Commit Graph

702 Commits

Author SHA1 Message Date
David Anderson
c5835c6ced wgengine/magicsock: temporarily deflake.
The remaining flake occurs due to a mysterious packet loss. This
doesn't affect normal tailscaled operations, so until I track down
where the loss occurs and fix it, the flaky test is going to be
lenient about packet loss (but not about whether the spray logic
worked).

Signed-off-by: David Anderson <danderson@tailscale.com>
2020-03-06 12:14:54 -08:00
Brad Fitzpatrick
61d83f759b wgengine/magicsock: remove redundant derpMagicIP comparison
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-03-06 11:31:39 -08:00
David Anderson
bd60a750e8 wgengine/magicsock: fix packet spraying test to (mostly) pass.
It previously passed incorrectly due to bugs. With those fixed,
it becomes flaky for 2 reasons. One of them is the wireguard handshake
race, which can eat the 1st sprayed packet and prevent roamAddr
discovery. This change fixes that failure, by spreading the test
traffic out enough that additional spraying occurs.

Signed-Off-By: David Anderson <danderson@tailscale.com>
2020-03-06 11:10:13 -08:00
David Anderson
ef31dd7bb5 wgengine/magicsock: check all 3 fast paths independently.
The previous code would skip the DERP short-circuit if roamAddr
was set, which is not what we wanted. More generally, hitting
any of the fast path conditions is a direct return, so we can
just have 3 standalone branches rather than 'else if' stuff.

Signed-Off-By: David Anderson <danderson@tailscale.com>
2020-03-06 11:10:13 -08:00
David Anderson
05a52746a4 wgengine/magicsock: fix destination selection logic to work with DERP.
The effect is subtle: when we're not spraying packets, and have not yet
figured out a curAddr, and we're not spraying, we end up sending to
whatever the first IP is in the iteration order. In English, that
means "when we have no idea where to send packets, and we've given
up on sending to everyone, just send to the first addr we see in
the list."

This is, in general, what we want, because the addrs are in sorted
preference order, low to high, and DERP is the least preferred
destination. So, when we have no idea where to send, send to DERP,
right?

... Except for very historical reasons, appendDests iterated through
addresses in _reverse_ order, most preferred to least preferred.
crawshaw@ believes this was part of the earliest handshaking
algorithm magicsock had, where it slowly iterated through possible
destinations and poked handshakes to them one at a time.

Anyway, because of this historical reverse iteration, in the case
described above of "we have no idea where to send", the code would
end up sending to the _most_ preferred candidate address, rather
than the _least_ preferred. So when in doubt, we'd end up firing
packets into the blackhole of some LAN address that doesn't work,
and connectivity would not work.

This case only comes up if all your non-DERP connectivity options
have failed, so we more or less failed to detect it because we
didn't have a pathological test box deployed. Worse, codependent
bug 2839854994 made DERP accidentally
work sometimes anyway by incorrectly exploiting roamAddr behavior,
albeit at the cost of making DERP traffic symmetric. In fixing
DERP to once again be asymmetric, we effectively removed the
bandaid that was concealing this bug.

Signed-Off-By: David Anderson <danderson@tailscale.com>
2020-03-06 11:10:13 -08:00
David Anderson
97e58ad44d wgengine/magicsock: only set addrByKey once in CreateEndpoint.
Signed-Off-By: David Anderson <danderson@tailscale.com>
2020-03-06 11:10:13 -08:00
Brad Fitzpatrick
fbab12c94c wgengine/magicsock: skip netcheck if external STUN aren't in use
Updates #146 (not a complete fix yet probably)
2020-03-06 07:47:54 -08:00
Brad Fitzpatrick
fe0051fafd wgengine/magicsock: expand AddrSet.addrs comment 2020-03-05 21:17:41 -08:00
David Anderson
2839854994 wgengine/magicsock: never set a DERP server as a roamAddr.
DERP traffic is asymmetric by design, with nodes always sending
to their peer's home DERP server. However, if roamAddr is set,
magicsock will always push data there, rather than let DERP
server selection do its thing, so we end up accidentally
creating a symmetric flow.

Signed-Off-By: David Anderson <danderson@tailscale.com>
2020-03-05 17:45:17 -08:00
David Anderson
4f5c0da1ae wgengine/magicsock: log when home DERP server changes. 2020-03-05 17:18:05 -08:00
Brad Fitzpatrick
6978b93bdd derp, magicsock: track home (preferred) vs visiting connections for stats 2020-03-05 15:00:56 -08:00
Brad Fitzpatrick
12b77f30ad wgengine/magicsock: close stale DERP connections 2020-03-05 12:49:37 -08:00
Brad Fitzpatrick
2cff9016e4 net/dnscache: add overly simplistic DNS cache package for selective use
I started to write a full DNS caching resolver and I realized it was
overkill and wouldn't work on Windows even in Go 1.14 yet, so I'm
doing this tiny one instead for now, just for all our netcheck STUN
derp lookups, and connections to DERP servers. (This will be caching a
exactly 8 DNS entries, all ours.)

Fixes #145 (can be better later, of course)
2020-03-05 12:23:37 -08:00
Brad Fitzpatrick
a36ccb8525 wgengine/magicsock: actually add to the activeDerp map
Fixes bug just introduced in 8f9849c140; not tested enough :(
2020-03-05 12:23:37 -08:00
Brad Fitzpatrick
8f9849c140 wgengine/magicsock: collapse three DERP maps down into one 2020-03-05 08:54:08 -08:00
Brad Fitzpatrick
40ebba1373 magicsock: use [unexpected] convention more
Fixes #136 (not entirely, but we have a convention now)
2020-03-05 08:18:55 -08:00
Brad Fitzpatrick
848a2bddf0 wgengine/magicsock: update set of DERP nodes 2020-03-05 08:18:55 -08:00
David Crawshaw
7932481b95 magicsock: lookup AddrSet by key from DERP
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-03-04 18:07:27 -05:00
Brad Fitzpatrick
eac62ec5ff ipn, wgengine/magicsock: add ipn.Prefs.DisableDERP bool
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-03-04 12:53:37 -08:00
Brad Fitzpatrick
bf704a5218 derp: protocol negotiation, add v2: send src pub keys to clients in packets
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-03-04 09:55:13 -08:00
David Crawshaw
a65b2a0efd magicsock: add some DERP tests
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-03-04 12:40:33 -05:00
David Crawshaw
a33419167b magicsock: plumb through derpTLSConfig variable (for testing)
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-03-04 12:40:33 -05:00
David Crawshaw
caec2c7e8b magicsock: test sequence of pings
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-03-04 12:40:33 -05:00
David Crawshaw
9f584414d9 magicsock: simple ping test via magicsock
Passes `go test -count=20 -race ./wgengine/magicsock`

Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-03-04 12:40:33 -05:00
David Crawshaw
34859f8e7d wgengine, magicsock: add a CreateBind method
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-03-04 12:40:33 -05:00
David Crawshaw
75e62d318f magicsock: use local STUN server in tests
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-03-04 12:40:33 -05:00
Brad Fitzpatrick
b27d4c017a magicsock, wgengine, ipn, controlclient: plumb regular netchecks to map poll
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-03-04 08:19:45 -08:00
Brad Fitzpatrick
724c37fb41 wgengine/magicsock: start tracking nearest DERP node 2020-03-03 17:50:17 -08:00
Brad Fitzpatrick
4675c70464 wgengine/magicsock: check STUN regularly 2020-03-02 12:37:52 -08:00
Brad Fitzpatrick
bc7bc43fb8 magicsock, interfaces: move some code from magicsock to interfaces 2020-03-02 10:38:44 -08:00
Brad Fitzpatrick
af7a01d6f0 wgengine/magicsock: drop donec channel, rename epUpdateCtx to serve its purpose 2020-03-02 09:31:25 -08:00
David Crawshaw
cc4afa775f magicsock: rate limit send error log messages
The x/time/rate dependency adds 24kb to tailscaled binary size.

Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-03-02 08:10:06 -05:00
David Crawshaw
0752c77dc2 magicsock: keep DERP magic IPs out of the address map
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-03-01 07:29:48 -05:00
David Crawshaw
c6550135d5 magicsock: remove the index from indexedAddrs
The value predates the introduction of AddrSet which replaces
the index by tracking curAddr directly.

Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-03-01 07:29:48 -05:00
Brad Fitzpatrick
1abf2da392 wgengine/magicsock: reset favorite address on handshakes
Updates #92 (not a complete fix; could be better/faster?)

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-28 17:23:09 -05:00
Brad Fitzpatrick
67ede8d6d2 wgengine, magicsock: fix SetPrivateKey data race
Updates #112

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-28 11:15:07 -08:00
Brad Fitzpatrick
c185e6b4b0 stunner: support IPv6, add latency info to callbacks, use unique TxIDs per retry
And some more docs.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-27 09:23:51 -08:00
David Crawshaw
a6ad3c46e2 magicsock: spray some normal packets after a handshake
In particular, this is designed to catch the case where a
HandshakeInitiation packet is sent out but the intermediate NATs
have not been primed, so the packet passes over DERP.
In that case, the HandshakeResponse also comes back over DERP,
and the connection proceeds via DERP without ever trying to punch
through the NAT.

With this change, the HandshakeResponse (which was sprayed out
and so primed one NAT) triggers an UpdateDst, which triggers
the extra spray logic.

(For this to work, there has to be an initial supply of packets
to send on to a peer for the three seconds following a handshake.
The source of these packets is left as a future exercise.)

Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-02-24 17:29:35 -05:00
Brad Fitzpatrick
8696b17b5f wgengine/magicsock: turn off DERP log spamminess by default
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-24 10:24:12 -08:00
Brad Fitzpatrick
7a3b91390b wgengine/magicsock: fix crash in Send when Endpoint isn't an AddrSet
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-24 08:47:20 -08:00
David Crawshaw
868cfae84f wgengine, magicsock: adjust for wireguard-go conn/device package split
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2020-02-24 07:30:14 -05:00
Brad Fitzpatrick
cc7b9b0dff control/controlclient: fix priority of DERP server, add comment 2020-02-21 14:47:05 -08:00
Brad Fitzpatrick
c02f4b5a1f control/controlclient: add temporary mechanism to force derp on
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-21 14:09:24 -08:00
Brad Fitzpatrick
525bf1f3d2 wgengine/magicsock: remember fixed port number preference
So LinkChange events rebind to the same port when possible.
2020-02-21 13:51:18 -08:00
Brad Fitzpatrick
379a3125fd derp, wgengine/magicsock: support more than just packets from Client.Recv
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-20 22:08:13 -08:00
Brad Fitzpatrick
d298d5b1f8 wgengine/magicsock: support multiple derp servers, and not just for handshakes
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-20 08:10:12 -08:00
Brad Fitzpatrick
fd1aa4f7f6 wgengine/magicsock: add a reSTUN method
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-18 10:55:36 -08:00
Brad Fitzpatrick
e06ca40650 wgengine, magicsock, derp: misc cleanups, docs
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-18 08:58:00 -08:00
Brad Fitzpatrick
259406e797 derp: move away from [32]byte key types
And some minor cleanup in the process.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-17 14:18:09 -08:00
Brad Fitzpatrick
587c3fcac4 control/controlclient, wgengine/magicsock: misc cleanups
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-02-14 09:50:08 -08:00
David Crawshaw
87334fb332 wgengine, controlclient: fewer pointers in wgcfg key types
Signed-off-by: David Crawshaw <david@zentus.com>
2020-02-10 22:09:59 -05:00
Earl Lee
a8d8b8719a Move Linux client & common packages into a public repo. 2020-02-09 09:32:57 -08:00