tailscale

Commit Graph

Author	SHA1	Message	Date
Andrew Dunham	6f18fbce8d	tailcfg: document zero value for KeyExpiry Change-Id: I50889f0205ecf66c415f50f9019c190448c991fc Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Andrew Dunham	1e67947cfa	control/controlclient, tailcfg: add Node.Expired field, set for expired nodes Nodes that are expired, taking into account the time delta calculated from MapResponse.ControlTime have the newly-added Expired boolean set. For additional defense-in-depth, also replicate what control does and clear the Endpoints and DERP fields, and additionally set the node key to a bogus value. Updates #6932 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia2bd6b56064416feee28aef5699ca7090940662a	2 years ago
Brad Fitzpatrick	69c0b7e712	ipn/ipnlocal: add c2n handler to flush logtail for support debugging Updates tailscale/corp#8564 Change-Id: I0c619d4007069f90cffd319fba66bd034d63e84d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	f1ab11e961	ipn/ipnlocal,tailcfg: introduce capability to gate TKA init paths Previously, `TAILSCALE_USE_WIP_CODE` was needed to hit a bunch of the TKA paths. With this change: - Enablement codepaths (NetworkLockInit) and initialization codepaths (tkaBootstrapFromGenesisLocked via tkaSyncIfNeeded) require either the WIP envknob or CapabilityTailnetLockAlpha. - Normal operation codepaths (tkaSyncIfNeeded, tkaFilterNetmapLocked) require TKA to be initialized, or either-or the envknob / capability. - Auxillary commands (ie: changing tka keys) require TKA to be initialized. The end result is that it shouldn't be possible to initialize TKA (or subsequently use any of its features) without being sent the capability or setting the envknob on tailscaled yourself. I've also pulled out a bunch of unnecessary checks for CanSupportNetworkLock(). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	5c8d2fa695	cmd/tailscale,ipn: improve UX of lock init command, cosmetic changes Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
shayne	0c4c66948b	cmd/tailscale/cli: Improve messaging when Funnel is unavailable. (#6502 ) There are three specific requirements for Funnel to work: 1) They must accept an invite. 2) They must enable HTTPS. 3) The "funnel" node attribute must be appropriately set up in the ACLs. Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Brad Fitzpatrick	20b27df4d0	tailcfg, ipn, controlclient: add MapResponse.ClientVersion, plumb to IPN bus Updates #6480 Change-Id: I6321071425cd091148d8140d1eb24dd536bb7984 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
shayne	d1e1c025b0	tailcfg: add TailscaleFunnelEnabled to HostInfo (#6414 ) Adding this convenience for tailscale/corp#8015 and to avoid leaking WireIngress. Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
shayne	a97369f097	cmd/tailscale/cli: flesh out serve CLI and tests (#6304 ) Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Maisem Ali	296e712591	tailcfg: add CapabilityDebug Updates tailscale/corp#7948 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	b08f37d069	tailcfg: add Hostinfo.WireIngress bool Yet unused. Future optimization for control. Updates tailscale/corp#7515 Change-Id: Icd755aa8b1d6ca61d16dfc124c28c9c56ebdfee5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	a255a08ea6	tailcfg: bump capver for ingress Updates tailscale/corp#7515 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	9dfb0916c2	ipn/ipnlocal, tailcfg: wire up ingress peerapi Updates tailscale/corp#7515 Co-authored-by: Shayne Sweeney <shayne@tailscale.com> Change-Id: I7eac7b4ac37fd8e8a9e0469594c1e9e7dd0da666 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	036334e913	net/netcheck: deflake (maybe) magicsock's TestNewConn Updates #6207 Change-Id: I51d200d0b42b9a1ef799d0abfc8d4bd871c50cf2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	0759d78f12	tailcfg: bump CurrentCapabilityVersion for EarlyNoise Updates #5972 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	e55ae53169	tailcfg: add Node.UnsignedPeerAPIOnly to let server mark node as peerapi-only capver 48 Change-Id: I20b2fa81d61ef8cc8a84e5f2afeefb68832bd904 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	0af57fce4c	cmd/tailscale,ipn: implement lock sign command Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	988c1f0ac7	control/controlclient, tailcfg: add support for EarlyNoise payload before http/2 Not yet used, but skipped over, parsed, and tested. Updates #5972 Change-Id: Icd00196959ce266ae16a6c9244bd5e458e2c2947 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	d98305c537	cmd,ipn/ipnlocal,tailcfg: implement TKA disablement * Plumb disablement values through some of the internals of TKA enablement. * Transmit the node's TKA hash at the end of sync so the control plane understands each node's head. * Implement /machine/tka/disable RPC to actuate disablement on the control plane. There is a partner PR for the control server I'll send shortly. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	ea24895e08	client/tailscale/apitype, tailcfg: delete never used mysterious PerDomain field It does nothing and never did and I don't think anybody remembers what the original goal for it was. Updates #5229 (fixes, but need to clean it up in another repo too) Change-Id: I81cc6ff44d6d2888bc43e9145437f4c407907ea6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	74693793be	net/netcheck, tailcfg: track whether OS supports IPv6 We had previously added this to the netcheck report in #5087 but never copied it into the NetInfo struct. Additionally, add it to log lines so it's visible to support. Change-Id: Ib6266f7c6aeb2eb2a28922aeafd950fe1bf5627e Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Tom DNetto	227777154a	control/controlclient,ipn/ipnlocal,tailcfg: rotate node-key signature on register CAPVER 47 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Kristoffer Dalby	01ebef0f4f	tailcfg: add views for ControlDialPlan (#5843 )	2 years ago
Brad Fitzpatrick	1841d0bf98	wgengine/magicsock: make debug-level stuff not logged by default And add a CLI/localapi and c2n mechanism to enable it for a fixed amount of time. Updates #1548 Change-Id: I71674aaf959a9c6761ff33bbf4a417ffd42195a7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Josh Soref	d4811f11a0	all: fix spelling mistakes Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>	2 years ago
Adrian Dewhurst	c581ce7b00	cmd/tailscale, client, ipn, tailcfg: add network lock modify command Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2 years ago
Tom DNetto	ebd1637e50	ipn/ipnlocal,tailcfg: Identify client using NodeKey in tka RPCs Updates https://github.com/tailscale/corp/pull/7024 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	9bdf0cd8cd	ipn/ipnlocal: add c2n /debug/{goroutines,prefs,metrics} * and move goroutine scrubbing code to its own package for reuse * bump capver to 45 Change-Id: I9b4dfa5af44d2ecada6cc044cd1b5674ee427575 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	fb4e23506f	control/controlclient: stop restarting map polls on health change At some point we started restarting map polls on health change, but we don't remember why. Maybe it was a desperate workaround for something. I'm not sure it ever worked. Rather than have a haunted graveyard, remove it. In its place, though, and somewhat as a safety backup, send those updates over the HTTP/2 noise channel if we have one open. Then if there was a reason that a map poll restart would help we could do it server-side. But mostly we can gather error stats and show machine-level health info for debugging. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	e1bdbfe710	tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan field (#5648 ) * tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan field This field allows the control server to provide explicit information about how to connect to it; useful if the client's link status can change after the initial connection, or if the DNS settings pushed by the control server break future connections. Change-Id: I720afe6289ec27d40a41b3dcb310ec45bd7e5f3e Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Aaron Klotz	acc7baac6d	tailcfg, util/deephash: add DataPlaneAuditLogID to Node and DomainDataPlaneAuditLogID to MapResponse We're adding two log IDs to facilitate data-plane audit logging: a node-specific log ID, and a domain-specific log ID. Updated util/deephash/deephash_test.go with revised expectations for tailcfg.Node. Updates https://github.com/tailscale/corp/issues/6991 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Maisem Ali	d5781f61a9	ipn/ipnlocal: return usernames when Tailscale SSH is enabled It was checking if the sshServer was initialized as a proxy, but that could either not have been initialized yet or Tailscale SSH could have been disabled after intialized. Also bump tailcfg.CurrentCapabilityVersion Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	e9b98dd2e1	control/controlclient,ipn/ipnlocal: wire tka enable/disable Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Maisem Ali	054ef4de56	tailcfg: mark CapabilityFileSharingTarget as inter-node Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	d045462dfb	ipn/ipnlocal: add c2n method to get SSH username candidates For control to fetch a list of Tailscale SSH username candidates to filter against the Tailnet's SSH policy to present some valid candidates to a user. Updates #3802 Updates tailscale/corp#7007 Change-Id: I3dce57b7a35e66891d5e5572e13ae6ef3c898498 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
phirework	5c42990c2f	wgengine/magicsock: add client flag and envknob to disable heartbeat (#5638 ) Baby steps towards turning off heartbeat pings entirely as per #540. This doesn't change any current magicsock functionality and requires additional changes to send/disco paths before the flag can be turned on. Updates #540 Change-Id: Idc9a72748e74145b068d67e6dd4a4ffe3932efd0 Signed-off-by: Jenny Zhang <jz@tailscale.com> Signed-off-by: Jenny Zhang <jz@tailscale.com>	2 years ago
Brad Fitzpatrick	45a3de14a6	cmd/tailscaled, tailcfg, hostinfo: add flag to disable logging + support As noted in #5617, our documented method of blocking log.tailscale.io DNS no longer works due to bootstrap DNS. Instead, provide an explicit flag (--no-logs-no-support) and/or env variable (TS_NO_LOGS_NO_SUPPORT=true) to explicitly disable logcatcher uploads. It also sets a bit on Hostinfo to say that the node is in that mode so we can end any support tickets from such nodes more quickly. This does not yet provide an easy mechanism for users on some platforms (such as Windows, macOS, Synology) to set flags/env. On Linux you'd used /etc/default/tailscaled typically. Making it easier to set flags for other platforms is tracked in #5114. Fixes #5617 Fixes tailscale/corp#1475 Change-Id: I72404e1789f9e56ec47f9b7021b44c025f7a373a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	d5e7e3093d	hostinfo, tailcfg: split Hostinfo.OSVersion into separate fields Stop jamming everything into one string. Fixes #5578 Change-Id: I7dec8d6c073bddc7dc5f653e3baf2b4bf6b68378 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	58abae1f83	net/dns/{publicdns,resolver}: add NextDNS DoH support NextDNS is unique in that users create accounts and then get user-specific DNS IPs & DoH URLs. For DoH, the customer ID is in the URL path. For IPv6, the IP address includes the customer ID in the lower bits. For IPv4, there's a fragile "IP linking" mechanism to associate your public IPv4 with an assigned NextDNS IPv4 and that tuple maps to your customer ID. We don't use the IP linking mechanism. Instead, NextDNS is DoH-only. Which means using NextDNS necessarily shunts all DNS traffic through 100.100.100.100 (programming the OS to use 100.100.100.100 as the global resolver) because operating systems can't usually do DoH themselves. Once it's in Tailscale's DoH client, we then connect out to the known NextDNS IPv4/IPv6 anycast addresses. If the control plane sends the client a NextDNS IPv6 address, we then map it to the corresponding NextDNS DoH with the same client ID, and we dial that DoH server using the combination of v4/v6 anycast IPs. Updates #2452 Change-Id: I3439d798d21d5fc9df5a2701839910f5bef85463 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ad7546fb9f	tailcfg: fix broken test from comment change Fix broken build from `255c0472fb` "Oh, that's safe to commit because most tests are passing and it's just a comment change!", I thought, forgetting I'd added a test that parses its comments. Change-Id: Iae93d595e06fec48831215a98adbb270f3bfda05 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	255c0472fb	tailcfg: reformat CurrentCapabilityVersion to be a bulleted list gofmt in 1.19 is now opinionated about structured text formatting in comments. It did not like our style and kept fighting us whenever we changed these lines. Give up the fight and be a bulleted list for it. See: * https://go.dev/doc/go1.19#go-doc and * https://go.dev/doc/comment Updates #4872 Change-Id: Ifae431218471217168c003ab3b4e03c394ca8105 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	9132b31e43	tailcfg: refactor/implement wire structs for TKA Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	761163815c	tailcfg: add Hostinfo.Userspace{,Router} bits Change-Id: Iad47f904872f2df146c1f63945f79cfddeac7fe8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	9f6c8517e0	net/dns: set OS DNS to 100.100.100.100 for route-less ExtraRecords [cap 41] If ExtraRecords (Hosts) are specified without a corresponding split DNS route and global DNS is specified, then program the host OS DNS to use 100.100.100.100 so it can blend in those ExtraRecords. Updates #1543 Change-Id: If49014a5ecc8e38978ff26e54d1f74fe8dbbb9bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	c66f99fcdc	tailcfg, control/controlclient, ipn/ipnlocal: add c2n (control-to-node) system This lets the control plane can make HTTP requests to nodes. Then we can use this for future things rather than slapping more stuff into MapResponse, etc. Change-Id: Ic802078c50d33653ae1f79d1e5257e7ade4408fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f1c9812188	tailcfg: add Hostinfo.GoVersion So next time something like #5340 happens we can identify all affected nodes and have the control plane send them health warnings. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	f81723ceac	tailcfg: implement wire format for map request/response tka comms Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	472529af38	tka: optimize common case of processing updates built from head Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	039def3b50	ipn,tailcfg: transmit NodeID in tka init RPCs Needed to identify the node. A serverside-check the machine key (used to authenticate the noise session) is that of the specified NodeID ensures the authenticity of the request. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	facafd8819	client,cmd/tailscale,ipn,tka,types: implement tka initialization flow This PR implements the client-side of initializing network-lock with the Coordination server. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago

1 2 3 4 5 ...

306 Commits (72cc70ebfc6e425a3eca077b4850dbd7916cbfb2)