3653 Commits (86a902b201ce9f454776d377eb6bb2b2fe3cceab)

 

All Branches   

Search

Author	SHA1	Message	Date
Brad Fitzpatrick	86a902b201	all: adjust some log verbosity ... Updates #1548 Change-Id: Ia55f1b5dc7dfea09a08c90324226fb92cd10fa00 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	adda2d2a51	control/controlclient: select newer certificate ... If multiple certificates match when selecting a certificate, use the one issued the most recently (as determined by the NotBefore timestamp). This also adds some tests for the function that performs that comparison. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Brad Fitzpatrick	a80cef0c13	cmd/derper: fix regression from bootstrap DNS optimization ... The commit b9c92b90db earlier today caused a regression of serving an empty map always, as it was JSON marshalling an atomic.Value instead of the DNS entries map it just built. Change-Id: I9da3eeca132c6324462dedeaa7d002908557384b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	84046d6f7c	Revert "cmd/derper: stop setting content header in handleBootstrapDNS" ... Didn't help enough. We are setting another header anyway. Restore it. This reverts commit 60abeb027b. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	ec62217f52	cmd/derper: close connections once bootstrap DNS has been served ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	21358cf2f5	net/dns: slightly optimize dbusPing for non-dbus case [Linux] ... Avoid some work when D-Bus isn't running. Change-Id: I6f89bb75fdb24c13f61be9b400610772756db1ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	37e7a387ff	net/dns: remove some unused code for detecting systemd-resolved [Linux] ... Change-Id: I19c5fd2cdacfb9e5b688ccd9b4336ae4edffc445 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	15599323a1	net/dns: fix systemd-resolved detection race at boot ... If systemd-resolved is enabled but not running (or not yet running, such as early boot) and resolv.conf is old/dangling, we weren't detecting systemd-resolved. This moves its ping earlier, which will trigger it to start up and write its file. Updates #3362 (likely fixes) Updates #3531 (likely fixes) Change-Id: I6392944ac59f600571c43b8f7a677df224f2beed Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	60abeb027b	cmd/derper: stop setting content header in handleBootstrapDNS ... No one really cares. Its cost outweighs its usefulness. name old time/op new time/op delta HandleBootstrapDNS-10 105ns ± 4% 65ns ± 2% -37.68% (p=0.000 n=15+14) name old alloc/op new alloc/op delta HandleBootstrapDNS-10 416B ± 0% 0B -100.00% (p=0.000 n=15+15) name old allocs/op new allocs/op delta HandleBootstrapDNS-10 3.00 ± 0% 0.00 -100.00% (p=0.000 n=15+15) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	b9c92b90db	cmd/derper: optimize handleBootstrapDNS ... Do json formatting once, rather than on every request. Use an atomic.Value. name old time/op new time/op delta HandleBootstrapDNS-10 6.35µs ± 0% 0.10µs ± 4% -98.35% (p=0.000 n=14+15) name old alloc/op new alloc/op delta HandleBootstrapDNS-10 3.20kB ± 0% 0.42kB ± 0% -86.99% (p=0.000 n=12+15) name old allocs/op new allocs/op delta HandleBootstrapDNS-10 41.0 ± 0% 3.0 ± 0% -92.68% (p=0.000 n=15+15) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	e206a3663f	cmd/derper: add BenchmarkHandleBootstrapDNS ... Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Joe Tsai	0173a50bf0	cmd/derper: add a rate limiter for accepting new connection (#3908) ... A large influx of new connections can bring down DERP since it spins off a new goroutine for each connection, where each routine may do significant amount of work (e.g., allocating memory and crunching numbers for TLS crypto). The momentary spike can cause the process to OOM. This commit sets the groundwork for limiting connections, but leaves the limit at infinite by default. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Denton Gentry	dbea8217ac	net/dns: add NetworkManager regression test ... Use the exact /etc/resolv.conf file from a user report. Updates https://github.com/tailscale/tailscale/issues/3531 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Aaron Klotz	82cd98609f	util/winutil: migrate corp's winutil into OSS. ... It makes the most sense to have all our utility functions reside in one place. There was nothing in corp that could not reasonably live in OSS. I also updated `StartProcessAsChild` to no longer depend on `futureexec`, thus reducing the amount of code that needed migration. I tested this change with `tswin` and it is working correctly. I have a follow-up PR to remove the corresponding code from corp. The migrated code was mostly written by @alexbrainman. Sourced from corp revision 03e90cfcc4dd7b8bc9b25eb13a26ec3a24ae0ef9 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Jay Stapleton	39d173e5fc	add -y flag for xbps to allow installation on void ... Signed-off-by: Jay Stapleton <jay@tailscale.com>	3 years ago
Jay Stapleton	c8551c8a67	add -y flag for xbps to allow installation on void	3 years ago
Aaron Klotz	3a74f2d2d7	cmd/tailscaled, util/winutil: add accessor functions for Windows system policies. ... This patch adds new functions to be used when accessing system policies, and revises callers to use the new functions. They first attempt the new registry path for policies, and if that fails, attempt to fall back to the legacy path. We keep non-policy variants of these functions because we should be able to retain the ability to read settings from locations that are not exposed to sysadmins for group policy edits. The remaining changes will be done in corp. Updates https://github.com/tailscale/tailscale/issues/3584 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	24c9dbd129	tsweb: fix JSONHandlerFunc regression where HTTP status was lost on gzip ... Change-Id: Ia7add6cf7e8b46bb6dd45bd3c0371ea79402fb45 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Xe Iaso	62db629227	words: add ferret to tails.txt (#3897) ... In honor of this post[1] inspiring me to remember that ferrets exist and have tails. [1]: https://tech.davidfield.co.uk/what-is-tailscale/ Signed-off-by: Xe <xe@tailscale.com>	3 years ago
Brad Fitzpatrick	3c481d6b18	cmd/tailscale: add "tailscale configure-host" to prep a Synology machine at boot ... Updates #3761 Change-Id: Ib5ab9a4808ade074f48d3abee22c57d7670f9e21 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b3d268c5a1	control/controlclient: turn off Go's implicit compression ... We don't use it anyway, so be explicit that we're not using it. Change-Id: Iec953271ef0169a2e227811932f5b65b479624af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	df8f02db3f	tsweb: add gzip support to JSONHandlerFunc ... Change-Id: I337e05f92f744bfc7e9d6fb8e67c87c191ba4da8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	16652ae52c	installer.sh: accommodate linuxmint versioning. ... Recent linuxmint releases now use VERSION_CODENAME for a linuxmint release (like "uma") and set UBUNTU_CODENAME to the Ubuntu release they branched from. Tested in a linuxmint 20.2 VM. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Sonia Appasamy	aaba49ca10	api.md: add docs for device tags and keys endpoints ... Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	3 years ago
Maisem Ali	e64cecac8e	chirp: remove regex dependency ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	2a67beaacf	net/interfaces: bound Linux /proc/net/route parsing ... tailscaled was using 100% CPU on a machine with ~1M lines, 100MB+ of /proc/net/route data. Two problems: in likelyHomeRouterIPLinux, we didn't stop reading the file once we found the default route (which is on the first non-header line when present). Which meant it was finding the answer and then parsing 100MB over 1M lines unnecessarily. Second was that if the default route isn't present, it'd read to the end of the file looking for it. If it's not in the first 1,000 lines, it ain't coming, or at least isn't worth having. (it's only used for discovering a potential UPnP/PMP/PCP server, which is very unlikely to be present in the environment of a machine with a ton of routes) Change-Id: I2c4a291ab7f26aedc13885d79237b8f05c2fd8e4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0626cf4183	util/winutil: fix build ... It was broken on Windows: Error: util\winutil\winutil_windows.go:15:7: regBase redeclared in this block Error: D:\a\tailscale\tailscale\util\winutil\winutil_notwindows.go:7:17: previous declaration Error: util\winutil\winutil_windows.go:29:6: getRegString redeclared in this block Error: D:\a\tailscale\tailscale\util\winutil\winutil_notwindows.go:9:40: previous declaration Error: util\winutil\winutil_windows.go:47:6: getRegInteger redeclared in this block Error: D:\a\tailscale\tailscale\util\winutil\winutil_notwindows.go:11:48: previous declaration Error: util\winutil\winutil_windows.go:77:6: isSIDValidPrincipal redeclared in this block Error: D:\a\tailscale\tailscale\util\winutil\winutil_notwindows.go:13:38: previous declaration Change-Id: Ib1ce4b647f5711547840c736b933a6c42bf09583 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Klotz	d7962e3bcf	ipn/ipnserver, util/winutil: update workaround for os/user.LookupId failures on Windows to reject SIDs from deleted/invalid security principals. ... Our current workaround made the user check too lax, thus allowing deleted users. This patch adds a helper function to winutil that checks that the uid's SID represents a valid Windows security principal. Now if `lookupUserFromID` determines that the SID is invalid, we simply propagate the error. Updates https://github.com/tailscale/tailscale/issues/869 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	6eed2811b2	wgengine/netstack: start supporting different SSH users ... Updates #3802 Change-Id: I44de6897e36b1362cd74c9b10c9cbfeb9abc3dbc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	e3dccfd7ff	chirp: handle multiline responses from BIRD ... Also add tests to verify the parsing logic. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	fa612c28cf	cmd/derper: make --stun default to on, flesh out flag docs ... Change-Id: I49e80c61ab19e78e4c8b4bc9012bb70cfe3bfa75 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Bieber	e5cd765e00	net/dns/resolvd: properly handle not having "search" entries ... This prevents adding an empty "search" line when no search domains are set. Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>	3 years ago
Brad Fitzpatrick	bd90781b34	ipn/ipnlocal, wgengine/netstack: use netstack for peerapi server ... We're finding a bunch of host operating systems/firewalls interact poorly with peerapi. We either get ICMP errors from the host or users need to run commands to allow the peerapi port: https://github.com/tailscale/tailscale/issues/3842#issuecomment-1025133727 ... even though the peerapi should be an internal implementation detail. Rather than fight the host OS & firewalls, this change handles the server side of peerapi entirely in netstack (except on iOS), so it never makes its way to the host OS where it might be messed with. Two main downsides are: 1) netstack isn't as fast, but we don't really need speed for peerapi. And actually, with fewer trips to/from the kernel, we might actually make up for some of the netstack performance loss by staying in userspace. 2) tcpdump / Wireshark etc packet captures will no longer see the peerapi traffic. Oh well. Crawshaw's been wanting to add packet capture server support to tailscaled, so we'll probably do that sooner now. A future change might also then use peerapi for the client-side (except on iOS). Updates #3842 (probably fixes, as well as many exit node issues I bet) Change-Id: Ibc25edbb895dc083d1f07bd3cab614134705aa39 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	e45d51b060	logtail: add a few new methods to PublicID ... These are for use in our internal systems. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	730aa1c89c	derp/derphttp, wgengine/magicsock: prefer IPv6 to DERPs when IPv6 works ... Fixes #3838 Change-Id: Ie47a2a30c7e8e431512824798d2355006d72fb6a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	f5ec916214	cmd/derper: disable TLS 1.0 and 1.1. ... Updates tailscale/corp#3568 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	69392411d9	.github/workflows: add some iOS CI coverage ... Updates #3812 Change-Id: Ia779c6a2e9a0fd02418bf5479fdb76d4c80c55a4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	02bdc654d5	cmd/tailscale: fix up --reset, again ... Also fix a somewhat related printing bug in the process where some paths would print "Success." inconsistently even when there otherwise was no output (in the EditPrefs path) Fixes #3830 Updates #3702 (which broke it once while trying to fix it) Change-Id: Ic51e14526ad75be61ba00084670aa6a98221daa5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	70d71ba1e7	cmd/derpprobe: check derper TLS certs too ... Change-Id: If8c48e012b294570ebbb1a46bacdc58fafbfbcc5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	1af26222b6	go.mod: bump netstack, switch to upstream netstack ... Now that Go 1.17 has module graph pruning (https://go.dev/doc/go1.17#go-command), we should be able to use upstream netstack without breaking our private repo's build that then depends on the tailscale.com Go module. This is that experiment. Updates #1518 (the original bug to break out netstack to own module) Updates #2642 (this updates netstack, but doesn't remove workaround) Change-Id: I27a252c74a517053462e5250db09f379de8ac8ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	857cd6c0d7	ipn/ipnstate: add TailnetName to status ... RELNOTE=tailscale status --json | jq .TailnetName Fixes tailscale/corp#3665 Change-Id: I85de027ba2781eb31ee1e0c5ab913b0dfa5b4c86 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Xe Iaso	ae525a7394	scripts/installer: add Centos Stream 9 support (#3818) ... Blocked on package server support being deployed Signed-off-by: Xe <xe@tailscale.com>	3 years ago
David Anderson	7a18fe3dca	wgengine/magicsock: make debugUseDerpRoute an opt.Bool. ... Can still be constant, just needs the extra methods. Fixes #3812 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	c2059d5b8a	words: fallout from mudpuppy-gate. ... Salamanders also have no scales. I checked the interweb, and there doesn't seem to be any subspecies that would let us claim that *some* salamanders are scaley. But they are tailey, for sure. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	ca774c3249	ipn/ipnserver: add TS_PERMIT_CERT_UID envknob to give webservers cert access ... So you can run Caddy etc as a non-root user and let it have access to get certs. Updates caddyserver/caddy#4541 Change-Id: Iecc5922274530e2b00ba107d4b536580f374109b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	508f332bb2	cmd/derper: export TLS vars with derper_ prefix, not stun_ ... Updates tailscale/corp#3568 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
davideger	f31546809f	cmd/tailscale: propagate tailscaled 403s as AccessDeniedErrors ... So Linux/etc CLI users get helpful advice to run tailscale with --operator=$USER when they try to 'tailscale file {cp,get}' but are mysteriously forbidden. Signed-off-by: David Eger <eger@google.com> Signed-off-by: David Eger <david.eger@gmail.com>	3 years ago
Brad Fitzpatrick	f3c0023add	wgengine/netstack: add an SSH server experiment ... Disabled by default. To use, run tailscaled with: TS_SSH_ALLOW_LOGIN=you@bar.com And enable with: $ TAILSCALE_USE_WIP_CODE=true tailscale up --ssh=true Then ssh [any-user]@[your-tailscale-ip] for a root bash shell. (both the "root" and "bash" part are temporary) Updates #3802 Change-Id: I268f8c3c95c8eed5f3231d712a5dc89615a406f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	41fd4eab5c	envknob: add new package for all the strconv.ParseBool(os.Getenv(..)) ... A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6feb8f4c51	net/dns: log why resolved does not look like it's on use [Linux] ... Updates #3742 Updates #3531 Change-Id: I9fc7fa0f4bcab1cf8001ba92408c660a5b25f105 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago