725 Commits (518f6cee630b73ef6b049fa55d7a7747aaee763d)

Author	SHA1	Message	Date
Maisem Ali	497324ddf6	ipn/store: add common package for instantiating ipn.StateStores ... Also move KubeStore and MemStore into their own package. RELNOTE: tsnet now supports providing a custom ipn.StateStore. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Dmytro Shynkevych	d9a7205be5	net/tstun: set link speed to SPEED_UNKNOWN ... Fixes #3933. Signed-off-by: Dmytro Shynkevych <dm.shynk@gmail.com>	2 years ago
Brad Fitzpatrick	4686224e5a	cmd/tailscaled: add a no-op test for profiling init-time memory allocs ... Turns out we're pretty good already at init-time work in tailscaled. The regexp/syntax shows up but it's hard to get rid of that; zstd even uses regexp. *shrug* Change-Id: I856aca056dcb7489f5fc22ef07f55f34ddf19bd6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	4cbdc84d27	cmd/tailscaled/childproc: add be-child registration mechanism ... For ssh and maybe windows service babysitter later. Updates #3802 Change-Id: I7492b98df98971b3fb72d148ba92c2276cca491f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	c9eca9451a	ssh: make it build on darwin ... For local dev testing initially. Product-wise, it'll probably only be workable on the two unsandboxed builds. Updates #3802 Change-Id: Ic352f966e7fb29aff897217d79b383131bf3f92b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7d897229d9	net/dns: ignore permission errors on Synology DSM7 for now ... Updates #4017 Change-Id: Ia7fd4df47588c010dea8e63d88f397cc8eb748e5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	29279b34fa	cmd/tailscale: make configure-host on Synology also add CAP_NET_RAW ... Updates #4012 Change-Id: Ic45b5709a73b4f1cd466823e177b52d1d20ba84e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Aaron Klotz	e31d68d64e	hostinfo: use the sentinel value set by the MSI installer to detect MSI package type ... The MSI installer sets a special sentinel value that we can use to detect it. I also removed the code that bails out when the installation path is not `Program Files`, as both the NSIS and MSI installers permit the user to install to a different path. Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Maisem Ali	c7a8f0992d	ipn/ipnlocal: use views for Peer.PrimaryRoutes and Peer.Tags ... RELNOTE=`tailscale status --json` now shows Tags and PrimaryRoutes Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	e921e1b02d	cmd/tailscale: add "tailscale debug hostinfo" subcommand ... Change-Id: Ifa09364d42e0516fdf80feddaf33c95880228049 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	f9a50779e2	cmd/tailscaled: add `-state=mem:` to support creation of an ephemeral node. ... RELNOTE=`tailscaled --state=mem:` registers as an ephemeral node and does not store state to disk. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Josh Bleecher Snyder	94409db7e2	cmd/tailscale: rewrite --authkey to --auth-key ... That way humans don't have to remember which is correct. RELNOTE=--auth-key is the new --authkey, but --authkey still works Updates tailscale/corp#3486 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	2 years ago
Maisem Ali	72d8672ef7	tailcfg: make Node.Hostinfo a HostinfoView ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	1b87e025e9	ssh/tailssh: move SSH code from wgengine/netstack to this new package ... Still largely incomplete, but in a better home now. Updates #3802 Change-Id: I46c5ffdeb12e306879af801b06266839157bc624 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	c988bd6ed1	net/dns/resolvconffile: unify three /etc/resolv.conf parsers into new package ... Change-Id: I2120893ca802d12f1bd0407d49077d3672627d33 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	8fe503057d	net/netutil: unify two oneConnListeners into a new package ... I was about to add a third copy, so unify them now instead. Change-Id: I3b93896aa1249b1250a6b1df4829d57717f2311a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a80cef0c13	cmd/derper: fix regression from bootstrap DNS optimization ... The commit b9c92b90db earlier today caused a regression of serving an empty map always, as it was JSON marshalling an atomic.Value instead of the DNS entries map it just built. Change-Id: I9da3eeca132c6324462dedeaa7d002908557384b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Josh Bleecher Snyder	84046d6f7c	Revert "cmd/derper: stop setting content header in handleBootstrapDNS" ... Didn't help enough. We are setting another header anyway. Restore it. This reverts commit 60abeb027b. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	2 years ago
Josh Bleecher Snyder	ec62217f52	cmd/derper: close connections once bootstrap DNS has been served ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	2 years ago
Josh Bleecher Snyder	60abeb027b	cmd/derper: stop setting content header in handleBootstrapDNS ... No one really cares. Its cost outweighs its usefulness. name old time/op new time/op delta HandleBootstrapDNS-10 105ns ± 4% 65ns ± 2% -37.68% (p=0.000 n=15+14) name old alloc/op new alloc/op delta HandleBootstrapDNS-10 416B ± 0% 0B -100.00% (p=0.000 n=15+15) name old allocs/op new allocs/op delta HandleBootstrapDNS-10 3.00 ± 0% 0.00 -100.00% (p=0.000 n=15+15) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	2 years ago
Josh Bleecher Snyder	b9c92b90db	cmd/derper: optimize handleBootstrapDNS ... Do json formatting once, rather than on every request. Use an atomic.Value. name old time/op new time/op delta HandleBootstrapDNS-10 6.35µs ± 0% 0.10µs ± 4% -98.35% (p=0.000 n=14+15) name old alloc/op new alloc/op delta HandleBootstrapDNS-10 3.20kB ± 0% 0.42kB ± 0% -86.99% (p=0.000 n=12+15) name old allocs/op new allocs/op delta HandleBootstrapDNS-10 41.0 ± 0% 3.0 ± 0% -92.68% (p=0.000 n=15+15) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	2 years ago
Josh Bleecher Snyder	e206a3663f	cmd/derper: add BenchmarkHandleBootstrapDNS ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	2 years ago
Joe Tsai	0173a50bf0	cmd/derper: add a rate limiter for accepting new connection (#3908) ... A large influx of new connections can bring down DERP since it spins off a new goroutine for each connection, where each routine may do significant amount of work (e.g., allocating memory and crunching numbers for TLS crypto). The momentary spike can cause the process to OOM. This commit sets the groundwork for limiting connections, but leaves the limit at infinite by default. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Aaron Klotz	3a74f2d2d7	cmd/tailscaled, util/winutil: add accessor functions for Windows system policies. ... This patch adds new functions to be used when accessing system policies, and revises callers to use the new functions. They first attempt the new registry path for policies, and if that fails, attempt to fall back to the legacy path. We keep non-policy variants of these functions because we should be able to retain the ability to read settings from locations that are not exposed to sysadmins for group policy edits. The remaining changes will be done in corp. Updates https://github.com/tailscale/tailscale/issues/3584 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Brad Fitzpatrick	3c481d6b18	cmd/tailscale: add "tailscale configure-host" to prep a Synology machine at boot ... Updates #3761 Change-Id: Ib5ab9a4808ade074f48d3abee22c57d7670f9e21 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	fa612c28cf	cmd/derper: make --stun default to on, flesh out flag docs ... Change-Id: I49e80c61ab19e78e4c8b4bc9012bb70cfe3bfa75 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Anderson	f5ec916214	cmd/derper: disable TLS 1.0 and 1.1. ... Updates tailscale/corp#3568 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Brad Fitzpatrick	02bdc654d5	cmd/tailscale: fix up --reset, again ... Also fix a somewhat related printing bug in the process where some paths would print "Success." inconsistently even when there otherwise was no output (in the EditPrefs path) Fixes #3830 Updates #3702 (which broke it once while trying to fix it) Change-Id: Ic51e14526ad75be61ba00084670aa6a98221daa5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	70d71ba1e7	cmd/derpprobe: check derper TLS certs too ... Change-Id: If8c48e012b294570ebbb1a46bacdc58fafbfbcc5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	1af26222b6	go.mod: bump netstack, switch to upstream netstack ... Now that Go 1.17 has module graph pruning (https://go.dev/doc/go1.17#go-command), we should be able to use upstream netstack without breaking our private repo's build that then depends on the tailscale.com Go module. This is that experiment. Updates #1518 (the original bug to break out netstack to own module) Updates #2642 (this updates netstack, but doesn't remove workaround) Change-Id: I27a252c74a517053462e5250db09f379de8ac8ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Anderson	508f332bb2	cmd/derper: export TLS vars with derper_ prefix, not stun_ ... Updates tailscale/corp#3568 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
davideger	f31546809f	cmd/tailscale: propagate tailscaled 403s as AccessDeniedErrors ... So Linux/etc CLI users get helpful advice to run tailscale with --operator=$USER when they try to 'tailscale file {cp,get}' but are mysteriously forbidden. Signed-off-by: David Eger <eger@google.com> Signed-off-by: David Eger <david.eger@gmail.com>	2 years ago
Brad Fitzpatrick	f3c0023add	wgengine/netstack: add an SSH server experiment ... Disabled by default. To use, run tailscaled with: TS_SSH_ALLOW_LOGIN=you@bar.com And enable with: $ TAILSCALE_USE_WIP_CODE=true tailscale up --ssh=true Then ssh [any-user]@[your-tailscale-ip] for a root bash shell. (both the "root" and "bash" part are temporary) Updates #3802 Change-Id: I268f8c3c95c8eed5f3231d712a5dc89615a406f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) ... A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Anderson	ff3442d92d	cmd/derper: record TLS versions used for requests. ... Surveying the fleet prior to turning off old/unused/insecure TLS versions. Updates tailscale/corp#3615 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Brad Fitzpatrick	92dfaf53bb	cmd/tailscaled: include Go runtime metrics in /debug/metrics ... Fixes #3772 Change-Id: I237ea23268664d99e83d27890146018b04474556 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Josh Bleecher Snyder	a076aaecc6	cmd/tailscale: use html/template for synoTokenRedirect ... The GitHub code scanner flagged this as a security vulnerability. I don't believe it was, but I couldn't convince myself of it 100%. Err on the safe side and use html/template to generate the HTML, with all necessary escaping. Fixes tailscale/corp#2698 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	2 years ago
Maisem Ali	9e8a432146	cmd/tailscale/cli/web: fix typo where the html template data was being ... replaced instead of being appended to. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	e6626366a2	cmd/tailscale: let 'tailscale up --reset' do a pref edit ... The --reset shouldn't imply that a Backend.Start is necessary. With this, it can do a Backend.EditPrefs instead, which then doesn't do all the heavy work that Start does. Also, Start on Windows behaves slightly differently than Linux etc in some cases because of tailscaled running in client mode on Windows (where the GUI supplies the prefs). Fixes #3702 Change-Id: I75c9f08d5e0052bf623074030a3a7fcaa677abf6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b8ad90c2bf	cmd/derper: in manual cert mode, don't discard error from VerifyHostname ... Updates #3701 Change-Id: If8ca5104bd8221c99cc390ca49ee3401aff09b62 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	64c2657448	cmd/printdep: add flag to print out Go toolchain tarball URL ... Updates #3669 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3690bfecb0	ipn/ipnlocal: fix cert fetching on macOS GUI platforms ... And clarify the directory they get written to when under the sandbox. Fixes #3667 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c8b63a409e	cmd/hello: also redirect https://hello.ipn.dev to hello.ts.net ... I apparently only did HTTP before, not HTTPS. Updates tailscale/corp#1327 Change-Id: I7d5265a0a25fcab5b142c8c3f21a0920f6cae39f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e2d9c99e5b	cmd/hello: migrate to hello.ts.net as the hostname ... But still support hello.ipn.dev for a bit. Updates tailscale/corp#1327 Change-Id: Iab59cca0b260d69858af16f4e42677e54f9fe54a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ebdd25920e	go.toolchain.rev: add Go toolchain rev, tool to print it out ... Updates tailscale/corp#3385 Change-Id: Ia0e285a0ae836744539c97ff6eff207588159688 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7d9b1de3aa	netcheck,portmapper,magicsock: ignore some UDP write errors on Linux ... Treat UDP send EPERM errors as a lost UDP packet, not something super fatal. That's just the Linux firewall preventing it from going out. And add a leaf package net/neterror for that (and future) policy that all three packages can share, with tests. Updates #3619 Change-Id: Ibdb838c43ee9efe70f4f25f7fc7fdf4607ba9c1d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	96cab21383	cmd/tailscale: add debug restun, rebind subcommands ... In the hidden debug menu. Change-Id: I20213f1f4e2290d36f9ff561bac0cc767400d5fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ae319b4636	wgengine/magicsock: add HTML debug handler to see magicsock state ... Change-Id: Ibc46f4e9651e1c86ec6f5d139f5e9bdc7a488415 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3dedcd1640	logpolicy, ipn/ipnserver: connect to logtail via tailscaled when needed ... This is for use by the Windows GUI client to log via when an exit node is in use, so the logs don't go out via the exit node and instead go directly, like tailscaled's. The dialer tried to do that in the unprivileged GUI by binding to a specific interface, but the "Internet Kill Switch" installed by tailscaled for exit nodes precludes that from working and instead the GUI fails to dial out. So, go through tailscaled (with a CONNECT request) instead. Fixes tailscale/corp#3169 Change-Id: I17a8efdc1d4b8fed53a29d1c19995592b651b215 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	40e2b312b6	ipn/ipnserver, logpolicy: move Windows disk logging up earlier ... This moves the Windows-only initialization of the filelogger into logpolicy. Previously we only did it when babysitting the tailscaled subprocess, but this meant that log messages from the service itself never made it to disk. Examples that weren't logged to disk: * logtail unable to dial out, * DNS flush messages from the service * svc.ChangeRequest messages (#3581) This is basically the same fix as #3571 but staying in the Logf type, and avoiding build-tagged file (which wasn't quite a goal, but happened and seemed nice) Fixes #3570 Co-authored-by: Aaron Klotz <aaron@tailscale.com> Change-Id: Iacd80c4720b7218365ec80ae143339d030842702	3 years ago