6240 Commits (9a56184beff409f1151afb8db5104bed140ba829)

 

All Branches   

Search

Author	SHA1	Message	Date
Sonia Appasamy	09e5e68297	client/web: track web client initializations ... Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Brad Fitzpatrick	947def7688	types/netmap: remove redundant Netmap.Hostinfo ... It was in SelfNode.Hostinfo anyway. The redundant copy was just costing us an allocation per netmap (a Hostinfo.Clone). Updates #1909 Change-Id: Ifac568aa5f8054d9419828489442a0f4559bc099 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Sonia Appasamy	50b558de74	client/web: hook up remaining legacy POST requests ... Hooks up remaining legacy POST request from the React side in --dev. Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Brad Fitzpatrick	db017d3b12	control/controlclient: remove quadratic allocs in mapSession ... The mapSession code was previously quadratic: N clients in a netmap send updates proportional to N and then for each, we do N units of work. This removes most of that "N units of work" per update. There's still a netmap-sized slice allocation per update (that's #8963), but that's it. Bit more efficient now, especially with larger netmaps: │ before │ after │ │ sec/op │ sec/op vs base │ MapSessionDelta/size_10-8 47.935µ ± 3% 1.232µ ± 2% -97.43% (p=0.000 n=10) MapSessionDelta/size_100-8 79.950µ ± 3% 1.642µ ± 2% -97.95% (p=0.000 n=10) MapSessionDelta/size_1000-8 355.747µ ± 10% 4.400µ ± 1% -98.76% (p=0.000 n=10) MapSessionDelta/size_10000-8 3079.71µ ± 3% 27.89µ ± 3% -99.09% (p=0.000 n=10) geomean 254.6µ 3.969µ -98.44% │ before │ after │ │ B/op │ B/op vs base │ MapSessionDelta/size_10-8 9.651Ki ± 0% 2.395Ki ± 0% -75.19% (p=0.000 n=10) MapSessionDelta/size_100-8 83.097Ki ± 0% 3.192Ki ± 0% -96.16% (p=0.000 n=10) MapSessionDelta/size_1000-8 800.25Ki ± 0% 10.32Ki ± 0% -98.71% (p=0.000 n=10) MapSessionDelta/size_10000-8 7896.04Ki ± 0% 82.32Ki ± 0% -98.96% (p=0.000 n=10) geomean 266.8Ki 8.977Ki -96.64% │ before │ after │ │ allocs/op │ allocs/op vs base │ MapSessionDelta/size_10-8 72.00 ± 0% 20.00 ± 0% -72.22% (p=0.000 n=10) MapSessionDelta/size_100-8 523.00 ± 0% 20.00 ± 0% -96.18% (p=0.000 n=10) MapSessionDelta/size_1000-8 5024.00 ± 0% 20.00 ± 0% -99.60% (p=0.000 n=10) MapSessionDelta/size_10000-8 50024.00 ± 0% 20.00 ± 0% -99.96% (p=0.000 n=10) geomean 1.754k 20.00 -98.86% Updates #1909 Change-Id: I41ee29358a5521ed762216a76d4cc5b0d16e46ac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
shayne	a3b0654ed8	.github: add flakehub-publish-tagged.yml (#9009) ... This workflow will publish a flake to flakehub when a tag is pushed to the repository. It will only publish tags that match the pattern `v*.*.*`. Fixes #9008 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	1 year ago
Marwan Sulaiman	35ff5bf5a6	cmd/tailscale/cli, ipn/ipnlocal: [funnel] add stream mode ... Adds ability to start Funnel in the foreground and stream incoming connections. When foreground process is stopped, Funnel is turned back off for the port. Exampe usage: ``` TAILSCALE_FUNNEL_V2=on tailscale funnel 8080 ``` Updates #8489 Signed-off-by: Marwan Sulaiman <marwan@tailscale.com>	1 year ago
Brad Fitzpatrick	cb4a61f951	control/controlclient: don't clone self node on each NetworkMap ... Drop in the bucket, but have to start somewhere. Real wins will come once this is done for peers. │ before │ after │ │ B/op │ B/op vs base │ MapSessionDelta/size_10-8 10.213Ki ± ∞ ¹ 9.650Ki ± ∞ ¹ -5.51% (p=0.008 n=5) MapSessionDelta/size_100-8 83.64Ki ± ∞ ¹ 83.08Ki ± ∞ ¹ -0.67% (p=0.008 n=5) MapSessionDelta/size_1000-8 800.8Ki ± ∞ ¹ 800.3Ki ± ∞ ¹ -0.07% (p=0.008 n=5) MapSessionDelta/size_10000-8 7.712Mi ± ∞ ¹ 7.711Mi ± ∞ ¹ -0.01% (p=0.008 n=5) geomean 271.1Ki 266.8Ki -1.59% │ before │ after │ │ allocs/op │ allocs/op vs base │ MapSessionDelta/size_10-8 73.00 ± ∞ ¹ 72.00 ± ∞ ¹ -1.37% (p=0.008 n=5) MapSessionDelta/size_100-8 524.0 ± ∞ ¹ 523.0 ± ∞ ¹ -0.19% (p=0.008 n=5) MapSessionDelta/size_1000-8 5.025k ± ∞ ¹ 5.024k ± ∞ ¹ -0.02% (p=0.008 n=5) MapSessionDelta/size_10000-8 50.02k ± ∞ ¹ 50.02k ± ∞ ¹ -0.00% (p=0.040 n=5) geomean 1.761k 1.754k -0.40% Updates #1909 Change-Id: Ie19dea3371de251d64d4373dd00422f53c2675ea Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Will Norris	a461d230db	Revert "release/dist: run yarn build before building CLI" ... This caused breakages on the build server: synology/dsm7/x86_64: chdir /home/ubuntu/builds/2023-08-21T21-47-38Z-unstable-main-tagged-devices/0/client/web: no such file or directory synology/dsm7/i686: chdir /home/ubuntu/builds/2023-08-21T21-47-38Z-unstable-main-tagged-devices/0/client/web: no such file or directory synology/dsm7/armv8: chdir /home/ubuntu/builds/2023-08-21T21-47-38Z-unstable-main-tagged-devices/0/client/web: no such file or directory ... Reverting while I investigate. This reverts commit 0fb95ec07d. Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Will Norris	0fb95ec07d	release/dist: run yarn build before building CLI ... This builds the assets for the new web client as part of our release process. These assets will soon be embedded into the cmd/tailscale binary, but are not actually done so yet. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Brad Fitzpatrick	84b94b3146	types/netmap, all: make NetworkMap.SelfNode a tailcfg.NodeView ... Updates #1909 Change-Id: I8c470cbc147129a652c1d58eac9b790691b87606 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
License Updater	699f9699ca	licenses: update tailscale{,d} licenses ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 year ago
Flakes Updater	f6615931d7	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	1 year ago
Sonia Appasamy	077bbb8403	client/web: add csrf protection to web client api ... Adds csrf protection and hooks up an initial POST request from the React web client. Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Andrew Dunham	77ff705545	net/portmapper: never select port 0 in UPnP ... Port 0 is interpreted, per the spec (but inconsistently among router software) as requesting to map every single available port on the UPnP gateway to the internal IP address. We'd previously avoided picking ports below 1024 for one of the two UPnP methods (in #7457), and this change moves that logic so that we avoid it in all cases. Updates #8992 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I20d652c0cd47a24aef27f75c81f78ae53cc3c71e	1 year ago
Brad Fitzpatrick	b5ff68a968	control/controlclient: flesh out mapSession to break up gigantic method ... Now mapSession has a bunch more fields and methods, rather than being just one massive func with a ton of local variables. So far there are no major new optimizations, though. It should behave the same as before. This has been done with an eye towards testability (so tests can set all the callback funcs as needed, or not, without a huge Direct client or long-running HTTP requests), but this change doesn't add new tests yet. That will follow in the changes which flesh out the NetmapUpdater interface. Updates #1909 Change-Id: Iad4e7442d5bbbe2614bd4b1dc4b02e27504898df Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	1b223566dd	util/linuxfw: fix typo in unexported doc comment ... And flesh it out and use idiomatic doc style ("whether" for bools) and end in a period while there anyway. Updates #cleanup Change-Id: Ieb82f13969656e2340c3510e7b102dc8e6932611 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Val	c85d7c301a	tool: force HTTP/1.1 in curl to prevent hang behind load balancer ... When running in our github CI environment, curl sometimes hangs while closing the download from the nodejs.org server and fails with INTERNAL_ERROR. This is likely caused by CI running behind some kind of load balancer or proxy that handles HTTP/2 incorrectly in some minor way, so force curl to use HTTP 1.1. Updates #8988 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Denton Gentry	f486041fd1	tsnet: add support for clientmetrics. ... Updates https://github.com/tailscale/tailscale/issues/1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
Val	c15997511d	wgengine/magicsock: only accept pong sent by CLI ping ... When sending a ping from the CLI, only accept a pong that is in reply to the specific CLI ping we sent. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Brad Fitzpatrick	165f0116f1	types/netmap: move some mutations earlier, remove, document some fields ... And optimize the Persist setting a bit, allocating later and only mutating fields when there's been a Node change. Updates #1909 Change-Id: Iaddfd9e88ef76e1d18e8d0a41926eb44d0955312 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	21170fb175	control/controlclient: scope a variable tighter, de-pointer a *time.Time ... Just misc cleanups. Updates #1909 Change-Id: I9d64cb6c46d634eb5fdf725c13a6c5e514e02e9a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	2548496cef	types/views,cmd/viewer: add ByteSlice[T] to replace mem.RO ... Add a new views.ByteSlice[T ~[]byte] to provide a better API to use with views. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	8a5ec72c85	cmd/cloner: use maps.Clone and ptr.To ... Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	4511e7d64e	ipn/ipnstate: add PeerStatus.AltSharerUserID, stop mangling Node.User ... In b987b2ab18 (2021-01-12) when we introduced sharing we mapped the sharer to the userid at a low layer, mostly to fix the display of "tailscale status" and the client UIs, but also some tests. The commit earlier today, 7dec09d169, removed the 2.5yo option to let clients disable that automatic mapping, as clearly we were never getting around to it. This plumbs the Sharer UserID all the way to ipnstatus so the CLI itself can choose to print out the Sharer's identity over the node's original owner. Then we stop mangling Node.User and let clients decide how they want to render things. To ease the migration for the Windows GUI (which currently operates on tailcfg.Node via the NetMap from WatchIPNBus, instead of PeerStatus), a new method Node.SharerOrUser is added to do the mapping of Sharer-else-User. Updates #1909 Updates tailscale/corp#1183 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	d483ed7774	tailcfg: generate RegisterResponse.Clone, remove manually written ... It had a custom Clone func with a TODO to replace with cloner, resolve that todo. Had to pull out the embedded Auth struct into a named struct. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	282dad1b62	tailcfg: update docs on NetInfo.FirewallMode ... Updates #391 Change-Id: Ifef196b31dd145f424fb0c0d0bb04565cc22c717 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	d8191a9813	ipn/ipnlocal: fix regression in printf arg type ... I screwed this up in 58a4fd43d as I expected. I even looked out for cases like this (because this always happens) and I still missed it. Vet doesn't flag these because they're not the standard printf funcs it knows about. TODO: make our vet recognize all our "logger.Logf" types. Updates #8948 Change-Id: Iae267d5f81da49d0876b91c0e6dc451bf7dcd721 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	f35ff84ee2	util/deephash: relax an annoyingly needy test ... I'd added a test case of deephash against a tailcfg.Node to make sure it worked at all more than anything. We don't care what the exact bytes are in this test, just that it doesn't fail. So adjust for that. Then when we make changes to tailcfg.Node and types under it, we don't need to keep adjusting this test. Updates #cleanup Change-Id: Ibf4fa42820aeab8f5292fe65f9f92ffdb0b4407b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	93a806ba31	types/tkatype: add test for MarshaledSignature's JSON format ... Lock in its wire format before a potential change to its Go type. Updates #1909 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	7dec09d169	control/controlclient: remove Opts.KeepSharerAndUserSplit ... It was added 2.5 years ago in c1dabd9436 but was never used. Clearly that migration didn't matter. We can attempt this again later if/when this matters. Meanwhile this simplifies the code and thus makes working on other current efforts in these parts of the code easier. Updates #1909 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	02b47d123f	tailcfg: remove unused Domain field from Login/User ... Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	58a4fd43d8	types/netmap, all: use read-only tailcfg.NodeView in NetworkMap ... Updates #8948 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
KevinLiang10	b040094b90	util/linuxfw: reorganize nftables rules to allow it to work with ufw ... This commit tries to mimic the way iptables-nft work with the filewall rules. We follow the convention of using tables like filter, nat and the conventional chains, to make our nftables implementation work with ufw. Updates: #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	1 year ago
Will Norris	d4586ca75f	tsnet/example/web-client: listen on localhost ... Serving the web client on the tailscale interface, while useful for remote management, is also inherently risky if ACLs are not configured appropriately. Switch the example to listen only on localhost, which is a much safer default. This is still a valuable example, since it still demonstrates how to have a web client connected to a tsnet instance. Updates #13775 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
KevinLiang10	93cab56277	wgengine/router: fall back and set iptables as default again ... Due to the conflict between our nftables implementation and ufw, which is a common utility used on linux. We now want to take a step back to prevent regression. This will give us more chance to let users to test our nftables support and heuristic. Updates: #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	1 year ago
Brad Fitzpatrick	6e57dee7eb	cmd/viewer, types/views, all: un-special case slice of netip.Prefix ... Make it just a views.Slice[netip.Prefix] instead of its own named type. Having the special case led to circular dependencies in another WIP PR of mine. Updates #8948 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	261cc498d3	types/views: add LenIter method to slice view types ... This is basically https://github.com/bradfitz/iter which was a joke but now that Go's adding range over int soonish, might as well. It simplies our code elsewher that uses slice views. Updates #8948 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	af2e4909b6	all: remove some Debug fields, NetworkMap.Debug, Reconfig Debug arg ... Updates #8923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Andrew Lytvynov	86ad1ea60e	clientupdate: parse /etc/synoinfo.conf to get CPU arch (#8940) ... The hardware version in `/proc/sys/kernel/syno_hw_version` does not map exactly to versions in https://github.com/SynoCommunity/spksrc/wiki/Synology-and-SynoCommunity-Package-Architectures. It contains some slightly different version formats. Instead, `/etc/synoinfo.conf` exists and contains a `unique` line with the CPU architecture encoded. Parse that out and filter through the list of architectures that we have SPKs for. Tested on DS218 and DS413j. Updates #8927 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Marwan Sulaiman	72d2122cad	cmd/tailscale: change serve and funnel calls to StatusWithoutPeers ... The tailscale serve|funnel commands frequently call the LocalBackend's Status but they never need the peers to be included. This PR changes the call to be StatusWithoutPeers which should gain a noticeable speed improvement Updates #8489 Signed-off-by: Marwan Sulaiman <marwan@tailscale.com>	1 year ago
Brad Fitzpatrick	121d1d002c	tailcfg: add nodeAttrs for forcing OneCGNAT on/off [capver 71] ... Updates #8923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	25663b1307	tailcfg: remove most Debug fields, move bulk to nodeAttrs [capver 70] ... Now a nodeAttr: ForceBackgroundSTUN, DERPRoute, TrimWGConfig, DisableSubnetsIfPAC, DisableUPnP. Kept support for, but also now a NodeAttr: RandomizeClientPort. Removed: SetForceBackgroundSTUN, SetRandomizeClientPort (both never used, sadly... never got around to them. But nodeAttrs are better anyway), EnableSilentDisco (will be a nodeAttr later when that effort resumes). Updates #8923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
David Anderson	e92adfe5e4	net/art: allow non-pointers as values ... Values are still turned into pointers internally to maintain the invariants of strideTable, but from the user's perspective it's now possible to tbl.Insert(pfx, true) rather than tbl.Insert(pfx, ptr.To(true)). Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Brad Fitzpatrick	bc0eb6b914	all: import x/exp/maps as xmaps to distinguish from Go 1.21 "maps" ... Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	e8551d6b40	all: use Go 1.21 slices, maps instead of x/exp/{slices,maps} ... Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Denton Gentry	e8d140654a	cmd/derper: count bootstrap dns unique lookups. ... Updates https://github.com/tailscale/corp/issues/13979 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
Denton Gentry	7e15c78a5a	syncs: add map.Clear() method ... Updates https://github.com/tailscale/corp/issues/13979 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
Brad Fitzpatrick	239ad57446	tailcfg: move LogHeapPprof from Debug to c2n [capver 69] ... And delete Debug.GoroutineDumpURL, which was already in c2n. Updates #8923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	24509f8b22	cmd/k8s-operator: add support for control plane assigned groups ... Previously we would use the Impersonate-Group header to pass through tags to the k8s api server. However, we would do nothing for non-tagged nodes. Now that we have a way to specify these via peerCaps respect those and send down groups for non-tagged nodes as well. For tagged nodes, it defaults to sending down the tags as groups to retain legacy behavior if there are no caps set. Otherwise, the tags are omitted. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	0913ec023b	CODEOWNERS: add the start of an owners file ... Updates tailscale/corp#13972 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago