tailscale

Commit Graph

Author	SHA1	Message	Date
James Tucker	0e2cb76abe	appc: add test to ensure that individual IPs are not removed during route updates If control advised the connector to advertise a route that had already been discovered by DNS it would be incorrectly removed. Now those routes are preserved. Updates tailscale/corp#16833 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Charlotte Brandhorst-Satzkorn	ce4553b988	appc,ipn/ipnlocal: optimize preference adjustments when routes update This change allows us to perform batch modification for new route advertisements and route removals. Additionally, we now handle the case where newly added routes are covered by existing ranges. This change also introduces a new appctest package that contains some shared functions used for testing. Updates tailscale/corp#16833 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	9 months ago
Irbe Krumina	370ec6b46b	cmd/k8s-operator: don't proceed with Ingress that has no valid backends (#10919 ) Do not provision resources for a tailscale Ingress that has no valid backends. Updates tailscale/tailscale#10910 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	9 months ago
Andrew Dunham	b45089ad85	net/portmapper: handle cases where we have no supported clients This no longer results in a nil pointer exception when we get a valid UPnP response with no supported clients. Updates #10911 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6e3715a49a193ff5261013871ad7fff197a4d77e	9 months ago
James Tucker	4e822c031f	go.toolchain.rev: bump Tailscale Go version to 1.21.6 Updates tailscale/go#83 Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
Flakes Updater	b787c27c00	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	10 months ago
James Tucker	7e3bcd297e	go.mod,wgengine/netstack: bump gvisor Updates #8043 Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
David Anderson	17eae5b0d3	tool/gocross: force use of our custom toolchain The new 'toolchain' directive in go.mod can sometimes force the use of an upstream toolchain against our wishes. Concurrently, some of our dependencies have added the 'toolchain' directive, which transitively adds it to our own go.mod. Force all uses of gocross to ignore that directive and stick to our customized toolchain. Updates #cleanup Signed-off-by: David Anderson <danderson@tailscale.com>	10 months ago
David Anderson	ae79b2e784	tsweb: add a helper to validate redirect URLs We issue redirects in a few different places, it's time to have a common helper to do target validation. Updates tailscale/corp#16875 Signed-off-by: David Anderson <danderson@tailscale.com>	10 months ago
Claire Wang	213d696db0	magicsock: mute noisy expected peer mtu related error (#10870 )	10 months ago
kari-ts	62b056d677	VERSION.txt: this is v1.59.0 (#10884 ) * VERSION.txt: this is v1.58.0 Signed-off-by: kari-ts <kari@tailscale.com> * VERSION.txt: this is v1.59.0 --------- Signed-off-by: kari-ts <kari@tailscale.com>	10 months ago
Flakes Updater	5b4eb47300	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	10 months ago
James Tucker	457102d070	go.mod: bump most deps for start of cycle Plan9 CI is disabled. 3p dependencies do not build for the target. Contributor enthusiasm appears to have ceased again, and no usage has been made. Skipped gvisor, nfpm, and k8s. Updates #5794 Updates #8043 Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
Andrew Dunham	7a0392a8a3	wgengine/netstack: expose gVisor metrics through expvar When tailscaled is run with "-debug 127.0.0.1:12345", these metrics are available at: http://localhost:12345/debug/metrics Updates #8210 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I19db6c445ac1f8344df2bc1066a3d9c9030606f8	10 months ago
as2643	832e5c781d	util/nocasemaps: add AppendSliceElem method to nocasemaps (#10871 ) Updates #7667 Signed-off-by: Anishka Singh <anishkasingh66@gmail.com>	10 months ago
ChandonPierre	2ce596ea7a	cmd/k8s-operator/deploy: allow modifying operator tags via Helm values Updates tailscale/tailscale#10659 Signed-off-by: Chandon Pierre <cpierre@coreweave.com>	10 months ago
Andrew Dunham	2ac7c0161b	util/slicesx: add Filter function For use in corp, where we appear to have re-implemented this in a few places with varying signatures. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id863a87e674f3caa87945519be8e09650e9c1d76	10 months ago
Irbe Krumina	2aec4f2c43	./github/workflows/kubemanifests.yaml: fix the paths whose changes should trigger test runs (#10885 ) Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	10 months ago
James Tucker	8250582fe6	ipn/ipnlocal: make app connector configuration concurrent If there are routes changes as a side effect of an app connector configuration update, the connector configuration may want to reenter a lock, so must be started asynchronously. Updates tailscale/corp#16833 Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
James Tucker	38a1cf748a	control/controlclient,util/execqueue: extract execqueue into a package This is a useful primitive for asynchronous execution of ordered work I want to use in another change. Updates tailscale/corp#16833 Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
Flakes Updater	32f01acc79	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	10 months ago
James Tucker	24df1ef1ee	appc,ipn/ipnlocal,types/appctype: implement control provided routes Control can now send down a set of routes along with the domains, and the routes will be advertised, with any newly overlapped routes being removed to reduce the size of the routing table. Fixes tailscale/corp#16833 Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
Andrea Gottardo	543e7ed596	licenses: mention tvOS in apple.md (#10872 ) Signed-off-by: Andrea Gottardo <andrea@tailscale.com>	10 months ago
License Updater	3eba895293	licenses: update tailscale{,d} licenses Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	10 months ago
License Updater	9fa2c4605f	licenses: update android licenses Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	10 months ago
Joe Tsai	c25968e1c5	all: make use of ctxkey everywhere (#10846 ) Also perform minor cleanups on the ctxkey package itself. Provide guidance on when to use ctxkey.Key[T] over ctxkey.New. Also, allow for interface kinds because the value wrapping trick also happens to fix edge cases with interfaces in Go. Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>	10 months ago
Joe Tsai	7732377cd7	tstime/rate: implement Value.{Marshal,Unmarshal}JSON (#8481 ) Implement support for marshaling and unmarshaling a Value. Updates tailscale/corp#8427 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	10 months ago
Irbe Krumina	1c3c3d6752	cmd/k8s-operator: warn if unsupported Ingress Exact path type is used. (#10865 ) To reduce the likelihood of breaking users, if we implement stricter Exact path type matching in the future. Updates tailscale/tailscale#10730 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	10 months ago
Irbe Krumina	50b52dbd7d	cmd/k8s-operator: sync StatefulSet labels to their Pods (#10861 ) So that users have predictable label values to use when configuring network policies. Updates tailscale/tailscale#10854 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	10 months ago
Irbe Krumina	d0492fdee5	cmd/k8s-operator: adds a tailscale IngressClass resource, prints warning if class not found. (#10823 ) * cmd/k8s-operator/deploy: deploy a Tailscale IngressClass resource. Some Ingress validating webhooks reject Ingresses with .spec.ingressClassName for which there is no matching IngressClass. Additionally, validate that the expected IngressClass is present, when parsing a tailscale `Ingress`. We currently do not utilize the IngressClass, however we might in the future at which point we might start requiring that the right class for this controller instance actually exists. Updates tailscale/tailscale#10820 Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Anton Tolchanov <anton@tailscale.com>	10 months ago
License Updater	381430eeca	licenses: update win/apple licenses Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	10 months ago
Joe Tsai	241a541864	util/ctxkey: add package for type-safe context keys (#10841 ) The lack of type-safety in context.WithValue leads to the common pattern of defining of package-scoped type to ensure global uniqueness: type fooKey struct{} func withFoo(ctx context, v Foo) context.Context { return context.WithValue(ctx, fooKey{}, v) } func fooValue(ctx context) Foo { v, _ := ctx.Value(fooKey{}).(Foo) return v } where usage becomes: ctx = withFoo(ctx, foo) foo := fooValue(ctx) With many different context keys, this can be quite tedious. Using generics, we can simplify this as: var fooKey = ctxkey.New("mypkg.fooKey", Foo{}) where usage becomes: ctx = fooKey.WithValue(ctx, foo) foo := fooKey.Value(ctx) See https://go.dev/issue/49189 Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>	10 months ago
kari-ts	c9fd166cc6	net/netmon: when a new network is added, trigger netmon update (#10840 ) Fixes #10107	10 months ago
Will Norris	236531c5fc	ipn/ipnserver: always allow Windows SYSTEM user to connect When establishing connections to the ipnserver, we validate that the local user is allowed to connect. If Tailscale is currently being managed by a different user (primarily for multi-user Windows installs), we don't allow the connection. With the new device web UI, the inbound connection is coming from tailscaled itself, which is often running as "NT AUTHORITY\SYSTEM". In this case, we still want to allow the connection, even though it doesn't match the user running the Tailscale GUI. The SYSTEM user has full access to everything on the system anyway, so this doesn't escalate privileges. Eventually, we want the device web UI to run outside of the tailscaled process, at which point this exception would probably not be needed. Updates tailscale/corp#16393 Signed-off-by: Will Norris <will@tailscale.com>	10 months ago
James Tucker	7100b6e721	derp: optimize another per client field alignment Updates #self Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
James Tucker	ee20327496	derp: remove unused per-client struct field Updates #self Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
OSS Updater	d841ddcb13	go.mod: update web-client-prebuilt module Signed-off-by: OSS Updater <noreply+oss-updater@tailscale.com>	10 months ago
James Tucker	a7f65b40c5	derp: optimize field order to reduce GC cost See the field alignment lints for more information. Reductions are 64->24 and 64->32 respectively. Updates #self Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
Charlotte Brandhorst-Satzkorn	e6910974ca	cmd/tailscale/cli: add description to exit-node CLI command This change adds a description to the exit-node CLI command. This description will be displayed when using `tailscale -h` and `tailscale exit-node -h`. Fixes #10787 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	10 months ago
Irbe Krumina	169778e23b	cmd/k8s-operator: minor fix in name gen (#10830 ) Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	10 months ago
Will Norris	b89c113365	client/web: skip connectivity check on https The manage client always listens on http (non-secure) port 5252. If the login client is loaded over https, then the connectivity check to `/ok` will fail with a mixed-content error. Mixed-content enforcement is a browser setting that we have no control over, so there's no way around this. In this case of the login client being loaded over https, we skip the connectivity check entirely. We will always render the sign-in button, though we don't know for sure if the user has connectivity, so we provide some additional help text in case they have trouble signing in. Updates hassio-addons/addon-tailscale#314 Signed-off-by: Will Norris <will@tailscale.com>	10 months ago
James Tucker	ff9c1ebb4a	derp: reduce excess goroutines blocking on broadcasts Observed on one busy derp node, there were 600 goroutines blocked writing to this channel, which represents not only more blocked routines than we need, but also excess wake-ups downstream as the latent goroutines writes represent no new work. Updates #self Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
Irbe Krumina	5cc1bfe82d	cmd/k8s-operator: remove configuration knob for Connector (#10791 ) The configuration knob (that defaulted to Connector being disabled) was added largely because the Connector CRD had to be installed in a separate step. Now when the CRD has been added to both chart and static manifest, we can have it on by default. Updates tailscale/tailscale#10878 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	10 months ago
Irbe Krumina	469af614b0	cmd/k8s-operator: fix base truncating for extra long Service names (#10825 ) cmd/k8s-operator: fix base truncating for extra long Service names StatefulSet names for ingress/egress proxies are calculated using Kubernetes name generator and the parent resource name as a base. The name generator also cuts the base, but has a higher max cap. This commit fixes a bug where, if we get a shortened base back from the generator, we cut off too little as the base that we have cut will be passed into the generator again, which will then itself cut less because the base is shorter- so we end up with a too long name again. Updates tailscale/tailscale#10807 Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Irbe Krumina <irbekrm@gmail.com>	10 months ago
Sonia Appasamy	331a6d105f	client/web: add initial types for using peer capabilities Sets up peer capability types for future use within the web client views and APIs. Updates tailscale/corp#16695 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Andrew Dunham	6540d1f018	wgengine/router: look up absolute path to netsh.exe on Windows This is in response to logs from a customer that show that we're unable to run netsh due to the following error: router: firewall: adding Tailscale-Process rule to allow UDP for "C:\\Program Files\\Tailscale\\tailscaled.exe" ... router: firewall: error adding Tailscale-Process rule: exec: "netsh": cannot run executable found relative to current directory: There's approximately no reason to ever dynamically look up the path of a system utility like netsh.exe, so instead let's first look for it in the System32 directory and only if that fails fall back to the previous behaviour. Updates #10804 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I68cfeb4cab091c79ccff3187d35f50359a690573	10 months ago
Irbe Krumina	ca48db0d60	Makefile,build_docker.sh: allow to configure target platform. (#10806 ) Build dev tailscale and k8s-operator images for linux/amd64 only by default, make it possible to configure target build platform via PLATFORM var. Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	10 months ago
Flakes Updater	91c7dfe85c	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	10 months ago
Andrew Lytvynov	86e476c8d1	version/mkversion: allow version override with $TS_VERSION_OVERRIDE (#10799 ) This is useful to build local binaries with custom versions to test version-specific logic (like updates). Updates https://github.com/tailscale/corp/issues/16703 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	10 months ago
Andrew Lytvynov	4ec6a78551	go.mod: update golang-x-crypto fork (#10786 ) Pick up a bunch of recent upstream commits. Updates #8593 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	10 months ago

... 20 21 22 23 24 ...

8121 Commits (031f1a2315eea3bd7fa2d63d36392f07d93f9039) All Branches Search

8121 Commits (031f1a2315eea3bd7fa2d63d36392f07d93f9039)

All Branches