March 2021 Summaries

The March Tailscale newsletter highlights various community contributions and product updates, featuring insights from users like Pat Reagan and Karan Sharma, who share their experiences with setting up secure, self-hosted systems using Tailscale. It also includes a Japanese article on setting up secure VPNs with Tailscale and Brian McMoses's account of using Tailscale’s subnet router feature for remote NAS access. The Tailscale team introduces essays on software design trade-offs, a new IP address type for Go, and best practices for SSH key rotation. The release of Tailscale v1.6 is announced, with IPv6 support and the introduction of "exit nodes" to route internet traffic through a specific device for enhanced security in untrusted environments. Updates to the admin console include improved visibility of ACL tags and a refreshed interface for tracking connected devices. The newsletter invites user feedback to further enhance Tailscale's offerings.

Tailscale, a networking application primarily written in Go, developed a new IP address type to address limitations in Go's standard library net.IP and net.IPNet types. The main issues with the existing types include mutability, lack of comparability, size inefficiencies, and allocation overheads, which hinder performance and usability. To overcome these problems, Tailscale introduced inet.af/netaddr, a package featuring a new IP type that is immutable, comparable, allocation-free, and supports both IPv4 and IPv6 with zones using a more compact 24-byte representation. This new type employs innovative techniques, such as using a uint128 struct for storage and leveraging pointers for zone representation, enabling faster operations and better memory efficiency. Additionally, the package includes other constructs like IPPort, IPPrefix, IPRange, and IPSet, offering more versatile solutions for handling IP addresses and networks in Go applications.

Tailscale's Control Protocol is a sophisticated system divided into a control plane and a data plane, designed to manage secure network connections through key management. The control plane handles user authentication, machine key validation, and the dissemination of public keys among network machines. Each machine generates a curve25519 private key upon installation, and the control server uses ECDH crypto_box messages to establish secure communication with clients. Machine keys require pre-authorization, ensuring that only approved machines join the network. Upon login, clients create a separate node key linked to a machine key and user identity, often verified through OAuth2 or SAML with multi-factor authentication. This node key configures WireGuard peers and is subject to automatic rotation for added security. Clients maintain a persistent HTTPS connection with the control server for real-time network updates, while firewall rules derived from network ACLs dictate permissible connections, streamlining policy management and maintaining separation of concerns between client operations and control protocols.