tailscale

Commit Graph

Author	SHA1	Message	Date
Andrew Dunham	6d84f3409b	ipn/ipnlocal: handle more edge cases in netmap expiry timer We now handle the case where the NetworkMap.SelfNode has already expired and do not return an expiry time in the past (which causes an ~infinite loop of timers to fire). Additionally, we now add an explicit check to ensure that the next expiry time is never before the current local-to-the-system time, to ensure that we don't end up in a similar situation due to clock skew. Finally, we add more tests for this logic to ensure that we don't regress on these edge cases. Fixes #7193 Change-Id: Iaf8e3d83be1d133a7aab7f8d62939e508cc53f9c Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Tom DNetto	99b9d7a621	all: implement pcap streaming for datapath debugging Updates: tailscale/corp#8470 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	6bae55e351	ipn/ipnlocal: add support to store certs in k8s secrets Fixes #5676 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
David Crawshaw	8cf2805cca	tailcfg, localapi: plumb device token to server Updates tailscale/corp#8940 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Andrew Dunham	5ba2543828	ipn/ipnlocal: print warning about DNS servers in bugreport --diagnose If the user passes the --diagnose flag, print a warning if any of the default or fallback DNS resolvers are Tailscale IPs. This can interfere with the ability to connect to the controlplane, and is typically something to pay attention to if there's a connectivity issue. Change-Id: Ib14bf6228c037877fbdcd22b069212b1a4b2c456 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Brad Fitzpatrick	b1248442c3	all: update to Go 1.20, use strings.CutPrefix/Suffix instead of our fork Updates #7123 Updates #5309 Change-Id: I90bcd87a2fb85a91834a0dd4be6e03db08438672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	d1146dc701	ipn/ipnlocal: rate-limit diagnose logs in bugreport We can log too quickly for logtail to catch up, even when we opt out of log rate-limiting. When the user passes the --diagnose flag to bugreport, we use a token bucket to control how many logs per second are printed and sleep until we're able to write more. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If27672d66b621b589280bd0fe228de367ffcbd8f	2 years ago
Maisem Ali	04b57a371e	ipn/ipnlocal: drop not required StateKey parameter This is #cleanup now that #7121 is merged. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	4973956419	ipn/ipnlocal: add /reset-auth LocalAPI endpoint The iOS has a command to reset the persisted state of the app, but it was doing its own direct keychain manipulation. This proved to be brittle (since we changed how preferences are stored with #6022), so we instead add a LocalAPI endpoint to do do this, which can be updated in tandem. This clears the same state as the iOS implementation (tailscale/corp#3186), that is the machine key and preferences (which includes the node key). Notably this does not clear the logtail ID, so that logs from the device still end up in the same place. Updates tailscale/corp#8923 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Will Norris	71029cea2d	all: update copyright and license headers This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Andrew Dunham	2703d6916f	net/netns: add functionality to bind outgoing sockets based on route table When turned on via environment variable (off by default), this will use the BSD routing APIs to query what interface index a socket should be bound to, rather than binding to the default interface in all cases. Updates #5719 Updates #5940 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib4c919471f377b7a08cd3413f8e8caacb29fee0b	2 years ago
Andrew Dunham	44d73ce932	ipn/ipnlocal, net/dnscache: allow configuring dnscache logging via capability This allows users to temporarily enable/disable dnscache logging via a new node capability, to aid in debugging strange connectivity issues. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I46cf2596a8ae4c1913880a78d0033f8b668edc08	2 years ago
Brad Fitzpatrick	6e5faff51e	ipn/ipnlocal: add health warning for Tailscale SSH + SELinux Updates #4908 Change-Id: If46be5045b13dd5c3068c334642f89b5917ec861 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	140b9aad5c	ipn/ipnlocal: fire expiry timer when the current node expires The current node isn't in NetMap.Peers, so without this we would not have fired this timer on self expiry. Updates #6932 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id57f96985397e372f9226802d63b42ff92c95093	2 years ago
Brad Fitzpatrick	06fff461dc	ipn/ipnstate: add PeerStatus.KeyExpiry for tailscale status --json Fixes #6712 Change-Id: I817cd5342fac8a956fcefda2d63158fa488f3395 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b6aa1c1f22	envknob, hostinfo, ipn/ipnlocal: add start of opt-in remote update support Updates #6907 Change-Id: I85db4f6f831dd5ff7a9ef4bfa25902607e0c1558 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
shayne	4471e403aa	ipn/ipnlocal: [serve] listen on all-interfaces for macOS sandboxed (#6771 ) On macOS (AppStore and macsys), we need to bind to ""/all-interfaces due to the network sandbox. Ideally we would only bind to the Tailscale interface, but macOS errors out if we try to to listen on privileged ports binding only to a specific interface. We also implement the lc.Control hook, same as we do for peerapi. It doesn't solve our problem but it's better that we do and would likely be required when Apple gets around to fixing per-interface priviliged port binding. Fixes: #6364 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Brad Fitzpatrick	6edf357b96	all: start groundwork for using capver for localapi & peerapi Updates #7015 Change-Id: I3d4c11b42a727a62eaac3262a879f29bb4ce82dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
salman	eec734a578	ipn/{ipnlocal,localapi}: ensure watcher is installed before /watch-ipn-bus/ responds with 200 This change delays the first flush in the /watch-ipn-bus/ handler until after the watcher has been successfully installed on the IPN bus. It does this by adding a new onWatchAdded callback to LocalBackend.WatchNotifications(). Without this, the endpoint returns a 200 almost immediatly, and only then installs a watcher for IPN events. This means there's a small window where events could be missed by clients after calling WatchIPNBus(). Fixes tailscale/corp#8594. Signed-off-by: salman <salman@tailscale.com>	2 years ago
Andrew Dunham	3a018e51bb	ipn/ipnlocal: move handling of expired nodes to LocalBackend In order to be able to synthesize a new NetMap when a node expires, have LocalBackend start a timer when receiving a new NetMap that fires slightly after the next node expires. Additionally, move the logic that updates expired nodes into LocalBackend so it runs on every netmap (whether received from controlclient or self-triggered). Updates #6932 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I833390e16ad188983eac29eb34cc7574f555f2f3	2 years ago
Mihai Parparita	67f82e62a1	ipn/ipnlocal: add Expired to PeerStatus Needed for clients that get information via the /v0/status LocalAPI endpoint (e.g. to not offer expired exit nodes as options). Updates tailscale/corp#8702 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Andrew Dunham	11ce5b7e57	ipn/ipnlocal, wgengine/magicsock: check Expired bool on Node; print error in Ping Change-Id: Ic5f533f175a6e1bb73d4957d8c3f970add42e82e Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Brad Fitzpatrick	61dfbc0a6e	cmd/tailscale/cli: plumb TUN mode into tailscale web template UI works remains, but data is there now. Updates #4015 Change-Id: Ib91e94718b655ad60a63596e59468f3b3b102306 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
James Tucker	2afa1672ac	ipn/ipnlocal: disallow unsigned peers from WoL Unsigned peers should not be allowed to generate Wake-on-Lan packets, only access Funnel. Updates #6934 Updates #7515 Updates #6475 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Brad Fitzpatrick	1116602d4c	ssh/tailssh: add OpenBSD support for Tailscale SSH And bump go.mod for https://github.com/u-root/u-root/pull/2593 Change-Id: I36ec94c5b2b76d671cb739f1e9a1a43ca1d9d1b1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	69c0b7e712	ipn/ipnlocal: add c2n handler to flush logtail for support debugging Updates tailscale/corp#8564 Change-Id: I0c619d4007069f90cffd319fba66bd034d63e84d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	0088c5ddc0	health,ipn/ipnlocal: report the node being locked out as a health issue Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	907f85cd67	cmd/tailscale,tka: make KeyID return an error instead of panicking Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Kristoffer Dalby	c4e262a0fc	ipn/profiles: set default prefs based on Windows registry (#6803 ) Co-authored-by: Maisem Ali maisem@tailscale.com	2 years ago
David Anderson	91e64ca74f	cmd/tailscale/cli: redact private key in debug netmap output by default This makes `tailscale debug watch-ipn` safe to use for troubleshooting user issues, in addition to local debugging during development. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Anton Tolchanov	82b9689e25	ipn/ipnlocal: maintain a proxy handler per backend (#6804 ) By default, `http.Transport` keeps idle connections open hoping to re-use them in the future. Combined with a separate transport per request in HTTP proxy this results in idle connection leak. Fixes #6773	2 years ago
Brad Fitzpatrick	0f604923d3	ipn/ipnlocal: fix StatusWithoutPeers not populating parts of Status Fixes #4311 Change-Id: Iaae0615148fa7154f4ef8f66b455e3a6c2fa9df3 Co-authored-by: Claire Wang <claire@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	bd2995c14b	ipn/ipnlocal: simplify redactErr (#6716 ) Use multierr.Range to iterate through an error tree instead of multiple invocations of errors.As. This scales better as we add more Go error types to the switch. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Mihai Parparita	47002d93a3	ipn/ipnlocal: add a few metrics for PeerAPI and LocalAPI Mainly motivated by wanting to know how much Taildrop is used, but also useful when tracking down how many invalid requests are generated. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
salman	2d271f3bd1	ipn/ipnlocal: disallow exit nodes from using exit nodes Nodes which have both -advertise-exit-node and -exit-node in prefs should continue have them until the next invocation of `tailscale up`. Updates #3569. Signed-off-by: salman <salman@tailscale.com>	2 years ago
Tom DNetto	55e0512a05	ipn/ipnlocal,cmd/tailscale: minor improvements to lock modify command * Do not print the status at the end of a successful operation * Ensure the key of the current node is actually trusted to make these changes Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	a887ca7efe	ipn/ipnlocal: improve redactErr to handle more cases This handles the case where the inner os.PathError is wrapped in another error type, and additionally will redact errors of type os.LinkError. Finally, add tests to verify that redaction works. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie83424ff6c85cdb29fb48b641330c495107aab7c	2 years ago
Brad Fitzpatrick	1598cd0361	net/tsaddr: remove ContainsFunc helpers (they're now in x/exp/slices) x/exp/slices now has ContainsFunc (golang/go#53983) so we can delete our versions. Change-Id: I5157a403bfc1b30e243bf31c8b611da25e995078 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	9c773af04c	ipn/ipnlocal: fix use of stale profile while processing netmap Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	86b6ff61e6	ipn/ipnlocal: fix Prefs access without mu being held Noticed while working on a different fix. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	cdb924f87b	ipn/ipnlocal: sanitize prefs in more notify code paths Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	57124e2126	ipn/localapi: add debug (root-required) access to inject debug Notify For testing of Windows GUI client. Updates #6480 Change-Id: I42f7526d95723e14bed7085fb759e371b43aa9da Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	e1d7d072a3	ipn/ipnlocal: set Notify.Version on initial Notifies Missed when added recently in `8dd1418774` Change-Id: Id682640a54c3717afe084edaf69258ad23031b6c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	74c1f632f6	types/key,cmd/tailscale/cli: support tlpub prefix for tailnet-lock keys Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	8dd1418774	ipn{,/ipnlocal}: add ipn.NotifyInitial* flags to WatchIPNBus To simplify clients getting the initial state when they subscribe. Change-Id: I2490a5ab2411253717c74265a46a98012b80db82 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a277eb4dcf	ipn/ipnlocal: add missing context cancel If user's fn returned false and never canceled their ctx, we never stopped the NotifyWatchEngineUpdates goroutine. This was introduced recently (this cycle). Change-Id: I3453966ac71e00727296ddd237ef845782f4e52e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	978d6af91a	ipn/ipnlocal: tweak error handling in interfaces PeerAPI debug endpoint We were writing the error when getting the default interface before setting the content type, so we'd get HTML treated as plain text. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	5bdca747b7	ipn/ipnlocal: fix netstack peerapi crash over IPv6 The peerapi IPv6 listener has a nil listener. But we didn't need the listener's address anyway, so don't try to use it. Change-Id: I8e8a1a895046d129a3683973e732d9bed82f3b02 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	f1ab11e961	ipn/ipnlocal,tailcfg: introduce capability to gate TKA init paths Previously, `TAILSCALE_USE_WIP_CODE` was needed to hit a bunch of the TKA paths. With this change: - Enablement codepaths (NetworkLockInit) and initialization codepaths (tkaBootstrapFromGenesisLocked via tkaSyncIfNeeded) require either the WIP envknob or CapabilityTailnetLockAlpha. - Normal operation codepaths (tkaSyncIfNeeded, tkaFilterNetmapLocked) require TKA to be initialized, or either-or the envknob / capability. - Auxillary commands (ie: changing tka keys) require TKA to be initialized. The end result is that it shouldn't be possible to initialize TKA (or subsequently use any of its features) without being sent the capability or setting the envknob on tailscaled yourself. I've also pulled out a bunch of unnecessary checks for CanSupportNetworkLock(). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	9a80b8fb10	cmd/tailscale,ipn: surface TKA-filtered peers in lock status command Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago

1 2 3 4 5 ...

552 Commits (6d84f3409bfb36ceed207563fac01e7b68423c58)