7306 Commits (0d8cd1645ac128bbdd979fb2cfb1db0b8a184955)

 

All Branches   

Search

Author	SHA1	Message	Date
Adrian Dewhurst	c05c4bdce4	ipn: apply ControlURL policy before login ... Unlike most prefs, the ControlURL policy needs to take effect before login. This resolves an issue where on first start, even when the ControlURL policy is set, it will generate a login URL to the Tailscale SaaS server. Updates tailscale/coral#118 Fixes #10736 Change-Id: I6da2a521f64028c15dbb6ac8175839fc3cc4e858 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	10 months ago
Adrian Dewhurst	d50303bef7	docs: add Windows administrative template ... To make setting Windows policies easier, this adds ADMX policy descriptions. Fixes #6495 Updates ENG-2515 Change-Id: If4613c9d8ec734afec8bd781575e24b4aef9bb73 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	10 months ago
Andrew Dunham	35c303227a	net/dns/resolver: add ID to verbose logs in forwarder ... To make it easier to correlate the starting/ending log messages. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I2802d53ad98e19bc8914bc58f8c04d4443227b26	11 months ago
Rhea Ghosh	dbe70962b1	taildrop: Allow category Z unicode characters (#10750) ... This will expand the unicode character categories that we allow for valid filenames to go from "L, M, N, P, S, and the ASCII space character" to "L, M, N, P, S, Zs" Fixes #10105 Signed-off-by: Rhea Ghosh <rhea@tailscale.com>	11 months ago
Andrew Dunham	d3574a350f	cmd/tailscale, ipn/ipnlocal: add 'debug dial-types' command ... This command allows observing whether a given dialer ("SystemDial", "UserDial", etc.) will successfully obtain a connection to a provided host, from inside tailscaled itself. This is intended to help debug a variety of issues from subnet routers to split DNS setups. Updates #9619 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie01ebb5469d3e287eac633ff656783960f697b84	11 months ago
Aaron Klotz	aed2cfec4e	util/winutil: add some missing docs to restartmgr errors ... Just a quick #cleanup. Signed-off-by: Aaron Klotz <aaron@tailscale.com>	11 months ago
Andrew Dunham	46bdbb3878	cmd/tailscaled, tsnet: don't return an interface containing a nil pointer ... This tripped me up when I was testing something and wrote: if conn != nil { conn.Close() } In netstack mode, when an error occurred we were getting a non-nil error and a non-nil interface that contained a nil pointer. Instead, just return a nil interface value. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id9ef3dd24529e0e8c53adc60ed914c31fbb10cc4	11 months ago
Andrew Lytvynov	29e98e18f8	ssh/tailssh: use a local error instead of gossh.ErrDenied (#10743) ... ErrDenied was added in [our fork of x/crypto/ssh](acc6f8fe8d) to short-circuit auth attempts once one fails. In the case of our callbacks, this error is returned when SSH policy check determines that a connection should not be allowed. Both `NoClientAuthCallback` and `PublicKeyHandler` check the policy and will fail anyway. The `fakePasswordHandler` returns true only if `NoClientAuthCallback` succeeds the policy check, so it checks it indirectly too. The difference here is that a client might attempt all 2-3 auth methods instead of just `none` but will fail to authenticate regardless. Updates #8593 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
James 'zofrex' Sanderson	124dc10261	controlclient,tailcfg,types: expose MaxKeyDuration via localapi (#10401) ... Updates tailscale/corp#16016 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	11 months ago
Andrea Gottardo	d9aeb30281	net/interfaces: handle iOS network transitions (#10680) ... Updates #8022 Updates #6075 On iOS, we currently rely on delegated interface information to figure out the default route interface. The NetworkExtension framework in iOS seems to set the delegate interface only once, upon the *creation* of the VPN tunnel. If a network transition (e.g. from Wi-Fi to Cellular) happens while the tunnel is connected, it will be ignored and we will still try to set Wi-Fi as the default route because the delegated interface is not getting updated as connectivity transitions. Here we work around this on the Swift side with a NWPathMonitor instance that observes the interface name of the first currently satisfied network path. Our Swift code will call into `UpdateLastKnownDefaultRouteInterface`, so we can rely on that when it is set. If for any reason the Swift machinery didn't work and we don't get any updates, here we also have some fallback logic: we try finding a hardcoded Wi-Fi interface called en0. If en0 is down, we fall back to cellular (pdp_ip0) as a last resort. This doesn't handle all edge cases like USB-Ethernet adapters or multiple Ethernet interfaces, but it is good enough to ensure connectivity isn't broken. I tested this on iPhones and iPads running iOS 17.1 and it appears to work. Switching between different cellular plans on a dual SIM configuration also works (the interface name remains pdp_ip0). Signed-off-by: Andrea Gottardo <andrea@tailscale.com>	11 months ago
James 'zofrex' Sanderson	10c595d962	ipn/ipnlocal: refresh node key without blocking if cap enabled (#10529) ... Updates tailscale/corp#16016 Signed-off-by: James Sanderson <jsanderson@tailscale.com> Co-authored-by: Maisem Ali <maisem@tailscale.com>	11 months ago
Irbe Krumina	3a9450bc06	cmd/containerboot: don't parse empty subnet routes (#10738) ... Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	11 months ago
Irbe Krumina	5a2eb26db3	cmd/containerboot: ensure that subnet routes can be unset. (#10734) ... A Tailnet node can be told to stop advertise subnets by passing an empty string to --advertise-routes flag. Respect an explicitly passed empty value to TS_ROUTES env var so that users have a way to stop containerboot acting as a subnet router without recreating it. Distinguish between TS_ROUTES being unset and empty. Updates tailscale/tailscale#10708 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	11 months ago
Aaron Klotz	e32a064659	cmd/tailscaled: don't create a network monitor in the parent tailscaled on Windows ... The service is only used as a watchdog and for piping logs from the child process. We shouldn't be creating a network monitor in that case. Fixes #10732 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	11 months ago
Andrew Dunham	fa3639783c	net/portmapper: check returned epoch from PMP and PCP protocols ... If the epoch that we see during a Probe is less than the existing epoch, it means that the gateway has either restarted or reset its configuration, and an existing mapping is no longer valid. Reset any saved mapping(s) if we detect this case so that a future createOrGetMapping will not attempt to re-use it. Updates #10597 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie3cddaf625cb94a29885f7a1eeea25dbf6b97b47	11 months ago
Jordan Whited	b084888e4d	wgengine/magicsock: fix typos in docs (#10729) ... Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	11 months ago
Chris Palmer	1f1ab74250	tsweb: use object-src instead of plugin-types (#10719) ... plugin-types is deprecated, and setting object-src: 'none' is best practice. This should result in no functional change. Fixes #10718 Signed-off-by: Chris Palmer <cpalmer@tailscale.com>	11 months ago
Adrian Dewhurst	3d57c885bf	logpolicy: use syspolicy to override LogTarget ... Previously, for Windows clients only, a registry value named LogTarget could override the log server, but only if the environment variable was unset. To allow administrators to enforce using a particular log server, switch this to make the registry value take precedence over the environment variable, and switch to the newer syspolicy.GetString so that the log target can be specified by a GPO more easily. Updates ENG-2515 Change-Id: Ia618986b0e07715d7db4c6df170a24d511c904c9 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	11 months ago
Flakes Updater	1406a9d494	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	11 months ago
Irbe Krumina	e72f2b7791	go.{mod,sum}: bump mkctr (#10722) ... go get github.com/tailscale/mkctr@bf50773ba7349ced8de812c3d5437e8618bd4fa7 Updates tailscale/tailscale#9902 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	11 months ago
Anton Tolchanov	1d22265f69	release: add shebang to the debian postinst script ... Seems like an omission, since we have it in postrm and prerm. Fixes #10705 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	11 months ago
Chris Palmer	5deeb56b95	cmd/tailscale/cli: document usage more clearly (#10681) ... The IP argument is required; only the port is optional. Updates #10605 Signed-off-by: Chris Palmer <cpalmer@tailscale.com>	11 months ago
Aaron Klotz	5812093d31	util/winutil: publicize existing functions for opening read-only connections to the Windows Service Control Manager ... We're going to need to access these from code outside winutil. Updates #10215 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	11 months ago
Andrew Dunham	cae6edf485	ipn/ipnlocal: fix data race with capForcedNetfilter field ... Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1fdad454198d7ea4a898dbff3062818b0db35167	11 months ago
Andrew Lytvynov	2716250ee8	all: cleanup unused code, part 2 (#10670) ... And enable U1000 check in staticcheck. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Nick Khyl	c9836b454d	net/netmon: fix goroutine leak in winMon if the monitor is never started ... When the portable Monitor creates a winMon via newOSMon, we register address and route change callbacks with Windows. Once a callback is hit, it starts a goroutine that attempts to send the event into messagec and returns. The newly started goroutine then blocks until it can send to the channel. However, if the monitor is never started and winMon.Receive is never called, the goroutines remain indefinitely blocked, leading to goroutine leaks and significant memory consumption in the tailscaled service process on Windows. Unlike the tailscaled subprocess, the service process creates but never starts a Monitor. This PR adds a check within the callbacks to confirm the monitor's active status, and exits immediately if the monitor hasn't started. Updates #9864 Signed-off-by: Nick Khyl <nickk@tailscale.com>	11 months ago
Andrew Lytvynov	2e956713de	safesocket: remove ConnectionStrategy (#10662) ... This type seems to be a migration shim for TCP tailscaled sockets (instead of unix/windows pipes). The `port` field was never set, so it was effectively used as a string (`path` field). Remove the whole type and simplify call sites to pass the socket path directly to `safesocket.Connect`. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Andrew Lytvynov	1302bd1181	all: cleanup unused code, part 1 (#10661) ... Run `staticcheck` with `U1000` to find unused code. This cleans up about a half of it. I'll do the other half separately to keep PRs manageable. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Andrew Dunham	3c333f6341	net/portmapper: add logs about obtained mapping(s) ... This logs additional information about what mapping(s) are obtained during the creation process, including whether we return an existing cached mapping. Updates #10597 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I9ff25071f064c91691db9ab0b9365ccc5f948d6e	11 months ago
David Crawshaw	f815d66a88	api.md: add docs for setting an IP address ... Updates tailscale/corp#16453 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	11 months ago
Andrew Dunham	01286af82b	net/interfaces: better handle multiple interfaces in LikelyHomeRouterIP ... Currently, we get the "likely home router" gateway IP and then iterate through all IPs for all interfaces trying to match IPs to determine the source IP. However, on many platforms we know what interface the gateway is through, and thus we don't need to iterate through all interfaces checking IPs. Instead, use the IP address of the associated interface. This better handles the case where we have multiple interfaces on a system all connected to the same gateway, and where the first interface that we visit (as iterated by ForeachInterfaceAddress) isn't also the default internet route. Updates #8992 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8632f577f1136930f4ec60c76376527a19a47d1f	11 months ago
Andrew Lytvynov	7a2eb22e94	ipn: remove use of reflect.MethodByName (#10652) ... Using reflect.MethodByName disables some linked deadcode optimizations and makes our binaries much bigger. Difference before/after this commit: ``` -rwxr-xr-x 1 awly awly 30M Dec 19 15:28 tailscaled.after* -rwxr-xr-x 1 awly awly 43M Dec 19 15:27 tailscaled.before* ``` Fixes #10627 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Andrew Dunham	09136e5995	net/netutil: add function to check rp_filter value (#5703) ... Updates #4432 Change-Id: Ifc332a5747fc1feffdbb87437308cf8ecb21b0b0 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	11 months ago
Paul Scott	65f2d32300	api.md: add device.postureIdentity field ... Updates tailscale/corp#15445 Signed-off-by: Paul Scott <paul@tailscale.com>	11 months ago
Paul Scott	03f22cd9fa	client/tailscale: add Device.PostureIdentity field ... New API fields being added in tailscale/corp#15445. Updates tailscale/corp#15203 Signed-off-by: Paul Scott <paul@tailscale.com>	11 months ago
Nick Khyl	5e3126f510	tool/gocross: make all Windows DLLs build with static libgcc ... In this commit, we have updated the build process for our Windows DLLs to link statically with libgcc, ensuring our Windows DLLs are self-contained. Updates #10617 Signed-off-by: Nick Khyl <nickk@tailscale.com>	11 months ago
James Tucker	0957258f84	appc,ipn: prevent undesirable route advertisements ... Individual route advertisements that are covered by existing routes are no longer advertised. If an upstream returns 0.0.0.0, 127.x, and other common unwanted addresses those are also rejected. Updates #16425 Signed-off-by: James Tucker <james@tailscale.com>	11 months ago
Gavin Greenwalt	865ee25a57	cmd/tailscale/cli: update debug.go (#10644) ... redundant run "portmap debugging" word 'debugging' Signed-off-by: Gavin Greenwalt <gavin@sfstudios.com>	11 months ago
Andrew Dunham	a661287c4b	util/cmpx: remove code that's in the stdlib now ... The cmpx.Compare function (and associated interface) are now available in the standard library as cmp.Compare. Remove our version of it and use the version from the standard library. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I4be3ac63d466c05eb7a0babb25cb0d41816fbd53	11 months ago
Andrew Lytvynov	945cf836ee	ipn: apply tailnet-wide default for auto-updates (#10508) ... When auto-update setting in local Prefs is unset, apply the tailnet default value from control. This only happens once, when we apply the default (or when the user manually overrides it), tailnet default no longer affects the node. Updates #16244 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Andrew Dunham	d05a572db4	net/portmapper: handle multiple UPnP discovery responses ... Instead of taking the first UPnP response we receive and using that to create port mappings, store all received UPnP responses, sort and deduplicate them, and then try all of them to obtain an external address. Updates #10602 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I783ccb1834834ee2a9ecbae2b16d801f2354302f	11 months ago
Irbe Krumina	38b4eb9419	cmd/k8s-operator/deploy/chart: document passing multiple proxy tags + log level values (#10624) ... Updates #cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	11 months ago
Flakes Updater	dc2792aaee	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	11 months ago
as2643	3fb6ee7fdb	tailscale/logtail: redact public ipv6 and ipv4 ip addresses within tailscaled. (#10531) ... Updates #15664 Signed-off-by: Anishka Singh <anishkasingh66@gmail.com>	11 months ago
James Tucker	3a635db06e	cmd/connector-gen: add helper tool for wide app connector configurations ... connector-gen can initially generate connector ACL snippets and advertise-routes flags for Github and AWS based on their public IP / domain data. Updates ENG-2425 Signed-off-by: James Tucker <james@tailscale.com>	11 months ago
James Tucker	706e30d49e	disco: correct noun for nacl box type in disco docs ... Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	11 months ago
Sonia Appasamy	c6a274611e	client/web: use Tailscale IP known by peer node ... Throughout the web UI, we present the tailscale addresses for the self node. In the case of the node being shared out with a user from another tailnet, the peer viewer may actually know the node by a different IP than the node knows itself as (Tailscale IPs can be configured as desired on a tailnet level). This change includes two fixes: 1. Present the self node's addresses in the frontend as the addresses the viewing node knows it as (i.e. the addresses the viewing node uses to access the web client). 2. We currently redirect the viewer to the Tailscale IPv4 address if viewing it by MagicDNS name, or any other name that maps to the Tailscale node. When doing this redirect, which is primarily added for DNS rebinding protection, we now check the address the peer knows this node as, and redirect to specifically that IP. Fixes tailscale/corp#16402 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	11 months ago
Jordan Whited	685b853763	wgengine/magicsock: fix handling of derp.PeerGoneMessage (#10589) ... The switch in Conn.runDerpReader() on the derp.ReceivedMessage type contained cases other than derp.ReceivedPacket that fell through to writing to c.derpRecvCh, which should only be reached for derp.ReceivedPacket. This can result in the last/previous derp.ReceivedPacket to be re-handled, effectively creating a duplicate packet. If the last derp.ReceivedPacket happens to be a disco.CallMeMaybe it may result in a disco ping scan towards the originating peer on the endpoints contained. The change in this commit moves the channel write on c.derpRecvCh and subsequent select awaiting the result into the derp.ReceivedMessage case, preventing it from being reached from any other case. Explicit continue statements are also added to non-derp.ReceivedPacket cases where they were missing, in order to signal intent to the reader. Fixes #10586 Signed-off-by: Jordan Whited <jordan@tailscale.com>	11 months ago
Andrew Dunham	3ae562366b	ipn/ipnlocal: fix usage of slices.Compact ... Fixes #10595 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I4e96e9c43b8dedb5f88b03368c01b0e46723e15b	11 months ago
Irbe Krumina	1a08ea5990	cmd/k8s-operator: operator can create subnetrouter (#9505) ... * k8s-operator,cmd/k8s-operator,Makefile,scripts,.github/workflows: add Connector kube CRD. Connector CRD allows users to configure the Tailscale Kubernetes operator to deploy a subnet router to expose cluster CIDRs or other CIDRs available from within the cluster to their tailnet. Also adds various CRD related machinery to generate CRD YAML, deep copy implementations etc. Engineers will now have to run 'make kube-generate-all` after changing kube files to ensure that all generated files are up to date. * cmd/k8s-operator,k8s-operator: reconcile Connector resources Reconcile Connector resources, create/delete subnetrouter resources in response to changes to Connector(s). Connector reconciler will not be started unless ENABLE_CONNECTOR env var is set to true. This means that users who don't want to use the alpha Connector custom resource don't have to install the Connector CRD to their cluster. For users who do want to use it the flow is: - install the CRD - install the operator (via Helm chart or using static manifests). For Helm users set .values.enableConnector to true, for static manifest users, set ENABLE_CONNECTOR to true in the static manifest. Updates tailscale/tailscale#502 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	11 months ago