8015 Commits (151b77f9d68a0bd212a60f1d40ce45b723263d9d)

 

All Branches   

Search

Author	SHA1	Message	Date
Will Norris	c615fe2296	client/web: add security attributes on session cookie ... Limit cookies to HTTP requests (not accessible from javascript). Set SameSite to "Lax", which is similar to "Strict" but allows for cookies to be included in requests that come from offsite links. This will be necessary when we link to the web client from the admin console. Updates #10261 Fixes tailscale/corp#16265 Signed-off-by: Will Norris <will@tailscale.com>	12 months ago
Sonia Appasamy	261b6f1e9f	client/web: limit updates ui to unstable builds ... The updates view still needs a final design pass, limit to unstable track for now. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Will Norris	33de922d57	client/web: only enforce path prefix in CGI mode ... The client has changed a bit since we introduced the path prefix. It is now used for two things: - its original purpose, of ensuring that when the client is run in CGI mode at arbitrary paths, then relative paths for assets continue to work - we also now pass the path to the frontend and use wouter to manage routes for the various subpages of the client. When the client is run behind a reverse proxy (as it is in Home Assistant), it is common for the proxy to rewrite the request so that the backend application doesn't see the path it's being served at. In this case, we don't need to call enforcePrefix, since it's already stripped before it reaches us. However, wouter (or react router library) still sees the original path in the browser, and needs to know what part of it is the prefix that needs to be stripped off. We're handling this by now only calling enforcePrefix when run in CGI mode. For Home Assistant, or any other platform that runs the client behind a reverse proxy with a custom path, they will still need to pass the `-prefix` flag to `tailscale web`, but we will only use it for route handling in the frontend. Updates #10261 Signed-off-by: Will Norris <will@tailscale.com>	12 months ago
Sonia Appasamy	c2319f0dfa	client/web: fix serveAPIAuth in Login mode ... In Login mode, must first run system auth. But once authorized, should be able to reach rest of auth logic to check whether the user can manage the node. This results in showing/hiding the sign in button in the frontend login toggle. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Sonia Appasamy	7c172df791	client/web: fix 500 error after logout ... Calling DebugPacketFilterRules fails when the node is not logged in, which was causing 500 errors on the node data endpoint after logging the node out. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Adrian Dewhurst	86aa0485a6	ipn/ipnlocal, util/syspolicy: make run exit node a preference option ... Previously, the "RunExitNode" policy merely controlled the visibility of the "run as exit node" menu item, not the setting itself. This migrates that setting to a preference option named "AdvertiseExitNode". Updates ENG-2138 Change-Id: Ia6a125beb6b4563d380c6162637ce4088f1117a0 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	12 months ago
Mario Minardi	21958d2934	client/web: add logging of device management type for web client (#10492) ... Add logging of device management type for the web client auth flow. Namely, this differentiates between viewing a node you do not own, viewing a local tagged node, viewing a remote tagged node, managing a local node, and managing a remote node. Updates https://github.com/tailscale/tailscale/issues/10261 Signed-off-by: Mario Minardi <mario@tailscale.com>	12 months ago
Maisem Ali	7bdea283bd	cmd/containerboot: symlink TS_SOCKET to socket expected by CLI ... `tailscaled` and `tailscale` expect the socket to be at `/var/run/tailscale/tailscaled.sock`, however containerboot would set up the socket at `/tmp/tailscaled.sock`. This leads to a poor UX when users try to use any `tailscale` command as they have to prefix everything with `--socket /tmp/tailscaled.sock`. To improve the UX, this adds a symlink to `/var/run/tailscale/tailscaled.sock` to point to `/tmp/tailscaled.sock`. This approach has two benefits, 1 users are able to continue to use existing scripts without this being a breaking change. 2. users are able to use the `tailscale` CLI without having to add the `--socket` flag. Fixes tailscale/corp#15902 Fixes #6849 Fixes #10027 Signed-off-by: Maisem Ali <maisem@tailscale.com>	12 months ago
Sonia Appasamy	ddb4b51122	client/web: always run platform auth for login mode ... Even if connected to the login client over tailscale, still check platform auth so the browser can obtain the tokens it needs to make platform requests complete successfully. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Andrew Lytvynov	e25f114916	ipn,cmd/tailscale/cli: support hierarchical MaskedPrefs (#10507) ... Some fields if `ipn.Prefs` are structs. `ipn.MaskedPrefs` has a single level of boolean `*Set` flags, which doesn't map well to nested structs within `ipn.Prefs`. Change `MaskedPrefs` and `ApplyEdits` to support `FooSet` struct fields that map to a nested struct of `ipn.Prefs` like `AutoUpdates`. Each struct field in `MaskedPrefs` is just a bundle of more `Set` bool fields or other structs. This allows you to have a `Set` flag for any arbitrarily-nested field of `ipn.Prefs`. Also, make `ApplyEdits` match fields between `Prefs` and `MaskedPrefs` by name instead of order, to make it a bit less finicky. It's probably slower but `ipn.ApplyEdits` should not be in any hot path. As a result, `AutoUpdate.Check` and `AutoUpdate.Apply` fields don't clobber each other when set individually. Updates #16247 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	12 months ago
Flakes Updater	2f01d5e3da	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	12 months ago
OSS Updater	6389322619	go.mod: update web-client-prebuilt module ... Signed-off-by: OSS Updater <noreply+oss-updater@tailscale.com>	12 months ago
Aaron Klotz	0f646937e9	clientupdate: remove TS_NOLAUNCH and GUI restart hacks from autoupdate ... We've fixed the underlying issue in github.com/tailscale/corp/issues/13998. Fixes #10513 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	12 months ago
Andrea Gottardo	646d17ac8d	util/syspolicy: rename client metric keys (#10516) ... Updates ENG-2513. Renames client metrics keys used on Windows for consistency with Apple platforms. Signed-off-by: Andrea Gottardo <andrea@tailscale.com>	12 months ago
Sonia Appasamy	d5d42d0293	client/web: small UI cleanups ... Updates: * Card component used throughout instead of custom card class * SSH toggle changed to non-editable text/status icon in readonly * Red error text on subnet route input when route post failed Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Sonia Appasamy	e5e5ebda44	client/web: precompress assets ... Precompress webclient assets with precompress util. This cuts our css and js build sizes to about 1/3 of non-compressed size. Similar compression done on tsconnect and adminhttp assets. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Sonia Appasamy	97f8577ad2	client/web: restructure api mutations into hook ... This commit makes some restructural changes to how we handle api posting from the web client frontend. Now that we're using SWR, we have less of a need for hooks like useNodeData that return a useSWR response alongside some mutation callbacks. SWR makes it easy to mutate throughout the UI without needing access to the original data state in order to reflect updates. So, we can fetch data without having to tie it to post callbacks that have to be passed around through components. In an effort to consolidate our posting endpoints, and make it easier to add more api handlers cleanly in the future, this change introduces a new `useAPI` hook that returns a single `api` callback that can make any changes from any component in the UI. The hook itself handles using SWR to mutate the relevant data keys, which get globally reflected throughout the UI. As a concurrent cleanup, node types are also moved to their own types.ts file, to consolidate data types across the app. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Andrew Dunham	9fd29f15c7	util/cache: add package for general-purpose caching ... This package allows caching arbitrary key/value pairs in-memory, along with an interface implemented by the cache types. Extracted from #7493 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic8ca820927c456721cf324a0c8f3882a57752cc9	12 months ago
Adrian Dewhurst	f706a3abd0	ipn/ipnlocal, util/syspolicy: add auto update policy ... Due to the Sparkle preference naming convention, macsys already has a policy key named "ApplyUpdates" that merely shows or hides the menu item that controls if auto updates are installed, rather than directly controlling the setting. For other platforms, we are going to use "InstallUpdates" instead because it seemed better than the other options that were considered. Updates ENG-2127 Updates tailscale/corp#16247 Change-Id: Ia6a125beb6b4563d380c6162637ce4088f1117a0 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	12 months ago
Sonia Appasamy	ef4f1e3a0b	client/web: add loading state to app ... Displays animated loading dots while initial auth and data endpoints are fetching. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Andrew Dunham	3f576fc4ca	ci: run 'go vet' in golangci-lint; fix errors in tests ... Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ice78fc907bad24c1de749a1595e212ef2db4b8bb	12 months ago
Mario Minardi	f5f21c213c	client/web: add additional web client metrics logging (#10462) ... Add additional web client metric logging. Namely, add logging events for auth / deauth, enable / disable using exit node, enable / disable SSH, enable / disable advertise routes, and click events on the device details button. Updates https://github.com/tailscale/tailscale/issues/10261 Signed-off-by: Mario Minardi <mario@tailscale.com>	12 months ago
Naman Sood	97f84200ac	wgengine/router: implement UpdateMagicsockPort for CallbackRouter (#10494) ... Updates #9084. Signed-off-by: Naman Sood <mail@nsood.in>	12 months ago
Sonia Appasamy	95655405b8	client/web: start using swr for some fetching ... Adds swr to the web client, and starts by using it from the useNodeData hook. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Sonia Appasamy	014ae98297	client/web: style tweaks ... Style changes made in live pairing session. Updates #10261 Co-authored-by: Will Norris <will@tailscale.com> Co-authored-by: Alessandro Mingione <alessandro@tailscale.com> Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Adrian Dewhurst	1a4d423328	ipn/ipnlocal: add additional syspolicy enforcement ... This adds support for enforcing exit node LAN access, DNS and subnet routes. Adding new preference policies was getting repetitive, so this turns some of the boilerplate into a table. Updates tailscale/corp#15585 Updates ENG-2240 Change-Id: Iabd3c42b0ae120b3145fac066c5caa7fc4d67824 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	12 months ago
Sonia Appasamy	2731a9da36	client/web: fix exit node selector styling ... Remove padding on top of search bar, remove rounded corners of bottom border of earch bar, and add auto focus. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Adrian Dewhurst	af32d1c120	ipn/ipnlocal: better enforce system policies ... Previously, policies affected the default prefs for a new profile, but that does not affect existing profiles. This change ensures that policies are applied whenever preferences are loaded or changed, so a CLI or GUI client that does not respect the policies will still be overridden. Exit node IP is dropped from this PR as it was implemented elsewhere in #10172. Fixes tailscale/corp#15585 Change-Id: Ide4c3a4b00a64e43f506fa1fab70ef591407663f Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	12 months ago
Sonia Appasamy	ac6f671c54	ipn/localapi: use clientupdate.CanAutoUpdate from serveUpdateCheck ... Fixes #10486 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Sonia Appasamy	a54a4f757b	client/web: add licenses and policies links ... Adds a footer to the device details page that mirrors license and policy content on other Tailscale clients. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Sonia Appasamy	cc6729a0bc	.github/workflows: add webclient workflow ... Add workflow to run yarn lint/test/format-check against the web client on pull requests. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	12 months ago
Mario Minardi	4a24db852a	client/web: use IPv4 instead of IP in login view (#10483) ... The IP property in node data was renamed to IPv4 but refactoring the usage of the property was missed in this file. Updates https://github.com/tailscale/tailscale/issues/10261 Signed-off-by: Mario Minardi <mario@tailscale.com>	12 months ago
Denton Gentry	137e9f4c46	net/portmap: add test of Mikrotik Root Desc XML. ... Unfortunately in the test we can't reproduce the failure seen in the real system ("SOAP fault: UPnPError") Updates https://github.com/tailscale/tailscale/issues/8364 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	12 months ago
Naman Sood	d46a4eced5	util/linuxfw, wgengine: allow ingress to magicsock UDP port on Linux (#10370) ... * util/linuxfw, wgengine: allow ingress to magicsock UDP port on Linux Updates #9084. Currently, we have to tell users to manually open UDP ports on Linux when certain firewalls (like ufw) are enabled. This change automates the process of adding and updating those firewall rules as magicsock changes what port it listens on. Signed-off-by: Naman Sood <mail@nsood.in>	1 year ago
Andrew Lytvynov	aad5fb28b1	go.toolchain.rev: bump to 1.21.5 (#10475) ... Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Claire Wang	47db67fef5	util/syspolicy: add policy counters (#10471) ... Fixes tailscale/corp#16138 Signed-off-by: Claire Wang <claire@tailscale.com>	1 year ago
Sonia Appasamy	a95b3cbfa8	client/web: add copyable components throughout UI ... Updates the IP address on home view to open a copyable list of node addresses on click. And makes various values on the details view copyable text items, mirroring the machine admin panel table. As part of these changes, pulls the AddressCard, NiceIP and QuickCopy components from the admin panel, with the AddressCard slightly modified to avoid needing to also pull in the CommandLine component. A new toaster interface is also added, allowing us to display success and failure toasts throughout the UI. The toaster code is slightly modified from it's admin form to avoid the need for some excess libraries. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Naman Sood	650c67a0a1	tailcfg: bump CapabilityVersion for Linux netfilter NodeAttrs and c2n endpoint ... Updates tailscale/corp#14029. Signed-off-by: Naman Sood <mail@nsood.in>	1 year ago
Naman Sood	0a59754eda	linuxfw,wgengine/route,ipn: add c2n and nodeattrs to control linux netfilter ... Updates tailscale/corp#14029. Signed-off-by: Naman Sood <mail@nsood.in>	1 year ago
James Tucker	215f657a5e	wgengine/router: create netfilter runner in setNetfilterMode ... This will enable the runner to be replaced as a configuration side effect in a later change. Updates tailscale/corp#14029 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Adrian Dewhurst	94a64c0017	util/syspolicy: rename incorrectly named policy keys ... These keys were intended to match the Apple platforms, but accidentally used the wrong name. Updates ENG-2133 Change-Id: I9ed7a17919e34e2d8896a5c64efc4d0c0003166e Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	1 year ago
License Updater	70f201c691	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 year ago
License Updater	9095518c2d	licenses: update tailscale{,d} licenses ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 year ago
Matt Layher	a217f1fccf	all: fix nilness issues ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	1 year ago
Will Norris	c5208f8138	client/web: small tweaks for small screens ... Add left and right padding around entire client so that the cards don't run into the side of the screen. Also tighten up vertical spacing in couple of places. Updates #10261 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Andrew Dunham	c4ccdd1bd1	net/interfaces: ensure we return valid 'self' IP in LikelyHomeRouterIP ... Before this fix, LikelyHomeRouterIP could return a 'self' IP that doesn't correspond to the gateway address, since it picks the first private address when iterating over the set interfaces as the 'self' IP, without checking that the address corresponds with the previously-detected gateway. This behaviour was introduced by accident in aaf2df7, where we deleted the following code: for _, prefix := range privatev4s { if prefix.Contains(gateway) && prefix.Contains(ip) { myIP = ip ok = true return } } Other than checking that 'gateway' and 'ip' were private IP addresses (which were correctly replaced with a call to the netip.Addr.IsPrivate method), it also implicitly checked that both 'gateway' and 'ip' were a part of the *same* prefix, and thus likely to be the same interface. Restore that behaviour by explicitly checking pfx.Contains(gateway), which, given that the 'ip' variable is derived from our prefix 'pfx', ensures that the 'self' IP will correspond to the returned 'gateway'. Fixes #10466 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Iddd2ee70cefb9fb40071986fefeace9ca2441ee6	1 year ago
Mario Minardi	6b083a8ddf	client/web: add metric logging logic to the web client (#10434) ... Add metric logging logic for the web client frontend. This is an initial pass of adding the base logic, plus a single point where it is used for validation that the logging is working correctly. More metric logging calls will follow in subsquent PRs. Updates https://github.com/tailscale/tailscale/issues/10261 Signed-off-by: Mario Minardi <mario@tailscale.com>	1 year ago
Will Norris	9c4b73d77d	client/web: handle login client inside an iframe ... If the login client is inside an iframe, open the management client in a new window, since it can't be loaded in the frame. Updates #10261 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Will Norris	9441a4e15d	client/web: render 404 message in empty card ... Switch the "feature disabled" page to use the same treatment. Updates #10261 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Sonia Appasamy	65643f6606	client/web: update device and connected icon ... Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago