8344 Commits (0cfa217f3e6e2078b82d73bd177bc1d96c291fb2)

 

All Branches   

Search

Author	SHA1	Message	Date
dependabot[bot]	0cfa217f3e	.github: Bump actions/upload-artifact from 4.4.0 to 4.4.3 (#13811) ... Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.4.0 to 4.4.3. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](50769540e7...b4b15b8c7c) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 weeks ago
dependabot[bot]	1847f26042	.github: Bump github/codeql-action from 3.26.11 to 3.27.1 (#14062) ... Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.26.11 to 3.27.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](6db8d6351f...4f3212b617) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 weeks ago
Naman Sood	7c6562c861	words: scale up our word count (#14082) ... Updates tailscale/corp#14698 Signed-off-by: Naman Sood <mail@nsood.in>	2 weeks ago
Brad Fitzpatrick	0c6bd9a33b	words: add a scale ... https://portsmouthbrewery.com/shilling-scale/ Any scale that includes "wee heavy" is a scale worth including. Updates #words Change-Id: I85fd7a64cf22e14f686f1093a220cb59c43e46ba Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 weeks ago
Irbe Krumina	cf41cec5a8	cmd/{k8s-operator,containerboot},k8s-operator: remove support for proxies below capver 95. (#13986) ... Updates tailscale/tailscale#13984 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2 weeks ago
Irbe Krumina	e38522c081	go.{mod,sum},build_docker.sh: bump mkctr, add ability to set OCI annotations for images (#14065) ... Updates tailscale/tailscale#12914 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2 weeks ago
Tom Proctor	d8a3683fdf	cmd/k8s-operator: restart ProxyGroup pods less (#14045) ... We currently annotate pods with a hash of the tailscaled config so that we can trigger pod restarts whenever it changes. However, the hash updates more frequently than is necessary causing more restarts than is necessary. This commit removes two causes; scaling up/down and removing the auth key after pods have initially authed to control. However, note that pods will still restart on scale-up/down because of the updated set of volumes mounted into each pod. Hopefully we can fix that in a planned follow-up PR. Updates #13406 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	2 weeks ago
Brad Fitzpatrick	4e0fc037e6	all: use iterators over slice views more ... This gets close to all of the remaining ones. Updates #12912 Change-Id: I9c672bbed2654a6c5cab31e0cbece6c107d8c6fa Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 weeks ago
Brad Fitzpatrick	00be1761b7	util/codegen: treat unique.Handle as an opaque value type ... It doesn't need a Clone method, like a time.Time, etc. And then, because Go 1.23+ uses unique.Handle internally for the netip package types, we can remove those special cases. Updates #14058 (pulled out from that PR) Updates tailscale/corp#24485 Change-Id: Iac3548a9417ccda5987f98e0305745a6e178b375 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 weeks ago
Irbe Krumina	b9ecc50ce3	cmd/k8s-operator,k8s-operator,kube/kubetypes: add an option to configure app connector via Connector spec (#13950) ... * cmd/k8s-operator,k8s-operator,kube/kubetypes: add an option to configure app connector via Connector spec Updates tailscale/tailscale#11113 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2 weeks ago
M. J. Fromberger	6ff85846bc	safeweb: add a Shutdown method to the Server type (#14048) ... Updates #14047 Change-Id: I2d20454c715b11ad9c6aad1d81445e05a170c3a2 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	2 weeks ago
Anton Tolchanov	64d70fb718	ipn/ipnlocal: log a summary of posture identity response ... Perhaps I was too opimistic in #13323 thinking we won't need logs for this. Let's log a summary of the response without logging specific identifiers. Updates tailscale/corp#24437 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 weeks ago
Brad Fitzpatrick	020cacbe70	derp/derphttp: don't link websockets other than on GOOS=js ... Or unless the new "ts_debug_websockets" build tag is set. Updates #1278 Change-Id: Ic4c4f81c1924250efd025b055585faec37a5491d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 weeks ago
Brad Fitzpatrick	c3306bfd15	control/controlhttp/controlhttpserver: split out Accept to its own package ... Otherwise all the clients only using control/controlhttp for the ts2021 HTTP client were also pulling in WebSocket libraries, as the server side always needs to speak websockets, but only GOOS=js clients speak it. This doesn't yet totally remove the websocket dependency on Linux because Linux has a envknob opt-in to act like GOOS=js for manual testing and force the use of WebSockets for DERP only (not control). We can put that behind a build tag in a future change to eliminate the dep on all GOOSes. Updates #1278 Change-Id: I4f60508f4cad52bf8c8943c8851ecee506b7ebc9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 weeks ago
Brad Fitzpatrick	23880eb5b0	cmd/tailscaled: support "ts_omit_ssh" build tag to remove SSH ... Some environments would like to remove Tailscale SSH support for the binary for various reasons when not needed (either for peace of mind, or the ~1MB of binary space savings). Updates tailscale/corp#24454 Updates #1278 Updates #12614 Change-Id: Iadd6c5a393992c254b5dc9aa9a526916f96fd07a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 weeks ago
Irbe Krumina	2c8859c2e7	client/tailscale,ipn/{ipnlocal,localapi}: add a pre-shutdown localAPI endpoint that terminates control connections. (#14028) ... Adds a /disconnect-control local API endpoint that just shuts down control client. This can be run before shutting down an HA subnet router/app connector replica - it will ensure that all connection to control are dropped and control thus considers this node inactive and tells peers to switch over to another replica. Meanwhile the existing connections keep working (assuming that the replica is given some graceful shutdown period). Updates tailscale/tailscale#14020 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	3 weeks ago
Brad Fitzpatrick	3090461961	tsweb/varz: optimize some allocs, add helper func for others ... Updates #cleanup Updates tailscale/corp#23546 (noticed when doing this) Change-Id: Ia9f627fe32bb4955739b2787210ba18f5de27f4d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 weeks ago
Irbe Krumina	8ba9b558d2	envknob,kube/kubetypes,cmd/k8s-operator: add app type for ProxyGroup (#14029) ... Sets a custom hostinfo app type for ProxyGroup replicas, similarly to how we do it for all other Kubernetes Operator managed components. Updates tailscale/tailscale#13406,tailscale/corp#22920 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	3 weeks ago
Percy Wegmann	8dcbd988f7	cmd/derper: show more information on home page ... - Basic description of DERP If configured to do so, also show - Mailto link to security@tailscale.com - Link to Tailscale Security Policies - Link to Tailscale Acceptable Use Policy Updates tailscale/corp#24092 Signed-off-by: Percy Wegmann <percy@tailscale.com>	3 weeks ago
License Updater	065825e94c	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	3 weeks ago
Brad Fitzpatrick	01185e436f	types/result, util/lineiter: add package for a result type, use it ... This adds a new generic result type (motivated by golang/go#70084) to try it out, and uses it in the new lineutil package (replacing the old lineread package), changing that package to return iterators: sometimes over []byte (when the input is all in memory), but sometimes iterators over results of []byte, if errors might happen at runtime. Updates #12912 Updates golang/go#70084 Change-Id: Iacdc1070e661b5fb163907b1e8b07ac7d51d3f83 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 weeks ago
Irbe Krumina	809a6eba80	cmd/k8s-operator: allow to optionally configure tailscaled port (#14005) ... Updates tailscale/tailscale#13981 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	3 weeks ago
Brad Fitzpatrick	d4222fae95	tsnet: add accessor to get tsd.System ... Pulled of otherwise unrelated PR #13884. Updates tailscale/corp#22075 Change-Id: I5b539fcb4aca1b93406cf139c719a5e3c64ff7f7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 weeks ago
Brad Fitzpatrick	45da3a4b28	cmd/tsconnect: block after starting esbuild dev server ... Thanks to @davidbuzz for raising the issue in #13973. Fixes #8272 Fixes #13973 Change-Id: Ic413e14d34c82df3c70a97e591b90316b0b4946b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 weeks ago
VimT	43138c7a5c	net/socks5: optimize UDP relay ... Key changes: - No mutex for every udp package: replace syncs.Map with regular map for udpTargetConns - Use socksAddr as map key for better type safety - Add test for multi udp target Updates #7581 Change-Id: Ic3d384a9eab62dcbf267d7d6d268bf242cc8ed3c Signed-off-by: VimT <me@vimt.me>	3 weeks ago
VimT	b0626ff84c	net/socks5: fix UDP relay in userspace-networking mode ... This commit addresses an issue with the SOCKS5 UDP relay functionality when using the --tun=userspace-networking option. Previously, UDP packets were not being correctly routed into the Tailscale network in this mode. Key changes: - Replace single UDP connection with a map of connections per target - Use c.srv.dial for creating connections to ensure proper routing Updates #7581 Change-Id: Iaaa66f9de6a3713218014cf3f498003a7cac9832 Signed-off-by: VimT <me@vimt.me>	3 weeks ago
Brad Fitzpatrick	634cc2ba4a	wgengine/netstack: remove unused taildrive deps ... A filesystem was plumbed into netstack in 993acf4475 but hasn't been used since 2d5d6f5403. Remove it. Noticed while rebasing a Tailscale fork elsewhere. Updates tailscale/corp#16827 Change-Id: Ib76deeda205ffe912b77a59b9d22853ebff42813 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 weeks ago
Maisem Ali	d09e9d967f	ipn/ipnlocal: reload prefs correctly on ReloadConfig ... We were only updating the ProfileManager and not going down the EditPrefs path which meant the prefs weren't applied till either the process restarted or some other pref changed. This makes it so that we reconfigure everything correctly when ReloadConfig is called. Updates #13032 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 weeks ago
Renato Aguiar	0ffc7bf38b	Fix MagicDNS on OpenBSD ... Add OpenBSD to the list of platforms that need DNS reconfigured on link changes. Signed-off-by: Renato Aguiar <renato@renatoaguiar.net>	3 weeks ago
Jordan Whited	49de23cf1b	net/netcheck: add addReportHistoryAndSetPreferredDERP() test case (#13989) ... Add an explicit case for exercising preferred DERP hysteresis around the branch that compares latencies on a percentage basis. Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	4 weeks ago
Aaron Klotz	84c8860472	util/syspolicy: add policy key for onboarding flow visibility ... Updates https://github.com/tailscale/corp/issues/23789 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	4 weeks ago
Andrew Lytvynov	ddbc950f46	safeweb: add support for custom CSP (#13975) ... To allow more flexibility with CSPs, add a fully customizable `CSP` type that can be provided in `Config` and encodes itself into the correct format. Preserve the `CSPAllowInlineStyles` option as is today, but maybe that'll get deprecated later in favor of the new CSP field. In particular, this allows for pages loading external JS, or inline JS with nonces or hashes (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_inline_script) Updates https://github.com/tailscale/corp/issues/8027 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	4 weeks ago
Andrea Gottardo	6985369479	net/sockstats: prevent crash in setNetMon (#13985)	4 weeks ago
Andrew Lytvynov	3477bfd234	safeweb: add support for "/" and "/foo" handler distinction (#13980) ... By counting "/" elements in the pattern we catch many scenarios, but not the root-level handler. If either of the patterns is "/", compare the pattern length to pick the right one. Updates https://github.com/tailscale/corp/issues/8027 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	4 weeks ago
Nick Khyl	3f626c0d77	cmd/tailscale/cli, client/tailscale, ipn/localapi: add tailscale syspolicy {list,reload} commands ... In this PR, we add the tailscale syspolicy command with two subcommands: list, which displays policy settings, and reload, which forces a reload of those settings. We also update the LocalAPI and LocalClient to facilitate these additions. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 weeks ago
Irbe Krumina	45354dab9b	ipn,tailcfg: add app connector config knob to conffile (#13942) ... Make it possible to advertise app connector via a new conffile field. Also bumps capver - conffile deserialization errors out if unknonw fields are set, so we need to know which clients understand the new field. Updates tailscale/tailscale#11113 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	4 weeks ago
Anton Tolchanov	b4f46c31bb	wgengine/magicsock: export packet drop metric for outbound errors ... This required sharing the dropped packet metric between two packages (tstun and magicsock), so I've moved its definition to util/usermetric. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 weeks ago
Anton Tolchanov	532b26145a	wgengine/magicsock: exclude disco from throughput metrics ... The user-facing metrics are intended to track data transmitted at the overlay network level. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 weeks ago
James Tucker	e1e22785b4	net/netcheck: ensure prior preferred DERP is always in netchecks ... In an environment with unstable latency, such as upstream bufferbloat, there are cases where a full netcheck could drop the prior preferred DERP (likely home DERP) from future netcheck probe plans. This will then likely result in a home DERP having a missing sample on the next incremental netcheck, ultimately resulting in a home DERP move. This change does not fix our overall response to highly unstable latency, but it is an incremental improvement to prevent single spurious samples during a full netcheck from alone triggering a flapping condition, as now the prior changes to include historical latency will still provide the desired resistance, and the home DERP should not move unless latency is consistently worse over a 5 minute period. Note that there is a nomenclature and semantics issue remaining in the difference between a report preferred DERP and a home DERP. A report preferred DERP is aspirational, it is what will be picked as a home DERP if a home DERP connection needs to be established. A nodes home DERP may be different than a recent preferred DERP, in which case a lot of netcheck logic is fallible. In future enhancements much of the DERP move logic should move to consider the home DERP, rather than recent report preferred DERP. Updates #8603 Updates #13969 Signed-off-by: James Tucker <james@tailscale.com>	4 weeks ago
Brad Fitzpatrick	f81348a16b	util/syspolicy/source: put EnvPolicyStore env keys in their own namespace ... ... all prefixed with TS_DEBUGSYSPOLICY_*. Updates #13193 Updates #12687 Updates #13855 Change-Id: Ia8024946f53e2b3afda4456a7bb85bbcf6d12bfc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 weeks ago
Nick Khyl	540e4c83d0	util/syspolicy/setting: make setting.Snapshot JSON-marshallable ... We make setting.Snapshot JSON-marshallable in preparation for returning it from the LocalAPI. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 weeks ago
Nick Khyl	2a2228f97b	util/syspolicy/setting: make setting.RawItem JSON-marshallable ... We add setting.RawValue, a new type that facilitates unmarshalling JSON numbers and arrays as uint64 and []string (instead of float64 and []any) for policy setting values. We then use it to make setting.RawItem JSON-marshallable and update the tests. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 weeks ago
Nick Khyl	2cc1100d24	util/syspolicy/source: use errors instead of github.com/pkg/errors ... Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 weeks ago
Nick Khyl	2336c340c4	util/syspolicy: implement a syspolicy store that reads settings from environment variables ... In this PR, we implement (but do not use yet, pending #13727 review) a syspolicy/source.Store that reads policy settings from environment variables. It converts a CamelCase setting.Key, such as AuthKey or ExitNodeID, to a SCREAMING_SNAKE_CASE, TS_-prefixed environment variable name, such as TS_AUTH_KEY and TS_EXIT_NODE_ID. It then looks up the variable and attempts to parse it according to the expected value type. If the environment variable is not set, the policy setting is considered not configured in this store (the syspolicy package will still read it from other sources). Similarly, if the environment variable has an invalid value for the setting type, it won't be used (though the reported/logged error will differ). Updates #13193 Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 weeks ago
Irbe Krumina	1103044598	cmd/k8s-operator,k8s-operator: add topology spread constraints to ProxyClass (#13959) ... Now when we have HA for egress proxies, it makes sense to support topology spread constraints that would allow users to define more complex topologies of how proxy Pods need to be deployed in relation with other Pods/across regions etc. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	4 weeks ago
Tim Walters	856ea2376b	wgengine/magicsock: log home DERP changes with latency ... This adds additional logging on DERP home changes to allow better troubleshooting. Updates tailscale/corp#18095 Signed-off-by: Tim Walters <tim@tailscale.com>	4 weeks ago
Jonathan Nobels	aecb0ab76b	tstest/tailmac: add support for mounting host directories in the guest (#13957) ... updates tailscale/corp#24197 tailmac run now supports the --share option which will allow you to specify a directory on the host which can be mounted in the guest using mount_virtiofs vmshare <path>. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	4 weeks ago
Jonathan Nobels	0f9a054cba	tstest/tailmac: fix Host.app path generation (#13953) ... updates tailscale/corp#24197 Generation of the Host.app path was erroneous and tailmac run would not work unless the pwd was tailmac/bin. Now you can be able to invoke tailmac from anywhere. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	4 weeks ago
Anton Tolchanov	9545e36007	cmd/tailscale/cli: add 'tailscale metrics' command ... - `tailscale metrics print`: to show metric values in console - `tailscale metrics write`: to write metrics to a file (with a tempfile & rename dance, which is atomic on Unix). Also, remove the `TS_DEBUG_USER_METRICS` envknob as we are getting more confident in these metrics. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 weeks ago
Anton Tolchanov	38af62c7b3	ipn/ipnlocal: remove the primary routes gauge for now ... Not confident this is the right way to expose this, so let's remote it for now. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 weeks ago