tailscale

Commit Graph

Author	SHA1	Message	Date
Mihai Parparita	79f3a5d753	net/netns, net/interfaces: explicitly bind sockets to the default interface on all Darwin variants We were previously only doing this for tailscaled-on-Darwin, but it also appears to help on iOS. Otherwise, when we rebind magicsock UDP connections after a cellular -> WiFi interface change they still keep using cellular one. To do this correctly when using exit nodes, we need to exclude the Tailscale interface when getting the default route, otherwise packets cannot leave the tunnel. There are native macOS/iOS APIs that we can use to do this, so we allow those clients to override the implementation of DefaultRouteInterfaceIndex. Updates #6565, may also help with #5156 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	cb525a1aad	cmd/tailscaled: fix typo in netstack variable name Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Julia Stein	3f16dec1bb	api.md: change "admin panel" to "admin console" Signed-off-by: Julia Stein <julia@tailscale.com>	2 years ago
Tom DNetto	9c773af04c	ipn/ipnlocal: fix use of stale profile while processing netmap Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Denton Gentry	c933b8882c	VERSION.txt: this is v1.35.0 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Brad Fitzpatrick	964d723aba	ipn/{ipnserver,localapi}: fix InUseOtherUser handling with WatchIPNBus Updates tailscale/corp#8222 Change-Id: I2d6fa6514c7b8d0f89fded35a2d44e7df27e6fb1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	86b6ff61e6	ipn/ipnlocal: fix Prefs access without mu being held Noticed while working on a different fix. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	cdb924f87b	ipn/ipnlocal: sanitize prefs in more notify code paths Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Denton Gentry	7c4d017636	paths: set QNAP socket to /tmp. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Brad Fitzpatrick	57124e2126	ipn/localapi: add debug (root-required) access to inject debug Notify For testing of Windows GUI client. Updates #6480 Change-Id: I42f7526d95723e14bed7085fb759e371b43aa9da Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	96cad35870	cmd/tailscaled: rename variables to be more descriptive renamed from `useNetstack` to `onlyNetstack` which is 1 letter more but more descriptive because we always have netstack enabled and `useNetstack` doesn't convey what it is supposed to be used for. e.g. we always use netstack for Tailscale SSH. Also renamed shouldWrapNetstack to handleSubnetsInNetstack as it was only used to configure subnet routing via netstack. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	a87e0b4ea8	ipn: update comments that refer to Options.Prefs Things are slightly less tangled now that we've migrated prefs to the backend (and renamed the field to LegacyMigrationPrefs). Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	b9dd3fa534	paths, version/distro: detect Synology DSM version better, use for socket path Resolves a TODO in the code noted while discussing QNAP defaults. Tested on DSM6 and DSM7. Change-Id: Icce03ff41fafd7b3a358cfee16f2ed13d5cc3c5d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	5b8323509f	cmd/tailscale/cli: use "account" instead of "profile" in user-visible text Matches the UI clients Updates #713 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Anton Tolchanov	d6dbefaa91	api.md: lowercase ACL field names Making this match https://tailscale.com/kb/1018/acls Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Anton Tolchanov	71c0e8d428	api.md: update documentation for the "set ACL" endpoint This documents the `If-Match: ts-default` header that can be set to only overwrite the default ACL contents, and also briefly mentions a few of the new top-level ACL fields. Updates tailscale/terraform-provider-tailscale#182 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Brad Fitzpatrick	e1d7d072a3	ipn/ipnlocal: set Notify.Version on initial Notifies Missed when added recently in `8dd1418774` Change-Id: Id682640a54c3717afe084edaf69258ad23031b6c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maya Kaczorowski	d5b4d2e276	cmd/tailscale/cli: improve tailnet lock help (#6583 ) Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com> Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com>	2 years ago
Walter Poupore	74b47eaad6	cmd/tailscale/cli: Fix 'tailscale switch' error message (#6585 ) Updates #713. Signed-off-by: Walter Poupore <walterp@tailscale.com> Signed-off-by: Walter Poupore <walterp@tailscale.com>	2 years ago
Maisem Ali	99aa335923	net/dns: [linux] log and add metric for dnsMode I couldn't find any logs that indicated which mode it was running in so adding that. Also added a gauge metric for dnsMode. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	a5a3188b7e	cmd/tailscale/cli: unhide login and switch subcommands Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maya Kaczorowski	a1084047ce	cmd/tailscale/cli: capitalize Get (#6586 ) Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com> Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com>	2 years ago
Tom DNetto	74c1f632f6	types/key,cmd/tailscale/cli: support tlpub prefix for tailnet-lock keys Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	8dd1418774	ipn{,/ipnlocal}: add ipn.NotifyInitial* flags to WatchIPNBus To simplify clients getting the initial state when they subscribe. Change-Id: I2490a5ab2411253717c74265a46a98012b80db82 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	197a4f1ae8	types/ptr: move all the ptrTo funcs to one new package's ptr.To Change-Id: Ia0b820ffe7aa72897515f19bd415204b6fe743c7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a277eb4dcf	ipn/ipnlocal: add missing context cancel If user's fn returned false and never canceled their ctx, we never stopped the NotifyWatchEngineUpdates goroutine. This was introduced recently (this cycle). Change-Id: I3453966ac71e00727296ddd237ef845782f4e52e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	978d6af91a	ipn/ipnlocal: tweak error handling in interfaces PeerAPI debug endpoint We were writing the error when getting the default interface before setting the content type, so we'd get HTML treated as plain text. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	5bdca747b7	ipn/ipnlocal: fix netstack peerapi crash over IPv6 The peerapi IPv6 listener has a nil listener. But we didn't need the listener's address anyway, so don't try to use it. Change-Id: I8e8a1a895046d129a3683973e732d9bed82f3b02 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	f1ab11e961	ipn/ipnlocal,tailcfg: introduce capability to gate TKA init paths Previously, `TAILSCALE_USE_WIP_CODE` was needed to hit a bunch of the TKA paths. With this change: - Enablement codepaths (NetworkLockInit) and initialization codepaths (tkaBootstrapFromGenesisLocked via tkaSyncIfNeeded) require either the WIP envknob or CapabilityTailnetLockAlpha. - Normal operation codepaths (tkaSyncIfNeeded, tkaFilterNetmapLocked) require TKA to be initialized, or either-or the envknob / capability. - Auxillary commands (ie: changing tka keys) require TKA to be initialized. The end result is that it shouldn't be possible to initialize TKA (or subsequently use any of its features) without being sent the capability or setting the envknob on tailscaled yourself. I've also pulled out a bunch of unnecessary checks for CanSupportNetworkLock(). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	9a80b8fb10	cmd/tailscale,ipn: surface TKA-filtered peers in lock status command Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	731be07777	cmd/tailscale/cli: show rotation key when suggesting lock sign command Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	a6dff4fb74	docs/webhooks: use subtle.ConstantTimeCompare for comparing signatures Fixes #6572 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I58610c46e0ea1d3a878f91d154db3da4de9cae00	2 years ago
Brad Fitzpatrick	74744b0a4c	ipn: be more consistent with omitempty on debug/rare Prefs Change-Id: Ib0ec72f243cdb2aca8dd392644d4eed33c3f92e6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f710d1cb20	cmd/tailscale/cli: add set --unattended on Windows Fixes #6567 Change-Id: I8cb57196c601466401f8602eb50456e7cf7c31ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
License Updater	d2a51f03ce	licenses: update win/apple licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Denton Gentry	a200a23f97	Revert "cmd/tailscale: access QNAP via localhost" When running `tailscale web` as a standalone process, it was necessary to send auth requests to QTS using localhost to avoid hitting the proxy recursively. However running `tailscale web` as a process means it is consuming RAM all the time even when it isn't actively doing anything. After switching back to the `tailscale web` CGI mode, we don't need to specifically use localhost for QNAP auth. This reverts commit `e0cadc5496`. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Maisem Ali	82ad585b5b	ipn/ipnlocal: account for ControlURL when merging profiles We merge/dedupe profiles based on UserID and NodeID, however we were not accounting for ControlURLs. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	adc302f428	all: use named pipes on windows Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	45042a76cd	cmd/tailscale,ipn: store disallowed TKA's in prefs, lock local-disable Take 2 of https://github.com/tailscale/tailscale/pull/6546 Builds on https://github.com/tailscale/tailscale/pull/6560 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	c4980f33f7	ipn,types/persist: add DisallowedTKAStateIDs, refactor as view type Supercedes https://github.com/tailscale/tailscale/pull/6557, precursor to trying https://github.com/tailscale/tailscale/pull/6546 again Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	6d012547b6	ipn/ipnlocal: use double dash flag style The Go style weirds people out so we try to stick to the more well-known double hyphen style in docs. Change-Id: Iad6db5c82cda37f6b7687eed7ecd9276f8fd94d6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	390d1bb871	Revert "ipn,types/persist: store disallowed TKA's in prefs, lock local-disable" This reverts commit `f1130421f0`. It was submitted with failing tests (go generate checks) Requires a lot of API changes to fix so rolling back instead of forward. Change-Id: I024e8885c0ed44675d3028a662f386dda811f2ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	f1130421f0	ipn,types/persist: store disallowed TKA's in prefs, lock local-disable Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Aaron Klotz	659e7837c6	health, ipn/ipnlocal: when -no-logs-no-support is enabled, deny access to tailnets that have network logging enabled We want users to have the freedom to start tailscaled with `-no-logs-no-support`, but that is obviously in direct conflict with tailnets that have network logging enabled. When we detect that condition, we record the issue in health, notify the client, set WantRunning=false, and bail. We clear the item in health when a profile switch occurs, since it is a per-tailnet condition that should not propagate across profiles. Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Maisem Ali	ad41cbd9d5	ipn/ipnlocal: sanitize prefs before sending over IPN Bus Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	0a10a5632b	cmd/tailscaled: add TS_DEBUG_BACKEND_DELAY_SEC for testing async startup This adds an envknob to make testing async startup more reproducible. We want the Windows GUI to behave well when wintun is not (or it's doing its initial slow driver installation), but during testing it's often too fast to see that it's working. This lets it be slowed down. Updates #6522 Change-Id: I6ae19f46e270ea679cbaea32a53888efcf2943a7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	256ba62e00	README.md: add commit message style bit Change-Id: I0c9423b76f773e20f0216d826620e169f82ee37c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	0cb2ccce7f	safesocket: remove the IPN protocol support Updates #6417 Change-Id: I78908633de842d83b2cc8b10a864a0f88ab1b113 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	06c4c47d46	ipn: remove unused Backend interface Only the macOS/iOS clients care about it still, so we'll move it to their repo. But keep a test that makes sure that LocalBackend continues to implement it so we get an early warning sign before we break macOS/iOS. Change-Id: I56392b740fe55b4d28468b77124c821b5c46c22b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	2e5d08ec4f	net/connstats: invert network logging data flow (#6272 ) Previously, tstun.Wrapper and magicsock.Conn managed their own statistics data structure and relied on an external call to Extract to extract (and reset) the statistics. This makes it difficult to ensure a maximum size on the statistics as the caller has no introspection into whether the number of unique connections is getting too large. Invert the control flow such that a connstats.Statistics is registered with tstun.Wrapper and magicsock.Conn. Methods on non-nil connstats.Statistics are called for every packet. This allows the implementation of connstats.Statistics (in the future) to better control when it needs to flush to ensure bounds on maximum sizes. The value registered into tstun.Wrapper and magicsock.Conn could be an interface, but that has two performance detriments: 1. Method calls on interface values are more expensive since they must go through a virtual method dispatch. 2. The implementation would need a sync.Mutex to protect the statistics value instead of using an atomic.Pointer. Given that methods on constats.Statistics are called for every packet, we want reduce the CPU cost on this hot path. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago

1 2 3 4 5 ...

5089 Commits (3599364312fafbcd8bbb391e338a28e4f218d83b) All Branches Search

5089 Commits (3599364312fafbcd8bbb391e338a28e4f218d83b)

All Branches