7682 Commits (916c4db75bc47d8c474cc077b33c45a11c48d66a)

 

All Branches   

Search

Author	SHA1	Message	Date
Brad Fitzpatrick	2d2b62c400	wgengine/router: probe generally-unused "ip" command style lazily ... This busybox fwmaskWorks check was added before we moved away from using the "ip" command to using netlink directly. So it's now just wasted work (and log spam on Gokrazy) to check the "ip" command capabilities if we're never going to use it. Do it lazily instead. Updates #12277 Change-Id: I8ab9acf64f9c0d8240ce068cb9ec8c0f6b1ecee7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Brad Fitzpatrick	909a292a8d	util/linuxfw: don't try cleaning iptables on gokrazy ... It just generates log spam. Updates #12277 Change-Id: I5f65c0859e86de0a5349f9d26c9805e7c26b9371 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Walter Poupore	0acb61fbf8	serve.go, tsnet.go: Fix "in in" typo (#12279) ... Fixes #cleanup Signed-off-by: Walter Poupore <walterp@tailscale.com>	6 months ago
Andrea Gottardo	dd77111462	xcode/iOS: set MatchDomains when no route requires a custom DNS resolver (#10576) ... Updates https://github.com/tailscale/corp/issues/15802. On iOS exclusively, this PR adds logic to use a split DNS configuration in more cases, with the goal of improving battery life. Acting as the global DNS resolver on iOS should be avoided, as it leads to frequent wakes of IPNExtension. We try to determine if we can have Tailscale only handle DNS queries for resources inside the tailnet, that is, all routes in the DNS configuration do not require a custom resolver (this is the case for app connectors, for instance). If so, we set all Routes as MatchDomains. This enables a split DNS configuration which will help preserve battery life. Effectively, for the average Tailscale user who only relies on MagicDNS to resolve *.ts.net domains, this means that Tailscale DNS will only be used for those domains. This PR doesn't affect users with Override Local DNS enabled. For these users, there should be no difference and Tailscale will continue acting as a global DNS resolver. Signed-off-by: Andrea Gottardo <andrea@tailscale.com>	6 months ago
Percy Wegmann	08a9551a73	ssh/tailssh: fall back to using su when no TTY available on Linux ... This allows pam authentication to run for ssh sessions, triggering automation like pam_mkhomedir. Updates #11854 Signed-off-by: Percy Wegmann <percy@tailscale.com>	6 months ago
Claire Wang	f1d10c12ac	ipn/ipnlocal: allowed suggested exit nodes policy (#12240) ... Updates tailscale/corp#19681 Signed-off-by: Claire Wang <claire@tailscale.com>	6 months ago
signed-long	5ad0dad15e	go generate directives reorder for 'make kube-generate-all' (#12210) ... Fixes #11980 Signed-off-by: Michael Long <michaelongdev@gmail.com>	6 months ago
Irbe Krumina	d0d33f257f	cmd/k8s-operator: add a note pointing at ProxyClass (#12246) ... Updates tailscale/tailscale#12242 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Andrew Dunham	8e4a29433f	util/pool: add package for storing and using a pool of items ... This can be used to implement a persistent pool (i.e. one that isn't cleared like sync.Pool is) of items–e.g. database connections. Some benchmarks vs. a naive implementation that uses a single map iteration show a pretty meaningful improvement: $ benchstat -col /impl ./bench.txt goos: darwin goarch: arm64 pkg: tailscale.com/util/pool │ Pool │ map │ │ sec/op │ sec/op vs base │ Pool_AddDelete-10 10.56n ± 2% 15.11n ± 1% +42.97% (p=0.000 n=10) Pool_TakeRandom-10 56.75n ± 4% 1899.50n ± 20% +3246.84% (p=0.000 n=10) geomean 24.49n 169.4n +591.74% Updates tailscale/corp#19900 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie509cb65573c4726cfc3da9a97093e61c216ca18	6 months ago
James Tucker	87ee559b6f	net/netcheck: apply some polish suggested from #12161 ... Apply some post-submit code review suggestions. Updates #12161 Updates tailscale/corp#19106 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
Maisem Ali	9a64c06a20	all: do not depend on the testing package ... Discovered while looking for something else. Updates tailscale/corp#18935 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Jordan Whited	4214e5f71b	logtail/backoff: update Backoff.BackOff docs (#12229) ... Update #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
James Tucker	538c2e8f7c	tool/gocross: add debug data to CGO builds ... We don't build a lot of tools with CGO, but we do build some, and it's extremely valuable for production services in particular to have symbols included - for perf and so on. I tested various other builds that could be affected negatively, in particular macOS/iOS, but those use split-dwarf already as part of their build path, and Android which does not currently use gocross. One binary which is normally 120mb only grew to 123mb, so the trade-off is definitely worthwhile in context. Updates tailscale/corp#20296 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
Brad Fitzpatrick	3c9be07214	cmd/derper: support TXT-mediated unpublished bootstrap DNS rollouts ... Updates tailscale/coral#127 Change-Id: I2712c50630d0d1272c30305fa5a1899a19ffacef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Irbe Krumina	72f0f53ed0	cmd/k8s-operator: fix typo (#12217) ... Fixes#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
James Tucker	9351eec3e1	net/netcheck: remove hairpin probes ... Palo Alto reported interpreting hairpin probes as LAND attacks, and the firewalls may be responding to this by shutting down otherwise in use NAT sessions prematurely. We don't currently make use of the outcome of the hairpin probes, and they contribute to other user confusion with e.g. the AirPort Extreme hairpin session workaround. We decided in response to remove the whole probe feature as a result. Updates #188 Updates tailscale/corp#19106 Updates tailscale/corp#19116 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
Andrew Lytvynov	c9179bc261	various: disable stateful filtering by default (#12197) ... After some analysis, stateful filtering is only necessary in tailnets that use `autogroup:danger-all` in `src` in ACLs. And in those cases users explicitly specify that hosts outside of the tailnet should be able to reach their nodes. To fix local DNS breakage in containers, we disable stateful filtering by default. Updates #12108 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	6 months ago
License Updater	6db1219185	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	6 months ago
Charlotte Brandhorst-Satzkorn	4f4f317174	api.md: direct TOC links to new publicapi docs location ... This change updates the existing api.md TOC links to point at the new publicapi folder/files. It also removes the body of the docs from the file, to avoid the docs becoming out of sync. This change also renames overview.md to readme.md. Updates tailscale/corp#19526 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	6 months ago
Brad Fitzpatrick	964282d34f	ipn,wgengine: remove vestigial Prefs.AllowSingleHosts ... It was requested by the first customer 4-5 years ago and only used for a brief moment of time. We later added netmap visibility trimming which removes the need for this. It's been hidden by the CLI for quite some time and never documented anywhere else. This keeps the CLI flag, though, out of caution. It just returns an error if it's set to anything but true (its default). Fixes #12058 Change-Id: I7514ba572e7b82519b04ed603ff9f3bdbaecfda7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Brad Fitzpatrick	1384c24e41	control/controlclient: delete unused Client.Login Oauth2Token field ... Updates #12172 (then need to update other repos) Change-Id: I439f65e0119b09e00da2ef5c7a4f002f93558578 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Andrew Dunham	47b3476eb7	util/lru: add Clear method ... Updates tailscale/corp#20109 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I751a669251a70f0134dd1540c19b274a97608a93	6 months ago
Charlotte Brandhorst-Satzkorn	c56e0c4934	publicapi: include device and user invites API documentation (#12168) ... This change includes the device and user invites API docs in the new publicapi documentation structure. Updates tailscale/corp#19526 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	6 months ago
Jordan Whited	adb7a86559	cmd/stunc: support ipv6 address targets (#12166) ... Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
James Tucker	8d1249550a	net/netcheck,wgengine/magicsock: add potential workaround for Palo Alto DIPP misbehavior ... Palo Alto firewalls have a typically hard NAT, but also have a mode called Persistent DIPP that is supposed to provide consistent port mapping suitable for STUN resolution of public ports. Persistent DIPP works initially on most Palo Alto firewalls, but some models/software versions have a bug which this works around. The bug symptom presents as follows: - STUN sessions resolve a consistent public IP:port to start with - Much later netchecks report the same IP:Port for a subset of sessions, most often the users active DERP, and/or the port related to sustained traffic. - The broader set of DERPs in a full netcheck will now consistently observe a new IP:Port. - After this point of observation, new inbound connections will only succeed to the new IP:Port observed, and existing/old sessions will only work to the old binding. In this patch we now advertise the lowest latency global endpoint discovered as we always have, but in addition any global endpoints that are observed more than once in a single netcheck report. This should provide viable endpoints for potential connection establishment across a NAT with this behavior. Updates tailscale/corp#19106 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
Charlotte Brandhorst-Satzkorn	6831a29f8b	publicapi: create new home for API docs and split into catagory files (#12116) ... This change creates a new folder called publicapi that will become the future home to the Tailscale public API docs. This change also splits the existing API docs (still located in api.md) into separate files, for easier reading and contribution. Updates tailscale/corp#19526 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	6 months ago
Andrea Gottardo	e5f67f90a2	xcode: allow ICMP ping relay on macOS + iOS platforms (#12048) ... Fixes tailscale/tailscale#10393 Fixes tailscale/corp#15412 Fixes tailscale/corp#19808 On Apple platforms, exit nodes and subnet routers have been unable to relay pings from Tailscale devices to non-Tailscale devices due to sandbox restrictions imposed on our network extensions by Apple. The sandbox prevented the code in netstack.go from spawning the `ping` process which we were using. Replace that exec call with logic to send an ICMP echo request directly, which appears to work in userspace, and not trigger a sandbox violation in the syslog. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	6 months ago
Percy Wegmann	59848fe14b	drive: rewrite LOCK paths ... Fixes #12097 Signed-off-by: Percy Wegmann <percy@tailscale.com>	6 months ago
James Tucker	87f00d76c4	tool/gocross: treat empty GOOS/GOARCH as native GOOS/GOARCH ... Tracking down the side effect can otherwise be a pain, for example on Darwin an empty GOOS resulted in CGO being implicitly disabled. The user intended for `export GOOS=` to act like unset, and while this is a misunderstanding, the main toolchain would treat it this way. Fixes tailscale/corp#20059 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
Irbe Krumina	76c30e014d	cmd/containerboot: warn when an ingress proxy with an IPv4 tailnet address is being created for an IPv6 backend(s) (#12159) ... Updates tailscale/tailscale#12156 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Maisem Ali	8feb4ff5d2	version: add GitCommitTime to Meta ... Updates tailscale/corp#1297 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Maisem Ali	359ef61263	Revert "version: add Info func to expose EmbeddedInfo" ... This reverts commit e3dec086e6. Going to reuse Meta instead as that is already exported. Updates tailscale/corp#1297 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Sonia Appasamy	89947606b2	api.md: document device invite apis ... Updates tailscale/corp#18153 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	6 months ago
Sonia Appasamy	b094e8c925	api.md: document user invite apis ... Updates tailscale/corp#18153 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	6 months ago
Maisem Ali	e3dec086e6	version: add Info func to expose EmbeddedInfo ... To be used to in a different repo. Updates tailscale/corp#1297 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Kevin Liang	7f83f9fc83	Net/DNS/Publicdns: update the IPv6 range that we use to recreate route endpoint for control D ... In this commit I updated the Ipv6 range we use to generate Control D DOH ip, we were using the NextDNSRanges to generate Control D DOH ip, updated to use the correct range. Updates: #7946 Signed-off-by: Kevin Liang <kevinliang@tailscale.com>	6 months ago
Brad Fitzpatrick	6877d44965	prober: plumb a now-required netmon to derphttp ... Updates #11896 Change-Id: Ie2f9cd024d85b51087d297aa36c14a9b8a2b8129 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Maisem Ali	1f51bb6891	net/tstun: do SNAT after filterPacketOutboundToWireGuard ... In a configuration where the local node (ip1) has a different IP (ip2) that it uses to communicate with a peer (ip3) we would do UDP flow tracking on the `ip2->ip3` tuple. When we receive the response from the peer `ip3->ip2` we would dnat it back to `ip3->ip1` which would then not match the flow track state and the packet would get dropped. To fix this, we should do flow tracking on the `ip1->ip3` tuple instead of `ip2->ip3` which requires doing SNAT after the running filterPacketOutboundToWireGuard. Updates tailscale/corp#19971, tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Andrea Gottardo	60266be298	version: fix macOS uploads by increasing build number prefix (#12134) ... Fixes tailscale/corp#19979 A build with version number 275 was uploaded to the App Store without bumping OSS first. The presence of that build is causing any 274.* build to be rejected. To address this, added -1 to the year component, which means new builds will use the 275.* prefix. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	6 months ago
Andrew Dunham	c6d42b1093	derp: remove stats goroutine, use a timer ... Without changing behaviour, don't create a goroutine per connection that sits and sleeps, but rather use a timer that wakes up and gathers statistics on a regular basis. Fixes #12127 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ibc486447e403070bdc3c2cd8ae340e7d02854f21	6 months ago
Irbe Krumina	7ef2f72135	util/linuxfw: fix IPv6 availability check for nftables (#12009) ... * util/linuxfw: fix IPv6 NAT availability check for nftables When running firewall in nftables mode, there is no need for a separate NAT availability check (unlike with iptables, there are no hosts that support nftables, but not IPv6 NAT - see tailscale/tailscale#11353). This change fixes a firewall NAT availability check that was using the no-longer set ipv6NATAvailable field by removing the field and using a method that, for nftables, just checks that IPv6 is available. Updates tailscale/tailscale#12008 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Brad Fitzpatrick	8aa5c3534d	ipn/ipnlocal: simplify authURL vs authURLSticky, remove interact field ... The previous LocalBackend & CLI 'up' changes improved some stuff, but might've been too aggressive in some edge cases. This simplifies the authURL vs authURLSticky distinction and removes the interact field, which seemed to just just be about duplicate URL suppression in IPN bus, back from when the IPN bus was a single client at a time. This moves that suppression to a different spot. Fixes #12119 Updates #12028 Updates #12042 Change-Id: I1f8800b1e82ccc1c8a0d7abba559e7404ddf41e4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Parker Higgins	7b3e30f391	words: add some fruit with scales (#8460) ... Signed-off-by: Parker Higgins <parker@tailscale.com>	6 months ago
Maisem Ali	79b2d425cf	types/views: move AsMap to Map from *Map ... This was a typo in 2e19790f61. It should have been on `Map` and not on `*Map` as otherwise it doesn't allow for chaining like `someView.SomeMap().AsMap()` and requires first assigning it to a variable. Updates #typo Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Charlotte Brandhorst-Satzkorn	fc1ae97e10	words: I had a feline we were missing some words (#12098) ... pspspsps Updates #tailscale/corp#14698 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	6 months ago
Maisem Ali	486a423716	tsnet: split user facing and backend logging ... This adds a new `UserLogf` field to the `Server` struct. When set this any logs generated by Server are logged using `UserLogf` and all spammy backend logs are logged to `Logf`. If it `UserLogf` is unset, we default to `log.Printf` and if `Logf` is unset we discard all the spammy logs. Fixes #12094 Signed-off-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Percy Wegmann	7209c4f91e	drive: parse depth 1 PROPFIND results to include children in cache ... Clients often perform a PROPFIND for the parent directory before performing PROPFIND for specific children within that directory. The PROPFIND for the parent directory is usually done at depth 1, meaning that we already have information for all of the children. By immediately adding that to the cache, we save a roundtrip to the remote peer on the PROPFIND for the specific child. Updates tailscale/corp#19779 Signed-off-by: Percy Wegmann <percy@tailscale.com>	6 months ago
Irbe Krumina	d86d1e7601	cmd/k8s-operator,cmd/containerboot,ipn,k8s-operator: turn off stateful filter for egress proxies. (#12075) ... Turn off stateful filtering for egress proxies to allow cluster traffic to be forwarded to tailnet. Allow configuring stateful filter via tailscaled config file. Deprecate EXPERIMENTAL_TS_CONFIGFILE_PATH env var and introduce a new TS_EXPERIMENTAL_VERSIONED_CONFIG env var that can be used to provide containerboot a directory that should contain one or more tailscaled config files named cap-<tailscaled-cap-version>.hujson. Containerboot will pick the one with the newest capability version that is not newer than its current capability version. Proxies with this change will not work with older Tailscale Kubernetes operator versions - users must ensure that the deployed operator is at the same version or newer (up to 4 version skew) than the proxies. Updates tailscale/tailscale#12061 Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Maisem Ali <maisem@tailscale.com>	6 months ago
Claire Wang	e070af7414	ipnlocal, magicsock: add more description to storing last suggested exit (#11998) ... node related functions Updates tailscale/corp#19681 Signed-off-by: Claire Wang <claire@tailscale.com>	6 months ago
Andrew Dunham	5708fc0639	wgengine/router: print Docker warning when stateful filtering is enabled ... When Docker is detected on the host and stateful filtering is enabled, Docker containers may be unable to reach Tailscale nodes (depending on the network settings of a container). Detect Docker when stateful filtering is enabled and print a health warning to aid users in noticing this issue. We avoid printing the warning if the current node isn't advertising any subnet routes and isn't an exit node, since without one of those being true, the node wouldn't have the correct AllowedIPs in WireGuard to allow a Docker container to connect to another Tailscale node anyway. Updates #12070 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Idef538695f4d101b0ef6f3fb398c0eaafc3ae281	6 months ago