5224 Commits (30e0156430d88bd2a8b736d9f0297be934872ab6)

 

All Branches   

Search

Author	SHA1	Message	Date
Dave Anderson	041a0e3c27	client/tailscale: add APIs for auth key management. (#6715) ... client/tailscale: add APIs for key management. Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	b2d4abf25a	cmd/k8s-operator: add a kubernetes operator. ... This was initially developed in a separate repo, but for build/release reasons and because go module management limits the damage of importing k8s things now, moving it into this repo. At time of commit, the operator enables exposing services over tailscale, with the 'tailscale' loadBalancerClass. It also currently requires an unreleased feature to access the Tailscale API, so is not usable yet. Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Mihai Parparita	47002d93a3	ipn/ipnlocal: add a few metrics for PeerAPI and LocalAPI ... Mainly motivated by wanting to know how much Taildrop is used, but also useful when tracking down how many invalid requests are generated. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Aaron Klotz	53e2010b8a	cmd/tailscaled: change Windows implementation to shut down subprocess via closing its stdin ... We've been doing a hard kill of the subprocess, which is only safe as long as both the cli and gui are not running and the subprocess has had the opportunity to clean up DNS settings etc. If unattended mode is turned on, this is definitely unsafe. I changed babysitProc to close the subprocess's stdin to make it shut down, and then I plumbed a cancel function into the stdin reader on the subprocess side. Fixes https://github.com/tailscale/corp/issues/5621 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	1 year ago
缘生	9c67395334	feat(build): add support on Loongnix-Server (loong64) (#6233) ... Makefile, .github/workflow: add tests, targets for GOARCH=loong64 (Loongnix) Signed-off-by: ysicing <i@ysicing.me>	1 year ago
Brad Fitzpatrick	7b65b7f85c	go.mod: bump tailscale/wireguard-go for loong64 ... Updates tailscale/tailscale#6233 Change-Id: I5ba1826e79be51c03b19f2b31d73024410be4970 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	5a523fdc7f	go.mod: update deps to add support for GOARCH=loong64 ... Updates tailscale/tailscale#6233 Change-Id: Ibbc8e42607342e4ab4fc0b365ed628d82b56864d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
shayne	9d335aabb2	cmd/tailscale/cli: [ssh] fix typo in help text (#6694) ... arugments => arguments Signed-off-by: shayne <79330+shayne@users.noreply.github.com>	1 year ago
License Updater	ab4992e10d	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	1 year ago
Jordan Whited	ea5ee6f87c	all: update golang.zx2c4.com/wireguard to github.com/tailscale/wireguard-go (#6692) ... This is temporary while we work to upstream performance work in https://github.com/WireGuard/wireguard-go/pull/64. A replace directive is less ideal as it breaks dependent code without duplication of the directive. Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 year ago
Andrew Dunham	b63094431b	wgengine/router: fix tests on systems with older Busybox 'ip' binary ... Adjust the expected system output by removing the unsupported mask component including and after the slash in expected output like: fwmask 0xabc/0xdef This package's tests now pass in an Alpine container when the 'go' and 'iptables' packages are installed (and run as privileged so /dev/net/tun exists). Fixes #5928 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id1a3896282bfa36b64afaec7a47205e63ad88542	1 year ago
Maisem Ali	eb1adf629f	net/tstun: reuse buffered packet from pool ... We would call parsedPacketPool.Get() for all packets received in Read/Write. This was wasteful and not necessary, fetch a single *packet.Parsed for all packets. Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Walter Poupore	383e203fd2	cmd/tailscale/cli: update lock status help strings (#6675) ... Signed-off-by: Walter Poupore <walterp@tailscale.com> Signed-off-by: Walter Poupore <walterp@tailscale.com>	1 year ago
Jordan Whited	76389d8baf	net/tstun, wgengine/magicsock: enable vectorized I/O on Linux (#6663) ... This commit updates the wireguard-go dependency and implements the necessary changes to the tun.Device and conn.Bind implementations to support passing vectors of packets in tailscaled. This significantly improves throughput performance on Linux. Updates #414 Signed-off-by: Jordan Whited <jordan@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com> Co-authored-by: James Tucker <james@tailscale.com>	1 year ago
James Tucker	389238fe4a	cmd/tailscale/cli: add workaround for improper named socket quoting in ssh command ... This avoids the issue in the common case where the socket path is the default path, avoiding the immediate need for a Windows shell quote implementation. Updates #6639 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Mihai Parparita	bdc45b9066	wgengine/magicsock: fix panic when rebinding fails ... We would replace the existing real implementation of nettype.PacketConn with a blockForeverConn, but that violates the contract of atomic.Value (where the type cannot change). Fix by switching to a pointer value (atomic.Pointer[nettype.PacketConn]). A longstanding issue, but became more prevalent when we started binding connections to interfaces on macOS and iOS (#6566), which could lead to the bind call failing if the interface was no longer available. Fixes #6641 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Tom DNetto	e27f4f022e	cmd/tailscale/cli: add progress to tailscale file cp ... Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Xe Iaso	d1a5757639	tsnet: add HTTP client method to tsnet.Server (#6669) ... This allows tsnet services to make requests to other services in the tailnet with the tsnet service identity instead of the identity of the host machine. This also enables tsnet services to make requests to other tailnet services without having to have the host machine join the tailnet. Signed-off-by: Xe Iaso <xe@tailscale.com> Signed-off-by: Xe Iaso <xe@tailscale.com>	1 year ago
salman	2d271f3bd1	ipn/ipnlocal: disallow exit nodes from using exit nodes ... Nodes which have both -advertise-exit-node and -exit-node in prefs should continue have them until the next invocation of `tailscale up`. Updates #3569. Signed-off-by: salman <salman@tailscale.com>	1 year ago
License Updater	5f68763cb2	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	1 year ago
shayne	98114bf608	cmd/tailscale/cli, ipn/localapi: add funnel status to status command (#6402) ... Fixes #6400 open up GETs for localapi serve-config to allow read-only access to ServeConfig `tailscale status` will include "Funnel on" status when Funnel is configured. Prints nothing if Funnel is not running. Example: $ tailscale status <nodes redacted> # Funnel on: # - https://node-name.corp.ts.net # - https://node-name.corp.ts.net:8443 # - tcp://node-name.corp.ts.net:10000 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	1 year ago
David Anderson	1b65630e83	cmd/containerboot: switch to IPN bus monitoring instead of polling. ... We still have to shell out to `tailscale up` because the container image's API includes "arbitrary flags to tailscale up", unfortunately. But this should still speed up startup a little, and also enables k8s-bound containers to update their device information as new netmap updates come in. Fixes #6657 Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Tom DNetto	55e0512a05	ipn/ipnlocal,cmd/tailscale: minor improvements to lock modify command ... * Do not print the status at the end of a successful operation * Ensure the key of the current node is actually trusted to make these changes Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Aaron Klotz	98f21354c6	cmd/tailscaled: add a special command to tailscaled's Windows service for removing WinTun ... WinTun is installed lazily by tailscaled while it is running as LocalSystem. Based upon what we're seeing in bug reports and support requests, removing WinTun as a lesser user may fail under certain Windows versions, even when that user is an Administrator. By adding a user-defined command code to tailscaled, we can ask the service to do the removal on our behalf while it is still running as LocalSystem. * The uninstall code is basically the same as it is in corp; * The command code will be sent as a service control request and is protected by the SERVICE_USER_DEFINED_CONTROL access right, which requires Administrator. I'll be adding follow-up patches in corp to engage this functionality. Updates https://github.com/tailscale/tailscale/issues/6433 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	1 year ago
David Anderson	367228ef82	cmd/containerboot: gracefully degrade if missing patch permissions in k8s. ... Fixes #6629. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Andrew Dunham	a887ca7efe	ipn/ipnlocal: improve redactErr to handle more cases ... This handles the case where the inner *os.PathError is wrapped in another error type, and additionally will redact errors of type *os.LinkError. Finally, add tests to verify that redaction works. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie83424ff6c85cdb29fb48b641330c495107aab7c	1 year ago
David Anderson	e36c27bcd1	cmd/containerboot: check that k8s secret permissions are correct. ... Updates #6629. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	e79a1eb24a	cmd/containerboot: refactor tests to have more explicit phases. ... In preparation for making startup more complex with IPN bus watches. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	e04aaa7575	cmd/containerboot: split tailscaled bringup and auth phases. ... In preparation for reworking auth to use IPN bus watch. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	a469ec8ff6	cmd/containerboot: fix some lint. ... Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
License Updater	c084c7d7ed	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	1 year ago
Anton Tolchanov	5ff946a9e6	cmd/containerboot: fix TS_STATE_DIR environment variable ... It's supposed to set `--statedir` rather than `--state` file. Fixes #6634. Signed-off-by: Anton Tolchanov <anton@tailscale.com>	1 year ago
License Updater	7048024e04	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	1 year ago
Brad Fitzpatrick	1598cd0361	net/tsaddr: remove ContainsFunc helpers (they're now in x/exp/slices) ... x/exp/slices now has ContainsFunc (golang/go#53983) so we can delete our versions. Change-Id: I5157a403bfc1b30e243bf31c8b611da25e995078 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
License Updater	4b34c88426	licenses: update android licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	1 year ago
Mihai Parparita	79f3a5d753	net/netns, net/interfaces: explicitly bind sockets to the default interface on all Darwin variants ... We were previously only doing this for tailscaled-on-Darwin, but it also appears to help on iOS. Otherwise, when we rebind magicsock UDP connections after a cellular -> WiFi interface change they still keep using cellular one. To do this correctly when using exit nodes, we need to exclude the Tailscale interface when getting the default route, otherwise packets cannot leave the tunnel. There are native macOS/iOS APIs that we can use to do this, so we allow those clients to override the implementation of DefaultRouteInterfaceIndex. Updates #6565, may also help with #5156 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Mihai Parparita	cb525a1aad	cmd/tailscaled: fix typo in netstack variable name ... Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Julia Stein	3f16dec1bb	api.md: change "admin panel" to "admin console" ... Signed-off-by: Julia Stein <julia@tailscale.com>	1 year ago
Tom DNetto	9c773af04c	ipn/ipnlocal: fix use of stale profile while processing netmap ... Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Denton Gentry	c933b8882c	VERSION.txt: this is v1.35.0 ... Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
Brad Fitzpatrick	964d723aba	ipn/{ipnserver,localapi}: fix InUseOtherUser handling with WatchIPNBus ... Updates tailscale/corp#8222 Change-Id: I2d6fa6514c7b8d0f89fded35a2d44e7df27e6fb1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	86b6ff61e6	ipn/ipnlocal: fix Prefs access without mu being held ... Noticed while working on a different fix. Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	cdb924f87b	ipn/ipnlocal: sanitize prefs in more notify code paths ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Denton Gentry	7c4d017636	paths: set QNAP socket to /tmp. ... Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
Brad Fitzpatrick	57124e2126	ipn/localapi: add debug (root-required) access to inject debug Notify ... For testing of Windows GUI client. Updates #6480 Change-Id: I42f7526d95723e14bed7085fb759e371b43aa9da Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	96cad35870	cmd/tailscaled: rename variables to be more descriptive ... renamed from `useNetstack` to `onlyNetstack` which is 1 letter more but more descriptive because we always have netstack enabled and `useNetstack` doesn't convey what it is supposed to be used for. e.g. we always use netstack for Tailscale SSH. Also renamed shouldWrapNetstack to handleSubnetsInNetstack as it was only used to configure subnet routing via netstack. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Mihai Parparita	a87e0b4ea8	ipn: update comments that refer to Options.Prefs ... Things are slightly less tangled now that we've migrated prefs to the backend (and renamed the field to LegacyMigrationPrefs). Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Brad Fitzpatrick	b9dd3fa534	paths, version/distro: detect Synology DSM version better, use for socket path ... Resolves a TODO in the code noted while discussing QNAP defaults. Tested on DSM6 and DSM7. Change-Id: Icce03ff41fafd7b3a358cfee16f2ed13d5cc3c5d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Mihai Parparita	5b8323509f	cmd/tailscale/cli: use "account" instead of "profile" in user-visible text ... Matches the UI clients Updates #713 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Anton Tolchanov	d6dbefaa91	api.md: lowercase ACL field names ... Making this match https://tailscale.com/kb/1018/acls Signed-off-by: Anton Tolchanov <anton@tailscale.com>	1 year ago