7903 Commits (1bd1d053349f53ac8c27e8afb268ab2c42e1e7bc)

 

All Branches   

Search

Author	SHA1	Message	Date
Percy Wegmann	d7fdc01f7f	ssh/tailssh: check IsSELinuxEnforcing in tailscaled process ... Checking in the incubator as this used to do fails because the getenforce command is not on the PATH. Updates #12442 Signed-off-by: Percy Wegmann <percy@tailscale.com>	5 months ago
Jonathan Nobels	02e3c046aa	net/dns: re-query system resolvers on no-upstream resolver failure on apple platforms (#12398) ... Fixes tailscale/corp#20677 On macOS sleep/wake, we're encountering a condition where reconfigure the network a little bit too quickly - before apple has set the nameservers for our interface. This results in a persistent condition where we have no upstream resolver and fail all forwarded DNS queries. No upstream nameservers is a legitimate configuration, and we have no (good) way of determining when Apple is ready - but if we need to forward a query, and we have no nameservers, then something has gone badly wrong and the network is very broken. A simple fix here is to simply inject a netMon event, which will go through the configuration dance again when we hit the SERVFAIL condition. Tested by artificially/randomly returning [] for the list of nameservers in the bespoke ipn-bridge code responsible for getting the nameservers. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	5 months ago
Andrew Dunham	d0f1a838a6	net/dnscache: use parent context to perform lookup ... As an alterative to #11935 using #12003. Updates #11935 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I05f643fe812ceeaec5f266e78e3e529cab3a1ac3	5 months ago
Mario Minardi	5f121396e9	VERSION.txt: this is v1.69.0 (#12441) ... Signed-off-by: Mario Minardi <mario@tailscale.com>	5 months ago
JunYanBJSS	4c01ce9f43	tsnet: fix error formatting bug ... Fixes #12411 Signed-off-by: JunYanBJSS <johnnycocoyan@hotmail.com>	5 months ago
Irbe Krumina	f5936d132a	kube: fix typo (#12437) ... Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Irbe Krumina	a95ea31a4e	kube,tailcfg: store parsed recorder tags in a separate field (#12429) ... Add an additional RecorderAddrs field to tailscale.com/cap/kubernetes capability. RecorderAddrs will only be populated by control with the addresses of any tsrecorder tags set via Recorder. Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Aaron Klotz	3511d1f8a2	cmd/tailscaled, net/dns, wgengine/router: start Windows child processes with DETACHED_PROCESS when I/O is being piped ... When we're starting child processes on Windows that are CLI programs that don't need to output to a console, we should pass in DETACHED_PROCESS as a CreationFlag on SysProcAttr. This prevents the OS from even creating a console for the child (and paying the associated time/space penalty for new conhost processes). This is more efficient than letting the OS create the console window and then subsequently trying to hide it, which we were doing at a few callsites. Fixes #12270 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Nick Khyl	4cdc4ed7db	net/dns/resolver: return an empty successful response instead of NXDomain when resolving A records for 4via6 domains ... As quad-100 is an authoritative server for 4via6 domains, it should always return responses with a response code of 0 (indicating no error) when resolving records for these domains. If there's no resource record of the specified type (e.g. A), it should return a response with an empty answer section rather than NXDomain. Such a response indicates that there is at least one RR of a different type (e.g., AAAA), suggesting the Windows stub resolver to look for it. Fixes tailscale/corp#20767 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Maisem Ali	4b6a0c42c8	safesocket: add ConnectContext ... This adds a variant for Connect that takes in a context.Context which allows passing through cancellation etc by the caller. Updates tailscale/corp#18266 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Nick Khyl	3672f66c74	tailcfg: bump capver for NodeAttrDisableSplitDNSWhenNoCustomResolvers ... Missed in b65221999c. Updates tailscale/corp#15802 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Andrew Dunham	93cd2ab224	util/singleflight: add DoChanContext ... This is a variant of DoChan that supports context propagation, such that the context provided to the inner function will only be canceled when there are no more waiters for a given key. This can be used to deduplicate expensive and cancelable calls among multiple callers safely. Updates #11935 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ibe1fb67442a854babbc6924fd8437b02cc9e7bcf	5 months ago
Irbe Krumina	bc53ebd4a0	ipn/{ipnlocal,localapi},net/netkernelconf,client/tailscale,cmd/containerboot: optionally enable UDP GRO forwarding for containers (#12410) ... Add a new TS_EXPERIMENTAL_ENABLE_FORWARDING_OPTIMIZATIONS env var that can be set for tailscale/tailscale container running as a subnet router or exit node to enable UDP GRO forwarding for improved performance. See https://tailscale.com/kb/1320/performance-best-practices#linux-optimizations-for-subnet-routers-and-exit-nodes This is currently considered an experimental approach; the configuration support is partially to allow further experimentation with containerized environments to evaluate the performance improvements. Updates tailscale/tailscale#12295 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Irbe Krumina	6f2bae019f	cmd/k8s-nameserver: fix AAAA record query response (#12412) ... Return empty response and NOERROR for AAAA record queries for DNS names for which we have an A record. This is to allow for callers that might be first sending an AAAA query and then, if that does not return a response, follow with an A record query. Previously we were returning NOTIMPL that caused some callers to potentially not follow with an A record query or misbehave in different ways. Also return NXDOMAIN for AAAA record queries for names that we DO NOT have an A record for to ensure that the callers do not follow up with an A record query. Returning an empty response and NOERROR is the behaviour that RFC 4074 recommends: https://datatracker.ietf.org/doc/html/rfc4074 Updates tailscale/tailscale#12321 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Aaron Klotz	df86576989	util/winutil: add AllocateContiguousBuffer and SetNTString helper funcs ... AllocateContiguousBuffer is for allocating structs with trailing buffers containing additional data. It is to be used for various Windows structures containing pointers to data located immediately after the struct. SetNTString performs in-place setting of windows.NTString and windows.NTUnicodeString. Updates #12383 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Irbe Krumina	c3e2b7347b	tailcfg,cmd/k8s-operator,kube: move Kubernetes cap to a location that can be shared with control (#12236) ... This PR is in prep of adding logic to control to be able to parse tailscale.com/cap/kubernetes grants in control: - moves the type definition of PeerCapabilityKubernetes cap to a location shared with control. - update the Kubernetes cap rule definition with fields for granting kubectl exec session recording capabilities. - adds a convenience function to produce tailcfg.RawMessage from an arbitrary cap rule and a test for it. An example grant defined via ACLs: "grants": [{ "src": ["tag:eng"], "dst": ["tag:k8s-operator"], "app": { "tailscale.com/cap/kubernetes": [{ "recorder": ["tag:my-recorder"] “enforceRecorder”: true }], }, } ] This grant enforces `kubectl exec` sessions from tailnet clients, matching `tag:eng` via API server proxy matching `tag:k8s-operator` to be recorded and recording to be sent to a tsrecorder instance, matching `tag:my-recorder`. The type needs to be shared with control because we want control to parse this cap and resolve tags to peer IPs. Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Fran Bull	ba46495e11	appc: log how many routes are being written ... So that we can debug customer problems more easily. Updates #11008 Signed-off-by: Fran Bull <fran@tailscale.com>	5 months ago
Irbe Krumina	807934f00c	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388) ... Add a new .spec.tailscale.acceptRoutes field to ProxyClass, that can be optionally set to true for the proxies to accept routes advertized by other nodes on tailnet (equivalent of setting --accept-routes to true). Updates tailscale/tailscale#12322,tailscale/tailscale#10684 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Irbe Krumina	53d9cac196	k8s-operator/apis/v1alpha1,cmd/k8s-operator/deploy/examples: update DNSConfig description (#11971) ... Also removes hardcoded image repo/tag from example DNSConfig resource as the operator now knows how to default those. Updates tailscale/tailscale#11019 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Tom Proctor	23e26e589f	cmd/k8s-operator,k8s-opeerator: include Connector's MagicDNS name and tailnet IPs in status (#12359) ... Add new fields TailnetIPs and Hostname to Connector Status. These contain the addresses of the Tailscale node that the operator created for the Connector to aid debugging. Fixes #12214 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	5 months ago
Irbe Krumina	3a6d3f1a5b	cmd/k8s-operator,k8s-operator,go.{mod,sum}: make individual proxy images/image pull policies configurable (#11928) ... cmd/k8s-operator,k8s-operator,go.{mod,sum}: make individual proxy images/image pull policies configurable Allow to configure images and image pull policies for individual proxies via ProxyClass.Spec.StatefulSet.Pod.{TailscaleContainer,TailscaleInitContainer}.Image, and ProxyClass.Spec.StatefulSet.Pod.{TailscaleContainer,TailscaleInitContainer}.ImagePullPolicy fields. Document that we have images in ghcr.io on the relevant Helm chart fields. Updates tailscale/tailscale#11675 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Brad Fitzpatrick	916c4db75b	net/dns: fix crash in tests ... Looks like #12346 as submitted with failing tests. Updates #12346 Change-Id: I582cd0dfb117686330d935d763d972373c5ae598 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Adrian Dewhurst	0219317372	ipn/ipnlocal: improve sticky last suggestion ... The last suggested exit node needs to be incorporated in the decision making process when a new suggestion is requested, but currently it is not quite right: it'll be used if the suggestion code has an error or a netmap is unavailable, but it won't be used otherwise. Instead, this makes the last suggestion into a tiebreaker when making a random selection between equally-good options. If the last suggestion does not make it to the final selection pool, then a different suggestion will be made. Since LocalBackend.SuggestExitNode is back to being a thin shim that sets up the parameters to suggestExitNode, it no longer needs a test. Its test was unable to be comprehensive anyway as the code being tested contains an uncontrolled random number generator. Updates tailscale/corp#19681 Change-Id: I94ecc9a0d1b622de3df4ef90523f1d3e67b4bfba Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	5 months ago
Andrew Lytvynov	7a7e314096	ipn/ipnlocal,clientupdate: allow auto-updates in contaienrs (#12391) ... We assume most containers are immutable and don't expect tailscale running in them to auto-update. But there's no reason to prohibit it outright. Ignore the tailnet-wide default auto-update setting in containers, but allow local users to turn on auto-updates via the CLI. RELNOTE=Auto-updates are allowed in containers, but ignore the tailnet-wide default. Fixes #12292 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Andrea Gottardo	b65221999c	tailcfg,net/dns: add controlknob to disable battery split DNS on iOS (#12346) ... Updates corp#15802. Adds the ability for control to disable the recently added change that uses split DNS in more cases on iOS. This will allow us to disable the feature if it leads to regression in production. We plan to remove this knob once we've verified that the feature works properly. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Andrew Dunham	e88a5dbc92	various: fix lint warnings ... Some lint warnings caught by running 'make lint' locally. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1534ed6f2f5e1eb029658906f9d62607dad98ca3	5 months ago
Aaron Klotz	34e8820301	util/winutil: add conpty package and helper for building windows.StartupInfoEx ... StartupInfoBuilder is a helper for constructing StartupInfoEx structures featuring proc/thread attribute lists. Calling its setters triggers the appropriate setting of fields, adjusting flags as necessary, and populating the proc/thread attribute list as necessary. Currently it supports four features: setting std handles, setting pseudo-consoles, specifying handles for inheritance, and specifying jobs. The conpty package simplifies creation of pseudo-consoles, their associated pipes, and assignment of the pty to StartupInfoEx proc/thread attributes. Updates #12383 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Brad Fitzpatrick	8a11a43c28	cmd/derpprobe: support 'local' derpmap to get derp map via LocalAPI ... To make it easier for people to monitor their custom DERP fleet. Updates tailscale/corp#20654 Change-Id: Id8af22936a6d893cc7b6186d298ab794a2672524 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Jordan Whited	6e106712f6	cmd/stunstamp: support probing multiple ports (#12356) ... Updates tailscale/corp#20344 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Brad Fitzpatrick	1ca323ac65	net/netcheck: fix probeProto.String result for IPv6 probes ... This bug was introduced in e6b84f215 (May 2020) but was only used in tests when stringifying probeProto values on failure so it wasn't noticed for a long time. But then it was moved into non-test code in 8450a18aa (Jun 2024) and I didn't notice during the code movement that it was wrong. It's still only used in failure paths in logs, but having wrong/ambiguous debugging information isn't the best. Whoops. Updates tailscale/corp#20654 Change-Id: I296c727ed1c292a04db7b46ecc05c07fc1abc774 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	8450a18aa9	net/netcheck: flesh out some logging in error paths ... Updates tailscale/corp#20654 Change-Id: Ie190f956b864985668f79b5b986438bbe07ce905	5 months ago
Kristoffer Dalby	95f266f1ce	tsweb: add optional on completion callback func ... Updates corp#17075 Co-Authored-By: Anton Tolchanov <anton@tailscale.com> Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	5 months ago
Andrew Lytvynov	b8cf852881	go.toolchain.rev: update to go 1.22.4 (#12365) ... Updates https://github.com/tailscale/corp/issues/20635 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Maisem Ali	36e8e8cd64	wgengine/magicsock: use math/rands/v2 ... Updates #11058 Co-authored-by: James Tucker <james@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Fran Bull	573c8bd8c7	cmd/natc: add --wg-port flag ... Updates tailscale/corp#20503 Signed-off-by: Fran Bull <fran@tailscale.com>	5 months ago
Maisem Ali	4a8cb1d9f3	all: use math/rand/v2 more ... Updates #11058 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Fran Bull	d2d459d442	cmd/natc: add --ignore-destinations flag ... Updates tailscale/corp#20503 Signed-off-by: Fran Bull <fran@tailscale.com>	5 months ago
Jun	9cdb33e2a4	tsnet: add a new error when HTTPS enabled but MagicDNC Disabled (#12364) ... Fixes tailscale#12303 Signed-off-by: Jun <johnnycocoyan@hotmail.com>	5 months ago
Jordan Whited	cf1e6c6e55	cmd/stunstamp: fix remote write retry (#12348) ... Evaluation of remote write errors was using errors.Is() where it should have been using errors.As(). Updates tailscale/corp#20344 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Brad Fitzpatrick	6d3c10579e	gokrazy: update breakglass with now-upstreamed ec2 change ... This updates breakglass to use the now-upsteamed https://github.com/gokrazy/breakglass/pull/18 change so we're not using our fork now. It also adds a gok wrapper tool, because doing it by hand was tedious. Updates #1866 Change-Id: Ifacbf5fbf0e377b3bd95c5f76c18751c2e1af7d7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Andrew Lytvynov	347e3f3d9a	go.mod,ipn/ipnlocal: update the ACME fork (#12343) ... Update our fork of golang.org/x/crypto to pick up a fix for ACME ARI: 3fde5e568a Fixes #12278 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Irbe Krumina	82576190a7	tailcfg,cmd/k8s-operator: moves tailscale.com/cap/kubernetes peer cap to tailcfg (#12235) ... This is done in preparation for adding kubectl session recording rules to this capability grant that will need to be unmarshalled by control, so will also need to be in a shared location. Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Andrea Gottardo	d636407f14	net/dns: don't set MatchDomains on Apple platforms when no upstream nameservers available (#12334) ... This PR addresses a DNS issue on macOS as discussed this morning. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Adrian Dewhurst	cf9f507d47	ipn/ipnlocal: only build allowed suggested node list once ... Rather than building a new suggested exit node set every time, compute it once on first use. Currently, syspolicy ensures that values do not change without a restart anyway. Since the set is being constructed in a separate func now, the test code that manipulates syspolicy can live there, and the TestSuggestExitNode can now run in parallel with other tests because it does not have global dependencies. Updates tailscale/corp#19681 Change-Id: Ic4bb40ccc91b671f9e542bd5ba9c96f942081515 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	5 months ago
signed-long	1dc3136a24	cmd/k8s-operator: Support image 'repo' or 'repository' keys in helm values file (#12285) ... cmd/k8s-operator/deploy/chart: Support image 'repo' or 'repository' keys in helm values Fixes #12100 Signed-off-by: Michael Long <michaelongdev@gmail.com>	5 months ago
Andrew Lytvynov	379e2bf189	ipn/ipnlocal: stop offline auto-updates on shutdown (#12342) ... Clean up the updater goroutine on shutdown, in addition to doing that on backend state change. This fixes a goroutine leak on shutdown in tests. Updates #cleanup	5 months ago
Jordan Whited	ba0dd493c8	cmd/stunstamp: validate STUN tx ID in responses (#12339) ... Extremely late arriving responses may leak across probing intervals. Updates tailscale/corp#20344 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Andrew Lytvynov	bc4c8b65c7	ipn/ipnlocal: periodically run auto-updates when "offline" (#12118) ... When the client is disconnected from control for any reason (typically just turned off), we should still attempt to update if auto-updates are enabled. This may help users who turn tailscale on infrequently for accessing resources. RELNOTE: Apply auto-updates even if the node is down or disconnected from the coordination server. Updates #12117 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Maisem Ali	2f2f588c80	cmd/natc: use ListenPacket ... Now that tsnet supports it, use it. Updates tailscale/corp#20503 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Brad Fitzpatrick	e84751217a	gokrazy: add prototype Tailscale appliance, build tooling, docs ... Updates #1866 Change-Id: I546316cb833bf2919e0d6f55cdc9951f375f165b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago