tailscale

Commit Graph

Author	SHA1	Message	Date
Aaron Klotz	acc7baac6d	tailcfg, util/deephash: add DataPlaneAuditLogID to Node and DomainDataPlaneAuditLogID to MapResponse We're adding two log IDs to facilitate data-plane audit logging: a node-specific log ID, and a domain-specific log ID. Updated util/deephash/deephash_test.go with revised expectations for tailcfg.Node. Updates https://github.com/tailscale/corp/issues/6991 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Kyle Carberry	91794f6498	wgengine/magicsock: move firstDerp check after nil derpMap check This fixes a race condition which caused `c.muCond.Broadcast()` to never fire in the `firstDerp` if block. It resulted in `Close()` hanging forever. Signed-off-by: Kyle Carberry <kyle@carberry.com>	2 years ago
Brad Fitzpatrick	2c447de6cc	cmd/tailscaled: use explicit equal sign in --port=$PORT in tailscaled.service Personal preference (so it's obvious it's not a bool flag), but it also matches the --state= before it. Bonus: stop allowing PORT to sneak in extra flags to be passed as their own arguments, as $FOO and ${FOO} expand differently. (${FOO} is required to concat to strings) Change-Id: I994626a5663fe0948116b46a971e5eb2c4023216 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Anton Schubert	021bedfb89	docker: add ability to use a custom control socket Signed-off-by: Anton Schubert <anton.schubert@riedel.net>	2 years ago
hlts2	d988c9f098	fix auth key name Signed-off-by: hlts2 <hiroto.funakoshi.hiroto@gmail.com>	2 years ago
Andrew Dunham	0607832397	wgengine/netstack: always respond to 4via6 echo requests (#5712 ) As the comment in the code says, netstack should always respond to ICMP echo requests to a 4via6 address, even if the netstack instance isn't normally processing subnet traffic. Follow-up to #5709 Change-Id: I504d0776c5824071b2a2e0e687bc33e24f6c4746 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Will Norris	565dbc599a	Revert "licenses: update win/apple licenses" This reverts commit `aadf63da1d`.	2 years ago
License Updater	aadf63da1d	licenses: update win/apple licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Maisem Ali	d5781f61a9	ipn/ipnlocal: return usernames when Tailscale SSH is enabled It was checking if the sshServer was initialized as a proxy, but that could either not have been initialized yet or Tailscale SSH could have been disabled after intialized. Also bump tailcfg.CurrentCapabilityVersion Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	a7a0baf6b9	cmd/tsconnect: add error callback for SSH sessions We were just logging them to the console, which is useful for debugging, but we may want to show them in the UI too. Updates tailscale/corp#6939 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Tom DNetto	e9b98dd2e1	control/controlclient,ipn/ipnlocal: wire tka enable/disable Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	b9b0bf65a0	wgengine/netstack: handle 4via6 packets when pinging (#5709 ) Change-Id: Ib6ebbaa11219fb91b550ed7fc6ede61f83262e89 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Andrew Dunham	c6162c2a94	net/netcheck: add check for captive portal (#5593 ) This doesn't change any behaviour for now, other than maybe running a full netcheck more often. The intent is to start gathering data on captive portals, and additionally, seeing this in the 'tailscale netcheck' command should provide a bit of additional information to users. Updates #1634 Change-Id: I6ba08f9c584dc0200619fa97f9fde1a319f25c76 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Brad Fitzpatrick	aa5e494aba	tsweb: export go_version in standard expvar vars For monitoring. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Berk D. Demir	ff13c66f55	cmd/tailscale: fix configure-host command for Synology `d5e7e309` changed the `hostinfo.GetVersion` from distro and distro version to UTS Name Release and moved distribution information under `hostinfo.Distro*`. `tailscale configure-host` command implementation for Synology DSM environments relies on the old semantics of this string for matching DSM Major version so it's been broken for a few days. Pull in `hostinfo` and prefix match `hostinfo.DistroVersion` to match DSM major version. Signed-off-by: Berk D. Demir <bdd@mindcast.org>	2 years ago
Brad Fitzpatrick	ed248b04a7	cmd/tailscale: remove leftover debug prints from earlier commit From `6632504f45` Change-Id: If21789232b3ecc14c1639cf87814af6fa73f535f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	8158dd2edc	cmd/tsconnect: allow SSH connection timeout to be overridden 5 seconds may not be enough if we're still loading the derp map and connecting to a slow machine. Updates #5693 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	6632504f45	cmd/tailscale/cli: [up] move lose-ssh check after other validations The check was happening too early and in the case of error would wait 5 s and then error out. This makes it so that it does validations before the SSH check. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	054ef4de56	tailcfg: mark CapabilityFileSharingTarget as inter-node Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	d045462dfb	ipn/ipnlocal: add c2n method to get SSH username candidates For control to fetch a list of Tailscale SSH username candidates to filter against the Tailnet's SSH policy to present some valid candidates to a user. Updates #3802 Updates tailscale/corp#7007 Change-Id: I3dce57b7a35e66891d5e5572e13ae6ef3c898498 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	d8eb111ac8	.github/workflows: add cross-android This would've caught the regression from `7c49db02a` before it was submitted so `42f1d92ae0` wouldn't have been necessary to fix it. Updates #4482 Change-Id: Ia4a9977e21853f68df96f043672c86a86c0181db Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	832031d54b	wgengine/magicsock: fix recently introduced data race From `5c42990c2f`, not yet released in a stable build. Caught by existing tests. Fixes #5685 Change-Id: Ia76bb328809d9644e8b96910767facf627830600 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Denton Gentry	42f1d92ae0	net/netns: implement UseSocketMark for Android. Build fails on Android: `../../../../go/pkg/mod/tailscale.com@v1.1.1-0.20220916223019-65c24b6334e9/wgengine/magicsock/magicsock_linux.go:133:12: undefined: netns.UseSocketMark` Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Brad Fitzpatrick	41bb47de0e	cmd/tailscaled: respect $PORT on all platforms, not just Linux Updates #5114 Change-Id: I6c6e28c493d6a026a03088157d08f9fd182ef373 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3562b5bdfa	envknob, health: support Synology, show parse errors in status Updates #5114 Change-Id: I8ac7a22a511f5a7d0dcb8cac470d4a403aa8c817 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
phirework	5c42990c2f	wgengine/magicsock: add client flag and envknob to disable heartbeat (#5638 ) Baby steps towards turning off heartbeat pings entirely as per #540. This doesn't change any current magicsock functionality and requires additional changes to send/disco paths before the flag can be turned on. Updates #540 Change-Id: Idc9a72748e74145b068d67e6dd4a4ffe3932efd0 Signed-off-by: Jenny Zhang <jz@tailscale.com> Signed-off-by: Jenny Zhang <jz@tailscale.com>	2 years ago
Brad Fitzpatrick	65c24b6334	envknob: generalize Windows tailscaled-env.txt support ipnserver previously had support for a Windows-only environment variable mechanism that further only worked when Windows was running as a service, not from a console. But we want it to work from tailscaed too, and we want it to work on macOS and Synology. So move it to envknob, now that envknob can change values at runtime post-init. A future change will wire this up for more platforms, and do something more for CLI flags like --port, which the bug was originally about. Updates #5114 Change-Id: I9fd69a9a91bb0f308fc264d4a6c33e0cbe352d71 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	4bda41e701	Dockerfile: add test that build-env Alpine version matches go.mod So things like #5660 don't happen in the future. Change-Id: I01234f241e297d5b7bdd18da1bb3cc5420ad2225 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	9b71008ef2	control/controlhttp: move Dial options into options struct (#5661 ) This turns 'dialParams' into something more like net.Dialer, where configuration fields are public on the struct. Split out of #5648 Change-Id: I0c56fd151dc5489c3c94fb40d18fd639e06473bc Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Luis Peralta	5623ef0271	Update Dockerfile to use golang:1.19-alpine Tailscale @4a82b31 does not build in the container image due to using golang:1.18 image Signed-off-by: Luis Peralta <luis.peralta@gmail.com>	2 years ago
Tyler Lee	486eecc063	Switched Secret snippet to match run.sh Signed-off-by: Tyler Lee <tyler.lee@radius.ai>	2 years ago
Tyler Lee	b830c9975f	Updated secret example in readme to match the sidecar key value Signed-off-by: Tyler Lee <tyler.lee@radius.ai>	2 years ago
Brad Fitzpatrick	4a82b317b7	ipn/{ipnlocal,localapi}: use strs.CutPrefix, add more domain validation The GitHub CodeQL scanner flagged the localapi's cert domain usage as a problem because user input in the URL made it to disk stat checks. The domain is validated against the ipnstate.Status later, and only authenticated root/configured users can hit this, but add some paranoia anyway. Change-Id: I373ef23832f1d8b3a27208bc811b6588ae5a1ddd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Eng Zer Jun	f0347e841f	refactor: move from io/ioutil to io and os packages The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	2 years ago
Mihai Parparita	027111fb5a	derp: update DERP acronym expansion Makes the package description consistent with other documentation. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	1ce0e558a7	cmd/derper, control/controlhttp: disable WebSocket compression The data that we send over WebSockets is encrypted and thus not compressible. Additionally, Safari has a broken implementation of compression (see nhooyr/websocket#218) that makes enabling it actively harmful. Fixes tailscale/corp#6943 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	74674b110d	envknob: support changing envknobs post-init Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	33ee2c058e	wgengine: update comments, remove redundant code in forceFullWireguardConfig Change-Id: I464a0bce36e3a362c7d7ace0e8d2dd77fa825ee2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	d34dd43562	ipn/ipnlocal: remove unused envknob Change-Id: I6d18af2c469eb660e6ca81d1dcc2af33c9e628aa Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	cf61070e26	net/dnscache: add better logging to bootstrap DNS path (#5640 ) Change-Id: I4cde3a72e06dac18df856a0cfeac10ab7e3a9108 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Kristoffer Dalby	81574a5c8d	portlist: normalise space delimited process names (#5634 )	2 years ago
Mihai Parparita	9c6bdae556	cmd/tsconnect: use the parent window for `beforeunload` event listener The SSH session may be rendered in a different window that the one that is executing the script. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	82e82d9b7a	net/dns/resolver: remove unused responseTimeout constant Timeout is now enforced elsewhere, see discussion in https://github.com/tailscale/tailscale/pull/4408#discussion_r970092333. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
nyghtowl	0f16640546	net/dns: fix fmt error on Revert print Fixes #5619 Signed-off-by: nyghtowl <warrick@tailscale.com>	2 years ago
Joe Tsai	aa0064db4d	logpolicy: add NewWithConfigPath (#5625 ) The version.CmdName implementation is buggy such that it does not correctly identify the binary name if it embeds other go binaries. For now, add a NewWithConfigPath API that allows the caller to explicitly specify this information. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	45a3de14a6	cmd/tailscaled, tailcfg, hostinfo: add flag to disable logging + support As noted in #5617, our documented method of blocking log.tailscale.io DNS no longer works due to bootstrap DNS. Instead, provide an explicit flag (--no-logs-no-support) and/or env variable (TS_NO_LOGS_NO_SUPPORT=true) to explicitly disable logcatcher uploads. It also sets a bit on Hostinfo to say that the node is in that mode so we can end any support tickets from such nodes more quickly. This does not yet provide an easy mechanism for users on some platforms (such as Windows, macOS, Synology) to set flags/env. On Linux you'd used /etc/default/tailscaled typically. Making it easier to set flags for other platforms is tracked in #5114. Fixes #5617 Fixes tailscale/corp#1475 Change-Id: I72404e1789f9e56ec47f9b7021b44c025f7a373a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	f6da2220d3	wgengine: set fwmark masks in netfilter & ip rules This change masks the bitspace used when setting and querying the fwmark on packets. This allows tailscaled to play nicer with other networking software on the host, assuming the other networking software is also using fwmarks & a different mask. IPTables / mark module has always supported masks, so this is safe on the netfilter front. However, busybox only gained support for parsing + setting masks in 1.33.0, so we make sure we arent such a version before we add the "/<mask>" syntax to an ip rule command. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Mihai Parparita	b22b565947	cmd/tsconnect: allow xterm.js terminal options to be passed in Allows clients to use a custom theme and other xterm.js customization options. Fixes #5610 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
David Anderson	7c49db02a2	wgengine/magicsock: don't use BPF receive when SO_MARK doesn't work. Fixes #5607 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Mihai Parparita	c312e0d264	cmd/tsconnect: allow hostname to be specified The auto-generated hostname is nice as a default, but there are cases where the client has a more specific name that it can generate. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago

... 3 4 5 6 7 ...

4716 Commits (2be951a582ce0a58b71c04b63bcf9c1bb38dd2e5) All Branches Search

4716 Commits (2be951a582ce0a58b71c04b63bcf9c1bb38dd2e5)

All Branches