8364 Commits (48343ee6738548dd85e908ea14d5f69338123ec1)

 

All Branches   

Search

Author	SHA1	Message	Date
Irbe Krumina	d6dfb7f242	kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: split out kube types (#13417) ... Further split kube package into kube/{client,api,types}. This is so that consumers who only need constants/static types don't have to import the client and api bits. Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2 months ago
Irbe Krumina	ecd64f6ed9	cmd/k8s-operator,kube: set app name for Kubernetes Operator proxies (#13410) ... Updates tailscale/corp#22920 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	3 months ago
Nick Khyl	4dfde7bffc	net/dns: disable DNS registration for Tailscale interface on Windows ... We already disable dynamic updates by setting DisableDynamicUpdate to 1 for the Tailscale interface. However, this does not prevent non-dynamic DNS registration from happening when `ipconfig /registerdns` runs and in similar scenarios. Notably, dns/windowsManager.SetDNS runs `ipconfig /registerdns`, triggering DNS registration for all interfaces that do not explicitly disable it. In this PR, we update dns/windowsManager.disableDynamicUpdates to also set RegistrationEnabled to 0. Fixes #13411 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago
Irbe Krumina	2b0d0ddf5d	sessionrecording,ssh/tailssh,k8s-operator: log connected recorder address (#13382) ... Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	3 months ago
Patrick O'Doherty	7ce9c1944a	go.toolchain.rev: update to 1.23.1 (#13408) ... Update Go toolchain to 1.23.1. Updates #cleanup Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>	3 months ago
Brad Fitzpatrick	71ff3d7c39	go.mod: bump github.com/illarion/gonotify/v2 ... Updates #13359 Change-Id: I28e048bf9d1d114d07d140f165f4ea89a82be79f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Jordan Whited	95f0094310	cmd/stunstamp: cleanup timeout and interval constants (#13393) ... Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Nick Khyl	e7b5e8c8cd	ipn/ipnserver: remove IdleTimeout ... We no longer need this on Windows, and it was never required on other platforms. It just results in more short-lived connections unless we use HTTP/2. Updates tailscale/corp#18342 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago
Andrew Lytvynov	e7a6e7930f	cmd/systray: handle reconnects to IPN bus (#13386) ... When tailscaled restarts and our watch connection goes down, we get stuck in an infinite loop printing `ipnbus error: EOF` (which ended up consuming all the disk space on my laptop via the log file). Instead, handle errors in `watchIPNBus` and reconnect after a short delay. Updates #1708 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	3 months ago
Flakes Updater	4f2a2bfa42	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	3 months ago
Jordan Whited	7aa766ee65	net/tstun: probe TCP GRO (#13376) ... Disable TCP & UDP GRO if the probe fails. torvalds/linux@e269d79c7d broke virtio_net TCP & UDP GRO causing GRO writes to return EINVAL. The bug was then resolved later in torvalds/linux@89add40066. The offending commit was pulled into various LTS releases. Updates #13041 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Andrew Dunham	7dcf65a10a	net/dns: fix IsZero and Equal methods on OSConfig ... Discovered this while investigating the following issue; I think it's unrelated, but might as well fix it. Also, add a test helper for checking things that have an IsZero method using the reflect package. Updates tailscale/support-escalations#55 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I57b7adde43bcef9483763b561da173b4c35f49e2	3 months ago
Brad Fitzpatrick	13dee9db7b	health: fix magicsockReceiveFuncWarnable health clearing ... Fixes #13204 Change-Id: I7154cdabc9dc362dcc3221fd5a86e21f610bbff0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Brad Fitzpatrick	3d401c11fa	all: use new Go 1.23 slices.Sorted more ... Updates #12912 Change-Id: If1294e5bc7b5d3cf0067535ae10db75e8b988d8b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Anton Tolchanov	fd6686d81a	tka: truncate long rotation signature chains ... When a rotation signature chain reaches a certain size, remove the oldest rotation signature from the chain before wrapping it in a new rotation signature. Since all previous rotation signatures are signed by the same wrapping pubkey (node's own tailnet lock key), the node can re-construct the chain, re-signing previous rotation signatures. This will satisfy the existing certificate validation logic. Updates #13185 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 months ago
Brad Fitzpatrick	bcc47d91ca	cmd/tailscale/cli: use new Go 1.23 slices.Sorted ... And a grammatical nit. Updates #12912 Change-Id: I9feae53beb4d28dfe98b583373e2e0a43c801fc4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Nick Khyl	11d205f6c4	control/controlclient,posture,util/syspolicy: use predefined syspolicy keys instead of string literals ... With the upcoming syspolicy changes, it's imperative that all syspolicy keys are defined in the syspolicy package for proper registration. Otherwise, the corresponding policy settings will not be read. This updates a couple of places where we still use string literals rather than syspolicy consts. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago
Andrea Gottardo	d060b3fa02	cli: implement `tailscale dns status` (#13353) ... Updates tailscale/tailscale#13326 This PR begins implementing a `tailscale dns` command group in the Tailscale CLI. It provides an initial implementation of `tailscale dns status` which dumps the state of the internal DNS forwarder. Two new endpoints were added in LocalAPI to support the CLI functionality: - `/netmap`: dumps a copy of the last received network map (because the CLI shouldn't have to listen to the ipn bus for a copy) - `/dns-osconfig`: dumps the OS DNS configuration (this will be very handy for the UI clients as well, as they currently do not display this information) My plan is to implement other subcommands mentioned in tailscale/tailscale#13326, such as `query`, in later PRs. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	3 months ago
Nick Khyl	5bc9fafab8	ipn/ipnlocal: always send auth URL notifications when a user requests interactive login ... This PR changes how LocalBackend handles interactive (initiated via StartLoginInteractive) and non-interactive (e.g., due to key expiration) logins, and when it sends the authURL to the connected clients. Specifically, - When a user initiates an interactive login by clicking Log In in the GUI, the LocalAPI calls StartLoginInteractive. If an authURL is available and hasn't expired, we immediately send it to all connected clients, suggesting them to open that URL in a browser. Otherwise, we send a login request to the control plane and set a flag indicating that an interactive login is in progress. - When LocalBackend receives an authURL from the control plane, we check if it differs from the previous one and whether an interactive login is in progress. If either condition is true, we notify all connected clients with the new authURL and reset the interactive login flag. We reset the auth URL and flags upon a successful authentication, when a different user logs in and when switching Tailscale login profiles. Finally, we remove the redundant dedup logic added to WatchNotifications in #12096 and revert the tests to their original state to ensure that calling StartLoginInteractive always produces BrowseToURL notifications, either immediately or when the authURL is received from the control plane. Fixes #13296 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago
Andrea Gottardo	0112da6070	net/dns: support GetBaseConfig on Darwin OSS tailscaled (#13351) ... Updates tailscale/tailscale#177 It appears that the OSS distribution of `tailscaled` is currently unable to get the current system base DNS configuration, as GetBaseConfig() in manager_darwin.go is unimplemented. This PR adds a basic implementation that reads the current values in `/etc/resolv.conf`, to at least unblock DNS resolution via Quad100 if `--accept-dns` is enabled. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	3 months ago
Jordan Whited	1fc4268aea	cmd/stunstamp: increase probe jitter (#13362) ... We've added more probe targets recently which has resulted in more timeouts behind restrictive NATs in localized testing that don't like how many flows we are creating at once. Not so much an issue for datacenter or cloud-hosted deployments. Updates tailscale/corp#22114 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Jordan Whited	1dd1798bfa	cmd/stunstamp: use measureFn more consistently in naming/signatures (#13360) ... Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Jordan Whited	6d6b1773ea	cmd/stunstamp: implement ICMP{v6} probing (#13354) ... This adds both userspace and kernel timestamping. Updates tailscale/corp#22114 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Brad Fitzpatrick	c4d0237e5c	tstest/natlab: add dual stack with blackholed IPv4 ... This reproduces the bug report from https://github.com/tailscale/tailscale/issues/13346 It does not yet fix it. Updates #13346 Change-Id: Ia5af7b0481a64a37efe259c798facdda6d9da618 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Nick Khyl	aeb15dea30	util/syspolicy/source: add package for reading policy settings from external stores ... We add package defining interfaces for policy stores, enabling creation of policy sources and reading settings from them. It includes a Windows-specific PlatformPolicyStore for GP and MDM policies stored in the Registry, and an in-memory TestStore for testing purposes. We also include an internal package that tracks and reports policy usage metrics when a policy setting is read from a store. Initially, it will be used only on Windows and Android, as macOS, iOS, and tvOS report their own metrics. However, we plan to use it across all platforms eventually. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago
Brad Fitzpatrick	e865a0e2b0	cmd/tailscale/cli: add 'debug go-buildinfo' subcommand ... To dump runtime/debug.BuildInfo. Updates #1866 Change-Id: I8810390858a03b7649f9b22ef3ab910d423388da Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Seaver Thorn	345876da33	client/tailscale: adding missing proto field in ACL parsing structures (#13051) ... Signed-off-by: Seaver Thorn <swthorn@ncsu.edu>	3 months ago
Irbe Krumina	8e1c00f841	cmd/k8s-operator,k8s-operator/sessionrecording: ensure recording header contains terminal size for terminal sessions (#12965) ... * cmd/k8s-operator,k8s-operator/sessonrecording: ensure CastHeader contains terminal size For tsrecorder to be able to play session recordings, the recording's CastHeader must have '.Width' and '.Height' fields set to non-zero. Kubectl (or whoever is the client that initiates the 'kubectl exec' session recording) sends the terminal dimensions in a resize message that the API server proxy can intercept, however that races with the first server message that we need to record. This PR ensures we wait for the terminal dimensions to be processed from the first resize message before any other data is sent, so that for all sessions with terminal attached, the header of the session recording contains the terminal dimensions and the recording can be played by tsrecorder. Updates tailscale/tailscale#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	3 months ago
Andrew Dunham	1c972bc7cb	wgengine/magicsock: actually use AF_PACKET socket for raw disco ... Previously, despite what the commit said, we were using a raw IP socket that was *not* an AF_PACKET socket, and thus was subject to the host firewall rules. Switch to using a real AF_PACKET socket to actually get the functionality we want. Updates #13140 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If657daeeda9ab8d967e75a4f049c66e2bca54b78	3 months ago
Brad Fitzpatrick	eb2fa16fcc	tailcfg: bump capver for earlier cryptokey panic fix [capver 106] ... I should've bumped capver in 65fe0ba7b5 but forgot. This lets us turn off the cryptokey routing change from control for the affected panicky range of commits, based on capver. Updates #13332 Updates tailscale/corp#20732 Change-Id: I32c17cfcb45b2369b2b560032330551d47a0ce0b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Brad Fitzpatrick	20cf48b8dd	gokrazy{,/natlabapp.arm64}: start adding arm64 appliance support ... Both for Raspberry Pis, and for running natlab tests faster on Apple Silicon Macs without emulating x86. Not fully wired up yet. Updates #1866 Updates #13038 Change-Id: I1552bf107069308f325f640773cc881ed735b5ab Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Brad Fitzpatrick	65fe0ba7b5	wgengine/magicsock: fix panic regression from cryptokey routing change ... Fixes #13332 Updates tailscale/corp#20732 Change-Id: I30f12746844bf77f5a664bf8e8d8ebf2511a2b27 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Nick Khyl	2f2aeaeaeb	ipn/ipnlocal: fix a nil pointer dereference when serving /localapi/v0/tka/status ... Fixes #13330 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago
Brad Fitzpatrick	3d9e3a17fa	tstest/natlab/vnet: move some boilerplate to mkPacket helper ... No need to make callers specify the redundant IP version or TTL/HopLimit or EthernetType in the common case. The mkPacket helper can set those when unset. And use the mkIPLayer in another place, simplifying some code. And rename mkPacketErr to just mkPacket, then move mkPacket to test-only code, as mustPacket. Updates #13038 Change-Id: Ic216e44dda760c69ab9bfc509370040874a47d30 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Brad Fitzpatrick	7e88d6712e	tstest/natlab/vnet: add syslog tests ... Updates #13038 Change-Id: I4ac96cb0a9e46a2fb1e09ddedd3614eb006c2c8c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Brad Fitzpatrick	b1a5b40318	tstest/natlab/vnet: add DHCP tests, ignore DHCPv4 on v6-only networks ... And clean up some of the test helpers in the process. Updates #13038 Change-Id: I3e2b5f7028a32d97af7f91941e59399a8e222b25 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Brad Fitzpatrick	ffa1c93f59	tstest/natlab/vnet: use mkPacketErr in more places ... I'd added this helper for tests, but then moved it to non-test code and forgot some places to use it. This uses it in more places to remove some boilerplate. Updates #13038 Change-Id: Ic4dc339be1c47a55b71d806bab421097ee3d75ed Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Anton Tolchanov	109d0891e1	posture: stop logging serial numbers ... Logging serial numbers every time they are read might have been useful early on, but seems unnecessary now. Updates #5902 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 months ago
Nick Khyl	959285e0c5	ipn/ipnlocal: fix race condition that results in a panic sending on a closed channel ... Fixes #13288 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago
Percy Wegmann	35423fcf69	drive/driveimpl: use su instead of sudo ... This allows Taildrive to work on systems like Busybox that don't have sudo. Fixes #12282 Signed-off-by: Percy Wegmann <percy@tailscale.com>	3 months ago
Jordan Whited	45c97751fb	net/tstun: clarify GROFilterFunc *gro.GRO usage (#13318) ... Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Percy Wegmann	ecc451501c	ssh/tailssh: add ability to force V2 behavior using new feature flag ... Introduces ssh-behavior-v2 node attribute to override ssh-behavior-v1. Updates #11854 Signed-off-by: Percy Wegmann <percy@tailscale.com>	3 months ago
Andrea Gottardo	a584d04f8a	dns: increase TimeToVisible before DNS unavailable warning (#13317) ... Updates tailscale/tailscale#13314 Some users are reporting 'DNS unavailable' spurious (?) warnings, especially on Android: https://old.reddit.com/r/Tailscale/comments/1f2ow3w/health_warning_dns_unavailable_on_tailscale/ https://old.reddit.com/r/Tailscale/comments/1f3l2il/health_warnings_dns_unavailable_what_does_it_mean/ I suspect this is caused by having a too low TimeToVisible setting on the Warnable, which triggers the unhealthy state during slow network transitions. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	3 months ago
Jordan Whited	0926954cf5	net/tstun,wgengine/netstack: implement TCP GRO for local services (#13315) ... Throughput improves substantially when measured via netstack loopback (TS_DEBUG_NETSTACK_LOOPBACK_PORT). Before (d21ebc2): jwhited@i5-12400-2:~$ iperf3 -V -c 100.100.100.100 Starting Test: protocol: TCP, 1 streams, 131072 byte blocks Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 5.77 GBytes 4.95 Gbits/sec 0 sender [ 5] 0.00-10.01 sec 5.77 GBytes 4.95 Gbits/sec receiver After: jwhited@i5-12400-2:~$ iperf3 -V -c 100.100.100.100 Starting Test: protocol: TCP, 1 streams, 131072 byte blocks Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 12.7 GBytes 10.9 Gbits/sec 0 sender [ 5] 0.00-10.00 sec 12.7 GBytes 10.9 Gbits/sec receiver Updates tailscale/corp#22754 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Jordan Whited	71acf87830	tstest/integration: add UDP netstack loopback integration test (#13312) ... Updates tailscale/corp#22713 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Kristoffer Dalby	e93c160a39	nix: update nix and use go 1.23 ... Updates #12912 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	3 months ago
Nick Khyl	b48c8db69c	ipn/ipnlocal: set WantRunning upon an interactive login, but not during a seamless renewal or a profile switch ... The LocalBackend's state machine starts in NoState and soon transitions to NeedsLogin if there's no auto-start profile, with the profileManager starting with a new empty profile. Notably, entering the NeedsLogin state blocks engine updates. We expect the user to transition out of this state by logging in interactively, and we set WantRunning to true when controlclient enters the StateAuthenticated state. While our intention is correct, and completing an interactive login should set WantRunning to true, our assumption that logging into the current Tailscale profile is the only way to transition out of the NeedsLogin state is not accurate. Another common transition path includes an explicit profile switch (via LocalBackend.SwitchProfile) or an implicit switch when a Windows user connects to the backend. This results in a bug where WantRunning is set to true even when it was previously set to false, and the user expressed no intention of changing it. A similar issue occurs when switching from (sic) a Tailnet that has seamlessRenewalEnabled, regardless of the current state of the LocalBackend's state machine, and also results in unexpectedly set WantRunning. While this behavior is generally undesired, it is also incorrect that it depends on the control knobs of the Tailnet we're switching from rather than the Tailnet we're switching to. However, this issue needs to be addressed separately. This PR updates LocalBackend.SetControlClientStatus to only set WantRunning to true in response to an interactive login as indicated by a non-empty authURL. Fixes #6668 Fixes #11280 Updates #12756 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago
Brad Fitzpatrick	82c2c5c597	tstest/natlab/vnet: add more tests ... This adds tests for DNS requests, and ignoring IPv6 packets on v4-only networks. No behavior changes. But some things are pulled out into functions. And the mkPacket helpers previously just for tests are moved into non-test code to be used elsewhere to reduce duplication, doing the checksum stuff automatically. Updates #13038 Change-Id: I4dd0b73c75b2b9567b4be3f05a2792999d83f6a3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 months ago
Jordan Whited	d21ebc28af	wgengine/netstack: implement netstack loopback (#13301) ... When the TS_DEBUG_NETSTACK_LOOPBACK_PORT environment variable is set, netstack will loop back (dnat to addressFamilyLoopback:loopbackPort) TCP & UDP flows originally destined to localServicesIP:loopbackPort. localServicesIP is quad-100 or the IPv6 equivalent. Updates tailscale/corp#22713 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 months ago
Nick Khyl	80b2b45d60	ipn/ipnlocal: refactor and cleanup profileManager ... In preparation for multi-user and unattended mode improvements, we are refactoring and cleaning up `ipn/ipnlocal.profileManager`. The concept of the "current user", which is only relevant on Windows, is being deprecated and will soon be removed to allow more than one Windows user to connect and utilize `LocalBackend` according to that user's access rights to the device and specific Tailscale profiles. We plan to pass the user's identity down to the `profileManager`, where it can be used to determine the user's access rights to a given `LoginProfile`. While the new permission model in `ipnauth` requires more work and is currently blocked pending PR reviews, we are updating the `profileManager` to reduce its reliance on the concept of a single OS user being connected to the backend at the same time. We extract the switching to the default Tailscale profile, which may also trigger legacy profile migration, from `profileManager.SetCurrentUserID`. This introduces `profileManager.DefaultUserProfileID`, which returns the default profile ID for the current user, and `profileManager.SwitchToDefaultProfile`, which is essentially a shorthand for `pm.SwitchProfile(pm.DefaultUserProfileID())`. Both methods will eventually be updated to accept the user's identity and utilize that user's default profile. We make access checks more explicit by introducing the `profileManager.checkProfileAccess` method. The current implementation continues to use `profileManager.currentUserID` and `LoginProfile.LocalUserID` to determine whether access to a given profile should be granted. This will be updated to utilize the `ipnauth` package and the new permissions model once it's ready. We also expand access checks to be used more widely in the `profileManager`, not just when switching or listing profiles. This includes access checks in methods like `SetPrefs` and, most notably, `DeleteProfile` and `DeleteAllProfiles`, preventing unprivileged Windows users from deleting Tailscale profiles owned by other users on the same device, including profiles owned by local admins. We extract `profileManager.ProfilePrefs` and `profileManager.SetProfilePrefs` methods that can be used to get and set preferences of a given `LoginProfile` if `profileManager.checkProfileAccess` permits access to it. We also update `profileManager.setUnattendedModeAsConfigured` to always enable unattended mode on Windows if `Prefs.ForceDaemon` is true in the current `LoginProfile`, even if `profileManager.currentUserID` is `""`. This facilitates enabling unattended mode via `tailscale up --unattended` even if `tailscale-ipn.exe` is not running, such as when a Group Policy or MDM-deployed script runs at boot time, or when Tailscale is used on a Server Code or otherwise headless Windows environments. See #12239, #2137, #3186 and https://github.com/tailscale/tailscale/pull/6255#issuecomment-2016623838 for details. Fixes #12239 Updates tailscale/corp#18342 Updates #3186 Updates #2137 Signed-off-by: Nick Khyl <nickk@tailscale.com>	3 months ago