6042 Commits (ab970fe55dcaa38fe9675a948b3c103929d6347e)

 

All Branches   

Search

Author	SHA1	Message	Date
James Tucker	ab970fe55d	VERSION.txt: this is v1.48.2 ... Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
James Tucker	ffd89ac66b	wgengine/magicsock: improve endpoint selection for WireGuard peers with rx time ... If we don't have the ICMP hint available, such as on Android, we can use the signal of rx traffic to bias toward a particular endpoint. We don't want to stick to a particular endpoint for a very long time without any signals, so the sticky time is reduced to 1 second, which is large enough to avoid excessive packet reordering in the common case, but should be small enough that either rx provides a strong signal, or we rotate in a user-interactive schedule to another endpoint, improving the feel of failover to other endpoints. Updates #8999 Cherry picked from 1a8b7af39036443cc328513746324715108a1292 Co-authored-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com> Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	9 months ago
James Tucker	8b36386530	wgengine/magicsock: clear out endpoint statistics when it becomes bad ... There are cases where we do not detect the non-viability of a route, but we will instead observe a failure to send. In a Disco path this would normally be handled as a side effect of Disco, which is not available to non-Disco WireGuard nodes. In both cases, recognizing the failure as such will result in faster convergence. Updates #8999 Cherry picked from 9f515676ce90c6bb438afbf7ca2b4be9f2a98c24 Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Charlotte Brandhorst-Satzkorn	572b0a43c6	wgengine/magicsock: update lastfullping comment to include wg only ... LastFullPing is now used for disco or wireguard only endpoints. This change updates the comment to make that clear. Updates #7826 Cherry picked from 274db2fdd3ecbec93947b2460a9d574fba1f7537 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	9 months ago
James Tucker	7a1205d010	wgengine/magicsock: clear endpoint state in noteConnectivityChange ... There are latency values stored in bestAddr and endpointState that are no longer applicable after a connectivity change and should be cleared out, following the documented behavior of the function. Updates #8999 Cherry picked from 92718070f206fa8a31fe4e11403c7fdb38db26ab Signed-off-by: James Tucker <james@tailscale.com>	9 months ago
Andrew Lytvynov	0e9f04c83c	VERSION.txt: this is v1.48.1 ... Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	9 months ago
Andrew Lytvynov	bd914d5186	net/portmapper: never select port 0 in UPnP (#8996) ... Port 0 is interpreted, per the spec (but inconsistently among router software) as requesting to map every single available port on the UPnP gateway to the internal IP address. We'd previously avoided picking ports below 1024 for one of the two UPnP methods (in #7457), and this change moves that logic so that we avoid it in all cases. Updates #8992 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I20d652c0cd47a24aef27f75c81f78ae53cc3c71e (cherry picked from commit 77ff705545) Co-authored-by: Andrew Dunham <andrew@du.nham.ca>	9 months ago
Andrew Lytvynov	728622665f	1.48 cherry-picks for nftables (#8989) ... * wgengine/router: fall back and set iptables as default again Due to the conflict between our nftables implementation and ufw, which is a common utility used on linux. We now want to take a step back to prevent regression. This will give us more chance to let users to test our nftables support and heuristic. Updates: #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com> (cherry picked from commit 93cab56277) * util/linuxfw: reorganize nftables rules to allow it to work with ufw This commit tries to mimic the way iptables-nft work with the filewall rules. We follow the convention of using tables like filter, nat and the conventional chains, to make our nftables implementation work with ufw. Updates: #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com> (cherry picked from commit b040094b90) * tailcfg: update docs on NetInfo.FirewallMode Updates #391 Change-Id: Ifef196b31dd145f424fb0c0d0bb04565cc22c717 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> (cherry picked from commit 282dad1b62) --------- Co-authored-by: KevinLiang10 <kevinliang@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com>	9 months ago
Andrew Lytvynov	2247011787	clientupdate: parse /etc/synoinfo.conf to get CPU arch (#8940) (#8950) ... The hardware version in `/proc/sys/kernel/syno_hw_version` does not map exactly to versions in https://github.com/SynoCommunity/spksrc/wiki/Synology-and-SynoCommunity-Package-Architectures. It contains some slightly different version formats. Instead, `/etc/synoinfo.conf` exists and contains a `unique` line with the CPU architecture encoded. Parse that out and filter through the list of architectures that we have SPKs for. Tested on DS218 and DS413j. Updates #8927 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	10 months ago
Andrew Lytvynov	77c732357b	VERSION.txt: this is v1.48.0 ... Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	10 months ago
Brad Fitzpatrick	6c791f7d60	derp: include src IPs in mesh watch messages ... Updates tailscale/corp#13945 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
KevinLiang10	7ed3681cbe	tailcfg: Add FirewallMode to NetInfo to record wether host using iptables or nftables ... To record wether user is using iptables or nftables after we add support to nftables on linux, we are adding a field FirewallMode to NetInfo in HostInfo to reflect what firewall mode the host is running, and form metrics. The information is gained from a global constant in hostinfo.go. We set it when selection heuristic made the decision, and magicsock reports this to control. Updates: tailscale/corp#13943 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	10 months ago
Andrew Dunham	95d776bd8c	wgengine/magicsock: only cache N most recent endpoints per-Addr ... If a node is flapping or otherwise generating lots of STUN endpoints, we can end up caching a ton of useless values and sending them to peers. Instead, let's apply a fixed per-Addr limit of endpoints that we cache, so that we're only sending peers up to the N most recent. Updates tailscale/corp#13890 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8079a05b44220c46da55016c0e5fc96dd2135ef8	10 months ago
Will Norris	9c4364e0b7	client/web: copy existing UI to basic react components ... This copies the existing go template frontend into very crude react components that will be driven by a simple JSON api for fetching and updating data. For now, this returns a static set of test data. This just implements the simple existing UI, so I've put these all in a "legacy" component, with the expectation that we will rebuild this with more properly defined components, some pulled from corp. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	10 months ago
Will Norris	ddba4824c4	client/web: add prettier and format scripts ... Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	10 months ago
Brad Fitzpatrick	bd02d00608	ssh/tailssh: fix gokrazy SSH crash ... Stupid mistake in earlier refactor. Updates gokrazy/gokrazy#209 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	25a8daf405	wgengine/router: always use nftables mode on gokrazy ... Updates gokrazy/gokrazy#209 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	17ce75347c	wgengine: adjust debug logging for WireGuard-only peers ... Updates #cleanup Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Sonia Appasamy	1a64166073	cli/serve: add interactive flow for enabling HTTPS certs ... When trying to use serve with https, send users through https cert provisioning enablement before editing the ServeConfig. Updates tailscale/corp#10577 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Sonia Appasamy	0052830c64	cli/serve: funnel interactive enablement flow tweaks ... 1. Add metrics to funnel flow. 2. Stop blocking users from turning off funnels when no longer in their node capabilities. 3. Rename LocalClient.IncrementMetric to IncrementCounter to better callout its usage is only for counter clientmetrics. Updates tailscale/corp#10577 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Sonia Appasamy	8e63d75018	client/tailscale: add LocalClient.IncrementMetric func ... A #cleanup to add a func to utilize the already-present "/localapi/v0/upload-client-metrics" localapi endpoint. Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Aaron Klotz	c17a817769	util/osdiag: add logging for winsock layered service providers to Windows bugreports ... The Layered Service Provider (LSP) is a deprecated (but still supported) mechanism for inserting user-mode DLLs into a filter chain between the Winsock API surface (ie, ws2_32.dll) and the internal user-mode interface to the networking stack. While their use is becoming more rare due to the aforementioned deprecation, it is still possible for third-party software to install their DLLs into this filter chain and interfere with Winsock API calls. Knowing whether this is happening is useful for troubleshooting. Fixes https://github.com/tailscale/tailscale/issues/8142 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	10 months ago
KevinLiang10	411e3364a9	wgengine/router: use iptablesRunner when no firewall tool is available: ... The current router errors out when neither iptables nor nftables support is present. We should fall back to the previous behaviour which we creates a dummy iptablesRunner. Fixes: #8878 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	10 months ago
Sonia Appasamy	12238dab48	client/web: add tailwind styling to react app ... Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Aaron Klotz	b07347640c	util/winutil/authenticode: add missing docs for CertSubjectError ... A #cleanup PR. Signed-off-by: Aaron Klotz <aaron@tailscale.com>	10 months ago
Brad Fitzpatrick	1fcae42055	control/controlclient: move lastUpdateGenInformed to tighter scope ... No need to have it on Auto or be behind a mutex; it's only read/written from a single goroutine. Move it there. Updates tailscale/corp#5761 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	2398993804	control/controlclient: refactor in prep for optimized delta handling ... See issue. This is a baby step towards passing through deltas end-to-end from node to control back to node and down to the various engine subsystems, not computing diffs from two full netmaps at various levels. This will then let us support larger netmaps without burning CPU. But this change itself changes no behavior. It just changes a func type to an interface with one method. That paves the way for future changes to then add new NetmapUpdater methods that do more fine-grained work than updating the whole world. Updates #1909 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Denton Gentry	4940a718a1	scripts/installer.sh: set Deepin to a debian version ... Deepin Linux 20.x reports its version as "apricot" Set it to bullseye, the Debian version it corresponds to. Also fix the installer CI: OpenSUSE Leap appears to have removed curl from the base image recently, we have to install it now. Fixes https://github.com/tailscale/tailscale/issues/8850 Updates https://github.com/tailscale/tailscale/issues/7862 Updates https://github.com/tailscale/corp/issues/8952 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	10 months ago
M. J. Fromberger	9e24a6508a	control/controlclient: avert a data race when logging (#8863) ... The read of the synced field for logging takes place outside the lock, and races with other (locked) writes of this field, including for example the one at current line 556 in mapRoutine. Updates tailscale/corp#13856 Change-Id: I056b36d7a93025aafdf73528dd7645f10b791af6 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	10 months ago
Andrew Lytvynov	c40d095c35	clientupdate: implement updates for Synology (#8858) ... Implement naive update for Synology packages, using latest versions from pkgs.tailscale.com. This is naive because we completely trust pkgs.tailscale.com to give us a safe package. We should switch this to some better signing mechanism later. I've only tested this on one DS218 box, so all the CPU architecture munging is purely based on docs. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	10 months ago
Brad Fitzpatrick	a1b8d703d6	tstime/mono: remove unsafe ... This removes the unsafe/linkname and only uses the standard library. It's a bit slower, for now, but https://go.dev/cl/518336 should get us back. On darwin/arm64, without https://go.dev/cl/518336 pkg: tailscale.com/tstime/mono │ before │ after │ │ sec/op │ sec/op vs base │ MonoNow-8 16.20n ± 0% 19.75n ± 0% +21.92% (p=0.000 n=10) TimeNow-8 39.46n ± 0% 39.40n ± 0% -0.16% (p=0.002 n=10) geomean 25.28n 27.89n +10.33% And with it, MonoNow-8 16.34n ± 1% 16.93n ± 0% +3.67% (p=0.001 n=10) TimeNow-8 39.55n ± 15% 38.46n ± 1% -2.76% (p=0.000 n=10) geomean 25.42n 25.52n +0.41% Updates #8839 Updates tailscale/go#70 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
shayne	cc3caa4b2a	hostinfo: add Home Assistant Add-On detection (#8857) ... Fixes #8856 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	10 months ago
James Tucker	de8e55fda6	net/netcheck,wgengine/magicsock: reduce coupling between netcheck and magicsock ... Netcheck no longer performs I/O itself, instead it makes requests via SendPacket and expects users to route reply traffic to ReceiveSTUNPacket. Netcheck gains a Standalone function that stands up sockets and goroutines to implement I/O when used in a standalone fashion. Magicsock now unconditionally routes STUN traffic to the netcheck.Client that it hosts, and plumbs the send packet sink. The CLI is updated to make use of the Standalone mode. Fixes #8723 Signed-off-by: James Tucker <james@tailscale.com>	10 months ago
Sonia Appasamy	d5ac18d2c4	client/web: add tsconfig.json ... Also allows us to use absolute import paths (see change in index.tsx). Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Maisem Ali	21e32b23f7	.github: use testwrapper on windows ... Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	10 months ago
Sonia Appasamy	3f12b9c8b2	client/web: pipe through to React in dev mode ... Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Maisem Ali	98ec8924c2	ipn/ipnlocal,net/tsdial: update docs/rename funcs ... Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	10 months ago
Brad Fitzpatrick	92fc9a01fa	cmd/tailscale: add debug commands to break connections ... For testing reconnects. Updates tailscale/corp#5761 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
salman aljammaz	99e06d3544	magicsock: set the don't fragment sockopt (#8715) ... This sets the Don't Fragment flag, for now behind the TS_DEBUG_ENABLE_PMTUD envknob. Updates #311. Signed-off-by: Val <valerie@tailscale.com> Signed-off-by: salman <salman@tailscale.com>	10 months ago
Sonia Appasamy	16bc9350e3	client/web: add barebones vite dev setup ... Currently just serving a "Hello world" page when running the web cli in --dev mode. Updates tailscale/corp#13775 Co-authored-by: Will Norris <will@tailscale.com> Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Andrew Lytvynov	215480a022	cmd/tailscale/cli,clientupdate: extract new clientupdate package (#8827) ... Extract the self-update logic from cmd/tailscale/cli into a standalone package that could be used from tailscaled later. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	10 months ago
Sonia Appasamy	53c722924b	tool/{node,yarn}: update node and yarn tools ... Syncing these up with what we've got in corp. Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Maisem Ali	d16946854f	control/controlclient: add Auto.updateRoutine ... Instead of having updates replace the map polls, create a third goroutine which is solely responsible for making sure that control is aware of the latest client state. This also makes it so that the streaming map polls are only broken when there are auth changes, or the client is paused. Updates tailscale/corp#5761 Signed-off-by: Maisem Ali <maisem@tailscale.com>	10 months ago
Brad Fitzpatrick	7a5263e6d0	util/linuxfw: rename ErrorFWModeNotSupported ... Go style is for error variables to start with "err" (or "Err") and for error types to end in "Error". Updates #cleanup Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Will Norris	3d56cafd7d	tsnet: add new example serving the Tailscale web client ... Updates tailscale/corp#13775 Co-authored-by: Sonia Appasamy <sonia@tailscale.com> Signed-off-by: Will Norris <will@tailscale.com> Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Will Norris	6ee85ba412	client/web: fix rendering of node owner profile ... Fixes #8837 Signed-off-by: Will Norris <will@tailscale.com>	10 months ago
Sonia Appasamy	2bc98abbd9	client/web: add web client Server struct ... Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Sonia Appasamy	7815fbe17a	tailscale/cli: add interactive flow for enabling Funnel ... Updates tailscale/corp#10577 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Andrew Lytvynov	90081a25ca	control/controlhttp: remove tstest.Clock from tests (#8830) ... These specific tests rely on some timers in the controlhttp code. Without time moving forward and timers triggering, the tests fail. Updates #8587 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	10 months ago
Aaron Klotz	3d2e35c053	util/winutil/authenticode: fix an inaccurate doc comment ... A #cleanup PR Signed-off-by: Aaron Klotz <aaron@tailscale.com>	10 months ago