tailscale

Commit Graph

Author	SHA1	Message	Date
phirework	f011a0923a	cmd/tailscale/cli: style synology outgoing access info (#6959 ) Follow-up to #6957. Updates #4015 Signed-off-by: Jenny Zhang <jz@tailscale.com>	2 years ago
Andrew Dunham	11ce5b7e57	ipn/ipnlocal, wgengine/magicsock: check Expired bool on Node; print error in Ping Change-Id: Ic5f533f175a6e1bb73d4957d8c3f970add42e82e Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Brad Fitzpatrick	5eded58924	cmd/tailscale/cli: make web show/link Synology outgoing connection mode/docs Fixes #4015 Change-Id: I8230bb0cc3d621b6fa02ab2462cea104fa1e9cf9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Matthias Gabriel	355c3b2be7	control/controlhttp: fix header case-sensitivity Change-Id: I49269bc969a80382997ec5c9de33c4f56d9dc787 Signed-off-by: Matthias Gabriel <matthias.gabriel@etit.tu-chemnitz.de>	2 years ago
Brad Fitzpatrick	61dfbc0a6e	cmd/tailscale/cli: plumb TUN mode into tailscale web template UI works remains, but data is there now. Updates #4015 Change-Id: Ib91e94718b655ad60a63596e59468f3b3b102306 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
salman	8a1201ac42	cmd/tailscale: correct order for -terminate-tls flag in serve tcp usage The -terminate-tls flag is for the tcp subsubcommand, not the serve subcommand like the usage example suggests. Signed-off-by: salman <salman@tailscale.com>	2 years ago
Brad Fitzpatrick	faf2d30439	version: advertise unstable track in CLI, daemon start-up Fixes #865 Change-Id: I166e56c3744b0a113973682b9a5327d7aec189f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Jordan Whited	25a0091f69	net/portmapper: relax handling of UPnP resp (#6946 ) Gateway devices operating as an HA pair w/VRRP or CARP may send UPnP replies from static addresses rather than the floating gateway address. This commit relaxes our source address verification such that we parse responses from non-gateway IPs, and re-point the UPnP root desc URL to the gateway IP. This ensures we are still interfacing with the gateway device (assuming L2 security intact), even though we got a root desc from a non-gateway address. This relaxed handling is required for ANY port mapping to work on certain OPNsense/pfsense distributions using CARP at the time of writing, as miniupnpd may only listen on the static, non-gateway interface address for PCP and PMP. Fixes #5502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
License Updater	b76dffa594	licenses: update win/apple licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Andrew Dunham	6f18fbce8d	tailcfg: document zero value for KeyExpiry Change-Id: I50889f0205ecf66c415f50f9019c190448c991fc Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	2 years ago
Tom DNetto	2ac5474be1	net/flowtrack,wgengine/filter: refactor Cache to use generics Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Will Norris	3becf82dd3	types/views: add SliceEqualAnyOrder func This is based on the tagsEqual func from corp/control/control.go, moved here so that it can be reused in other places. Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Andrew Dunham	1e67947cfa	control/controlclient, tailcfg: add Node.Expired field, set for expired nodes Nodes that are expired, taking into account the time delta calculated from MapResponse.ControlTime have the newly-added Expired boolean set. For additional defense-in-depth, also replicate what control does and clear the Endpoints and DERP fields, and additionally set the node key to a bogus value. Updates #6932 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia2bd6b56064416feee28aef5699ca7090940662a	2 years ago
Denton Gentry	22ebb25e83	cmd/tailscale: disable HTTPS verification for QNAP auth. QNAP's "Force HTTPS" mode redirects even localhost HTTP to HTTPS, but uses a self-signed certificate which fails verification. We accommodate this by disabling checking of the cert. Fixes https://github.com/tailscale/tailscale/issues/6903 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
James Tucker	2afa1672ac	ipn/ipnlocal: disallow unsigned peers from WoL Unsigned peers should not be allowed to generate Wake-on-Lan packets, only access Funnel. Updates #6934 Updates #7515 Updates #6475 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
License Updater	237b1108b3	licenses: update tailscale{,d} licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Will Norris	fff617c988	go.mod: bump golang.org/x/net and dependencies I don't think CVE-2022-41717 necessarily impacts us (maybe as part of funnel?), but it came up in a recent security scan so worth updating anyway. Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
License Updater	c684ca7a0c	licenses: update tailscale{,d} licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Brad Fitzpatrick	1116602d4c	ssh/tailssh: add OpenBSD support for Tailscale SSH And bump go.mod for https://github.com/u-root/u-root/pull/2593 Change-Id: I36ec94c5b2b76d671cb739f1e9a1a43ca1d9d1b1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	be67b8e75b	ssh/tailssh: fix Tailscale SSH to non-root tailscaled Fix regression from `337c77964b` where tailscaled started calling Setgroups. Prior to that, SSH to a non-root tailscaled was working. Instead, ignore any failure calling Setgroups if the groups are already correct. Fixes #6888 Change-Id: I561991ddb37eaf2620759c6bcaabd36e0fb2a22d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	8047dfa2dc	ssh/tailssh: unify some of the incubator_* GOOS files into incubator.go In prep for fix for #6888 Change-Id: I79f780c6467a9b7ac03017b27d412d6b0d2f7e6b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ebbf5c57b3	README.md: update with some new links, refresh And remove Darwin from the list, as macOS was already there. Change-Id: I76bdcad97c926771f44a67140af21f07a8334796 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Anderson	39efba528f	cmd/containerboot: use TS_AUTHKEY as the parameter for auth keys We still accept the previous TS_AUTH_KEY for backwards compatibility, but the documented option name is the spelling we use everywhere else. Updates #6321 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Brad Fitzpatrick	69c0b7e712	ipn/ipnlocal: add c2n handler to flush logtail for support debugging Updates tailscale/corp#8564 Change-Id: I0c619d4007069f90cffd319fba66bd034d63e84d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	673b3d8dbd	net/dns,userspace: remove unused DNS paths, normalize query limit on iOS With `a42a594bb3`, iOS uses netstack and hence there are no longer any platforms which use the legacy MagicDNS path. As such, we remove it. We also normalize the limit for max in-flight DNS queries on iOS (it was 64, now its 256 as per other platforms). It was 64 for the sake of being cautious about memory, but now we have 50Mb (iOS-15 and greater) instead of 15Mb so we have the spare headroom. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	10eec37cd9	scripts: permit 2023 in license headers Change-Id: Ia018cb8491871c8bf756c454d085780b75512962 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	8f2bc0708b	logtail: make logs flush delay dynamic Instead of a static FlushDelay configuration value, use a FlushDelayFn function that we invoke every time we decide send logs. This will allow mobile clients to be more dynamic about when to send logs. Updates #6768 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Tom DNetto	0088c5ddc0	health,ipn/ipnlocal: report the node being locked out as a health issue Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	907f85cd67	cmd/tailscale,tka: make KeyID return an error instead of panicking Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	8724aa254f	cmd/tailscale,tka: implement compat for TKA messages, minor UX tweaks Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Kristoffer Dalby	c4e262a0fc	ipn/profiles: set default prefs based on Windows registry (#6803 ) Co-authored-by: Maisem Ali maisem@tailscale.com	2 years ago
Brad Fitzpatrick	eafbf8886d	ipn/localapi: add localapi debug endpoints for packet filter/matches For debugging #6423. This is easier than TS_DEBUG_MAP, as this means I can pipe things into jq, etc. Updates #6423 Change-Id: Ib3e7496b2eb3f47d4bed42e9b8045a441424b23c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	b2b8e62476	util/codegen: permit running in directories without copyright headers It broke in our corp repo that lacks copyright headers. Change-Id: Iafc433e6b6affe83b45477899455527658dc4f12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Anderson	91e64ca74f	cmd/tailscale/cli: redact private key in debug netmap output by default This makes `tailscale debug watch-ipn` safe to use for troubleshooting user issues, in addition to local debugging during development. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
License Updater	d72575eaaa	licenses: update android licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
James Tucker	b2c55e62c8	net/tlsdial,tstest,version: use go command from $PATH Go now includes the GOROOT bin directory in $PATH while running tests and generate, so it is no longer necessary to construct a path using runtime.GOROOT(). Fixes #6689 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Denton Gentry	467ace7d0c	cmd/tailscale: use localhost for QNAP authLogin.cgi When the user clicks on the Tailscale app in the QNAP App Center, we do a GET from /cgi-bin/authLogin.cgi to look up their SID. If the user clicked "secure login" on the QNAP login page to use HTTPS, then our access to authLogin.cgi will also use HTTPS but the certiciate is self-signed. Our GET fails with: Get "https://10.1.10.41/cgi-bin/authLogin.cgi?sid=abcd0123": x509: cannot validate certificate for 10.1.10.41 because it doesn't contain any IP SANs or similar errors. Instead, access QNAP authentication via http://localhost:8080/ as documented in https://download.qnap.com/dev/API_QNAP_QTS_Authentication.pdf Fixes https://github.com/tailscale/tailscale-qpkg/issues/62 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Brad Fitzpatrick	aad6830df0	util/codegen, all: use latest year, not time.Now, in generated files Updates #6865 Change-Id: I6b86c646968ebbd4553cf37df5e5612fbf5c5f7d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ea70aa3d98	net/dns/resolvconffile: fix handling of multiple search domains Fixes #6875 Change-Id: I57eb9312c9a1c81792ce2b5a0a0f254213b05df2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
License Updater	692eac23ad	licenses: update android licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
David Anderson	c86d9f2ab1	flake.nix: rename package to just "tailscale". There is no unstability inherent in this package, it's just unstable if you choose to import the flake at the main branch. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	7bfb9999ee	cmd/printdep: support printing the toolchain SRI hash. Updates #6845. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	d2beaea523	update-flake.sh: tooling to keep Nix SRI hashes in sync. Also fixes the Go toolchain SRI hash from `a7f05c6bb0`, it turns out I initialized the file with an SRI hash for an older toolchain version, and because of the unique way fixed-output derivations work in nix, nix didn't tell me about the mismatch because it just cache-hit on the older toolchain and moved on. Sigh. Updates #6845. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Brad Fitzpatrick	3599364312	cmd/nardump: Go tool to build Nix NARs and compute their hashes. Updates #6845. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	a7f05c6bb0	flake.nix: init to ship unstable tailscale packages. With this, you can import "github:tailscale/tailscale" as a nix flake, and get access to the "tailscale-unstable" package. Updates #6845. Signed-off-by: David Anderson <dave@natulte.net>	2 years ago
David Anderson	eb682d2a0b	version: construct short hash in dev mode if GitCommit is given. Allows a dev built to provide GitCommit and have the short hash computed correctly, even if the Go embedded build info lacks a git commit. Signed-off-by: David Anderson <dave@natulte.net>	2 years ago
Denton Gentry	2a1f1c79ca	scripts/installer.sh: add SUSE Enterprise Server. Fixes https://github.com/tailscale/tailscale/issues/6840 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
License Updater	6107c65f1e	licenses: update win/apple licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Claire Wang	a45c9f982a	wgengine/netstack: change netstack API to require LocalBackend The macOS client was forgetting to call netstack.Impl.SetLocalBackend. Change the API so that it can't be started without one, eliminating this class of bug. Then update all the callers. Updates #6764 Change-Id: I2b3a4f31fdfd9fdbbbbfe25a42db0c505373562f Signed-off-by: Claire Wang <claire@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	84eaef0bbb	ssh/tailssh: don't swallow process exit code in be-child Thanks to @nshalman and @Soypete for debugging! Updates #6054 Change-Id: I74550cc31f8a257b37351b8152634c768e1e0a8a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago

1 2 3 4 5 ...

5182 Commits (9af7e8a0ffe480c07f6f013ce42f9ae3336ef9aa) All Branches Search

5182 Commits (9af7e8a0ffe480c07f6f013ce42f9ae3336ef9aa)

All Branches