8363 Commits (810da91a9e3e4b2a9fe0e8aba21b10ed5cf9db34)

 

All Branches   

Search

Author	SHA1	Message	Date
Andrew Lytvynov	ddbc950f46	safeweb: add support for custom CSP (#13975) ... To allow more flexibility with CSPs, add a fully customizable `CSP` type that can be provided in `Config` and encodes itself into the correct format. Preserve the `CSPAllowInlineStyles` option as is today, but maybe that'll get deprecated later in favor of the new CSP field. In particular, this allows for pages loading external JS, or inline JS with nonces or hashes (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_inline_script) Updates https://github.com/tailscale/corp/issues/8027 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	4 weeks ago
Andrea Gottardo	6985369479	net/sockstats: prevent crash in setNetMon (#13985)	4 weeks ago
Andrew Lytvynov	3477bfd234	safeweb: add support for "/" and "/foo" handler distinction (#13980) ... By counting "/" elements in the pattern we catch many scenarios, but not the root-level handler. If either of the patterns is "/", compare the pattern length to pick the right one. Updates https://github.com/tailscale/corp/issues/8027 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	4 weeks ago
Nick Khyl	3f626c0d77	cmd/tailscale/cli, client/tailscale, ipn/localapi: add tailscale syspolicy {list,reload} commands ... In this PR, we add the tailscale syspolicy command with two subcommands: list, which displays policy settings, and reload, which forces a reload of those settings. We also update the LocalAPI and LocalClient to facilitate these additions. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 weeks ago
Irbe Krumina	45354dab9b	ipn,tailcfg: add app connector config knob to conffile (#13942) ... Make it possible to advertise app connector via a new conffile field. Also bumps capver - conffile deserialization errors out if unknonw fields are set, so we need to know which clients understand the new field. Updates tailscale/tailscale#11113 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	4 weeks ago
Anton Tolchanov	b4f46c31bb	wgengine/magicsock: export packet drop metric for outbound errors ... This required sharing the dropped packet metric between two packages (tstun and magicsock), so I've moved its definition to util/usermetric. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 weeks ago
Anton Tolchanov	532b26145a	wgengine/magicsock: exclude disco from throughput metrics ... The user-facing metrics are intended to track data transmitted at the overlay network level. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 weeks ago
James Tucker	e1e22785b4	net/netcheck: ensure prior preferred DERP is always in netchecks ... In an environment with unstable latency, such as upstream bufferbloat, there are cases where a full netcheck could drop the prior preferred DERP (likely home DERP) from future netcheck probe plans. This will then likely result in a home DERP having a missing sample on the next incremental netcheck, ultimately resulting in a home DERP move. This change does not fix our overall response to highly unstable latency, but it is an incremental improvement to prevent single spurious samples during a full netcheck from alone triggering a flapping condition, as now the prior changes to include historical latency will still provide the desired resistance, and the home DERP should not move unless latency is consistently worse over a 5 minute period. Note that there is a nomenclature and semantics issue remaining in the difference between a report preferred DERP and a home DERP. A report preferred DERP is aspirational, it is what will be picked as a home DERP if a home DERP connection needs to be established. A nodes home DERP may be different than a recent preferred DERP, in which case a lot of netcheck logic is fallible. In future enhancements much of the DERP move logic should move to consider the home DERP, rather than recent report preferred DERP. Updates #8603 Updates #13969 Signed-off-by: James Tucker <james@tailscale.com>	4 weeks ago
Brad Fitzpatrick	f81348a16b	util/syspolicy/source: put EnvPolicyStore env keys in their own namespace ... ... all prefixed with TS_DEBUGSYSPOLICY_*. Updates #13193 Updates #12687 Updates #13855 Change-Id: Ia8024946f53e2b3afda4456a7bb85bbcf6d12bfc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 weeks ago
Nick Khyl	540e4c83d0	util/syspolicy/setting: make setting.Snapshot JSON-marshallable ... We make setting.Snapshot JSON-marshallable in preparation for returning it from the LocalAPI. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 weeks ago
Nick Khyl	2a2228f97b	util/syspolicy/setting: make setting.RawItem JSON-marshallable ... We add setting.RawValue, a new type that facilitates unmarshalling JSON numbers and arrays as uint64 and []string (instead of float64 and []any) for policy setting values. We then use it to make setting.RawItem JSON-marshallable and update the tests. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 weeks ago
Nick Khyl	2cc1100d24	util/syspolicy/source: use errors instead of github.com/pkg/errors ... Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 weeks ago
Nick Khyl	2336c340c4	util/syspolicy: implement a syspolicy store that reads settings from environment variables ... In this PR, we implement (but do not use yet, pending #13727 review) a syspolicy/source.Store that reads policy settings from environment variables. It converts a CamelCase setting.Key, such as AuthKey or ExitNodeID, to a SCREAMING_SNAKE_CASE, TS_-prefixed environment variable name, such as TS_AUTH_KEY and TS_EXIT_NODE_ID. It then looks up the variable and attempts to parse it according to the expected value type. If the environment variable is not set, the policy setting is considered not configured in this store (the syspolicy package will still read it from other sources). Similarly, if the environment variable has an invalid value for the setting type, it won't be used (though the reported/logged error will differ). Updates #13193 Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 weeks ago
Irbe Krumina	1103044598	cmd/k8s-operator,k8s-operator: add topology spread constraints to ProxyClass (#13959) ... Now when we have HA for egress proxies, it makes sense to support topology spread constraints that would allow users to define more complex topologies of how proxy Pods need to be deployed in relation with other Pods/across regions etc. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	4 weeks ago
Tim Walters	856ea2376b	wgengine/magicsock: log home DERP changes with latency ... This adds additional logging on DERP home changes to allow better troubleshooting. Updates tailscale/corp#18095 Signed-off-by: Tim Walters <tim@tailscale.com>	4 weeks ago
Jonathan Nobels	aecb0ab76b	tstest/tailmac: add support for mounting host directories in the guest (#13957) ... updates tailscale/corp#24197 tailmac run now supports the --share option which will allow you to specify a directory on the host which can be mounted in the guest using mount_virtiofs vmshare <path>. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	4 weeks ago
Jonathan Nobels	0f9a054cba	tstest/tailmac: fix Host.app path generation (#13953) ... updates tailscale/corp#24197 Generation of the Host.app path was erroneous and tailmac run would not work unless the pwd was tailmac/bin. Now you can be able to invoke tailmac from anywhere. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	4 weeks ago
Anton Tolchanov	9545e36007	cmd/tailscale/cli: add 'tailscale metrics' command ... - `tailscale metrics print`: to show metric values in console - `tailscale metrics write`: to write metrics to a file (with a tempfile & rename dance, which is atomic on Unix). Also, remove the `TS_DEBUG_USER_METRICS` envknob as we are getting more confident in these metrics. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 weeks ago
Anton Tolchanov	38af62c7b3	ipn/ipnlocal: remove the primary routes gauge for now ... Not confident this is the right way to expose this, so let's remote it for now. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 weeks ago
Anton Tolchanov	11e96760ff	wgengine/magicsock: fix stats packet counter on derp egress ... Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 weeks ago
Anton Tolchanov	94fa6d97c5	ipn/ipnlocal: log errors while fetching serial numbers ... If the client cannot fetch a serial number, write a log message helping the user understand what happened. Also, don't just return the error immediately, since we still have a chance to collect network interface addresses. Updates #5902 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 weeks ago
James Tucker	0d76d7d21c	tool/gocross: remove trimpath from test builds ... trimpath can be inconvenient for IDEs and LSPs that do not always correctly handle module relative paths, and can also contribute to caching bugs taking effect. We rarely have a real need for trimpath of test produced binaries, so avoiding it should be a net win. Updates #2988 Signed-off-by: James Tucker <james@tailscale.com>	4 weeks ago
James Tucker	c0a1ed86cb	tstest/natlab: add latency & loss simulation ... A simple implementation of latency and loss simulation, applied to writes to the ethernet interface of the NIC. The latency implementation could be optimized substantially later if necessary. Updates #13355 Signed-off-by: James Tucker <james@tailscale.com>	1 month ago
License Updater	41aac26106	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 month ago
Renato Aguiar	5d07c17b93	net/dns: fix blank lines being added to resolv.conf on OpenBSD (#13928) ... During resolv.conf update, old 'search' lines are cleared but '\n' is not deleted, leaving behind a new blank line on every update. This adds 's' flag to regexp, so '\n' is included in the match and deleted when old lines are cleared. Also, insert missing `\n` when updated 'search' line is appended to resolv.conf. Signed-off-by: Renato Aguiar <renato@renatoaguiar.net>	1 month ago
Irbe Krumina	9d1348fe21	ipn/store/kubestore: don't error if state cannot be preloaded (#13926) ... Preloading of state from kube Secret should not error if the Secret does not exist. Updates tailscale/tailscale#7671 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	1 month ago
Irbe Krumina	853fe3b713	ipn/store/kubestore: cache state in memory (#13918) ... Cache state in memory on writes, read from memory in reads. kubestore was previously always reading state from a Secret. This change should fix bugs caused by temporary loss of access to kube API server and imporove overall performance Fixes #7671 Updates tailscale/tailscale#12079,tailscale/tailscale#13900 Signed-off-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Maisem Ali <maisem@tailscale.com>	1 month ago
Nick Kirby	6ab39b7bcd	cmd/k8s-operator: validate that tailscale.com/tailnet-ip annotation value is a valid IP ... Fixes #13836 Signed-off-by: Nick Kirby <nrkirb@gmail.com>	1 month ago
Nick Khyl	e815ae0ec4	util/syspolicy, ipn/ipnlocal: update syspolicy package to utilize syspolicy/rsop ... In this PR, we update the syspolicy package to utilize syspolicy/rsop under the hood, and remove syspolicy.CachingHandler, syspolicy.windowsHandler and related code which is no longer used. We mark the syspolicy.Handler interface and RegisterHandler/SetHandlerForTest functions as deprecated, but keep them temporarily until they are no longer used in other repos. We also update the package to register setting definitions for all existing policy settings and to register the Registry-based, Windows-specific policy stores when running on Windows. Finally, we update existing internal and external tests to use the new API and add a few more tests and benchmarks. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	1 month ago
Andrew Dunham	7fe6e50858	net/dns/resolver: fix test flake ... Updates #13902 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib2def19caad17367e9a31786ac969278e65f51c6	1 month ago
Paul Scott	212270463b	cmd/testwrapper: add pkg runtime to output (#13894) ... Fixes #13893 Signed-off-by: Paul Scott <paul@tailscale.com>	1 month ago
Andrew Dunham	b2665d9b89	net/netcheck: add a Now field to the netcheck Report ... This allows us to print the time that a netcheck was run, which is useful in debugging. Updates #10972 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id48d30d4eb6d5208efb2b1526a71d83fe7f9320b	1 month ago
Brad Fitzpatrick	ae5bc88ebe	health: fix spurious warning about DERP home region '0' ... Updates #13650 Change-Id: I6b0f165f66da3f881a4caa25d2d9936dc2a7f22c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Maisem Ali	85241f8408	net/tstun: use /10 as subnet for TAP mode; read IP from netmap ... Few changes to resolve TODOs in the code: - Instead of using a hardcoded IP, get it from the netmap. - Use 100.100.100.100 as the gateway IP - Use the /10 CGNAT range instead of a random /24 Updates #2589 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 month ago
Maisem Ali	d4d21a0bbf	net/tstun: restore tap mode functionality ... It had bit-rotted likely during the transition to vector io in 76389d8baf. Tested on Ubuntu 24.04 by creating a netns and doing the DHCP dance to get an IP. Updates #2589 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 month ago
Nick Khyl	0f4c9c0ecb	cmd/viewer: import types/views when generating a getter for a map field ... Fixes #13873 Signed-off-by: Nick Khyl <nickk@tailscale.com>	1 month ago
Andrea Gottardo	f8f53bb6d4	health: remove SysDNSOS, add two Warnables for read+set system DNS config (#13874)	1 month ago
Erisa A	72587ab03c	scripts/installer.sh: allow Archcraft for Arch packages (#13870) ... Fixes #13869 Signed-off-by: Erisa A <erisa@tailscale.com>	1 month ago
Brad Fitzpatrick	c76a6e5167	derp: track client-advertised non-ideal DERP connections in more places ... In f77821fd63 (released in v1.72.0), we made the client tell a DERP server when the connection was not its ideal choice (the first node in its region). But we didn't do anything with that information until now. This adds a metric about how many such connections are on a given derper, and also adds a bit to the PeerPresentFlags bitmask so watchers can identify (and rebalance) them. Updates tailscale/corp#372 Change-Id: Ief8af448750aa6d598e5939a57c062f4e55962be Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Andrea Gottardo	fd77965f23	net/tlsdial: call out firewalls blocking Tailscale in health warnings (#13840) ... Updates tailscale/tailscale#13839 Adds a new blockblame package which can detect common MITM SSL certificates used by network appliances. We use this in `tlsdial` to display a dedicated health warning when we cannot connect to control, and a network appliance MITM attack is detected. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	1 month ago
Mario Minardi	e711ee5d22	release/dist: clamp min / max version for synology package centre (#13857) ... Clamp the min and max version for DSM 7.0 and DSM 7.2 packages when we are building packages for the synology package centre. This change leaves packages destined for pkgs.tailscale.com with just the min version set to not break packages in the wild / our update flow. Updates https://github.com/tailscale/corp/issues/22908 Signed-off-by: Mario Minardi <mario@tailscale.com>	1 month ago
Jordan Whited	877fa504b4	net/netcheck: remove arbitrary deadlines from GetReport() tests (#13832) ... GetReport() may have side effects when the caller enforces a deadline that is shorter than ReportTimeout. Updates #13783 Updates #13394 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 month ago
Nick Khyl	874db2173b	ipn/{ipnauth,ipnlocal,ipnserver}: send the auth URL to the user who started interactive login ... We add the ClientID() method to the ipnauth.Actor interface and updated ipnserver.actor to implement it. This method returns a unique ID of the connected client if the actor represents one. It helps link a series of interactions initiated by the client, such as when a notification needs to be sent back to a specific session, rather than all active sessions, in response to a certain request. We also add LocalBackend.WatchNotificationsAs and LocalBackend.StartLoginInteractiveAs methods, which are like WatchNotifications and StartLoginInteractive but accept an additional parameter specifying an ipnauth.Actor who initiates the operation. We store these actor identities in watchSession.owner and LocalBackend.authActor, respectively,and implement LocalBackend.sendTo and related helper methods to enable sending notifications to watchSessions associated with actors (or, more broadly, identifiable recipients). We then use the above to change who receives the BrowseToURL notifications: - For user-initiated, interactive logins, the notification is delivered only to the user who initiated the process. If the initiating actor represents a specific connected client, the URL notification is sent back to the same LocalAPI client that called StartLoginInteractive. Otherwise, the notification is sent to all clients connected as that user. Currently, we only differentiate between users on Windows, as it is inherently a multi-user OS. - In all other cases (e.g., node key expiration), we send the notification to all connected users. Updates tailscale/corp#18342 Signed-off-by: Nick Khyl <nickk@tailscale.com>	1 month ago
Jordan Whited	bb60da2764	derp: add sclient write deadline timeout metric (#13831) ... Write timeouts can be indicative of stalled TCP streams. Understanding changes in the rate of such events can be helpful in an ops context. Updates tailscale/corp#23668 Signed-off-by: Jordan Whited <jordan@tailscale.com>	1 month ago
Brad Fitzpatrick	18fc093c0d	derp: give trusted mesh peers longer write timeouts ... Updates tailscale/corp#24014 Change-Id: I700872be48ab337dce8e11cabef7f82b97f0422a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago
Andrew Dunham	c0a9895748	scripts/installer.sh: support DNF5 ... This fixes the installation on newer Fedora versions that use dnf5 as the 'dnf' binary. Updates #13828 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I39513243c81640fab244a32b7dbb3f32071e9fce	1 month ago
Andrea Gottardo	fa95318a47	tool/gocross: add support for tvOS Simulator (#13847) ... Updates ENG-5321 Allow gocross to build a static library for the Apple TV Simulator. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	1 month ago
Naman Sood	22c89fcb19	cmd/tailscale,ipn,tailcfg: add `tailscale advertise` subcommand behind envknob (#13734) ... Signed-off-by: Naman Sood <mail@nsood.in>	1 month ago
Mario Minardi	d32d742af0	ipn/ipnlocal: error when trying to use exit node on unsupported platform (#13726) ... Adds logic to `checkExitNodePrefsLocked` to return an error when attempting to use exit nodes on a platform where this is not supported. This mirrors logic that was added to error out when trying to use `ssh` on an unsupported platform, and has very similar semantics. Fixes https://github.com/tailscale/tailscale/issues/13724 Signed-off-by: Mario Minardi <mario@tailscale.com>	1 month ago
Brad Fitzpatrick	6a885dbc36	wgengine/magicsock: fix CI-only test warning of missing health tracker ... While looking at deflaking TestTwoDevicePing/ping_1.0.0.2_via_SendPacket, there were a bunch of distracting: WARNING: (non-fatal) nil health.Tracker (being strict in CI): ... This pacifies those so it's easier to work on actually deflaking the test. Updates #11762 Updates #11874 Change-Id: I08dcb44511d4996b68d5f1ce5a2619b555a2a773 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 month ago