-26 19:20:09 +00:00
|
|
|
} else {
|
2021-11-02 01:21:48 +00:00
|
|
|
trimmedNodes[nk] = true
|
2020-07-23 22:15:28 +00:00
|
|
|
}
|
|
|
|
}
|
2021-08-18 22:06:40 +00:00
|
|
|
e.lastNMinPeers = len(min.Peers)
|
2020-07-23 22:15:28 +00:00
|
|
|
|
2021-09-01 02:06:04 +00:00
|
|
|
if !deephash.Update(&e.lastEngineSigTrim, &min, trimmedNodes, trackNodes, trackIPs) {
|
2020-07-23 22:15:28 +00:00
|
|
|
// No changes
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-09-01 02:06:04 +00:00
|
|
|
e.trimmedNodes = trimmedNodes
|
2020-08-26 19:20:09 +00:00
|
|
|
|
2021-09-01 02:06:04 +00:00
|
|
|
e.updateActivityMapsLocked(trackNodes, trackIPs)
|
2020-07-23 22:15:28 +00:00
|
|
|
|
2020-11-16 23:17:24 +00:00
|
|
|
if needRemoveStep {
|
|
|
|
minner := min
|
|
|
|
minner.Peers = nil
|
|
|
|
numRemove := 0
|
|
|
|
for _, p := range min.Peers {
|
2021-11-02 01:21:48 +00:00
|
|
|
if discoChanged[p.PublicKey] {
|
2020-11-16 23:17:24 +00:00
|
|
|
numRemove++
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
minner.Peers = append(minner.Peers, p)
|
|
|
|
}
|
|
|
|
if numRemove > 0 {
|
|
|
|
e.logf("wgengine: Reconfig: removing session keys for %d peers", numRemove)
|
2021-01-29 20:16:36 +00:00
|
|
|
if err := wgcfg.ReconfigDevice(e.wgdev, &minner, e.logf); err != nil {
|
2020-11-16 23:17:24 +00:00
|
|
|
e.logf("wgdev.Reconfig: %v", err)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-04 19:10:17 +00:00
|
|
|
e.logf("wgengine: Reconfig: configuring userspace WireGuard config (with %d/%d peers)", len(min.Peers), len(full.Peers))
|
2021-01-29 20:16:36 +00:00
|
|
|
if err := wgcfg.ReconfigDevice(e.wgdev, &min, e.logf); err != nil {
|
2020-07-23 22:15:28 +00:00
|
|
|
e.logf("wgdev.Reconfig: %v", err)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// updateActivityMapsLocked updates the data structures used for tracking the activity
|
|
|
|
// of wireguard peers that we might add/remove dynamically from the real config
|
|
|
|
// as given to wireguard-go.
|
|
|
|
//
|
|
|
|
// e.wgLock must be held.
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func (e *userspaceEngine) updateActivityMapsLocked(trackNodes []key.NodePublic, trackIPs []netip.Addr) {
|
2021-09-01 02:06:04 +00:00
|
|
|
// Generate the new map of which nodekeys we want to track
|
2020-07-23 22:15:28 +00:00
|
|
|
// receive times for.
|
2021-11-02 01:21:48 +00:00
|
|
|
mr := map[key.NodePublic]mono.Time{} // TODO: only recreate this if set of keys changed
|
2021-09-01 02:06:04 +00:00
|
|
|
for _, nk := range trackNodes {
|
2020-07-23 22:15:28 +00:00
|
|
|
// Preserve old times in the new map, but also
|
2021-09-01 02:06:04 +00:00
|
|
|
// populate map entries for new trackNodes values with
|
2020-07-23 22:15:28 +00:00
|
|
|
// time.Time{} zero values. (Only entries in this map
|
|
|
|
// are tracked, so the Time zero values allow it to be
|
|
|
|
// tracked later)
|
2021-09-01 02:06:04 +00:00
|
|
|
mr[nk] = e.recvActivityAt[nk]
|
2020-07-23 22:15:28 +00:00
|
|
|
}
|
|
|
|
e.recvActivityAt = mr
|
|
|
|
|
2020-12-20 00:43:25 +00:00
|
|
|
oldTime := e.sentActivityAt
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
e.sentActivityAt = make(map[netip.Addr]*mono.Time, len(oldTime))
|
2020-12-20 00:43:25 +00:00
|
|
|
oldFunc := e.destIPActivityFuncs
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
e.destIPActivityFuncs = make(map[netip.Addr]func(), len(oldFunc))
|
2020-12-15 10:31:33 +00:00
|
|
|
|
2021-07-21 19:14:04 +00:00
|
|
|
updateFn := func(timePtr *mono.Time) func() {
|
2020-12-15 10:31:33 +00:00
|
|
|
return func() {
|
2021-07-21 19:14:04 +00:00
|
|
|
now := e.timeNow()
|
|
|
|
old := timePtr.LoadAtomic()
|
2020-12-15 10:31:33 +00:00
|
|
|
|
|
|
|
// How long's it been since we last sent a packet?
|
2021-07-21 19:14:04 +00:00
|
|
|
elapsed := now.Sub(old)
|
|
|
|
if old == 0 {
|
|
|
|
// For our first packet, old is 0, which has indeterminate meaning.
|
|
|
|
// Set elapsed to a big number (four score and seven years).
|
|
|
|
elapsed = 762642 * time.Hour
|
|
|
|
}
|
2020-12-15 10:31:33 +00:00
|
|
|
|
2021-07-21 19:14:04 +00:00
|
|
|
if elapsed >= packetSendTimeUpdateFrequency {
|
|
|
|
timePtr.StoreAtomic(now)
|
2020-12-15 10:31:33 +00:00
|
|
|
}
|
|
|
|
// On a big jump, assume we might no longer be in the wireguard
|
|
|
|
// config and go check.
|
2021-07-21 19:14:04 +00:00
|
|
|
if elapsed >= packetSendRecheckWireguardThreshold {
|
2020-12-15 10:31:33 +00:00
|
|
|
e.wgLock.Lock()
|
|
|
|
defer e.wgLock.Unlock()
|
|
|
|
e.maybeReconfigWireguardLocked(nil)
|
|
|
|
}
|
2020-07-23 22:15:28 +00:00
|
|
|
}
|
2020-12-15 10:31:33 +00:00
|
|
|
}
|
2020-07-23 22:15:28 +00:00
|
|
|
|
2020-12-24 20:33:55 +00:00
|
|
|
for _, ip := range trackIPs {
|
|
|
|
timePtr := oldTime[ip]
|
2020-12-20 00:43:25 +00:00
|
|
|
if timePtr == nil {
|
2021-07-21 19:14:04 +00:00
|
|
|
timePtr = new(mono.Time)
|
2020-12-20 00:43:25 +00:00
|
|
|
}
|
2020-12-24 20:33:55 +00:00
|
|
|
e.sentActivityAt[ip] = timePtr
|
2020-07-31 19:40:49 +00:00
|
|
|
|
2020-12-24 20:33:55 +00:00
|
|
|
fn := oldFunc[ip]
|
2020-12-20 00:43:25 +00:00
|
|
|
if fn == nil {
|
|
|
|
fn = updateFn(timePtr)
|
2020-07-23 22:15:28 +00:00
|
|
|
}
|
2020-12-24 20:33:55 +00:00
|
|
|
e.destIPActivityFuncs[ip] = fn
|
2020-07-23 22:15:28 +00:00
|
|
|
}
|
2020-12-20 00:43:25 +00:00
|
|
|
e.tundev.SetDestIPActivityFuncs(e.destIPActivityFuncs)
|
2020-07-23 22:15:28 +00:00
|
|
|
}
|
|
|
|
|
2021-08-30 16:45:55 +00:00
|
|
|
// hasOverlap checks if there is a IPPrefix which is common amongst the two
|
|
|
|
// provided slices.
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func hasOverlap(aips, rips []netip.Prefix) bool {
|
2021-08-30 16:45:55 +00:00
|
|
|
for _, aip := range aips {
|
|
|
|
for _, rip := range rips {
|
|
|
|
if aip == rip {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2021-06-22 20:13:59 +00:00
|
|
|
func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config, dnsCfg *dns.Config, debug *tailcfg.Debug) error {
|
2020-05-31 06:36:57 +00:00
|
|
|
if routerCfg == nil {
|
|
|
|
panic("routerCfg must not be nil")
|
|
|
|
}
|
2021-04-02 07:34:32 +00:00
|
|
|
if dnsCfg == nil {
|
|
|
|
panic("dnsCfg must not be nil")
|
|
|
|
}
|
2020-05-31 06:36:57 +00:00
|
|
|
|
2021-05-05 19:58:40 +00:00
|
|
|
e.isLocalAddr.Store(tsaddr.NewContainsIPFunc(routerCfg.LocalAddrs))
|
2020-06-09 18:00:48 +00:00
|
|
|
|
2020-02-05 22:16:58 +00:00
|
|
|
e.wgLock.Lock()
|
|
|
|
defer e.wgLock.Unlock()
|
2021-07-26 05:33:30 +00:00
|
|
|
e.lastDNSConfig = dnsCfg
|
2020-02-05 22:16:58 +00:00
|
|
|
|
2021-10-29 20:15:27 +00:00
|
|
|
peerSet := make(map[key.NodePublic]struct{}, len(cfg.Peers))
|
2020-02-25 16:06:29 +00:00
|
|
|
e.mu.Lock()
|
2020-04-10 15:22:13 +00:00
|
|
|
e.peerSequence = e.peerSequence[:0]
|
|
|
|
for _, p := range cfg.Peers {
|
2021-11-02 01:21:48 +00:00
|
|
|
e.peerSequence = append(e.peerSequence, p.PublicKey)
|
2021-10-29 20:15:27 +00:00
|
|
|
peerSet[p.PublicKey] = struct{}{}
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
2022-03-16 16:46:19 +00:00
|
|
|
nm := e.netMap
|
2020-02-25 16:06:29 +00:00
|
|
|
e.mu.Unlock()
|
2020-02-05 22:16:58 +00:00
|
|
|
|
2021-06-22 20:13:59 +00:00
|
|
|
listenPort := e.confListenPort
|
|
|
|
if debug != nil && debug.RandomizeClientPort {
|
|
|
|
listenPort = 0
|
|
|
|
}
|
|
|
|
|
2021-08-30 16:45:55 +00:00
|
|
|
isSubnetRouter := false
|
2022-03-16 16:46:19 +00:00
|
|
|
if e.birdClient != nil && nm != nil && nm.SelfNode != nil {
|
|
|
|
isSubnetRouter = hasOverlap(nm.SelfNode.PrimaryRoutes, nm.Hostinfo.RoutableIPs)
|
2021-08-30 16:45:55 +00:00
|
|
|
}
|
|
|
|
isSubnetRouterChanged := isSubnetRouter != e.lastIsSubnetRouter
|
|
|
|
|
2021-07-20 05:49:51 +00:00
|
|
|
engineChanged := deephash.Update(&e.lastEngineSigFull, cfg)
|
|
|
|
routerChanged := deephash.Update(&e.lastRouterSig, routerCfg, dnsCfg)
|
2021-08-30 16:45:55 +00:00
|
|
|
if !engineChanged && !routerChanged && listenPort == e.magicConn.LocalPort() && !isSubnetRouterChanged {
|
2020-04-10 15:42:34 +00:00
|
|
|
return ErrNoChanges
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
2020-11-16 23:17:24 +00:00
|
|
|
|
2021-06-23 04:53:43 +00:00
|
|
|
// TODO(bradfitz,danderson): maybe delete this isDNSIPOverTailscale
|
|
|
|
// field and delete the resolver.ForwardLinkSelector hook and
|
|
|
|
// instead have ipnlocal populate a map of DNS IP => linkName and
|
|
|
|
// put that in the *dns.Config instead, and plumb it down to the
|
|
|
|
// dns.Manager. Maybe also with isLocalAddr above.
|
|
|
|
e.isDNSIPOverTailscale.Store(tsaddr.NewContainsIPFunc(dnsIPsOverTailscale(dnsCfg, routerCfg)))
|
|
|
|
|
2020-11-16 23:17:24 +00:00
|
|
|
// See if any peers have changed disco keys, which means they've restarted.
|
|
|
|
// If so, we need to update the wireguard-go/device.Device in two phases:
|
|
|
|
// once without the node which has restarted, to clear its wireguard session key,
|
|
|
|
// and a second time with it.
|
2021-11-02 01:21:48 +00:00
|
|
|
discoChanged := make(map[key.NodePublic]bool)
|
2020-11-16 23:17:24 +00:00
|
|
|
{
|
2021-11-02 01:21:48 +00:00
|
|
|
prevEP := make(map[key.NodePublic]key.DiscoPublic)
|
2020-11-16 23:17:24 +00:00
|
|
|
for i := range e.lastCfgFull.Peers {
|
2021-09-01 05:37:23 +00:00
|
|
|
if p := &e.lastCfgFull.Peers[i]; !p.DiscoKey.IsZero() {
|
2021-11-02 01:21:48 +00:00
|
|
|
prevEP[p.PublicKey] = p.DiscoKey
|
2020-11-16 23:17:24 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
for i := range cfg.Peers {
|
|
|
|
p := &cfg.Peers[i]
|
2021-09-01 05:37:23 +00:00
|
|
|
if p.DiscoKey.IsZero() {
|
2020-11-16 23:17:24 +00:00
|
|
|
continue
|
|
|
|
}
|
2021-11-02 01:21:48 +00:00
|
|
|
pub := p.PublicKey
|
2021-09-01 05:37:23 +00:00
|
|
|
if old, ok := prevEP[pub]; ok && old != p.DiscoKey {
|
2020-11-16 23:17:24 +00:00
|
|
|
discoChanged[pub] = true
|
2021-09-01 05:37:23 +00:00
|
|
|
e.logf("wgengine: Reconfig: %s changed from %q to %q", pub.ShortString(), old, p.DiscoKey)
|
2020-11-16 23:17:24 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-04-30 22:34:03 +00:00
|
|
|
e.lastCfgFull = *cfg.Clone()
|
2020-04-10 15:42:34 +00:00
|
|
|
|
2020-07-23 22:15:28 +00:00
|
|
|
// Tell magicsock about the new (or initial) private key
|
|
|
|
// (which is needed by DERP) before wgdev gets it, as wgdev
|
|
|
|
// will start trying to handshake, which we want to be able to
|
|
|
|
// go over DERP.
|
2021-10-28 18:07:25 +00:00
|
|
|
if err := e.magicConn.SetPrivateKey(cfg.PrivateKey); err != nil {
|
2020-07-23 22:15:28 +00:00
|
|
|
e.logf("wgengine: Reconfig: SetPrivateKey: %v", err)
|
|
|
|
}
|
|
|
|
e.magicConn.UpdatePeers(peerSet)
|
2021-06-22 20:13:59 +00:00
|
|
|
e.magicConn.SetPreferredPort(listenPort)
|
2020-02-05 22:16:58 +00:00
|
|
|
|
2020-11-16 23:17:24 +00:00
|
|
|
if err := e.maybeReconfigWireguardLocked(discoChanged); err != nil {
|
2020-07-23 22:15:28 +00:00
|
|
|
return err
|
2020-05-31 06:37:58 +00:00
|
|
|
}
|
2020-04-18 15:48:01 +00:00
|
|
|
|
2020-05-31 06:37:58 +00:00
|
|
|
if routerChanged {
|
2021-04-11 10:37:14 +00:00
|
|
|
e.logf("wgengine: Reconfig: configuring router")
|
|
|
|
err := e.router.Set(routerCfg)
|
|
|
|
health.SetRouterHealth(err)
|
2021-04-03 02:31:58 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2021-04-11 10:37:14 +00:00
|
|
|
// Keep DNS configuration after router configuration, as some
|
|
|
|
// DNS managers refuse to apply settings if the device has no
|
|
|
|
// assigned address.
|
|
|
|
e.logf("wgengine: Reconfig: configuring DNS")
|
|
|
|
err = e.dns.Set(*dnsCfg)
|
|
|
|
health.SetDNSHealth(err)
|
2021-02-18 16:58:13 +00:00
|
|
|
if err != nil {
|
2020-05-31 06:37:58 +00:00
|
|
|
return err
|
|
|
|
}
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
2020-03-02 22:54:57 +00:00
|
|
|
|
2021-08-30 16:45:55 +00:00
|
|
|
if isSubnetRouterChanged && e.birdClient != nil {
|
|
|
|
e.logf("wgengine: Reconfig: configuring BIRD")
|
|
|
|
var err error
|
|
|
|
if isSubnetRouter {
|
|
|
|
err = e.birdClient.EnableProtocol("tailscale")
|
|
|
|
} else {
|
|
|
|
err = e.birdClient.DisableProtocol("tailscale")
|
|
|
|
}
|
|
|
|
if err != nil {
|
|
|
|
// Log but don't fail here.
|
|
|
|
e.logf("wgengine: error configuring BIRD: %v", err)
|
|
|
|
} else {
|
|
|
|
e.lastIsSubnetRouter = isSubnetRouter
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-12-21 18:58:06 +00:00
|
|
|
e.logf("[v1] wgengine: Reconfig done")
|
2020-03-02 22:54:57 +00:00
|
|
|
return nil
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
|
|
|
|
2020-03-25 07:47:55 +00:00
|
|
|
func (e *userspaceEngine) GetFilter() *filter.Filter {
|
2020-05-13 13:16:17 +00:00
|
|
|
return e.tundev.GetFilter()
|
2020-03-25 07:47:55 +00:00
|
|
|
}
|
|
|
|
|
2020-02-05 22:16:58 +00:00
|
|
|
func (e *userspaceEngine) SetFilter(filt *filter.Filter) {
|
2020-05-13 13:16:17 +00:00
|
|
|
e.tundev.SetFilter(filt)
|
2020-06-08 22:19:26 +00:00
|
|
|
}
|
|
|
|
|
2020-02-05 22:16:58 +00:00
|
|
|
func (e *userspaceEngine) SetStatusCallback(cb StatusCallback) {
|
2020-02-28 17:32:06 +00:00
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
2020-02-05 22:16:58 +00:00
|
|
|
e.statusCallback = cb
|
|
|
|
}
|
|
|
|
|
2020-02-28 17:32:06 +00:00
|
|
|
func (e *userspaceEngine) getStatusCallback() StatusCallback {
|
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
|
|
|
return e.statusCallback
|
|
|
|
}
|
|
|
|
|
2021-01-27 18:30:57 +00:00
|
|
|
var singleNewline = []byte{'\n'}
|
|
|
|
|
2021-05-11 18:14:53 +00:00
|
|
|
var ErrEngineClosing = errors.New("engine closing; no status")
|
|
|
|
|
2020-02-05 22:16:58 +00:00
|
|
|
func (e *userspaceEngine) getStatus() (*Status, error) {
|
2020-08-05 23:36:53 +00:00
|
|
|
// Grab derpConns before acquiring wgLock to not violate lock ordering;
|
|
|
|
// the DERPs method acquires magicsock.Conn.mu.
|
|
|
|
// (See comment in userspaceEngine's declaration.)
|
|
|
|
derpConns := e.magicConn.DERPs()
|
|
|
|
|
2020-02-05 22:16:58 +00:00
|
|
|
e.wgLock.Lock()
|
|
|
|
defer e.wgLock.Unlock()
|
|
|
|
|
2020-05-17 16:51:38 +00:00
|
|
|
e.mu.Lock()
|
|
|
|
closing := e.closing
|
|
|
|
e.mu.Unlock()
|
|
|
|
if closing {
|
2021-05-11 18:14:53 +00:00
|
|
|
return nil, ErrEngineClosing
|
2020-05-17 16:51:38 +00:00
|
|
|
}
|
|
|
|
|
2020-02-05 22:16:58 +00:00
|
|
|
if e.wgdev == nil {
|
|
|
|
// RequestStatus was invoked before the wgengine has
|
|
|
|
// finished initializing. This can happen when wgegine
|
|
|
|
// provides a callback to magicsock for endpoint
|
|
|
|
// updates that calls RequestStatus.
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
2020-04-08 15:42:38 +00:00
|
|
|
pr, pw := io.Pipe()
|
2021-01-27 18:30:57 +00:00
|
|
|
defer pr.Close() // to unblock writes on error path returns
|
2021-01-26 18:20:13 +00:00
|
|
|
|
2020-04-08 15:42:38 +00:00
|
|
|
errc := make(chan error, 1)
|
|
|
|
go func() {
|
|
|
|
defer pw.Close()
|
|
|
|
// TODO(apenwarr): get rid of silly uapi stuff for in-process comms
|
|
|
|
// FIXME: get notified of status changes instead of polling.
|
2021-02-08 21:34:27 +00:00
|
|
|
err := e.wgdev.IpcGetOperation(pw)
|
2021-01-26 18:20:13 +00:00
|
|
|
if err != nil {
|
|
|
|
err = fmt.Errorf("IpcGetOperation: %w", err)
|
2020-04-08 15:42:38 +00:00
|
|
|
}
|
2021-01-26 18:20:13 +00:00
|
|
|
errc <- err
|
2020-04-08 15:42:38 +00:00
|
|
|
}()
|
2020-02-05 22:16:58 +00:00
|
|
|
|
2021-11-02 01:21:48 +00:00
|
|
|
pp := make(map[key.NodePublic]ipnstate.PeerStatusLite)
|
2021-08-18 21:30:14 +00:00
|
|
|
var p ipnstate.PeerStatusLite
|
2020-04-08 15:42:38 +00:00
|
|
|
|
2020-02-05 22:16:58 +00:00
|
|
|
var hst1, hst2, n int64
|
2020-04-08 15:42:38 +00:00
|
|
|
|
2021-01-26 18:20:13 +00:00
|
|
|
br := e.statusBufioReader
|
|
|
|
if br != nil {
|
|
|
|
br.Reset(pr)
|
|
|
|
} else {
|
|
|
|
br = bufio.NewReaderSize(pr, 1<<10)
|
|
|
|
e.statusBufioReader = br
|
|
|
|
}
|
|
|
|
for {
|
|
|
|
line, err := br.ReadSlice('\n')
|
|
|
|
if err == io.EOF {
|
|
|
|
break
|
|
|
|
}
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("reading from UAPI pipe: %w", err)
|
|
|
|
}
|
2021-01-27 18:30:57 +00:00
|
|
|
line = bytes.TrimSuffix(line, singleNewline)
|
2020-04-08 15:42:38 +00:00
|
|
|
k := line
|
|
|
|
var v mem.RO
|
|
|
|
if i := bytes.IndexByte(line, '='); i != -1 {
|
|
|
|
k = line[:i]
|
|
|
|
v = mem.B(line[i+1:])
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
2020-04-08 15:42:38 +00:00
|
|
|
switch string(k) {
|
2020-02-05 22:16:58 +00:00
|
|
|
case "public_key":
|
2021-10-29 21:57:32 +00:00
|
|
|
pk, err := key.ParseNodePublicUntyped(v)
|
2020-02-05 22:16:58 +00:00
|
|
|
if err != nil {
|
2021-01-27 18:30:57 +00:00
|
|
|
return nil, fmt.Errorf("IpcGetOperation: invalid key in line %q", line)
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
2021-08-18 21:30:14 +00:00
|
|
|
if !p.NodeKey.IsZero() {
|
2021-11-02 01:38:24 +00:00
|
|
|
pp[p.NodeKey] = p
|
2021-08-18 21:30:14 +00:00
|
|
|
}
|
2021-11-02 01:38:24 +00:00
|
|
|
p = ipnstate.PeerStatusLite{NodeKey: pk}
|
2020-02-05 22:16:58 +00:00
|
|
|
case "rx_bytes":
|
2020-06-01 03:22:46 +00:00
|
|
|
n, err = mem.ParseInt(v, 10, 64)
|
2021-02-04 21:12:42 +00:00
|
|
|
p.RxBytes = n
|
2020-02-05 22:16:58 +00:00
|
|
|
if err != nil {
|
2021-01-26 18:20:13 +00:00
|
|
|
return nil, fmt.Errorf("IpcGetOperation: rx_bytes invalid: %#v", line)
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
|
|
|
case "tx_bytes":
|
2020-06-01 03:22:46 +00:00
|
|
|
n, err = mem.ParseInt(v, 10, 64)
|
2021-02-04 21:12:42 +00:00
|
|
|
p.TxBytes = n
|
2020-02-05 22:16:58 +00:00
|
|
|
if err != nil {
|
2021-01-26 18:20:13 +00:00
|
|
|
return nil, fmt.Errorf("IpcGetOperation: tx_bytes invalid: %#v", line)
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
|
|
|
case "last_handshake_time_sec":
|
2020-06-01 03:22:46 +00:00
|
|
|
hst1, err = mem.ParseInt(v, 10, 64)
|
2020-02-05 22:16:58 +00:00
|
|
|
if err != nil {
|
2021-01-26 18:20:13 +00:00
|
|
|
return nil, fmt.Errorf("IpcGetOperation: hst1 invalid: %#v", line)
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
|
|
|
case "last_handshake_time_nsec":
|
2020-06-01 03:22:46 +00:00
|
|
|
hst2, err = mem.ParseInt(v, 10, 64)
|
2020-02-05 22:16:58 +00:00
|
|
|
if err != nil {
|
2021-01-26 18:20:13 +00:00
|
|
|
return nil, fmt.Errorf("IpcGetOperation: hst2 invalid: %#v", line)
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
|
|
|
if hst1 != 0 || hst2 != 0 {
|
|
|
|
p.LastHandshake = time.Unix(hst1, hst2)
|
|
|
|
} // else leave at time.IsZero()
|
|
|
|
}
|
|
|
|
}
|
2021-08-18 21:30:14 +00:00
|
|
|
if !p.NodeKey.IsZero() {
|
2021-11-02 01:38:24 +00:00
|
|
|
pp[p.NodeKey] = p
|
2021-08-18 21:30:14 +00:00
|
|
|
}
|
2020-04-08 15:42:38 +00:00
|
|
|
if err := <-errc; err != nil {
|
2021-01-26 18:20:13 +00:00
|
|
|
return nil, fmt.Errorf("IpcGetOperation: %v", err)
|
2020-04-08 15:42:38 +00:00
|
|
|
}
|
2020-02-05 22:16:58 +00:00
|
|
|
|
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
|
|
|
|
2021-08-18 21:30:14 +00:00
|
|
|
// Do two passes, one to calculate size and the other to populate.
|
|
|
|
// This code is sensitive to allocations.
|
|
|
|
npeers := 0
|
|
|
|
for _, pk := range e.peerSequence {
|
|
|
|
if _, ok := pp[pk]; ok { // ignore idle ones not in wireguard-go's config
|
|
|
|
npeers++
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
peers := make([]ipnstate.PeerStatusLite, 0, npeers)
|
2020-02-05 22:16:58 +00:00
|
|
|
for _, pk := range e.peerSequence {
|
2020-07-23 22:15:28 +00:00
|
|
|
if p, ok := pp[pk]; ok { // ignore idle ones not in wireguard-go's config
|
2021-08-18 21:30:14 +00:00
|
|
|
peers = append(peers, p)
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return &Status{
|
2022-03-27 03:12:12 +00:00
|
|
|
AsOf: time.Now(),
|
tailcfg: add Endpoint, EndpointType, MapRequest.EndpointType
Track endpoints internally with a new tailcfg.Endpoint type that
includes a typed netaddr.IPPort (instead of just a string) and
includes a type for how that endpoint was discovered (STUN, local,
etc).
Use []tailcfg.Endpoint instead of []string internally.
At the last second, send it to the control server as the existing
[]string for endpoints, but also include a new parallel
MapRequest.EndpointType []tailcfg.EndpointType, so the control server
can start filtering out less-important endpoint changes from
new-enough clients. Notably, STUN-discovered endpoints can be filtered
out from 1.6+ clients, as they can discover them amongst each other
via CallMeMaybe disco exchanges started over DERP. And STUN endpoints
change a lot, causing a lot of MapResposne updates. But portmapped
endpoints are worth keeping for now, as they they work right away
without requiring the firewall traversal extra RTT dance.
End result will be less control->client bandwidth. (despite negligible
increase in client->control bandwidth)
Updates tailscale/corp#1543
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-12 20:24:29 +00:00
|
|
|
LocalAddrs: append([]tailcfg.Endpoint(nil), e.endpoints...),
|
2020-02-05 22:16:58 +00:00
|
|
|
Peers: peers,
|
2020-08-05 23:36:53 +00:00
|
|
|
DERPs: derpConns,
|
2020-02-05 22:16:58 +00:00
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (e *userspaceEngine) RequestStatus() {
|
|
|
|
// This is slightly tricky. e.getStatus() can theoretically get
|
|
|
|
// blocked inside wireguard for a while, and RequestStatus() is
|
|
|
|
// sometimes called from a goroutine, so we don't want a lot of
|
|
|
|
// them hanging around. On the other hand, requesting multiple
|
|
|
|
// status updates simultaneously is pointless anyway; they will
|
|
|
|
// all say the same thing.
|
|
|
|
|
|
|
|
// Enqueue at most one request. If one is in progress already, this
|
|
|
|
// adds one more to the queue. If one has been requested but not
|
|
|
|
// started, it is a no-op.
|
|
|
|
select {
|
|
|
|
case e.reqCh <- struct{}{}:
|
|
|
|
default:
|
|
|
|
}
|
|
|
|
|
|
|
|
// Dequeue at most one request. Another thread may have already
|
|
|
|
// dequeued the request we enqueued above, which is fine, since the
|
|
|
|
// information is guaranteed to be at least as recent as the current
|
|
|
|
// call to RequestStatus().
|
|
|
|
select {
|
|
|
|
case <-e.reqCh:
|
|
|
|
s, err := e.getStatus()
|
|
|
|
if s == nil && err == nil {
|
2021-04-27 16:59:25 +00:00
|
|
|
e.logf("[unexpected] RequestStatus: both s and err are nil")
|
2020-02-05 22:16:58 +00:00
|
|
|
return
|
|
|
|
}
|
2020-02-28 17:32:06 +00:00
|
|
|
if cb := e.getStatusCallback(); cb != nil {
|
|
|
|
cb(s, err)
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
|
|
|
default:
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (e *userspaceEngine) Close() {
|
2020-02-25 16:06:29 +00:00
|
|
|
e.mu.Lock()
|
2020-05-17 16:51:38 +00:00
|
|
|
if e.closing {
|
|
|
|
e.mu.Unlock()
|
|
|
|
return
|
|
|
|
}
|
|
|
|
e.closing = true
|
2020-02-25 16:06:29 +00:00
|
|
|
e.mu.Unlock()
|
|
|
|
|
2020-02-20 17:47:33 +00:00
|
|
|
r := bufio.NewReader(strings.NewReader(""))
|
|
|
|
e.wgdev.IpcSetOperation(r)
|
2020-07-03 07:00:04 +00:00
|
|
|
e.magicConn.Close()
|
2021-02-28 05:42:34 +00:00
|
|
|
e.linkMonUnregister()
|
2021-02-28 05:48:00 +00:00
|
|
|
if e.linkMonOwned {
|
|
|
|
e.linkMon.Close()
|
|
|
|
}
|
2021-04-03 02:34:53 +00:00
|
|
|
e.dns.Down()
|
2020-02-05 22:16:58 +00:00
|
|
|
e.router.Close()
|
2020-07-03 07:00:04 +00:00
|
|
|
e.wgdev.Close()
|
2020-09-18 15:04:15 +00:00
|
|
|
e.tundev.Close()
|
2021-08-30 16:45:55 +00:00
|
|
|
if e.birdClient != nil {
|
|
|
|
e.birdClient.DisableProtocol("tailscale")
|
|
|
|
e.birdClient.Close()
|
|
|
|
}
|
2020-02-05 22:16:58 +00:00
|
|
|
close(e.waitCh)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (e *userspaceEngine) Wait() {
|
|
|
|
<-e.waitCh
|
|
|
|
}
|
|
|
|
|
2021-03-01 20:56:03 +00:00
|
|
|
func (e *userspaceEngine) GetLinkMonitor() *monitor.Mon {
|
|
|
|
return e.linkMon
|
2020-03-13 03:10:11 +00:00
|
|
|
}
|
|
|
|
|
2021-03-04 04:58:09 +00:00
|
|
|
// LinkChange signals a network change event. It's currently
|
2021-10-07 00:43:37 +00:00
|
|
|
// (2021-03-03) only called on Android. On other platforms, linkMon
|
|
|
|
// generates link change events for us.
|
2021-03-04 04:58:09 +00:00
|
|
|
func (e *userspaceEngine) LinkChange(_ bool) {
|
|
|
|
e.linkMon.InjectEvent()
|
|
|
|
}
|
|
|
|
|
2021-03-01 20:56:03 +00:00
|
|
|
func (e *userspaceEngine) linkChange(changed bool, cur *interfaces.State) {
|
2020-10-06 22:22:46 +00:00
|
|
|
up := cur.AnyInterfaceUp()
|
|
|
|
if !up {
|
|
|
|
e.logf("LinkChange: all links down; pausing: %v", cur)
|
2021-03-01 20:56:03 +00:00
|
|
|
} else if changed {
|
2020-10-06 22:22:46 +00:00
|
|
|
e.logf("LinkChange: major, rebinding. New state: %v", cur)
|
2020-08-12 19:48:34 +00:00
|
|
|
} else {
|
2020-12-21 18:58:06 +00:00
|
|
|
e.logf("[v1] LinkChange: minor")
|
2020-08-12 19:48:34 +00:00
|
|
|
}
|
2020-03-13 03:10:11 +00:00
|
|
|
|
2021-03-23 04:41:53 +00:00
|
|
|
health.SetAnyInterfaceUp(up)
|
2020-10-06 22:22:46 +00:00
|
|
|
e.magicConn.SetNetworkUp(up)
|
2021-09-19 03:33:21 +00:00
|
|
|
if !up || changed {
|
|
|
|
if err := e.dns.FlushCaches(); err != nil {
|
|
|
|
e.logf("wgengine: dns flush failed after major link change: %v", err)
|
|
|
|
}
|
|
|
|
}
|
2020-10-06 22:22:46 +00:00
|
|
|
|
2021-07-26 05:33:30 +00:00
|
|
|
// Hacky workaround for Linux DNS issue 2458: on
|
|
|
|
// suspend/resume or whenever NetworkManager is started, it
|
|
|
|
// nukes all systemd-resolved configs. So reapply our DNS
|
|
|
|
// config on major link change.
|
2021-10-09 19:17:59 +00:00
|
|
|
if (runtime.GOOS == "linux" || runtime.GOOS == "android") && changed {
|
2021-07-26 05:33:30 +00:00
|
|
|
e.wgLock.Lock()
|
|
|
|
dnsCfg := e.lastDNSConfig
|
|
|
|
e.wgLock.Unlock()
|
|
|
|
if dnsCfg != nil {
|
|
|
|
if err := e.dns.Set(*dnsCfg); err != nil {
|
|
|
|
e.logf("wgengine: error setting DNS config after major link change: %v", err)
|
|
|
|
} else {
|
|
|
|
e.logf("wgengine: set DNS config again after major link change")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-03-13 03:10:11 +00:00
|
|
|
why := "link-change-minor"
|
2021-03-01 20:56:03 +00:00
|
|
|
if changed {
|
2020-03-13 03:10:11 +00:00
|
|
|
why = "link-change-major"
|
2022-04-22 17:40:49 +00:00
|
|
|
metricNumMajorChanges.Add(1)
|
2020-03-13 03:10:11 +00:00
|
|
|
e.magicConn.Rebind()
|
2022-04-22 17:40:49 +00:00
|
|
|
} else {
|
|
|
|
metricNumMinorChanges.Add(1)
|
2020-03-13 03:10:11 +00:00
|
|
|
}
|
|
|
|
e.magicConn.ReSTUN(why)
|
2020-02-05 22:16:58 +00:00
|
|
|
}
|
2020-03-04 06:21:56 +00:00
|
|
|
|
2021-01-15 14:16:28 +00:00
|
|
|
func (e *userspaceEngine) AddNetworkMapCallback(cb NetworkMapCallback) func() {
|
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
|
|
|
if e.networkMapCallbacks == nil {
|
|
|
|
e.networkMapCallbacks = make(map[*someHandle]NetworkMapCallback)
|
|
|
|
}
|
|
|
|
h := new(someHandle)
|
|
|
|
e.networkMapCallbacks[h] = cb
|
|
|
|
return func() {
|
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
|
|
|
delete(e.networkMapCallbacks, h)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-03-04 06:21:56 +00:00
|
|
|
func (e *userspaceEngine) SetNetInfoCallback(cb NetInfoCallback) {
|
|
|
|
e.magicConn.SetNetInfoCallback(cb)
|
|
|
|
}
|
2020-03-04 20:21:40 +00:00
|
|
|
|
2020-05-17 16:51:38 +00:00
|
|
|
func (e *userspaceEngine) SetDERPMap(dm *tailcfg.DERPMap) {
|
|
|
|
e.magicConn.SetDERPMap(dm)
|
2020-03-04 20:21:40 +00:00
|
|
|
}
|
2020-03-26 05:57:46 +00:00
|
|
|
|
2021-02-05 23:44:46 +00:00
|
|
|
func (e *userspaceEngine) SetNetworkMap(nm *netmap.NetworkMap) {
|
2020-06-25 18:04:52 +00:00
|
|
|
e.magicConn.SetNetworkMap(nm)
|
2021-01-15 14:16:28 +00:00
|
|
|
e.mu.Lock()
|
2021-03-23 04:25:43 +00:00
|
|
|
e.netMap = nm
|
2021-01-15 14:16:28 +00:00
|
|
|
callbacks := make([]NetworkMapCallback, 0, 4)
|
|
|
|
for _, fn := range e.networkMapCallbacks {
|
|
|
|
callbacks = append(callbacks, fn)
|
|
|
|
}
|
|
|
|
e.mu.Unlock()
|
|
|
|
for _, fn := range callbacks {
|
|
|
|
fn(nm)
|
|
|
|
}
|
2020-06-25 18:04:52 +00:00
|
|
|
}
|
|
|
|
|
2021-11-02 21:41:56 +00:00
|
|
|
func (e *userspaceEngine) DiscoPublicKey() key.DiscoPublic {
|
|
|
|
return e.magicConn.DiscoPublicKey()
|
2020-06-19 19:06:49 +00:00
|
|
|
}
|
|
|
|
|
2020-03-26 05:57:46 +00:00
|
|
|
func (e *userspaceEngine) UpdateStatus(sb *ipnstate.StatusBuilder) {
|
|
|
|
st, err := e.getStatus()
|
|
|
|
if err != nil {
|
|
|
|
e.logf("wgengine: getStatus: %v", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
for _, ps := range st.Peers {
|
2021-11-02 01:38:24 +00:00
|
|
|
sb.AddPeer(ps.NodeKey, &ipnstate.PeerStatus{
|
2020-03-26 05:57:46 +00:00
|
|
|
RxBytes: int64(ps.RxBytes),
|
|
|
|
TxBytes: int64(ps.TxBytes),
|
|
|
|
LastHandshake: ps.LastHandshake,
|
|
|
|
InEngine: true,
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
e.magicConn.UpdateStatus(sb)
|
|
|
|
}
|
2020-04-10 20:44:08 +00:00
|
|
|
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func (e *userspaceEngine) Ping(ip netip.Addr, pingType tailcfg.PingType, cb func(*ipnstate.PingResult)) {
|
2021-03-23 04:25:43 +00:00
|
|
|
res := &ipnstate.PingResult{IP: ip.String()}
|
2021-11-30 18:30:44 +00:00
|
|
|
pip, ok := e.PeerForIP(ip)
|
|
|
|
if !ok {
|
2021-03-23 04:47:42 +00:00
|
|
|
e.logf("ping(%v): no matching peer", ip)
|
2021-03-23 04:25:43 +00:00
|
|
|
res.Err = "no matching peer"
|
|
|
|
cb(res)
|
|
|
|
return
|
|
|
|
}
|
2021-11-30 18:30:44 +00:00
|
|
|
if pip.IsSelf {
|
2021-09-07 18:57:23 +00:00
|
|
|
res.Err = fmt.Sprintf("%v is local Tailscale IP", ip)
|
|
|
|
res.IsLocalIP = true
|
|
|
|
cb(res)
|
|
|
|
return
|
|
|
|
}
|
2021-11-30 18:30:44 +00:00
|
|
|
peer := pip.Node
|
2021-09-07 18:57:23 +00:00
|
|
|
|
2021-03-23 22:16:15 +00:00
|
|
|
e.logf("ping(%v): sending %v ping to %v %v ...", ip, pingType, peer.Key.ShortString(), peer.ComputedName)
|
2022-04-22 01:49:01 +00:00
|
|
|
switch pingType {
|
|
|
|
case "disco":
|
2021-03-23 22:16:15 +00:00
|
|
|
e.magicConn.Ping(peer, res, cb)
|
2022-04-22 01:49:01 +00:00
|
|
|
case "TSMP":
|
|
|
|
e.sendTSMPPing(ip, peer, res, cb)
|
|
|
|
case "ICMP":
|
|
|
|
e.sendICMPEchoRequest(ip, peer, res, cb)
|
2021-03-23 22:16:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func (e *userspaceEngine) mySelfIPMatchingFamily(dst netip.Addr) (src netip.Addr, err error) {
|
2021-03-23 22:16:15 +00:00
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
|
|
|
if e.netMap == nil {
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
return netip.Addr{}, errors.New("no netmap")
|
2021-03-23 22:16:15 +00:00
|
|
|
}
|
|
|
|
for _, a := range e.netMap.Addresses {
|
2022-07-25 03:08:42 +00:00
|
|
|
if a.IsSingleIP() && a.Addr().BitLen() == dst.BitLen() {
|
|
|
|
return a.Addr(), nil
|
2021-03-23 22:16:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
if len(e.netMap.Addresses) == 0 {
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
return netip.Addr{}, errors.New("no self address in netmap")
|
2021-03-23 22:16:15 +00:00
|
|
|
}
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
return netip.Addr{}, errors.New("no self address in netmap matching address family")
|
2021-03-23 22:16:15 +00:00
|
|
|
}
|
|
|
|
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func (e *userspaceEngine) sendICMPEchoRequest(destIP netip.Addr, peer *tailcfg.Node, res *ipnstate.PingResult, cb func(*ipnstate.PingResult)) {
|
2022-04-22 01:49:01 +00:00
|
|
|
srcIP, err := e.mySelfIPMatchingFamily(destIP)
|
|
|
|
if err != nil {
|
|
|
|
res.Err = err.Error()
|
|
|
|
cb(res)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
var icmph packet.Header
|
|
|
|
if srcIP.Is4() {
|
|
|
|
icmph = packet.ICMP4Header{
|
|
|
|
IP4Header: packet.IP4Header{
|
|
|
|
IPProto: ipproto.ICMPv4,
|
|
|
|
Src: srcIP,
|
|
|
|
Dst: destIP,
|
|
|
|
},
|
|
|
|
Type: packet.ICMP4EchoRequest,
|
|
|
|
Code: packet.ICMP4NoCode,
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
icmph = packet.ICMP6Header{
|
|
|
|
IP6Header: packet.IP6Header{
|
|
|
|
IPProto: ipproto.ICMPv6,
|
|
|
|
Src: srcIP,
|
|
|
|
Dst: destIP,
|
|
|
|
},
|
|
|
|
Type: packet.ICMP6EchoRequest,
|
|
|
|
Code: packet.ICMP6NoCode,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
idSeq, payload := packet.ICMPEchoPayload(nil)
|
|
|
|
|
|
|
|
expireTimer := time.AfterFunc(10*time.Second, func() {
|
|
|
|
e.setICMPEchoResponseCallback(idSeq, nil)
|
|
|
|
})
|
|
|
|
t0 := time.Now()
|
|
|
|
e.setICMPEchoResponseCallback(idSeq, func() {
|
|
|
|
expireTimer.Stop()
|
|
|
|
d := time.Since(t0)
|
|
|
|
res.LatencySeconds = d.Seconds()
|
|
|
|
res.NodeIP = destIP.String()
|
|
|
|
res.NodeName = peer.ComputedName
|
|
|
|
cb(res)
|
|
|
|
})
|
|
|
|
|
|
|
|
icmpPing := packet.Generate(icmph, payload)
|
|
|
|
e.tundev.InjectOutbound(icmpPing)
|
|
|
|
}
|
|
|
|
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func (e *userspaceEngine) sendTSMPPing(ip netip.Addr, peer *tailcfg.Node, res *ipnstate.PingResult, cb func(*ipnstate.PingResult)) {
|
2021-03-23 22:16:15 +00:00
|
|
|
srcIP, err := e.mySelfIPMatchingFamily(ip)
|
|
|
|
if err != nil {
|
|
|
|
res.Err = err.Error()
|
|
|
|
cb(res)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
var iph packet.Header
|
|
|
|
if srcIP.Is4() {
|
|
|
|
iph = packet.IP4Header{
|
|
|
|
IPProto: ipproto.TSMP,
|
|
|
|
Src: srcIP,
|
|
|
|
Dst: ip,
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
iph = packet.IP6Header{
|
|
|
|
IPProto: ipproto.TSMP,
|
|
|
|
Src: srcIP,
|
|
|
|
Dst: ip,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
var data [8]byte
|
|
|
|
crand.Read(data[:])
|
|
|
|
|
|
|
|
expireTimer := time.AfterFunc(10*time.Second, func() {
|
|
|
|
e.setTSMPPongCallback(data, nil)
|
|
|
|
})
|
|
|
|
t0 := time.Now()
|
2021-03-29 22:17:05 +00:00
|
|
|
e.setTSMPPongCallback(data, func(pong packet.TSMPPongReply) {
|
2021-03-23 22:16:15 +00:00
|
|
|
expireTimer.Stop()
|
|
|
|
d := time.Since(t0)
|
|
|
|
res.LatencySeconds = d.Seconds()
|
|
|
|
res.NodeIP = ip.String()
|
|
|
|
res.NodeName = peer.ComputedName
|
2021-03-29 22:17:05 +00:00
|
|
|
res.PeerAPIPort = pong.PeerAPIPort
|
2021-03-23 22:16:15 +00:00
|
|
|
cb(res)
|
|
|
|
})
|
|
|
|
|
|
|
|
var tsmpPayload [9]byte
|
|
|
|
tsmpPayload[0] = byte(packet.TSMPTypePing)
|
|
|
|
copy(tsmpPayload[1:], data[:])
|
|
|
|
|
|
|
|
tsmpPing := packet.Generate(iph, tsmpPayload[:])
|
|
|
|
e.tundev.InjectOutbound(tsmpPing)
|
|
|
|
}
|
|
|
|
|
2021-03-29 22:17:05 +00:00
|
|
|
func (e *userspaceEngine) setTSMPPongCallback(data [8]byte, cb func(packet.TSMPPongReply)) {
|
2021-03-23 22:16:15 +00:00
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
|
|
|
if e.pongCallback == nil {
|
2021-03-29 22:17:05 +00:00
|
|
|
e.pongCallback = map[[8]byte]func(packet.TSMPPongReply){}
|
2021-03-23 22:16:15 +00:00
|
|
|
}
|
|
|
|
if cb == nil {
|
|
|
|
delete(e.pongCallback, data)
|
|
|
|
} else {
|
|
|
|
e.pongCallback[data] = cb
|
|
|
|
}
|
2020-08-09 21:49:42 +00:00
|
|
|
}
|
|
|
|
|
2022-04-22 01:49:01 +00:00
|
|
|
func (e *userspaceEngine) setICMPEchoResponseCallback(idSeq uint32, cb func()) {
|
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
|
|
|
if cb == nil {
|
|
|
|
delete(e.icmpEchoResponseCallback, idSeq)
|
|
|
|
} else {
|
|
|
|
mak.Set(&e.icmpEchoResponseCallback, idSeq, cb)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func (e *userspaceEngine) RegisterIPPortIdentity(ipport netip.AddrPort, tsIP netip.Addr) {
|
2021-03-15 21:59:35 +00:00
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
|
|
|
if e.tsIPByIPPort == nil {
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
e.tsIPByIPPort = make(map[netip.AddrPort]netip.Addr)
|
2021-03-15 21:59:35 +00:00
|
|
|
}
|
|
|
|
e.tsIPByIPPort[ipport] = tsIP
|
|
|
|
}
|
|
|
|
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func (e *userspaceEngine) UnregisterIPPortIdentity(ipport netip.AddrPort) {
|
2021-03-15 21:59:35 +00:00
|
|
|
e.mu.Lock()
|
|
|
|
defer e.mu.Unlock()
|
|
|
|
if e.tsIPByIPPort == nil {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
delete(e.tsIPByIPPort, ipport)
|
|
|
|
}
|
|
|
|
|
2021-03-30 16:50:25 +00:00
|
|
|
var whoIsSleeps = [...]time.Duration{
|
|
|
|
0,
|
|
|
|
10 * time.Millisecond,
|
|
|
|
20 * time.Millisecond,
|
|
|
|
50 * time.Millisecond,
|
|
|
|
100 * time.Millisecond,
|
|
|
|
}
|
|
|
|
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func (e *userspaceEngine) WhoIsIPPort(ipport netip.AddrPort) (tsIP netip.Addr, ok bool) {
|
2021-03-30 16:50:25 +00:00
|
|
|
// We currently have a registration race,
|
|
|
|
// https://github.com/tailscale/tailscale/issues/1616,
|
|
|
|
// so loop a few times for now waiting for the registration
|
|
|
|
// to appear.
|
|
|
|
// TODO(bradfitz,namansood): remove this once #1616 is fixed.
|
|
|
|
for _, d := range whoIsSleeps {
|
|
|
|
time.Sleep(d)
|
|
|
|
e.mu.Lock()
|
|
|
|
tsIP, ok = e.tsIPByIPPort[ipport]
|
|
|
|
e.mu.Unlock()
|
|
|
|
if ok {
|
|
|
|
return tsIP, true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return tsIP, false
|
2021-03-15 21:59:35 +00:00
|
|
|
}
|
|
|
|
|
2021-11-30 18:30:44 +00:00
|
|
|
// PeerForIP returns the Node in the wireguard config
|
2021-03-23 04:25:43 +00:00
|
|
|
// that's responsible for handling the given IP address.
|
|
|
|
//
|
|
|
|
// If none is found in the wireguard config but one is found in
|
|
|
|
// the netmap, it's described in an error.
|
|
|
|
//
|
|
|
|
//
|
|
|
|
// peerForIP acquires both e.mu and e.wgLock, but neither at the same
|
|
|
|
// time.
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func (e *userspaceEngine) PeerForIP(ip netip.Addr) (ret PeerForIP, ok bool) {
|
2021-03-23 04:25:43 +00:00
|
|
|
e.mu.Lock()
|
|
|
|
nm := e.netMap
|
|
|
|
e.mu.Unlock()
|
|
|
|
if nm == nil {
|
2021-11-30 18:30:44 +00:00
|
|
|
return ret, false
|
2021-03-23 04:25:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Check for exact matches before looking for subnet matches.
|
2021-11-30 18:30:44 +00:00
|
|
|
// TODO(bradfitz): add maps for these. on NetworkMap?
|
2021-03-23 04:25:43 +00:00
|
|
|
for _, p := range nm.Peers {
|
|
|
|
for _, a := range p.Addresses {
|
2022-07-25 03:08:42 +00:00
|
|
|
if a.Addr() == ip && a.IsSingleIP() && tsaddr.IsTailscaleIP(ip) {
|
2021-11-30 18:30:44 +00:00
|
|
|
return PeerForIP{Node: p, Route: a}, true
|
2021-03-23 04:25:43 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2021-09-07 18:57:23 +00:00
|
|
|
for _, a := range nm.Addresses {
|
2022-07-25 03:08:42 +00:00
|
|
|
if a.Addr() == ip && a.IsSingleIP() && tsaddr.IsTailscaleIP(ip) {
|
2021-11-30 18:30:44 +00:00
|
|
|
return PeerForIP{Node: nm.SelfNode, IsSelf: true, Route: a}, true
|
2021-09-07 18:57:23 +00:00
|
|
|
}
|
|
|
|
}
|
2021-03-23 04:25:43 +00:00
|
|
|
|
|
|
|
e.wgLock.Lock()
|
|
|
|
defer e.wgLock.Unlock()
|
|
|
|
|
|
|
|
// TODO(bradfitz): this is O(n peers). Add ART to netaddr?
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
var best netip.Prefix
|
2021-11-02 01:21:48 +00:00
|
|
|
var bestKey key.NodePublic
|
2021-03-23 04:25:43 +00:00
|
|
|
for _, p := range e.lastCfgFull.Peers {
|
|
|
|
for _, cidr := range p.AllowedIPs {
|
|
|
|
if !cidr.Contains(ip) {
|
|
|
|
continue
|
|
|
|
}
|
2022-07-25 03:08:42 +00:00
|
|
|
if !best.IsValid() || cidr.Bits() > best.Bits() {
|
2021-03-23 04:25:43 +00:00
|
|
|
best = cidr
|
2021-11-02 01:21:48 +00:00
|
|
|
bestKey = p.PublicKey
|
2021-03-23 04:25:43 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
// And another pass. Probably better than allocating a map per peerForIP
|
|
|
|
// call. But TODO(bradfitz): add a lookup map to netmap.NetworkMap.
|
|
|
|
if !bestKey.IsZero() {
|
|
|
|
for _, p := range nm.Peers {
|
2021-11-02 03:55:52 +00:00
|
|
|
if p.Key == bestKey {
|
2021-11-30 18:30:44 +00:00
|
|
|
return PeerForIP{Node: p, Route: best}, true
|
2021-03-23 04:25:43 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2021-11-30 18:30:44 +00:00
|
|
|
return ret, false
|
2021-03-23 04:25:43 +00:00
|
|
|
}
|
|
|
|
|
2021-02-28 05:42:34 +00:00
|
|
|
type closeOnErrorPool []func()
|
|
|
|
|
|
|
|
func (p *closeOnErrorPool) add(c io.Closer) { *p = append(*p, func() { c.Close() }) }
|
|
|
|
func (p *closeOnErrorPool) addFunc(fn func()) { *p = append(*p, fn) }
|
|
|
|
func (p closeOnErrorPool) closeAllIfError(errp *error) {
|
|
|
|
if *errp != nil {
|
|
|
|
for _, closeFn := range p {
|
|
|
|
closeFn()
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2021-06-23 04:53:43 +00:00
|
|
|
|
|
|
|
// ipInPrefixes reports whether ip is in any of pp.
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func ipInPrefixes(ip netip.Addr, pp []netip.Prefix) bool {
|
2021-06-23 04:53:43 +00:00
|
|
|
for _, p := range pp {
|
|
|
|
if p.Contains(ip) {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// dnsIPsOverTailscale returns the IPPrefixes of DNS resolver IPs that are
|
|
|
|
// routed over Tailscale. The returned value does not contain duplicates is
|
|
|
|
// not necessarily sorted.
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func dnsIPsOverTailscale(dnsCfg *dns.Config, routerCfg *router.Config) (ret []netip.Prefix) {
|
|
|
|
m := map[netip.Addr]bool{}
|
2021-06-23 04:53:43 +00:00
|
|
|
|
2022-05-03 21:41:58 +00:00
|
|
|
add := func(resolvers []*dnstype.Resolver) {
|
2021-08-03 13:56:31 +00:00
|
|
|
for _, r := range resolvers {
|
2022-07-26 03:55:44 +00:00
|
|
|
ip, err := netip.ParseAddr(r.Addr)
|
2021-08-03 13:56:31 +00:00
|
|
|
if err != nil {
|
2022-07-26 03:55:44 +00:00
|
|
|
if ipp, err := netip.ParseAddrPort(r.Addr); err == nil {
|
2022-07-25 03:08:42 +00:00
|
|
|
ip = ipp.Addr()
|
2021-08-03 13:56:31 +00:00
|
|
|
} else {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
}
|
2021-06-23 04:53:43 +00:00
|
|
|
if ipInPrefixes(ip, routerCfg.Routes) && !ipInPrefixes(ip, routerCfg.LocalRoutes) {
|
|
|
|
m[ip] = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-06-24 19:57:26 +00:00
|
|
|
add(dnsCfg.DefaultResolvers)
|
|
|
|
for _, resolvers := range dnsCfg.Routes {
|
|
|
|
add(resolvers)
|
|
|
|
}
|
|
|
|
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
ret = make([]netip.Prefix, 0, len(m))
|
2021-06-23 04:53:43 +00:00
|
|
|
for ip := range m {
|
2022-07-25 03:08:42 +00:00
|
|
|
ret = append(ret, netip.PrefixFrom(ip, ip.BitLen()))
|
2021-06-23 04:53:43 +00:00
|
|
|
}
|
|
|
|
return ret
|
|
|
|
}
|
|
|
|
|
|
|
|
// fwdDNSLinkSelector is userspaceEngine's resolver.ForwardLinkSelector, to pick
|
|
|
|
// which network interface to send DNS queries out of.
|
|
|
|
type fwdDNSLinkSelector struct {
|
|
|
|
ue *userspaceEngine
|
|
|
|
tunName string
|
|
|
|
}
|
|
|
|
|
all: convert more code to use net/netip directly
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.)
perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. )
perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. )
goimports -w .
Then delete some stuff from the net/netaddr shim package which is no
longer neeed.
Updates #5162
Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-26 04:14:09 +00:00
|
|
|
func (ls fwdDNSLinkSelector) PickLink(ip netip.Addr) (linkName string) {
|
|
|
|
if ls.ue.isDNSIPOverTailscale.Load().(func(netip.Addr) bool)(ip) {
|
2021-06-23 04:53:43 +00:00
|
|
|
return ls.tunName
|
|
|
|
}
|
|
|
|
return ""
|
|
|
|
}
|
2021-11-17 00:01:42 +00:00
|
|
|
|
|
|
|
var (
|
2022-05-11 23:15:31 +00:00
|
|
|
metricMagicDNSPacketIn = clientmetric.NewCounter("magicdns_packet_in") // for 100.100.100.100
|
|
|
|
metricReflectToOS = clientmetric.NewCounter("packet_reflect_to_os")
|
2022-04-22 17:40:49 +00:00
|
|
|
|
|
|
|
metricNumMajorChanges = clientmetric.NewCounter("wgengine_major_changes")
|
|
|
|
metricNumMinorChanges = clientmetric.NewCounter("wgengine_minor_changes")
|
2021-11-17 00:01:42 +00:00
|
|
|
)
|