49 Commits

Author SHA1 Message Date
Cuong Manh Le
e52402eb0c Upgrade quic-go to v0.54.0 2025-09-25 16:45:05 +07:00
Cuong Manh Le
3937e885f0 Bump golang.org/x/net to v0.38.0
Fixes CVE-2025-22872
2025-04-01 23:20:12 +07:00
Cuong Manh Le
c60cf33af3 all: implement self-upgrade flag from API
So upgrading don't have to be initiated manually, helping large
deployments to upgrade to latest ctrld version easily.
2025-03-26 23:18:04 +07:00
Cuong Manh Le
8bf654aece Bump golang.org/x/net to v0.36.0
Fixing https://pkg.go.dev/vuln/GO-2025-3503
2025-03-26 23:17:18 +07:00
Alex
f7a6dbe39b fix upgrade flow
set service on new run, fix duplicate args

set service on new run, fix duplicate args

revert startCmd in upgrade flow due to pin compat issues

make restart reset DNS like upgrade, add debugging to uninstall method

debugging

debugging

debugging

debugging

debugging WMI

remove stackexchange lib, use ms wmi pkg

debugging

debugging

set correct class

fix os reolver init issues

fix netadapter class

use os resolver instead of fetching default nameservers while already running

remove debug lines

fix lookup IP

fix lookup IP

fix lookup IP

fix lookup IP

fix dns namserver retries when not needed
2025-01-31 20:04:03 +07:00
Alex
e573a490c9 ignore non physical ifaces in validInterfaces method on Windows
debugging

skip type 24 in nameserver detection

skip type 24 in nameserver detection

remove interface type check from valid interfaces for now

skip non hardware interfaces in DNS nameserver lookup

ignore win api log output

set retries to 5 and 1s backoff

reset DNS when upgrading to make sure we get the proper OS nameservers on start

init running iface for upgrade

update windows service options for auto restarts on failure

make upgrade use the actual stop and start commands

fix the windows service retry logic

fix the windows service retry logic

task debugging

more task debugging

windows service name fix

windows service name fix

fix start command args

fix restart delay

dont recover from non crash failures

fix upgrade flow
2025-01-30 17:06:43 +07:00
Alex
ce3281e70d much more debugging, improved nameserver detection, no more testing nameservers
fix logging

fix logging

try to enable nameserver logs

try to enable nameserver logs

handle flags in interface state changes

debugging

debugging

debugging

fix state detection, AD status fix

fix debugging line

more dc info

always log state changes

remove unused method

windows AD IP discovery

windows AD IP discovery

windows AD IP discovery
2025-01-29 12:28:49 +07:00
Cuong Manh Le
69e0aab73e cmd/cli: use wmi to get AD domain
Since using syscall.NetGetJoinInformation won't return the full domain
name.

Discovered while investigating issue with SRV ldap check.
2025-01-24 14:54:10 +07:00
Cuong Manh Le
5a566c028a cmd/cli: better error message when log file is empty
While at it, also record the size of logs being sent in debug/error
message.
2025-01-14 14:31:24 +07:00
Cuong Manh Le
ff43c74d8d Bump golang.org/x/net to v0.33.0
Fix CVE-2024-45338
2025-01-14 14:31:13 +07:00
Cuong Manh Le
221917e80b Bump golang.org/x/crypto to v0.31.0
To fix CVE-2024-45337 (even though ctrld do not use SSH)
2024-12-19 21:50:00 +07:00
Cuong Manh Le
8a96b8bec4 cmd/cli: adopt FilteredLevelWriter when doing internal logging
Without verbose log, we use internal log writer with log level set to
debug. However, this will affect other writers, like console log, since
they are default to notice level.

By adopting FilteredLevelWriter, we can make internal log writer run in
debug level, but all others will run in default level instead.
2024-12-19 21:50:00 +07:00
Cuong Manh Le
a9f76322bd Bump quic-go to v0.48.2
For fixing GO-2024-3302 (CVE-2024-53259)
2024-12-19 21:50:00 +07:00
Cuong Manh Le
5e9b4244e7 cmd/cli: get physical interfaces using Windows WMI 2024-12-19 21:34:26 +07:00
Cuong Manh Le
84e06c363c Avoid tailscale.com/tsd dependency
Since it brings gvisor.dev/gvisor to the dependency graph, causing the
binary size bloating on *nix (except darwin).
2024-11-13 15:00:41 +07:00
Cuong Manh Le
282a8ce78e all: add DNS Stamps support
See: https://dnscrypt.info/stamps-specifications
2024-09-30 18:15:16 +07:00
Cuong Manh Le
617674ce43 all: update tailscale.com to v1.74.0 2024-09-30 18:14:30 +07:00
Cuong Manh Le
69ee6582e2 Bump quic-go to v0.42.0
Fixes https://pkg.go.dev/vuln/GO-2024-2682
2024-04-11 00:19:36 +07:00
Cuong Manh Le
56b2056190 Bump golang.org/x/net to v0.23.0
Fix https://pkg.go.dev/vuln/GO-2024-2687
2024-04-04 22:44:29 +07:00
Cuong Manh Le
13db23553d Upgrade protobuf to v1.33.0
Fixing CVE-2024-24786.
2024-03-22 22:36:12 +07:00
Cuong Manh Le
ebcbf85373 cmd/cli: add upgrade command
This commit implements upgrade command which will:

 - Download latest version for current running arch.
 - Replacing the binary on disk.
 - Self-restart ctrld service.

If the service does not start with new binary, old binary will be
restored and self-restart again.
2024-03-22 16:08:14 +07:00
Cuong Manh Le
edca1f4f89 Drop quic free build
Since go1.21, Go standard library have added support for QUIC protocol.
The binary size gains between quic and quic-free version is now minimal.
Removing the quic free build, simplify the code and build process.
2024-02-07 14:38:19 +07:00
Cuong Manh Le
71f26a6d81 Add prometheus exporter
Updates #6
2024-01-22 23:12:17 +07:00
Cuong Manh Le
51b235b61a internal/clientinfo: implement ndp listen
So when new clients join the network, ctrld can really the event and
update client information to NDP table quickly.
2024-01-22 23:10:00 +07:00
Cuong Manh Le
3fea92c8b1 Bump golang.org/x/net to v0.17.0 2023-11-08 23:51:08 +07:00
Cuong Manh Le
34758f6205 Sending OS information in DoH header 2023-09-22 18:47:14 +07:00
Ginder Singh
507c1afd59 cmd: allow import/running ctrld as library 2023-09-22 18:44:24 +07:00
Cuong Manh Le
d58d8074f4 internal/clientinfo: use jaytaylor/go-hostsfile for parsing hosts file
txn2/txeh lower the hostname, which is not suitable for ctrld use case.
2023-09-22 18:39:04 +07:00
Cuong Manh Le
82e44b01af Add hosts file as source for hostname resolver 2023-09-22 18:29:37 +07:00
Cuong Manh Le
e355fd70ab Upgrading quic-go to v0.38.0 2023-09-22 18:28:36 +07:00
Cuong Manh Le
437fb1b16d all: add clients list command to debug Mac discovery 2023-08-09 23:54:23 +07:00
Cuong Manh Le
de951fd895 Upgrade dependencies for security/bug fixes
- tailscale.com to its latest v1.44.0
 - github.com/spf13/viper to its latest v1.16.0
2023-08-09 23:54:23 +07:00
Cuong Manh Le
24100c4cbe cmd/ctrld: use Windscribe fork of zerolog
For supporting default log level notice. While at it, also fix a missing
os.Exit call when setup router on non-supported platforms.
2023-05-15 20:54:01 +07:00
Cuong Manh Le
5cad0d6be1 all: watch link state on Linux using netlink
So we can detect changed to link and trigger re-bootstrap.
2023-05-13 12:24:16 +07:00
Cuong Manh Le
95dbf71939 Upgrage tailscale.com for fixing security issue 2023-03-31 23:31:38 +07:00
Cuong Manh Le
b65a5ac283 all: fix bug that causes ctrld stop working if bootstrap failed
The bootstrap process has two issues that can make ctrld stop resolving
after restarting machine host.

ctrld uses bootstrap DNS and os nameservers for resolving upstream. On
unix, /etc/resolv.conf content is used to get available nameservers.
This works well when installing ctrld. However, after being installed,
ctrld may modify the content of /etc/resolv.conf itself, to make other
apps use its listener as DNS resolver. So when ctrld starts after OS
restart, it ends up using [bootstrap DNS + ctrld's listener], for
resolving upstream. At this moment, if ctrld could not contact bootstrap
DNS for any reason, upstream domain will not be resolved.

For above reason, an upstream may not have bootstrap IPs after ctrld
starts. When re-bootstrapping, if there's no bootstrap IPs, ctrld should
call the setup bootstrap process again. Currently, it does not, causing
all queries failed.

This commit fixes above issue by adding mechanism for retrieving OS
nameservers properly, by querying routing table information:

 - Parsing /proc/net subsystem on Linux.
 - For BSD variants, just fetching routing information base from OS.
 - On Windows, just include the gateway information when reading iface.

The fixing for second issue is trivial, just kickoff a bootstrap process
if there's no bootstrap IPs when re-boostrapping.

While at it, also ensure that fetching resolver information from
ControlD API is also used the same approach.

Fixes #34
2023-03-31 10:23:05 +07:00
Cuong Manh Le
b3a342bc44 all: some improvements for better troubleshooting
- Include version/OS information when logging
 - Make time field human readable in log file
 - Force root privilege when running status command on darwin

Updates #34
2023-03-31 10:17:42 +07:00
Cuong Manh Le
2e1b3f9d07 Upgrade golang.org/x/net to v0.7.0
For pulling CVE-2022-41723 fix.
2023-03-07 10:25:48 +07:00
Cuong Manh Le
df514d15a5 Update quic-go to v0.32.0
Updates #51
2023-02-27 19:51:39 +07:00
Cuong Manh Le
d73ece9d9e Remove darwin from regular builds
PR #13 add notarizing step for darwin, but forgot to remove darwin from
regular OS builds.
2023-02-08 00:21:15 +07:00
Cuong Manh Le
851f9b9742 all: fork tailscale Linux dns manager package
With modification to fit our use case.
2023-02-03 02:47:31 +07:00
Cuong Manh Le
eb0dd6235e cmd/ctrld: use NetworkManager to disable DNS manager
Currently, ctrld force NetworkManager ignore auto DNS setup from DHCP
per connection. This does not work well, because an interface can be
attached to many connections. So if `ctrld` started with a connection,
then user connect to new one, the DNS configured by ctrld will be
override.

Instead, we can force NetworkManager not to manage DNS by:

 - Using dns=none
 - Set systemd-resolved=false

So NetworkManager won't attempt to send DNS setup to systemd-resolved,
leaving what ctrld set as-is.
2023-02-02 22:10:06 +07:00
Cuong Manh Le
149941f17f cmd/ctrld: do set/reset DNS only when start/stop/uninstall 2023-02-01 23:11:33 +07:00
Cuong Manh Le
b00a7c34ee cmd/ctrld: add --iface for setting DNS on specific interface 2023-01-20 21:43:03 +07:00
Cuong Manh Le
d5344aea52 cmd/ctrld: add list interfaces command 2023-01-20 21:37:55 +07:00
Cuong Manh Le
ec72af1916 cmd/ctrld: add commands to control ctrld as a system service
Supported actions:

 - start: install and start ctrld as a system service
 - stop: stop the ctrld service
 - restart: restart ctrld service
 - status: show status of ctrld service
 - uninstall: remove ctrld from system service
2023-01-20 21:33:31 +07:00
Cuong Manh Le
e331a4113a Rework os resolver
Currently, os resolver not only handle A and AAAA records, but also does
it wrongly, since when it packs AAAA record to a dns.A record.

This commit reworks os resolver to make it works with all supported
record types.
2023-01-20 21:33:17 +07:00
Cuong Manh Le
30fefe7ab9 all: add local caching
This commit adds config params to enable local DNS response caching and
control its behavior, allow tweaking the cache size, ttl override and
serving stale response.
2023-01-20 21:33:01 +07:00
Cuong Manh Le
91d60d2a64 Import code, preparing for release 2022-12-13 01:27:48 +07:00