3770 Commits (4b1e02057aa8a7fb4615c9e30f0e77b4f02e5e7f)

 

All Branches   

Search

Author	SHA1	Message	Date
Josh Bleecher Snyder	b486448ab9	go.toolchain.rev: bump to Go 1.17.7 ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	1b87e025e9	ssh/tailssh: move SSH code from wgengine/netstack to this new package ... Still largely incomplete, but in a better home now. Updates #3802 Change-Id: I46c5ffdeb12e306879af801b06266839157bc624 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Ross Zurowski	6d02a48d8d	ipn: add `TailnetStatus` field to `tailscale status --json` (#3865) ... We need to capture some tailnet-related information for some Docker features we're building. This exposes the tailnet name and MagicDNS information via `tailscale status --json`. Fixes tailscale/corp#3670 Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	3 years ago
Brad Fitzpatrick	c988bd6ed1	net/dns/resolvconffile: unify three /etc/resolv.conf parsers into new package ... Change-Id: I2120893ca802d12f1bd0407d49077d3672627d33 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	1dc4151f8b	logtail: add MustParsePublicID ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	8d6cf14456	net/dnscache: don't do bootstrap DNS lookup after most failed dials ... If we've already connected to a certain name's IP in the past, don't assume the problem was DNS related. That just puts unnecessarily load on our bootstrap DNS servers during regular restarts of Tailscale infrastructure components. Also, if we do do a bootstrap DNS lookup and it gives the same IP(s) that we already tried, don't try them again. Change-Id: I743e8991a7f957381b8e4c1508b8e9d0df1782fe Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Xe Iaso	b4947be0c8	scripts/installer: automagically run apt update (#3939) ... When running this script against a totally fresh out of the box Debian 11 image, sometimes it will fail to run because it doesn't have a package list cached. This patch adds an `apt-get update` to ensure that the local package cache is up to date. Signed-off-by: Xe Iaso <xe@tailscale.com>	3 years ago
Brad Fitzpatrick	01e8a152f7	ipn/ipnlocal: log most of Hostinfo once non-verbose at start-up ... Our previous Hostinfo logging was all as a side effect of telling control. And it got marked as verbose (as it was) This adds a one-time Hostinfo logging that's not verbose, early in start-up. Change-Id: I1896222b207457b9bb12ffa7cf361761fa4d3b3a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Charlotte Brandhorst-Satzkorn	2448c000b3	words: more hamsters, less hampsters (#3938) ... Spell hamster correctly, and add the name of a teeny tiny type of hamster, the Roborovski dwarf hamster. Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	3 years ago
Brad Fitzpatrick	903988b392	net/dnscache: refactor from func-y closure-y state to types & methods ... No behavior changes (intended, at least). This is in prep for future changes to this package, which would get too complicated in the current style. Change-Id: Ic260f8e34ae2f64f34819d4a56e38bee8d8ac5ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8267ea0f80	net/tstun: remove TODO that's done ... This TODO was both added and fixed in 506c727e3. As I recall, I wasn't originally going to do it because it seemed annoying, so I wrote the TODO, but then I felt bad about it and just did it, but forgot to remove the TODO. Change-Id: I8f3514809ad69b447c62bfeb0a703678c1aec9a3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8fe503057d	net/netutil: unify two oneConnListeners into a new package ... I was about to add a third copy, so unify them now instead. Change-Id: I3b93896aa1249b1250a6b1df4829d57717f2311a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5d9ab502f3	logtail: don't strip verbose level on upload ... For analysis of log spam. Bandwidth is ~unchanged from had we not stripped the "[vN] " from text; it just gets restructed intot he new "v":N, field. I guess it adds one byte. Updates #1548 Change-Id: Ie00a4e0d511066a33d10dc38d765d92b0b044697 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a19c110dd3	envknob: track, log env knobs in use ... Fixes #3921 Change-Id: I8186053b5c09c43f0358b4e7fdd131361a6d8f2e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2db6cd1025	ipn/ipnlocal, wgengine/magicsock, logpolicy: quiet more logs ... Updates #1548 Change-Id: Ied169f872e93be2857890211f2e018307d4aeadc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	be9d564c29	envknob: remove some stutter from error messages ... The strconv errors already stringified with the same. Change-Id: I6938c5653e9aafa6d9028d45fc26e39eb9ccbaea Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3a94ece30c	control/controlclient: remove dummy endpoint in endpoint stripping mode ... The TODO is done. Magicsock doesn't require any endpoints to create an *endpoint now. Verified both in code and empirically: I can use the env knob and access everything. Change-Id: I4fe7ed5b11c5c5e94b21ef3d77be149daeab998a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	86a902b201	all: adjust some log verbosity ... Updates #1548 Change-Id: Ia55f1b5dc7dfea09a08c90324226fb92cd10fa00 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	adda2d2a51	control/controlclient: select newer certificate ... If multiple certificates match when selecting a certificate, use the one issued the most recently (as determined by the NotBefore timestamp). This also adds some tests for the function that performs that comparison. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Brad Fitzpatrick	a80cef0c13	cmd/derper: fix regression from bootstrap DNS optimization ... The commit b9c92b90db earlier today caused a regression of serving an empty map always, as it was JSON marshalling an atomic.Value instead of the DNS entries map it just built. Change-Id: I9da3eeca132c6324462dedeaa7d002908557384b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	84046d6f7c	Revert "cmd/derper: stop setting content header in handleBootstrapDNS" ... Didn't help enough. We are setting another header anyway. Restore it. This reverts commit 60abeb027b. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	ec62217f52	cmd/derper: close connections once bootstrap DNS has been served ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	21358cf2f5	net/dns: slightly optimize dbusPing for non-dbus case [Linux] ... Avoid some work when D-Bus isn't running. Change-Id: I6f89bb75fdb24c13f61be9b400610772756db1ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	37e7a387ff	net/dns: remove some unused code for detecting systemd-resolved [Linux] ... Change-Id: I19c5fd2cdacfb9e5b688ccd9b4336ae4edffc445 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	15599323a1	net/dns: fix systemd-resolved detection race at boot ... If systemd-resolved is enabled but not running (or not yet running, such as early boot) and resolv.conf is old/dangling, we weren't detecting systemd-resolved. This moves its ping earlier, which will trigger it to start up and write its file. Updates #3362 (likely fixes) Updates #3531 (likely fixes) Change-Id: I6392944ac59f600571c43b8f7a677df224f2beed Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	60abeb027b	cmd/derper: stop setting content header in handleBootstrapDNS ... No one really cares. Its cost outweighs its usefulness. name old time/op new time/op delta HandleBootstrapDNS-10 105ns ± 4% 65ns ± 2% -37.68% (p=0.000 n=15+14) name old alloc/op new alloc/op delta HandleBootstrapDNS-10 416B ± 0% 0B -100.00% (p=0.000 n=15+15) name old allocs/op new allocs/op delta HandleBootstrapDNS-10 3.00 ± 0% 0.00 -100.00% (p=0.000 n=15+15) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	b9c92b90db	cmd/derper: optimize handleBootstrapDNS ... Do json formatting once, rather than on every request. Use an atomic.Value. name old time/op new time/op delta HandleBootstrapDNS-10 6.35µs ± 0% 0.10µs ± 4% -98.35% (p=0.000 n=14+15) name old alloc/op new alloc/op delta HandleBootstrapDNS-10 3.20kB ± 0% 0.42kB ± 0% -86.99% (p=0.000 n=12+15) name old allocs/op new allocs/op delta HandleBootstrapDNS-10 41.0 ± 0% 3.0 ± 0% -92.68% (p=0.000 n=15+15) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	e206a3663f	cmd/derper: add BenchmarkHandleBootstrapDNS ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Joe Tsai	0173a50bf0	cmd/derper: add a rate limiter for accepting new connection (#3908) ... A large influx of new connections can bring down DERP since it spins off a new goroutine for each connection, where each routine may do significant amount of work (e.g., allocating memory and crunching numbers for TLS crypto). The momentary spike can cause the process to OOM. This commit sets the groundwork for limiting connections, but leaves the limit at infinite by default. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Denton Gentry	dbea8217ac	net/dns: add NetworkManager regression test ... Use the exact /etc/resolv.conf file from a user report. Updates https://github.com/tailscale/tailscale/issues/3531 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Aaron Klotz	82cd98609f	util/winutil: migrate corp's winutil into OSS. ... It makes the most sense to have all our utility functions reside in one place. There was nothing in corp that could not reasonably live in OSS. I also updated `StartProcessAsChild` to no longer depend on `futureexec`, thus reducing the amount of code that needed migration. I tested this change with `tswin` and it is working correctly. I have a follow-up PR to remove the corresponding code from corp. The migrated code was mostly written by @alexbrainman. Sourced from corp revision 03e90cfcc4dd7b8bc9b25eb13a26ec3a24ae0ef9 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Jay Stapleton	39d173e5fc	add -y flag for xbps to allow installation on void ... Signed-off-by: Jay Stapleton <jay@tailscale.com>	3 years ago
Jay Stapleton	c8551c8a67	add -y flag for xbps to allow installation on void	3 years ago
Aaron Klotz	3a74f2d2d7	cmd/tailscaled, util/winutil: add accessor functions for Windows system policies. ... This patch adds new functions to be used when accessing system policies, and revises callers to use the new functions. They first attempt the new registry path for policies, and if that fails, attempt to fall back to the legacy path. We keep non-policy variants of these functions because we should be able to retain the ability to read settings from locations that are not exposed to sysadmins for group policy edits. The remaining changes will be done in corp. Updates https://github.com/tailscale/tailscale/issues/3584 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	24c9dbd129	tsweb: fix JSONHandlerFunc regression where HTTP status was lost on gzip ... Change-Id: Ia7add6cf7e8b46bb6dd45bd3c0371ea79402fb45 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Xe Iaso	62db629227	words: add ferret to tails.txt (#3897) ... In honor of this post[1] inspiring me to remember that ferrets exist and have tails. [1]: https://tech.davidfield.co.uk/what-is-tailscale/ Signed-off-by: Xe <xe@tailscale.com>	3 years ago
Brad Fitzpatrick	3c481d6b18	cmd/tailscale: add "tailscale configure-host" to prep a Synology machine at boot ... Updates #3761 Change-Id: Ib5ab9a4808ade074f48d3abee22c57d7670f9e21 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b3d268c5a1	control/controlclient: turn off Go's implicit compression ... We don't use it anyway, so be explicit that we're not using it. Change-Id: Iec953271ef0169a2e227811932f5b65b479624af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	df8f02db3f	tsweb: add gzip support to JSONHandlerFunc ... Change-Id: I337e05f92f744bfc7e9d6fb8e67c87c191ba4da8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	16652ae52c	installer.sh: accommodate linuxmint versioning. ... Recent linuxmint releases now use VERSION_CODENAME for a linuxmint release (like "uma") and set UBUNTU_CODENAME to the Ubuntu release they branched from. Tested in a linuxmint 20.2 VM. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Sonia Appasamy	aaba49ca10	api.md: add docs for device tags and keys endpoints ... Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	3 years ago
Maisem Ali	e64cecac8e	chirp: remove regex dependency ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	2a67beaacf	net/interfaces: bound Linux /proc/net/route parsing ... tailscaled was using 100% CPU on a machine with ~1M lines, 100MB+ of /proc/net/route data. Two problems: in likelyHomeRouterIPLinux, we didn't stop reading the file once we found the default route (which is on the first non-header line when present). Which meant it was finding the answer and then parsing 100MB over 1M lines unnecessarily. Second was that if the default route isn't present, it'd read to the end of the file looking for it. If it's not in the first 1,000 lines, it ain't coming, or at least isn't worth having. (it's only used for discovering a potential UPnP/PMP/PCP server, which is very unlikely to be present in the environment of a machine with a ton of routes) Change-Id: I2c4a291ab7f26aedc13885d79237b8f05c2fd8e4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0626cf4183	util/winutil: fix build ... It was broken on Windows: Error: util\winutil\winutil_windows.go:15:7: regBase redeclared in this block Error: D:\a\tailscale\tailscale\util\winutil\winutil_notwindows.go:7:17: previous declaration Error: util\winutil\winutil_windows.go:29:6: getRegString redeclared in this block Error: D:\a\tailscale\tailscale\util\winutil\winutil_notwindows.go:9:40: previous declaration Error: util\winutil\winutil_windows.go:47:6: getRegInteger redeclared in this block Error: D:\a\tailscale\tailscale\util\winutil\winutil_notwindows.go:11:48: previous declaration Error: util\winutil\winutil_windows.go:77:6: isSIDValidPrincipal redeclared in this block Error: D:\a\tailscale\tailscale\util\winutil\winutil_notwindows.go:13:38: previous declaration Change-Id: Ib1ce4b647f5711547840c736b933a6c42bf09583 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Klotz	d7962e3bcf	ipn/ipnserver, util/winutil: update workaround for os/user.LookupId failures on Windows to reject SIDs from deleted/invalid security principals. ... Our current workaround made the user check too lax, thus allowing deleted users. This patch adds a helper function to winutil that checks that the uid's SID represents a valid Windows security principal. Now if `lookupUserFromID` determines that the SID is invalid, we simply propagate the error. Updates https://github.com/tailscale/tailscale/issues/869 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	6eed2811b2	wgengine/netstack: start supporting different SSH users ... Updates #3802 Change-Id: I44de6897e36b1362cd74c9b10c9cbfeb9abc3dbc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	e3dccfd7ff	chirp: handle multiline responses from BIRD ... Also add tests to verify the parsing logic. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	fa612c28cf	cmd/derper: make --stun default to on, flesh out flag docs ... Change-Id: I49e80c61ab19e78e4c8b4bc9012bb70cfe3bfa75 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Bieber	e5cd765e00	net/dns/resolvd: properly handle not having "search" entries ... This prevents adding an empty "search" line when no search domains are set. Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>	3 years ago
Brad Fitzpatrick	bd90781b34	ipn/ipnlocal, wgengine/netstack: use netstack for peerapi server ... We're finding a bunch of host operating systems/firewalls interact poorly with peerapi. We either get ICMP errors from the host or users need to run commands to allow the peerapi port: https://github.com/tailscale/tailscale/issues/3842#issuecomment-1025133727 ... even though the peerapi should be an internal implementation detail. Rather than fight the host OS & firewalls, this change handles the server side of peerapi entirely in netstack (except on iOS), so it never makes its way to the host OS where it might be messed with. Two main downsides are: 1) netstack isn't as fast, but we don't really need speed for peerapi. And actually, with fewer trips to/from the kernel, we might actually make up for some of the netstack performance loss by staying in userspace. 2) tcpdump / Wireshark etc packet captures will no longer see the peerapi traffic. Oh well. Crawshaw's been wanting to add packet capture server support to tailscaled, so we'll probably do that sooner now. A future change might also then use peerapi for the client-side (except on iOS). Updates #3842 (probably fixes, as well as many exit node issues I bet) Change-Id: Ibc25edbb895dc083d1f07bd3cab614134705aa39 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago