tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	343c0f1031	wgengine{,/netstack}: remove AddNetworkMapCallback from Engine interface It had exactly one user: netstack. Just have LocalBackend notify netstack when here's a new netmap instead, simplifying the bloated Engine interface that has grown a bunch of non-Engine-y things. (plenty of rando stuff remains after this, but it's a start) Updates #cleanup Change-Id: I45e10ab48119e962fc4967a95167656e35b141d8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	4e91cf20a8	control/controlknobs, all: add plumbed Knobs type, not global variables Previously two tsnet nodes in the same process couldn't have disjoint sets of controlknob settings from control as both would overwrite each other's global variables. This plumbs a new controlknobs.Knobs type around everywhere and hangs the knobs sent by control on that instead. Updates #9351 Change-Id: I75338646d36813ed971b4ffad6f9a8b41ec91560 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	9a86aa5732	all: depend on zstd unconditionally, remove plumbing to make it optional All platforms use it at this point, including iOS which was the original hold out for memory reasons. No more reason to make it optional. Updates #9332 Change-Id: I743fbc2f370921a852fbcebf4eb9821e2bdd3086 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	47cf836720	tsnet: remove redundant ephemeral logout on close LocalBackend.Shutdown already does it. Updates #cleanup Change-Id: Ie5dd7d8e5d9e69644f211ee1de6c790f57f5ae25 Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Sonia Appasamy	f3077c6ab5	client/web: add self node cache Adds a cached self node to the web client Server struct, which will be used from the web client api to verify that request came from the node's own machine (i.e. came from the web client frontend). We'll be using when we switch the web client api over to acting as a proxy to the localapi, to protect against DNS rebinding attacks. Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Will Norris	824cd02d6d	client/web: cache csrf key when running in CGI mode Indicate to the web client when it is running in CGI mode, and if it is then cache the csrf key between requests. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Marwan Sulaiman	9c07f4f512	all: replace deprecated ioutil references This PR removes calls to ioutil library and replaces them with their new locations in the io and os packages. Fixes #9034 Updates #5210 Signed-off-by: Marwan Sulaiman <marwan@tailscale.com>	1 year ago
Denton Gentry	f486041fd1	tsnet: add support for clientmetrics. Updates https://github.com/tailscale/tailscale/issues/1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
Will Norris	d4586ca75f	tsnet/example/web-client: listen on localhost Serving the web client on the tailscale interface, while useful for remote management, is also inherently risky if ACLs are not configured appropriately. Switch the example to listen only on localhost, which is a much safer default. This is still a valuable example, since it still demonstrates how to have a web client connected to a tsnet instance. Updates #13775 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Brad Fitzpatrick	e8551d6b40	all: use Go 1.21 slices, maps instead of x/exp/{slices,maps} Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Sonia Appasamy	16bc9350e3	client/web: add barebones vite dev setup Currently just serving a "Hello world" page when running the web cli in --dev mode. Updates tailscale/corp#13775 Co-authored-by: Will Norris <will@tailscale.com> Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Will Norris	3d56cafd7d	tsnet: add new example serving the Tailscale web client Updates tailscale/corp#13775 Co-authored-by: Sonia Appasamy <sonia@tailscale.com> Signed-off-by: Will Norris <will@tailscale.com> Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Sonia Appasamy	7815fbe17a	tailscale/cli: add interactive flow for enabling Funnel Updates tailscale/corp#10577 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Maisem Ali	682fd72f7b	util/testenv: add new package to hold InTest Removes duplicated code. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Xe Iaso	24f0e91169	tsnet: add examples (#8289 ) Closes #8288 Follows the examples from the KB[1]. [1]: https://tailscale.com/kb/1244/tsnet/ Signed-off-by: Xe Iaso <xe@tailscale.com>	1 year ago
Andrew Dunham	60ab8089ff	logpolicy, various: allow overriding log function This allows sending logs from the "logpolicy" package (and associated callees) to something other than the log package. The behaviour for tailscaled remains the same, passing in log.Printf Updates #8249 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie1d43b75fa7281933d9225bffd388462c08a5f31	1 year ago
Charlotte Brandhorst-Satzkorn	f05a9f3e7f	tsnet: mark TestLoopbackLocalAPI as flakey Test flaked in CI. Updates #8557 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	1 year ago
KevinLiang10	a795b4a641	tsnet: add TestLoopbackSOCKS5 as flaky test Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	1 year ago
Tom DNetto	1377618dbc	tsnet: expose field to configure Wireguard port Signed-off-by: Tom DNetto <tom@tailscale.com> Updates #1748	1 year ago
Aaron Bieber	6829caf6de	tsnet: remove extra wording from Store comment	1 year ago
Brad Fitzpatrick	1543e233e6	net/tstun, tsnet: make happier on WASI Also fix a js/wasm issue with tsnet in the process. (same issue as WASI) Updates #8320 Fixes #8315 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Xe Iaso	43e230d4cd	tsnet: document how to use Dir with multiple servers per process (#8286 ) Followup from a conversation on the Gophers slack, also matches the examples in the tsnet kb. Closes #8287 Signed-off-by: Xe Iaso <xe@tailscale.com>	1 year ago
James Tucker	ca49b29582	tsnet: reenable TestLoopbackSOCKS5 on Windows This test was either fixed in the intermediate time or mis-flagged during the #7876 triage, but is now passing. Updates #7876 Signed-off-by: James Tucker <jftucker@gmail.com>	2 years ago
Brad Fitzpatrick	6e967446e4	tsd: add package with System type to unify subsystem init, discovery This is part of an effort to clean up tailscaled initialization between tailscaled, tailscaled Windows service, tsnet, and the mac GUI. Updates #8036 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	7330aa593e	all: avoid repeated default interface lookups On some platforms (notably macOS and iOS) we look up the default interface to bind outgoing connections to. This is both duplicated work and results in logspam when the default interface is not available (i.e. when a phone has no connectivity, we log an error and thus cause more things that we will try to upload and fail). Fixed by passing around a netmon.Monitor to more places, so that we can use its cached interface state. Fixes #7850 Updates #7621 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	4722f7e322	all: move network monitoring from wgengine/monitor to net/netmon We're using it in more and more places, and it's not really specific to our use of Wireguard (and does more just link/interface monitoring). Also removes the separate interface we had for it in sockstats -- it's a small enough package (we already pull in all of its dependencies via other paths) that it's not worth the extra complexity. Updates #7621 Updates #7850 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Andrew Dunham	280255acae	various: add golangci-lint, fix issues (#7905 ) This adds an initial and intentionally minimal configuration for golang-ci, fixes the issues reported, and adds a GitHub Action to check new pull requests against this linter configuration. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8f38fbc315836a19a094d0d3e986758b9313f163	2 years ago
Mihai Parparita	9a655a1d58	net/dnsfallback: more explicitly pass through logf function Redoes the approach from #5550 and #7539 to explicitly pass in the logf function, instead of having global state that can be overridden. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
James Tucker	bd0c32ca21	tsnet: disable TestLoopbackSOCKS5 on Windows This test is not regularly passing on CI, but seems to pass reliably locally. Needs deeper debugging. Updates #7876 Signed-off-by: James Tucker <jftucker@gmail.com>	2 years ago
Maisem Ali	920ec69241	tsnet,wgenegine/netstack: add test and fix resource leaks We were not closing the http.Server and were also not waiting for netstack to fully close. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	d39a5e4417	tsnet: support TS_AUTH_KEY variant too Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Will Norris	57a008a1e1	all: pass log IDs as the proper type rather than strings This change focuses on the backend log ID, which is the mostly commonly used in the client. Tests which don't seem to make use of the log ID just use the zero value. Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Maisem Ali	f34590d9ed	tsnet: add test for Funnel connections For the logic added in `b797f77`. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	c6d96a2b61	tsnet: do not start logtail in tests It was trying to upload logs in tests. skip-issuebot Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	b4d3e2928b	tsnet: avoid deadlock on close tsnet.Server.Close was calling listener.Close with the server mutex held, but the listener close method tries to grab that mutex, resulting in a deadlock. Co-authored-by: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	5e8a80b845	all: replace /kb/ links with /s/ equivalents Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	558735bc63	cmd/k8s-operator: require HTTPS to be enabled for AuthProxy Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	83fa17d26c	various: pass logger.Logf through to more places Updates #7537 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id89acab70ea678c8c7ff0f44792d54c7223337c6	2 years ago
Maisem Ali	958c89470b	tsnet: add CertDomains helper (#7533 ) Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
shayne	e109cf9fdd	tsnet/tsnet: clear ipn.ServeConfig on Up for tsnet apps (#7534 ) We persist the ServeConfig, even for tsnet apps. It's quite possible for the ServeConfig to be out of step with the code. Example: If you run `ListenFunnel` then later turn it off, the ServeConfig will still show it enabled, the admin console will show it enabled, but the packet handler will reject the packets. Workaround by clearing the ServeConfig in `tsnet.Up` Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Maisem Ali	3ff44b2307	ipn: add Funnel port check from nodeAttr Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	ccdd534e81	tsnet: add ListenFunnel This lets a tsnet binary share a server out over Tailscale Funnel. Signed-off-by: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Maisem Ali	b797f773c7	ipn/ipnlocal: add support for funnel in tsnet Previously the part that handled Funnel connections was not aware of any listeners that tsnet.Servers might have had open so it would check against the ServeConfig and fail. Adding a ServeConfig for a TCP proxy was also not suitable in this scenario as that would mean creating two different listeners and have one forward to the other, which really meant that you could not have funnel and tailnet-only listeners on the same port. This also introduces the ipn.FunnelConn as a way for users to identify whether the call is coming over funnel or not. Currently it only holds the underlying conn and the target as presented in the "Tailscale-Ingress-Target" header. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	b0cb39cda1	tsnet: only intercept TCP flows that have listeners Previously, it would accept all TCP connections and then close the ones it did not care about. Make it only ever accept the connections that it cares about. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
David Crawshaw	9245d813c6	tsnet: explicit message for panic seen in CI Updates #7488 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Denton Gentry	b46c5ae82a	cmd/sniproxy: draw the rest of the DNS owl. Add a DNS server which always responds as its own IP addresses. Additionally add a tsnet TailscaleIPs() function to return the IP addresses, both IPv4 and IPv6. Updates https://github.com/tailscale/tailscale/issues/1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
David Crawshaw	387b68fe11	tsnet: generalize loopback listener to include SOCKS5 Some languages do not give you any useful access to the sockets underlying their networking packages. E.g. java.net.http.HttpClient provides no official access to its dialing logic. ...but everyone supports proxies. So add a SOCKS5 proxy on the listener we are already running. (The function being revamped is very new, I only added it in the last week and it wasn't part of any release, so I believe it is fine to redo its function signature.) Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Brad Fitzpatrick	0f4359116e	tsnet: add UDP support to Server.Listen No ListenPacket support yet, but Listen with a udp network type fit easier into netstack's model to start. Then added an example of using it to cmd/sniproxy with a little udp :53 handler. No tests in tsnet yet because we don't have support for dialing over UDP in tsnet yet. When that's done, a new test can test both sides. Updates #5871 Updates #1748 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	9ff51ca17f	wgengine/netstack: add support for custom UDP flow handlers To be used by tsnet and sniproxy later. Updates #5871 Updates #1748 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Crawshaw	d41f6a8752	tsnet: do not error on NeedsMachineAuth for Up It turns out even with an AuthKey that pre-approves devices on a tailnet with machine auth turned on, we still temporarily see the NeedsMachineAuth state. So remove that error (for now). Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago

1 2 3

107 Commits (9843e922b8da99e99a1249f36ae9aba8eda5e839)