tailscale

Commit Graph

Author	SHA1	Message	Date
David Anderson	1c56643136	disco: amplify comment that disco ping's NodeKey shouldn't be trusted by itself. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Robert	cb030a0bb4	docs/k8s: add example about setting up a subnet router Signed-off-by: Robert <rspier@pobox.com> Co-authored-by: Maisem Ali <3953239+maisem@users.noreply.github.com>	3 years ago
Maisem Ali	53199738fb	wgengine: don't try to delete legacy netfilter rules on synology. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Anderson	2aa5df7ac1	wgengine/magicsock: document and enforce that peerInfo.ep is non-nil. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	521b44e653	wgengine/magicsock: move discoKey fields to the mutex-protected section. Fixes #3106 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maisem Ali	27799a1a96	wgengine: only use AmbientCaps on DSM7+ Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	a6d02dc122	wgengine/magicsock: track which NodeKey each DiscoKey was last for This adds new fields (currently unused) to discoInfo to track what the last verified (unambiguous) NodeKey a DiscoKey last mapped to, and when. Then on CallMeMaybe, Pong and on most Pings, we update the mapping from DiscoKey to the current NodeKey for that DiscoKey. Updates #3088 Change-Id: Idc4261972084dec71cf8ec7f9861fb9178eb0a4d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c759fcc7d3	wgengine/magicsock: fix data race with sync.Pool in error+logging path Fixes #3122 Change-Id: Ib52e84f9bd5813d6cf2e80ce5b2296912a48e064 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	75a7779b42	disco, wgengine/magicsock: send self node key in disco pings This lets clients quickly (sub-millisecond within a local LAN) map from an ambiguous disco key to a node key without waiting for a CallMeMaybe (over relatively high latency DERP). Updates #3088 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Joe Tsai	9af27ba829	cmd/cloner: mangle "go:generate" in cloner.go The "go generate" command blindly looks for "//go:generate" anywhere in the file regardless of whether it is truly a comment. Prevent this false positive in cloner.go by mangling the string to look less like "//go:generate". Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Denton Gentry	def650b3e8	wgengine/magicsock: don't Rebind after STUN error if closed. https://github.com/tailscale/tailscale/pull/3014 added a rebind on STUN failure, which means there can now be a tailscale.com/wgengine/magicsock.(*RebindingUDPConn).ReadFromNetaddr in progress at the end of the test waiting for a STUN response which will never arrive. This causes a test flake due to the resource leak in those cases where the Conn decided to rebind. For whatever reason, it mostly flakes with Windows. If the Conn is closed, don't Rebind after a send error. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	f55c2bccf5	wgengine/magicsock: don't call setAddrToDiscoLocked on DERP ping Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	569f70abfd	wgengine/magicsock: finish some renamings of discoEndpoint to endpoint Renames only; continuation of earlier `8049063d35` These kept confusing me while working on #3088 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	695df497ba	wgengine/magicsock: delete peerMap.endpointForDiscoKey, remove remaining caller The one remaining caller of peerMap.endpointForDiscoKey was making the improper assumption that there's exactly 1 node with a given DiscoKey in the network. That was the cause of #3088. Now that all the other callers have been updated to not use endpointForDiscoKey, there's no need to try to keep maintaining that prone-to-misuse index. Updates #3088 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	04fd94acd6	wgengine/magicsock: remove endpointForDiscoKey call from handleDiscoMessage A DiscoKey maps 1:n to endpoints. When we get a disco pong, we don't necessarily know which endpoint sent it to us. Ask them all. There will only usually be 1 (and in rare circumstances 2). So it's easier to ask all two rather than building new maps from the random ping TxID to its endpoint. Updates #3088 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	151b4415ca	wgengine/magicsock: remove endpoint parameter from handlePingLocked We can reply to a ping without knowing which exact node it's from. As long as it's in our netmap, it's safe to reply. If there's more than one node with that discokey, it doesn't matter who we're relpying to. Updates #3088 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d86081f353	wgengine/magicsock: add new discoInfo type for DiscoKey state, move some fields As more prep for removing the false assumption that you're able to map from DiscoKey to a single peer, move the lastPingFrom and lastPingTime fields from the endpoint type to a new discoInfo type, effectively upgrading the old sharedDiscoKey map (which only held a *[32]byte nacl precomputed key as its value) to discoInfo which then includes that naclbox key. Then start plumbing it into handlePing in prep for removing the need for handlePing to take an endpoint parameter. Updates #3088 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e5779f019e	wgengine/magicsock: move temporary endpoint lookup later, add TODO to remove Updates #3088 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	36a07089ee	wgengine/magicsock: remove redundant/wrong sharedDiscoKey delete The pass just after in this method handles cleaning up sharedDiscoKey. No need to do it wrong (assuming DiscoKey => 1 node) earlier. Updates #3088 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3e80806804	wgengine/magicsock: pass src NodeKey to handleDiscoMessage for DERP disco msgs And then use it to avoid another lookup-by-DiscoKey. Updates #3088	3 years ago
Brad Fitzpatrick	82fa15fa3b	wgengine/magicsock: start removing endpointForDiscoKey It's not valid to assume that a discokey is globally unique. This removes the first two of the four callers. Updates #3088 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	7817ab6b20	net/dns/resolver: set maxDoHInFlight to 1000 on iOS 15+. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	2662a1c98c	hostinfo: add EnvType for Kubernetes Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Felipe Cruz Martinez	47ace13ac8	Fix k8s README Use the correct KUBE_SECRET value	3 years ago
Maisem Ali	c6d3f622e9	ipn/ipnlocal: use netaddr.IPSetBuilder when constructing list of interface IPPrefixes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	e538d47bd5	docs/k8s: update run.sh to use the correct socket path Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	4a3e2842d9	net/interfaces: add List, GetList And start moving funcs to methods on List. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	14f9c75293	wgengine/router: ignore Linux ip route error adding dup route Updates #3060 Updates #391 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ddf3394b40	ipn/ipnlocal: don't try to block localhost traffic when using exit nodes Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	77696579f5	net/dns/resolver: drop dropping log Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	7742caef0a	.github/workflows: always ignore go:generate dnsfallback check Keep the now-redundant github.ref branch check for the future, in case we want to change the policy for main vs release-branch again later. Save somebody the YAML debugging time.	3 years ago
Joe Tsai	2fa004a2a0	cmd/cloner: emit go:generate pragmas (#3082 ) Emit a go:generate pragma with the full set of flags passed to cloner. This allows the user to simply run "go generate" at the location of the generate file to reproduce the file. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Brad Fitzpatrick	676fb458c3	net/dns/resolver: make hasRDNSBonjourPrefix match shorter queries too Fixes tailscale/corp#2886 Updates tailscale/corp#2820 Updates #2442 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	a6c3de72d6	docs/k8s: use ghcr.io for base image Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	751c42c097	ipn: fix formatting of ExitNodeIP in MaskedPrefs %#v on a netaddr.IP showed the netaddr.IP innards. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	9ab8492694	docker: install ip6tables Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	45d4adcb63	docs/k8s: use tailscale/tailscale as base image Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	061dab5d61	docker: only add tailscale and tailscaled binaries Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	2c403cbb31	docs/k8s: add instructions on how to run as a sidecar or a proxy. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
nicksherron	f01ff18b6f	all: fix spelling mistakes Signed-off-by: nicksherron <nsherron90@gmail.com>	3 years ago
Maya Kaczorowski	9795fca946	.github: change issue checkboxes to dropdown	3 years ago
Maya Kaczorowski	7dbb1b51fe	.github: change issue checkboxes to dropdown Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com>	3 years ago
Maisem Ali	c121fa81c4	tsnet: add TLS and LetsEncrypt example. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Aaron Klotz	1991a1ac6a	net/tstun: update tun_windows for wintun 0.14 API revisions, update wireguard-go dependency to 82d2aa87aa623cb5143a41c3345da4fb875ad85d Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Maxime VISONNEAU	4528f448d6	ipn/store/aws, cmd/tailscaled: add AWS SSM ipn.StateStore implementation From https://github.com/tailscale/tailscale/pull/1919 with edits by bradfitz@. This change introduces a new storage provider for the state file. It allows users to leverage AWS SSM parameter store natively within tailscaled, like: $ tailscaled --state=arn:aws:ssm:eu-west-1:123456789:parameter/foo Known limitations: - it is not currently possible to specific a custom KMS key ID RELNOTE=tailscaled on Linux supports using AWS SSM for state Edits-By: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maxime VISONNEAU <maxime.visonneau@gmail.com>	3 years ago
Maya Kaczorowski	1b20d1ce54	Dockerfile, build_docker: change Docker warning	3 years ago
apenwarr	5b06c50669	Bug report template: remove empty 'title' field. Mysteriously, GitHub can't parse it if it's an empty string rather than just missing. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Maya Kaczorowski	525f15bf81	Dockerfile, build_docker: change Docker warning Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com>	3 years ago
Avery Pennarun	9c3ae750da	Bug template: remove "[Bug]: " prefix for the common case. Also shorten "[FR]:" to "FR:" to save precious subject line space. I don't mind a prefix to distinguish feature requests, but the majority of cases are bugs. Let's preserve as many chars as possible for the specific topic when looking at subject lines in gmail. (Now, if only it wouldn't include [tailscale/tailscale] on every message...) Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Smitty	b382161fe5	tsdns: don't forward transient DNS errors When a DNS server claims to be unable or unwilling to handle a request, instead of passing that refusal along to the client, just treat it as any other error trying to connect to the DNS server. This prevents DNS requests from failing based on if a server can respond with a transient error before another server is able to give an actual response. DNS requests only failing sometimes is really hard to find the cause of (#1033). Signed-off-by: Smitty <me@smitop.com>	3 years ago

... 2 3 4 5 6 ...

3333 Commits (89a68a4c22ffe717f82cc40de6c16900a4121511) All Branches Search

3333 Commits (89a68a4c22ffe717f82cc40de6c16900a4121511)

All Branches