tailscale

Commit Graph

Author	SHA1	Message	Date
Andrew Lytvynov	2e956713de	safesocket: remove ConnectionStrategy (#10662 ) This type seems to be a migration shim for TCP tailscaled sockets (instead of unix/windows pipes). The `port` field was never set, so it was effectively used as a string (`path` field). Remove the whole type and simplify call sites to pass the socket path directly to `safesocket.Connect`. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Andrew Lytvynov	1302bd1181	all: cleanup unused code, part 1 (#10661 ) Run `staticcheck` with `U1000` to find unused code. This cleans up about a half of it. I'll do the other half separately to keep PRs manageable. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Andrew Dunham	3c333f6341	net/portmapper: add logs about obtained mapping(s) This logs additional information about what mapping(s) are obtained during the creation process, including whether we return an existing cached mapping. Updates #10597 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I9ff25071f064c91691db9ab0b9365ccc5f948d6e	11 months ago
David Crawshaw	f815d66a88	api.md: add docs for setting an IP address Updates tailscale/corp#16453 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	11 months ago
Andrew Dunham	01286af82b	net/interfaces: better handle multiple interfaces in LikelyHomeRouterIP Currently, we get the "likely home router" gateway IP and then iterate through all IPs for all interfaces trying to match IPs to determine the source IP. However, on many platforms we know what interface the gateway is through, and thus we don't need to iterate through all interfaces checking IPs. Instead, use the IP address of the associated interface. This better handles the case where we have multiple interfaces on a system all connected to the same gateway, and where the first interface that we visit (as iterated by ForeachInterfaceAddress) isn't also the default internet route. Updates #8992 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8632f577f1136930f4ec60c76376527a19a47d1f	11 months ago
Andrew Lytvynov	7a2eb22e94	ipn: remove use of reflect.MethodByName (#10652 ) Using reflect.MethodByName disables some linked deadcode optimizations and makes our binaries much bigger. Difference before/after this commit: ``` -rwxr-xr-x 1 awly awly 30M Dec 19 15:28 tailscaled.after* -rwxr-xr-x 1 awly awly 43M Dec 19 15:27 tailscaled.before* ``` Fixes #10627 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Andrew Dunham	09136e5995	net/netutil: add function to check rp_filter value (#5703 ) Updates #4432 Change-Id: Ifc332a5747fc1feffdbb87437308cf8ecb21b0b0 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	11 months ago
Paul Scott	65f2d32300	api.md: add device.postureIdentity field Updates tailscale/corp#15445 Signed-off-by: Paul Scott <paul@tailscale.com>	11 months ago
Paul Scott	03f22cd9fa	client/tailscale: add Device.PostureIdentity field New API fields being added in tailscale/corp#15445. Updates tailscale/corp#15203 Signed-off-by: Paul Scott <paul@tailscale.com>	11 months ago
Nick Khyl	5e3126f510	tool/gocross: make all Windows DLLs build with static libgcc In this commit, we have updated the build process for our Windows DLLs to link statically with libgcc, ensuring our Windows DLLs are self-contained. Updates #10617 Signed-off-by: Nick Khyl <nickk@tailscale.com>	11 months ago
James Tucker	0957258f84	appc,ipn: prevent undesirable route advertisements Individual route advertisements that are covered by existing routes are no longer advertised. If an upstream returns 0.0.0.0, 127.x, and other common unwanted addresses those are also rejected. Updates #16425 Signed-off-by: James Tucker <james@tailscale.com>	11 months ago
Gavin Greenwalt	865ee25a57	cmd/tailscale/cli: update debug.go (#10644 ) redundant run "portmap debugging" word 'debugging' Signed-off-by: Gavin Greenwalt <gavin@sfstudios.com>	11 months ago
Andrew Dunham	a661287c4b	util/cmpx: remove code that's in the stdlib now The cmpx.Compare function (and associated interface) are now available in the standard library as cmp.Compare. Remove our version of it and use the version from the standard library. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I4be3ac63d466c05eb7a0babb25cb0d41816fbd53	11 months ago
Andrew Lytvynov	945cf836ee	ipn: apply tailnet-wide default for auto-updates (#10508 ) When auto-update setting in local Prefs is unset, apply the tailnet default value from control. This only happens once, when we apply the default (or when the user manually overrides it), tailnet default no longer affects the node. Updates #16244 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Andrew Dunham	d05a572db4	net/portmapper: handle multiple UPnP discovery responses Instead of taking the first UPnP response we receive and using that to create port mappings, store all received UPnP responses, sort and deduplicate them, and then try all of them to obtain an external address. Updates #10602 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I783ccb1834834ee2a9ecbae2b16d801f2354302f	11 months ago
Irbe Krumina	38b4eb9419	cmd/k8s-operator/deploy/chart: document passing multiple proxy tags + log level values (#10624 ) Updates #cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	11 months ago
Flakes Updater	dc2792aaee	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	11 months ago
as2643	3fb6ee7fdb	tailscale/logtail: redact public ipv6 and ipv4 ip addresses within tailscaled. (#10531 ) Updates #15664 Signed-off-by: Anishka Singh <anishkasingh66@gmail.com>	11 months ago
James Tucker	3a635db06e	cmd/connector-gen: add helper tool for wide app connector configurations connector-gen can initially generate connector ACL snippets and advertise-routes flags for Github and AWS based on their public IP / domain data. Updates ENG-2425 Signed-off-by: James Tucker <james@tailscale.com>	11 months ago
James Tucker	706e30d49e	disco: correct noun for nacl box type in disco docs Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	11 months ago
Sonia Appasamy	c6a274611e	client/web: use Tailscale IP known by peer node Throughout the web UI, we present the tailscale addresses for the self node. In the case of the node being shared out with a user from another tailnet, the peer viewer may actually know the node by a different IP than the node knows itself as (Tailscale IPs can be configured as desired on a tailnet level). This change includes two fixes: 1. Present the self node's addresses in the frontend as the addresses the viewing node knows it as (i.e. the addresses the viewing node uses to access the web client). 2. We currently redirect the viewer to the Tailscale IPv4 address if viewing it by MagicDNS name, or any other name that maps to the Tailscale node. When doing this redirect, which is primarily added for DNS rebinding protection, we now check the address the peer knows this node as, and redirect to specifically that IP. Fixes tailscale/corp#16402 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	11 months ago
Jordan Whited	685b853763	wgengine/magicsock: fix handling of derp.PeerGoneMessage (#10589 ) The switch in Conn.runDerpReader() on the derp.ReceivedMessage type contained cases other than derp.ReceivedPacket that fell through to writing to c.derpRecvCh, which should only be reached for derp.ReceivedPacket. This can result in the last/previous derp.ReceivedPacket to be re-handled, effectively creating a duplicate packet. If the last derp.ReceivedPacket happens to be a disco.CallMeMaybe it may result in a disco ping scan towards the originating peer on the endpoints contained. The change in this commit moves the channel write on c.derpRecvCh and subsequent select awaiting the result into the derp.ReceivedMessage case, preventing it from being reached from any other case. Explicit continue statements are also added to non-derp.ReceivedPacket cases where they were missing, in order to signal intent to the reader. Fixes #10586 Signed-off-by: Jordan Whited <jordan@tailscale.com>	11 months ago
Andrew Dunham	3ae562366b	ipn/ipnlocal: fix usage of slices.Compact Fixes #10595 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I4e96e9c43b8dedb5f88b03368c01b0e46723e15b	11 months ago
Irbe Krumina	1a08ea5990	cmd/k8s-operator: operator can create subnetrouter (#9505 ) * k8s-operator,cmd/k8s-operator,Makefile,scripts,.github/workflows: add Connector kube CRD. Connector CRD allows users to configure the Tailscale Kubernetes operator to deploy a subnet router to expose cluster CIDRs or other CIDRs available from within the cluster to their tailnet. Also adds various CRD related machinery to generate CRD YAML, deep copy implementations etc. Engineers will now have to run 'make kube-generate-all` after changing kube files to ensure that all generated files are up to date. * cmd/k8s-operator,k8s-operator: reconcile Connector resources Reconcile Connector resources, create/delete subnetrouter resources in response to changes to Connector(s). Connector reconciler will not be started unless ENABLE_CONNECTOR env var is set to true. This means that users who don't want to use the alpha Connector custom resource don't have to install the Connector CRD to their cluster. For users who do want to use it the flow is: - install the CRD - install the operator (via Helm chart or using static manifests). For Helm users set .values.enableConnector to true, for static manifest users, set ENABLE_CONNECTOR to true in the static manifest. Updates tailscale/tailscale#502 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	11 months ago
Chris Palmer	b62a3fc895	client/web: keep redirects on-site (#10525 ) Ensure we don't create Location: header URLs that have leading //, which is a schema-less reference to arbitrary 3rd-party sites. That is, //example.com/foo redirects off-site, while /example.com/foo is an on-site path URL. Fixes tailscale/corp#16268 Signed-off-by: Chris Palmer <cpalmer@tailscale.com>	11 months ago
Andrew Dunham	727acf96a6	net/netcheck: use DERP frames as a signal for home region liveness This uses the fact that we've received a frame from a given DERP region within a certain time as a signal that the region is stil present (and thus can still be a node's PreferredDERP / home region) even if we don't get a STUN response from that region during a netcheck. This should help avoid DERP flaps that occur due to losing STUN probes while still having a valid and active TCP connection to the DERP server. RELNOTE=Reduce home DERP flapping when there's still an active connection Updates #8603 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If7da6312581e1d434d5c0811697319c621e187a0	11 months ago
Andrew Dunham	bac4890467	net/portmapper: be smarter about selecting a UPnP device Previously, we would select the first WANIPConnection2 (and related) client from the root device, without any additional checks. However, some routers expose multiple UPnP devices in various states, and simply picking the first available one can result in attempting to perform a portmap with a device that isn't functional. Instead, mimic what the miniupnpc code does, and prefer devices that are (a) reporting as Connected, and (b) have a valid external IP address. For our use-case, we additionally prefer devices that have an external IP address that's a public address, to increase the likelihood that we can obtain a direct connection from peers. Finally, we split out fetching the root device (getUPnPRootDevice) from selecting the best service within that root device (selectBestService), and add some extensive tests for various UPnP server behaviours. RELNOTE=Improve UPnP portmapping when multiple UPnP services exist Updates #8364 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I71795cd80be6214dfcef0fe83115a5e3fe4b8753	11 months ago
Sonia Appasamy	971fa8dc56	VERSION.txt: this is v1.57.0 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	11 months ago
Flakes Updater	e00141ccbe	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	11 months ago
OSS Updater	e78cb9aeb3	go.mod: update web-client-prebuilt module Signed-off-by: OSS Updater <noreply+oss-updater@tailscale.com>	11 months ago
Sonia Appasamy	4fb679d9cd	client/web: fix redirect logic when accessing login client over TS IP Was previously failing to redirect to the manage client when accessing the login client with the Tailscale IP. Updates #10261 Fixes tailscale/corp#16348 Co-authored-by: Will Norris <will@tailscale.com> Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	11 months ago
Anton Tolchanov	869b34ddeb	prober: log HTTP response body on failure Signed-off-by: Anton Tolchanov <anton@tailscale.com>	11 months ago
Andrea Barisani	affe11c503	net/netcheck: only run HTTP netcheck for tamago clients Signed-off-by: Andrea Barisani <andrea@inversepath.com>	11 months ago
Flakes Updater	3ba5fd4baa	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	11 months ago
OSS Updater	be19262cc5	go.mod: update web-client-prebuilt module Signed-off-by: OSS Updater <noreply+oss-updater@tailscale.com>	11 months ago
Charlotte Brandhorst-Satzkorn	7370f3e3a7	words: some stellar additions Don't get too starry-eyed reviewing these. Updates tailscale/corp#14698 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	11 months ago
Sonia Appasamy	77f5d669fa	client/web: fix key expiry text when expiry disabled Displays "No expiry" when disabled. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	11 months ago
Sonia Appasamy	06af3e3014	client/web: only add cache header for assets Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	11 months ago
Flakes Updater	808f19bf01	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	11 months ago
OSS Updater	afe138f18d	go.mod: update web-client-prebuilt module Signed-off-by: OSS Updater <noreply+oss-updater@tailscale.com>	11 months ago
Sonia Appasamy	dd0279a6c9	client/web: fix ts connection check Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	11 months ago
Flakes Updater	8c2fcef453	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	11 months ago
Sonia Appasamy	343f4e4f26	client/web: refresh auth after syno login Makes sure we refresh auth state after synology auth has run. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	11 months ago
Will Norris	1b7d289fad	client/web: add debug card to details page Add a new "Debug" card at the bottom of the details page. It's maybe premature to add a separate card for this, since all it currently lists is whether the device is using TUN mode and (for Synology) the DSM version. But I think it may be helpful to add client connectivity data (like shown on admin console machine page) as well as a bug report button. Those can come soon after the 1.56 launch. Updates #10261 Signed-off-by: Will Norris <will@tailscale.com>	11 months ago
OSS Updater	552b1ad094	go.mod: update web-client-prebuilt module Signed-off-by: OSS Updater <noreply+oss-updater@tailscale.com>	11 months ago
Sonia Appasamy	1aee6e901d	client/web: use prefs.ControlURLOrDefault from controlSupportsCheckMode To be safe, use `prefs.ControlURLOrDefault()` rather than the current `prefs.ControlURL` directly. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	11 months ago
Irbe Krumina	0cdc8e20d6	util/linuxfw: return created chain (#10563 ) Ensure that if getOrCreateChain creates a new chain, it actually returns the created chain Updates tailscale/tailscale#10399 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	11 months ago
Will Norris	d2fbdb005d	client/web: use CSP hash for inline javascript Calculate and set the hash of the one inline script we have in index.html. That script is unlikely to change, so hardcoding the hash seems fine for now. Updates #10261 Updates tailscale/corp#16266 Signed-off-by: Will Norris <will@tailscale.com>	11 months ago
Sonia Appasamy	bc9b9e8f69	client/web: restrict using an exit node on a couple more platforms Completed testing of the new UI on the existing platforms that use it. From testing, QNAP, Unraid, and Home Assistant (in addition to Synology) all do not play well with using an exit node. For now, we're disabling this setting from the UI. CLI should be updated to also disallow selection of an exit node from these platforms. All platforms still allow for advertising as an exit node. Co-authored-by: Will Norris <will@tailscale.com> Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	11 months ago
Will Norris	fc69301fd1	client/web: don't show login button if /ok errors When displaying the login client, we check for connectivity to the management client by calling it's /ok handler. If that response is non-200, then there is something wrong with the management client, so don't render the login button. Updates #10261 Signed-off-by: Will Norris <will@tailscale.com>	11 months ago

1 2 3 4 5 ...

6980 Commits (2e956713deed73822db6b82a37aaced91a05bea3) All Branches Search

6980 Commits (2e956713deed73822db6b82a37aaced91a05bea3)

All Branches