6823 Commits (5aa7687b2193cd3c86d350109f9eaab9dbad614b)

 

All Branches   

Search

Author	SHA1	Message	Date
Andrew Lytvynov	1fc1077052	ssh/tailssh,util: extract new osuser package from ssh code (#10170) ... This package is a wrapper for os/user that handles non-cgo builds, gokrazy and user shells. Updates tailscale/corp#15405 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Will Norris	09de240934	ipn/ipnlocal: allow connecting to local web client ... The local web client has the same characteristic as tailscale serve, in that it needs a local listener to allow for connections from the local machine itself when running in kernel networking mode. This change renames and adapts the existing serveListener to allow it to be used by the web client as well. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Brad Fitzpatrick	d36a0d42aa	tsnet: check a bit harder for https in Server.ListenFunnel ... This was mostly already fixed already indirectly in earlier commits but add a last second length check to this slice so it can't ever OOB. Fixes #7860 Change-Id: I31ac17fc93b5808deb09ff34e452fe37c87ddf3a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Andrew Lytvynov	bff786520e	clientupdate,ipn/ipnlocal: fix c2n update on freebsd (#10168) ... The c2n part was broken because we were not looking up the tailscale binary for that GOOS. The rest of the update was failing at the `pkg upgrade` confirmation prompt. We also need to manually restart tailscaled after update. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Sonia Appasamy	d544e80fc1	client/web: populate device details view ... Fills /details page with real values, passed back from the /data endpoint. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Brad Fitzpatrick	d852c616c6	logtail: fix Logger.Write return result ... io.Writer says you need to write completely on err=nil. (the result int should be the same as the input buffer length) We weren't doing that. We used to, but at some point the verbose filtering was modifying buf before the final return of len(buf). We've been getting lucky probably, that callers haven't looked at our results and turned us into a short write error. Updates #cleanup Updates tailscale/corp#15664 Change-Id: I01e765ba35b86b759819e38e0072eceb9d10d75c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Tom DNetto	11a20f371a	ipn/ipnlocal: fix nil control client panic while updating TKA head ... As part of tailnet-lock netmap processing, the LocalBackend mutex is unlocked so we can potentially make a network call. Its possible (during shutdown or while the control client is being reset) for b.cc to become nil before the lock is picked up again. Fixes: #9554 Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Tom DNetto	3496d62ed3	ipn/ipnlocal: add empty address to the app-connector localNets set ... App connectors handle DNS requests for app domains over PeerAPI, but a safety check verifies the requesting peer has at least permission to send traffic to 0.0.0.0:53 (or 2000:: for IPv6) before handling the DNS request. The correct filter rules are synthesized by the coordination server and sent down, but the address needs to be part of the 'local net' for the filter package to even bother checking the filter rules, so we set them here. See: https://github.com/tailscale/corp/issues/11961 for more information. Signed-off-by: Tom DNetto <tom@tailscale.com> Updates: ENG-2405	1 year ago
Will Norris	fdbe511c41	cmd/tailscale: add -webclient flag to up and set ... Initially, only expose this flag on dev and unstable builds. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Charlotte Brandhorst-Satzkorn	f937cb6794	tailcfg,ipn,appc: add c2n endpoint for appc domain routes ... This change introduces a c2n endpoint that returns a map of domains to a slice of resolved IP addresses for the domain. Fixes tailscale/corp#15657 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	1 year ago
Andrew Lytvynov	63062abadc	clientupdate: check whether running as root early (#10161) ... Check for root early, before we fetch the pkgs index. This avoids several seconds delay for the command to tell you to sudo. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	9b158db2c6	ipn/localapi: require root or sudo+operator access for SetServeConfig (#10142) ... For an operator user, require them to be able to `sudo tailscale` to use `tailscale serve`. This is similar to the Windows elevated token check. Updates tailscale/corp#15405 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Will Norris	fc2d63bb8c	go.mod: updates web-client-prebuilt ... Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Will Norris	623f669239	client/web: pass URL prefix to frontend ... This allows wouter to route URLs properly when running in CGI mode. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Sonia Appasamy	0753ad6cf8	client/web: move useNodeData out of App component ... Only loading data once auth request has completed. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Will Norris	d530153d2f	go.mod: bump web-client-prebuilt ... Updates #cleanup Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Sonia Appasamy	5e095ddc20	client/web: add initial framework for exit node selector ... Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Sonia Appasamy	de2af54ffc	client/web: pipe newSession through to readonly view ... Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Sonia Appasamy	d73e923b73	client/web: add device details view ... Initial addition of device details view on the frontend. A little more backend piping work to come to fill all of the detail fields, for now using placeholders. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Will Norris	3e9026efda	client/web: show manage button in readonly view ... We render the readonly view in two situations: - the client is in login mode, and the device is connected - the client is in manage mode, but the user does not yet have a session If the user is not authenticated, and they are not currently on the Tailscale IP address, render a "Manage" button that will take them to the Tailcale IP of the device and immediately start check mode. Still to do is detecting if they have connectivity to the Tailscale IP, and disabling the button if not. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Thomas Kosiewski	96a80fcce3	Add support for custom DERP port in TLS prober ... Updates #10146 Signed-off-by: Thomas Kosiewski <thoma471@googlemail.com>	1 year ago
Charlotte Brandhorst-Satzkorn	839fee9ef4	wgengine/magicsock: handle wireguard only clean up and log messages ... This change updates log messaging when cleaning up wireguard only peers. This change also stops us unnecessarily attempting to clean up disco pings for wireguard only endpoints. Updates #7826 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	1 year ago
Sonia Appasamy	3269b36bd0	client/web: fix hotreload proxy ... Previously had HMR websocket set to run from a different port than the http proxy server. This was an old setting carried over from the corp repo admin panel config. It's messing with hot reloads when run from the tailscaled web client, as it keeps causing the full page to refresh each time a connection is made. Switching back to the default config here fixes things. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Sonia Appasamy	942d720a16	cli/web: don't block startup on status req ... If the status request to check for the preview node cap fails, continue with starting up the legacy client. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Sonia Appasamy	7df2c5d6b1	client/web: add route management for ui pages ... Using wouter, a lightweight React routing library. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
License Updater	a97ead9ce4	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 year ago
License Updater	aeb5a8b123	licenses: update tailscale{,d} licenses ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 year ago
Sonia Appasamy	f2a4c4fa55	client/web: build out client home page ... Hooks up more of the home page UI. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Andrew Lytvynov	aba4bd0c62	util/winutil: simplify dropping privileges after use (#10099) ... To safely request and drop privileges, runtime.Lock/UnlockOSThread and windows.Impersonate/RevertToSelf should be called. Add these calls to winutil.EnableCurrentThreadPrivilege so that callers don't need to worry about it. Updates https://github.com/tailscale/corp/issues/15488 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Anton Tolchanov	ef6a6e94f1	derp/derphttp: use a getter method to read server key ... To hold the mutex while accessing it. Fixes #10122 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	1 year ago
Brad Fitzpatrick	44c6909c92	control/controlclient: move watchdog out of mapSession ... In prep for making mapSession's lifetime not be 1:1 with a single HTTP response's lifetime, this moves the inactivity timer watchdog out of mapSession and into the caller that owns the streaming HTTP response. (This is admittedly closer to how it was prior to the mapSession type existing, but that was before we connected some dots which were impossible to even see before the mapSession type broke the code up.) Updates #7175 Change-Id: Ia108dac84a4953db41cbd30e73b1de4a2a676c11 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	c87d58063a	control/controlclient: move lastPrintMap field from Direct to mapSession ... It was a really a mutable field owned by mapSession that we didn't move in earlier commits. Once moved, it's then possible to de-func-ify the code and turn it into a regular method rather than an installed optional hook. Noticed while working to move map session lifetimes out of Direct.sendMapRequest's single-HTTP-connection scope. Updates #7175 Updates #cleanup Change-Id: I6446b15793953d88d1cabf94b5943bb3ccac3ad9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Matt Layher	1a1e0f460a	client/tailscale: remove redundant error check ... Signed-off-by: Matt Layher <mdlayher@gmail.com>	1 year ago
Will Norris	e537d304ef	client/web: relax CSP restrictions for manage client ... Don't return CSP headers in dev mode, since that includes a bunch of extra things like the vite server. Allow images from any source, which is needed to load user profile images. Allow 'unsafe-inline' for various inline scripts and style react uses. We can eliminate this by using CSP nonce or hash values, but we'll need to look into the best way to handle that. There appear to be several react plugins for this, but I haven't evaluated any of them. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Claire Wang	5de8650466	syspolicy: add Allow LAN Access visibility key (#10113) ... Fixes tailscale/corp#15594 Signed-off-by: Claire Wang <claire@tailscale.com>	1 year ago
Brad Fitzpatrick	b2b836214c	derp/derphttp: fix derptrack fix ... 3d7fb6c21d dropped the explicit called to (*Client).connect when its (*Client).WatchConnectionChanges got removed+refactored. This puts it back, but in RunWatchConnectionLoop, before the call to the (*Client).ServerPublicKey accessor, which is documented to return the zero value (which is what broke us) on an unconnected connection. Plus some tests. Fixes tailscale/corp#15604 Change-Id: I0f242816f5ee4ad3bb0bf0400abc961dbe9f5fc8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Flakes Updater	8dc6de6f58	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	1 year ago
Will Norris	7e81c83e64	cmd/tailscale: respect existing web client pref ... After running `tailscale web`, only disable the user pref if it was not already previously set. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Will Norris	cb07ed54c6	go.mod: update web-client-prebuilt ... Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Will Norris	a05ab9f3bc	client/web: check r.Host rather than r.URL.Host ... r.URL.Host is not typically populated on server requests. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Will Norris	6b956b49e0	client/web: add some security checks for full client ... Require that requests to servers in manage mode are made to the Tailscale IP (either ipv4 or ipv6) or quad-100. Also set various security headers on those responses. These might be too restrictive, but we can relax them as needed. Allow requests to /ok (even in manage mode) with no checks. This will be used for the connectivity check from a login client to see if the management client is reachable. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Aaron Klotz	fbc18410ad	ipn/ipnauth: improve the Windows token administrator check ... (*Token).IsAdministrator is supposed to return true even when the user is running with a UAC limited token. The idea is that, for the purposes of this check, we don't care whether the user is *currently* running with full Admin rights, we just want to know whether the user can *potentially* do so. We accomplish this by querying for the token's "linked token," which should be the fully-elevated variant, and checking its group memberships. We also switch ipn/ipnserver/(*Server).connIsLocalAdmin to use the elevation check to preserve those semantics for tailscale serve; I want the IsAdministrator check to be used for less sensitive things like toggling auto-update on and off. Fixes #10036 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	1 year ago
Sonia Appasamy	e5dcf7bdde	client/web: move auth session creation out of /api/auth ... Splits auth session creation into two new endpoints: /api/auth/session/new - to request a new auth session /api/auth/session/wait - to block until user has completed auth url Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Will Norris	658971d7c0	ipn/ipnlocal: serve web client on quad100 if enabled ... if the user pref and nodecap for the new web client are enabled, serve the client over requests to 100.100.100.100. Today, that is just a static page that lists the local Tailcale IP addresses. For now, this will render the readonly full management client, with an "access" button that sends the user through check mode. After completing check mode, they will still be in the read-only view, since they are not accessing the client over Tailscale. Instead, quad100 should serve the lobby client that has a "manage" button that will open the management client on the Tailscale IP (and trigger check mode). That is something we'll fix in a subsequent PR in the web client code itself. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
James Tucker	46fd488a6d	types/dnstype: update the usage documentation on dnstype.Resolver ... There was pre-existing additional usage for Exit Node DNS resolution via PeerAPI, as well as new usage just introduced for App Connectors. Fixes ENG-2324 Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Sonia Appasamy	0ecfc1d5c3	client/web: fill devMode from an env var ... Avoids the need to pipe a web client dev flag through the tailscaled command. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Andrew Lytvynov	f0bc95a066	ipn/localapi: make serveTKASign require write permission (#10094) ... The existing read permission check looks like an oversight. Write seems more appropriate for sining new nodes. Updates https://github.com/tailscale/corp/issues/15506 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Sonia Appasamy	191e2ce719	client/web: add ServerMode to web.Server ... Adds a new Mode to the web server, indicating the specific scenario the constructed server is intended to be run in. Also starts filling this from the cli/web and ipn/ipnlocal callers. From cli/web this gets filled conditionally based on whether the preview web client node cap is set. If not set, the existing "legacy" client is served. If set, both a login/lobby and full management client are started (in "login" and "manage" modes respectively). Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Andrew Lytvynov	7145016414	clientupdate: do not recursively delete dirs in cleanupOldDownloads (#10093) ... In case there's a wild symlink in one of the target paths, we don't want to accidentally delete too much. Limit `cleanupOldDownloads` to deleting individual files only. Updates https://github.com/tailscale/tailscale/issues/10082 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Will Norris	4ce4bb6271	client/web: limit authorization checks to API calls ... This completes the migration to setting up authentication state in the client first before fetching any node data or rendering the client view. Notable changes: - `authorizeRequest` is now only enforced on `/api/*` calls (with the exception of /api/auth, which is handled early because it's needed to initially setup auth, particularly for synology) - re-separate the App and WebClient components to ensure that auth is completed before moving on - refactor platform auth (synology and QNAP) to fit into this new structure. Synology no longer returns redirect for auth, but returns authResponse instructing the client to fetch a SynoToken Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago