8052 Commits (9f7683e2a1059889fbeee61795400ef74df220d4)

 

All Branches   

Search

Author	SHA1	Message	Date
James Tucker	6e334e64a1	net/netcheck,wgengine/magicsock: align DERP frame receive time heuristics ... The netcheck package and the magicksock package coordinate via the health package, but both sides have time based heuristics through indirect dependencies. These were misaligned, so the implemented heuristic aimed at reducing DERP moves while there is active traffic were non-operational about 3/5ths of the time. It is problematic to setup a good test for this integration presently, so instead I added comment breadcrumbs along with the initial fix. Updates #8603 Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
Irbe Krumina	1fbaf26106	util/linuxfw: fix chain comparison (#11639) ... Don't compare pointer fields by pointer value, but by the actual value Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	8 months ago
Charlotte Brandhorst-Satzkorn	8c75da27fc	drive: move normalizeShareName into pkg drive and make func public (#11638) ... This change makes the normalizeShareName function public, so it can be used for validation in control. Updates tailscale/corp#16827 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	8 months ago
Will Morrison	306bacc669	cmd/tailscale/cli: Add CLI command to update certs on Synology devices. ... Fixes #4674 Signed-off-by: Will Morrison <william.barr.morrison@gmail.com>	8 months ago
Brad Fitzpatrick	9699bb0a20	metrics: fix outdated docs on MultiLabelMap ... And make NewMultiLabelMap panic earlier (at construction time) if the comparable struct type T violates the documented rules, rather than panicking at Add time. Updates #cleanup Change-Id: Ib1a03babdd501b8d699c4f18b1097a56c916c6d5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Joonas Kuorilehto	fe0cfec4ad	wgengine/router: enable ip forwarding on gokrazy ... Only on Gokrazy, set sysctls to enable IP forwarding so subnet routing and advertised exit node works. Fixes #11405 Signed-off-by: Joonas Kuorilehto <joneskoo@derbian.fi>	8 months ago
Joe Tsai	4bbac72868	util/truncate: support []byte as well (#11614) ... There are no mutations to the input, so we can support both ~string and ~[]byte just fine. Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>	8 months ago
Charlotte Brandhorst-Satzkorn	98cf71cd73	tailscale: switch tailfs to drive syntax for api and logs (#11625) ... This change switches the api to /drive, rather than the previous /tailfs as well as updates the log lines to reflect the new value. It also cleans up some existing tailfs references. Updates tailscale/corp#16827 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	8 months ago
Percy Wegmann	853e3e29a0	wgengine/router: provide explicit hook to signal Android when VPN needs to be reconfigured ... This allows clients to avoid establishing their VPN multiple times when both routes and DNS are changing in rapid succession. Updates tailscale/corp#18928 Signed-off-by: Percy Wegmann <percy@tailscale.com>	8 months ago
Joe Tsai	1a38d2a3b4	util/zstdframe: support specifying a MaxWindowSize (#11595) ... Specifying a smaller window size during compression provides a knob to tweak the tradeoff between memory usage and the compression ratio. Updates tailscale/corp#18514 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	8 months ago
Andrew Dunham	7d7d159824	prober: support creating multiple probes in ForEachAddr ... So that we can e.g. check TLS on multiple ports for a given IP. Updates tailscale/corp#16367 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I81d840a4c88138de1cbb2032b917741c009470e6	8 months ago
Andrew Dunham	ac574d875c	prober: add helper function to check all IPs for a DNS hostname ... This allows us to check all IP addresses (and address families) for a given DNS hostname while dynamically discovering new IPs and removing old ones as they're no longer valid. Also add a testable example that demonstrates how to use it. Alternative to #11610 Updates tailscale/corp#16367 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6d6f39bafc30e6dfcf6708185d09faee2a374599	8 months ago
Brad Fitzpatrick	8d7894c68e	clientupdate, net/dns: fix some "tailsacle" typos ... Updates #cleanup Change-Id: I982175e74b0c8c5b3e01a573e5785e6596b7ac39 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	92d3f64e95	go.toolchain.rev: bump to Go 1.22.2 ... Update tailscale/corp#18893 Change-Id: I4c04f5153ad43429d7f510c9ac2194c3b2fbc6c1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Charlotte Brandhorst-Satzkorn	93618a3518	tailscale: update tailfs functions and vars to use drive naming (#11597) ... This change updates all tailfs functions and the majority of the tailfs variables to use the new drive naming. Updates tailscale/corp#16827 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	8 months ago
Brad Fitzpatrick	2409661a0d	control/controlclient: delete old naclbox code, require ts2021 Noise ... Updates #11585 Updates tailscale/corp#18882 Change-Id: I90e2e4a211c58d429e2b128604614dde18986442 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	b9611461e5	ipn/ipnlocal: q-encode (RFC 2047) Tailscale serve header values ... Updates #11603 RELNOTE=Tailscale serve headers are now RFC 2047 Q-encoded Change-Id: I1314b65ecf5d39a5a601676346ec2c334fdef042 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Claire Wang	262fa8a01e	ipn/ipnlocal: populate peers' capabilities (#11365) ... Populates capabilties field of peers in ipn status. Updates tailscale/corp#17516 Signed-off-by: Claire Wang <claire@tailscale.com>	8 months ago
James Tucker	9eaa56df93	tsweb: update doc on BucketedStatsOptions.Finish to match behavior ... I originally came to update this to match the documented behavior, but the code is deliberately avoiding this behavior currently, making it hard to decide how to update this. For now just align the documentation to the behavior. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
Charlotte Brandhorst-Satzkorn	14683371ee	tailscale: update tailfs file and package names (#11590) ... This change updates the tailfs file and package names to their new naming convention. Updates #tailscale/corp#16827 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	8 months ago
Brad Fitzpatrick	1c259100b0	cmd/{derper,derpprobe}: add --version flag ... Fixes #11582 Change-Id: If99fc1ab6b89d624fbb07bd104dd882d2c7b50b4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Patrick O'Doherty	1535d0feca	safeweb: move http.Serve for HTTP redirects into lib (#11592) ... Refactor the interaction between caller/library when establishing the HTTP to HTTPS redirects by moving the call to http.Serve into safeweb. This makes linting for other uses of http.Serve easier without having to account for false positives created by the old interface. Updates https://github.com/tailscale/corp/issues/8027 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>	8 months ago
James Tucker	f384742375	net/packet: allow more ICMP errors ... We now allow some more ICMP errors to flow, specifically: - ICMP parameter problem in both IPv4 and IPv6 (corrupt headers) - ICMP Packet Too Big (for IPv6 PMTU) Updates #311 Updates #8102 Updates #11002 Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
Irbe Krumina	92ca770b8d	util/linuxfw: fix MSS clamping in nftables mode (#11588) ... MSS clamping for nftables was mostly not ran due to to an earlier rule in the FORWARD chain issuing accept verdict. This commit places the clamping rule into a chain of its own to ensure that it gets ran. Updates tailscale/tailscale#11002 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	8 months ago
Kyle Carberry	27038ee3c2	hostinfo: cache device model to speed up init ... This was causing a relatively consistent ~10ms of delay on Linux. Signed-off-by: Kyle Carberry <kyle@carberry.com>	8 months ago
Brad Fitzpatrick	ec87e219ae	logtail: delete unused code from old way to configure zstd ... Updates #cleanup Change-Id: I666ecf08ea67e461adf2a3f4daa9d1753b2dc1e4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Joe Tsai	e2586bc674	logtail: always zstd compress with FastestCompression and LowMemory (#11583) ... This is based on empirical testing using actual logs data. FastestCompression only incurs a marginal <1% compression ratio hit for a 2.25x reduction in memory use for small payloads (which are common if log uploads happen at a decently high frequency). The memory savings for large payloads is much lower (less than 1.1x reduction). LowMemory only incurs a marginal <5% hit on performance for a 1.6-2.0x reduction in memory use for small or large payloads. The memory gains for both settings justifies the loss of benefits, which are arguably minimal. tailscale/corp#18514 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	8 months ago
James Tucker	7558a1d594	ipn/ipnlocal: disable sockstats on (unstable) mobile by default ... We're tracking down a new instance of memory usage, and excessive memory usage from sockstats is definitely not going to help with debugging, so disable it by default on mobile. Updates tailscale/corp#18514 Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
Asutorufa	e20ce7bf0c	net/dns: close ctx when close dns directManager ... Signed-off-by: Asutorufa <16442314+Asutorufa@users.noreply.github.com>	8 months ago
Will Norris	1d2af801fa	.github/workflows: remove go-licenses action ... This is now handled by an action running in corp. Updates tailscale/corp#18803 Signed-off-by: Will Norris <will@tailscale.com>	8 months ago
License Updater	e80b99cdd1	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	8 months ago
Andrew Lytvynov	5aa4cfad06	safeweb: detect mux handler conflicts (#11562) ... When both muxes match, and one of them is a wildcard "/" pattern (which is common in browser muxes), choose the more specific pattern. If both are non-wildcard matches, there is a pattern overlap, so return an error. Updates https://github.com/tailscale/corp/issues/8027 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	8 months ago
Brad Fitzpatrick	e7599c1f7e	logtail: prevent js/wasm clients from picking TLS client cert ... Corp details: https://github.com/tailscale/corp/issues/18177#issuecomment-2026598715 https://github.com/tailscale/corp/pull/18775#issuecomment-2027505036 Updates tailscale/corp#18177 Change-Id: I7c03a4884540b8519e0996088d085af77991f477 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Irbe Krumina	5fb721d4ad	util/linuxfw,wgengine/router: skip IPv6 firewall configuration in partial iptables mode (#11546) ... We have hosts that support IPv6, but not IPv6 firewall configuration in iptables mode. We also have hosts that have some support for IPv6 firewall configuration in iptables mode, but do not have iptables filter table. We should: - configure ip rules for all hosts that support IPv6 - only configure firewall rules in iptables mode if the host has iptables filter table. Updates tailscale/tailscale#11540 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	8 months ago
Patrick O'Doherty	af61179c2f	safeweb: add opt-in inline style CSP toggle (#11551) ... Allow the use of inline styles with safeweb via an opt-in configuration item. This will append `style-src "self" "unsafe-inline"` to the default CSP. The `style-src` directive will be used in lieu of the fallback `default-src "self"` directive. Updates tailscale/corp#8027 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>	8 months ago
Brad Fitzpatrick	b0941b79d6	tsweb: make BucketedStats not track 400s, 404s, etc ... Updates tailscale/corp#18687 Change-Id: I142ccb1301ec4201c70350799ff03222bce96668 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Brad Fitzpatrick	354cac74a9	tsweb/varz: add charset=utf-8 to varz handler ... Some of our labels contain UTF-8 and get mojibaked in the browser right now. Updates tailscale/corp#18687 Change-Id: I6069cffd6cc8813df415f06bb308bc2fc3ab65c4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
James Tucker	9401b09028	control/controlclient: move client watchdog to cover initial request ... The initial control client request can get stuck in the event that a connection is established but then lost part way through, without any ICMP or RST. Ensure that the control client will be restarted by timing out that initial request as well. Fixes #11542 Signed-off-by: James Tucker <james@tailscale.com>	8 months ago
Irbe Krumina	9b5176c4d9	cmd/k8s-operator: fix failing tests (#11541) ... Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	8 months ago
Irbe Krumina	9e2f58f846	cmd/{k8s-nameserver,k8s-operator},k8s-operator: add a kube nameserver, make operator deploy it (#11017) ... * cmd/k8s-nameserver,k8s-operator: add a nameserver that can resolve ts.net DNS names in cluster. Adds a simple nameserver that can respond to A record queries for ts.net DNS names. It can respond to queries from in-memory records, populated from a ConfigMap mounted at /config. It dynamically updates its records as the ConfigMap contents changes. It will respond with NXDOMAIN to queries for any other record types (AAAA to be implemented in the future). It can respond to queries over UDP or TCP. It runs a miekg/dns DNS server with a single registered handler for ts.net domain names. Queries for other domain names will be refused. The intended use of this is: 1) to allow non-tailnet cluster workloads to talk to HTTPS tailnet services exposed via Tailscale operator egress over HTTPS 2) to allow non-tailnet cluster workloads to talk to workloads in the same cluster that have been exposed to tailnet over their MagicDNS names but on their cluster IPs. Updates tailscale/tailscale#10499 Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/k8s-operator/deploy/crds,k8s-operator: add DNSConfig CustomResource Definition DNSConfig CRD can be used to configure the operator to deploy kube nameserver (./cmd/k8s-nameserver) to cluster. Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/k8s-operator,k8s-operator: optionally reconcile nameserver resources Adds a new reconciler that reconciles DNSConfig resources. If a DNSConfig is deployed to cluster, the reconciler creates kube nameserver resources. This reconciler is only responsible for creating nameserver resources and not for populating nameserver's records. Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/{k8s-operator,k8s-nameserver}: generate DNSConfig CRD for charts, append to static manifests Signed-off-by: Irbe Krumina <irbe@tailscale.com> --------- Signed-off-by: Irbe Krumina <irbe@tailscale.com>	8 months ago
Patrick O'Doherty	b60c4664c7	safeweb: return http.Handler from safeweb.RedirectHTTP (#11538) ... Updates #cleanup Change the return type of the safeweb.RedirectHTTP method to a handler that can be passed directly to http.Serve without any http.HandlerFunc wrapping necessary. Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>	8 months ago
Brad Fitzpatrick	3e6306a782	derp/derphttp: make CONNECT Host match request-target's authority-form ... This CONNECT client doesn't match what Go's net/http.Transport does (making the two values match). This makes it match. This is all pretty unspecified but most clients & doc examples show these matching. And some proxy implementations (such as Zscaler) care. Updates tailscale/corp#18716 Change-Id: I135c5facbbcec9276faa772facbde1bb0feb2d26 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	8 months ago
Patrick O'Doherty	8f27520633	safeweb: init (#11467) ... Updates https://github.com/tailscale/corp/issues/8027 Safeweb is a wrapper around http.Server & tsnet that encodes some application security defaults. Safeweb asks developers to split their HTTP routes into two http.ServeMuxs for serving browser and API-facing endpoints repsectively. It then wraps these HTTP routes with the context-appropriate security controls. safeweb.Server#Serve will serve the HTTP muxes over the provided listener. Caller are responsible for creating and tearing down their application's listeners. Applications being served over HTTPS that wish to implement HTTP redirects can use the Server#HTTPRedirect handler to do so. Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>	8 months ago
Andrea Gottardo	008676f76e	cmd/serve: update warning for sandboxed macOS builds (#11530)	8 months ago
Percy Wegmann	66e4d843c1	ipn/localapi: add support for multipart POST to file-put ... This allows sending multiple files via Taildrop in one request. Progress is tracked via ipn.Notify. Updates tailscale/corp#18202 Signed-off-by: Percy Wegmann <percy@tailscale.com>	8 months ago
Percy Wegmann	bed818a978	ipn/localapi: add support for multipart POST to file-put ... This allows sending multiple files via Taildrop in one request. Progress is tracked via ipn.Notify. Updates tailscale/corp#18202 Signed-off-by: Percy Wegmann <percy@tailscale.com>	8 months ago
Maisem Ali	0d8cd1645a	go.mod: bump github.com/gaissmai/bart ... To pick up https://github.com/gaissmai/bart/pull/17. Updates #deps Signed-off-by: Maisem Ali <maisem@tailscale.com>	8 months ago
Percy Wegmann	eb42a16da9	ipn/ipnlocal: report Taildrive access message on failed responses ... For example, if we get a 404 when downloading a file, we'll report access. Also, to reduce verbosty of logs, this elides 0 length files. Updates tailscale/corp#17818 Signed-off-by: Percy Wegmann <percy@tailscale.com>	8 months ago
Andrew Lytvynov	5d41259a63	cmd/tailscale/cli: remove Beta tag from tailscale update (#11529) ... Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	8 months ago
Charlotte Brandhorst-Satzkorn	acb611f034	ipn/localipn: introduce logs for tailfs (#11496) ... This change introduces some basic logging into the access and share pathways for tailfs. Updates tailscale/corp#17818 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	8 months ago