4144 Commits (88133c361e8cc267b9e45c90f357f96084c60a0c)

 

All Branches   

Search

Author	SHA1	Message	Date
Maisem Ali	88133c361e	Docker: add ALPINE.txt to manage alpine versions ... The goal here is to 1. make it so that the number doesn't diverge between the various places we had it defined 2. not define the number in corp, only in oss Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	cfa484e1a2	Dockerfile: bump alpine to 3.16 ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	ef351ac0dd	Dockerfile: fix build ... The Dockerfile directions said: But that failed with: Step 14/15 : FROM ghcr.io/tailscale/alpine-base:3.14 Head "https://ghcr.io/v2/tailscale/alpine-base/manifests/3.14": denied: denied So I guess the Dockerfile.base part was undocumented. But it only had one line anyway, so move it here to avoid the intermediate layer's published permissions problem entirely. Also optimize the cachability a bit while here. Change-Id: I846ad59fe7e88e6126925689fae78bfb80c279f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	06aa141632	wgengine/router: avoid unncessary routing configuration changes ... The iOS and macOS networking extension API only exposes a single setter for the entire routing and DNS configuration, and does not appear to do any kind of diffing or deltas when applying changes. This results in spurious "network changed" errors in Chrome, even when the `OneCGNATRoute` flag from df9ce972c7 is used (because we're setting the same configuration repeatedly). Since we already keep track of the current routing and DNS configuration in CallbackRouter, use that to detect if they're actually changing, and only invoke the platform setter if it's actually necessary. Updates #3102 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	3b1f99ded1	ssh/tailssh: fix Tailscale SSH to Linux Arch machines ... See https://github.com/tailscale/tailscale/issues/4924#issuecomment-1168201823 Arch uses a different login binary that makes the -h flag set the PAM service to "remote". So if they don't have that configured, don't pass -h. Thanks to @eddiezane for debugging! Updates #4924 Change-Id: I8d33e0afb2dfb99517bcea2f9d5d0c6247519b3c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
kylecarbs	9280d39678	wgengine/netstack: close ipstack when netstack.Impl is closed ... Fixes netstack.Impl leaking goroutines after shutdown. Signed-off-by: kylecarbs <kyle@carberry.com>	2 years ago
Denton Gentry	d7f452c0a1	net/portmapper: send discovery packet for IGD specifically. ... There appear to be devices out there which send only their first descriptor in response to a discovery packet for `ssdp:all`, for example the Sagemcom FAST3890V3 only sends urn:schemas-wifialliance-org:device:WFADevice:1 Send both ssdp:all and a discovery frame for InternetGatewayDevice specifically. Updates https://github.com/tailscale/tailscale/issues/3557 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Denton Gentry	09eaba91ad	net/portmap: add a test for Sagemcom FAST3890V3. ... Updates https://github.com/tailscale/tailscale/issues/3557 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Denton Gentry	b5553c6ad2	net/portmap: run go fmt ... Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Denton Gentry	de4c635e54	net/portmapper: make pcpCodeNotAuthorized log more descriptive ... If PCP is present but disabled, turning it on might help get direct connections. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Brad Fitzpatrick	3ac8ab1791	tsnet: add Server.AuthKey field ... ... so callers can provide the AuthKey via mechanisms other than environment variables which means multiple Servers can't be started concurrently in the same process without coordination. Change-Id: I7736ef4f59b7cc29637939e140e990613ce58e0d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Jordan Whited	bef6e2831a	cmd/tailscale: move call to cli.CleanUpArgs() from main() into cli.Run() (#4954) ... Not all distributions build from package main. Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
Maisem Ali	40503ef07a	ssh/tailssh: fix logging typo ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
soypete	412c4c55e2	cmd/tailscale: make up respect explicitly empty --operator= value ... Fixes #3808 Signed-off-by: soypete <miriah@tailscale.com>	2 years ago
Maisem Ali	c434e47f2d	ssh/tailssh: always use current time for policy evaluation ... Whenever the SSH policy changes we revaluate all open connections to make sure they still have access. This check was using the wrong timestamp and would match against expired policies, however this really isn't a problem today as we don't have policy that would be impacted by this check. Fixing it for future use. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	a7d2024e35	ssh/tailssh: allow multiple sessions on the same conn ... Fixes #4920 Fixes tailscale/corp#5633 Updates #4479 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
mattn	1d04e01d1e	use C:\Windows\System32\OpenSSH\ssh.exe (#4933) ... cmd/tailscale: make ssh command prefer Windows ssh.exe over PATH Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>	2 years ago
Adam Eijdenberg	9294a14a37	ssh/tailssh: limit setgroups to 16 on macOS ... Fixes #4938 Signed-off-by: Adam Eijdenberg <adam@continusec.com>	2 years ago
Adam Eijdenberg	7f807fef6c	ssh/tailssh: fix /usr/bin/login args on macOS ... Fixes #4931 Signed-off-by: Adam Eijdenberg <adam@continusec.com>	2 years ago
Brad Fitzpatrick	35782f891d	util/deephash: add canMemHash func + typeInfo property ... Currently unused. (breaking up a bigger change) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7b9a901489	util/deephash: add packet filter benchmark ... (breaking up parts of another change) This adds a PacketFilter hashing benchmark with an input that both contains every possible field, but also is somewhat representative in the shape of what real packet filters contain. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
James Tucker	c88bd53b1b	.github/workflows: windows-race: print gcc version ... Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Maisem Ali	2d65c1a950	client/tailscale: update ACLRow and ACLTest with new ACL fields ... Signed-off-by: Maisem Ali <maisem@tailscale.com> Co-authored-by: Will Norris <will@tailscale.com>	2 years ago
Aaron Klotz	4baf34cf25	net/dns: set appropriate Windows registry values to prevent it from sending DNS changes concerning our interface to AD domain controllers. ... We do this unconditionally inside SetDNS such that the values are always set before we make any other changes to DNS configurations. It should not be harmful for the settings to remain even when other DNS settings are cleared out (since they only affect our network interface). See https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-dns-dynamic-updates-windows-server-2003 for details about the registry value. Fixes https://github.com/tailscale/tailscale/issues/4829 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Aaron Klotz	8cdfd12977	net/dns: update Windows split DNS settings to work alongside other NRPT entries set by group policy. ... When there are group policy entries for the NRPT that do not belong to Tailscale, we recognize that we need to add ourselves to group policy and use that registry key instead of the local one. We also refresh the group policy settings as necessary to ensure that our changes take effect immediately. Fixes https://github.com/tailscale/tailscale/issues/4607 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
James Tucker	76256d22d8	wgengine/router: windows: set SkipAsSource on IPv6 LL addresses ... Link-local addresses on the Tailscale interface are not routable. Ideally they would be removed, however, a concern exists that the operating system will attempt to re-add them which would lead to thrashing. Setting SkipAsSource attempts to avoid production of packets using the address as a source in any default behaviors. Before, in powershell: `ping (hostname)` would ping the link-local address of the Tailscale interface, and fail. After: `ping (hostname)` now pings the link-local address on the next highest priority metric local interface. Fixes #4647 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Brad Fitzpatrick	8c5c87be26	util/deephash: fix collisions between different types ... Updates #4883 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	4f6fa3d63a	shell.nix: use 1.18 from system nixpkgs ... (Now that 22.05 / 22.11 are released and presumably everyone has updated). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Xe Iaso	dee95d0894	cmd/gitops-pusher: add new GitOps assistant (#4893) ... This is for an upcoming blogpost on how to manage Tailscale ACLs using a GitOps flow. This tool is intended to be used in CI and will allow users to have a git repository be the ultimate source of truth for their ACL file. This enables ACL changes to be proposed, approved and discussed before they are applied. Signed-off-by: Xe <xe@tailscale.com>	2 years ago
Sofiane Hamlaoui	1007983159	Adding pkg for Freebsd installation ... Signed-off-by: Sofiane Hamlaoui <s0fianehaml40u1@gmail.com>	2 years ago
Sofiane Hamlaoui	51cc0e503b	adding --noconfirm to pacman installation ... Signed-off-by: Sofiane Hamlaoui <s0fianehaml40u1@gmail.com>	2 years ago
Brad Fitzpatrick	87a4c75fd4	control/controlclient, ipn/ipnlocal: remove Client.SetExpirySooner, fix race ... Client.SetExpirySooner isn't part of the state machine. Remove it from the Client interface. And fix a use of LocalBackend.cc without acquiring the lock that guards that field. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ef0d740270	control/controlclient: remove Client.SetStatusFunc ... It can't change at runtime. Make it an option. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	70a2797064	control/controlclient, ipn/ipnlocal: remove some Client methods ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a1e429f7c3	control/controlclient, types/netmap: remove unused LocalPort field ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	526b0b6890	control/controlclient: start simplifying netmap fetch APIs ... Step 1 of many, cleaning up the direct/auto client & restarting map requests that leads to all the unnecessary map requests. Updates tailscale/corp#5761 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	467eb2eca0	cmd/tailscale/cli, ipn/ipnlocal: give SSH tips when off/unconfigured ... Updates #3802 Change-Id: I6b9a3175f68a6daa670f912561f2c2ececc07770 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	99ed54926b	tailcfg: define some Node.Capabilities about SSH, its config ... Updates #3802 Change-Id: Icb4ccbc6bd1c6304013bfc553d04007844a5c0bf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	13d0b8e6a4	control/controlclient, net/dnscache: use typed singleflight fork ... Change-Id: I12be4c5a91ae3a812fe88d9b2d15526fdbb5a921 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	59ed846277	util/singleflight: add fork of singleflight with generics ... Forked from golang.org/x/sync/singleflight at the x/sync repo's commit 67f06af15bc961c363a7260195bcd53487529a21 Updates golang/go#53427 Change-Id: Iec2b47b7777940017bb9b3db9bd7d93ba4a2e394 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	757ecf7e80	util/deephash: fix map hashing when key & element have the same type ... Regression from 09afb8e35b, in which the same reflect.Value scratch value was being used as the map iterator copy destination. Also: make nil and empty maps hash differently, add test. Fixes #4871 Co-authored-by: Josh Bleecher Snyder <josharian@gmail.com> Change-Id: I67f42524bc81f694c1b7259d6682200125ea4a66 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	22c544bca7	go.mod: bump go4.org/unsafe/assume-no-moving-gc for Go 1.19beta1 ... Otherwise we crash at startup with Go 1.19beta1. Updates #4872 Change-Id: I371df4146735f7e066efd2edd48c1a305906c13d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f31588786f	util/deephash: don't track cycles on non-recursive types ... name old time/op new time/op delta Hash-8 67.3µs ±20% 76.5µs ±16% ~ (p=0.143 n=10+10) HashMapAcyclic-8 63.0µs ± 2% 56.3µs ± 1% -10.65% (p=0.000 n=10+8) TailcfgNode-8 9.18µs ± 2% 6.52µs ± 3% -28.96% (p=0.000 n=9+10) HashArray-8 732ns ± 3% 709ns ± 1% -3.21% (p=0.000 n=10+10) name old alloc/op new alloc/op delta Hash-8 24.0B ± 0% 24.0B ± 0% ~ (all equal) HashMapAcyclic-8 0.00B 0.00B ~ (all equal) TailcfgNode-8 0.00B 0.00B ~ (all equal) HashArray-8 0.00B 0.00B ~ (all equal) name old allocs/op new allocs/op delta Hash-8 1.00 ± 0% 1.00 ± 0% ~ (all equal) HashMapAcyclic-8 0.00 0.00 ~ (all equal) TailcfgNode-8 0.00 0.00 ~ (all equal) HashArray-8 0.00 0.00 ~ (all equal) Change-Id: I28642050d837dff66b2db54b2b0e6d272a930be8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	36ea837736	util/deephash: fix map hashing to actually hash elements ... Fixes #4868 Change-Id: I574fd139cb7f7033dd93527344e6aa0e625477c7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	4005134263	tailcfg: clarify some of the MapRequest variants ... Change-Id: Ia09bd69856e372c3a6b64cda7ddb34029b32a11b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	0f05b2c13f	tsnet: use tailscaled as prefix for state file names (#4816) ... Use the "tailscaled" prefix instead of "tsnet" for state file names: 1. It is consistent with the pre-existing {{Dir}}/tailscaled.state file. 2. It makes the file layout of `tsnet` and `tailscaled` identical, so that they are compatible with each other. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Denton Gentry	1392a93445	socks5: add a simple test ... Start up a backend service, put a SOCKS5 server in front of it, and verify that we can get data from the backend via SOCKS5. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Denton Gentry	7fffddce8e	net/portmapper: enable for iOS ... In the 1.27 unstable releases we set the min-version to iOS15, which means we have 50 MBytes of RAM in the Network Extension. https://tailscale.com/blog/go-linker/ Include the UPnP/NAT-PMP/PCP portmapper support now that there is memory for it. Fixes https://github.com/tailscale/tailscale/issues/2495 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Mihai Parparita	2990c2b1cf	control/controlhttp: use secure WebSockets protocol by default ... Forcing the insecure protocol (and perserving the port number) is only desired for localhost testing, in prod we need to use wss:// to avoid mixed-content errors. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Tom DNetto	32c6823cf5	tsweb: implement interceptor for error page presentation ... Updates https://github.com/tailscale/corp/issues/5605 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago