7385 Commits (percy/cherry-pick-2648d475d751b47755958f47a366e300b6b6de0a)

 

All Branches   

Search

Author	SHA1	Message	Date
Claire Wang	262fa8a01e	ipn/ipnlocal: populate peers' capabilities (#11365) ... Populates capabilties field of peers in ipn status. Updates tailscale/corp#17516 Signed-off-by: Claire Wang <claire@tailscale.com>	7 months ago
James Tucker	9eaa56df93	tsweb: update doc on BucketedStatsOptions.Finish to match behavior ... I originally came to update this to match the documented behavior, but the code is deliberately avoiding this behavior currently, making it hard to decide how to update this. For now just align the documentation to the behavior. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
Charlotte Brandhorst-Satzkorn	14683371ee	tailscale: update tailfs file and package names (#11590) ... This change updates the tailfs file and package names to their new naming convention. Updates #tailscale/corp#16827 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	7 months ago
Brad Fitzpatrick	1c259100b0	cmd/{derper,derpprobe}: add --version flag ... Fixes #11582 Change-Id: If99fc1ab6b89d624fbb07bd104dd882d2c7b50b4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Patrick O'Doherty	1535d0feca	safeweb: move http.Serve for HTTP redirects into lib (#11592) ... Refactor the interaction between caller/library when establishing the HTTP to HTTPS redirects by moving the call to http.Serve into safeweb. This makes linting for other uses of http.Serve easier without having to account for false positives created by the old interface. Updates https://github.com/tailscale/corp/issues/8027 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>	7 months ago
James Tucker	f384742375	net/packet: allow more ICMP errors ... We now allow some more ICMP errors to flow, specifically: - ICMP parameter problem in both IPv4 and IPv6 (corrupt headers) - ICMP Packet Too Big (for IPv6 PMTU) Updates #311 Updates #8102 Updates #11002 Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
Irbe Krumina	92ca770b8d	util/linuxfw: fix MSS clamping in nftables mode (#11588) ... MSS clamping for nftables was mostly not ran due to to an earlier rule in the FORWARD chain issuing accept verdict. This commit places the clamping rule into a chain of its own to ensure that it gets ran. Updates tailscale/tailscale#11002 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	7 months ago
Kyle Carberry	27038ee3c2	hostinfo: cache device model to speed up init ... This was causing a relatively consistent ~10ms of delay on Linux. Signed-off-by: Kyle Carberry <kyle@carberry.com>	7 months ago
Brad Fitzpatrick	ec87e219ae	logtail: delete unused code from old way to configure zstd ... Updates #cleanup Change-Id: I666ecf08ea67e461adf2a3f4daa9d1753b2dc1e4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Joe Tsai	e2586bc674	logtail: always zstd compress with FastestCompression and LowMemory (#11583) ... This is based on empirical testing using actual logs data. FastestCompression only incurs a marginal <1% compression ratio hit for a 2.25x reduction in memory use for small payloads (which are common if log uploads happen at a decently high frequency). The memory savings for large payloads is much lower (less than 1.1x reduction). LowMemory only incurs a marginal <5% hit on performance for a 1.6-2.0x reduction in memory use for small or large payloads. The memory gains for both settings justifies the loss of benefits, which are arguably minimal. tailscale/corp#18514 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	7 months ago
James Tucker	7558a1d594	ipn/ipnlocal: disable sockstats on (unstable) mobile by default ... We're tracking down a new instance of memory usage, and excessive memory usage from sockstats is definitely not going to help with debugging, so disable it by default on mobile. Updates tailscale/corp#18514 Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
Asutorufa	e20ce7bf0c	net/dns: close ctx when close dns directManager ... Signed-off-by: Asutorufa <16442314+Asutorufa@users.noreply.github.com>	7 months ago
Will Norris	1d2af801fa	.github/workflows: remove go-licenses action ... This is now handled by an action running in corp. Updates tailscale/corp#18803 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
License Updater	e80b99cdd1	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	7 months ago
Andrew Lytvynov	5aa4cfad06	safeweb: detect mux handler conflicts (#11562) ... When both muxes match, and one of them is a wildcard "/" pattern (which is common in browser muxes), choose the more specific pattern. If both are non-wildcard matches, there is a pattern overlap, so return an error. Updates https://github.com/tailscale/corp/issues/8027 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	7 months ago
Brad Fitzpatrick	e7599c1f7e	logtail: prevent js/wasm clients from picking TLS client cert ... Corp details: https://github.com/tailscale/corp/issues/18177#issuecomment-2026598715 https://github.com/tailscale/corp/pull/18775#issuecomment-2027505036 Updates tailscale/corp#18177 Change-Id: I7c03a4884540b8519e0996088d085af77991f477 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Irbe Krumina	5fb721d4ad	util/linuxfw,wgengine/router: skip IPv6 firewall configuration in partial iptables mode (#11546) ... We have hosts that support IPv6, but not IPv6 firewall configuration in iptables mode. We also have hosts that have some support for IPv6 firewall configuration in iptables mode, but do not have iptables filter table. We should: - configure ip rules for all hosts that support IPv6 - only configure firewall rules in iptables mode if the host has iptables filter table. Updates tailscale/tailscale#11540 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	7 months ago
Patrick O'Doherty	af61179c2f	safeweb: add opt-in inline style CSP toggle (#11551) ... Allow the use of inline styles with safeweb via an opt-in configuration item. This will append `style-src "self" "unsafe-inline"` to the default CSP. The `style-src` directive will be used in lieu of the fallback `default-src "self"` directive. Updates tailscale/corp#8027 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>	7 months ago
Brad Fitzpatrick	b0941b79d6	tsweb: make BucketedStats not track 400s, 404s, etc ... Updates tailscale/corp#18687 Change-Id: I142ccb1301ec4201c70350799ff03222bce96668 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	354cac74a9	tsweb/varz: add charset=utf-8 to varz handler ... Some of our labels contain UTF-8 and get mojibaked in the browser right now. Updates tailscale/corp#18687 Change-Id: I6069cffd6cc8813df415f06bb308bc2fc3ab65c4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
James Tucker	9401b09028	control/controlclient: move client watchdog to cover initial request ... The initial control client request can get stuck in the event that a connection is established but then lost part way through, without any ICMP or RST. Ensure that the control client will be restarted by timing out that initial request as well. Fixes #11542 Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
Irbe Krumina	9b5176c4d9	cmd/k8s-operator: fix failing tests (#11541) ... Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	7 months ago
Irbe Krumina	9e2f58f846	cmd/{k8s-nameserver,k8s-operator},k8s-operator: add a kube nameserver, make operator deploy it (#11017) ... * cmd/k8s-nameserver,k8s-operator: add a nameserver that can resolve ts.net DNS names in cluster. Adds a simple nameserver that can respond to A record queries for ts.net DNS names. It can respond to queries from in-memory records, populated from a ConfigMap mounted at /config. It dynamically updates its records as the ConfigMap contents changes. It will respond with NXDOMAIN to queries for any other record types (AAAA to be implemented in the future). It can respond to queries over UDP or TCP. It runs a miekg/dns DNS server with a single registered handler for ts.net domain names. Queries for other domain names will be refused. The intended use of this is: 1) to allow non-tailnet cluster workloads to talk to HTTPS tailnet services exposed via Tailscale operator egress over HTTPS 2) to allow non-tailnet cluster workloads to talk to workloads in the same cluster that have been exposed to tailnet over their MagicDNS names but on their cluster IPs. Updates tailscale/tailscale#10499 Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/k8s-operator/deploy/crds,k8s-operator: add DNSConfig CustomResource Definition DNSConfig CRD can be used to configure the operator to deploy kube nameserver (./cmd/k8s-nameserver) to cluster. Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/k8s-operator,k8s-operator: optionally reconcile nameserver resources Adds a new reconciler that reconciles DNSConfig resources. If a DNSConfig is deployed to cluster, the reconciler creates kube nameserver resources. This reconciler is only responsible for creating nameserver resources and not for populating nameserver's records. Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/{k8s-operator,k8s-nameserver}: generate DNSConfig CRD for charts, append to static manifests Signed-off-by: Irbe Krumina <irbe@tailscale.com> --------- Signed-off-by: Irbe Krumina <irbe@tailscale.com>	7 months ago
Patrick O'Doherty	b60c4664c7	safeweb: return http.Handler from safeweb.RedirectHTTP (#11538) ... Updates #cleanup Change the return type of the safeweb.RedirectHTTP method to a handler that can be passed directly to http.Serve without any http.HandlerFunc wrapping necessary. Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>	7 months ago
Brad Fitzpatrick	3e6306a782	derp/derphttp: make CONNECT Host match request-target's authority-form ... This CONNECT client doesn't match what Go's net/http.Transport does (making the two values match). This makes it match. This is all pretty unspecified but most clients & doc examples show these matching. And some proxy implementations (such as Zscaler) care. Updates tailscale/corp#18716 Change-Id: I135c5facbbcec9276faa772facbde1bb0feb2d26 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Patrick O'Doherty	8f27520633	safeweb: init (#11467) ... Updates https://github.com/tailscale/corp/issues/8027 Safeweb is a wrapper around http.Server & tsnet that encodes some application security defaults. Safeweb asks developers to split their HTTP routes into two http.ServeMuxs for serving browser and API-facing endpoints repsectively. It then wraps these HTTP routes with the context-appropriate security controls. safeweb.Server#Serve will serve the HTTP muxes over the provided listener. Caller are responsible for creating and tearing down their application's listeners. Applications being served over HTTPS that wish to implement HTTP redirects can use the Server#HTTPRedirect handler to do so. Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>	7 months ago
Andrea Gottardo	008676f76e	cmd/serve: update warning for sandboxed macOS builds (#11530)	7 months ago
Percy Wegmann	66e4d843c1	ipn/localapi: add support for multipart POST to file-put ... This allows sending multiple files via Taildrop in one request. Progress is tracked via ipn.Notify. Updates tailscale/corp#18202 Signed-off-by: Percy Wegmann <percy@tailscale.com>	7 months ago
Percy Wegmann	bed818a978	ipn/localapi: add support for multipart POST to file-put ... This allows sending multiple files via Taildrop in one request. Progress is tracked via ipn.Notify. Updates tailscale/corp#18202 Signed-off-by: Percy Wegmann <percy@tailscale.com>	7 months ago
Maisem Ali	0d8cd1645a	go.mod: bump github.com/gaissmai/bart ... To pick up https://github.com/gaissmai/bart/pull/17. Updates #deps Signed-off-by: Maisem Ali <maisem@tailscale.com>	7 months ago
Percy Wegmann	eb42a16da9	ipn/ipnlocal: report Taildrive access message on failed responses ... For example, if we get a 404 when downloading a file, we'll report access. Also, to reduce verbosty of logs, this elides 0 length files. Updates tailscale/corp#17818 Signed-off-by: Percy Wegmann <percy@tailscale.com>	7 months ago
Andrew Lytvynov	5d41259a63	cmd/tailscale/cli: remove Beta tag from tailscale update (#11529) ... Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	7 months ago
Charlotte Brandhorst-Satzkorn	acb611f034	ipn/localipn: introduce logs for tailfs (#11496) ... This change introduces some basic logging into the access and share pathways for tailfs. Updates tailscale/corp#17818 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	7 months ago
Irbe Krumina	4cbef20569	cmd/k8s-operator: redact auth key from debug logs (#11523) ... Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	7 months ago
Brad Fitzpatrick	55baf9474f	metrics, tsweb/varz: add multi-label map metrics ... Updates tailscale/corp#18640 Change-Id: Ia9ae25956038e9d3266ea165537ac6f02485b74c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Flakes Updater	90a4d6ce69	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	7 months ago
Brad Fitzpatrick	6d90966c1f	logtail: move a scratch buffer to Logger ... Rather than pass around a scratch buffer, put it on the Logger. This is a baby step towards removing the background uploading goroutine and starting it as needed. Updates tailscale/corp#18514 (insofar as it led me to look at this code) Change-Id: I6fd94581c28bde40fdb9fca788eb9590bcedae1b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Irbe Krumina	06e22a96b1	.github/workflows: fix path filter for 'Kubernetes manifests' test job (#11520) ... Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	7 months ago
Chris Milson-Tokunaga	b6dfd7443a	Change type of installCRDs (#11478) ... Including the double quotes (`"`) around the value made it appear like the helm chart should expect a string value for `installCRDs`. Signed-off-by: Chris Milson-Tokunaga <chris.w.milson@gmail.com>	7 months ago
Percy Wegmann	8b8b315258	net/tstun: use gaissmai/bart instead of tempfork/device ... This implementation uses less memory than tempfork/device, which helps avoid OOM conditions in the iOS VPN extension when switching to a Tailnet with ExitNode routing enabled. Updates tailscale/corp#18514 Signed-off-by: Percy Wegmann <percy@tailscale.com>	7 months ago
Andrew Lytvynov	1e7050e73a	go.mod: bump github.com/docker/docker (#11515) ... There's a vulnerability https://pkg.go.dev/vuln/GO-2024-2659 that govulncheck flags, even though it's only reachable from tests and cmd/sync-containers and cannot be exploited there. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	7 months ago
Brad Fitzpatrick	a36cfb4d3d	tailcfg, ipn/ipnlocal, wgengine/magicsock: add only-tcp-443 node attr ... Updates tailscale/corp#17879 Change-Id: I0dc305d147b76c409cf729b599a94fa723aef0e0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	7b34154df2	all: deprecate Node.Capabilities (more), remove PeerChange.Capabilities [capver 89] ... First we had Capabilities []string. Then https://tailscale.com/blog/acl-grants (#4217) brought CapMap, a superset of Capabilities. Except we never really finished the transition inside the codebase to go all-in on CapMap. This does so. Notably, this coverts Capabilities on the wire early to CapMap internally so the code can only deal in CapMap, even against an old control server. In the process, this removes PeerChange.Capabilities support, which no known control plane sent anyway. They can and should use PeerChange.CapMap instead. Updates #11508 Updates #4217 Change-Id: I872074e226b873f9a578d9603897b831d50b25d9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	4992aca6ec	tsweb/varz: flesh out munging of expvar keys into valid Prometheus metrics ... From a problem we hit with how badger registers expvars; it broke trunkd's exported metrics. Updates tailscale/corp#1297 Change-Id: I42e1552e25f734c6f521b6e993d57a82849464b2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	b104688e04	ipn/ipnlocal, types/netmap: replace hasCapability with set lookup on NetworkMap ... When node attributes were super rare, the O(n) slice scans looking for node attributes was more acceptable. But now more code and more users are using increasingly more node attributes. Time to make it a map. Noticed while working on tailscale/corp#17879 Updates #cleanup Change-Id: Ic17c80341f418421002fbceb47490729048756d2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Percy Wegmann	8c88853db6	ipn/ipnlocal: add c2n /debug/pprof/allocs endpoint ... This behaves the same as typical debug/pprof/allocs. Updates tailscale/corp#18514 Signed-off-by: Percy Wegmann <percy@tailscale.com>	7 months ago
Brad Fitzpatrick	f45594d2c9	control/controlclient: free memory on iOS before full netmap work ... Updates tailscale/corp#18514 Change-Id: I8d0330334b030ed8692b25549a0ee887ac6d7188 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
James Tucker	e0f97738ee	localapi: reduce garbage production in bus watcher ... Updates #optimization Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
James Tucker	3f7313dbdb	util/linuxfw,wgengine/router: enable IPv6 configuration when netfilter is disabled ... Updates #11434 Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
Brad Fitzpatrick	8444937c89	control/controlclient: fix panic regression from earlier load balancer hint header ... In the recent 20e9f3369 we made HealthChangeRequest machine requests include a NodeKey, as it was the oddball machine request that didn't include one. Unfortunately, that code was sometimes being called (at least in some of our integration tests) without a node key due to its registration with health.RegisterWatcher(direct.ReportHealthChange). Fortunately tests in corp caught this before we cut a release. It's possible this only affects this particular integration test's environment, but still worth fixing. Updates tailscale/corp#1297 Change-Id: I84046779955105763dc1be5121c69fec3c138672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago