1060 Commits (69f1324c9e3b169bb8e71cf4584a7c276545e95d)

Author	SHA1	Message	Date
Brad Fitzpatrick	8049053f86	ipn/*: make new WindowsUserID type to consolidate docs ... The "userID is empty everywhere but Windows" docs on lots of places but not everywhere while using just a string type was getting confusing. This makes a new type to wrap up those rules, however weird/historical they might be. Change-Id: I142e85a8e38760988d6c0c91d0efecedade81b9b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	5676d201d6	ipn: add a WatchIPNBus option bit to subscribe to EngineStatus changes ... So GUI clients don't need to poll for it. We still poll internally (for now!) but that's still cheaper. And will get much cheaper later, without having to modify clients once they start sending this bit. Change-Id: I36647b701c8d1fe197677e5eb76f6894e8ff79f7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f45106d47c	ipn/ipnserver: move Windows-specific code to tailscaled_windows.go ... We'll eventually remove it entirely, but for now move get it out of ipnserver where it's distracting and move it to its sole caller. Updates #6522 Change-Id: I9c6f6a91bf9a8e3c5ea997952b7c08c81723d447 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	109aa3b2fb	cmd/tailscale: add start of "debug derp" subcommand ... Updates #6526 Change-Id: I84e440a8bd837c383000ce0cec4ff36b24249e8b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b0545873e5	ipn/ipnserver: remove protoSwitchConn shenanigans; just use http.Server early ... Now that everything's just HTTP, there's no longer a need to have a header-sniffing net.Conn wraper that dispatches which route to take. Refactor to just use an http.Server earlier instead. Updates #6417 Change-Id: I12a2054db4e56f48660c46f81233db224fdc77cb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f3ba268a96	ipn/ipnserver: move BabysitProc to tailscaled_windows.go ... It's only used by Windows. No need for it to be in ipn/ipnserver, which we're trying to trim down. Change-Id: Idf923ac8b6cdae8b5338ec26c16fb8b5ea548071 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	699b39dec1	ipn/ipnlocal: drop LocalBackend.inServerMode ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	7e016c1d90	ipn/ipnserver: remove IPN protocol server ... Unused in this repo as of the earlier #6450 (300aba61a6) and unused in the Windows GUI as of tailscale/corp#8065. With this ipn.BackendServer is no longer used and could also be removed from this repo. The macOS and iOS clients still temporarily depend on it, but I can move it to that repo instead while and let its migration proceed on its own schedule while we clean this repo up. Updates #6417 Updates tailscale/corp#8051 Change-Id: Ie13f82af3eb9f96b3a21c56cdda51be31ddebdcf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	1fdfb0dd08	ipn/localapi: add "enginestatus" debug command to LocalAPI ... To force an EngineStatus update to the IPN bus. This is a temporary measure while migrating the Windows GUI entirely to the LocalAPI and off the old IPN protocol. The old IPN protocol had RequestEngineStatus and LocalAPI didn't. Updates #6417 Change-Id: I8ff525fc3dd82bdd9d92c2bdad6db5b75609eacd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	c258015165	ipn/ipnlocal,ipnserver: rename {,Set}CurrentUser to {,Set}CurrentUserID ... Address comments from https://github.com/tailscale/tailscale/pull/6506#discussion_r1032454064 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	0a842f353c	ipn/ipnserver: move more connection acceptance logic to LocalBackend ... Follow-up to #6467 and #6506. LocalBackend knows the server-mode state, so move more auth checking there, removing some bookkeeping from ipnserver.Server. Updates #6417 Updates tailscale/corp#8051 Change-Id: Ic5d14a077bf0dccc92a3621bd2646bab2cc5b837 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	5ea7c7d603	ipn/{ipnlocal,ipnserver}: add some comments ... Change-Id: Ieb5917edaf572342b755caa458693512c7aece81 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	a3cd171773	ipn/ipnserver: remove Server.serverModeUser ... We can just rely on LocalBackend.CurrentUser Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	d321b0ea4f	ipn/ipnlocal: add docs to LocalBackend.SetCurrentUserID ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	250edeb3da	ipn/ipnserver: only permit the pre-HTTP LocalAPI protocol on Windows ... Updates #6417 Change-Id: I1c9dbee3f72969f703b3ff2dbbaa145a17db868b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b68d008fee	envknob: add CanTaildrop (TS_DISABLE_TAILDROP) to disable taildrop on device ... This matches CanSSHD (TS_DISABLE_SSH_SERVER) for administratively disabling the code on a node, regardless of local or server configs. This can be configured in /etc/default/tailscaled on Linux, %ProgramData%\Tailscale\tailscaled-env.txt on Windows, or /etc/tailscale/tailscaled-env.txt on Synology. (see getPlatformEnvFile) Also delete some dead code and tidy up some docs. Change-Id: I79a87c03e33209619466ea8aeb0f6651afcb8789 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	20b27df4d0	tailcfg, ipn, controlclient: add MapResponse.ClientVersion, plumb to IPN bus ... Updates #6480 Change-Id: I6321071425cd091148d8140d1eb24dd536bb7984 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	4d3713f631	envknob: add GOOS func ... Centralize the fake GOOS stuff, start to use it more. To be used more in the future. Change-Id: Iabacfbeaf5fca0b53bf4d5dbcdc0367f05a205f9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6e6f27dd21	ipn/ipnlocal: lock down unsigned peers more ... Apparently there's no tracking bug? Updates tailscale/corp#7515 for ingress/funnel at least. Change-Id: I03bc54fdc1f53f9832ab8b51475b2d676c38d897 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7bff7345cc	ipn/ipnauth: start splitting ipnserver into new ipnauth package ... We're trying to gut 90% of the ipnserver package. A lot will get deleted, some will move to LocalBackend, and a lot is being moved into this new ipn/ipnauth package which will be leaf-y and testable. This is a baby step towards moving some stuff to ipnauth. Update #6417 Updates tailscale/corp#8051 Change-Id: I28bc2126764f46597d92a2d72565009dc6927ee0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	3a5d02cb31	ipn/ipnlocal: update comment about using FallbackResolvers for exit nodes ... While reading the DNS code noticed that we were still using FallbackResolvers in this code path but the comment was out of date. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	300aba61a6	ipn, cmd/tailscale/cli: add LocalAPI IPN bus watch, Start, convert CLI ... Updates #6417 Updates tailscale/corp#8051 Change-Id: I1ca360730c45ffaa0261d8422877304277fc5625 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	d4f6efa1df	ipn/ipnlocal: handle case when selected profile is deleted ... Profile keys are not deleted but are instead set to `nil` which results in getting a nil error and we were not handling that correctly. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	b45b948776	ipn/ipnlocal: call initTKALocked on backend start ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	aeb80bf8cb	ipn/ipnlocal,tka: generate a nonce for each TKA ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	6708f9a93f	cmd/tailscale,ipn: implement lock log command ... This commit implements `tailscale lock log [--limit N]`, which displays an ordered list of changes to network-lock state in a manner familiar to `git log`. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	ed1fae6c73	ipn/ipnlocal: always tx TKA sync after enablement ... By always firing off a sync after enablement, the control plane should know the node's TKA head at all times. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	0f7da5c7dc	ipn{,/ipnlocal}, client/tailscale: move Taildrop recv notifications to LocalAPI HTTP method ... Updates #6417 Change-Id: Iec544c477a0e5e9f1c6bf23555afec06255e2e22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	8d84178884	ipn/ipnlocal: stop storing serverURL in LocalBackend ... It's only read in a couple of places and we can read from Prefs directly. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	aeac4bc8e2	ipn/ipnlocal: account for currentUserID when iterating over knownProfiles ... We were not checking the currentUserID in all code paths that looped over knownProfiles. This only impacted multi-user Windows setups. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	18c7c3981a	ipn/ipnlocal: call checkPrefs in Start too ... We were not calling checkPrefs on `opts.*Prefs` in (*LocalBackend).Start(). Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	0480a925c1	ipn/ipnlocal: send Content-Security-Policy, etc to peerapi browser requests ... Updates tailscale/corp#7948 Change-Id: Ie70e0d042478338a37b7789ac63225193e47a524 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	b94b91c168	cmd/tailscale/cli: add ability to set short names for profiles ... This adds a `--nickname` flag to `tailscale login|set`. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	575fd5f22b	ipn: add ability to name profiles ... Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	33520920c3	all: use strs.CutPrefix and strs.CutSuffix more ... Updates places where we use HasPrefix + TrimPrefix to use the combined function. Updates #5309 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	039ea51ca6	ipn/ipnlocal: add health warning for unstable builds ... Like the macOS About dialog. Change-Id: Ic27f091e66e29d5eebe4e195eda97ed331d748fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a26f23d949	ipn/ipnlocal: actually fill out PeerAPIURLs in PeerStatus ... The earlier 5f6d63936f was not complete. Updates tailscale/corp#7515 Change-Id: I35efca51d1584c48ef6834a7d29cd42d7c943628 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
shayne	f52a6d1b8c	cmd/tailscale/cli, ipn: move serve CLI funcs on to ServeConfig (#6401) ... Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Tom DNetto	2a991a3541	ipn/{localapi,ipnserver}: set a CSP for ServeHTMLStatus, refactor host check ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	f1ad26f694	ipn/ipnlocal: strip NetworkLockKey from Prefs ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	dd50dcd067	ipn/ipnlocal: handle untagging nodes better ... We would end up with duplicate profiles for the node as the UserID would have chnaged. In order to correctly deduplicate profiles, we need to look at both the UserID and the NodeID. A single machine can only ever have 1 profile per NodeID and 1 profile per UserID. Note: UserID of a Node can change when the node is tagged/untagged, and the NodeID of a device can change when the node is deleted so we need to check for both. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	f18dde6ad1	ipn/ipnserver: validate Host header on debug ServeHTMLStatus status ... Updates tailscale/corp#7948 Change-Id: I3a8c64f353af1eeae620812b2700ce4af4fbbc88 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a13753ae1e	ipn/localapi: require POST to add a bugreport marker ... The LocalClient.BugReport method already sends it via POST. Updates tailscale/corp#7948 Change-Id: I98dbd558c99d4296d934baa5ebc97052c7413073 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
shayne	a97369f097	cmd/tailscale/cli: flesh out serve CLI and tests (#6304) ... Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Maisem Ali	5f6d63936f	ipn/ipnlocal: fill out PeerAPIURLs in PeerStatus ... Updates tailscale/corp#7515 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	cec48743fb	ipn/localapi: set security headers ... Change-Id: I028b6ab91229e2f824e5a69856ca9e1844f7486e Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Maisem Ali	1de64e89cd	ipn/ipnlocal: set Hostinfo.WireIngress when ingress enabled ... Optimization for control. Updates tailscale/corp#7515 Change-Id: Ie93b232ab3e543d53062b462bdc13e279176f7a9 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	b3da5de10f	ipn/localapi: also allow localhost as the LocalAPI host ... The Mac and iOS LocalAPI clients make requests to it. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	b0736fe6f7	ipn/ipnlocal: move selfNode from peerAPIServer to peerAPIHandler ... The peerAPIHandler is instantiated per PeerAPI call so it is guaranteed to have the latest selfNode. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	2f4fca65a1	ipn/ipnlocal: prevent duplicate profiles of the same user ... Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	e9c851b04b	ipn/ipnlocal: also accept service IP IPv6 literal in brackets for quad100 ... The fix in 4fc8538e2 was sufficient for IPv6. Browsers (can?) send the IPv6 literal, even without a port number, in brackets. Updates tailscale/corp#7948 Change-Id: I0e429d3de4df8429152c12f251ab140b0c8f6b77 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	296e712591	tailcfg: add CapabilityDebug ... Updates tailscale/corp#7948 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	1e78fc462c	ipn/ipnlocal: add some validation to PeerAPI ... Updates tailscale/corp#7948 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	22238d897b	all: standardize on PeerAPI ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	1b56acf513	ipn/ipnlocal: move LocalBackend.validPopBrowserURL empty check from caller ... I was too late with review feedback to 513780f4f8. Updates tailscale/corp#7948 Change-Id: I8fa3b4eba4efaff591a2d0bfe6ab4795638b7c3a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	513780f4f8	ipn/ipnlocal: move URL validation to LocalBackend ... Updates tailscale/corp#7948 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	4caca8619e	ipn/localapi: serve files with application/octet-stream Content-Type ... Updates tailscale/corp#7948 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I5f570c04974598c7abae4017e4a7a0f63492c87c	2 years ago
Brad Fitzpatrick	4fc8538e2f	ipn/ipnlocal: check quad100 Host header in info page ... Updates tailscale/corp#7948 Change-Id: I0ab61c764bff9ba8afaf9070db73e971eb018477 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	49b0ce8180	ipn/ipnlocal: update profile on server sent profile changes ... We were not updating the LoginProfile.UserProfile when a netmap updated the UserProfile (e.g. when a node was tagged via the admin panel). Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	976e88d430	client/tailscale/apitype: add LocalAPIHost const, use it ... Removes duplication. Updates tailcale/corp#7948 Change-Id: I564c912ecfde31ba2293124bb1316e433c2a10f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6ea2d01626	ipn/ipnlocal: be more assertive about rules for applyPrefsToHostinfo (now Locked) ... The old docs were too cagey. Change-Id: I92c4fdc4165e7ca35c4537aebe51eb3604b56f6d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	d3878ecd62	ipn/ipnlocal: add client metrics for profile switching ... Updates #713 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	235309adc4	all: store NL keys per profile ... This moves the NetworkLock key from a dedicated StateKey to be part of the persist.Persist struct. This struct is stored as part for ipn.Prefs and is also the place where we store the NodeKey. It also moves the ChonkDir from "/tka" to "/tka-profile/<profile-id>". The rename was intentional to be able to delete the "/tka" dir if it exists. This means that we will have a unique key per profile, and a unique directory per profile. Note: `tailscale logout` will delete the entire profile, including any keys. It currently does not delete the ChonkDir. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	fe81ee62d7	ipn/ipnlocal: do controlclient.Shutdown in a different goroutine ... We do not need to wait for it to complete. And we might have to call Shutdown from callback from the controlclient which might already be holding a lock that Shutdown requires. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	42855d219b	ipn/ipnlocal: fix checks for node-key presence in TKA logic ... Found by tests in another repo. TKA code wasn't always checking enough to be sure a node-key was set for the current state. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Mihai Parparita	0cc65b4bbe	ipn/localapi: add LocalAPI endpoints for profile switching ... Exposes a REST-y API for interacting with the profile switching introduced in #6022. Updates #713 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Tom DNetto	3271daf7a3	cmd/tailscale,ipn: support disablement args in lock cli, implement disable ... * Support specifiying disablement values in lock init command * Support specifying rotation key in lock sign command * Implement lock disable command * Implement disablement-kdf command Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	7c285fe7ee	ipn/ipnlocal: fix error message typo in ingress peerapi handler ... Updates tailscale/corp#7515 Change-Id: I81edd7d9f8958eef61be71d3d34e545cd3347008 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3114eacbb8	ipn/ipnlocal: don't warn about serve listener failing on IPv6-less machines ... Fixes #6303 Change-Id: Ie1ce12938f68dfa0533246bbe3b9d7f3e749a243 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3f8e185003	health: add Warnable, move ownership of warnable items to callers ... The health package was turning into a rando dumping ground. Make a new Warnable type instead that callers can request an instance of, and then Set it locally in their code without the health package being aware of all the things that are warnable. (For plenty of things the health package will want to know details of how Tailscale works so it can better prioritize/suppress errors, but lots of the warnings are pretty leaf-y and unrelated) This just moves two of the health warnings. Can probably move more later. Change-Id: I51e50e46eb633f4e96ced503d3b18a1891de1452 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	b87cb2c4a5	ipn/ipnlocal: call restart backend on user changes ... This makes it so that the backend also restarts when users change, otherwise an extra call to Start was required. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	8e85227059	cmd/tailscale/cli: [set] handle selectively modifying routes/exit node ... Noticed this while debugging something else, we would reset all routes if either `--advertise-exit-node` or `--advertise-routes` were set. This handles correctly updating them. Also added tests. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	26d1fc867e	ipn/ipnlocal: delete profile on logout ... Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	9e70daad6f	ipn/ipnlocal: make TKA tests not have side effects ... It left the envknob turned on which meant that running all the tests in the package had different behavior than running just any one test. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
shayne	74e892cbc2	ipn/ipnlocal: listen to serve ports on netmap addrs (#6282) ... Updates tailscale/corp#7515 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Brad Fitzpatrick	08e110ebc5	cmd/tailscale: make "up", "status" warn if routes and --accept-routes off ... Example output: # Health check: # - Some peers are advertising routes but --accept-routes is false Also, move "tailscale status" health checks to the bottom, where they won't be lost in large netmaps. Updates #2053 Updates #6266 Change-Id: I5ae76a0cd69a452ce70063875cd7d974bfeb8f1a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	4c31183781	cmd/tailscale,ipn: minor fixes to tailscale lock commands ... * Fix broken add/remove key commands * Make lock status display whether the node is signed Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	ae18cd02c1	ipn: add AdvertisesExitNode and AdminPageURL accessors to PrefsView ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	6cc0036b40	ipn/ipnlocal: use updated prefs in tkaSyncIfNeeded ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	f00a49667d	control/controlclient: make Status.Persist a PersistView ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	4d330bac14	ipn/ipnlocal: add support for multiple user profiles ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	c9d6a9cb4d	ipn/ipnlocal: add optional TLS termination on proxied TCP connections ... Updates tailscale/corp#7515 Change-Id: Ib250fa20275971563adccfa72db48e0cec02b7a5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Pat Maddox	9bf3ef4167	ssh/tailssh: add Tailscale SSH (server) support on FreeBSD ... Change-Id: I607194b6ef99205e777f3df93a74ffe1a2e0344c Signed-off-by: Pat Maddox <pat@ratiopbc.com>	2 years ago
shayne	e3a66e4d2f	ipn/localapi: introduce get/set config for serve (#6243) ... Updates tailscale/corp#7515 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Brad Fitzpatrick	7b5866ac0a	ipn/ipnlocal: support serving files/directories too ... Updates tailscale/corp#7515 Change-Id: I7b4c924005274ba57763264313d70d2a0c55da30 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	7a07bc654b	ipn/localapi: rename /profile to /pprof ... Avoids name collision with profiles for user switching. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	d7bfef12cf	ipn/ipnlocal: support https+insecure:// backend proxy targets ... Updates tailscale/corp#7515 Change-Id: Ie50295c09e4a16959b37087d8165c4d7360db37f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	9dfb0916c2	ipn/ipnlocal, tailcfg: wire up ingress peerapi ... Updates tailscale/corp#7515 Co-authored-by: Shayne Sweeney <shayne@tailscale.com> Change-Id: I7eac7b4ac37fd8e8a9e0469594c1e9e7dd0da666 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Aaron Klotz	73b8968404	ipn/ipnlocal: ensure Persist information is saved to server mode start state ... Numerous issues have been filed concerning an inability to install and run Tailscale headlessly in unattended mode, particularly after rebooting. The server mode `Prefs` stored in `server-state.conf` were not being updated with `Persist` state once the node had been succesfully logged in. Users have been working around this by finagling with the GUI to make it force a state rewrite. This patch makes that unnecessary by ensuring the required server mode state is updated when prefs are updated by the control client. Fixes https://github.com/tailscale/tailscale/issues/3186 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Brad Fitzpatrick	32a4ff3e5f	ipn/ipnlocal: implement the reverse proxy HTTP handler type ... Updates tailscale/corp#7515 Change-Id: Icbfe57f44b9516388edc0556eb04a370a9e3e009 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6beb3184d5	ipn/ipnlocal: don't serve a TLS cert unless it has webserver config ... Even if the name is right, or is configured on a different port. Updates tailscale/corp#7515 Change-Id: I8b721968f3241af10d98431e1b5ba075223e6cd3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	1a94c309ea	ipn/ipnlocal: support web TLS ports other than 443 ... Updates tailscale/corp#7515 Change-Id: I87df50b1bc92efd1d8c538c2ad4f1222361e4d6b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	4797bacb7c	ipn/ipnlocal: send RST when serving an actionless TCPPortHandler ... Updates tailscale/corp#7515 Change-Id: I790f1b5d1e8a887e39bb573b4610b8f37a3f5963 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b683921b87	ipn/ipnlocal: add start of handling TCP proxying ... Updates tailscale/corp#7515 Change-Id: I82d19b5864674b2169f25ec8e429f60a543e0c57 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	4bccc02413	ipn/ipnlocal: use ServerConfig views internally ... Updates tailscale/corp#7515 Change-Id: Ica2bc44b92d281d5ce16cee55b7ca51c7910145c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	25e26c16ee	ipn/ipnlocal: start implementing web server bits of serve ... Updates tailscale/corp#7515 Change-Id: I96f4016161ba3c370492da941274c6d9a234c2bb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	df5e40f731	ipn: add WebServerConfig, add views ... cmd/viewer couldn't deal with that map-of-map. Add a wrapper type instead, which also gives us a place to add future stuff. Updates tailscale/corp#7515 Change-Id: I44a4ca1915300ea8678e5b0385056f0642ccb155 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	2daf0f146c	ipn/ipnlocal, wgengine/netstack: start handling ports for future serving ... Updates tailscale/corp#7515 Change-Id: I966e936e72a2ee99be8d0f5f16872b48cc150258 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6d8320a6e9	ipn/{ipnlocal,localapi}: move most of cert.go to ipnlocal ... Leave only the HTTP/auth bits in localapi. Change-Id: I8e23fb417367f1e0e31483e2982c343ca74086ab Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	9be8d15979	ipn/localapi: refactor some cert code in prep for a move ... I want to move the guts (after the HTTP layer) of the certificate fetching into the ipnlocal package, out of localapi. As prep, refactor a bit: * add a method to do the fetch-from-cert-or-as-needed-with-refresh, rather than doing it in the HTTP hander * convert two methods to funcs, taking the one extra field (LocalBackend) then needed from their method receiver. One of the methods needed nothing from its receiver. This will make a future change easier to reason about. Change-Id: I2a7811e5d7246139927bb86e7db8009bf09b3be3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	5bb7e0307c	cmd/tailscale, ipn/ipnlocal: add debug command to write to StateStore for dev ... Not for end users (unless directed by support). Mostly for ease of development for some upcoming webserver work. Change-Id: I43acfed217514567acb3312367b24d620e739f88 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	da8def8e13	all: remove old +build tags ... The //go:build syntax was introduced in Go 1.17: https://go.dev/doc/go1.17#build-lines gofmt has kept the +build and go:build lines in sync since then, but enough time has passed. Time to remove them. Done with: perl -i -npe 's,^// \+build.*\n,,' $(git grep -l -F '+build') Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	bb2cba0cd1	ipn: add missing check for nil Notify.Prefs ... This was missed in 6afe26575c Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	6afe26575c	ipn: make Notify.Prefs be a *ipn.PrefsView ... It is currently a `ipn.PrefsView` which means when we do a JSON roundtrip, we go from an invalid Prefs to a valid one. This makes it a pointer, which fixes the JSON roundtrip. This was introduced in 0957bc5af2. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	e55ae53169	tailcfg: add Node.UnsignedPeerAPIOnly to let server mark node as peerapi-only ... capver 48 Change-Id: I20b2fa81d61ef8cc8a84e5f2afeefb68832bd904 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	e975cb6b05	ipn/ipnlocal: fix test flake when we log after a test completes ... This switches from using an atomic.Bool to a mutex for reasons that are described in the commit, and should address the flakes that we're still seeing. Fixes #3020 Change-Id: I4e39471c0eb95886db03020ea1ccf688c7564a11 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Tom DNetto	0af57fce4c	cmd/tailscale,ipn: implement lock sign command ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	910db02652	client/tailscale, tsnet, ipn/ipnlocal: prove nodekey ownership over noise ... Fixes #5972 Change-Id: Ic33a93d3613ac5dbf172d6a8a459ca06a7f9e547 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	d98305c537	cmd,ipn/ipnlocal,tailcfg: implement TKA disablement ... * Plumb disablement values through some of the internals of TKA enablement. * Transmit the node's TKA hash at the end of sync so the control plane understands each node's head. * Implement /machine/tka/disable RPC to actuate disablement on the control plane. There is a partner PR for the control server I'll send shortly. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Anton Tolchanov	193afe19cb	ipn/ipnlocal: add tags and a few other details to self status ... This makes tags, creation time, exit node option and primary routes for the current node exposed via `tailscale status --json` Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Mihai Parparita	4e6e3bd13d	ipn/ipnlocal: fix a log line having function pointers instead of values ... Followup to using ipn.PrefsView (#6031). Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	19b5586573	cmd/tailscale/cli: add beginnings of `tailscale set` ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	2a9ba28def	ipn/ipnlocal: set prefs before calling tkaSyncIfNeeded ... Caught this in a test in a different repo. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	9f39c3b10f	ipn/ipnlocal: make EditPrefs strip private keys before returning ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	a2d15924fb	types/persist: add PublicNodeKey helper ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	0957bc5af2	ipn/ipnlocal: use ipn.PrefsView ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	20324eeebc	ipn/prefs: add views ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	def089f9c9	portlist: unexport all Poller fields, removing unused one, rework channels ... Poller.C and Poller.c were duplicated for one caller. Add an accessor returning the receive-only version instead. It'll inline. Poller.Err was unused. Remove. Then Poller is opaque. The channel usage and shutdown was a bit sketchy. Clean it up. And document some things. Change-Id: I5669e54f51a6a13492cf5485c83133bda7ea3ce9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	afce773aae	ipn: remove handle.go ... It was unused in this repo. The Windows client used it, but it can move there. Change-Id: I572816fd80cbbf1b8db734879b6280857d5bd2a7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	9475801ebe	ipn/ipnlocal: fix E.G.G. port number accounting ... Change-Id: Id35461fdde79448372271ba54f6e6af586f2304d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	630bcb5b67	tsnet,client/tailscale: add APIClient which runs API over Noise. ... Updates tailscale/corp#4383 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	c32f9f5865	cmd/tailscale, ipn: enable debug logs when --report flag is passed to bugreport (#5830) ... Change-Id: Id22e9f4a2dcf35cecb9cd19dd844389e38c922ec Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Tom DNetto	a515fc517b	ipn/ipnlocal: make tkaSyncIfNeeded exclusive with a mutex ... Running corp/ipn#TestNetworkLockE2E has a 1/300 chance of failing, and deskchecking suggests thats whats happening are two netmaps are racing each other to be processed through tkaSyncIfNeededLocked. This happens in the first place because we release b.mu during network RPCs. To fix this, we make the tka sync logic an exclusive section, so two netmaps will need to wait for tka sync to complete serially (which is what we would want anyway, as the second run through probably wont need to sync). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	227777154a	control/controlclient,ipn/ipnlocal,tailcfg: rotate node-key signature on register ... CAPVER 47 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	b2994568fe	ipn/localapi: put all the LocalAPI methods into a map ... Rather than a bunch of switch cases. Change-Id: Id1db813ec255bfab59cbc982bee351eb36373245 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6d76764f37	ipn/ipnlocal: fix taildrop target list UI bug ... The macOS and iOS apps that used the /localapi/v0/file-targets handler were getting too many candidate targets. They wouldn't actually accept the file. This is effectively just a UI glitch in the wrong hosts being listed as valid targets from the source side. Change-Id: I6907a5a1c3c66920e5ec71601c044e722e7cb888 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	a37ee8483f	ipn/ipnlocal: fix data race from missing lock in NetworkLockStatus ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	8602061f32	ipn/ipnlocal,tka: Fix bugs found by integration testing ... * tka.State.staticValidateCheckpoint could call methods on a contained key prior to calling StaticValidate on that key * Remove broken backoff / RPC retry logic from tka methods in ipn/ipnlocal, to be fixed at a later time * Fix NetworkLockModify() which would attempt to take b.mu twice and deadlock, remove now-unused dependence on netmap * Add methods on ipnlocal.LocalBackend to be used in integration tests * Use TAILSCALE_USE_WIP_CODE as the feature flag so it can be manipulated in tests Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	73db56af52	ipn/ipnlocal: filter peers with bad signatures when tka is enabled ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	1841d0bf98	wgengine/magicsock: make debug-level stuff not logged by default ... And add a CLI/localapi and c2n mechanism to enable it for a fixed amount of time. Updates #1548 Change-Id: I71674aaf959a9c6761ff33bbf4a417ffd42195a7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	d7c0410ea8	ipn/localapi: print hostinfo and health on bugreport (#5816) ... This information is super helpful when debugging and it'd be nice to not have to scroll around in the logs to find it near a bugreport. Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Mihai Parparita	8343b243e7	all: consistently initialize Logf when creating tsdial.Dialers ... Most visible when using tsnet.Server, but could have resulted in dropped messages in a few other places too. Fixes #5743 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Josh Soref	d4811f11a0	all: fix spelling mistakes ... Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>	2 years ago
Adrian Dewhurst	c581ce7b00	cmd/tailscale, client, ipn, tailcfg: add network lock modify command ... Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2 years ago
Tom DNetto	58ffe928af	ipn/ipnlocal, tka: Implement TKA synchronization with the control plane ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	ebd1637e50	ipn/ipnlocal,tailcfg: Identify client using NodeKey in tka RPCs ... Updates https://github.com/tailscale/corp/pull/7024 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	9bdf0cd8cd	ipn/ipnlocal: add c2n /debug/{goroutines,prefs,metrics} ... * and move goroutine scrubbing code to its own package for reuse * bump capver to 45 Change-Id: I9b4dfa5af44d2ecada6cc044cd1b5674ee427575 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	b1867457a6	doctor: add package for running in-depth healthchecks; use in bugreport (#5413) ... Change-Id: Iaa4e5b021a545447f319cfe8b3da2bd3e5e5782b Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Andrew Dunham	e1bdbfe710	tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan field (#5648) ... * tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan field This field allows the control server to provide explicit information about how to connect to it; useful if the client's link status can change after the initial connection, or if the DNS settings pushed by the control server break future connections. Change-Id: I720afe6289ec27d40a41b3dcb310ec45bd7e5f3e Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Maisem Ali	d5781f61a9	ipn/ipnlocal: return usernames when Tailscale SSH is enabled ... It was checking if the sshServer was initialized as a proxy, but that could either not have been initialized yet or Tailscale SSH could have been disabled after intialized. Also bump tailcfg.CurrentCapabilityVersion Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	e9b98dd2e1	control/controlclient,ipn/ipnlocal: wire tka enable/disable ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	054ef4de56	tailcfg: mark CapabilityFileSharingTarget as inter-node ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	d045462dfb	ipn/ipnlocal: add c2n method to get SSH username candidates ... For control to fetch a list of Tailscale SSH username candidates to filter against the Tailnet's SSH policy to present some valid candidates to a user. Updates #3802 Updates tailscale/corp#7007 Change-Id: I3dce57b7a35e66891d5e5572e13ae6ef3c898498 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	65c24b6334	envknob: generalize Windows tailscaled-env.txt support ... ipnserver previously had support for a Windows-only environment variable mechanism that further only worked when Windows was running as a service, not from a console. But we want it to work from tailscaed too, and we want it to work on macOS and Synology. So move it to envknob, now that envknob can change values at runtime post-init. A future change will wire this up for more platforms, and do something more for CLI flags like --port, which the bug was originally about. Updates #5114 Change-Id: I9fd69a9a91bb0f308fc264d4a6c33e0cbe352d71 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	4a82b317b7	ipn/{ipnlocal,localapi}: use strs.CutPrefix, add more domain validation ... The GitHub CodeQL scanner flagged the localapi's cert domain usage as a problem because user input in the URL made it to disk stat checks. The domain is validated against the ipnstate.Status later, and only authenticated root/configured users can hit this, but add some paranoia anyway. Change-Id: I373ef23832f1d8b3a27208bc811b6588ae5a1ddd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Eng Zer Jun	f0347e841f	refactor: move from io/ioutil to io and os packages ... The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	2 years ago
Brad Fitzpatrick	74674b110d	envknob: support changing envknobs post-init ... Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	d34dd43562	ipn/ipnlocal: remove unused envknob ... Change-Id: I6d18af2c469eb660e6ca81d1dcc2af33c9e628aa Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	45a3de14a6	cmd/tailscaled, tailcfg, hostinfo: add flag to disable logging + support ... As noted in #5617, our documented method of blocking log.tailscale.io DNS no longer works due to bootstrap DNS. Instead, provide an explicit flag (--no-logs-no-support) and/or env variable (TS_NO_LOGS_NO_SUPPORT=true) to explicitly disable logcatcher uploads. It also sets a bit on Hostinfo to say that the node is in that mode so we can end any support tickets from such nodes more quickly. This does not yet provide an easy mechanism for users on some platforms (such as Windows, macOS, Synology) to set flags/env. On Linux you'd used /etc/default/tailscaled typically. Making it easier to set flags for other platforms is tracked in #5114. Fixes #5617 Fixes tailscale/corp#1475 Change-Id: I72404e1789f9e56ec47f9b7021b44c025f7a373a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f3ce1e2536	util/mak: deprecate NonNil, add type-safe NonNilSliceForJSON, NonNilMapForJSON ... And put the rationale in the name too to save the callers the need for a comment. Change-Id: I090f51b749a5a0641897ee89a8fb2e2080c8b782 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	b8596f2a2f	net/dnsfallback: cache most recent DERP map on disk (#5545) ... This is especially helpful as we launch newer DERPs over time, and older clients have progressively out-of-date static DERP maps baked in. After this, as long as the client has successfully connected once, it'll cache the most recent DERP map it knows about. Resolves an in-code comment from @bradfitz Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Brad Fitzpatrick	ba3cc08b62	cmd/tailscale/cli: add backwards compatibility 'up' processing for legacy client ... Updates tailscale/corp#6781 Change-Id: I843fc810cbec0140d423d65db81e90179d6e0fa5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	be95aebabd	tka: implement credential signatures (key material delegation) ... This will be needed to support preauth-keys with network lock in the future, so getting the core mechanics out of the way now. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	1ac4a26fee	ipn/localapi: send Tailscale version in ACME User-Agent (#5499) ... Requested by a friend at Let's Encrypt. Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Brad Fitzpatrick	761163815c	tailcfg: add Hostinfo.Userspace{,Router} bits ... Change-Id: Iad47f904872f2df146c1f63945f79cfddeac7fe8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	c66f99fcdc	tailcfg, control/controlclient, ipn/ipnlocal: add c2n (control-to-node) system ... This lets the control plane can make HTTP requests to nodes. Then we can use this for future things rather than slapping more stuff into MapResponse, etc. Change-Id: Ic802078c50d33653ae1f79d1e5257e7ade4408fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Nahum Shalman	d20392d413	cmd/tailscale: add emoji for illumos in status subcommand ... Signed-off-by: Nahum Shalman <nahamu@gmail.com>	2 years ago
Tom DNetto	79905a1162	tka: make storage a parameter rather than an Authority struct member ... Updates #5435 Based on the discussion in #5435, we can better support transactional data models by making the underlying storage layer a parameter (which can be specialized for the request) rather than a long-lived member of Authority. Now that Authority is just an instantaneous snapshot of state, we can do things like provide idempotent methods and make it cloneable, too. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Mihai Parparita	7a5cf39d0d	ipn/ipnlocal: fix Taildrop not returning any sharing targets ... The CapabilityFileSharingTarget capability added by eb32847d85 is meant to control the ability to share with nodes not owned by the current user, not to restrict all sharing (the coordination server is not currently populating the capability at all) Fixes tailscale/corp#6669 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Tom DNetto	472529af38	tka: optimize common case of processing updates built from head ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	039def3b50	ipn,tailcfg: transmit NodeID in tka init RPCs ... Needed to identify the node. A serverside-check the machine key (used to authenticate the noise session) is that of the specified NodeID ensures the authenticity of the request. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	facafd8819	client,cmd/tailscale,ipn,tka,types: implement tka initialization flow ... This PR implements the client-side of initializing network-lock with the Coordination server. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Joe Tsai	32a1a3d1c0	util/deephash: avoid variadic argument for Update (#5372) ... Hashing []any is slow since hashing of interfaces is slow. Hashing of interfaces is slow since we pessimistically assume that cycles can occur through them and start cycle tracking. Drop the variadic signature of Update and fix callers to pass in an anonymous struct so that we are hashing concrete types near the root of the value tree. Signed-off-by: Joe Tsai <joetsai@digital-static.net> Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	4ee64681ad	tailcfg, control/controlclient: make Debug settings sticky in a map session [capver 37] ... Fixes #4843 Change-Id: I3accfd91be474ac745cb47f5d6e866c37d5c5d2d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	486cc9393c	ipn/ipnlocal: fix log about local IPs when using exit nodes ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	a9f6cd41fd	all: use syncs.AtomicValue ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	4950fe60bd	syncs, all: move to using Go's new atomic types instead of ours ... Fixes #5185 Change-Id: I850dd532559af78c3895e2924f8237ccc328449d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	9bb5a038e5	all: use atomic.Pointer ... Also add some missing docs. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	4001d0bf25	assorted: plumb tka initialization & network-lock key into tailscaled ... - A network-lock key is generated if it doesn't already exist, and stored in the StateStore. The public component is communicated to control during registration. - If TKA state exists on the filesystem, a tailnet key authority is initialized (but nothing is done with it for now). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	5f6abcfa6f	all: migrate code from netaddr.FromStdAddr to Go 1.18 ... With caveat https://github.com/golang/go/issues/53607#issuecomment-1203466984 that then requires a new wrapper. But a simpler one at least. Updates #5162 Change-Id: I0a5265065bfcd7f21e8dd65b2bd74cae90d76090 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	eb32847d85	tailcfg: add CapabilityFileSharingTarget to identify FileTargets ... This adds the inverse to CapabilityFileSharingSend so that senders can identify who they can Taildrop to. Updates #2101 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	116f55ff66	all: gofmt for Go 1.19 ... Updates #5210 Change-Id: Ib02cd5e43d0a8db60c1f09755a8ac7b140b670be Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	eae003e56f	ipn/ipnlocal: blend existing host SSH keys + newly-generated types as needed ... If the host only has RSA, use its RSA + generate ecdsa + ed25519, etc. Perhaps fixes https://twitter.com/colek42c/status/1550554439299244032 and something else that was reported. Change-Id: I88dc475c8e3d95b6f25288ff7664b8e72655fd16 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	97b8c4fa1b	ipn/store/awsstore: add "ts_omit_aws" build tag to reduce binary size ... Drops tailscaled from 23M to 21M. Change-Id: I731c542d03113ac94abb695e3c8fcacbc5542712 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a12aad6b47	all: convert more code to use net/netip directly ... perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6a396731eb	all: use various net/netip parse funcs directly ... Mechanical change with perl+goimports. Changed {Must,}Parse{IP,IPPrefix,IPPort} to their netip variants, then goimports -d . Finally, removed the net/netaddr wrappers, to prevent future use. Updates #5162 Change-Id: I59c0e38b5fbca5a935d701645789cddf3d7863ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7eaf5e509f	net/netaddr: start migrating to net/netip via new netaddr adapter package ... Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Denton Gentry	f85bb60eba	ipn/ipnlocal: prevent attempting to run SSH on QNAP for now ... tailscaled runs as a non-root user, SSH is not immediately working. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Denton Gentry	d17849461c	ipn/{ipnserver,ipnlocal}: support incoming Taildrop on QNAP ... Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Brad Fitzpatrick	ba91f57ddd	ipn/ipnlocal: ignore empty SSH host key files ... Change-Id: I332b0d7d01386111d0af4adf98c96c04d3d12fbb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	227c6b2a53	ipn/ipnlocal: flesh out error on ssh host key parse error ... Change-Id: Iedd2d3898befa536181036b9e9dea59bc777a440 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	4d0461f721	ipn/ipnlocal: logout ephemeral nodes on shutdown ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	469c30c33b	ipn/localapi: define a cert dir for Synology DSM6 ... Fixes #4060 Change-Id: I5f145d4f56f6edb14825268e858d419c55918673 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	e37167b3ef	ipn/localapi: add API for uploading client metrics ... Clients may have platform-specific metrics they would like uploaded (e.g. extracted from MetricKit on iOS). Add a new local API endpoint that allows metrics to be updated by a simple name/value JSON-encoded struct. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	ec649e707f	ipn/ipnlocal: prefer to use one CGNAT route on the Mac ... Together with 06aa141632 this minimizes the number of NEPacketTunnelNetworkSettings updates that we have to do, and thus avoids Chrome interrupting outstanding requests due to (perceived) network changes. Updates #3102 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	aa37aece9c	ipn/ipnlocal, net/dns*, util/cloudenv: add AWS DNS support ... And remove the GCP special-casing from ipn/ipnlocal; do it only in the forwarder for *.internal. Fixes #4980 Fixes #4981 Change-Id: I5c481e96d91f3d51d274a80fbd37c38f16dfa5cb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	88c2afd1e3	ipn/ipnlocal, net/dns*, util/cloudenv: specialize DNS config on Google Cloud ... This does three things: * If you're on GCP, it adds a *.internal DNS split route to the metadata server, so we never break GCP DNS names. This lets people have some Tailscale nodes on GCP and some not (e.g. laptops at home) without having to add a Tailnet-wide *.internal DNS route. If you already have such a route, though, it won't overwrite it. * If the 100.100.100.100 DNS forwarder has nowhere to forward to, it forwards it to the GCP metadata IP, which forwards to 8.8.8.8. This means there are never errNoUpstreams ("upstream nameservers not set") errors on GCP due to e.g. mangled /etc/resolv.conf (GCP default VMs don't have systemd-resolved, so it's likely a DNS supremacy fight) * makes the DNS fallback mechanism use the GCP metadata IP as a fallback before our hosted HTTP-based fallbacks I created a default GCP VM from their web wizard. It has no systemd-resolved. I then made its /etc/resolv.conf be empty and deleted its GCP hostnames in /etc/hosts. I then logged in to a tailnet with no global DNS settings. With this, tailscaled writes /etc/resolv.conf (direct mode, as no systemd-resolved) and sets it to 100.100.100.100, which then has regular DNS via the metadata IP and *.internal DNS via the metadata IP as well. If the tailnet configures explicit DNS servers, those are used instead, except for *.internal. This also adds a new util/cloudenv package based on version/distro where the cloud type is only detected once. We'll likely expand it in the future for other clouds, doing variants of this change for other popular cloud environments. Fixes #4911 RELNOTES=Google Cloud DNS improvements Change-Id: I19f3c2075983669b2b2c0f29a548da8de373c7cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	87a4c75fd4	control/controlclient, ipn/ipnlocal: remove Client.SetExpirySooner, fix race ... Client.SetExpirySooner isn't part of the state machine. Remove it from the Client interface. And fix a use of LocalBackend.cc without acquiring the lock that guards that field. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ef0d740270	control/controlclient: remove Client.SetStatusFunc ... It can't change at runtime. Make it an option. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	70a2797064	control/controlclient, ipn/ipnlocal: remove some Client methods ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a1e429f7c3	control/controlclient, types/netmap: remove unused LocalPort field ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	467eb2eca0	cmd/tailscale/cli, ipn/ipnlocal: give SSH tips when off/unconfigured ... Updates #3802 Change-Id: I6b9a3175f68a6daa670f912561f2c2ececc07770 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Praneet Loke	d8c05fc1b2	Update a Taildrop error message (#4818) ... ipn/ipnlocal: update error message on Taildrop send while not connected Signed-off-by: Praneet <1466314+praneetloke@users.noreply.github.com>	3 years ago
Melanie Warrick	3a182d5dd6	ipn/ipnstate: add ExitNodeStatus to share the exit node if it is in use, the IP, ID and whether its online. (#4761) ... - Updates #4619 Signed-off-by: nyghtowl <warrick@tailscale.com>	3 years ago
Mihai Parparita	27a1ad6a70	wasm: exclude code that's not used on iOS for Wasm too ... It has similar size constraints. Saves ~1.9MB from the Wasm build. Updates #3157 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Brad Fitzpatrick	4007601f73	cmd/controlclient: wire up PingRequest peerapi pings too ... Updates tailscale/corp#754 Change-Id: I61ac3fc44783b54bd02455bcb0baf19159b7a9d2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fbc079d82d	ipn/ipnlocal: prevent attempting to run SSH on Synology for now ... On DSM7 as a non-root user it'll run into problems. And we haven't tested on DSM6, even though it might work, but I doubt it. Updates #3802 Updates tailscale/corp#5468 Change-Id: I75729042e4788f03f9eb82057482a44b319f04f3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a9b4bf1535	ipn/ipnserver, cmd/tailscaled: fix peerapi on Windows ... We weren't wiring up netstack.Impl to the LocalBackend in some cases on Windows. This fixes Windows 7 when run as a service. Updates #4750 (fixes after pull in to corp repo) Change-Id: I9ce51b797710f2bedfa90545776b7628c7528e99 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Jordan Whited	43f9c25fd2	cmd/tailscale: surface authentication errors in status.Health (#4748) ... Fixes #3713 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 years ago
Maisem Ali	928530a112	ipn/ipnlocal: shutdown sshServer on tailscale down ... Also lazify SSHServer initialization to allow restarting the server on a subsequent `tailscale up` Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	4d85cf586b	cmd/tailscale, ipn/ipnlocal: add "peerapi" ping type ... For debugging when stuff like #4750 isn't working. RELNOTE=tailscale ping -peerapi Change-Id: I9c52c90fb046e3ab7d2b121387073319fbf27b99 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	7cd8c3e839	ssh/tailssh: terminate sessions when tailscaled shutsdown ... Ideally we would re-establish these sessions when tailscaled comes back up, however we do not do that yet so this is better than leaking the sessions. Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Joel Cressy	c16271fb46	ipn/localapi: implement LoginInteractive via localapi ... Updates: #4738 Signed-off-by: Joel Cressy <joel@jtcressy.net>	3 years ago
Brad Fitzpatrick	cc91a05686	ipn/ipnserver: fix build on js/wasm ... Broken by 3dedcd1640 but we don't have CI coverage yet. Updates #3157 Change-Id: Ie8e95ebd36264887fdeed16fc9f25a857d48124b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	da601c23e1	ipn/ipnlocal: add missing place where we set the SSH atomic ... This fixes the "tailscale up --authkey=... --ssh" path (or any "up" path that used Start instead of EditPrefs) which wasn't setting the bit. Updates #3802 Change-Id: Ifca532ec58296fedcedb5582312dfee884367ed7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	fd99c54e10	tailcfg,all: change structs to []*dnstype.Resolver ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	e409e59a54	cmd/cloner,util/codegen: refactor cloner internals to allow reuse ... Also run go generate again for Copyright updates. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	35111061e9	wgengine/netstack, ipn/ipnlocal: serve http://100.100.100.100/ ... For future stuff. Change-Id: I64615b8b2ab50b57e4eef1ca66fa72e3458cb4a9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3e1f2d01f7	ipn/ipnlocal: move Ping method from IPN bus to LocalBackend (HTTP) ... Change-Id: I61759f1dae8d9d446353db54c8b1e13bfffb3287 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	c60cbca371	control/controlclient: store netinfo and hostinfo separately ... Currently, when SetNetInfo is called it sets the value on hostinfo.NetInfo. However, when SetHostInfo is called it overwrites the hostinfo field which may mean it also clears out the NetInfo it had just received. This commit stores NetInfo separately and combines it into Hostinfo as needed so that control is always notified of the latest values. Also, remove unused copies of Hostinfo from ipn.Status and controlclient.Auto. Updates #tailscale/corp#4824 (maybe fixes) Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
James Tucker	ae483d3446	wgengine, net/packet, cmd/tailscale: add ICMP echo ... Updates tailscale/corp#754 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Tom DNetto	9dee6adfab	cmd/tailscaled,ipn/ipnlocal,wgengine/...: pass dns.Manager into netstack ... Needed for a following commit which moves magicDNS handling into netstack. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Maisem Ali	3012a2e1ca	ssh/tailssh,ipn/ipnlocal: terminate any active sessions on `up --ssh=false` ... Currently the ssh session isn't terminated cleanly, instead the packets are just are no longer routed to the in-proc SSH server. This makes it so that clients get a disconnection when the `RunSSH` pref changes to `false`. Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Mihai Parparita	2ec371fe8b	ipn: remove FakeExpireAfter Backend function ... No callers remain (last one was removed with tailscale/corp@1c095ae08f), and it's pretty esoteric. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Mihai Parparita	316523cc1e	ipn: remove enforceDefaults option from PrefsFromBytes ... The Mac client was using it, but it had the effect of the `RouteAll` ("Use Tailscale subnets") pref always being enabled at startup, regardless of the persisted value. enforceDefaults was added to handle cases from ~2 years ago where we ended up with persisted `"RouteAll": false` values in the keychain, but that should no longer be a concern. New users will get the default of it being enabled via `NewPrefs`. There will be a corresponding Mac client change to stop passing in enforceDefaults. For #3962 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Maisem Ali	5a1ef1bbb9	net/tsdial: add SystemDial as a wrapper on netns.Dial ... The connections returned from SystemDial are automatically closed when there is a major link change. Also plumb through the dialer to the noise client so that connections are auto-reset when moving from cellular to WiFi etc. Updates #3363 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	637cc1b5fc	ipn/ipnlocal/peerapi: add endpoint to list local interfaces ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	c88506caa6	ipn/ipnlocal: add Wake-on-LAN function to peerapi ... No CLI support yet. Just the curl'able version if you know the peerapi port. (like via a TSMP ping) Updates #306 Change-Id: I0662ba6530f7ab58d0ddb24e3664167fcd1c4bcf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3f7cc3563f	ipn: always treat login.tailscale.com as controlplane.tailscale.com ... Like 888e50e1, but more aggressive. Updates #4538 (likely fixes) Updates #3488 Change-Id: I3924eee9110e47bdba926ce12954253bf2413040 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3601b43530	ipn: add IPCVersion override func ... I've done this a handful of times in the past and again today. Time to make it a supported thing for the future. Used while debugging tailscale/corp#4559 (macsys CLI issues) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	1a19aed410	ipn/ipnlocal: do not initialize peer api listeners when shutting down ... Updates tailscale/corp#4824 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	910ae68e0b	util/mak: move tailssh's mapSet into a new package for reuse elsewhere ... Change-Id: Idfe95db82275fd2be6ca88f245830731a0d5aecf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7a097ccc83	ipn/ipnlocal: close peerapi listeners on LocalBackend.Shutdown ... For tests. Now that we can always listen (whereas we used to fail prior to a2c330c496), some goroutine leak checks were failing in tests in another repo after that change. Change-Id: Id95a4b71167eca61962a48616d79741b9991e0bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	a2c330c496	ipn/ipnlocal: use the fake peerapi listener as fallback if netstack available ... The previous commit (1b89662eff) this for Android, but we can also use this on any platform if we we would otherwise fail. Change-Id: I4cd78b40e9e77fca5cc8e717dd48ac173101bed4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1b89662eff	ipn/ipnlocal: make peerapi listener on Android avoid the kernel ... We intercept the peerapi port in netstack anyway, so there's no reason the linux kernel on Android needs to know about it. It's only getting in the way and causing problems for reasons we don't fully understand. But we don't even need to understand it because it's not relevant anymore. Instead, provide a dummy net.Listener that just sits and blocks to pacify the rest of the code that assumes it can be stuck in a Listener.Accept call and call Listener.Close and Listener.Addr. We'll likely do this for all platforms in the future, if/when we also link in netstack on iOS. Updates #4449 Updates #4293 Updates #3986 Change-Id: Ic2d3fe2f3cee60fc527356a3368830f17aeb75ae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8b81254992	ipn/ipnlocal: reject tailscale up --ssh if disabled on tailnet ... Updates #3802 Change-Id: I3f1e839391fe9b28270f506f4bb8d8e3d36716f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cc575fe4d6	net/dns: schedule DoH upgrade explicitly, fix Resolver.Addr confusion ... Two changes in one: * make DoH upgrades an explicitly scheduled send earlier, when we come up with the resolvers-and-delay send plan. Previously we were getting e.g. four Google DNS IPs and then spreading them out in time (for back when we only did UDP) but then later we added DoH upgrading at the UDP packet layer, which resulted in sometimes multiple DoH queries to the same provider running (each doing happy eyeballs dialing to 4x IPs themselves) for each of the 4 source IPs. Instead, take those 4 Google/Cloudflare IPs and schedule 5 things: first the DoH query (which can use all 4 IPs), and then each of the 4 IPs as UDP later. * clean up the dnstype.Resolver.Addr confusion; half the code was using it as an IP string (as documented) as half was using it as an IP:port (from some prior type we used), primarily for tests. Instead, document it was being primarily an IP string but also accepting an IP:port for tests, then add an accessor method on it to get the IPPort and use that consistently everywhere. Change-Id: Ifdd72b9e45433a5b9c029194d50db2b9f9217b53 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	a04eebf59f	ipn/ipnlocal: also use SSHPolicies when updating filterHash ... Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	e96dd00652	ipn/ipnlocal: add capability for debugging peers over peerapi ... The default is still users can debug their own nodes. But like cd916b728b did, this adds support for admins to grant additional capabilities with the new tailcfg.CapabilityDebugPeer cap. Updates #4217 Change-Id: Ifce3d9a1f8e8845797970a4f97b393194663d35f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8f5e5bff1e	cmd/tailscale, etc: make "tailscale up --ssh" fail fast when unavailable ... Fail on unsupported platforms (must be Linux or macOS tailscaled with WIP env) or when disabled by admin (with TS_DISABLE_SSH_SERVER=1) Updates #3802 Change-Id: I5ba191ed0d8ba4ddabe9b8fc1c6a0ead8754b286 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ade7bd8745	ssh/tailssh: close sessions on policy change if no longer allowed ... Updates #3802 Change-Id: I98503c2505b77ac9d0cc792614fcdb691761a70c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4ec83fbad6	ipn/ipnlocal: only call updateFilter with mutex held ... And rename to updateFilterLocked to prevent future mistakes. Fixes #4427 Change-Id: I4d37b90027d5ff872a339ce8180f5723704848dc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cd916b728b	ipn/ipnlocal: add start of inter-user Taildrop ... Controlled by server-sent capability policy. To be initially used for SSH servers to record sessions to other nodes. Not yet productized into something user-accessible. (Notably, the list of Taildrop targets from the sender side isn't augmented yet.) This purely permits expanding the set of expands a node will accept a drop from. Updates #3802 Updates #4217 Change-Id: Id7a5bccd686490f8ef2cdc7dae7c07c440dc0085 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	16f3520089	all: add arbitrary capability support ... Updates #4217 RELNOTE=start of WhoIsResponse capability support Change-Id: I6522998a911fe49e2f003077dad6164c017eed9b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	c591c91653	tailcfg, control/controlclient: TSMP & disco pings ... tailcfg.PingResponse formalizes the TSMP & disco response message, and controlclient is wired to send POST responses containing tailcfg.PingResponse for TSMP and disco PingRequests. Updates tailscale/corp#754 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	8ee044ea4a	ssh/tailssh: make the SSH server a singleton, register with LocalBackend ... Remove the weird netstack -> tailssh dependency and instead have tailssh register itself with ipnlocal when linked. This makes tailssh.server a singleton, so we can have a global map of all sessions. Updates #3802 Change-Id: Iad5caec3a26a33011796878ab66b8e7b49339f29 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	df9ce972c7	tailcfg, ipn/ipnlocal: add debug flag to enable one-big-CGNAT/10 route ... To experiment with avoiding Chrome ERR_NETWORK_CHANGED errors on route changes. Updates #3102 Change-Id: I339da14c684fdac45ac261566aa21bf2198672ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	50b4b8b2c6	ipn/ipnlocal: make peerIPs return a sorted slice ... Currently peerIPs doesn't do any sorting of the routes it returns. This is typically fine, however imagine the case of an HA subnet router failover. When a route R moves from peer A to peer B, the output of peerIPs changes. This in turn causes all the deephash check inside wgengine to fail as the hashed value of [R1, R2] is different than the hashed value of [R2, R1]. When the hash check failes, it causes wgengine to reconfigure all routes in the OS. This is especially problematic for macOS and iOS where we use the NetworkExtension. This commit makes it that the peerIPs are always sorted when returned, thus making the hash be consistent as long as the list of routes remains static. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Ilya Mateyko	2748750aa2	ipn/ipnstate: make status page more mobile-friendly ... Signed-off-by: Ilya Mateyko <me@astrophena.name>	3 years ago
Maisem Ali	c87ed52ad4	cmd/tailscale: add id-token subcommand ... RELNOTE=Initial support for getting OIDC ID Tokens Updates tailscale/corp#4347 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	3ae701f0eb	net/tsaddr, wgengine/netstack: add IPv6 range that forwards to site-relative IPv4 ... This defines a new magic IPv6 prefix, fd7a:115c:a1e0:b1a::/64, a subset of our existing /48, where the final 32 bits are an IPv4 address, and the middle 32 bits are a user-chosen "site ID". (which must currently be 0000:00xx; the top 3 bytes must be zero for now) e.g., I can say my home LAN's "site ID" is "0000:00bb" and then advertise its 10.2.0.0/16 IPv4 range via IPv6, like: tailscale up --advertise-routes=fd7a:115c:a1e0:b1a::bb:10.2.0.0/112 (112 being /128 minuse the /96 v6 prefix length) Then people in my tailnet can: $ curl '[fd7a:115c:a1e0:b1a::bb:10.2.0.230]' <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" .... Updates #3616, etc RELNOTE=initial support for TS IPv6 addresses to route v4 "via" specific nodes Change-Id: I9b49b6ad10410a24b5866b9fbc69d3cae1f600ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	3603a18710	ipn/localapi: add endpoint to request id token ... Updates tailscale/corp#4347 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	309ddef852	net/netutil: add CheckIPForwardingLinux (#4301) ... Combine the code between `LocalBackend.CheckIPForwarding` and `controlclient.ipForwardingBroken`. Fixes #4300 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	5a44f9f5b5	tempfork: temporarily fork gliderlabs/ssh and x/crypto/ssh ... While we rearrange/upstream things. gliderlabs/ssh is forked into tempfork from our prior fork at be8b7add40 x/crypto/ssh OTOH is forked at https://github.com/tailscale/golang-x-crypto because it was gnarlier to vendor with various internal packages, etc. Its git history shows where it starts (2c7772ba30643b7a2026cbea938420dce7c6384d). Updates #3802 Change-Id: I546e5cdf831cfc030a6c42557c0ad2c58766c65f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	6fecc16c3b	ipn/ipnlocal: do not process old status messages received out of order ... When `setWgengineStatus` is invoked concurrently from multiple goroutines, it is possible that the call invoked with a newer status is processed before a call with an older status. e.g. a status that has endpoints might be followed by a status without endpoints. This causes unnecessary work in the engine and can result in packet loss. This patch adds an `AsOf time.Time` field to the status to specifiy when the status was calculated, which later allows `setWgengineStatus` to ignore any status messages it receives that are older than the one it has already processed. Updates tailscale/corp#2579 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	cceacda5eb	ipn/ipnstate: put SSH Host Keys in ipnstate.PeerStatus ... Updates #3802 Change-Id: I47ba3b4545b25988f375bd867aecd98bb0da8d79 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fc12cbfcd3	client/tailscale, cmd/tailscale, localapi: add 'tailscale nc' ... This adds a "tailscale nc" command that acts a bit like "nc", but dials out via tailscaled via localapi. This is a step towards a "tailscale ssh", as we'll use "tailscale nc" as a ProxyCommand for in some cases (notably in userspace mode). But this is also just useful for debugging & scripting. Updates #3802 RELNOTE=tailscale nc Change-Id: Ia5c37af2d51dd0259d5833d80264d3ad5f68446a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d2f3ec8a63	envknob, ipn/ipnlocal: add SSH admin kill switch ... Updates #3802 Change-Id: I6127907446d1a6be1b097d9ba3b534f2b8eb707f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f3b13604b3	control/controlclient, ipn/ipnlocal, tailcfg: add MapResponse.PopBrowserURL ... Updates #3802 Change-Id: I89481fc5782a0cc8084354706f8f28d94f197325 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	0868329936	all: use any instead of interface{} ... My favorite part of generics. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago