tailscale

Commit Graph

Author	SHA1	Message	Date
Mihai Parparita	b64d78d58f	sockstats: refactor validation to be opt-in Followup to #7499 to make validation a separate function ( GetWithValidation vs. Get). This way callers that don't need it don't pay the cost of a syscall per active TCP socket. Also clears the conn on close, so that we don't double-count the stats. Also more consistently uses Go doc comments for the exported API of the sockstats package. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	1e72de6b72	ipn/ipnlocal: remove WIP restriction for Tailscale SSH on macOS It kinda works fine now on macOS with the recent fixes in `0582829` and `5787989d`. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	3471fbf8dc	cmd/tailscale: surface node-key for locked out tailnet-lock peers Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	b797f773c7	ipn/ipnlocal: add support for funnel in tsnet Previously the part that handled Funnel connections was not aware of any listeners that tsnet.Servers might have had open so it would check against the ServeConfig and fail. Adding a ServeConfig for a TCP proxy was also not suitable in this scenario as that would mean creating two different listeners and have one forward to the other, which really meant that you could not have funnel and tailnet-only listeners on the same port. This also introduces the ipn.FunnelConn as a way for users to identify whether the call is coming over funnel or not. Currently it only holds the underlying conn and the target as presented in the "Tailscale-Ingress-Target" header. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	ce99474317	all: implement preauth-key support with tailnet lock Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Mihai Parparita	f4f8ed98d9	sockstats: add validation for TCP socket stats We can use the TCP_CONNECTION_INFO getsockopt() on Darwin to get OS-collected tx/rx bytes for TCP sockets. Since this API is not available for UDP sockets (or on Linux/Android), we can't rely on it for actual stats gathering. However, we can use it to validate the stats that we collect ourselves using read/write hooks, so that we can be more confident in them. We do need additional hooks from the Go standard library (added in tailscale/go#59) to be able to collect them. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Andrew Dunham	be107f92d3	wgengine/magicsock: track per-endpoint changes in ringbuffer This change adds a ringbuffer to each magicsock endpoint that keeps a fixed set of "changes"–debug information about what updates have been made to that endpoint. Additionally, this adds a LocalAPI endpoint and associated "debug peer-status" CLI subcommand to fetch the set of changes for a given IP or hostname. Updates tailscale/corp#9364 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I34f726a71bddd0dfa36ec05ebafffb24f6e0516a	2 years ago
Mihai Parparita	6ac6ddbb47	sockstats: switch label to enum Makes it cheaper/simpler to persist values, and encourages reuse of labels as opposed to generating an arbitrary number. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Andrew Dunham	df2561f6a2	ipn/ipnlocal: stop netmap expiry timer when resetting control client This prevents a panic where we synthesize a new netmap in setClientStatus after we've shut down and nil'd out the controlclient, since that function expects to be called while connected to control. Fixes #7392 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib631eb90f34f6afa008d69bbb386f70da145e102	2 years ago
Andrew Dunham	045f995203	ipn/localapi: close portmapper after debug This ensures that any mappings that are created are correctly cleaned up, instead of waiting for them to expire in the router. Updates #7377 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I436248ee7740eded6d8adae5df525e785a8f7ccb	2 years ago
Andrew Dunham	69f9c17555	ipn/localapi: fix panic after handler returns Change-Id: I612f9ebf78d962e094bff908670b3ffd89f756e5 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Maisem Ali	1a30b2d73f	all: use tstest.Replace more Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	a9c17dbf93	ipn/ipnlocal: reject unmasked routes Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic804efd24f5f536de1f2c910de3a24372d48d54d	2 years ago
Tom DNetto	88c7d19d54	tka: compact TKA storage on startup Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	e2d652ec4d	ipn,cmd/tailscale: implement resigning nodes on tka key removal Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	3f8e8b04fd	cmd/tailscale, cmd/tailscaled: move portmapper debugging into tailscale CLI The debug flag on tailscaled isn't available in the macOS App Store build, since we don't have a tailscaled binary; move it to the 'tailscale debug' CLI that is available on all platforms instead, accessed over LocalAPI. Updates #7377 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I47bffe4461e036fab577c2e51e173f4003592ff7	2 years ago
Mihai Parparita	9cb332f0e2	sockstats: instrument networking code paths Uses the hooks added by tailscale/go#45 to instrument the reads and writes on the major code paths that do network I/O in the client. The convention is to use "<package>.<type>:<label>" as the annotation for the responsible code path. Enabled on iOS, macOS and Android only, since mobile platforms are the ones we're most interested in, and we are less sensitive to any throughput degradation due to the per-I/O callback overhead (macOS is also enabled for ease of testing during development). For now just exposed as counters on a /v0/sockstats PeerAPI endpoint. We also keep track of the current interface so that we can break out the stats by interface. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Joe Tsai	0d19f5d421	all: replace logtail.{Public,Private}ID with logid.{Public,Private}ID (#7404 ) The log ID types were moved to a separate package so that code that only depend on log ID types do not need to link in the logic for the logtail client itself. Not all code need the logtail client. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
David Crawshaw	768df4ff7a	tsnet: add a LocalAPI listener on loopback, with basic auth This is for use by LocalAPI clients written in other languages that don't appear to be able to talk HTTP over a socket (e.g. java.net.http.HttpClient). Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Mihai Parparita	780c56e119	ipn/ipnlocal: add delegated interface information to /interfaces PeerAPI handler Exposes the delegated interface data added by #7248 in the debug endpoint. I would have found it useful when working on that PR, and it may be handy in the future as well. Also makes the interfaces table slightly easier to parse by adding borders to it. To make then nicer-looking, the CSP was relaxed to allow inline styles. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
David Anderson	8b2ae47c31	version: unexport all vars, turn Short/Long into funcs The other formerly exported values aren't used outside the package, so just unexport them. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Mihai Parparita	fa932fefe7	net/interfaces: redo how we get the default interface on macOS and iOS With #6566 we added an external mechanism for getting the default interface, and used it on macOS and iOS (see tailscale/corp#8201). The goal was to be able to get the default physical interface even when using an exit node (in which case the routing table would say that the Tailscale utun* interface is the default). However, the external mechanism turns out to be unreliable in some cases, e.g. when multiple cellular interfaces are present/toggled (I have occasionally gotten my phone into a state where it reports the pdp_ip1 interface as the default, even though it can't actually route traffic). It was observed that `ifconfig -v` on macOS reports an "effective interface" for the Tailscale utn* interface, which seems promising. By examining the ifconfig source code, it turns out that this is done via a SIOCGIFDELEGATE ioctl syscall. Though this is a private API, it appears to have been around for a long time (e.g. it's in the 10.13 xnu release at https://opensource.apple.com/source/xnu/xnu-4570.41.2/bsd/net/if_types.h.auto.html) and thus is unlikely to go away. We can thus use this ioctl if the routing table says that a utun* interface is the default, and go back to the simpler mechanism that we had before #6566. Updates #7184 Updates #7188 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	7d204d89c2	ipn/ipnlocal: fix passthrough of formatting arguments in PeerAPI doctor output Followup to #7235, we were not treating the formatting arguments as variadic. This worked OK for single values, but stopped working when we started passing multiple values (noticed while trying out #7244). Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	6799ef838f	ipn/ipnlocal: add PeerAPI endpoint for doctor output Useful when debugging issues (e.g. to see the full routing table), and easier to refer to the output via a browser than trying to read it from the logs generated by `bugreport --diagnose`. Behind a canDebug() check, similar to the /magicsock and /interfaces endpoints. Updates #7184 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	89bd414be6	ipn/ipnstate: update field docs on PeerStatus. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	62f4df3257	net/interfaces, net/netns: add node attributes to control default interface getting and binding With #6566 we started to more aggressively bind to the default interface on Darwin. We are seeing some reports of the wrong cellular interface being chosen on iOS. To help with the investigation, this adds to knobs to control the behavior changes: - CapabilityDebugDisableAlternateDefaultRouteInterface disables the alternate function that we use to get the default interface on macOS and iOS (implemented in tailscale/corp#8201). We still log what it would have returned so we can see if it gets things wrong. - CapabilityDebugDisableBindConnToInterface is a bigger hammer that disables binding of connections to the default interface altogether. Updates #7184 Updates #7188 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	31e2e9a300	ipn: remove unused NLKeyStateKey constant We stopped writing network lock keys as separate items with #6315, the constant is no longer used. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
M. J. Fromberger	9be47f789c	ipn/ipnlocal: fix the path for writing cert files (#7203 ) Fixes #7202. Change-Id: I1f8e9c59d5e42e7df7a3fbbd82ae2b4293845916 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	2 years ago
Andrew Dunham	cab2b2b59e	ipn/localapi: print envknobs on bugreport Previously, we only printed these at startup; print those when the user generates a bugreport as we so we don't have to go spelunking through the logs. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If5b0970f09fcb4cf8839958af5d37f84e0ba6ed2	2 years ago
Maisem Ali	0fd2f71a1e	ipn/ipnlocal: use presence of NodeID to identify logins The profileManager was using the LoginName as a proxy to figure out if the profile had logged in, however the LoginName is not present if the node was created with an Auth Key that does not have an associated user. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	6d84f3409b	ipn/ipnlocal: handle more edge cases in netmap expiry timer We now handle the case where the NetworkMap.SelfNode has already expired and do not return an expiry time in the past (which causes an ~infinite loop of timers to fire). Additionally, we now add an explicit check to ensure that the next expiry time is never before the current local-to-the-system time, to ensure that we don't end up in a similar situation due to clock skew. Finally, we add more tests for this logic to ensure that we don't regress on these edge cases. Fixes #7193 Change-Id: Iaf8e3d83be1d133a7aab7f8d62939e508cc53f9c Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Tom DNetto	99b9d7a621	all: implement pcap streaming for datapath debugging Updates: tailscale/corp#8470 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	6bae55e351	ipn/ipnlocal: add support to store certs in k8s secrets Fixes #5676 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
David Crawshaw	8cf2805cca	tailcfg, localapi: plumb device token to server Updates tailscale/corp#8940 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Andrew Dunham	d2301db49c	ipn/localapi: print node IDs, pubkeys, and expiry on bugreport Having this information near the "user bugreport" line makes it easier to identify the node and expiry without spelunking through the rest of the logs. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1597c783efc06574fa4c8f211e68d835f20b6ccb	2 years ago
Andrew Dunham	5ba2543828	ipn/ipnlocal: print warning about DNS servers in bugreport --diagnose If the user passes the --diagnose flag, print a warning if any of the default or fallback DNS resolvers are Tailscale IPs. This can interfere with the ability to connect to the controlplane, and is typically something to pay attention to if there's a connectivity issue. Change-Id: Ib14bf6228c037877fbdcd22b069212b1a4b2c456 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Brad Fitzpatrick	cf8dd7aa09	all: use Go 1.20's bytes.Clone Updates #7123 Updates #6257 (more to do in other repos) Change-Id: I073e2a6d81a5d7fbecc29caddb7e057ff65239d0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b1248442c3	all: update to Go 1.20, use strings.CutPrefix/Suffix instead of our fork Updates #7123 Updates #5309 Change-Id: I90bcd87a2fb85a91834a0dd4be6e03db08438672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Crawshaw	4136f27f35	ipn/localapi: fix validHost parsing logic Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Andrew Dunham	d1146dc701	ipn/ipnlocal: rate-limit diagnose logs in bugreport We can log too quickly for logtail to catch up, even when we opt out of log rate-limiting. When the user passes the --diagnose flag to bugreport, we use a token bucket to control how many logs per second are printed and sleep until we're able to write more. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If27672d66b621b589280bd0fe228de367ffcbd8f	2 years ago
Maisem Ali	04b57a371e	ipn/ipnlocal: drop not required StateKey parameter This is #cleanup now that #7121 is merged. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	4441609d8f	safesocket: remove the now unused WindowsLocalPort Also drop the port param from safesocket.Listen. #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	4973956419	ipn/ipnlocal: add /reset-auth LocalAPI endpoint The iOS has a command to reset the persisted state of the app, but it was doing its own direct keychain manipulation. This proved to be brittle (since we changed how preferences are stored with #6022), so we instead add a LocalAPI endpoint to do do this, which can be updated in tandem. This clears the same state as the iOS implementation (tailscale/corp#3186), that is the machine key and preferences (which includes the node key). Notably this does not clear the logtail ID, so that logs from the device still end up in the same place. Updates tailscale/corp#8923 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Will Norris	71029cea2d	all: update copyright and license headers This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Brad Fitzpatrick	a1b4ab34e6	util/httpm: add new package for prettier HTTP method constants See package doc. Change-Id: Ibbfc8e1f98294217c56f3a9452bd93ffa3103572 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	2703d6916f	net/netns: add functionality to bind outgoing sockets based on route table When turned on via environment variable (off by default), this will use the BSD routing APIs to query what interface index a socket should be bound to, rather than binding to the default interface in all cases. Updates #5719 Updates #5940 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib4c919471f377b7a08cd3413f8e8caacb29fee0b	2 years ago
Andrew Dunham	44d73ce932	ipn/ipnlocal, net/dnscache: allow configuring dnscache logging via capability This allows users to temporarily enable/disable dnscache logging via a new node capability, to aid in debugging strange connectivity issues. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I46cf2596a8ae4c1913880a78d0033f8b668edc08	2 years ago
Brad Fitzpatrick	6e5faff51e	ipn/ipnlocal: add health warning for Tailscale SSH + SELinux Updates #4908 Change-Id: If46be5045b13dd5c3068c334642f89b5917ec861 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	c8db70fd73	cmd/tailscale/cli: add debug set-expire command for testing Updates tailscale/corp#8811 Updates tailscale/corp#8613 Change-Id: I1c87806ca3ccc5c43e7ddbd6b4d521f73f7d29f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	140b9aad5c	ipn/ipnlocal: fire expiry timer when the current node expires The current node isn't in NetMap.Peers, so without this we would not have fired this timer on self expiry. Updates #6932 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id57f96985397e372f9226802d63b42ff92c95093	2 years ago
Brad Fitzpatrick	06fff461dc	ipn/ipnstate: add PeerStatus.KeyExpiry for tailscale status --json Fixes #6712 Change-Id: I817cd5342fac8a956fcefda2d63158fa488f3395 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b6aa1c1f22	envknob, hostinfo, ipn/ipnlocal: add start of opt-in remote update support Updates #6907 Change-Id: I85db4f6f831dd5ff7a9ef4bfa25902607e0c1558 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
shayne	4471e403aa	ipn/ipnlocal: [serve] listen on all-interfaces for macOS sandboxed (#6771 ) On macOS (AppStore and macsys), we need to bind to ""/all-interfaces due to the network sandbox. Ideally we would only bind to the Tailscale interface, but macOS errors out if we try to to listen on privileged ports binding only to a specific interface. We also implement the lc.Control hook, same as we do for peerapi. It doesn't solve our problem but it's better that we do and would likely be required when Apple gets around to fixing per-interface priviliged port binding. Fixes: #6364 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Brad Fitzpatrick	6793685bba	go.mod: bump AWS SDK past a breaking API change of theirs They changed a type in their SDK which meant others using the AWS APIs in their Go programs (with newer AWS modules in their caller go.mod) and then depending on Tailscale (for e.g. tsnet) then couldn't compile ipn/store/awsstore. Thanks to @thisisaaronland for bringing this up. Fixes #7019 Change-Id: I8d2919183dabd6045a96120bb52940a9bb27193b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6edf357b96	all: start groundwork for using capver for localapi & peerapi Updates #7015 Change-Id: I3d4c11b42a727a62eaac3262a879f29bb4ce82dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
salman	eec734a578	ipn/{ipnlocal,localapi}: ensure watcher is installed before /watch-ipn-bus/ responds with 200 This change delays the first flush in the /watch-ipn-bus/ handler until after the watcher has been successfully installed on the IPN bus. It does this by adding a new onWatchAdded callback to LocalBackend.WatchNotifications(). Without this, the endpoint returns a 200 almost immediatly, and only then installs a watcher for IPN events. This means there's a small window where events could be missed by clients after calling WatchIPNBus(). Fixes tailscale/corp#8594. Signed-off-by: salman <salman@tailscale.com>	2 years ago
Brad Fitzpatrick	b657187a69	cmd/tailscale, logtail: add 'tailscale debug daemon-logs' logtail mechanism Fixes #6836 Change-Id: Ia6eb39ff8972e1aa149aeeb63844a97497c2cf04 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	3a018e51bb	ipn/ipnlocal: move handling of expired nodes to LocalBackend In order to be able to synthesize a new NetMap when a node expires, have LocalBackend start a timer when receiving a new NetMap that fires slightly after the next node expires. Additionally, move the logic that updates expired nodes into LocalBackend so it runs on every netmap (whether received from controlclient or self-triggered). Updates #6932 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I833390e16ad188983eac29eb34cc7574f555f2f3	2 years ago
Mihai Parparita	67f82e62a1	ipn/ipnlocal: add Expired to PeerStatus Needed for clients that get information via the /v0/status LocalAPI endpoint (e.g. to not offer expired exit nodes as options). Updates tailscale/corp#8702 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Andrew Dunham	11ce5b7e57	ipn/ipnlocal, wgengine/magicsock: check Expired bool on Node; print error in Ping Change-Id: Ic5f533f175a6e1bb73d4957d8c3f970add42e82e Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Brad Fitzpatrick	61dfbc0a6e	cmd/tailscale/cli: plumb TUN mode into tailscale web template UI works remains, but data is there now. Updates #4015 Change-Id: Ib91e94718b655ad60a63596e59468f3b3b102306 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
James Tucker	2afa1672ac	ipn/ipnlocal: disallow unsigned peers from WoL Unsigned peers should not be allowed to generate Wake-on-Lan packets, only access Funnel. Updates #6934 Updates #7515 Updates #6475 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Brad Fitzpatrick	1116602d4c	ssh/tailssh: add OpenBSD support for Tailscale SSH And bump go.mod for https://github.com/u-root/u-root/pull/2593 Change-Id: I36ec94c5b2b76d671cb739f1e9a1a43ca1d9d1b1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	69c0b7e712	ipn/ipnlocal: add c2n handler to flush logtail for support debugging Updates tailscale/corp#8564 Change-Id: I0c619d4007069f90cffd319fba66bd034d63e84d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	0088c5ddc0	health,ipn/ipnlocal: report the node being locked out as a health issue Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	907f85cd67	cmd/tailscale,tka: make KeyID return an error instead of panicking Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Kristoffer Dalby	c4e262a0fc	ipn/profiles: set default prefs based on Windows registry (#6803 ) Co-authored-by: Maisem Ali maisem@tailscale.com	2 years ago
Brad Fitzpatrick	eafbf8886d	ipn/localapi: add localapi debug endpoints for packet filter/matches For debugging #6423. This is easier than TS_DEBUG_MAP, as this means I can pipe things into jq, etc. Updates #6423 Change-Id: Ib3e7496b2eb3f47d4bed42e9b8045a441424b23c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Anderson	91e64ca74f	cmd/tailscale/cli: redact private key in debug netmap output by default This makes `tailscale debug watch-ipn` safe to use for troubleshooting user issues, in addition to local debugging during development. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Brad Fitzpatrick	aad6830df0	util/codegen, all: use latest year, not time.Now, in generated files Updates #6865 Change-Id: I6b86c646968ebbd4553cf37df5e5612fbf5c5f7d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Anton Tolchanov	82b9689e25	ipn/ipnlocal: maintain a proxy handler per backend (#6804 ) By default, `http.Transport` keeps idle connections open hoping to re-use them in the future. Combined with a separate transport per request in HTTP proxy this results in idle connection leak. Fixes #6773	2 years ago
Brad Fitzpatrick	0f604923d3	ipn/ipnlocal: fix StatusWithoutPeers not populating parts of Status Fixes #4311 Change-Id: Iaae0615148fa7154f4ef8f66b455e3a6c2fa9df3 Co-authored-by: Claire Wang <claire@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Anton Tolchanov	53c4892841	ipn/ipnserver: propagate http.Serve error This ensures that we capture error returned by `Serve` and exit with a non-zero exit code if it happens. Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Joe Tsai	bd2995c14b	ipn/ipnlocal: simplify redactErr (#6716 ) Use multierr.Range to iterate through an error tree instead of multiple invocations of errors.As. This scales better as we add more Go error types to the switch. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Mihai Parparita	47002d93a3	ipn/ipnlocal: add a few metrics for PeerAPI and LocalAPI Mainly motivated by wanting to know how much Taildrop is used, but also useful when tracking down how many invalid requests are generated. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
salman	2d271f3bd1	ipn/ipnlocal: disallow exit nodes from using exit nodes Nodes which have both -advertise-exit-node and -exit-node in prefs should continue have them until the next invocation of `tailscale up`. Updates #3569. Signed-off-by: salman <salman@tailscale.com>	2 years ago
shayne	98114bf608	cmd/tailscale/cli, ipn/localapi: add funnel status to status command (#6402 ) Fixes #6400 open up GETs for localapi serve-config to allow read-only access to ServeConfig `tailscale status` will include "Funnel on" status when Funnel is configured. Prints nothing if Funnel is not running. Example: $ tailscale status <nodes redacted> # Funnel on: # - https://node-name.corp.ts.net # - https://node-name.corp.ts.net:8443 # - tcp://node-name.corp.ts.net:10000 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Tom DNetto	55e0512a05	ipn/ipnlocal,cmd/tailscale: minor improvements to lock modify command * Do not print the status at the end of a successful operation * Ensure the key of the current node is actually trusted to make these changes Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	a887ca7efe	ipn/ipnlocal: improve redactErr to handle more cases This handles the case where the inner os.PathError is wrapped in another error type, and additionally will redact errors of type os.LinkError. Finally, add tests to verify that redaction works. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie83424ff6c85cdb29fb48b641330c495107aab7c	2 years ago
Brad Fitzpatrick	1598cd0361	net/tsaddr: remove ContainsFunc helpers (they're now in x/exp/slices) x/exp/slices now has ContainsFunc (golang/go#53983) so we can delete our versions. Change-Id: I5157a403bfc1b30e243bf31c8b611da25e995078 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	9c773af04c	ipn/ipnlocal: fix use of stale profile while processing netmap Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	964d723aba	ipn/{ipnserver,localapi}: fix InUseOtherUser handling with WatchIPNBus Updates tailscale/corp#8222 Change-Id: I2d6fa6514c7b8d0f89fded35a2d44e7df27e6fb1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	86b6ff61e6	ipn/ipnlocal: fix Prefs access without mu being held Noticed while working on a different fix. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	cdb924f87b	ipn/ipnlocal: sanitize prefs in more notify code paths Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	57124e2126	ipn/localapi: add debug (root-required) access to inject debug Notify For testing of Windows GUI client. Updates #6480 Change-Id: I42f7526d95723e14bed7085fb759e371b43aa9da Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	a87e0b4ea8	ipn: update comments that refer to Options.Prefs Things are slightly less tangled now that we've migrated prefs to the backend (and renamed the field to LegacyMigrationPrefs). Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	e1d7d072a3	ipn/ipnlocal: set Notify.Version on initial Notifies Missed when added recently in `8dd1418774` Change-Id: Id682640a54c3717afe084edaf69258ad23031b6c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	74c1f632f6	types/key,cmd/tailscale/cli: support tlpub prefix for tailnet-lock keys Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	8dd1418774	ipn{,/ipnlocal}: add ipn.NotifyInitial* flags to WatchIPNBus To simplify clients getting the initial state when they subscribe. Change-Id: I2490a5ab2411253717c74265a46a98012b80db82 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a277eb4dcf	ipn/ipnlocal: add missing context cancel If user's fn returned false and never canceled their ctx, we never stopped the NotifyWatchEngineUpdates goroutine. This was introduced recently (this cycle). Change-Id: I3453966ac71e00727296ddd237ef845782f4e52e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	978d6af91a	ipn/ipnlocal: tweak error handling in interfaces PeerAPI debug endpoint We were writing the error when getting the default interface before setting the content type, so we'd get HTML treated as plain text. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	5bdca747b7	ipn/ipnlocal: fix netstack peerapi crash over IPv6 The peerapi IPv6 listener has a nil listener. But we didn't need the listener's address anyway, so don't try to use it. Change-Id: I8e8a1a895046d129a3683973e732d9bed82f3b02 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	f1ab11e961	ipn/ipnlocal,tailcfg: introduce capability to gate TKA init paths Previously, `TAILSCALE_USE_WIP_CODE` was needed to hit a bunch of the TKA paths. With this change: - Enablement codepaths (NetworkLockInit) and initialization codepaths (tkaBootstrapFromGenesisLocked via tkaSyncIfNeeded) require either the WIP envknob or CapabilityTailnetLockAlpha. - Normal operation codepaths (tkaSyncIfNeeded, tkaFilterNetmapLocked) require TKA to be initialized, or either-or the envknob / capability. - Auxillary commands (ie: changing tka keys) require TKA to be initialized. The end result is that it shouldn't be possible to initialize TKA (or subsequently use any of its features) without being sent the capability or setting the envknob on tailscaled yourself. I've also pulled out a bunch of unnecessary checks for CanSupportNetworkLock(). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	9a80b8fb10	cmd/tailscale,ipn: surface TKA-filtered peers in lock status command Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	74744b0a4c	ipn: be more consistent with omitempty on debug/rare Prefs Change-Id: Ib0ec72f243cdb2aca8dd392644d4eed33c3f92e6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	82ad585b5b	ipn/ipnlocal: account for ControlURL when merging profiles We merge/dedupe profiles based on UserID and NodeID, however we were not accounting for ControlURLs. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	adc302f428	all: use named pipes on windows Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	45042a76cd	cmd/tailscale,ipn: store disallowed TKA's in prefs, lock local-disable Take 2 of https://github.com/tailscale/tailscale/pull/6546 Builds on https://github.com/tailscale/tailscale/pull/6560 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	c4980f33f7	ipn,types/persist: add DisallowedTKAStateIDs, refactor as view type Supercedes https://github.com/tailscale/tailscale/pull/6557, precursor to trying https://github.com/tailscale/tailscale/pull/6546 again Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	6d012547b6	ipn/ipnlocal: use double dash flag style The Go style weirds people out so we try to stick to the more well-known double hyphen style in docs. Change-Id: Iad6db5c82cda37f6b7687eed7ecd9276f8fd94d6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	390d1bb871	Revert "ipn,types/persist: store disallowed TKA's in prefs, lock local-disable" This reverts commit `f1130421f0`. It was submitted with failing tests (go generate checks) Requires a lot of API changes to fix so rolling back instead of forward. Change-Id: I024e8885c0ed44675d3028a662f386dda811f2ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	f1130421f0	ipn,types/persist: store disallowed TKA's in prefs, lock local-disable Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Aaron Klotz	659e7837c6	health, ipn/ipnlocal: when -no-logs-no-support is enabled, deny access to tailnets that have network logging enabled We want users to have the freedom to start tailscaled with `-no-logs-no-support`, but that is obviously in direct conflict with tailnets that have network logging enabled. When we detect that condition, we record the issue in health, notify the client, set WantRunning=false, and bail. We clear the item in health when a profile switch occurs, since it is a per-tailnet condition that should not propagate across profiles. Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Maisem Ali	ad41cbd9d5	ipn/ipnlocal: sanitize prefs before sending over IPN Bus Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	0cb2ccce7f	safesocket: remove the IPN protocol support Updates #6417 Change-Id: I78908633de842d83b2cc8b10a864a0f88ab1b113 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	06c4c47d46	ipn: remove unused Backend interface Only the macOS/iOS clients care about it still, so we'll move it to their repo. But keep a test that makes sure that LocalBackend continues to implement it so we get an early warning sign before we break macOS/iOS. Change-Id: I56392b740fe55b4d28468b77124c821b5c46c22b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Aaron Klotz	6e33d2da2b	ipn/ipnauth, util/winutil: add temporary LookupPseudoUser workaround to address os/user.LookupId errors on Windows I added util/winutil/LookupPseudoUser, which essentially consists of the bits that I am in the process of adding to Go's standard library. We check the provided SID for "S-1-5-x" where 17 <= x <= 20 (which are the known pseudo-users) and then manually populate a os/user.User struct with the correct information. Fixes https://github.com/tailscale/tailscale/issues/869 Fixes https://github.com/tailscale/tailscale/issues/2894 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Brad Fitzpatrick	3b0de97e07	cmd/tailscaled: unify the two Windows paths + separate IPN server path tailscaled on Windows had two entirely separate start-up paths for running as a service vs in the foreground. It's been causing problems for ages. This unifies the two paths, making them be the same as the path used for every other platform. Also, it uses the new async LocalBackend support in ipnserver.Server so the Server can start serving HTTP immediately, even if tun takes awhile to come up. Updates #6535 Change-Id: Icc8c4f96d4887b54a024d7ac15ad11096b5a58cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ea25ef8236	util/set: add new set package for SetHandle type We use this pattern in a number of places (in this repo and elsewhere) and I was about to add a fourth to this repo which was crossing the line. Add this type instead so they're all the same. Also, we have another Set type (SliceSet, which tracks its keys in order) in another repo we can move to this package later. Change-Id: Ibbdcdba5443fae9b6956f63990bdb9e9443cefa9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	5c8d2fa695	cmd/tailscale,ipn: improve UX of lock init command, cosmetic changes Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	e8cc78b1af	ipn/ipnserver: change Server to let LocalBackend be supplied async This is step 1 of de-special-casing of Windows and letting the LocalAPI HTTP server start serving immediately, even while the rest of the world (notably the Engine and its TUN device) are being created, which can take a few to dozens of seconds on Windows. With this change, the ipnserver.New function changes to not take an Engine and to return immediately, not returning an error, and let its Run run immediately. If its ServeHTTP is called when it doesn't yet have a LocalBackend, it returns an error. A TODO in there shows where a future handler will serve status before an engine is available. Future changes will: * delete a bunch of tailscaled_windows.go code and use this new API * add the ipnserver.Server ServerHTTP handler to await the engine being available * use that handler in the Windows GUI client Updates #6522 Change-Id: Iae94e68c235e850b112a72ea24ad0e0959b568ee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	8049053f86	ipn/*: make new WindowsUserID type to consolidate docs The "userID is empty everywhere but Windows" docs on lots of places but not everywhere while using just a string type was getting confusing. This makes a new type to wrap up those rules, however weird/historical they might be. Change-Id: I142e85a8e38760988d6c0c91d0efecedade81b9b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	5676d201d6	ipn: add a WatchIPNBus option bit to subscribe to EngineStatus changes So GUI clients don't need to poll for it. We still poll internally (for now!) but that's still cheaper. And will get much cheaper later, without having to modify clients once they start sending this bit. Change-Id: I36647b701c8d1fe197677e5eb76f6894e8ff79f7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f45106d47c	ipn/ipnserver: move Windows-specific code to tailscaled_windows.go We'll eventually remove it entirely, but for now move get it out of ipnserver where it's distracting and move it to its sole caller. Updates #6522 Change-Id: I9c6f6a91bf9a8e3c5ea997952b7c08c81723d447 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	109aa3b2fb	cmd/tailscale: add start of "debug derp" subcommand Updates #6526 Change-Id: I84e440a8bd837c383000ce0cec4ff36b24249e8b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b0545873e5	ipn/ipnserver: remove protoSwitchConn shenanigans; just use http.Server early Now that everything's just HTTP, there's no longer a need to have a header-sniffing net.Conn wraper that dispatches which route to take. Refactor to just use an http.Server earlier instead. Updates #6417 Change-Id: I12a2054db4e56f48660c46f81233db224fdc77cb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f3ba268a96	ipn/ipnserver: move BabysitProc to tailscaled_windows.go It's only used by Windows. No need for it to be in ipn/ipnserver, which we're trying to trim down. Change-Id: Idf923ac8b6cdae8b5338ec26c16fb8b5ea548071 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	699b39dec1	ipn/ipnlocal: drop LocalBackend.inServerMode Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	7e016c1d90	ipn/ipnserver: remove IPN protocol server Unused in this repo as of the earlier #6450 (`300aba61a6`) and unused in the Windows GUI as of tailscale/corp#8065. With this ipn.BackendServer is no longer used and could also be removed from this repo. The macOS and iOS clients still temporarily depend on it, but I can move it to that repo instead while and let its migration proceed on its own schedule while we clean this repo up. Updates #6417 Updates tailscale/corp#8051 Change-Id: Ie13f82af3eb9f96b3a21c56cdda51be31ddebdcf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	1fdfb0dd08	ipn/localapi: add "enginestatus" debug command to LocalAPI To force an EngineStatus update to the IPN bus. This is a temporary measure while migrating the Windows GUI entirely to the LocalAPI and off the old IPN protocol. The old IPN protocol had RequestEngineStatus and LocalAPI didn't. Updates #6417 Change-Id: I8ff525fc3dd82bdd9d92c2bdad6db5b75609eacd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	c258015165	ipn/ipnlocal,ipnserver: rename {,Set}CurrentUser to {,Set}CurrentUserID Address comments from https://github.com/tailscale/tailscale/pull/6506#discussion_r1032454064 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	0a842f353c	ipn/ipnserver: move more connection acceptance logic to LocalBackend Follow-up to #6467 and #6506. LocalBackend knows the server-mode state, so move more auth checking there, removing some bookkeeping from ipnserver.Server. Updates #6417 Updates tailscale/corp#8051 Change-Id: Ic5d14a077bf0dccc92a3621bd2646bab2cc5b837 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	5ea7c7d603	ipn/{ipnlocal,ipnserver}: add some comments Change-Id: Ieb5917edaf572342b755caa458693512c7aece81 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	a3cd171773	ipn/ipnserver: remove Server.serverModeUser We can just rely on LocalBackend.CurrentUser Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	d321b0ea4f	ipn/ipnlocal: add docs to LocalBackend.SetCurrentUserID Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	250edeb3da	ipn/ipnserver: only permit the pre-HTTP LocalAPI protocol on Windows Updates #6417 Change-Id: I1c9dbee3f72969f703b3ff2dbbaa145a17db868b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b68d008fee	envknob: add CanTaildrop (TS_DISABLE_TAILDROP) to disable taildrop on device This matches CanSSHD (TS_DISABLE_SSH_SERVER) for administratively disabling the code on a node, regardless of local or server configs. This can be configured in /etc/default/tailscaled on Linux, %ProgramData%\Tailscale\tailscaled-env.txt on Windows, or /etc/tailscale/tailscaled-env.txt on Synology. (see getPlatformEnvFile) Also delete some dead code and tidy up some docs. Change-Id: I79a87c03e33209619466ea8aeb0f6651afcb8789 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	20b27df4d0	tailcfg, ipn, controlclient: add MapResponse.ClientVersion, plumb to IPN bus Updates #6480 Change-Id: I6321071425cd091148d8140d1eb24dd536bb7984 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	4d3713f631	envknob: add GOOS func Centralize the fake GOOS stuff, start to use it more. To be used more in the future. Change-Id: Iabacfbeaf5fca0b53bf4d5dbcdc0367f05a205f9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6e6f27dd21	ipn/ipnlocal: lock down unsigned peers more Apparently there's no tracking bug? Updates tailscale/corp#7515 for ingress/funnel at least. Change-Id: I03bc54fdc1f53f9832ab8b51475b2d676c38d897 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7bff7345cc	ipn/ipnauth: start splitting ipnserver into new ipnauth package We're trying to gut 90% of the ipnserver package. A lot will get deleted, some will move to LocalBackend, and a lot is being moved into this new ipn/ipnauth package which will be leaf-y and testable. This is a baby step towards moving some stuff to ipnauth. Update #6417 Updates tailscale/corp#8051 Change-Id: I28bc2126764f46597d92a2d72565009dc6927ee0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	3a5d02cb31	ipn/ipnlocal: update comment about using FallbackResolvers for exit nodes While reading the DNS code noticed that we were still using FallbackResolvers in this code path but the comment was out of date. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	300aba61a6	ipn, cmd/tailscale/cli: add LocalAPI IPN bus watch, Start, convert CLI Updates #6417 Updates tailscale/corp#8051 Change-Id: I1ca360730c45ffaa0261d8422877304277fc5625 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	d4f6efa1df	ipn/ipnlocal: handle case when selected profile is deleted Profile keys are not deleted but are instead set to `nil` which results in getting a nil error and we were not handling that correctly. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	b45b948776	ipn/ipnlocal: call initTKALocked on backend start Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	aeb80bf8cb	ipn/ipnlocal,tka: generate a nonce for each TKA Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	6708f9a93f	cmd/tailscale,ipn: implement lock log command This commit implements `tailscale lock log [--limit N]`, which displays an ordered list of changes to network-lock state in a manner familiar to `git log`. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	ed1fae6c73	ipn/ipnlocal: always tx TKA sync after enablement By always firing off a sync after enablement, the control plane should know the node's TKA head at all times. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	0f7da5c7dc	ipn{,/ipnlocal}, client/tailscale: move Taildrop recv notifications to LocalAPI HTTP method Updates #6417 Change-Id: Iec544c477a0e5e9f1c6bf23555afec06255e2e22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	8d84178884	ipn/ipnlocal: stop storing serverURL in LocalBackend It's only read in a couple of places and we can read from Prefs directly. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	aeac4bc8e2	ipn/ipnlocal: account for currentUserID when iterating over knownProfiles We were not checking the currentUserID in all code paths that looped over knownProfiles. This only impacted multi-user Windows setups. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	18c7c3981a	ipn/ipnlocal: call checkPrefs in Start too We were not calling checkPrefs on `opts.Prefs` in (LocalBackend).Start(). Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	0480a925c1	ipn/ipnlocal: send Content-Security-Policy, etc to peerapi browser requests Updates tailscale/corp#7948 Change-Id: Ie70e0d042478338a37b7789ac63225193e47a524 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	b94b91c168	cmd/tailscale/cli: add ability to set short names for profiles This adds a `--nickname` flag to `tailscale login\|set`. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	575fd5f22b	ipn: add ability to name profiles Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	33520920c3	all: use strs.CutPrefix and strs.CutSuffix more Updates places where we use HasPrefix + TrimPrefix to use the combined function. Updates #5309 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	039ea51ca6	ipn/ipnlocal: add health warning for unstable builds Like the macOS About dialog. Change-Id: Ic27f091e66e29d5eebe4e195eda97ed331d748fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a26f23d949	ipn/ipnlocal: actually fill out PeerAPIURLs in PeerStatus The earlier `5f6d63936f` was not complete. Updates tailscale/corp#7515 Change-Id: I35efca51d1584c48ef6834a7d29cd42d7c943628 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
shayne	f52a6d1b8c	cmd/tailscale/cli, ipn: move serve CLI funcs on to ServeConfig (#6401 ) Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Tom DNetto	2a991a3541	ipn/{localapi,ipnserver}: set a CSP for ServeHTMLStatus, refactor host check Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	f1ad26f694	ipn/ipnlocal: strip NetworkLockKey from Prefs Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	dd50dcd067	ipn/ipnlocal: handle untagging nodes better We would end up with duplicate profiles for the node as the UserID would have chnaged. In order to correctly deduplicate profiles, we need to look at both the UserID and the NodeID. A single machine can only ever have 1 profile per NodeID and 1 profile per UserID. Note: UserID of a Node can change when the node is tagged/untagged, and the NodeID of a device can change when the node is deleted so we need to check for both. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	f18dde6ad1	ipn/ipnserver: validate Host header on debug ServeHTMLStatus status Updates tailscale/corp#7948 Change-Id: I3a8c64f353af1eeae620812b2700ce4af4fbbc88 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a13753ae1e	ipn/localapi: require POST to add a bugreport marker The LocalClient.BugReport method already sends it via POST. Updates tailscale/corp#7948 Change-Id: I98dbd558c99d4296d934baa5ebc97052c7413073 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
shayne	a97369f097	cmd/tailscale/cli: flesh out serve CLI and tests (#6304 ) Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Maisem Ali	5f6d63936f	ipn/ipnlocal: fill out PeerAPIURLs in PeerStatus Updates tailscale/corp#7515 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	cec48743fb	ipn/localapi: set security headers Change-Id: I028b6ab91229e2f824e5a69856ca9e1844f7486e Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Maisem Ali	1de64e89cd	ipn/ipnlocal: set Hostinfo.WireIngress when ingress enabled Optimization for control. Updates tailscale/corp#7515 Change-Id: Ie93b232ab3e543d53062b462bdc13e279176f7a9 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	b3da5de10f	ipn/localapi: also allow localhost as the LocalAPI host The Mac and iOS LocalAPI clients make requests to it. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	b0736fe6f7	ipn/ipnlocal: move selfNode from peerAPIServer to peerAPIHandler The peerAPIHandler is instantiated per PeerAPI call so it is guaranteed to have the latest selfNode. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	2f4fca65a1	ipn/ipnlocal: prevent duplicate profiles of the same user Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	e9c851b04b	ipn/ipnlocal: also accept service IP IPv6 literal in brackets for quad100 The fix in `4fc8538e2` was sufficient for IPv6. Browsers (can?) send the IPv6 literal, even without a port number, in brackets. Updates tailscale/corp#7948 Change-Id: I0e429d3de4df8429152c12f251ab140b0c8f6b77 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	296e712591	tailcfg: add CapabilityDebug Updates tailscale/corp#7948 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	1e78fc462c	ipn/ipnlocal: add some validation to PeerAPI Updates tailscale/corp#7948 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	22238d897b	all: standardize on PeerAPI Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	1b56acf513	ipn/ipnlocal: move LocalBackend.validPopBrowserURL empty check from caller I was too late with review feedback to `513780f4f8`. Updates tailscale/corp#7948 Change-Id: I8fa3b4eba4efaff591a2d0bfe6ab4795638b7c3a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	513780f4f8	ipn/ipnlocal: move URL validation to LocalBackend Updates tailscale/corp#7948 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	4caca8619e	ipn/localapi: serve files with application/octet-stream Content-Type Updates tailscale/corp#7948 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I5f570c04974598c7abae4017e4a7a0f63492c87c	2 years ago
Brad Fitzpatrick	4fc8538e2f	ipn/ipnlocal: check quad100 Host header in info page Updates tailscale/corp#7948 Change-Id: I0ab61c764bff9ba8afaf9070db73e971eb018477 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	49b0ce8180	ipn/ipnlocal: update profile on server sent profile changes We were not updating the LoginProfile.UserProfile when a netmap updated the UserProfile (e.g. when a node was tagged via the admin panel). Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	976e88d430	client/tailscale/apitype: add LocalAPIHost const, use it Removes duplication. Updates tailcale/corp#7948 Change-Id: I564c912ecfde31ba2293124bb1316e433c2a10f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6ea2d01626	ipn/ipnlocal: be more assertive about rules for applyPrefsToHostinfo (now Locked) The old docs were too cagey. Change-Id: I92c4fdc4165e7ca35c4537aebe51eb3604b56f6d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	d3878ecd62	ipn/ipnlocal: add client metrics for profile switching Updates #713 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	235309adc4	all: store NL keys per profile This moves the NetworkLock key from a dedicated StateKey to be part of the persist.Persist struct. This struct is stored as part for ipn.Prefs and is also the place where we store the NodeKey. It also moves the ChonkDir from "/tka" to "/tka-profile/<profile-id>". The rename was intentional to be able to delete the "/tka" dir if it exists. This means that we will have a unique key per profile, and a unique directory per profile. Note: `tailscale logout` will delete the entire profile, including any keys. It currently does not delete the ChonkDir. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	fe81ee62d7	ipn/ipnlocal: do controlclient.Shutdown in a different goroutine We do not need to wait for it to complete. And we might have to call Shutdown from callback from the controlclient which might already be holding a lock that Shutdown requires. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	42855d219b	ipn/ipnlocal: fix checks for node-key presence in TKA logic Found by tests in another repo. TKA code wasn't always checking enough to be sure a node-key was set for the current state. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Mihai Parparita	0cc65b4bbe	ipn/localapi: add LocalAPI endpoints for profile switching Exposes a REST-y API for interacting with the profile switching introduced in #6022. Updates #713 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Tom DNetto	3271daf7a3	cmd/tailscale,ipn: support disablement args in lock cli, implement disable * Support specifiying disablement values in lock init command * Support specifying rotation key in lock sign command * Implement lock disable command * Implement disablement-kdf command Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	7c285fe7ee	ipn/ipnlocal: fix error message typo in ingress peerapi handler Updates tailscale/corp#7515 Change-Id: I81edd7d9f8958eef61be71d3d34e545cd3347008 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3114eacbb8	ipn/ipnlocal: don't warn about serve listener failing on IPv6-less machines Fixes #6303 Change-Id: Ie1ce12938f68dfa0533246bbe3b9d7f3e749a243 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3f8e185003	health: add Warnable, move ownership of warnable items to callers The health package was turning into a rando dumping ground. Make a new Warnable type instead that callers can request an instance of, and then Set it locally in their code without the health package being aware of all the things that are warnable. (For plenty of things the health package will want to know details of how Tailscale works so it can better prioritize/suppress errors, but lots of the warnings are pretty leaf-y and unrelated) This just moves two of the health warnings. Can probably move more later. Change-Id: I51e50e46eb633f4e96ced503d3b18a1891de1452 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	b87cb2c4a5	ipn/ipnlocal: call restart backend on user changes This makes it so that the backend also restarts when users change, otherwise an extra call to Start was required. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	8e85227059	cmd/tailscale/cli: [set] handle selectively modifying routes/exit node Noticed this while debugging something else, we would reset all routes if either `--advertise-exit-node` or `--advertise-routes` were set. This handles correctly updating them. Also added tests. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	26d1fc867e	ipn/ipnlocal: delete profile on logout Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	9e70daad6f	ipn/ipnlocal: make TKA tests not have side effects It left the envknob turned on which meant that running all the tests in the package had different behavior than running just any one test. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
shayne	74e892cbc2	ipn/ipnlocal: listen to serve ports on netmap addrs (#6282 ) Updates tailscale/corp#7515 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Brad Fitzpatrick	08e110ebc5	cmd/tailscale: make "up", "status" warn if routes and --accept-routes off Example output: # Health check: # - Some peers are advertising routes but --accept-routes is false Also, move "tailscale status" health checks to the bottom, where they won't be lost in large netmaps. Updates #2053 Updates #6266 Change-Id: I5ae76a0cd69a452ce70063875cd7d974bfeb8f1a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	4c31183781	cmd/tailscale,ipn: minor fixes to tailscale lock commands * Fix broken add/remove key commands * Make lock status display whether the node is signed Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	ae18cd02c1	ipn: add AdvertisesExitNode and AdminPageURL accessors to PrefsView Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	6cc0036b40	ipn/ipnlocal: use updated prefs in tkaSyncIfNeeded Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	f00a49667d	control/controlclient: make Status.Persist a PersistView Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	4d330bac14	ipn/ipnlocal: add support for multiple user profiles Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	c9d6a9cb4d	ipn/ipnlocal: add optional TLS termination on proxied TCP connections Updates tailscale/corp#7515 Change-Id: Ib250fa20275971563adccfa72db48e0cec02b7a5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Pat Maddox	9bf3ef4167	ssh/tailssh: add Tailscale SSH (server) support on FreeBSD Change-Id: I607194b6ef99205e777f3df93a74ffe1a2e0344c Signed-off-by: Pat Maddox <pat@ratiopbc.com>	2 years ago
shayne	e3a66e4d2f	ipn/localapi: introduce get/set config for serve (#6243 ) Updates tailscale/corp#7515 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Brad Fitzpatrick	7b5866ac0a	ipn/ipnlocal: support serving files/directories too Updates tailscale/corp#7515 Change-Id: I7b4c924005274ba57763264313d70d2a0c55da30 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	7a07bc654b	ipn/localapi: rename /profile to /pprof Avoids name collision with profiles for user switching. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	d7bfef12cf	ipn/ipnlocal: support https+insecure:// backend proxy targets Updates tailscale/corp#7515 Change-Id: Ie50295c09e4a16959b37087d8165c4d7360db37f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	9dfb0916c2	ipn/ipnlocal, tailcfg: wire up ingress peerapi Updates tailscale/corp#7515 Co-authored-by: Shayne Sweeney <shayne@tailscale.com> Change-Id: I7eac7b4ac37fd8e8a9e0469594c1e9e7dd0da666 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Aaron Klotz	73b8968404	ipn/ipnlocal: ensure Persist information is saved to server mode start state Numerous issues have been filed concerning an inability to install and run Tailscale headlessly in unattended mode, particularly after rebooting. The server mode `Prefs` stored in `server-state.conf` were not being updated with `Persist` state once the node had been succesfully logged in. Users have been working around this by finagling with the GUI to make it force a state rewrite. This patch makes that unnecessary by ensuring the required server mode state is updated when prefs are updated by the control client. Fixes https://github.com/tailscale/tailscale/issues/3186 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago

... 2 3 4 5 6 ...

1121 Commits (47ffbffa97fb2203265dec2dc5eb44bc83379aa6)