tailscale

Commit Graph

Author	SHA1	Message	Date
Tom DNetto	c08cf2a9c6	all: declare & plumb IPv6 masquerade address for peer This PR plumbs through awareness of an IPv6 SNAT/masquerade address from the wire protocol through to the low-level (tstun / wgengine). This PR is the first in two PRs for implementing IPv6 NAT support to/from peers. A subsequent PR will implement the data-plane changes to implement IPv6 NAT - this is just plumbing. Signed-off-by: Tom DNetto <tom@tailscale.com> Updates ENG-991	1 year ago
Maisem Ali	19a9d9037f	tailcfg: add NodeCapMap Like PeerCapMap, add a field to `tailcfg.Node` which provides a map of Capability to raw JSON messages which are deferred to be parsed later by the application code which cares about the specific capabilities. This effectively allows us to prototype new behavior without having to commit to a schema in tailcfg, and it also opens up the possibilities to develop custom behavior in tsnet applications w/o having to plumb through application specific data in the MapResponse. Updates #4217 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	a61caea911	tailcfg: define a type for NodeCapability Instead of untyped string, add a type to identify these. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
James Tucker	e7727db553	tailcfg: add DNS address list for IsWireGuardOnly nodes Tailscale exit nodes provide DNS service over the peer API, however IsWireGuardOnly nodes do not have a peer API, and instead need client DNS parameters passed in their node description. For Mullvad nodes this will contain the in network 10.64.0.1 address. Updates #9377 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Maisem Ali	2548496cef	types/views,cmd/viewer: add ByteSlice[T] to replace mem.RO Add a new views.ByteSlice[T ~[]byte] to provide a better API to use with views. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	d483ed7774	tailcfg: generate RegisterResponse.Clone, remove manually written It had a custom Clone func with a TODO to replace with cloner, resolve that todo. Had to pull out the embedded Auth struct into a named struct. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	02b47d123f	tailcfg: remove unused Domain field from Login/User Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	6e57dee7eb	cmd/viewer, types/views, all: un-special case slice of netip.Prefix Make it just a views.Slice[netip.Prefix] instead of its own named type. Having the special case led to circular dependencies in another WIP PR of mine. Updates #8948 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	b090d61c0f	tailcfg: rename prototype field to reflect its status (Added earlier today in #8916, `57da1f150`) Updates tailscale/corp#13969 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Richard Castro	57da1f1501	client: update DNSConfig type (#8916 ) This PR adds DNSFilterURL to the DNSConfig type to be used by control changes to add DNS filtering logic Fixes #cleanup Signed-off-by: Richard Castro <richard@tailscale.com>	1 year ago
KevinLiang10	7ed3681cbe	tailcfg: Add FirewallMode to NetInfo to record wether host using iptables or nftables To record wether user is using iptables or nftables after we add support to nftables on linux, we are adding a field FirewallMode to NetInfo in HostInfo to reflect what firewall mode the host is running, and form metrics. The information is gained from a global constant in hostinfo.go. We set it when selection heuristic made the decision, and magicsock reports this to control. Updates: tailscale/corp#13943 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	1 year ago
Brad Fitzpatrick	f1cc8ab3f9	tailcfg: add UserProfile.Groups Updates tailscale/corp#13375 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Andrew Dunham	7aba0b0d78	net/netcheck, tailcfg: add DERPHomeParams and use it This allows providing additional information to the client about how to select a home DERP region, such as preferring a given DERP region over all others. Updates #8603 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I7c4a270f31d8585112fab5408799ffba5b75266f	1 year ago
Brad Fitzpatrick	7b1c3dfd28	tailcfg,etc: remove unused tailcfg.Node.KeepAlive field The server hasn't sent it in ages. Updates #cleanup Change-Id: I9695ab0f074ec6fb006e11faf3cdfc5ca049fbf8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Charlotte Brandhorst-Satzkorn	3417ddc00c	tailcfg: add location field to hostinfo This change adds Location field to HostInfo. Location contains the option for a Country, CountryCode, City, CityCode and a Priority. Neither of these fields are populated by default. The Priority field is used to determine the priority an exit node should be given for use, if the field is set. The higher the value set, the higher priority the node should be given for use. Updates tailscale/corp#12146 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	1 year ago
Maisem Ali	2e0aa151c9	ssh/tailssh: add support for remote/reverse port forwarding This basically allows running services on the SSH client and reaching them from the SSH server during the session. Updates #6575 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	f66ddb544c	tailcfg: add SSHRecorderFailureAction and SSHRecordingFailureNotifyRequest This allows control to specify how to handle situations where the recorder isn't available. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	6f521c138d	tailcfg: add CanPort80 field to DERPNode A follow-up PR will start using this field after we set it in our production DERPMap. Updates #7925 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Idb41b79e6055dddb8944f79d91ad4a186ace98c7	2 years ago
Maisem Ali	64bbf1738e	tailcfg: make SelfNodeV4MasqAddrForThisPeer a pointer This makes `omitempty` actually work, and saves bytes in each map response. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Charlotte Brandhorst-Satzkorn	c573bef0aa	tailcfg,wgengine: add initial support for WireGuard only peers A peer can have IsWireGuardOnly, which means it will not support DERP or Disco, and it must have Endpoints filled in order to be usable. In the present implementation only the first Endpoint will be used as the bestAddr. Updates tailscale/corp#10351 Co-authored-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com> Co-authored-by: James Tucker <james@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Maisem Ali	f61b306133	tailcfg: add Node.SelfNodeV4MasqAddrForThisPeer This only adds the field, to be used in a future commit. Updates tailscale/corp#8020 Co-authored-by: Melanie Warrick <warrick@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Charlotte Brandhorst-Satzkorn	1b78dc1f33	tailcfg: move recorders field from SSHRule to SSHAction Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	2 years ago
Charlotte Brandhorst-Satzkorn	3efd83555f	tailcfg: add recorders field to SSHRule struct This change introduces the Recorders field to the SSHRule struct. The field is used to store and define addresses where the ssh recorder is located. Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	2 years ago
Maisem Ali	49c206fe1e	tailcfg,hostinfo: add App field to identify tsnet uses This allows us to differentiate between the various tsnet apps that we have like `golinks` and `k8s-operator`. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
David Crawshaw	8cf2805cca	tailcfg, localapi: plumb device token to server Updates tailscale/corp#8940 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Will Norris	71029cea2d	all: update copyright and license headers This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Brad Fitzpatrick	b6aa1c1f22	envknob, hostinfo, ipn/ipnlocal: add start of opt-in remote update support Updates #6907 Change-Id: I85db4f6f831dd5ff7a9ef4bfa25902607e0c1558 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	64547b2b86	tailcfg,hostinfo: add Hostinfo.Machine and Hostinfo.GoArchVar For detecting a non-ideal binary running on the current CPU. And for helping detect the best Synology package to update to. Updates #6995 Change-Id: I722f806675b60ce95364471b11c388150c0d4aea Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6edf357b96	all: start groundwork for using capver for localapi & peerapi Updates #7015 Change-Id: I3d4c11b42a727a62eaac3262a879f29bb4ce82dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	1e67947cfa	control/controlclient, tailcfg: add Node.Expired field, set for expired nodes Nodes that are expired, taking into account the time delta calculated from MapResponse.ControlTime have the newly-added Expired boolean set. For additional defense-in-depth, also replicate what control does and clear the Endpoints and DERP fields, and additionally set the node key to a bogus value. Updates #6932 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia2bd6b56064416feee28aef5699ca7090940662a	2 years ago
Brad Fitzpatrick	b08f37d069	tailcfg: add Hostinfo.WireIngress bool Yet unused. Future optimization for control. Updates tailscale/corp#7515 Change-Id: Icd755aa8b1d6ca61d16dfc124c28c9c56ebdfee5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	e55ae53169	tailcfg: add Node.UnsignedPeerAPIOnly to let server mark node as peerapi-only capver 48 Change-Id: I20b2fa81d61ef8cc8a84e5f2afeefb68832bd904 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ea24895e08	client/tailscale/apitype, tailcfg: delete never used mysterious PerDomain field It does nothing and never did and I don't think anybody remembers what the original goal for it was. Updates #5229 (fixes, but need to clean it up in another repo too) Change-Id: I81cc6ff44d6d2888bc43e9145437f4c407907ea6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	227777154a	control/controlclient,ipn/ipnlocal,tailcfg: rotate node-key signature on register CAPVER 47 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Kristoffer Dalby	01ebef0f4f	tailcfg: add views for ControlDialPlan (#5843 )	2 years ago
Aaron Klotz	acc7baac6d	tailcfg, util/deephash: add DataPlaneAuditLogID to Node and DomainDataPlaneAuditLogID to MapResponse We're adding two log IDs to facilitate data-plane audit logging: a node-specific log ID, and a domain-specific log ID. Updated util/deephash/deephash_test.go with revised expectations for tailcfg.Node. Updates https://github.com/tailscale/corp/issues/6991 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Brad Fitzpatrick	45a3de14a6	cmd/tailscaled, tailcfg, hostinfo: add flag to disable logging + support As noted in #5617, our documented method of blocking log.tailscale.io DNS no longer works due to bootstrap DNS. Instead, provide an explicit flag (--no-logs-no-support) and/or env variable (TS_NO_LOGS_NO_SUPPORT=true) to explicitly disable logcatcher uploads. It also sets a bit on Hostinfo to say that the node is in that mode so we can end any support tickets from such nodes more quickly. This does not yet provide an easy mechanism for users on some platforms (such as Windows, macOS, Synology) to set flags/env. On Linux you'd used /etc/default/tailscaled typically. Making it easier to set flags for other platforms is tracked in #5114. Fixes #5617 Fixes tailscale/corp#1475 Change-Id: I72404e1789f9e56ec47f9b7021b44c025f7a373a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	d5e7e3093d	hostinfo, tailcfg: split Hostinfo.OSVersion into separate fields Stop jamming everything into one string. Fixes #5578 Change-Id: I7dec8d6c073bddc7dc5f653e3baf2b4bf6b68378 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	761163815c	tailcfg: add Hostinfo.Userspace{,Router} bits Change-Id: Iad47f904872f2df146c1f63945f79cfddeac7fe8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f1c9812188	tailcfg: add Hostinfo.GoVersion So next time something like #5340 happens we can identify all affected nodes and have the control plane send them health warnings. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	18edd79421	control/controlclient,tailcfg: [capver 40] create KeySignature field in tailcfg.Node We calve out a space to put the node-key signature (used on tailnets where network lock is enabled). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	f0d6f173c9	net/netcheck: try ICMP if UDP is blocked (#5056 ) Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Maisem Ali	fa2fbaf3aa	tailcfg: add views for SSHRule and SSHPrincipal Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	7eaf5e509f	net/netaddr: start migrating to net/netip via new netaddr adapter package Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Anderson	c1cb3efbba	net/netcheck: test for OS IPv6 support as well as connectivity. This lets us distinguish "no IPv6 because the device's ISP doesn't offer IPv6" from "IPv6 is unavailable/disabled in the OS". Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Brad Fitzpatrick	6b71568eb7	util/cloudenv: add Azure support & DNS IPs And rewrite cloud detection to try to do only zero or one metadata discovery request for all clouds, only doing a first (or second) as confidence increases. Work remains for Windows, but a start. And add Cloud to tailcfg.Hostinfo, which helped with testing using "tailcfg debug hostinfo". Updates #4983 (Linux only) Updates #4984 Change-Id: Ib03337089122ce0cb38c34f724ba4b4812bc614e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	d04afc697c	cmd/viewer,types/views: add support for views of maps Updates #4635 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	9f3ad40707	tailcfg: use cmd/viewer instead of cmd/cloner. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	679415f3a8	tailcfg: move views into tailcfg_view.go Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago

49 Commits (35ad2aafe3852686e9ecc2a89ade26cefc32f929)