tailscale

Commit Graph

Author	SHA1	Message	Date
David Anderson	df02bb013a	tool/gocross: fail if the toolchain revision isn't findable This used to make sense, but after a refactor somewhere along the line this results in trying to download from a malformed URL and generally confusing failures. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Denton Gentry	ebc630c6c0	net/interfaces: also allow link-local for AzureAppServices. In May 2021, Azure App Services used 172.16.x.x addresses: ``` 10: eth0@if11: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP link/ether 02:42:ac:10:01:03 brd ff:ff:ff:ff:ff:ff inet 172.16.1.3/24 brd 172.16.1.255 scope global eth0 valid_lft forever preferred_lft forever ``` Now it uses link-local: ``` 2: eth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP link/ether 8a:30:1f:50:1d:23 brd ff:ff:ff:ff:ff:ff inet 169.254.129.3/24 brd 169.254.129.255 scope global eth0 valid_lft forever preferred_lft forever ``` This is reasonable for them to choose to do, it just broke the handling in net/interfaces. This PR proposes to: 1. Always allow link-local in LocalAddresses() if we have no better address available. 2. Continue to make isUsableV4() conditional on an environment we know requires it. I don't love the idea of having to discover these environments one by one, but I don't understand the consequences of making isUsableV4() return true unconditionally. It makes isUsableV4() essentially always return true and perform no function. Fixes https://github.com/tailscale/tailscale/issues/7603 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Andrew Dunham	ccace1f7df	ssh/tailssh: fix privilege dropping on FreeBSD; add tests On FreeBSD and Darwin, changing a process's supplementary groups with setgroups(2) will also change the egid of the process, setting it to the first entry in the provided list. This is distinct from the behaviour on other platforms (and possibly a violation of the POSIX standard). Because of this, on FreeBSD with no TTY, our incubator code would previously not change the process's gid, because it would read the newly-changed egid, compare it against the expected egid, and since they matched, not change the gid. Because we didn't use the 'login' program on FreeBSD without a TTY, this would propagate to a child process. This could be observed by running "id -p" in two contexts. The expected output, and the output returned when running from a SSH shell, is: andrew@freebsd:~ $ id -p uid andrew groups andrew However, when run via "ssh andrew@freebsd id -p", the output would be: $ ssh andrew@freebsd id -p login root uid andrew rgid wheel groups andrew (this could also be observed via "id -g -r" to print just the gid) We fix this by pulling the details of privilege dropping out into their own function and prepending the expected gid to the start of the list on Darwin and FreeBSD. Finally, we add some tests that run a child process, drop privileges, and assert that the final UID/GID/additional groups are what we expect. More information can be found in the following article: https://www.usenix.org/system/files/login/articles/325-tsafrir.pdf Updates #7616 Alternative to #7609 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I0e6513c31b121108b50fe561c89e5816d84a45b9	2 years ago
Mihai Parparita	e1fb687104	cmd/tailscale/cli: fix inconsistency between serve text and example command Use the same local port number in both, and be more precise about what is being forwarded Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Anton Tolchanov	654b5a0616	derp: add optional debug logging for prober clients This allows tracking packet flow via logs for prober clients. Note that the new sclient.debug() function is called on every received packet, but will do nothing for most clients. I have adjusted sclient logging to print public keys in short format rather than full. This takes effect even for existing non-debug logging (mostly client disconnect messages). Example logs for a packet being sent from client [SbsJn] (connected to derper [dM2E3]) to client [10WOo] (connected to derper [AVxvv]): ``` derper [dM2E3]: derp client 10.0.0.1:35470[SbsJn]: register single client mesh("10.0.1.1"): 4 peers derp client 10.0.0.1:35470[SbsJn]: read frame type 4 len 40 err <nil> derp client 10.0.0.1:35470[SbsJn]: SendPacket for [10WOo], forwarding via <derphttp_client.Client [AVxvv] url=https://10.0.1.1/derp>: <nil> derp client 10.0.0.1:35470[SbsJn]: read frame type 0 len 0 err EOF derp client 10.0.0.1:35470[SbsJn]: read EOF derp client 10.0.0.1:35470[SbsJn]: sender failed: context canceled derp client 10.0.0.1:35470[SbsJn]: removing connection derper [AVxvv]: derp client 10.0.1.1:50650[10WOo]: register single client derp client 10.0.1.1:50650[10WOo]: received forwarded packet from [SbsJn] via [dM2E3] derp client 10.0.1.1:50650[10WOo]: sendPkt attempt 0 enqueued derp client 10.0.1.1:50650[10WOo]: sendPacket from [SbsJn]: <nil> derp client 10.0.1.1:50650[10WOo]: read frame type 0 len 0 err EOF derp client 10.0.1.1:50650[10WOo]: read EOF derp client 10.0.1.1:50650[10WOo]: sender failed: context canceled derp client 10.0.1.1:50650[10WOo]: removing connection ``` Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Anton Tolchanov	50d211d1a4	cmd/derpprobe: allow running all probes at the same time This allows disabling spread mode, which is helpful if you are manually running derpprobe in `--once` mode against a small number of DERP machines. Updates https://github.com/tailscale/corp/issues/9916 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Anton Tolchanov	e59dc29a55	prober: log client pubkeys on derp mesh probe failures Updates https://github.com/tailscale/corp/issues/9916 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
dependabot[bot]	60a028a4f6	.github: Bump peter-evans/create-pull-request from 4.1.4 to 4.2.4 Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 4.1.4 to 4.2.4. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](`ad43dccb4d...38e0b6e68b`) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2 years ago
dependabot[bot]	927e2e3e7c	.github: Bump actions/setup-go from 3 to 4 Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3 to 4. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v3...v4) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2 years ago
Nahum Shalman	82e067e0ff	build_dist.sh: make cross-compilation friendly Signed-off-by: Nahum Shalman <nahamu@gmail.com>	2 years ago
Maisem Ali	95494a155e	.github: use unique names for jobs Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
James 'zofrex' Sanderson	9534783758	tailscale/cmd: Warn for up --force-reauth over SSH without accepting the risk (#7575 ) Fixes #6377 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	2 years ago
Maisem Ali	f34590d9ed	tsnet: add test for Funnel connections For the logic added in `b797f77`. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	c6d96a2b61	tsnet: do not start logtail in tests It was trying to upload logs in tests. skip-issuebot Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
David Anderson	0498d5ea86	tool/gocross: delete bootstrap tarball downloads after use Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	1f95bfedf7	tool/gocross: adjust Xcode flags to match new Xcode env Xcode changed how/what data it exports to build steps at some point recently, so our old way of figuring out the minimum support version for clang stopped working. Updates tailscale/corp#4095 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Kurnia D Win	9526858b1e	control/controlclient: fix accidental backoff reset Signed-off-by: Kurnia D Win <kurnia.d.win@gmail.com>	2 years ago
David Anderson	df3996cae3	tool/gocross: bootstrap correctly on an older toolchain Sometimes, our cached toolchain ends up being an older version of Go, older than our go.mod allows. In that scenario, gocross-wrapper.sh would find a usable toolchain, but then fail to compile gocross. This change makes the wrapper script check that the cached toolchain's minor version is good enough to build tailscale.com, and re-bootstraps in shell if not. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Mihai Parparita	97b6d3e917	sockstats: remove per-interface stats from Get They're not needed for the sockstats logger, and they're somewhat expensive to return (since they involve the creation of a map per label). We now have a separate GetInterfaces() method that returns them instead (which we can still use in the PeerAPI debug endpoint). If changing sockstatlog to sample at 10,000 Hz (instead of the default of 10Hz), the CPU usage would go up to 59% on a iPhone XS. Removing the per-interface stats drops it to 20% (a no-op implementation of Get that returns a fixed value is 16%). Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
David Anderson	9ebab961c9	version/mkversion: don't break on tagged go.mod entries I thought our versioning scheme would make go.mod include a commit hash even on stable builds. I was wrong. Fortunately, the rest of this code wants anything that 'git rev-parse' understands (to convert it into a full git hash), and tags qualify. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Denton Gentry	6d3490f399	VERSION.txt: this is 1.39 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
License Updater	51b0169b10	licenses: update win/apple licenses Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	2 years ago
Maisem Ali	b4d3e2928b	tsnet: avoid deadlock on close tsnet.Server.Close was calling listener.Close with the server mutex held, but the listener close method tries to grab that mutex, resulting in a deadlock. Co-authored-by: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
shayne	2b892ad6e7	cmd/tailscale/cli: [serve] rework commands based on feedback (#6521 ) ``` $ tailscale serve https:<port> <mount-point> <source> [off] $ tailscale serve tcp:<port> tcp://localhost:<local-port> [off] $ tailscale serve tls-terminated-tcp:<port> tcp://localhost:<local-port> [off] $ tailscale serve status [--json] $ tailscale funnel <serve-port> {on\|off} $ tailscale funnel status [--json] ``` Fixes: #6674 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Will Norris	6ef2105a8e	log/sockstatlog: only start once; don't copy ticker Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Maisem Ali	8c4adde083	log/sockstatlog: also shutdown the poll goroutine Co-authored-by: Will Norris <will@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	c87782ba9d	cmd/k8s-operator: drop trailing dot in tagged node name Also update tailcfg docs. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Will Norris	09e0ccf4c2	ipn: add c2n endpoint for sockstats logs Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Will Norris	a1d9f65354	ipn,log: add logger for sockstat deltas Signed-off-by: Will Norris <will@tailscale.com> Co-authored-by: Melanie Warrick <warrick@tailscale.com>	2 years ago
Maisem Ali	5e8a80b845	all: replace /kb/ links with /s/ equivalents Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	558735bc63	cmd/k8s-operator: require HTTPS to be enabled for AuthProxy Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	489e27f085	cmd/k8s-operator: make auth proxy pass tags as Impersonate-Group We were not handling tags at all, pass them through as Impersonate-Group headers. And use the FQDN for tagged nodes as Impersonate-User. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	56526ff57f	tailcfg: bump capver for 1.38 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	09aed46d44	cmd/tailscale/cli: update docs and unhide configure Also call out Alpha. Updates #7220 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	223713d4a1	tailcfg,all: add and use Node.IsTagged() Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	83fa17d26c	various: pass logger.Logf through to more places Updates #7537 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id89acab70ea678c8c7ff0f44792d54c7223337c6	2 years ago
Maisem Ali	958c89470b	tsnet: add CertDomains helper (#7533 ) Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
shayne	e109cf9fdd	tsnet/tsnet: clear ipn.ServeConfig on Up for tsnet apps (#7534 ) We persist the ServeConfig, even for tsnet apps. It's quite possible for the ServeConfig to be out of step with the code. Example: If you run `ListenFunnel` then later turn it off, the ServeConfig will still show it enabled, the admin console will show it enabled, but the packet handler will reject the packets. Workaround by clearing the ServeConfig in `tsnet.Up` Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Maisem Ali	3ff44b2307	ipn: add Funnel port check from nodeAttr Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	ccdd534e81	tsnet: add ListenFunnel This lets a tsnet binary share a server out over Tailscale Funnel. Signed-off-by: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Denton Gentry	047b324933	scripts/installer: add PureOS and Amazon Linux Next Fixes https://github.com/tailscale/tailscale/issues/7410 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Andrew Dunham	f0d6228c52	ipn/localapi: flesh out the 'debug derp' checks Updates #6526 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic18d9ff288b9c7b8d5ab1bd77dd59693cd776cc4	2 years ago
License Updater	920de86cee	licenses: update android licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Mihai Parparita	b64d78d58f	sockstats: refactor validation to be opt-in Followup to #7499 to make validation a separate function ( GetWithValidation vs. Get). This way callers that don't need it don't pay the cost of a syscall per active TCP socket. Also clears the conn on close, so that we don't double-count the stats. Also more consistently uses Go doc comments for the exported API of the sockstats package. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	ea81bffdeb	sockstats: export as client metrics Though not fine-grained enough to be useful for detailed analysis, we might as well export that we gather as client metrics too, since we have an upload/analysis pipeline for them. clientmetric.Metric.Add is an atomic add, so it's pretty cheap to also do per-packet. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	1e72de6b72	ipn/ipnlocal: remove WIP restriction for Tailscale SSH on macOS It kinda works fine now on macOS with the recent fixes in `0582829` and `5787989d`. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	92fc243755	cmd/tailscale: annotate tailnet-lock keys which wrap pre-auth keys Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	3471fbf8dc	cmd/tailscale: surface node-key for locked out tailnet-lock peers Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	b797f773c7	ipn/ipnlocal: add support for funnel in tsnet Previously the part that handled Funnel connections was not aware of any listeners that tsnet.Servers might have had open so it would check against the ServeConfig and fail. Adding a ServeConfig for a TCP proxy was also not suitable in this scenario as that would mean creating two different listeners and have one forward to the other, which really meant that you could not have funnel and tailnet-only listeners on the same port. This also introduces the ipn.FunnelConn as a way for users to identify whether the call is coming over funnel or not. Currently it only holds the underlying conn and the target as presented in the "Tailscale-Ingress-Target" header. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Joe Tsai	dad78f31f3	syncs: add WaitGroup wrapper (#7481 ) The addition of WaitGroup.Go in the standard library has been repeatedly proposed and rejected. See golang/go#18022, golang/go#23538, and golang/go#39863 In summary, the argument for WaitGroup.Go is that it avoids bugs like: go func() { wg.Add(1) defer wg.Done() ... }() where the increment happens after execution (not before) and also (to a lesser degree) because: wg.Go(func() { ... }) is shorter and more readble. The argument against WaitGroup.Go is that the provided function takes no arguments and so inputs and outputs must closed over by the provided function. The most common race bug for goroutines is that the caller forgot to capture the loop iteration variable, so this pattern may make it easier to be accidentally racy. However, that is changing with golang/go#57969. In my experience the probability of race bugs due to the former still outwighs the latter, but I have no concrete evidence to prove it. The existence of errgroup.Group.Go and frequent utility of the method at least proves that this is a workable pattern and the possibility of accidental races do not appear to manifest as frequently as feared. A reason not to use errgroup.Group everywhere is that there are many situations where it doesn't make sense for the goroutine to return an error since the error is handled in a different mechanism (e.g., logged and ignored, formatted and printed to the frontend, etc.). While you can use errgroup.Group by always returning nil, the fact that you can return nil makes it easy to accidentally return an error when nothing is checking the return of group.Wait. This is not a hypothetical problem, but something that has bitten us in usages that was only using errgroup.Group without intending to use the error reporting part of it. Thus, add a (yet another) variant of WaitGroup here that is identical to sync.WaitGroup, but with an extra method. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago

... 5 6 7 8 9 ...

5784 Commits (2e0aa151c98c69d7fd8da87031abcb5c26f9df94) All Branches Search

5784 Commits (2e0aa151c98c69d7fd8da87031abcb5c26f9df94)

All Branches