tailscale

Commit Graph

Author	SHA1	Message	Date
Sam Linville	812025a39c	words: what?! a llama?! he's supposed to be dead! (#7623 ) pull the lever, kronk Signed-off-by: Sam Linville <samlinville@protonmail.com>	2 years ago
Andrew Dunham	39b289578e	ssh/tailssh: make uid an int instead of uint64 Follow-up to #7615 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib4256bff276f6d5cf95838d8e39c87b3643bde37	2 years ago
David Anderson	c9a4dbe383	tool/gocross: correctly embed the git commit into gocross Previously, the build ended up embedding an empty string, which made the shell wrapper rebuild gocross on every invocation. This is still reasonably fast, but fixing the bypass shaves 80% off gocross's overhead when no rebuild is needed. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Brad Fitzpatrick	f11c270c6b	go.toolchain.rev: bump Go toolchain For tailscale/go#60 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	d2dec13392	net/sockstats: export cellular-only clientmetrics Followup to #7518 to also export client metrics when the active interface is cellular. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
David Anderson	e7a78bc28f	tool/gocross: support running from outside the repo dir A bunch of us invoke tool/go from outside the repo that hosts gocross, as a way of accessing our version-controlled toolchain. This removes assumptions from gocross that it's being invoked within the repository that contains its source code and toolchain configuration. Fixes tailscale/corp#9627 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	df02bb013a	tool/gocross: fail if the toolchain revision isn't findable This used to make sense, but after a refactor somewhere along the line this results in trying to download from a malformed URL and generally confusing failures. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Denton Gentry	ebc630c6c0	net/interfaces: also allow link-local for AzureAppServices. In May 2021, Azure App Services used 172.16.x.x addresses: ``` 10: eth0@if11: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP link/ether 02:42:ac:10:01:03 brd ff:ff:ff:ff:ff:ff inet 172.16.1.3/24 brd 172.16.1.255 scope global eth0 valid_lft forever preferred_lft forever ``` Now it uses link-local: ``` 2: eth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP link/ether 8a:30:1f:50:1d:23 brd ff:ff:ff:ff:ff:ff inet 169.254.129.3/24 brd 169.254.129.255 scope global eth0 valid_lft forever preferred_lft forever ``` This is reasonable for them to choose to do, it just broke the handling in net/interfaces. This PR proposes to: 1. Always allow link-local in LocalAddresses() if we have no better address available. 2. Continue to make isUsableV4() conditional on an environment we know requires it. I don't love the idea of having to discover these environments one by one, but I don't understand the consequences of making isUsableV4() return true unconditionally. It makes isUsableV4() essentially always return true and perform no function. Fixes https://github.com/tailscale/tailscale/issues/7603 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Andrew Dunham	ccace1f7df	ssh/tailssh: fix privilege dropping on FreeBSD; add tests On FreeBSD and Darwin, changing a process's supplementary groups with setgroups(2) will also change the egid of the process, setting it to the first entry in the provided list. This is distinct from the behaviour on other platforms (and possibly a violation of the POSIX standard). Because of this, on FreeBSD with no TTY, our incubator code would previously not change the process's gid, because it would read the newly-changed egid, compare it against the expected egid, and since they matched, not change the gid. Because we didn't use the 'login' program on FreeBSD without a TTY, this would propagate to a child process. This could be observed by running "id -p" in two contexts. The expected output, and the output returned when running from a SSH shell, is: andrew@freebsd:~ $ id -p uid andrew groups andrew However, when run via "ssh andrew@freebsd id -p", the output would be: $ ssh andrew@freebsd id -p login root uid andrew rgid wheel groups andrew (this could also be observed via "id -g -r" to print just the gid) We fix this by pulling the details of privilege dropping out into their own function and prepending the expected gid to the start of the list on Darwin and FreeBSD. Finally, we add some tests that run a child process, drop privileges, and assert that the final UID/GID/additional groups are what we expect. More information can be found in the following article: https://www.usenix.org/system/files/login/articles/325-tsafrir.pdf Updates #7616 Alternative to #7609 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I0e6513c31b121108b50fe561c89e5816d84a45b9	2 years ago
Mihai Parparita	e1fb687104	cmd/tailscale/cli: fix inconsistency between serve text and example command Use the same local port number in both, and be more precise about what is being forwarded Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Anton Tolchanov	654b5a0616	derp: add optional debug logging for prober clients This allows tracking packet flow via logs for prober clients. Note that the new sclient.debug() function is called on every received packet, but will do nothing for most clients. I have adjusted sclient logging to print public keys in short format rather than full. This takes effect even for existing non-debug logging (mostly client disconnect messages). Example logs for a packet being sent from client [SbsJn] (connected to derper [dM2E3]) to client [10WOo] (connected to derper [AVxvv]): ``` derper [dM2E3]: derp client 10.0.0.1:35470[SbsJn]: register single client mesh("10.0.1.1"): 4 peers derp client 10.0.0.1:35470[SbsJn]: read frame type 4 len 40 err <nil> derp client 10.0.0.1:35470[SbsJn]: SendPacket for [10WOo], forwarding via <derphttp_client.Client [AVxvv] url=https://10.0.1.1/derp>: <nil> derp client 10.0.0.1:35470[SbsJn]: read frame type 0 len 0 err EOF derp client 10.0.0.1:35470[SbsJn]: read EOF derp client 10.0.0.1:35470[SbsJn]: sender failed: context canceled derp client 10.0.0.1:35470[SbsJn]: removing connection derper [AVxvv]: derp client 10.0.1.1:50650[10WOo]: register single client derp client 10.0.1.1:50650[10WOo]: received forwarded packet from [SbsJn] via [dM2E3] derp client 10.0.1.1:50650[10WOo]: sendPkt attempt 0 enqueued derp client 10.0.1.1:50650[10WOo]: sendPacket from [SbsJn]: <nil> derp client 10.0.1.1:50650[10WOo]: read frame type 0 len 0 err EOF derp client 10.0.1.1:50650[10WOo]: read EOF derp client 10.0.1.1:50650[10WOo]: sender failed: context canceled derp client 10.0.1.1:50650[10WOo]: removing connection ``` Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Anton Tolchanov	50d211d1a4	cmd/derpprobe: allow running all probes at the same time This allows disabling spread mode, which is helpful if you are manually running derpprobe in `--once` mode against a small number of DERP machines. Updates https://github.com/tailscale/corp/issues/9916 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Anton Tolchanov	e59dc29a55	prober: log client pubkeys on derp mesh probe failures Updates https://github.com/tailscale/corp/issues/9916 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
dependabot[bot]	60a028a4f6	.github: Bump peter-evans/create-pull-request from 4.1.4 to 4.2.4 Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 4.1.4 to 4.2.4. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](`ad43dccb4d...38e0b6e68b`) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2 years ago
dependabot[bot]	927e2e3e7c	.github: Bump actions/setup-go from 3 to 4 Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3 to 4. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v3...v4) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2 years ago
Nahum Shalman	82e067e0ff	build_dist.sh: make cross-compilation friendly Signed-off-by: Nahum Shalman <nahamu@gmail.com>	2 years ago
Maisem Ali	95494a155e	.github: use unique names for jobs Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
James 'zofrex' Sanderson	9534783758	tailscale/cmd: Warn for up --force-reauth over SSH without accepting the risk (#7575 ) Fixes #6377 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	2 years ago
Maisem Ali	f34590d9ed	tsnet: add test for Funnel connections For the logic added in `b797f77`. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	c6d96a2b61	tsnet: do not start logtail in tests It was trying to upload logs in tests. skip-issuebot Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
David Anderson	0498d5ea86	tool/gocross: delete bootstrap tarball downloads after use Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	1f95bfedf7	tool/gocross: adjust Xcode flags to match new Xcode env Xcode changed how/what data it exports to build steps at some point recently, so our old way of figuring out the minimum support version for clang stopped working. Updates tailscale/corp#4095 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Kurnia D Win	9526858b1e	control/controlclient: fix accidental backoff reset Signed-off-by: Kurnia D Win <kurnia.d.win@gmail.com>	2 years ago
David Anderson	df3996cae3	tool/gocross: bootstrap correctly on an older toolchain Sometimes, our cached toolchain ends up being an older version of Go, older than our go.mod allows. In that scenario, gocross-wrapper.sh would find a usable toolchain, but then fail to compile gocross. This change makes the wrapper script check that the cached toolchain's minor version is good enough to build tailscale.com, and re-bootstraps in shell if not. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Mihai Parparita	97b6d3e917	sockstats: remove per-interface stats from Get They're not needed for the sockstats logger, and they're somewhat expensive to return (since they involve the creation of a map per label). We now have a separate GetInterfaces() method that returns them instead (which we can still use in the PeerAPI debug endpoint). If changing sockstatlog to sample at 10,000 Hz (instead of the default of 10Hz), the CPU usage would go up to 59% on a iPhone XS. Removing the per-interface stats drops it to 20% (a no-op implementation of Get that returns a fixed value is 16%). Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
David Anderson	9ebab961c9	version/mkversion: don't break on tagged go.mod entries I thought our versioning scheme would make go.mod include a commit hash even on stable builds. I was wrong. Fortunately, the rest of this code wants anything that 'git rev-parse' understands (to convert it into a full git hash), and tags qualify. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Denton Gentry	6d3490f399	VERSION.txt: this is 1.39 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
License Updater	51b0169b10	licenses: update win/apple licenses Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	2 years ago
Maisem Ali	b4d3e2928b	tsnet: avoid deadlock on close tsnet.Server.Close was calling listener.Close with the server mutex held, but the listener close method tries to grab that mutex, resulting in a deadlock. Co-authored-by: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
shayne	2b892ad6e7	cmd/tailscale/cli: [serve] rework commands based on feedback (#6521 ) ``` $ tailscale serve https:<port> <mount-point> <source> [off] $ tailscale serve tcp:<port> tcp://localhost:<local-port> [off] $ tailscale serve tls-terminated-tcp:<port> tcp://localhost:<local-port> [off] $ tailscale serve status [--json] $ tailscale funnel <serve-port> {on\|off} $ tailscale funnel status [--json] ``` Fixes: #6674 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Will Norris	6ef2105a8e	log/sockstatlog: only start once; don't copy ticker Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Maisem Ali	8c4adde083	log/sockstatlog: also shutdown the poll goroutine Co-authored-by: Will Norris <will@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	c87782ba9d	cmd/k8s-operator: drop trailing dot in tagged node name Also update tailcfg docs. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Will Norris	09e0ccf4c2	ipn: add c2n endpoint for sockstats logs Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Will Norris	a1d9f65354	ipn,log: add logger for sockstat deltas Signed-off-by: Will Norris <will@tailscale.com> Co-authored-by: Melanie Warrick <warrick@tailscale.com>	2 years ago
Maisem Ali	5e8a80b845	all: replace /kb/ links with /s/ equivalents Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	558735bc63	cmd/k8s-operator: require HTTPS to be enabled for AuthProxy Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	489e27f085	cmd/k8s-operator: make auth proxy pass tags as Impersonate-Group We were not handling tags at all, pass them through as Impersonate-Group headers. And use the FQDN for tagged nodes as Impersonate-User. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	56526ff57f	tailcfg: bump capver for 1.38 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	09aed46d44	cmd/tailscale/cli: update docs and unhide configure Also call out Alpha. Updates #7220 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	223713d4a1	tailcfg,all: add and use Node.IsTagged() Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	83fa17d26c	various: pass logger.Logf through to more places Updates #7537 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id89acab70ea678c8c7ff0f44792d54c7223337c6	2 years ago
Maisem Ali	958c89470b	tsnet: add CertDomains helper (#7533 ) Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
shayne	e109cf9fdd	tsnet/tsnet: clear ipn.ServeConfig on Up for tsnet apps (#7534 ) We persist the ServeConfig, even for tsnet apps. It's quite possible for the ServeConfig to be out of step with the code. Example: If you run `ListenFunnel` then later turn it off, the ServeConfig will still show it enabled, the admin console will show it enabled, but the packet handler will reject the packets. Workaround by clearing the ServeConfig in `tsnet.Up` Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Maisem Ali	3ff44b2307	ipn: add Funnel port check from nodeAttr Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	ccdd534e81	tsnet: add ListenFunnel This lets a tsnet binary share a server out over Tailscale Funnel. Signed-off-by: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Denton Gentry	047b324933	scripts/installer: add PureOS and Amazon Linux Next Fixes https://github.com/tailscale/tailscale/issues/7410 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Andrew Dunham	f0d6228c52	ipn/localapi: flesh out the 'debug derp' checks Updates #6526 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic18d9ff288b9c7b8d5ab1bd77dd59693cd776cc4	2 years ago
License Updater	920de86cee	licenses: update android licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Mihai Parparita	b64d78d58f	sockstats: refactor validation to be opt-in Followup to #7499 to make validation a separate function ( GetWithValidation vs. Get). This way callers that don't need it don't pay the cost of a syscall per active TCP socket. Also clears the conn on close, so that we don't double-count the stats. Also more consistently uses Go doc comments for the exported API of the sockstats package. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago

1 2 3 4 5 ...

5540 Commits (840d69e1ebfc39c6a58ae38a7bf4aae321e7720a) All Branches Search

5540 Commits (840d69e1ebfc39c6a58ae38a7bf4aae321e7720a)

All Branches