4058 Commits (4d85cf586bd89713846d2787f04430e7b592ae38)

 

All Branches   

Search

Author	SHA1	Message	Date
Brad Fitzpatrick	46cb9d98a3	api.md: update GET tailnet key detail docs to show preauthorized, tags ... Fixes #4571 Change-Id: If81471d0d8cb2f659736991ad8612aed2efc174e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c1445155ef	ssh/tailssh: handle Control-C during hold-and-delegate prompt ... Fixes #4549 Change-Id: Iafc61af5e08cd03564d39cf667e940b2417714cc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	f9e86e64b7	*: use WireGuard where logged, printed or named ... Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	2d1849a7b9	tsweb: remove JSONHandlerFunc ... It's unused and we've decided it's not what we want. Change-Id: I425a0104e8869630b498a0adfd0f455876d6f92b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Charlotte Brandhorst-Satzkorn	7ee3068f9d	words: after a Series of discussions, Bees should be included (#4606) ... There has been a lot of talk about Bees at Tailscale recently, and naturally, with it being Tailscale, we thought to ourselves: Do Bees have a tail and/or scales? Tailscale has a long track record of scientific rigor around the validity of the inclusions on the tails and scales list, and this time will be no exception. Our research has found that Bees, in particular the Honey Bee, produces wax scales on their abdomens and thus should be included. As for tails; 'Stabby-tails' - Tailscale Employee, 2022 No further justification needed, it will be included. This change includes Bee in both tails.txt and scales.txt. Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	3 years ago
Brad Fitzpatrick	3e1f2d01f7	ipn/ipnlocal: move Ping method from IPN bus to LocalBackend (HTTP) ... Change-Id: I61759f1dae8d9d446353db54c8b1e13bfffb3287 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	c60cbca371	control/controlclient: store netinfo and hostinfo separately ... Currently, when SetNetInfo is called it sets the value on hostinfo.NetInfo. However, when SetHostInfo is called it overwrites the hostinfo field which may mean it also clears out the NetInfo it had just received. This commit stores NetInfo separately and combines it into Hostinfo as needed so that control is always notified of the latest values. Also, remove unused copies of Hostinfo from ipn.Status and controlclient.Auto. Updates #tailscale/corp#4824 (maybe fixes) Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
James Tucker	ae483d3446	wgengine, net/packet, cmd/tailscale: add ICMP echo ... Updates tailscale/corp#754 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	66f9292835	client/tailscale: update Client API a bit ... Change-Id: I81aa29a8b042a247eac1941038f5d90259569941 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	512573598a	tailcfg: remove some documented DebugFlags that no longer exist ... Update tailscale/corp#5007 Change-Id: I3ce5b1c4cd367bae769a5f5a301925a2dac1b3a6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Tom DNetto	2a0b5c21d2	net/dns/{., resolver}, wgengine: fix goroutine leak on shutdown ... Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Tom DNetto	7f45734663	assorted: documentation and readability fixes ... This were intended to be pushed to #4408, but in my excitement I forgot to git push :/ better late than never. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Tom DNetto	9e77660931	net/tstun,wgengine/{.,netstack}: handle UDP magicDNS traffic in netstack ... This change wires netstack with a hook for traffic coming from the host into the tun, allowing interception and handling of traffic to quad-100. With this hook wired, magicDNS queries over UDP are now handled within netstack. The existing logic in wgengine to handle magicDNS remains for now, but its hook operates after the netstack hook so the netstack implementation takes precedence. This is done in case we need to support platforms with netstack longer than expected. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Tom DNetto	dc71d3559f	net/tstun,wgengine: split PreFilterOut into multiple hooks ... A subsequent commit implements handling of magicDNS traffic via netstack. Implementing this requires a hook for traffic originating from the host and hitting the tun, so we make another hook to support this. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Tom DNetto	9dee6adfab	cmd/tailscaled,ipn/ipnlocal,wgengine/...: pass dns.Manager into netstack ... Needed for a following commit which moves magicDNS handling into netstack. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Tom DNetto	5b85f848dd	net/dns,net/dns/resolver: refactor channels/magicDNS out of Resolver ... Moves magicDNS-specific handling out of Resolver & into dns.Manager. This greatly simplifies the Resolver to solely issuing queries and returning responses, without channels. Enforcement of max number of in-flight magicDNS queries, assembly of synthetic UDP datagrams, and integration with wgengine for recieving/responding to magicDNS traffic is now entirely in Manager. This path is being kept around, but ultimately aims to be deleted and replaced with a netstack-based path. This commit is part of a series to implement magicDNS using netstack. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	a54671529b	client/tailscale: move API client for the control admin API ... This was work done Nov-Dec 2020 by @c22wen and @chungdaniel. This is just moving it to another repo. Co-Authored-By: Christina Wen <37028905+c22wen@users.noreply.github.com> Co-Authored-By: Christina Wen <christina@tailscale.com> Co-Authored-By: Daniel Chung <chungdaniel@users.noreply.github.com> Co-Authored-By: Daniel Chung <daniel@tailscale.com> Change-Id: I6da3b05b972b54771f796b5be82de5aa463635ca Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e3619b890c	client/tailscale: rename tailscale.go -> localclient.go ... In prep for other stuff. Change-Id: I82c24946d062d668cab48ca6749776b6ae7025ac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	3012a2e1ca	ssh/tailssh,ipn/ipnlocal: terminate any active sessions on `up --ssh=false` ... Currently the ssh session isn't terminated cleanly, instead the packets are just are no longer routed to the in-proc SSH server. This makes it so that clients get a disconnection when the `RunSSH` pref changes to `false`. Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Mihai Parparita	2ec371fe8b	ipn: remove FakeExpireAfter Backend function ... No callers remain (last one was removed with tailscale/corp@1c095ae08f), and it's pretty esoteric. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Aaron Klotz	d915e0054c	cmd/tailscaled: change Windows service shutdown and add optional event logging ... Once a stop request is received and the service updates its status to `svc.StopPending`, it should continue running *until the shutdown sequence is complete*, and then return out of `(*ipnService).Execute`, which automatically sends a `svc.Stopped` notification to Windows. To make this happen, I changed the loop so that it runs until `doneCh` is closed, and then returns. I also removed a spurious `svc.StopPending` notification that the Windows Service Control Manager might be interpreting as a request for more time to shut down. Finally, I added some optional logging that sends a record of service notifications to the Windows event log, allowing us to more easily correlate with any Service Control Manager errors that are sent to the same log. Change-Id: I5b596122e5e89c4c655fe747a612a52cb4e8f1e0 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Mihai Parparita	316523cc1e	ipn: remove enforceDefaults option from PrefsFromBytes ... The Mac client was using it, but it had the effect of the `RouteAll` ("Use Tailscale subnets") pref always being enabled at startup, regardless of the persisted value. enforceDefaults was added to handle cases from ~2 years ago where we ended up with persisted `"RouteAll": false` values in the keychain, but that should no longer be a concern. New users will get the default of it being enabled via `NewPrefs`. There will be a corresponding Mac client change to stop passing in enforceDefaults. For #3962 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Brad Fitzpatrick	87ba528ae0	client/tailscale: move/copy all package funcs to new LocalClient type ... Remove all global variables, and clean up tsnet and cmd/tailscale's usage. This is in prep for using this package for the web API too (it has the best package name). RELNOTE=tailscale.com/client/tailscale package refactored w/ LocalClient type Change-Id: Iba9f162fff0c520a09d1d4bd8862f5c5acc9d7cd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	373176ea54	util/codegen: format generated code with goimports, not gofmt ... goimports is a superset of gofmt that also groups imports. (the goimports tool also adds/removes imports as needed, but that part is disabled here) Change-Id: Iacf0408dfd9497f4ed3da4fa50e165359ce38498 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6bed781259	all: gofmt all ... Well, goimports actually (which adds the normal import grouping order we do) Change-Id: I0ce1b1c03185f3741aad67c14a7ec91a838de389 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	deb56f276e	Revert "api: document preauthorized auth keys" ... This reverts commit dd6472d4e8. Reason: it appears I was just really really wrong or confused. We added it to the old internal API used by the website instead, not to the "v2" API. Updates #2120 Updates #4571 Change-Id: I744a72b9193aafa7b526fd760add52148a377e83 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Mihai Parparita	cfe68d0a86	safesocket: log warning when running sandboxed Mac binary as root ... It won't work, provide a clue in the error output. Fixes #3063 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Brad Fitzpatrick	6f5b91c94c	go.mod: tidy ... Change-Id: If3b5fe42e7dd7858dcce02a3a24a5e59736815a2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2336c73d4d	go.mod: tidy ... Change-Id: If3b5fe42e7dd7858dcce02a3a24a5e59736815a2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	96fec4b969	net/tshttpproxy: synology: pick proxy by scheme ... This updates the fix from #4562 to pick the proxy based on the request scheme. Updates #4395, #2605, #4562 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Maisem Ali	eff6a404a6	net/tshttpproxy: use http as the scheme for proxies ... Currently we try to use `https://` when we see `https_host`, however that doesn't work and results in errors like `Received error: fetch control key: Get "https://controlplane.tailscale.com/key?v=32": proxyconnect tcp: tls: first record does not look like a TLS handshake` This indiciates that we are trying to do a HTTPS request to a HTTP server. Googling suggests that the standard is to use `http` regardless of `https` or `http` proxy Updates #4395, #2605 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Walter Poupore	71d401cc4e	api.md: remove descriptions from TOC (#4561)	3 years ago
Brad Fitzpatrick	1237000efe	control/controlhttp: don't assume port 80 upgrade response will work ... Just because we get an HTTP upgrade response over port 80, don't assume we'll be able to do bi-di Noise over it. There might be a MITM corp proxy or anti-virus/firewall interfering. Do a bit more work to validate the connection before proceeding to give up on the TLS port 443 dial. Updates #4557 (probably fixes) Change-Id: I0e1bcc195af21ad3d360ffe79daead730dfd86f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	488e63979e	api.md: document new ACL validate mode ... Updates tailscale/corp#4932 Change-Id: Ie176ee79595c3b56d3376f1d81a441f9272e6ed4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	5a1ef1bbb9	net/tsdial: add SystemDial as a wrapper on netns.Dial ... The connections returned from SystemDial are automatically closed when there is a major link change. Also plumb through the dialer to the noise client so that connections are auto-reset when moving from cellular to WiFi etc. Updates #3363 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	e38d3dfc76	control/controlhttp: start port 443 fallback sooner if 80's stuck ... Fixes #4544 Change-Id: I39877e71915ad48c6668351c45cd8e33e2f5dbae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	637cc1b5fc	ipn/ipnlocal/peerapi: add endpoint to list local interfaces ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
James Tucker	1aa75b1c9e	wgengine/netstack: always set TCP keepalive ... Setting keepalive ensures that idle connections will eventually be closed. In userspace mode, any application configured TCP keepalive is effectively swallowed by the host kernel, and is not easy to detect. Failure to close connections when a peer tailscaled goes offline or restarts may result in an otherwise indefinite connection for any protocol endpoint that does not initiate new traffic. This patch does not take any new opinion on a sensible default for the keepalive timers, though as noted in the TODO, doing so likely deserves further consideration. Update #4522 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	adcb7e59d2	control/controlclient: fix log print with always-empty key ... In debugging #4541, I noticed this log print was always empty. The value printed was always zero at this point. Updates #4541 Change-Id: I0eef60c32717c293c1c853879446be65d9b2cef6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c88506caa6	ipn/ipnlocal: add Wake-on-LAN function to peerapi ... No CLI support yet. Just the curl'able version if you know the peerapi port. (like via a TSMP ping) Updates #306 Change-Id: I0662ba6530f7ab58d0ddb24e3664167fcd1c4bcf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3f7cc3563f	ipn: always treat login.tailscale.com as controlplane.tailscale.com ... Like 888e50e1, but more aggressive. Updates #4538 (likely fixes) Updates #3488 Change-Id: I3924eee9110e47bdba926ce12954253bf2413040 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c6c752cf64	net/tshttpproxy: fix typo ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	50eb8c5add	cmd/tailscale: mostly fix 'tailscale ssh' on macOS (sandbox) ... Still a little wonky, though. See the tcsetattr error and inability to hit Ctrl-D, for instance: bradfitz@laptop ~ % tailscale.app ssh foo@bar tcsetattr: Operation not permitted # Authentication checked with Tailscale SSH. # Time since last authentication: 1h13m22s foo@bar:~$ ^D ^D ^D Updates #4518 Updates #4529 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	48e5f4ff88	cmd/tailscale/cli: add 'debug stat' subcommand ... For debugging what's visible inside the macOS sandbox. But could also be useful for giving users portable commands during debugging without worrying about which OS they're on. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	21413392cf	safesocket: fix CLI on standalone mac GUI build ... Tested three macOS Tailscale daemons: - App Store (Network Extension) - Standalone (macsys) - tailscaled And two types of local IPC each: - IPN - HTTP And two CLI modes: - sandboxed (running the GUI binary as the CLI; normal way) - open source CLI hitting GUI (with #4525) Bonus: simplifies the code. Fixes tailscale/corp#4559 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3601b43530	ipn: add IPCVersion override func ... I've done this a handful of times in the past and again today. Time to make it a supported thing for the future. Used while debugging tailscale/corp#4559 (macsys CLI issues) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	928d1fddd2	cmd/tailscale: s/-authkey/-auth-key/ in help text ... Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Tom DNetto	5fb8e01a8b	net/dns/resolver: add metric for number of truncated dns packets ... Updates #2067 This should help us determine if more robust control of edns parameters + implementing answer truncation is warranted, given its likely complexity. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Maisem Ali	80ba161c40	wgengine/monitor: do not ignore changes to pdp_ip* ... One current theory (among other things) on battery consumption is that magicsock is resorting to using the IPv6 over LTE even on WiFi. One thing that could explain this is that we do not get link change updates for the LTE modem as we ignore them in this list. This commit makes us not ignore changes to `pdp_ip` as a test. Updates #3363 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	1a19aed410	ipn/ipnlocal: do not initialize peer api listeners when shutting down ... Updates tailscale/corp#4824 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago