7693 Commits (3672f66c74477c27ec4f100e70b4a10ababc7bac)

 

All Branches   

Search

Author	SHA1	Message	Date
Nick Khyl	3672f66c74	tailcfg: bump capver for NodeAttrDisableSplitDNSWhenNoCustomResolvers ... Missed in b65221999c. Updates tailscale/corp#15802 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Andrew Dunham	93cd2ab224	util/singleflight: add DoChanContext ... This is a variant of DoChan that supports context propagation, such that the context provided to the inner function will only be canceled when there are no more waiters for a given key. This can be used to deduplicate expensive and cancelable calls among multiple callers safely. Updates #11935 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ibe1fb67442a854babbc6924fd8437b02cc9e7bcf	5 months ago
Irbe Krumina	bc53ebd4a0	ipn/{ipnlocal,localapi},net/netkernelconf,client/tailscale,cmd/containerboot: optionally enable UDP GRO forwarding for containers (#12410) ... Add a new TS_EXPERIMENTAL_ENABLE_FORWARDING_OPTIMIZATIONS env var that can be set for tailscale/tailscale container running as a subnet router or exit node to enable UDP GRO forwarding for improved performance. See https://tailscale.com/kb/1320/performance-best-practices#linux-optimizations-for-subnet-routers-and-exit-nodes This is currently considered an experimental approach; the configuration support is partially to allow further experimentation with containerized environments to evaluate the performance improvements. Updates tailscale/tailscale#12295 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Irbe Krumina	6f2bae019f	cmd/k8s-nameserver: fix AAAA record query response (#12412) ... Return empty response and NOERROR for AAAA record queries for DNS names for which we have an A record. This is to allow for callers that might be first sending an AAAA query and then, if that does not return a response, follow with an A record query. Previously we were returning NOTIMPL that caused some callers to potentially not follow with an A record query or misbehave in different ways. Also return NXDOMAIN for AAAA record queries for names that we DO NOT have an A record for to ensure that the callers do not follow up with an A record query. Returning an empty response and NOERROR is the behaviour that RFC 4074 recommends: https://datatracker.ietf.org/doc/html/rfc4074 Updates tailscale/tailscale#12321 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Aaron Klotz	df86576989	util/winutil: add AllocateContiguousBuffer and SetNTString helper funcs ... AllocateContiguousBuffer is for allocating structs with trailing buffers containing additional data. It is to be used for various Windows structures containing pointers to data located immediately after the struct. SetNTString performs in-place setting of windows.NTString and windows.NTUnicodeString. Updates #12383 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Irbe Krumina	c3e2b7347b	tailcfg,cmd/k8s-operator,kube: move Kubernetes cap to a location that can be shared with control (#12236) ... This PR is in prep of adding logic to control to be able to parse tailscale.com/cap/kubernetes grants in control: - moves the type definition of PeerCapabilityKubernetes cap to a location shared with control. - update the Kubernetes cap rule definition with fields for granting kubectl exec session recording capabilities. - adds a convenience function to produce tailcfg.RawMessage from an arbitrary cap rule and a test for it. An example grant defined via ACLs: "grants": [{ "src": ["tag:eng"], "dst": ["tag:k8s-operator"], "app": { "tailscale.com/cap/kubernetes": [{ "recorder": ["tag:my-recorder"] “enforceRecorder”: true }], }, } ] This grant enforces `kubectl exec` sessions from tailnet clients, matching `tag:eng` via API server proxy matching `tag:k8s-operator` to be recorded and recording to be sent to a tsrecorder instance, matching `tag:my-recorder`. The type needs to be shared with control because we want control to parse this cap and resolve tags to peer IPs. Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Fran Bull	ba46495e11	appc: log how many routes are being written ... So that we can debug customer problems more easily. Updates #11008 Signed-off-by: Fran Bull <fran@tailscale.com>	6 months ago
Irbe Krumina	807934f00c	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388) ... Add a new .spec.tailscale.acceptRoutes field to ProxyClass, that can be optionally set to true for the proxies to accept routes advertized by other nodes on tailnet (equivalent of setting --accept-routes to true). Updates tailscale/tailscale#12322,tailscale/tailscale#10684 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Irbe Krumina	53d9cac196	k8s-operator/apis/v1alpha1,cmd/k8s-operator/deploy/examples: update DNSConfig description (#11971) ... Also removes hardcoded image repo/tag from example DNSConfig resource as the operator now knows how to default those. Updates tailscale/tailscale#11019 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Tom Proctor	23e26e589f	cmd/k8s-operator,k8s-opeerator: include Connector's MagicDNS name and tailnet IPs in status (#12359) ... Add new fields TailnetIPs and Hostname to Connector Status. These contain the addresses of the Tailscale node that the operator created for the Connector to aid debugging. Fixes #12214 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	6 months ago
Irbe Krumina	3a6d3f1a5b	cmd/k8s-operator,k8s-operator,go.{mod,sum}: make individual proxy images/image pull policies configurable (#11928) ... cmd/k8s-operator,k8s-operator,go.{mod,sum}: make individual proxy images/image pull policies configurable Allow to configure images and image pull policies for individual proxies via ProxyClass.Spec.StatefulSet.Pod.{TailscaleContainer,TailscaleInitContainer}.Image, and ProxyClass.Spec.StatefulSet.Pod.{TailscaleContainer,TailscaleInitContainer}.ImagePullPolicy fields. Document that we have images in ghcr.io on the relevant Helm chart fields. Updates tailscale/tailscale#11675 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Brad Fitzpatrick	916c4db75b	net/dns: fix crash in tests ... Looks like #12346 as submitted with failing tests. Updates #12346 Change-Id: I582cd0dfb117686330d935d763d972373c5ae598 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Adrian Dewhurst	0219317372	ipn/ipnlocal: improve sticky last suggestion ... The last suggested exit node needs to be incorporated in the decision making process when a new suggestion is requested, but currently it is not quite right: it'll be used if the suggestion code has an error or a netmap is unavailable, but it won't be used otherwise. Instead, this makes the last suggestion into a tiebreaker when making a random selection between equally-good options. If the last suggestion does not make it to the final selection pool, then a different suggestion will be made. Since LocalBackend.SuggestExitNode is back to being a thin shim that sets up the parameters to suggestExitNode, it no longer needs a test. Its test was unable to be comprehensive anyway as the code being tested contains an uncontrolled random number generator. Updates tailscale/corp#19681 Change-Id: I94ecc9a0d1b622de3df4ef90523f1d3e67b4bfba Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	6 months ago
Andrew Lytvynov	7a7e314096	ipn/ipnlocal,clientupdate: allow auto-updates in contaienrs (#12391) ... We assume most containers are immutable and don't expect tailscale running in them to auto-update. But there's no reason to prohibit it outright. Ignore the tailnet-wide default auto-update setting in containers, but allow local users to turn on auto-updates via the CLI. RELNOTE=Auto-updates are allowed in containers, but ignore the tailnet-wide default. Fixes #12292 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	6 months ago
Andrea Gottardo	b65221999c	tailcfg,net/dns: add controlknob to disable battery split DNS on iOS (#12346) ... Updates corp#15802. Adds the ability for control to disable the recently added change that uses split DNS in more cases on iOS. This will allow us to disable the feature if it leads to regression in production. We plan to remove this knob once we've verified that the feature works properly. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	6 months ago
Andrew Dunham	e88a5dbc92	various: fix lint warnings ... Some lint warnings caught by running 'make lint' locally. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1534ed6f2f5e1eb029658906f9d62607dad98ca3	6 months ago
Aaron Klotz	34e8820301	util/winutil: add conpty package and helper for building windows.StartupInfoEx ... StartupInfoBuilder is a helper for constructing StartupInfoEx structures featuring proc/thread attribute lists. Calling its setters triggers the appropriate setting of fields, adjusting flags as necessary, and populating the proc/thread attribute list as necessary. Currently it supports four features: setting std handles, setting pseudo-consoles, specifying handles for inheritance, and specifying jobs. The conpty package simplifies creation of pseudo-consoles, their associated pipes, and assignment of the pty to StartupInfoEx proc/thread attributes. Updates #12383 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	6 months ago
Brad Fitzpatrick	8a11a43c28	cmd/derpprobe: support 'local' derpmap to get derp map via LocalAPI ... To make it easier for people to monitor their custom DERP fleet. Updates tailscale/corp#20654 Change-Id: Id8af22936a6d893cc7b6186d298ab794a2672524 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Jordan Whited	6e106712f6	cmd/stunstamp: support probing multiple ports (#12356) ... Updates tailscale/corp#20344 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Brad Fitzpatrick	1ca323ac65	net/netcheck: fix probeProto.String result for IPv6 probes ... This bug was introduced in e6b84f215 (May 2020) but was only used in tests when stringifying probeProto values on failure so it wasn't noticed for a long time. But then it was moved into non-test code in 8450a18aa (Jun 2024) and I didn't notice during the code movement that it was wrong. It's still only used in failure paths in logs, but having wrong/ambiguous debugging information isn't the best. Whoops. Updates tailscale/corp#20654 Change-Id: I296c727ed1c292a04db7b46ecc05c07fc1abc774 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Brad Fitzpatrick	8450a18aa9	net/netcheck: flesh out some logging in error paths ... Updates tailscale/corp#20654 Change-Id: Ie190f956b864985668f79b5b986438bbe07ce905	6 months ago
Kristoffer Dalby	95f266f1ce	tsweb: add optional on completion callback func ... Updates corp#17075 Co-Authored-By: Anton Tolchanov <anton@tailscale.com> Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	6 months ago
Andrew Lytvynov	b8cf852881	go.toolchain.rev: update to go 1.22.4 (#12365) ... Updates https://github.com/tailscale/corp/issues/20635 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	6 months ago
Maisem Ali	36e8e8cd64	wgengine/magicsock: use math/rands/v2 ... Updates #11058 Co-authored-by: James Tucker <james@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Fran Bull	573c8bd8c7	cmd/natc: add --wg-port flag ... Updates tailscale/corp#20503 Signed-off-by: Fran Bull <fran@tailscale.com>	6 months ago
Maisem Ali	4a8cb1d9f3	all: use math/rand/v2 more ... Updates #11058 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Fran Bull	d2d459d442	cmd/natc: add --ignore-destinations flag ... Updates tailscale/corp#20503 Signed-off-by: Fran Bull <fran@tailscale.com>	6 months ago
Jun	9cdb33e2a4	tsnet: add a new error when HTTPS enabled but MagicDNC Disabled (#12364) ... Fixes tailscale#12303 Signed-off-by: Jun <johnnycocoyan@hotmail.com>	6 months ago
Jordan Whited	cf1e6c6e55	cmd/stunstamp: fix remote write retry (#12348) ... Evaluation of remote write errors was using errors.Is() where it should have been using errors.As(). Updates tailscale/corp#20344 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Brad Fitzpatrick	6d3c10579e	gokrazy: update breakglass with now-upstreamed ec2 change ... This updates breakglass to use the now-upsteamed https://github.com/gokrazy/breakglass/pull/18 change so we're not using our fork now. It also adds a gok wrapper tool, because doing it by hand was tedious. Updates #1866 Change-Id: Ifacbf5fbf0e377b3bd95c5f76c18751c2e1af7d7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Andrew Lytvynov	347e3f3d9a	go.mod,ipn/ipnlocal: update the ACME fork (#12343) ... Update our fork of golang.org/x/crypto to pick up a fix for ACME ARI: 3fde5e568a Fixes #12278 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	6 months ago
Irbe Krumina	82576190a7	tailcfg,cmd/k8s-operator: moves tailscale.com/cap/kubernetes peer cap to tailcfg (#12235) ... This is done in preparation for adding kubectl session recording rules to this capability grant that will need to be unmarshalled by control, so will also need to be in a shared location. Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Andrea Gottardo	d636407f14	net/dns: don't set MatchDomains on Apple platforms when no upstream nameservers available (#12334) ... This PR addresses a DNS issue on macOS as discussed this morning. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	6 months ago
Adrian Dewhurst	cf9f507d47	ipn/ipnlocal: only build allowed suggested node list once ... Rather than building a new suggested exit node set every time, compute it once on first use. Currently, syspolicy ensures that values do not change without a restart anyway. Since the set is being constructed in a separate func now, the test code that manipulates syspolicy can live there, and the TestSuggestExitNode can now run in parallel with other tests because it does not have global dependencies. Updates tailscale/corp#19681 Change-Id: Ic4bb40ccc91b671f9e542bd5ba9c96f942081515 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	6 months ago
signed-long	1dc3136a24	cmd/k8s-operator: Support image 'repo' or 'repository' keys in helm values file (#12285) ... cmd/k8s-operator/deploy/chart: Support image 'repo' or 'repository' keys in helm values Fixes #12100 Signed-off-by: Michael Long <michaelongdev@gmail.com>	6 months ago
Andrew Lytvynov	379e2bf189	ipn/ipnlocal: stop offline auto-updates on shutdown (#12342) ... Clean up the updater goroutine on shutdown, in addition to doing that on backend state change. This fixes a goroutine leak on shutdown in tests. Updates #cleanup	6 months ago
Jordan Whited	ba0dd493c8	cmd/stunstamp: validate STUN tx ID in responses (#12339) ... Extremely late arriving responses may leak across probing intervals. Updates tailscale/corp#20344 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Andrew Lytvynov	bc4c8b65c7	ipn/ipnlocal: periodically run auto-updates when "offline" (#12118) ... When the client is disconnected from control for any reason (typically just turned off), we should still attempt to update if auto-updates are enabled. This may help users who turn tailscale on infrequently for accessing resources. RELNOTE: Apply auto-updates even if the node is down or disconnected from the coordination server. Updates #12117 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	6 months ago
Maisem Ali	2f2f588c80	cmd/natc: use ListenPacket ... Now that tsnet supports it, use it. Updates tailscale/corp#20503 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Brad Fitzpatrick	e84751217a	gokrazy: add prototype Tailscale appliance, build tooling, docs ... Updates #1866 Change-Id: I546316cb833bf2919e0d6f55cdc9951f375f165b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Maisem Ali	0b1a8586eb	cmd/natc: initial implementation of a NAT based connector ... This adds a new prototype `cmd/natc` which can be used to expose a services/domains to the tailnet. It requires the user to specify a set of IPv4 prefixes from the CGNAT range. It advertises these as normal subnet routes. It listens for DNS on the first IP of the first range provided to it. When it gets a DNS query it allocates an IP for that domain from the v4 range. Subsequent connections to the assigned IP are then tcp proxied to the domain. It is marked as a WIP prototype and requires the use of the `TAILSCALE_USE_WIP_CODE` env var. Updates tailscale/corp#20503 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Maisem Ali	7b193de6b9	tsnet: return net.Listener from s.listen ... A `*listener` implements net.Listener which breaks a test in another repo. Regressed in 42cfbf427c. Updates #12182 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Adrian Dewhurst	3bf2bddbb5	ipn/ipnlocal: improve testability of random node selection ... In order to test the sticky last suggestion code, a test was written for LocalBackend.SuggestExitNode but it contains a random number generator which makes writing comprehensive tests very difficult. This doesn't change how the last suggestion works, but it adds some infrastructure to make that easier in a later PR. This adds func parameters for the two randomized parts: breaking ties between DERP regions and breaking ties between nodes. This way tests can validate the entire list of tied options, rather than expecting a particular outcome given a particular random seed. As a result of this, the global random number generator can be used rather than seeding a local one each time. In order to see the tied nodes for the location based (i.e. Mullvad) case, pickWeighted needed to return a slice instead of a single arbitrary option, so there is a small change in how that works. Updates tailscale/corp#19681 Change-Id: I83c48a752abdec0f59c58ccfd8bfb3f3f17d0ea8 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	6 months ago
Jordan Whited	d21c00205d	cmd/stunstamp: implement service to measure DERP STUN RTT (#12241) ... stunstamp timestamping includes userspace and SO_TIMESTAMPING kernel timestamping where available. Measurements are written locally to a sqlite DB, exposed over an HTTP API, and written to prometheus via remote-write protocol. Updates tailscale/corp#20344 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
License Updater	1fad06429e	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	6 months ago
Fran Bull	e06862b8d8	appc: log how often routeInfo is stored ... So that we have some debugging info if users have trouble with storing the routeInfo. Updates #11008 Signed-off-by: Fran Bull <fran@tailscale.com>	6 months ago
Adrian Dewhurst	db6447ce63	ipn/ipnlocal: simplify suggest exit node tests ... This mostly removes a lot of repetition by predefining some nodes and other data structures, plus adds some helpers for creating Peer entries in the netmap. Several existing test cases were reworked to ensure better coverage of edge cases, and several new test cases were added to handle some additional responsibility that is in (or will be shortly moving in) suggestExitNode(). Updates tailscale/corp#19681 Change-Id: Ie14c2988d7fd482f7d6a877f78525f7788669b85 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	6 months ago
Andrew Dunham	ced9a0d413	net/dns: fix typo in OSConfig logging (#12330) ... Updates tailscale/corp#20530 Change-Id: I48834a0a5944ed35509c63bdd2830aa34e1bddeb Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	6 months ago
Anton Tolchanov	01847e0123	ipn/ipnlocal: discard node keys that have been rotated out ... A non-signing node can be allowed to re-sign its new node keys following key renewal/rotation (e.g. via `tailscale up --force-reauth`). To be able to do this, node's TLK is written into WrappingPubkey field of the initial SigDirect signature, signed by a signing node. The intended use of this field implies that, for each WrappingPubkey, we typically expect to have at most one active node with a signature tracing back to that key. Multiple valid signatures referring to the same WrappingPubkey can occur if a client's state has been cloned, but it's something we explicitly discourage and don't support: https://tailscale.com/s/clone This change propagates rotation details (wrapping public key, a list of previous node keys that have been rotated out) to netmap processing, and adds tracking of obsolete node keys that, when found, will get filtered out. Updates tailscale/corp#19764 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	6 months ago
Maisem Ali	42cfbf427c	tsnet,wgengine/netstack: add ListenPacket and tests ... This adds a new ListenPacket function on tsnet.Server which acts mostly like `net.ListenPacket`. Unlike `Server.Listen`, this requires listening on a specific IP and does not automatically listen on both V4 and V6 addresses of the Server when the IP is unspecified. To test this, it also adds UDP support to tsdial.Dialer.UserDial and plumbs it through the localapi. Then an associated test to make sure the UDP functionality works from both sides. Updates #12182 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago