7464 Commits (5d4b4ffc3c16e1d7a4101de9105b081d69188a12)

 

All Branches   

Search

Author	SHA1	Message	Date
Marwan Sulaiman	da7c3d1753	envknob: ensure f is not nil before using it ... This PR fixes a panic that I saw in the mac app where parsing the env file fails but we don't get to see the error due to the panic of using f.Name() Fixes #11425 Signed-off-by: Marwan Sulaiman <marwan@tailscale.com>	8 months ago
Andrea Gottardo	08ebac9acb	version,cli,safesocket: detect non-sandboxed macOS GUI (#11369) ... Updates ENG-2848 We can safely disable the App Sandbox for our macsys GUI, allowing us to use `tailscale ssh` and do a few other things that we've wanted to do for a while. This PR: - allows Tailscale SSH to be used from the macsys GUI binary when called from a CLI - tweaks the detection of client variants in prop.go, with new functions `IsMacSys()`, `IsMacSysApp()` and `IsMacAppSandboxEnabled()` Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	8 months ago
Irbe Krumina	ea55f96310	cmd/tailscale/cli: fix configuring partially empty kubeconfig (#11417) ... When a user deletes the last cluster/user/context from their kubeconfig via 'kubectl delete-[cluster|user|context] command, kubectx sets the relevant field in kubeconfig to 'null'. This was breaking our conversion logic that was assuming that the field is either non-existant or is an array. Updates tailscale/corp#18320 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	8 months ago
Anton Tolchanov	cf8948da5f	net/routetable: increase route limit used by the test ... I was running all tests while preparing a recent stable release, and this was failing because my computer is connected to a fairly large tailnet. ``` --- FAIL: TestGetRouteTable (0.01s) routetable_linux_test.go:32: expected at least one default route; ... ``` ``` $ ip route show table 52 | wc -l 1051 ``` Updates #cleanup Signed-off-by: Anton Tolchanov <anton@tailscale.com>	8 months ago
Andrew Lytvynov	decd9893e4	ipn/ipnlocal: validate domain of PopBrowserURL on default control URL (#11394) ... If the client uses the default Tailscale control URL, validate that all PopBrowserURLs are under tailscale.com or *.tailscale.com. This reduces the risk of a compromised control plane opening phishing pages for example. The client trusts control for many other things, but this is one easy way to reduce that trust a bit. Fixes #11393 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	8 months ago
Andrew Lytvynov	48eef9e6eb	clientupdate: do not allow msiexec to reboot the OS (#11409) ... According to https://learn.microsoft.com/en-us/windows/win32/msi/standard-installer-command-line-options#promptrestart, `/promptrestart` is ignored with `/quiet` is set, so msiexec.exe can sometimes silently trigger a reboot. The best we can do to reduce unexpected disruption is to just prevent restarts, until the user chooses to do it. Restarts aren't normally needed for Tailscale updates, but there seem to be some situations where it's triggered. Updates #18254 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	8 months ago
Anton Tolchanov	da3cf12194	VERSION.txt: this is v1.63.0 ... Signed-off-by: Anton Tolchanov <anton@tailscale.com>	8 months ago
Anton Tolchanov	f12d2557f9	prober: add a DERP bandwidth probe ... Updates tailscale/corp#17912 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	8 months ago
Anton Tolchanov	5018683d58	prober: remove unused derp prober latency measurements ... Signed-off-by: Anton Tolchanov <anton@tailscale.com>	8 months ago
Anton Tolchanov	205a10b51a	prober: export probe counters and cumulative latency ... Updates #cleanup Signed-off-by: Anton Tolchanov <anton@tailscale.com>	8 months ago
Andrew Dunham	7429e8912a	wgengine/netstack: fix bug with duplicate SYN packets in client limit ... This fixes a bug that was introduced in #11258 where the handling of the per-client limit didn't properly account for the fact that the gVisor TCP forwarder will return 'true' to indicate that it's handled a duplicate SYN packet, but not launch the handler goroutine. In such a case, we neither decremented our per-client limit in the wrapper function, nor did we do so in the handler function, leading to our per-client limit table slowly filling up without bound. Fix this by doing the same duplicate-tracking logic that the TCP forwarder does so we can detect such cases and appropriately decrement our in-flight counter. Updates tailscale/corp#12184 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib6011a71d382a10d68c0802593f34b8153d06892	9 months ago
Brad Fitzpatrick	ad33e47270	ipn/{ipnlocal,localapi}: add debug verb to force spam IPN bus NetMap ... To force the problem in its worst case scenario before fixing it. Updates tailscale/corp#17859 Change-Id: I2c8b8e5f15c7801e1ab093feeafac52ec175a763 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Flakes Updater	04fceae898	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	9 months ago
James Tucker	055117ad45	util/linuxfw: fix support for containers without IPv6 iptables filters (#11381) ... There are container environments such as GitHub codespaces that have partial IPv6 support - routing support is enabled at the kernel level, but lacking IPv6 filter support in the iptables module. In the specific example of the codespaces environment, this also has pre-existing legacy iptables rules in the IPv4 tables, as such the nascent firewall mode detection will always pick iptables. We would previously fault trying to install rules to the filter table, this catches that condition earlier, and disables IPv6 support under these conditions. Updates #5621 Updates #11344 Updates #11354 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
James Tucker	43fba6e04d	util/linuxfw: correct logical error in NAT table check (#11380) ... Updates #11344 Updates #11354 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
panchajanya	50a570a83f	Code Improvements (#11311) ... build_docker, update-flake: cleanup and apply shellcheck fixes Was editing this file to match my needs while shellcheck warnings bugged me out. REV isn't getting used anywhere. Better remove it. Updates #cleanup Signed-off-by: Panchajanya1999 <kernel@panchajanya.dev> Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Percy Wegmann	e496451928	ipn,cmd/tailscale,client/tailscale: add support for renaming TailFS shares ... - Updates API to support renaming TailFS shares. - Adds a CLI rename subcommand for renaming a share. - Renames the CLI subcommand 'add' to 'set' to make it clear that this is an add or update. - Adds a unit test for TailFS in ipnlocal Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago
Percy Wegmann	6c160e6321	ipn,tailfs: tie TailFS share configuration to user profile ... Previously, the configuration of which folders to share persisted across profile changes. Now, it is tied to the user's profile. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago
Percy Wegmann	16ae0f65c0	cmd/viewer: import views when generating byteSliceField ... Updates #cleanup Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago
Andrew Dunham	f072d017bd	wgengine/magicsock: don't change DERP home when not connected to control ... This pretty much always results in an outage because peers won't discover our new home region and thus won't be able to establish connectivity. Updates tailscale/corp#18095 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic0d09133f198b528dd40c6383b16d7663d9d37a7	9 months ago
Sonia Appasamy	54e52532eb	version/mkversion: enforce synology versions within int32 range ... Synology requires version numbers are within int32 range. This change updates the version logic to keep things closer within the range, and errors on building when the range is exceeded. Updates #cleanup Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	9 months ago
Claire Wang	74e33b9c50	tailcfg: bump CapabilityVersion (#11368) ... bump version for adding NodeAttrSuggestExitNode remove extra s from NodeAttrSuggestExitNode Updates tailscale/corp#17516 Signed-off-by: Claire Wang <claire@tailscale.com>	9 months ago
Mario Minardi	c662bd9fe7	client/web: dedupe packages in yarn.lock (#11327) ... Run yarn-deduplicate on yarn.lock to dedupe packages. This is being done to reduce the number of redundant packages fetched by yarn when existing versions in the lockfile satisfy the version dependency we need. See https://github.com/scinos/yarn-deduplicate for details on the tool used to perform this deduplication. Updates #cleanup Signed-off-by: Mario Minardi <mario@tailscale.com>	9 months ago
Andrew Dunham	34176432d6	cmd/derper, types/logger: move log filter to shared package ... So we can use it in trunkd to quiet down the logs there. Updates #5563 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie3177dc33f5ad103db832aab5a3e0e4f128f973f	9 months ago
Irbe Krumina	3047b6274c	docs/k8s: don't run subnet router in userspace mode (#11363) ... There should not be a need to do that unless we run on host network Signed-off-by: Irbe Krumina <irbe@tailscale.com>	9 months ago
Andrew Dunham	9884d06b80	net/interfaces: fix test hang on Darwin ... This test could hang because the subprocess was blocked on writing to the stdout pipe if we find the address we're looking for early in the output. Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I68d82c22a5d782098187ae6d8577e43063b72573	9 months ago
Andrew Dunham	62cf83eb92	go.mod: bump gvisor ... The `stack.PacketBufferPtr` type no longer exists; replace it with `*stack.PacketBuffer` instead. Updates #8043 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib56ceff09166a042aa3d9b80f50b2aa2d34b3683	9 months ago
Andrew Dunham	8f27d519bb	tsweb: add String method to tsweb.RequestID ... In case we want to change the format to something opaque later. Updates tailscale/corp#2549 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie2eac8b885b694be607e9d5101d24b650026d89c	9 months ago
Irbe Krumina	90c4067010	util/linuxfw: add container-friendly IPv6 NAT check (#11353) ... Remove IPv6 NAT check when routing is being set up using nftables. This is unnecessary as support for nftables was added after support for IPv6. https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://wiki.nftables.org/wiki-nftables/index.php/Building_and_installing_nftables_from_sources Additionally, run an extra check for IPv6 NAT support when the routing is set up with iptables. This is because the earlier checks rely on being able to use modprobe and on /proc/net/ip6_tables_names being populated on start - these conditions are usually not true in container environments. Updates tailscale/tailscale#11344 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	9 months ago
Percy Wegmann	fd942b5384	ipn/ipnlocal: reduce allocations in TailFS share notifications ... This eliminates unnecessary map.Clone() calls and also eliminates repetitive notifications about the same set of shares. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago
Percy Wegmann	6f66f5a75a	ipn: add comment about thread-safety to StateStore ... Updates #cleanup Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago
Andrea Gottardo	0cb86468ca	ipn/localapi: add set-gui-visible endpoint ... Updates tailscale/corp#17859 Provides a local API endpoint to be called from the GUI to inform the backend when the client menu is opened or closed. cc @bradfitz Signed-off-by: Andrea Gottardo <andrea@gottardo.me> Signed-off-by: Andrea Gottardo <andrea@tailscale.com> Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	9 months ago
Percy Wegmann	00373f07ac	ipn/ipnlocal: exclude mullvad exit nodes from TailFS peers list ... This is a temporary solution to at least omit Mullvad exit nodes from the list of TailFS peers. Once we can identify peers that are actually sharing via TailFS, we can remove this, but for alpha it'll be sufficient to just omit Mullvad. Updates tailscale/corp#17766 Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago
Sonia Appasamy	c58c59ee54	{ipn,cmd/tailscale/cli}: move ServeConfig mutation logic to ipn/serve ... Moving logic that manipulates a ServeConfig into recievers on the ServeConfig in the ipn package. This is setup work to allow the web client and cli to both utilize these shared functions to edit the serve config. Any logic specific to flag parsing or validation is left untouched in the cli command. The web client will similarly manage its validation of user's requested changes. If validation logic becomes similar-enough, we can make a serve util for shared functionality, which likely does not make sense in ipn. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	9 months ago
Kristoffer Dalby	65255b060b	client/tailscale: add postures to UserRuleMatch ... Updates tailscale/corp#17770 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	9 months ago
License Updater	d59878e457	licenses: update android licenses ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	9 months ago
License Updater	797d75c50a	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	9 months ago
License Updater	6a4e5329c3	licenses: update tailscale{,d} licenses ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	9 months ago
Andrew Dunham	4338db28f7	wgengine/magicsock: prefer link-local addresses to private ones ... Since link-local addresses are definitionally more likely to be a direct (lower-latency, more reliable) connection than a non-link-local private address, give those a bit of a boost when selecting endpoints. Updates #8097 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I93fdeb07de55ba39ba5fcee0834b579ca05c2a4e	9 months ago
Sonia Appasamy	65c3c690cf	{ipn/serve,cmd/tailscale/cli}: move some shared funcs to ipn ... In preparation for changes to allow configuration of serve/funnel from the web client, this commit moves some functionality that will be shared between the CLI and web client to the ipn package's serve.go file, where some other util funcs are already defined. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	9 months ago
Brad Fitzpatrick	8780e33500	go.toolchain.rev: bump Go toolchain to 1.22.1 ... Updates tailscale/corp#18000 Change-Id: I45de95e974ea55b0dac2218b3c82d124c4793390 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Paul Scott	2fa20e3787	util/cmpver: add Less/LessEq helper funcs ... Updates tailscale/corp#17199 Signed-off-by: Paul Scott <paul@tailscale.com>	9 months ago
Claire Wang	d610f8eec0	tailcfg: add suggest exit node related node attribute (#11329) ... Updates tailscale/corp#17516 Signed-off-by: Claire Wang <claire@tailscale.com>	9 months ago
Chris Palmer	13853e7f29	tsweb: add more test cases for TestCleanRedirectURL (#11331) ... Updates #cleanup Signed-off-by: Chris Palmer <cpalmer@tailscale.com>	9 months ago
Irbe Krumina	dff6f3377f	docs/k8s: update docs (#11307) ... Update docs for static Tailscale deployments on kube to always use firewall mode autodection when in non-userspace. Also add a note about running multiple replicas and a few suggestions how folks could do that. Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Anton Tolchanov <1687799+knyar@users.noreply.github.com>	9 months ago
Percy Wegmann	232a2d627c	tailfs: only impersonate unprivileged user if able to sudo -u as that user ... When serving TailFS shares, tailscaled executes another tailscaled to act as a file server. It attempts to execute this child process as an unprivileged user using sudo -u. This is important to avoid accessing files as root, which would result in potential privilege escalation. Previously, tailscaled assumed that it was running as someone who can sudo -u, and would fail if it was unable to sudo -u. With this commit, if tailscaled is unable to sudo -u as the requested user, and tailscaled is not running as root, then tailscaled executes the the file server process under the same identity that ran tailscaled, since this is already an unprivileged identity. In the unlikely event that tailscaled is running as root but is unable to sudo -u, it will refuse to run the child file server process in order to avoid privilege escalation. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago
Flakes Updater	00554ad277	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	9 months ago
Andrew Lytvynov	23fbf0003f	clientupdate: handle multiple versions in "apk info tailscale" output (#11310) ... The package info output can list multiple package versions, and not in descending order. Find the newest version in the output, instead of the first one. Fixes #11309 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	9 months ago
Irbe Krumina	097c5ed927	util/linuxfw: insert rather than append nftables DNAT rule (#11303) ... Ensure that the latest DNATNonTailscaleTraffic rule gets inserted on top of any pre-existing rules. Updates tailscale/tailscale#11281 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	9 months ago
Percy Wegmann	e324a5660f	ipn: include full tailfs shares in ipn notifications ... This allows the Mac application to regain access to restricted folders after restarts. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>	9 months ago