7894 Commits (a21bf100f3e1211240fbd54b49f2ec4c67ee7d92)

 

All Branches   

Search

Author	SHA1	Message	Date
Irbe Krumina	a21bf100f3	cmd/k8s-operator,k8s-operator/sessionrecording,sessionrecording,ssh/tailssh: refactor session recording functionality (#12945) ... cmd/k8s-operator,k8s-operator/sessionrecording,sessionrecording,ssh/tailssh: refactor session recording functionality Refactor SSH session recording functionality (mostly the bits related to Kubernetes API server proxy 'kubectl exec' session recording): - move the session recording bits used by both Tailscale SSH and the Kubernetes API server proxy into a shared sessionrecording package, to avoid having the operator to import ssh/tailssh - move the Kubernetes API server proxy session recording functionality into a k8s-operator/sessionrecording package, add some abstractions in preparation for adding support for a second streaming protocol (WebSockets) Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	4 months ago
Paul Scott	1bf7ed0348	tsweb: add QuietLogging option (#12838) ... Allows the use of tsweb.LogHandler exclusively for callbacks describing the handler HTTP requests. Fixes #12837 Signed-off-by: Paul Scott <paul@tailscale.com>	4 months ago
Irbe Krumina	c5623e0471	go.{mod,sum},tstest/tools,k8s-operator,cmd/k8s-operator: autogenerate CRD API docs (#12884) ... Re-instates the functionality that generates CRD API docs, but using a different library as the one we were using earlier seemed to have some issues with its Git history. Also regenerates the docs (make kube-generate-all). Updates tailscale/tailscale#12859 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	4 months ago
Ross Williams	1bf82ddf84	util/osuser: run getent on non-Linux Unixes ... Remove the restriction that getent is skipped on non-Linux unixes. Improve validation of the parsed output from getent, in case unknown systems return unusable information. Fixes #12730. Signed-off-by: Ross Williams <ross@ross-williams.net>	4 months ago
Andrea Gottardo	6840f471c0	net/dnsfallback: set CanPort80 in static DERPMap (#12929) ... Updates tailscale/corp#21949 As discussed with @raggi, this PR updates the static DERPMap embedded in the client to reflect the availability of HTTP on the DERP servers run by Tailscale. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	4 months ago
Andrea Gottardo	90be06bd5b	health: introduce captive-portal-detected Warnable (#12707) ... Updates tailscale/tailscale#1634 This PR introduces a new `captive-portal-detected` Warnable which is set to an unhealthy state whenever a captive portal is detected on the local network, preventing Tailscale from connecting. ipn/ipnlocal: fix captive portal loop shutdown Change-Id: I7cafdbce68463a16260091bcec1741501a070c95 net/captivedetection: fix mutex misuse ipn/ipnlocal: ensure that we don't fail to start the timer Change-Id: I3e43fb19264d793e8707c5031c0898e48e3e7465 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	4 months ago
Brad Fitzpatrick	cf97cff33b	wgengine/netstack: simplify netaddrIPFromNetstackIP ... Updates #cleanup Change-Id: I66878b08a75d44170460cbf33c895277c187bd8d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 months ago
Paul Scott	855da47777	tsweb: Add MiddlewareStack func to apply lists of Middleware (#12907) ... Fixes #12909 Signed-off-by: Paul Scott <paul@tailscale.com>	4 months ago
Nick Khyl	43375c6efb	types/lazy: re-init SyncValue during test cleanup if it wasn't set before SetForTest ... Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 months ago
Paul Scott	ba7f2d129e	tsweb: log all cancellations as 499s (#12894) ... Updates #12141 Signed-off-by: Paul Scott <paul@tailscale.com>	4 months ago
Irbe Krumina	57856fc0d5	ipn,wgengine/magicsock: allow setting static node endpoints via tailscaled configfile (#12882) ... wgengine/magicsock,ipn: allow setting static node endpoints via tailscaled config file. Adds a new StaticEndpoints field to tailscaled config that can be used to statically configure the endpoints that the node advertizes. This field will replace TS_DEBUG_PRETENDPOINTS env var that can be used to achieve the same. Additionally adds some functionality that ensures that endpoints are updated when configfile is reloaded. Also, refactor configuring/reconfiguring components to use the same functionality when configfile is parsed the first time or subsequent times (after reload). Previously a configfile reload did not result in resetting of prefs. Now it does- but does not yet tell the relevant components to consume the new prefs. This is to be done in a follow-up. Updates tailscale/tailscale#12578 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	4 months ago
License Updater	9904421853	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	4 months ago
Nick Khyl	5d09649b0b	types/lazy: add (*SyncValue[T]).SetForTest method ... It is sometimes necessary to change a global lazy.SyncValue for the duration of a test. This PR adds a (*SyncValue[T]).SetForTest method to facilitate that. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 months ago
Nick Khyl	d500a92926	util/slicesx: add HasPrefix, HasSuffix, CutPrefix, and CutSuffix functions ... The standard library includes these for strings and byte slices, but it lacks similar functions for generic slices of comparable types. Although they are not as commonly used, these functions are useful in scenarios such as working with field index sequences (i.e., []int) via reflection. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 months ago
Flakes Updater	1f94047475	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	4 months ago
Nick Khyl	bd54b61746	types/opt: add (Value[T]).GetOr(def T) T method ... Updates #12736 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 months ago
Nick Khyl	20562a4fb9	cmd/viewer, types/views, util/codegen: add viewer support for custom container types ... This adds support for container-like types such as Container[T] that don't explicitly specify a view type for T. Instead, a package implementing a container type should also implement and export a ContainerView[T, V] type and a ContainerViewOf(*Container[T]) ContainerView[T, V] function, which returns a view for the specified container, inferring the element view type V from the element type T. Updates #12736 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 months ago
Andrew Lytvynov	e7bf6e716b	cmd/tailscale: add --min-validity flag to the cert command (#12822) ... Some users run "tailscale cert" in a cron job to renew their certificates on disk. The time until the next cron job run may be long enough for the old cert to expire with our default heristics. Add a `--min-validity` flag which ensures that the returned cert is valid for at least the provided duration (unless it's longer than the cert lifetime set by Let's Encrypt). Updates #8725 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	4 months ago
Lee Briggs	32ce18716b	Add extra environment variables in deployment template (#12858) ... Fixes #12857 Signed-off-by: Lee Briggs <lee@leebriggs.co.uk>	4 months ago
Irbe Krumina	0f57b9340b	cmd/k8s-operator,tstest,go.{mod,sum}: remove fybrik.io/crdoc dependency (#12862) ... Remove fybrik.io/crdoc dependency as it is causing issues for folks attempting to vendor tailscale using GOPROXY=direct. This means that the CRD API docs in ./k8s-operator/api.md will no longer be generated- I am going to look at replacing it with another tool in a follow-up. Updates tailscale/tailscale#12859 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	4 months ago
Paul Scott	b2c522ce95	tsweb: log cancelled requests as 499 ... Fixes #12860 Signed-off-by: Paul Scott <paul@tailscale.com>	4 months ago
Adrian Dewhurst	54f58d1143	ipn/ipnlocal: add comment explaining auto exit node migration ... Updates tailscale/corp#19681 Change-Id: I6d396780b058ff0fbea0e9e53100f04ef3b76339 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 months ago
Mario Minardi	485018696a	{tool,client}: bump node version (#12840) ... Bump node version to latest lts on the 18.x line which is 18.20.4 at the time of writing. Updates https://github.com/tailscale/corp/issues/21741 Signed-off-by: Mario Minardi <mario@tailscale.com>	4 months ago
Nick Khyl	1608831c33	wgengine/router: use quad-100 as the nexthop on Windows ... Windows requires routes to have a nexthop. Routes created using the interface's local IP address or an unspecified IP address ("0.0.0.0" or "::") as the nexthop are considered on-link routes. Notably, Windows treats on-link subnet routes differently, reserving the last IP in the range as the broadcast IP and therefore prohibiting TCP connections to it, resulting in WSA error 10049: "The requested address is not valid in its context. This does not happen with single-host routes, such as routes to Tailscale IP addresses, but becomes a problem with advertised subnets when all IPs in the range should be reachable. Before Windows 8, only routes created with an unspecified IP address were considered on-link, so our previous approach of using the interface's own IP as the nexthop likely worked on Windows 7. This PR updates configureInterface to use the TailscaleServiceIP (100.100.100.100) and its IPv6 counterpart as the nexthop for subnet routes. Fixes tailscale/support-escalations#57 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 months ago
Brad Fitzpatrick	d3af54444c	client/tailscale: document ACLTestFailureSummary.User field ... And justify its legacy name. Updates #1931 Change-Id: I3eff043679bf8f046aed6e2c4fb7592fe2e66514 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 months ago
Paul Scott	d97cddd876	tsweb: swallow panics ... With this change, the error handling and request logging are all done in defers after calling inner.ServeHTTP. This ensures that any recovered values which we want to re-panic with retain a useful stacktrace. However, we now only re-panic from errorHandler when there's no outside logHandler. Which if you're using StdHandler there always is. We prefer this to ensure that we are able to write a 500 Internal Server Error to the client. If a panic hits http.Server then the response is not sent back. Updates #12784 Signed-off-by: Paul Scott <paul@tailscale.com>	4 months ago
Brad Fitzpatrick	f77821fd63	derp/derphttp: determine whether a region connect was to non-ideal node ... ... and then do approximately nothing with that information, other than a big TODO. This is mostly me relearning this code and leaving breadcrumbs for others in the future. Updates #12724 Signed-off-by: Brad Fitzpatrick <brad@danga.com>	4 months ago
Brad Fitzpatrick	0b32adf9ec	hostinfo: set Hostinfo.PackageType for mkctr container builds ... Fixes tailscale/corp#21448 Change-Id: Id60fb5cd7d31ef94cdbb176141e034845a480a00 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 months ago
Cameron Stokes	1ac14d7216	Dockerfile: remove warning (#12841) ... Fixes tailscale/tailscale#12842 Signed-off-by: Cameron Stokes <cameron@cameronstokes.com>	4 months ago
Aaron Klotz	4ff276cf52	VERSION.txt: this is v1.71.0 ... Signed-off-by: Aaron Klotz <aaron@tailscale.com>	4 months ago
Irbe Krumina	2742153f84	cmd/k8s-operator: add a metric to track the amount of ProxyClass resources (#12833) ... Updates tailscale/tailscale#10709 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	4 months ago
Paul Scott	646990a7d0	tsweb: log once per request ... StdHandler/retHandler would previously emit one log line for each request. If there were multiple StdHandler in the chain, there would be one log line per instance of retHandler. With this change, only the outermost StdHandler/logHandler actually logs the request or invokes OnStart or OnCompletion callbacks. The error-rendering part of retHandler lives on in errorHandler, and errorHandler passes those errors up the stack to logHandler through a callback that logHandler places in the request.Context(). Updates tailscale/corp#19999 Signed-off-by: Paul Scott <paul@tailscale.com>	4 months ago
Adrian Dewhurst	8882c6b730	ipn/ipnlocal: wait for DERP before auto exit node migration ... Updates tailscale/corp#19681 Change-Id: I31dec154aa3b5edba01f10eec37640f631729cb2 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 months ago
License Updater	35d2efd692	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	4 months ago
Anton Tolchanov	fc074a6b9f	client/tailscale: add the nodeAttrs section ... This change allows ACL contents to include node attributes https://tailscale.com/kb/1337/acl-syntax#node-attributes-nodeattrs Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 months ago
Paul Scott	014bf25c0a	tsweb: fix TestStdHandler_panic flake ... Fixes #12816 Signed-off-by: Paul Scott <paul@tailscale.com>	4 months ago
Adrian Dewhurst	0834712c91	ipn: allow FQDN in exit node selection ... To match the format of exit node suggestions and ensure that the result is not ambiguous, relax exit node CLI selection to permit using a FQDN including the trailing dot. Updates #12618 Change-Id: I04b9b36d2743154aa42f2789149b2733f8555d3f Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 months ago
Paul Scott	fec41e4904	tsweb: add stack trace to panic error msg ... Updates #12784 Signed-off-by: Paul Scott <paul@tailscale.com>	4 months ago
Nick Khyl	fd0acc4faf	cmd/cloner, cmd/viewer: add _test prefix for files generated with the test build tag ... Updates #12736 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 months ago
Fran Bull	380a3a0834	appc: track metrics for route info storing ... Track how often we're writing state and how many routes we're writing. Updates #11008 Signed-off-by: Fran Bull <fran@tailscale.com>	4 months ago
Anton Tolchanov	5d61d1c7b0	log/sockstatlog: don't block for more than 5s on shutdown ... Fixes tailscale/corp#21618 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 months ago
Linus Brogan	9609b26541	cmd/tailscale: resolve taildrive share paths ... Fixes #12258. Signed-off-by: Linus Brogan <git@linusbrogan.com>	4 months ago
Anton Tolchanov	7403d8e9a8	logtail: close idle HTTP connections on shutdown ... Fixes tailscale/corp#21609 Co-authored-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Anton Tolchanov <anton@tailscale.com>	4 months ago
Jordan Whited	f0b9d3f477	net/tstun: fix docstring for Wrapper.SetWGConfig (#12796) ... Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	4 months ago
Andrea Gottardo	3f3edeec07	health: drop unnecessary logging in TestSetUnhealthyWithTimeToVisible (#12795) ... Fixes tailscale/tailscale#12794 We were printing some leftover debug logs within a callback function that would be executed after the test completion, causing the test to fail. This change drops the log calls to address the issue. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	4 months ago
Brad Fitzpatrick	808b4139ee	wgengine/magicsock: use wireguard-go/conn.PeerAwareEndpoint ... If we get an non-disco presumably-wireguard-encrypted UDP packet from an IP:port we don't recognize, rather than drop the packet, give it to WireGuard anyway and let WireGuard try to figure out who it's from and tell us. This uses the new hook added in https://github.com/tailscale/wireguard-go/pull/27 Updates tailscale/corp#20732 Change-Id: I5c61a40143810592f9efac6c12808a87f924ecf2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 months ago
Claire Wang	49bf63cdd0	ipn/ipnlocal: check for offline auto exit node in SetControlClientStatus (#12772) ... Updates tailscale/corp#19681 Signed-off-by: Claire Wang <claire@tailscale.com>	4 months ago
Joe Tsai	d209b032ab	syncs: add Map.WithLock to allow mutations to the underlying map (#8101) ... Some operations cannot be implemented with the prior API: * Iterating over the map and deleting keys * Iterating over the map and replacing items * Calling APIs that expect a native Go map Add a Map.WithLock method that acquires a write-lock on the map and then calls a user-provided closure with the underlying Go map. This allows users to interact with the Map as a regular Go map, but with the gaurantees that it is concurrent safe. Updates tailscale/corp#9115 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	4 months ago
Nick Khyl	fc28c8e7f3	cmd/cloner, cmd/viewer, util/codegen: add support for generic types and interfaces ... This adds support for generic types and interfaces to our cloner and viewer codegens. It updates these packages to determine whether to make shallow or deep copies based on the type parameter constraints. Additionally, if a template parameter or an interface type has View() and Clone() methods, we'll use them for getters and the cloner of the owning structure. Updates #12736 Signed-off-by: Nick Khyl <nickk@tailscale.com>	4 months ago
Andrea Gottardo	b7c3cfe049	health: support delayed Warnable visibility (#12783) ... Updates tailscale/tailscale#4136 To reduce the likelihood of presenting spurious warnings, add the ability to delay the visibility of certain Warnables, based on a TimeToVisible time.Duration field on each Warnable. The default is zero, meaning that a Warnable is immediately visible to the user when it enters an unhealthy state. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	4 months ago