1522 Commits (73bbf941f8ba3e33e7b780b724165b11d0984783)

Author	SHA1	Message	Date
Brad Fitzpatrick	cf27761265	cmd/tsconnect/wasm: add missing tstun.Wrapper.Start call ... It's required as of the recent 5297bd2cff. Updates #7894 Updates #9394 (sure would be nice) Change-Id: Id6672408dd8a6c82dba71022c8763e589d789fcd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Andrew Lytvynov	33bb2bbfe9	tailcfg,cmd/tailscale: add UrgentSecurityUpdate flag to ClientVersion (#9848) ... This flag is used in clients to surface urgent updates more prominently. Updates #755 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	9 months ago
Irbe Krumina	cac290da87	cmd/k8s-operator: users can configure firewall mode for kube operator proxies (#9769) ... * cmd/k8s-operator: users can configure operator to set firewall mode for proxies Users can now pass PROXY_FIREWALL_MODE={nftables,auto,iptables} to operator to make it create ingress/egress proxies with that firewall mode Also makes sure that if an invalid firewall mode gets configured, the operator will not start provisioning proxy resources, but will instead log an error and write an error event to the related Service. Updates tailscale/tailscale#9310 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	9 months ago
Tyler Smalley	ddb2a6eb8d	cmd/tailscale: promote new serve/funnel CLI to be default (#9833) ... The change is being kept to a minimum to make a revert easy if necessary. After the release, we will go back for a final cleanup. updates #8489 Signed-off-by: Tyler Smalley <tyler@tailscale.com>	9 months ago
Maisem Ali	f53c3be07c	cmd/k8s-operator: use our own container image instead of busybox ... We already have sysctl in the `tailscale/tailscale` image, just use that. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
Brad Fitzpatrick	4dec0c6eb9	tstest, tstest/integration, github/workflows: shard integration tests ... Over four jobs for now. Updates #cleanup Change-Id: Ic2b1a739a454916893945a3f9efc480d6fcbd70b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Maisem Ali	e6ab7d3c14	cmd/testwrapper: parse args better ... Previously we were just smushing together args and not trying to parse the values at all. This resulted in the args to testwrapper being limited and confusing. This makes it so that testwrapper parses flags in the exact format as `go test` command and passes them down in the provided order. It uses tesing.Init to register flags that `go test` understands, however those are not the only flags understood by `go test` (such as `-exec`) so we register these separately. Updates tailscale/corp#14975 Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
Maisem Ali	4899c2c1f4	cmd/containerboot: revert to using tailscale up ... This partially reverts commits a61a9ab087 and 7538f38671 and fully reverts 4823a7e591. The goal of that commit was to reapply known config whenever the container restarts. However, that already happens when TS_AUTH_ONCE was false (the default back then). So we only had to selectively reapply the config if TS_AUTH_ONCE is true, this does exactly that. This is a little sad that we have to revert to `tailscale up`, but it fixes the backwards incompatibility problem. Updates tailscale/tailscale#9539 Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
Brad Fitzpatrick	18bd98d35b	cmd/tailscaled,*: add start of configuration file support ... Updates #1412 Co-authored-by: Maisem Ali <maisem@tailscale.com> Change-Id: I38d559c1784d09fc804f521986c9b4b548718f7d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Rhea Ghosh	71271e41d6	ipn/{ipnlocal/peerapi, localapi} initial taildrop resume api plumbing (#9798) ... This change: * adds a partial files peerAPI endpoint to get a list of partial files * adds a helper function to extract the basename of a file * updates the peer put peerAPI endpoint * updates the file put localapi endpoint to allow resume functionality Updates #14772 Signed-off-by: Rhea Ghosh <rhea@tailscale.com>	9 months ago
Brad Fitzpatrick	c363b9055d	tstest/integration: add tests for tun mode (requiring root) ... Updates #7894 Change-Id: Iff0b07b21ae28c712dd665b12918fa28d6f601d0 Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Maisem Ali	5297bd2cff	cmd/tailscaled,net/tstun: fix data race on start-up in TUN mode ... Fixes #7894 Change-Id: Ice3f8019405714dd69d02bc07694f3872bb598b8 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
Maisem Ali	1294b89792	cmd/k8s-operator: allow setting same host value for tls and ingress rules ... We were too strict and required the user not specify the host field at all in the ingress rules, but that degrades compatibility with existing helm charts. Relax the constraint so that rule.Host can either be empty, or match the tls.Host[0] value exactly. Fixes #9548 Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
Maisem Ali	2d4f808a4c	cmd/containerboot: fix time based serveConfig watcher ... This broke in a last minute refactor and seems to have never worked. Fixes #9686 Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
James Tucker	96f01a73b1	tailcfg: import ProtoPortRange for local use ... Imported type and parsing, with minor modifications. Updates tailscale/corp#15043 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Maisem Ali	1cb9e33a95	cmd/k8s-operator: update env var in manifest to APISERVER_PROXY ... Replace the deprecated var with the one in docs to avoid confusion. Introduced in 335a5aaf9a. Updates #8317 Fixes #9764 Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
James Tucker	c1ef55249a	types/ipproto: import and test string parsing for ipproto ... IPProto has been being converted to and from string formats in multiple locations with variations in behavior. TextMarshaller and JSONMarshaller implementations are now added, along with defined accepted and preferred formats to centralize the logic into a single cross compatible implementation. Updates tailscale/corp#15043 Fixes tailscale/corp#15141 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Maisem Ali	9d96e05267	net/packet: split off checksum munging into different pkg ... The current structure meant that we were embedding netstack in the tailscale CLI and in the GUIs. This removes that by isolating the checksum munging to a different pkg which is only called from `net/tstun`. Fixes #9756 Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
Maisem Ali	fbfee6a8c0	cmd/containerboot: use linuxfw.NetfilterRunner ... This migrates containerboot to reuse the NetfilterRunner used by tailscaled instead of manipulating iptables rule itself. This has the added advantage of now working with nftables and we can potentially drop the `iptables` command from the container image in the future. Updates #9310 Co-authored-by: Irbe Krumina <irbe@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
Sonia Appasamy	7a0de2997e	client/web: remove unused context param from NewServer ... Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	9 months ago
Andrew Lytvynov	677d486830	clientupdate: abort if current version is newer than latest (#9733) ... This is only relevant for unstable releases and local builds. When local version is newer than upstream, abort release. Also, re-add missing newlines in output that were missed in https://github.com/tailscale/tailscale/pull/9694. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	9 months ago
Brad Fitzpatrick	6b1ed732df	go.mod: bump x/net to 0.17 for CVE-2023-39325 ... https://go.googlesource.com/net/+/b225e7ca6dde1ef5a5ae5ce922861bda011cfabd Updates tailscale/corp#15165 Change-Id: Ia8b5e16b1acfe1b2400d321034b41370396f70e2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Kristoffer Dalby	7f540042d5	ipn/ipnlocal: use syspolicy to determine collection of posture data ... Updates #5902 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	9 months ago
Kristoffer Dalby	9eedf86563	posture: add get serial support for Windows/Linux ... This commit adds support for getting serial numbers from SMBIOS on Windows/Linux (and BSD) using go-smbios. Updates #5902 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	9 months ago
Kristoffer Dalby	9593cd3871	posture: add get serial stub for all platforms ... Updates #5902 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	9 months ago
Kristoffer Dalby	623926a25d	cmd/tailscale: add --posture-checking flag to set ... Updates #5902 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	9 months ago
Simon Leonhardt	553f657248	sniproxy allows configuration of hostname ... Signed-off-by: Simon Leonhardt <simon@controlzee.com>	9 months ago
Brad Fitzpatrick	6f36f8842c	cmd/tailscale, magicsock: add debug command to flip DERP homes ... For testing netmap patchification server-side. Updates #1909 Change-Id: Ib1d784bd97b8d4a31e48374b4567404aae5280cc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Andrew Lytvynov	e6aa7b815d	clientupdate,cmd/tailscale/cli: use cli.Stdout/Stderr (#9694) ... In case cli.Stdout/Stderr get overriden, all CLI output should use them instead of os.Stdout/Stderr. Update the `update` command to follow this pattern. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	9 months ago
Andrew Lytvynov	3ee756757b	cmd/tailscale/cli: add update notification to "up" (#9644) ... Add available update message in "tailscale up" output. Also update the message in "tailscale status" to match and mention auto-update. Updates https://github.com/tailscale/tailscale/issues/755 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	9 months ago
Rhea Ghosh	dc1c7cbe3e	taildrop: initial commit of taildrop functionality refactoring (#9676) ... Over time all taildrop functionality will be contained in the taildrop package. This will include end to end unit tests. This is simply the first smallest piece to move over. There is no functionality change in this commit. Updates tailscale/corp#14772 Signed-off-by: Rhea Ghosh <rhea@tailscale.com> Co-authored-by: Joseph Tsai <joetsai@tailscale.com>	9 months ago
Brad Fitzpatrick	93c6e1d53b	tstest/deptest: add check that x/exp/{maps,slices} imported as xfoo ... Updates #cleanup Change-Id: I4cbb5e477c739deddf7a46b66f286c9fdb106279 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Andrew Dunham	286c6ce27c	net/dns/resolver: race UDP and TCP queries (#9544) ... Instead of just falling back to making a TCP query to an upstream DNS server when the UDP query returns a truncated query, also start a TCP query in parallel with the UDP query after a given race timeout. This ensures that if the upstream DNS server does not reply over UDP (or if the response packet is blocked, or there's an error), we can still make queries if the server replies to TCP queries. This also adds a new package, util/race, to contain the logic required for racing two different functions and returning the first non-error answer. Updates tailscale/corp#14809 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I4311702016c1093b1beaa31b135da1def6d86316	9 months ago
Val	73e53dcd1c	cmd/tailscale,ipn/ipnlocal: print debug component names ... Make the 'tailscale debug component-logs' command print the component names for which extra logging can be turned on, for easier discoverability of debug functions. Updates #cleanup Co-authored-by: Paul Scott <paul@tailscale.com> Signed-off-by: Val <valerie@tailscale.com>	9 months ago
Tom DNetto	656a77ab4e	net/packet: implement methods for rewriting v6 addresses ... Implements the ability for the address-rewriting code to support rewriting IPv6 addresses. Specifically, UpdateSrcAddr & UpdateDstAddr. Signed-off-by: Tom DNetto <tom@tailscale.com> Updates https://github.com/tailscale/corp/issues/11202	9 months ago
Brad Fitzpatrick	d2ea9bb1eb	cmd/cloner: fix typo in test type's name ... s/SliceContianer/SliceContainer/g Updates #9604 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
James Tucker	ab810f1f6d	cmd/cloner: add regression test for slice nil/empty semantics ... We had a misstep with the semantics when applying an optimization that showed up in the roll into corp. This test ensures that case and related cases must be retained. Updates #9410 Updates #9601 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Claire Wang	a56e58c244	util/syspolicy: add read boolean setting (#9592)	9 months ago
James Tucker	324f0d5f80	cmd/cloner,*: revert: optimize nillable slice cloner ... This reverts commit ee90cd02fd. The outcome is not identical for empty slices. Cloner really needs tests! Updates #9601 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
James Tucker	ee90cd02fd	cmd/cloner,*: optimize nillable slice cloner ... A wild @josharian appears with a good suggestion for a refactor, thanks Josh! Updates #9410 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
James Tucker	0c8c374a41	go.mod: bump all dependencies except go-billy ... go-billy is held back at v5.4.1 in order to avoid a newly introduced subdependency that is not compatible with plan9. Updates #8043 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
James Tucker	87bc831730	go.mod,cmd/tsconnect: bump esbuild ... Updates #8043 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Maisem Ali	d71184d674	cmd/containerboot: only wipeout serve config when TS_SERVE_CONFIG is set ... Fixes #9558 Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
Denton Gentry	4823a7e591	cmd/containerboot: set TS_AUTH_ONCE default to true. ... 1.50.0 switched containerboot from using `tailscale up` to `tailscale login`. A side-effect is that a re-usable authkey is now re-applied on every boot by `tailscale login`, where `tailscale up` would ignore an authkey if already authenticated. Though this looks like it is changing the default, in reality it is setting the default to match what 1.48 and all prior releases actually implemented. Fixes https://github.com/tailscale/tailscale/issues/9539 Fixes https://github.com/tailscale/corp/issues/14953 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	9 months ago
Brad Fitzpatrick	856d32b4a9	cmd/testwrapper: include flake URL in JSON metadata ... Updates tailscale/corp#14975 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Andrea Barisani	b5b4298325	go.mod,*: bump gvisor ... Updates #9253 Signed-off-by: Andrea Barisani <andrea@inversepath.com> Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Brad Fitzpatrick	2c92f94e2a	cmd/testwrapper: output machine-readable JSON on test flakes ... For parsing by other tools. Updates tailscale/corp#14975 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Maisem Ali	354455e8be	ipn: use NodeCapMap in CheckFunnel ... These were missed when adding NodeCapMap and resulted in tsnet binaries not being able to turn on funnel. Fixes #9566 Signed-off-by: Maisem Ali <maisem@tailscale.com>	9 months ago
Claire Wang	e3d6236606	winutil: refactor methods to get values from registry to also return (#9536) ... errors Updates tailscale/corp#14879 Signed-off-by: Claire Wang <claire@tailscale.com>	9 months ago
Irbe Krumina	bdd9eeca90	cmd/k8s-operator: fix reconcile filters (#9533) ... Ensure that when there is an event on a Tailscale managed Ingress or Service child resource, the right parent type gets reconciled Updates tailscale/tailscale#502 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	9 months ago