tailscale

Commit Graph

Author	SHA1	Message	Date
Nick Khyl	1608831c33	wgengine/router: use quad-100 as the nexthop on Windows Windows requires routes to have a nexthop. Routes created using the interface's local IP address or an unspecified IP address ("0.0.0.0" or "::") as the nexthop are considered on-link routes. Notably, Windows treats on-link subnet routes differently, reserving the last IP in the range as the broadcast IP and therefore prohibiting TCP connections to it, resulting in WSA error 10049: "The requested address is not valid in its context. This does not happen with single-host routes, such as routes to Tailscale IP addresses, but becomes a problem with advertised subnets when all IPs in the range should be reachable. Before Windows 8, only routes created with an unspecified IP address were considered on-link, so our previous approach of using the interface's own IP as the nexthop likely worked on Windows 7. This PR updates configureInterface to use the TailscaleServiceIP (100.100.100.100) and its IPv6 counterpart as the nexthop for subnet routes. Fixes tailscale/support-escalations#57 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Brad Fitzpatrick	d3af54444c	client/tailscale: document ACLTestFailureSummary.User field And justify its legacy name. Updates #1931 Change-Id: I3eff043679bf8f046aed6e2c4fb7592fe2e66514 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Paul Scott	d97cddd876	tsweb: swallow panics With this change, the error handling and request logging are all done in defers after calling inner.ServeHTTP. This ensures that any recovered values which we want to re-panic with retain a useful stacktrace. However, we now only re-panic from errorHandler when there's no outside logHandler. Which if you're using StdHandler there always is. We prefer this to ensure that we are able to write a 500 Internal Server Error to the client. If a panic hits http.Server then the response is not sent back. Updates #12784 Signed-off-by: Paul Scott <paul@tailscale.com>	5 months ago
Brad Fitzpatrick	f77821fd63	derp/derphttp: determine whether a region connect was to non-ideal node ... and then do approximately nothing with that information, other than a big TODO. This is mostly me relearning this code and leaving breadcrumbs for others in the future. Updates #12724 Signed-off-by: Brad Fitzpatrick <brad@danga.com>	5 months ago
Brad Fitzpatrick	0b32adf9ec	hostinfo: set Hostinfo.PackageType for mkctr container builds Fixes tailscale/corp#21448 Change-Id: Id60fb5cd7d31ef94cdbb176141e034845a480a00 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Cameron Stokes	1ac14d7216	Dockerfile: remove warning (#12841 ) Fixes tailscale/tailscale#12842 Signed-off-by: Cameron Stokes <cameron@cameronstokes.com>	5 months ago
Aaron Klotz	4ff276cf52	VERSION.txt: this is v1.71.0 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Irbe Krumina	2742153f84	cmd/k8s-operator: add a metric to track the amount of ProxyClass resources (#12833 ) Updates tailscale/tailscale#10709 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Paul Scott	646990a7d0	tsweb: log once per request StdHandler/retHandler would previously emit one log line for each request. If there were multiple StdHandler in the chain, there would be one log line per instance of retHandler. With this change, only the outermost StdHandler/logHandler actually logs the request or invokes OnStart or OnCompletion callbacks. The error-rendering part of retHandler lives on in errorHandler, and errorHandler passes those errors up the stack to logHandler through a callback that logHandler places in the request.Context(). Updates tailscale/corp#19999 Signed-off-by: Paul Scott <paul@tailscale.com>	5 months ago
Adrian Dewhurst	8882c6b730	ipn/ipnlocal: wait for DERP before auto exit node migration Updates tailscale/corp#19681 Change-Id: I31dec154aa3b5edba01f10eec37640f631729cb2 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	5 months ago
License Updater	35d2efd692	licenses: update license notices Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	5 months ago
Anton Tolchanov	fc074a6b9f	client/tailscale: add the nodeAttrs section This change allows ACL contents to include node attributes https://tailscale.com/kb/1337/acl-syntax#node-attributes-nodeattrs Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	5 months ago
Paul Scott	014bf25c0a	tsweb: fix TestStdHandler_panic flake Fixes #12816 Signed-off-by: Paul Scott <paul@tailscale.com>	5 months ago
Adrian Dewhurst	0834712c91	ipn: allow FQDN in exit node selection To match the format of exit node suggestions and ensure that the result is not ambiguous, relax exit node CLI selection to permit using a FQDN including the trailing dot. Updates #12618 Change-Id: I04b9b36d2743154aa42f2789149b2733f8555d3f Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	5 months ago
Paul Scott	fec41e4904	tsweb: add stack trace to panic error msg Updates #12784 Signed-off-by: Paul Scott <paul@tailscale.com>	5 months ago
Nick Khyl	fd0acc4faf	cmd/cloner, cmd/viewer: add _test prefix for files generated with the test build tag Updates #12736 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Fran Bull	380a3a0834	appc: track metrics for route info storing Track how often we're writing state and how many routes we're writing. Updates #11008 Signed-off-by: Fran Bull <fran@tailscale.com>	5 months ago
Anton Tolchanov	5d61d1c7b0	log/sockstatlog: don't block for more than 5s on shutdown Fixes tailscale/corp#21618 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	5 months ago
Linus Brogan	9609b26541	cmd/tailscale: resolve taildrive share paths Fixes #12258. Signed-off-by: Linus Brogan <git@linusbrogan.com>	5 months ago
Anton Tolchanov	7403d8e9a8	logtail: close idle HTTP connections on shutdown Fixes tailscale/corp#21609 Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Anton Tolchanov <anton@tailscale.com>	5 months ago
Jordan Whited	f0b9d3f477	net/tstun: fix docstring for Wrapper.SetWGConfig (#12796 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Andrea Gottardo	3f3edeec07	health: drop unnecessary logging in TestSetUnhealthyWithTimeToVisible (#12795 ) Fixes tailscale/tailscale#12794 We were printing some leftover debug logs within a callback function that would be executed after the test completion, causing the test to fail. This change drops the log calls to address the issue. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Brad Fitzpatrick	808b4139ee	wgengine/magicsock: use wireguard-go/conn.PeerAwareEndpoint If we get an non-disco presumably-wireguard-encrypted UDP packet from an IP:port we don't recognize, rather than drop the packet, give it to WireGuard anyway and let WireGuard try to figure out who it's from and tell us. This uses the new hook added in https://github.com/tailscale/wireguard-go/pull/27 Updates tailscale/corp#20732 Change-Id: I5c61a40143810592f9efac6c12808a87f924ecf2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Claire Wang	49bf63cdd0	ipn/ipnlocal: check for offline auto exit node in SetControlClientStatus (#12772 ) Updates tailscale/corp#19681 Signed-off-by: Claire Wang <claire@tailscale.com>	5 months ago
Joe Tsai	d209b032ab	syncs: add Map.WithLock to allow mutations to the underlying map (#8101 ) Some operations cannot be implemented with the prior API: * Iterating over the map and deleting keys * Iterating over the map and replacing items * Calling APIs that expect a native Go map Add a Map.WithLock method that acquires a write-lock on the map and then calls a user-provided closure with the underlying Go map. This allows users to interact with the Map as a regular Go map, but with the gaurantees that it is concurrent safe. Updates tailscale/corp#9115 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	5 months ago
Nick Khyl	fc28c8e7f3	cmd/cloner, cmd/viewer, util/codegen: add support for generic types and interfaces This adds support for generic types and interfaces to our cloner and viewer codegens. It updates these packages to determine whether to make shallow or deep copies based on the type parameter constraints. Additionally, if a template parameter or an interface type has View() and Clone() methods, we'll use them for getters and the cloner of the owning structure. Updates #12736 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Andrea Gottardo	b7c3cfe049	health: support delayed Warnable visibility (#12783 ) Updates tailscale/tailscale#4136 To reduce the likelihood of presenting spurious warnings, add the ability to delay the visibility of certain Warnables, based on a TimeToVisible time.Duration field on each Warnable. The default is zero, meaning that a Warnable is immediately visible to the user when it enters an unhealthy state. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
KevinLiang10	8d7b78f3f7	net/dns/publicdns: remove additional information in DOH URL passed to IPv6 address generation for controlD. This commit truncates any additional information (mainly hostnames) that's passed to controlD via DOH URL in DoHIPsOfBase. This change is to make sure only resolverID is passed to controlDv6Gen but not the additional information. Updates: #7946 Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	5 months ago
Mario Minardi	041733d3d1	publicapi: add note that API docs have moved to existing docs files (#12770 ) Add note that API docs have moved to `https://tailscale.com/api` to the top of existing API docs markdown files. Updates https://github.com/tailscale/corp/issues/1301 Signed-off-by: Mario Minardi <mario@tailscale.com>	5 months ago
Anton Tolchanov	874972b683	posture: add network hardware addresses to posture identity If an optional `hwaddrs` URL parameter is present, add network interface hardware addresses to the posture identity response. Just like with serial numbers, this requires client opt-in via MDM or `tailscale set --posture-checking=true` (https://tailscale.com/kb/1326/device-identity) Updates tailscale/corp#21371 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	5 months ago
Lee Briggs	b546a6e758	wgengine/magicsock: allow a CSV list for pretendpoint Load Balancers often have more than one ingress IP, so allowing us to add multiple means we can offer multiple options. Updates #12578 Change-Id: I4aa49a698d457627d2f7011796d665c67d4c7952 Signed-off-by: Lee Briggs <lee@leebriggs.co.uk>	5 months ago
Brad Fitzpatrick	c6af5bbfe8	all: add test for package comments, fix, add comments as needed Updates #cleanup Change-Id: Ic4304e909d2131a95a38b26911f49e7b1729aaef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Joe Tsai	e92f4c6af8	syncs: add generic Pool (#12759 ) Pool is a type-safe wrapper over sync.Pool. Updates tailscale/corp#11038 Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>	5 months ago
Irbe Krumina	986d60a094	cmd/k8s-operator: add metrics for attempted/uploaded session recordings (#12765 ) Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Irbe Krumina	6a982faa7d	cmd/k8s-operator: send container name to session recorder (#12763 ) Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Anton Tolchanov	c8f258a904	prober: propagate DERPMap request creation errors Updates tailscale/corp#8497 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	5 months ago
Nick Khyl	726d5d507d	cmd/k8s-operator: update depaware.txt This fixes an issue caused by the merge order of `2b638f550d` and `8bd442ba8c`. Updates #Cleanup Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Maisem Ali	2238ca8a05	go.mod: bump bart Updates #bart Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Nick Khyl	8bd442ba8c	util/winutil/gp, net/dns: add package for Group Policy API This adds a package with GP-related functions and types to be used in the future PRs. It also updates nrptRuleDatabase to use the new package instead of its own gpNotificationWatcher implementation. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Andrew Lytvynov	7b1c764088	ipn/ipnlocal: gate systemd-run flags on systemd version (#12747 ) We added a workaround for --wait, but didn't confirm the other flags, which were added in systemd 235 and 236. Check systemd version for deciding when to set all 3 flags. Fixes #12136 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Andrew Lytvynov	b8af91403d	clientupdate: return true for CanAutoUpdate for macsys (#12746 ) While `clientupdate.Updater` won't be able to apply updates on macsys, we use `clientupdate.CanAutoUpdate` to gate the EditPrefs endpoint in localAPI. We should allow the GUI client to set AutoUpdate.Apply on macsys for it to properly get reported to the control plane. This also allows the tailnet-wide default for auto-updates to propagate to macsys clients. Updates https://github.com/tailscale/corp/issues/21339 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Nick Khyl	e21d8768f9	types/opt: add generic Value[T any] for optional values of any types Updates #12736 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Maisem Ali	5576972261	client/tailscale: use safesocket.ConnectContext I apparently missed this in `4b6a0c42c8`. Updates tailscale/corp#18266 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Irbe Krumina	ba517ab388	cmd/k8s-operator,ssh/tailssh,tsnet: optionally record 'kubectl exec' sessions via Kubernetes operator's API server proxy (#12274 ) cmd/k8s-operator,ssh/tailssh,tsnet: optionally record kubectl exec sessions The Kubernetes operator's API server proxy, when it receives a request for 'kubectl exec' session now reads 'RecorderAddrs', 'EnforceRecorder' fields from tailcfg.KubernetesCapRule. If 'RecorderAddrs' is set to one or more addresses (of a tsrecorder instance(s)), it attempts to connect to those and sends the session contents to the recorder before forwarding the request to the kube API server. If connection cannot be established or fails midway, it is only allowed if 'EnforceRecorder' is not true (fail open). Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Maisem Ali	2b638f550d	cmd/k8s-operator: add depaware.txt Updates #12742 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
License Updater	9102a5bb73	licenses: update license notices Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	5 months ago
Flakes Updater	c8fe9f0064	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	5 months ago
Brad Fitzpatrick	42dac7c5c2	wgengine/magicsock: add debug envknob for injecting an endpoint For testing. Lee wants to play with 'AWS Global Accelerator Custom Routing with Amazon Elastic Kubernetes Service'. If this works well enough, we can promote it. Updates #12578 Change-Id: I5018347ed46c15c9709910717d27305d0aedf8f4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	d2fef01206	control/controlknobs,tailcfg,wgengine/magicsock: remove DRPO shutoff switch The DERP Return Path Optimization (DRPO) is over four years old (and on by default for over two) and we haven't had problems, so time to remove the emergency shutoff code (controlknob) which we've never used. The controlknobs are only meant for new features, to mitigate risk. But we don't want to keep them forever, as they kinda pollute the code. Updates #150 Change-Id: If021bc8fd1b51006d8bddd1ffab639bb1abb0ad1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	9df107f4f0	wgengine/magicsock: use derp-region-as-magic-AddrPort hack in fewer places And fix up a bogus comment and flesh out some other comments. Updates #cleanup Change-Id: Ia60a1c04b0f5e44e8d9587914af819df8e8f442a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago

... 6 7 8 9 10 ...

8221 Commits (866714a8941072ce576628d62b8cd0eed3f67e3e) All Branches Search

8221 Commits (866714a8941072ce576628d62b8cd0eed3f67e3e)

All Branches