8142 Commits (40825122938085d3a943e3c6212dce0c2b13399a)

 

All Branches   

Search

Author	SHA1	Message	Date
Brad Fitzpatrick	a867a4869d	go.toolchain.rev: bump Go toolchain for net pkg resolv.conf fix ... Updates tailscale/corp#22206 Change-Id: I9d995d408d4be3fd552a0d6e12bf79db8461d802 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Andrew Lytvynov	c0c4791ce7	cmd/gitops-pusher: ignore previous etag if local acls match control (#13068) ... In a situation when manual edits are made on the admin panel, around the GitOps process, the pusher will be stuck if `--fail-on-manual-edits` is set, as expected. To recover from this, there are 2 options: 1. revert the admin panel changes to get back in sync with the code 2. check in the manual edits to code The former will work well, since previous and local ETags will match control ETag again. The latter will still fail, since local and control ETags match, but previous does not. For this situation, check the local ETag against control first and ignore previous when things are already in sync. Updates https://github.com/tailscale/corp/issues/22177 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	3 months ago
Andrew Lytvynov	ad038f4046	cmd/gitops-pusher: add --fail-on-manual-edits flag (#13066) ... For cases where users want to be extra careful about not overwriting manual changes, add a flag to hard-fail. This is only useful if the etag cache is persistent or otherwise reliable. This flag should not be used in ephemeral CI workers that won't persist the cache. Updates https://github.com/tailscale/corp/issues/22177 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	3 months ago
Anton Tolchanov	46db698333	prober: make status page more clear ... Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 months ago
Naman Sood	f79183dac7	cmd/tsidp: add funnel support (#12591) ... * cmd/tsidp: add funnel support Updates #10263. Signed-off-by: Naman Sood <mail@nsood.in> * look past funnel-ingress-node to see who we're authenticating Signed-off-by: Naman Sood <mail@nsood.in> * fix comment typo Signed-off-by: Naman Sood <mail@nsood.in> * address review feedback, support Basic auth for /token Turns out you need to support Basic auth if you do client ID/secret according to OAuth. Signed-off-by: Naman Sood <mail@nsood.in> * fix typos Signed-off-by: Naman Sood <mail@nsood.in> * review fixes Signed-off-by: Naman Sood <mail@nsood.in> * remove debugging log Signed-off-by: Naman Sood <mail@nsood.in> * add comments, fix header Signed-off-by: Naman Sood <mail@nsood.in> --------- Signed-off-by: Naman Sood <mail@nsood.in>	3 months ago
Brad Fitzpatrick	1ed958fe23	tstest/natlab/vnet: add start of virtual network-based NAT Lab ... Updates #13038 Change-Id: I3c74120d73149c1329288621f6474bbbcaa7e1a6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Brad Fitzpatrick	6ca078c46e	cmd/derper: move 204 handler from package main to derphttp ... Updates #13038 Change-Id: I28a8284dbe49371cae0e9098205c7c5f17225b40 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Jordan Whited	a93dc6cdb1	wgengine/magicsock: refactor batchingUDPConn to batchingConn interface (#13042) ... This commit adds a batchingConn interface, and renames batchingUDPConn to linuxBatchingConn. tryUpgradeToBatchingConn() may return a platform- specific implementation of batchingConn. So far only a Linux implementation of this interface exists, but this refactor is being done in anticipation of a Windows implementation. Updates tailscale/corp#21874 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Anton Tolchanov	7bac5dffcb	control/controlhttp: extract the last network connection ... The same context we use for the HTTP request here might be re-used by the dialer, which could result in `GotConn` being called multiple times. We only care about the last one. Fixes #13009 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 months ago
Anton Tolchanov	b3fc345aba	cmd/derpprobe: use a status page from the prober library ... Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 months ago
Anton Tolchanov	9106187a95	prober: support JSON response in RunHandler ... Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 months ago
Anton Tolchanov	9b08399d9e	prober: add a status page handler ... This change adds an HTTP handler with a table showing a list of all probes, their status, and a button that allows triggering a specific probe. Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 months ago
Anton Tolchanov	153a476957	prober: add an HTTP endpoint for triggering a probe ... - Keep track of the last 10 probe results and successful probe latencies; - Add an HTTP handler that triggers a given probe by name and returns it result as a plaintext HTML page, showing recent probe results as a baseline Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 months ago
Anton Tolchanov	227509547f	{control,net}: close idle connections of custom transports ... I noticed a few places with custom http.Transport where we are not closing idle connections when transport is no longer used. Updates tailscale/corp#21609 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 months ago
VimT	e3f047618b	net/socks5: support UDP ... Updates #7581 Signed-off-by: VimT <me@vimt.me>	3 months ago
Kot C	91d2e1772d	words: raccoon dog, dog with the raccoon in 'im ... Signed-off-by: Kot C <kot@yukata.dev>	3 months ago
License Updater	3b6849e362	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	3 months ago
Anton Tolchanov	0fd73746dd	cmd/tailscale/cli: fix `revoke-keys` command name in CLI output ... During review of #8644 the `recover-compromised-key` command was renamed to `revoke-key`, but the old name remained in some messages printed by the command. Fixes tailscale/corp#19446 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 months ago
Jordan Whited	17c88a19be	net/captivedetection: mark TestAllEndpointsAreUpAndReturnExpectedResponse flaky (#13021) ... Updates #13019 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Jordan Whited	25f0a3fc8f	wgengine/netstack: use build tags to exclude gVisor GRO importation on iOS (#13015) ... Updates tailscale/corp#22125 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Maisem Ali	a7a394e7d9	tstest/integration: mark TestNATPing flaky ... Updates #12169 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 months ago
Maisem Ali	07e2487c1d	wgengine/capture: fix v6 field typo in wireshark dissector ... It was using a v4 field for a v6 address. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 months ago
Maisem Ali	1dd9c44d51	tsweb: mark TestStdHandler_ConnectionClosedDuringBody flaky ... Updates #13107 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 months ago
Flakes Updater	0a6eb12f05	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	3 months ago
Maisem Ali	f205efcf18	net/packet/checksum: fix v6 NAT ... We were copying 12 out of the 16 bytes which meant that the 1:1 NAT required would only work if the last 4 bytes happened to match between the new and old address, something that our tests accidentally had. Fix it by copying the full 16 bytes and make the tests also verify the addr and use rand addresses. Updates #9511 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 months ago
Maisem Ali	a917718353	util/linuxfw: return nil interface not concrete type ... It was returning a nil `*iptablesRunner` instead of a nil `NetfilterRunner` interface which would then fail checks later. Fixes #13012 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 months ago
Nick Khyl	4099a36468	util/winutil/gp: fix a busy loop bug ... Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago
Jordan Whited	d9d9d525d9	wgengine/netstack: increase gVisor's TCP send and receive buffer sizes (#12994) ... This commit increases gVisor's TCP max send (4->6MiB) and receive (4->8MiB) buffer sizes on all platforms except iOS. These values are biased towards higher throughput on high bandwidth-delay product paths. The iperf3 results below demonstrate the effect of this commit between two Linux computers with i5-12400 CPUs. 100ms of RTT latency is introduced via Linux's traffic control network emulator queue discipline. The first set of results are from commit f0230ce prior to TCP buffer resizing. gVisor write direction: Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 180 MBytes 151 Mbits/sec 0 sender [ 5] 0.00-10.10 sec 179 MBytes 149 Mbits/sec receiver gVisor read direction: Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.10 sec 337 MBytes 280 Mbits/sec 20 sender [ 5] 0.00-10.00 sec 323 MBytes 271 Mbits/sec receiver The second set of results are from this commit with increased TCP buffer sizes. gVisor write direction: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 297 MBytes 249 Mbits/sec 0 sender [ 5] 0.00-10.10 sec 297 MBytes 247 Mbits/sec receiver gVisor read direction: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.10 sec 501 MBytes 416 Mbits/sec 17 sender [ 5] 0.00-10.00 sec 485 MBytes 407 Mbits/sec receiver Updates #9707 Updates tailscale/corp#22119 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Andrew Dunham	9939374c48	wgengine/magicsock: use cloud metadata to get public IPs ... Updates #12774 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1661b6a2da7966ab667b075894837afd96f4742f	3 months ago
Andrea Gottardo	4055b63b9b	net/captivedetection: exclude cellular data interfaces (#13002) ... Updates tailscale/tailscale#1634 This PR optimizes captive portal detection on Android and iOS by excluding cellular data interfaces (`pdp*` and `rmnet`). As cellular networks do not present captive portals, frequent network switches between Wi-Fi and cellular would otherwise trigger captive detection unnecessarily, causing battery drain. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	3 months ago
Jordan Whited	f0230ce0b5	go.mod,net/tstun,wgengine/netstack: implement gVisor TCP GRO for Linux (#12921) ... This commit implements TCP GRO for packets being written to gVisor on Linux. Windows support will follow later. The wireguard-go dependency is updated in order to make use of newly exported IP checksum functions. gVisor is updated in order to make use of newly exported stack.PacketBuffer GRO logic. TCP throughput towards gVisor, i.e. TUN write direction, is dramatically improved as a result of this commit. Benchmarks show substantial improvement, sometimes as high as 2x. High bandwidth-delay product paths remain receive window limited, bottlenecked by gVisor's default TCP receive socket buffer size. This will be addressed in a follow-on commit. The iperf3 results below demonstrate the effect of this commit between two Linux computers with i5-12400 CPUs. There is roughly ~13us of round trip latency between them. The first result is from commit 57856fc without TCP GRO. Starting Test: protocol: TCP, 1 streams, 131072 byte blocks - - - - - - - - - - - - - - - - - - - - - - - - - Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 4.77 GBytes 4.10 Gbits/sec 20 sender [ 5] 0.00-10.00 sec 4.77 GBytes 4.10 Gbits/sec receiver The second result is from this commit with TCP GRO. Starting Test: protocol: TCP, 1 streams, 131072 byte blocks - - - - - - - - - - - - - - - - - - - - - - - - - Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 10.6 GBytes 9.14 Gbits/sec 20 sender [ 5] 0.00-10.00 sec 10.6 GBytes 9.14 Gbits/sec receiver Updates #6816 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Brad Fitzpatrick	cc370314e7	health: don't show login error details with context cancelations ... Fixes #12991 Change-Id: I2a5e109395761b720ecf1069d0167cf0caf72876 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Aaron Klotz	655b4f8fc5	net/netns: remove some logspam by avoiding logging parse errors due to unspecified addresses ... I updated the address parsing stuff to return a specific error for unspecified hosts passed as empty strings, and look for that when logging errors. I explicitly did not make parseAddress return a netip.Addr containing an unspecified address because at this layer, in the absence of any host, we don't necessarily know the address family we're dealing with. For the purposes of this code I think this is fine, at least until we implement #12588. Fixes #12979 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 months ago
Brad Fitzpatrick	004dded0a8	net/tlsdial: relax self-signed cert health warning ... It seems some security software or macOS itself might be MITMing TLS (for ScreenTime?), so don't warn unless it fails x509 validation against system roots. Updates #3198 Change-Id: I6ea381b5bb6385b3d51da4a1468c0d803236b7bf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Aaron Klotz	0def4f8e38	net/netns: on Windows, fall back to default interface index when unspecified address is passed to ControlC and bindToInterfaceByRoute is enabled ... We were returning an error instead of binding to the default interface. Updates #12979 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 months ago
Jordan Whited	7bc2ddaedc	go.mod,net/tstun,wgengine/netstack: implement gVisor TCP GSO for Linux (#12869) ... This commit implements TCP GSO for packets being read from gVisor on Linux. Windows support will follow later. The wireguard-go dependency is updated in order to make use of newly exported GSO logic from its tun package. A new gVisor stack.LinkEndpoint implementation has been established (linkEndpoint) that is loosely modeled after its predecessor (channel.Endpoint). This new implementation supports GSO of monster TCP segments up to 64K in size, whereas channel.Endpoint only supports up to 32K. linkEndpoint will also be required for GRO, which will be implemented in a follow-on commit. TCP throughput from gVisor, i.e. TUN read direction, is dramatically improved as a result of this commit. Benchmarks show substantial improvement through a wide range of RTT and loss conditions, sometimes as high as 5x. The iperf3 results below demonstrate the effect of this commit between two Linux computers with i5-12400 CPUs. There is roughly ~13us of round trip latency between them. The first result is from commit 57856fc without TCP GSO. Starting Test: protocol: TCP, 1 streams, 131072 byte blocks - - - - - - - - - - - - - - - - - - - - - - - - - Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.51 GBytes 2.15 Gbits/sec 154 sender [ 5] 0.00-10.00 sec 2.49 GBytes 2.14 Gbits/sec receiver The second result is from this commit with TCP GSO. Starting Test: protocol: TCP, 1 streams, 131072 byte blocks - - - - - - - - - - - - - - - - - - - - - - - - - Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 12.6 GBytes 10.8 Gbits/sec 6 sender [ 5] 0.00-10.00 sec 12.6 GBytes 10.8 Gbits/sec receiver Updates #6816 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Andrea Gottardo	949b15d858	net/captivedetection: call SetHealthy once connectivity restored (#12974) ... Fixes tailscale/tailscale#12973 Updates tailscale/tailscale#1634 There was a logic issue in the captive detection code we shipped in https://github.com/tailscale/tailscale/pull/12707. Assume a captive portal has been detected, and the user notified. Upon switching to another Wi-Fi that does *not* have a captive portal, we were issuing a signal to interrupt any pending captive detection attempt. However, we were not also setting the `captive-portal-detected` warnable to healthy. The result was that any "captive portal detected" alert would not be cleared from the UI. Also fixes a broken log statement value. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	3 months ago
Jonathan Nobels	8a8ecac6a7	net/dns, cmd/tailscaled: plumb system health tracker into dns cleanup (#12969) ... fixes tailscale#12968 The dns manager cleanup func was getting passed a nil health tracker, which will panic. Fixed to pass it the system health tracker. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	3 months ago
Irbe Krumina	eead25560f	build_docker.sh: update script comment (#12970) ... It is no longer correct to state that we don't support running Tailscale in containers or on Kubernetes. Updates tailscale/tailscale#12842 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	3 months ago
dependabot[bot]	1b64961320	build(deps): bump github.com/docker/docker (#12966) ... Bumps [github.com/docker/docker](https://github.com/docker/docker) from 25.0.5+incompatible to 26.1.4+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v25.0.5...v26.1.4) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 months ago
Irbe Krumina	32308fcf71	Dockerfile: add a warning that this is not used to build our published images (#12955) ... Add a warning that the Dockerfile in the OSS repo is not the currently used mechanism to build the images we publish - for folks who want to contribute to image build scripts or otherwise need to understand the image build process that we use. Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	3 months ago
Flakes Updater	34de96d06e	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	3 months ago
Brad Fitzpatrick	575feb486f	util/osuser: turn wasm check into a const expression ... All wasi* are GOARCH wasm, so check that instead. Updates #12732 Change-Id: Id3cc346295c1641bcf80a6c5eb1ad65488509656 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Brad Fitzpatrick	2ab1d532e8	gokrazy/tsapp: add go.mod replacing two tailscale.com binaries with parent module ... Updates #1866 Change-Id: I1ee7d41f7ee55806fb7ad94d0333dd0ec33d8efd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Brad Fitzpatrick	360046e5c3	words: add some associated with scales ... Updates tailscale/corp#14698 Change-Id: Ica7f179bd368d3c15f58fb236d377881cd80efcf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Andrew Dunham	35a8fca379	cmd/tailscale/cli: release portmap after netcheck ... Updates #12954 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic14f037b48a79b1263b140c6699579b466d89310	3 months ago
Jonathan Nobels	19b0c8a024	net/dns, health: raise health warning for failing forwarded DNS queries (#12888) ... updates tailscale/corp#21823 Misconfigured, broken, or blocked DNS will often present as "internet is broken'" to the end user. This plumbs the health tracker into the dns manager and forwarder and adds a health warning with a 5 second delay that is raised on failures in the forwarder and lowered on successes. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	3 months ago
Percy Wegmann	3088c6105e	go.mod: pull in latest github.com/tailscale/xnet ... This picks up https://github.com/tailscale/xnet/pull/1 so that clients can move files even when holding only a lock for the source file. Updates #12941 Signed-off-by: Percy Wegmann <percy@tailscale.com>	3 months ago
Irbe Krumina	a21bf100f3	cmd/k8s-operator,k8s-operator/sessionrecording,sessionrecording,ssh/tailssh: refactor session recording functionality (#12945) ... cmd/k8s-operator,k8s-operator/sessionrecording,sessionrecording,ssh/tailssh: refactor session recording functionality Refactor SSH session recording functionality (mostly the bits related to Kubernetes API server proxy 'kubectl exec' session recording): - move the session recording bits used by both Tailscale SSH and the Kubernetes API server proxy into a shared sessionrecording package, to avoid having the operator to import ssh/tailssh - move the Kubernetes API server proxy session recording functionality into a k8s-operator/sessionrecording package, add some abstractions in preparation for adding support for a second streaming protocol (WebSockets) Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	3 months ago
Paul Scott	1bf7ed0348	tsweb: add QuietLogging option (#12838) ... Allows the use of tsweb.LogHandler exclusively for callbacks describing the handler HTTP requests. Fixes #12837 Signed-off-by: Paul Scott <paul@tailscale.com>	3 months ago