1436 Commits (18b2638b075db6881b283452fba6156a5b6fe7bf)

Author	SHA1	Message	Date
Tyler Smalley	70a9854b39	cmd/tailscale: add background mode to serve/funnel wip (#9202) ... > **Note** > Behind the `TAILSCALE_FUNNEL_DEV` flag * Expose additional listeners through flags * Add a --bg flag to run in the background * --set-path to set a path for a specific target (assumes running in background) See the parent issue for more context. Updates #8489 Signed-off-by: Tyler Smalley <tyler@tailscale.com>	1 year ago
Marwan Sulaiman	50990f8931	ipn, ipn/ipnlocal: add Foreground field for ServeConfig ... This PR adds a new field to the serve config that can be used to identify which serves are in "foreground mode" and then can also be used to ensure they do not get persisted to disk so that if Tailscaled gets ungracefully shutdown, the reloaded ServeConfig will not have those ports opened. Updates #8489 Signed-off-by: Marwan Sulaiman <marwan@tailscale.com>	1 year ago
Paul Scott	96094cc07e	cmd/testwrapper: exit code 1 when go build fails (#9276) ... Fixes #9275 Fixes #8586 Fixes tailscale/corp#13115 Signed-off-by: Paul Scott <paul@tailscale.com>	1 year ago
Marwan Sulaiman	51d3220153	ipn, ipn/ipnlocal: remove log streaming for StreamServe ... This PR removes the per request logging to the CLI as the CLI will not be displaying those logs initially. Updates #8489 Signed-off-by: Marwan Sulaiman <marwan@tailscale.com>	1 year ago
Chris Palmer	ac7b4d62fd	cmd/tailscale/cli: make update visible in list (#8662) ... This also makes "HIDDEN: " work (requires the custom UsageFunc). Updates #6995 Signed-off-by: Chris Palmer <cpalmer@tailscale.com>	1 year ago
Marwan Sulaiman	a4aa6507fa	ipn, ipn/ipnlocal: add session identifier for WatchIPNBus ... This PR adds a SessionID field to the ipn.Notify struct so that ipn buses can identify a session and register deferred clean up code in the future. The first use case this is for is to be able to tie foreground serve configs to a specific watch session and ensure its clean up when a connection is closed. Updates #8489 Signed-off-by: Marwan Sulaiman <marwan@tailscale.com>	1 year ago
Brad Fitzpatrick	7175f06e62	util/rands: add package with HexString func ... We use it a number of places in different repos. Might as well make one. Another use is coming. Updates #cleanup Change-Id: Ib7ce38de0db35af998171edee81ca875102349a4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Sonia Appasamy	f824274093	cli/serve: shorten help text on error ... Our BETA serve help text is long and often hides the actual error in the user's usage. Instead of printing the full text, prompt users to use `serve --help` if they want the help info. Fixes #14274 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Maisem Ali	3280c81c95	.github,cmd/gitops-pusher: update to checkout@v4 ... checkout@v3 is broken: actions/checkout#1448 Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	0f397baf77	cmd/testwrapper: emit logs of failed tests on timeout ... It would just fail the entire pkg, but would not print any logs. It was already tracking all the logs, so have it emit them when the pkg fails/times out. Updates #9231 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	1262df0578	net/netmon, net/tsdial: add some link change metrics ... Updates #9040 Change-Id: I2c87572d79d2118bcf1f0122eccfe712c1bea9d5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Will Norris	9a3bc9049c	client/web,cmd/tailscale: add prefix flag for web command ... We already had a path on the web client server struct, but hadn't plumbed it through to the CLI. Add that now and use it for Synology and QNAP instead of hard-coding the path. (Adding flag for QNAP is tailscale/tailscale-qpkg#112) This will allow supporting other environments (like unraid) without additional changes to the client/web package. Also fix a small bug in unraid handling to only include the csrf token on POST requests. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Andrew Lytvynov	34e3450734	cmd/tailscale,ipn: add auto-update flags and prefs (#8861) ... The flags are hidden for now. Adding propagation to tailscaled and persistence only. The prefs field is wrapped in a struct to allow for future expansion (like update schedule). Updates #6907 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Brad Fitzpatrick	055fdb235f	cmd/tailscaled, tstest/integration: make tailscaled die when parent dies ... I noticed that failed tests were leaving aroudn stray tailscaled processes on macOS at least. To repro, add this to tstest/integration: func TestFailInFewSeconds(t *testing.T) { t.Parallel() time.Sleep(3 * time.Second) os.Exit(1) t.Fatal("boom") } Those three seconds let the other parallel tests (with all their tailscaled child processes) start up and start running their tests, but then we violently os.Exit(1) the test driver and all the children were kept alive (and were spinning away, using all available CPU in gvisor scheduler code, which is a separate scary issue) Updates #cleanup Change-Id: I9c891ed1a1ec639fb2afec2808c04dbb8a460e0e Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Tyler Smalley	e1fbb5457b	cmd/tailscale: combine serve and funnel for debug wip funnel stream model (#9169) ... > **Note** > Behind the `TAILSCALE_USE_WIP_CODE` flag In preparing for incoming CLI changes, this PR merges the code path for the `serve` and `funnel` subcommands. See the parent issue for more context. The following commands will run in foreground mode when using the environment flag. ``` tailscale serve localhost:3000 tailscae funnel localhost:3000 ``` Replaces #9134 Updates #8489 Signed-off-by: Tyler Smalley <tyler@tailscale.com> Signed-off-by: Marwan Sulaiman <marwan@tailscale.com> Co-authored-by: Marwan Sulaiman <marwan@tailscale.com>	1 year ago
Maisem Ali	96277b63ff	ipn/ipnlocal: rename LogoutSync to Logout ... Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	04e1ce0034	control/controlclient: remove unused StartLogout ... Updates #cleanup Co-authored-by: Maisem Ali <maisem@tailscale.com> Change-Id: I9d052fdbee787f1e8c872124e4bee61c7f04d142 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Andrew Lytvynov	4e72992900	clientupdate: add linux tarball updates (#9144) ... As a fallback to package managers, allow updating tailscale that was self-installed in some way. There are some tricky bits around updating the systemd unit (should we stick to local binary paths or to the ones in tailscaled.service?), so leaving that out for now. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Chris Palmer	ce1e02096a	ipn/ipnlocal: support most Linuxes in handleC2NUpdate (#9114) ... * ipn/ipnlocal: support most Linuxes in handleC2NUpdate Updates #6995 Signed-off-by: Chris Palmer <cpalmer@tailscale.com>	1 year ago
Brad Fitzpatrick	7053e19562	control/controlclient: delete Status.Log{in,out}Finished ... They were entirely redundant and 1:1 with the status field so this turns them into methods instead. Updates #cleanup Updates #1909 Change-Id: I7d939750749edf7dae4c97566bbeb99f2f75adbc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	794650fe50	cmd/k8s-operator: emit event if HTTPS is disabled on Tailnet ... Instead of confusing users, emit an event that explicitly tells the user that HTTPS is disabled on the tailnet and that ingress may not work until they enable it. Updates #9141 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Denton Gentry	be9914f714	cmd/sniproxy: move default debug-port away from 8080. ... Port 8080 is routinely used for HTTP services, make it easier to use --forwards=tcp/8080/... by moving the metrics port out of the way. Updates #1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
Maisem Ali	306b85b9a3	cmd/k8s-operator: add metrics to track usage ... Updates #502 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Irbe Krumina	17438a98c0	cm/k8s-operator,cmd/containerboot: fix STS config, more tests (#9155) ... Ensures that Statefulset reconciler config has only one of Cluster target IP or tailnet target IP. Adds a test case for containerboot egress proxy mode. Updates tailscale/tailscale#8184 Signed-off-by: irbekrm <irbekrm@gmail.com>	1 year ago
Denton Gentry	29a35d4a5d	cmd/sniproxy: switch to peterbourgon/ff for flags ... Add support for TS_APPC_* variables to supply arguments by switching to https://github.com/peterbourgon/ff for CLI flag parsing. For example: TS_APPC_FORWARDS=tcp/22/github.com ./sniproxy Updates https://github.com/tailscale/tailscale/issues/1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
Irbe Krumina	fe709c81e5	cmd/k8s-operator,cmd/containerboot: add kube egress proxy (#9031) ... First part of work for the functionality that allows users to create an egress proxy to access Tailnet services from within Kubernetes cluster workloads. This PR allows creating an egress proxy that can access Tailscale services over HTTP only. Updates tailscale/tailscale#8184 Signed-off-by: irbekrm <irbekrm@gmail.com> Co-authored-by: Maisem Ali <maisem@tailscale.com> Co-authored-by: Rhea Ghosh <rhea@tailscale.com>	1 year ago
Maisem Ali	ae747a2e48	cmd/testwrapper: handle timeouts as test failures ... While investigating the fix in 7538f38671, I was curious why the testwrapper didn't fail. Turns out if the test times out and there was no explicit failure, the only message we get is that the overall pkg failed and no failure information about the individual test. This resulted in a 0 exit code. This fixes that by failing the explicit case of the pkg failing when there is nothing to retry for that pkg. Updates #8493 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	7538f38671	cmd/containerboot: fix broken tests ... The tests were broken in a61a9ab087, maybe even earlier. Updates #502 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
David Anderson	8b492b4121	net/wsconn: accept a remote addr string and plumb it through ... This makes wsconn.Conns somewhat present reasonably when they are the client of an http.Request, rather than just put a placeholder in that field. Updates tailscale/corp#13777 Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Maisem Ali	c919ff540f	cmd/k8s-operator,ipn/store/kubestore: patch secrets instead of updating ... We would call Update on the secret, but that was racey and would occasionaly fail. Instead use patch whenever we can. Fixes errors like ``` boot: 2023/08/29 01:03:53 failed to set serve config: sending serve config: updating config: writing ServeConfig to StateStore: Operation cannot be fulfilled on secrets "ts-webdav-kfrzv-0": the object has been modified; please apply your changes to the latest version and try again {"level":"error","ts":"2023-08-29T01:03:48Z","msg":"Reconciler error","controller":"ingress","controllerGroup":"networking.k8s.io","controllerKind":"Ingress","Ingress":{"name":"webdav","namespace":"default"},"namespace":"default","name":"webdav","reconcileID":"96f5cfed-7782-4834-9b75-b0950fd563ed","error":"failed to provision: failed to create or get API key secret: Operation cannot be fulfilled on secrets \"ts-webdav-kfrzv-0\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\tsigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:324\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\tsigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:265\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\tsigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:226"} ``` Updates #502 Updates #7895 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	6dfa403e6b	cmd/tailscaled: default to userspace-networking on plan9 ... No tun support yet. Updates #5794 Change-Id: Ibd8db67594d4c65b47e352ae2af2ab3d2712dfad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	590c693b96	types/logger: add AsJSON ... Printing out JSON representation things in log output is pretty common. Updates #cleanup Change-Id: Ife2d2e321a18e6e1185efa8b699a23061ac5e5a4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Andrew Lytvynov	8d2eaa1956	clientupdate: download SPK and MSI packages with distsign (#9115) ... Reimplement `downloadURLToFile` using `distsign.Download` and move all of the progress reporting logic over there. Updates #6995 Updates #755 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Maisem Ali	0c6fe94cf4	cmd/k8s-operator: add matching family addresses to status ... This was added in 3451b89e5f, but resulted in the v6 Tailscale address being added to status when when the forwarding only happened on the v4 address. Updates #502 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	f92e6a1be8	cmd/k8s-operator: update RBAC to allow creating events ... The new ingress reconcile raises events on failure, but I forgot to add the updated permission. Updates #502 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Will Norris	d74c771fda	client/web: always use new web client; remove old client ... This uses the new react-based web client for all builds, not just with the --dev flag. If the web client assets have not been built, the client will serve a message that Tailscale was built without the web client, and link to build instructions. Because we will include the web client in all of our builds, this should only be seen by developers or users building from source. (And eventually this will be replaced by attempting to download needed assets as runtime.) We do now checkin the build/index.html file, which serves the error message when assets are unavailable. This will also eventually be used to trigger in CI when new assets should be built and uploaded to a well-known location. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Andrew Dunham	c86a610eb3	cmd/tailscale, net/portmapper: add --log-http option to "debug portmap" ... This option allows logging the raw HTTP requests and responses that the portmapper Client makes when using UPnP. This can be extremely helpful when debugging strange UPnP issues with users' devices, and might allow us to avoid having to instruct users to perform a packet capture. Updates #8992 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I2c3cf6930b09717028deaff31738484cc9b008e4	1 year ago
Mike Beaumont	3451b89e5f	cmd/k8s-operator: put Tailscale IPs in Service ingress status ... Updates #502 Signed-off-by: Mike Beaumont <mjboamail@gmail.com>	1 year ago
Mike Beaumont	ce4bf41dcf	cmd/k8s-operator: support being the default loadbalancer controller ... Updates #502 Signed-off-by: Mike Beaumont <mjboamail@gmail.com>	1 year ago
Maisem Ali	9430481926	cmd/containerboot: account for k8s secret reflection in fsnotify ... On k8s the serve-config secret mount is symlinked so checking against the Name makes us miss the events. Updates #7895 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	c8dea67cbf	cmd/k8s-operator: add support for Ingress resources ... Previously, the operator would only monitor Services and create a Tailscale StatefulSet which acted as a L3 proxy which proxied traffic inbound to the Tailscale IP onto the services ClusterIP. This extends that functionality to also monitor Ingress resources where the `ingressClassName=tailscale` and similarly creates a Tailscale StatefulSet, acting as a L7 proxy instead. Users can override the desired hostname by setting: ``` - tls hosts: - "foo" ``` Hostnames specified under `rules` are ignored as we only create a single host. This is emitted as an event for users to see. Fixes #7895 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	320f77bd24	cmd/containerboot: add support for setting ServeConfig ... This watches the provided path for a JSON encoded ipn.ServeConfig. Everytime the file changes, or the nodes FQDN changes it reapplies the ServeConfig. At boot time, it nils out any previous ServeConfig just like tsnet does. As the ServeConfig requires pre-existing knowledge of the nodes FQDN to do SNI matching, it introduces a special `${TS_CERT_DOMAIN}` value in the JSON file which is replaced with the known CertDomain before it is applied. Updates #502 Updates #7895 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	12ac672542	cmd/k8s-operator: handle changes to services w/o teardown ... Previously users would have to unexpose/expose the service in order to change Hostname/TargetIP. This now applies those changes by causing a StatefulSet rollout now that a61a9ab087 is in. Updates #502 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Denton Gentry	24d41e4ae7	cmd/sniproxy: add port forwarding and prometheus metrics ... 1. Add TCP port forwarding. For example: ./sniproxy -forwards=tcp/22/github.com will forward SSH to github. % ssh -i ~/.ssh/id_ecdsa.pem -T git@github.com Hi GitHubUser! You've successfully authenticated, but GitHub does not provide shell access. % ssh -i ~/.ssh/id_ecdsa.pem -T git@100.65.x.y Hi GitHubUser! You've successfully authenticated, but GitHub does not provide shell access. 2. Additionally export clientmetrics as prometheus metrics for local scraping over the tailnet: http://sniproxy-hostname:8080/debug/varz Updates https://github.com/tailscale/tailscale/issues/1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
Brad Fitzpatrick	98a5116434	all: adjust some build tags for plan9 ... I'm not saying it works, but it compiles. Updates #5794 Change-Id: I2f3c99732e67fe57a05edb25b758d083417f083e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Sonia Appasamy	f3077c6ab5	client/web: add self node cache ... Adds a cached self node to the web client Server struct, which will be used from the web client api to verify that request came from the node's own machine (i.e. came from the web client frontend). We'll be using when we switch the web client api over to acting as a proxy to the localapi, to protect against DNS rebinding attacks. Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Andrew Lytvynov	b42c4e2da1	cmd/dist,release/dist: add distsign signing hooks (#9070) ... Add `dist.Signer` hook which can arbitrarily sign linux/synology artifacts. Plumb it through in `cmd/dist` and remove existing tarball signing key. Distsign signing will happen on a remote machine, not using a local key. Updates #755 Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Maisem Ali	ff7f4b4224	cmd/testwrapper: fix off-by-one error in maxAttempts check ... It was checking if `>= maxAttempts` which meant that the third attempt would never run. Updates #8493 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	a61a9ab087	cmd/containerboot: reapply known args on restart ... Previously we would not reapply changes to TS_HOSTNAME etc when then the container restarted and TS_AUTH_ONCE was enabled. This splits those into two steps login and set, allowing us to only rerun the set step on restarts. Updates #502 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Aaron Klotz	5fb1695bcb	util/osdiag, util/osdiag/internal/wsc: add code to probe the Windows Security Center for installed software ... The Windows Security Center is a component that manages the registration of security products on a Windows system. Only products that have obtained a special cert from Microsoft may register themselves using the WSC API. Practically speaking, most vendors do in fact sign up for the program as it enhances their legitimacy. From our perspective, this is useful because it gives us a high-signal source of information to query for the security products installed on the system. I've tied this query into the osdiag package and is run during bugreports. It uses COM bindings that were automatically generated by my prototype metadata processor, however that program still has a few bugs, so I had to make a few manual tweaks. I dropped those binding into an internal package because (for the moment, at least) they are effectively purpose-built for the osdiag use case. We also update the wingoes dependency to pick up BSTR. Fixes #10646 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	1 year ago