8014 Commits (7d83056a1bb3273940ac162a42ae383b42911ee7)

 

All Branches   

Search

Author	SHA1	Message	Date
Percy Wegmann	7d83056a1b	ssh/tailssh: fix SSH on busybox systems ... This involved the following: 1. Pass the su command path as first of args in call to unix.Exec to make sure that busybox sees the correct program name. Busybox is a single executable userspace that implements various core userspace commands in a single binary. You'll see it used via symlinking, so that for example /bin/su symlinks to /bin/busybox. Busybox knows that you're trying to execute /bin/su because argv[0] is '/bin/su'. When we called unix.Exec, we weren't including the program name for argv[0], which caused busybox to fail with 'applet not found', meaning that it didn't know which command it was supposed to run. 2. Tell su to whitelist the SSH_AUTH_SOCK environment variable in order to support ssh agent forwarding. 3. Run integration tests on alpine, which uses busybox. 4. Increment CurrentCapabilityVersion to allow turning on SSH V2 behavior from control. Fixes #12849 Signed-off-by: Percy Wegmann <percy@tailscale.com>	1 month ago
Jordan Whited	7675c3ebf2	wgengine/netstack/gro: exclude importation of gVisor GRO pkg on iOS (#13202) ... In df6014f1d7 we removed build tag gating preventing importation, which tripped a NetworkExtension limit test in corp. This was a reversal of 25f0a3fc8f which actually made the situation worse, hence the simplification. This commit goes back to the strategy in 25f0a3fc8f, and gets us back under the limit in my local testing. Admittedly, we don't fully understand the effects of importing or excluding importation of this package, and have seen mixed results, but this commit allows us to move forward again. Updates tailscale/corp#22125 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 month ago
Jordan Whited	df6014f1d7	net/tstun,wgengine{/netstack/gro}: refactor and re-enable gVisor GRO for Linux (#13172) ... In 2f27319baf we disabled GRO due to a data race around concurrent calls to tstun.Wrapper.Write(). This commit refactors GRO to be thread-safe, and re-enables it on Linux. This refactor now carries a GRO type across tstun and netstack APIs with a lifetime that is scoped to a single tstun.Wrapper.Write() call. In 25f0a3fc8f we used build tags to prevent importation of gVisor's GRO package on iOS as at the time we believed it was contributing to additional memory usage on that platform. It wasn't, so this commit simplifies and removes those build tags. Updates tailscale/corp#22353 Updates tailscale/corp#22125 Updates #6816 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 month ago
ChandonPierre	93dc2ded6e	cmd/k8s-operator: support default proxy class in k8s-operator (#12711) ... Signed-off-by: ChandonPierre <cpierre@coreweave.com> Closes #12421	1 month ago
Aaron Klotz	8f6a2353d8	util/winutil: add GetRegUserString/SetRegUserString accessors for storage and retrieval of string values in HKEY_CURRENT_USER ... Fixes #13187 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	1 month ago
pierig-n3xtio	2105773874	cmd/k8s-operator/deploy: replace wildcards in Kubernetes Operator RBAC role definitions with verbs ... cmd/k8s-operator/deploy: replace wildcards in Kubernetes Operator RBAC role definitions with verbs fixes: #13168 Signed-off-by: Pierig Le Saux <pierig@n3xt.io>	1 month ago
Kristoffer Dalby	01aa01f310	ipn/ipnlocal: network-lock, error if no pubkey instead of panic ... Updates tailscale/corp#20931 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	1 month ago
Andrea Gottardo	9d2b1820f1	ipnlocal: support setting authkey at login using syspolicy (#13061) ... Updates tailscale/corp#22120 Adds the ability to start the backend by reading an authkey stored in the syspolicy database (MDM). This is useful for devices that are provisioned in an unattended fashion. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	1 month ago
tomholford	16bb541adb	wgengine/magicsock: replace deprecated poly1305 (#13184) ... Signed-off-by: tomholford <tomholford@users.noreply.github.com>	1 month ago
Aaron Klotz	f95785f22b	util/winutil: add constants from Win32 SDK for dll blocking mitigation policies ... Fixes #13182 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	1 month ago
Jonathan Nobels	8fad8c4b9b	tstest/tailmac: add customized macOS virtualization tooling (#13146) ... updates tailcale/corp#22371 Adds custom macOS vm tooling. See the README for the general gist, but this will spin up VMs with unixgram capable network interfaces listening to a named socket, and with a virtio socket device for host-guest communication. We can add other devices like consoles, serial, etc as needed. The whole things is buildable with a single make command, and everything is controllable via the command line using the TailMac utility. This should all be generally functional but takes a few shortcuts with error handling and the like. The virtio socket device support has not been tested and may require some refinement. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	1 month ago
Andrea Gottardo	1e8f8ee5f1	VERSION.txt: this is v1.73.0 (#13181) ... Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	1 month ago
Anton Tolchanov	ee976ad704	posture: deduplicate MAC addresses before returning them ... Some machines have multiple network interfaces with the same MAC address. Updates tailscale/corp#21371 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	1 month ago
Andrea Gottardo	5cbbb48c2e	health/dns: reduce severity of DNS unavailable warning (#13152) ... `DNS unavailable` was marked as a high severity warning. On Android (and other platforms), these trigger a system notification. Here we reduce the severity level to medium. A medium severity warning will still display the warning icon on platforms with a tray icon because of the `ImpactsConnectivity=true` flag being set here, but it won't show a notification anymore. If people enter an area with bad cellular reception, they're bound to receive so many of these notifications and we need to reduce notification fatigue. Signed-off-by: Andrea Gottardo <andrea@tailscale.com>	1 month ago
Jordan Whited	ccf091e4a6	wgengine/magicsock: don't upgrade to linuxBatchingConn on Android (#13161) ... In a93dc6cdb1 tryUpgradeToBatchingConn() moved to build tag gated files, but the runtime.GOOS condition excluding Android was removed unintentionally from batching_conn_linux.go. Add it back. Updates tailscale/corp#22348 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 month ago
License Updater	cc136a58ea	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 month ago
Andrew Lytvynov	d88be7cddf	safeweb: add Server.Close method (#13160) ... Updates https://github.com/tailscale/corp/issues/14881 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 month ago
Andrew Dunham	e107977f75	wgengine/magicsock: disable SIO_UDP_NETRESET on Windows ... By default, Windows sets the SIO_UDP_CONNRESET and SIO_UDP_NETRESET options on created UDP sockets. These behaviours make the UDP socket ICMP-aware; when the system gets an ICMP message (e.g. an "ICMP Port Unreachable" message, in the case of SIO_UDP_CONNRESET), it will cause the underlying UDP socket to throw an error. Confusingly, this can occur even on reads, if the same UDP socket is used to write a packet that triggers this response. The Go runtime disabled the SIO_UDP_CONNRESET behavior in 3114bd6, but did not change SIO_UDP_NETRESET–probably because that socket option isn't documented particularly well. Various other networking code seem to disable this behaviour, such as the Godot game engine (godotengine/godot#22332) and the Eclipse TCF agent (link below). Others appear to work around this by ignoring the error returned (anacrolix/dht#16, among others). For now, until it's clear whether this ends up in the upstream Go implementation or not, let's also disable the SIO_UDP_NETRESET in a similar manner to SIO_UDP_CONNRESET. Eclipse TCF agent: https://gitlab.eclipse.org/eclipse/tcf/tcf.agent/-/blob/master/agent/tcf/framework/mdep.c Updates #10976 Updates golang/go#68614 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I70a2f19855f8dec1bfb82e63f6d14fc4a22ed5c3	1 month ago
Flakes Updater	db4247f705	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	1 month ago
Kyle Carberry	6c852fa817	go.{mod,sum}: migrate from nhooyr.io/websocket to github.com/coder/websocket ... Coder has just adopted nhooyr/websocket which unfortunately changes the import path. `github.com/coder/coder` imports `tailscale.com/net/wsconn` which was still pointing to `nhooyr.io/websocket`, but this change updates it. See https://coder.com/blog/websocket Updates #13154 Change-Id: I3dec6512472b14eae337ae22c5bcc1e3758888d5 Signed-off-by: Kyle Carberry <kyle@carberry.com>	1 month ago
Nick Khyl	f8f9f05ffe	cmd/viewer: add support for map-like container types ... This PR modifies viewTypeForContainerType to use the last type parameter of a container type as the value type, enabling the implementation of map-like container types where the second-to-last (usually first) type parameter serves as the key type. It also adds a MapContainer type to test the code generation. Updates #12736 Signed-off-by: Nick Khyl <nickk@tailscale.com>	1 month ago
Jordan Whited	2f27319baf	wgengine/netstack: disable gVisor TCP GRO for Linux (#13138) ... A SIGSEGV was observed around packet merging logic in gVisor's GRO package. Updates tailscale/corp#22353 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 month ago
Brad Fitzpatrick	2dd71e64ac	wgengine/magicsock: log when a ReceiveFunc fails ... Updates #10976 Change-Id: I86d30151a25c7d42ed36e273fb207873f4acfdb4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Percy Wegmann	74b9fa1348	ipn/localapi: only flush relevant data in multiFilePostResponseWriter.Flush() ... This prevents two things: 1. Crashing if there's no response body 2. Sending a nonsensical 0 response status code Updates tailscale/corp#22357 Signed-off-by: Percy Wegmann <percy@tailscale.com>	1 month ago
Irbe Krumina	a15ff1bade	cmd/k8s-operator,k8s-operator/sessionrecording: support recording kubectl exec sessions over WebSockets (#12947) ... cmd/k8s-operator,k8s-operator/sessionrecording: support recording WebSocket sessions Kubernetes currently supports two streaming protocols, SPDY and WebSockets. WebSockets are replacing SPDY, see https://github.com/kubernetes/enhancements/issues/4006. We were currently only supporting SPDY, erroring out if session was not SPDY and relying on the kube's built-in SPDY fallback. This PR: - adds support for parsing contents of 'kubectl exec' sessions streamed over WebSockets - adds logic to distinguish 'kubectl exec' requests for a SPDY/WebSockets sessions and call the relevant handler Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>	1 month ago
Brad Fitzpatrick	4c2e978f1e	cmd/tailscale/cli: support passing network lock keys via files ... Fixes tailscale/corp#22356 Change-Id: I959efae716a22bcf582c20d261fb1b57bacf6dd9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
cai.li	2506bf5b06	fix #13076: codegen error when using anonymous struct ... Signed-off-by: cai.li <cai.li@qingteng.cn>	1 month ago
Irbe Krumina	b9f42814b5	cmd/containerboot: optionally serve health check endpoint (#12899) ... Add functionality to optionally serve a health check endpoint (off by default). Users can enable health check endpoint by setting TS_HEALTHCHECK_ADDR_PORT to [<addr>]:<port>. Containerboot will then serve an unauthenticatd HTTP health check at /healthz at that address. The health check returns 200 OK if the node has at least one tailnet IP address, else returns 503. Updates tailscale/tailscale#12898 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	1 month ago
Flakes Updater	b4e595621f	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	1 month ago
Aaron Bieber	c987cf1255	go.mod: pull in latest github.com/creack/pty ... This latest version allows for building on various OpenBSD architectures. (such as openbsd/riscv64) Updates #8043 Change-Id: Ie9a8738e6aa96335214d5750e090db35e526a4a4 Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>	1 month ago
Brad Fitzpatrick	02581b1603	gokrazy,tstest/integration/nat: add Gokrazy appliance just for natlab ... ... rather than abusing the generic tsapp. Per discussion in https://github.com/gokrazy/gokrazy/pull/275 It also means we can remove stuff we don't need, like ntp or randomd. Updates #13038 Change-Id: Iccf579c354bd3b5025d05fa1128e32f1d5bde4e4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Brad Fitzpatrick	b358f489b9	tstest/integration/nat: remove -audio none flag from qemu ... It's too new to be supported in Debian bookworm so just remove it. It doesn't seem to matter or help speed anything up. Updates #13038 Change-Id: I39077ba8032bebecd75209552b88f1842c843c33 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Brad Fitzpatrick	d985da207f	tstest/natlab/vnet: fix one-by-one from earlier numbering change ... 84adfa1ba3 made MAC addresses 1-based too, but didn't adjust this IP address calculation which was based on the MAC address Updates #13038 Change-Id: Idc112b303b0b85f41fe51fd61ce1c0d8a3f0f57e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Brad Fitzpatrick	b26c53368d	tstest/integration/nat: make Tailscale status log print less spammy ... No need to print all the internal fields. We only care about the BackendState. Updates #13038 Change-Id: Iaa0e47ade3c6d30e1887ab1e2a7412ed4e0dab7d	1 month ago
Brad Fitzpatrick	eae6a00651	tstest/integration/nat: crank up verbosity of a failing test ... Updates #13038 Change-Id: I36cde97b74e4a675b6c0f3be30f817bccdbe8715	1 month ago
Brad Fitzpatrick	b60a9fce4b	gokrazy/tsapp: remove implicit heartbeat package ... The heartbeat package does nothing if not configured anyway, so don't even put it in the image and pay the cost of it running. Updates #13038 Updates #1866 Change-Id: Id22c0fb1f8395ad21ab0e0350973d31730e8d39f	1 month ago
Brad Fitzpatrick	f79e688e0d	cmd/tailscale/cli: fix gokrazy CLI-as-a-service detection ... The change in b7e48058c8 was too loose; it also captured the CLI being run as a child process under cmd/tta. Updates #13038 Updates #1866 Change-Id: Id410b87132938dd38ed4dd3959473c5d0d242ff5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Irbe Krumina	adbab25bac	cmd/k8s-operator: fix DNS reconciler for dual-stack clusters (#13057) ... * cmd/k8s-operator: fix DNS reconciler for dual-stack clusters This fixes a bug where DNS reconciler logic was always assuming that no more than one EndpointSlice exists for a Service. In fact, there can be multiple, for example, in dual-stack clusters, but also in other cases this is valid (as per kube docs). This PR: - allows for multiple EndpointSlices - picks out the ones for IPv4 family - deduplicates addresses Updates tailscale/tailscale#13056 Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>	1 month ago
Brad Fitzpatrick	9f1d9d324d	gokrazy/tsapp: remove builddirs packages that aren't in config.json ... These three packages aren't in gokrazy/tsapp/config.json but used to be. Unfortunately, that meant that were being included in the resulting image. Apparently `gok` doesn't delete them or warn about them being present on disk when they're moved from the config file. Updates #13038 Updates #1866 Change-Id: I54918a9e3286ea755b11dde5e9efdd433b8f8fb8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Brad Fitzpatrick	b7e48058c8	cmd/tailscale/cli: don't run CLI as a service on gokrazy ... Updates #13038 Updates #1866 Change-Id: Ie3223573044a92f5715a827fb66cc6705b38004f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Brad Fitzpatrick	84adfa1ba3	tstest/natlab/vnet: standardize on 1-based naming of nodes, networks, MACs ... We had a mix of 0-based and 1-based nodes and MACs in logs. Updates #13038 Change-Id: I36d1b00f7f94b37b4ae2cd439bcdc5dbee6eda4d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Brad Fitzpatrick	10d0ce8dde	tstest/natlab: get tailscaled logs from gokrazy via syslog ... Using https://github.com/gokrazy/gokrazy/pull/275 This is much lower latency than logcatcher, which is higher latency and chunkier. And this is better than getting it via 'tailscale debug daemon-logs', which misses early interesting logs. Updates #13038 Change-Id: I499ec254c003a9494c0e9910f9c650c8ac44ef33 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Brad Fitzpatrick	10662c4282	tstest/integration/nat: annotate test 'want' values, fail on mismatch ... Updates #13038 Change-Id: Id711ee19e52a7051a2273c806b184c5571c6e24f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Nick Khyl	67df9abdc6	util/syspolicy/setting: add package that contains types for the next syspolicy PRs ... Package setting contains types for defining and representing policy settings. It facilitates the registration of setting definitions using Register and RegisterDefinition, and the retrieval of registered setting definitions via Definitions and DefinitionOf. This package is intended for use primarily within the syspolicy package hierarchy, and added in a preparation for the next PRs. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	1 month ago
Brad Fitzpatrick	a61825c7b8	cmd/tta, vnet: add host firewall, env var support, more tests ... In particular, tests showing that #3824 works. But that test doesn't actually work yet; it only gets a DERP connection. (why?) Updates #13038 Change-Id: Ie1fd1b6a38d4e90fae7e72a0b9a142a95f0b2e8f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Brad Fitzpatrick	b692985aef	client/tailscale: add LocalClient.OmitAuth for tests ... Similar to UseSocketOnly, but pulled out separately in case people are doing unknown weird things. Updates #13038 Change-Id: I7478e5cb9794439b947440b831caa798941845ea Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Brad Fitzpatrick	0686bc8b19	cmd/tailscaled: add env knob to control default verbosity ... Updates #13038 Change-Id: Ic0e6dfc7a8d127ab5ce0ae9aab9119c56e19b636 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Flakes Updater	0dd9f5397b	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	1 month ago
Maisem Ali	10c2bee9e1	tstest/natlab/vnet: capture network wan/lan interfaces ... Updates #13038 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 month ago
Jordan Whited	7aec8d4e6b	cmd/stunstamp: refactor connection construction (#13110) ... getConns() is now responsible for returning both stable and unstable conns. conn and measureFn are now passed together via connAndMeasureFn. newConnAndMeasureFn() is responsible for constructing them. TCP measurement timeouts are adjusted to more closely match netcheck. Updates tailscale/corp#22114 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 month ago