tailscale

Commit Graph

Author	SHA1	Message	Date
Anton Tolchanov	bd47e28638	prober: optionally spread probes over time By default all probes with the same probe interval that have been added together will run on a synchronized schedule, which results in spiky resource usage and potential throttling by third-party systems (for example, OCSP servers used by the TLS probes). To address this, prober can now run in "spread" mode that will introduce a random delay before the first run of each probe. Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Charlotte Brandhorst-Satzkorn	adec726fee	words: for charlotte, by charlotte (#6002 ) What's better than getting a community request? A community request from another Charlotte! Bun and hops! Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	2 years ago
Maisem Ali	74637f2c15	wgengine/router: [linux] add before deleting interface addrs Deleting may temporarily result in no addrs on the interface, which results in all other rules (like routes) to get dropped by the OS. I verified this fixes the problem. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Charlotte Brandhorst-Satzkorn	95f630ced0	words: beaver, the cutest of them all (#6001 ) Beavers have scales, on their tails. Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	2 years ago
phirework	d13c9cdfb4	wgengine/magicsock: set up pathfinder (#5994 ) Sets up new file for separate silent disco goroutine, tentatively named pathfinder for now. Updates #540 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Jenny Zhang <jz@tailscale.com>	2 years ago
Brad Fitzpatrick	deac82231c	wgengine/magicsock: add start of alternate send path During development of silent disco (#540), an alternate send policy for magicsock that doesn't wake up the radio frequently with heartbeats, we want the old & new policies to coexist, like we did previously pre- and post-disco. We started to do that earlier in `5c42990c2f` but only set up the env+control knob plumbing to set a bool about which path should be used. This starts to add a way for the silent disco code to update the send path from a separate goroutine. (Part of the effort is going to de-state-machinify the event based soup that is the current disco code and make it more Go synchronous style.) So far this does nothing. (It does add an atomic load on each send but that should be noise in the grand scheme of things, and a even more rare atomic store of nil on node config changes.) Baby steps. Updates #540 Co-authored-by: Jenny Zhang <jz@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Anton Tolchanov	69f61dcad8	prober: add a DERP probe manager based on derpprobe This ensures that each DERP server is probed individually (TLS and STUN) and also manages per-region mesh probing. Actual probing code has been copied from cmd/derpprobe. Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Charlotte Brandhorst-Satzkorn	f39847aa52	words: double double tails and trouble, scales aflame and puns abubble (#5992 ) Months upon months I ponder about this, Adding new words onto our little lists. Given our integrity I should not have missed, Including the creatures from folklore and myth. Carefully curated, many of them hiss, Don't forget about the ones hiding in the abyss. Now they are added, I cannot resist, Searching for more words for me to enlist. Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	2 years ago
Brad Fitzpatrick	afce773aae	ipn: remove handle.go It was unused in this repo. The Windows client used it, but it can move there. Change-Id: I572816fd80cbbf1b8db734879b6280857d5bd2a7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	18c61afeb9	types/key: add ChallengePublic, ChallengePrivate, NewChallenge Updates #5972 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	d0b7a44840	api.md: add expirySeconds as parameter to post Tailnet keys Updates #4570 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	e966f024b0	net/dns: print systemd-resolved ResolvConfMode The ResolvConfMode property is documented to return how systemd-resolved is currently managing /etc/resolv.conf. Include that information in the debug line, when available, to assist in debugging DNS issues. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1ae3a257df1d318d0193a8c7f135c458ec45093e	2 years ago
Andrew Dunham	223126fe5b	cmd/derper, net/netcheck: add challenge/response to generate_204 endpoint The Lufthansa in-flight wifi generates a synthetic 204 response to the DERP server's /generate_204 endpoint. This PR adds a basic challenge/response to the endpoint; something sufficiently complicated that it's unlikely to be implemented by a captive portal. We can then check for the expected response to verify whether we're being MITM'd. Follow-up to #5601 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I94a68c9a16a7be7290200eea6a549b64f02ff48f	2 years ago
Anton Tolchanov	d499afac78	net/interfaces: improve default route detection Instead of treating any interface with a non-ifscope route as a potential default gateway, now verify that a given route is actually a default route (0.0.0.0/0 or ::/0). Fixes #5879 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Anton Tolchanov	9c2ad7086c	net/interfaces: deduplicate route table parsing on Darwin and FreeBSD Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Mihai Parparita	9d04ffc782	net/wsconn: add back custom wrapper for turning a websocket.Conn into a net.Conn We removed it in #4806 in favor of the built-in functionality from the nhooyr.io/websocket package. However, it has an issue with deadlines that has not been fixed yet (see nhooyr/websocket#350). Temporarily go back to using a custom wrapper (using the fix from our fork) so that derpers will stop closing connections too aggressively. Updates #5921 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maya Kaczorowski	d00b095f14	.github: update issue templates (#5978 ) Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com> Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com>	2 years ago
Brad Fitzpatrick	9475801ebe	ipn/ipnlocal: fix E.G.G. port number accounting Change-Id: Id35461fdde79448372271ba54f6e6af586f2304d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	37da617380	.github/workflows: use fast compression for NPM package CI check Starting with #5946 we're compressing main.wasm when building the package, but that should not show down the CI check. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Mihai Parparita	7741e9feb0	cmd/tsconnect: add progress and connection callbacks Allows UI to display slightly more fine-grained progress when the SSH connection is being established. Updates tailscale/corp#7186 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Brad Fitzpatrick	246274b8e9	control/controlhttp: allow setting, getting Upgrade headers in Noise upgrade Not currently used, but will allow us to usually remove a round-trip for a future feature. Updates #5972 Change-Id: I2770ea28e3e6ec9626d1cbb505a38ba51df7fba2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
License Updater	03ecf335f7	licenses: update android licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Joe Tsai	14100c0985	wgengine/magicsock: restore allocation-free endpoint.DstToString (#5971 ) The wireguard-go code unfortunately calls this unconditionally even when verbose logging is disabled. Partial revert of #5911. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	45b7e8c23c	cmd/tailscale: make tailscale cert --serve-demo accept optional listen argument Change-Id: I48f2f4f74c9996b9ed4bee02c61f125d42154a34 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	630bcb5b67	tsnet,client/tailscale: add APIClient which runs API over Noise. Updates tailscale/corp#4383 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	e8a11f6181	tka: make rotation signatures use nested keyID Duplicating this at each layer doesnt make any sense, and is another invariant where things could go wrong. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Xe Iaso	86c5bddce2	tsnet/examples/tshello: update example for LocalClient method (#5966 ) Before this would silently fail if this program was running on a machine that was not already running Tailscale. This patch changes the WhoIs call to use the tsnet.Server LocalClient instead of the global tailscale LocalClient. Signed-off-by: Xe <xe@tailscale.com> Signed-off-by: Xe <xe@tailscale.com>	2 years ago
Joe Tsai	9116e92718	cmd/netlogfmt: new package to pretty print network traffic logs (#5930 ) This package parses a JSON stream of netlog.Message from os.Stdin and pretty prints the contents as a stream of tables. It supports reverse lookup of tailscale IP addresses if given an API key and the tailnet that these traffic logs belong to. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	9ee3df02ee	wgengine/magicsock: remove endpoint.wgEndpoint (#5911 ) This field seems seldom used and the documentation is wrong. It is simpler to just derive its original value dynamically when endpoint.DstToString is called. This method is potentially used by wireguard-go, but not in any code path is performance sensitive. All calls to it use it in conjunction with fmt.Printf, which is going to be slow anyways since it uses Go reflection. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
dependabot[bot]	3a33895f1b	.github: Bump peter-evans/create-pull-request from 4.1.1 to 4.1.4 (#5965 ) * .github: Bump peter-evans/create-pull-request from 4.1.1 to 4.1.4 * Update semantic version comment. Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 4.1.1 to 4.1.4. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](`18f90432be...ad43dccb4d`) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: M. J. Fromberger <fromberger@tailscale.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: M. J. Fromberger <fromberger@tailscale.com>	2 years ago
Andrew Dunham	a4e707bcf0	control/controlhttp: try to avoid flakes in TestDialPlan Updates tailscale/corp#7446 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ifcf3b5176f065c2e67cbb8943f6356dea720a9c5	2 years ago
Denton Gentry	b55761246b	prober: add utilities to generate alerts and warnings. sendAlert will trigger the Incident Response system. sendWarning will post to Slack. Co-authored-by: M. J. Fromberger <fromberger@tailscale.com> Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Maisem Ali	af966391c7	kube: handle 201 as a valid status code. Fixes tailscale/corp#7478 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Denton Gentry	19dfdeb1bb	cmd/tailscale: correct --cpu-profile help text Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Charlotte Brandhorst-Satzkorn	4eed2883db	words: space, the final frontier (#5952 ) Captains log. Stardate 100386.37. Work is proceeding on the Words list as Tailscalars are forced to scavenge for more taily and scaley things. Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	2 years ago
Andrew Dunham	c32f9f5865	cmd/tailscale, ipn: enable debug logs when --report flag is passed to bugreport (#5830 ) Change-Id: Id22e9f4a2dcf35cecb9cd19dd844389e38c922ec Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Andrew Dunham	64ea60aaa3	derp: add TCP RTT metric on Linux (#5949 ) Periodically poll the TCP RTT metric from all open TCP connections and update a (bucketed) histogram metric. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6214902196b05bf7829c9d0ea501ce0e13d984cf	2 years ago
Brad Fitzpatrick	a04f1ff9e6	logtail: default to 2s log flush delay on all platforms Per chat. This is close enough to realtime but massively reduces number of HTTP requests. (which you can verify with TS_DEBUG_LOGTAIL_WAKES and watching tailscaled run at start) By contrast, this is set to 2 minutes on mobile. Change-Id: Id737c7924d452de5c446df3961f5e94a43a33f1f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	63ad49890f	cmd/tsconnect: pre-compress main.wasm when building the NPM package This way we can do that once (out of band, in the GitHub action), instead of increasing the time of each deploy that uses the package. .wasm is removed from the list of automatically pre-compressed extensions, an OSS bump and small change on the corp side is needed to make use of this change. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
License Updater	899b4cae10	licenses: update win/apple licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Tom DNetto	a515fc517b	ipn/ipnlocal: make tkaSyncIfNeeded exclusive with a mutex Running corp/ipn#TestNetworkLockE2E has a 1/300 chance of failing, and deskchecking suggests thats whats happening are two netmaps are racing each other to be processed through tkaSyncIfNeededLocked. This happens in the first place because we release b.mu during network RPCs. To fix this, we make the tka sync logic an exclusive section, so two netmaps will need to wait for tka sync to complete serially (which is what we would want anyway, as the second run through probably wont need to sync). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	227777154a	control/controlclient,ipn/ipnlocal,tailcfg: rotate node-key signature on register CAPVER 47 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Anton Tolchanov	26af329fde	prober: expand certificate verification logic in the TLS prober TLS prober now checks validity period for all server certificates and verifies OCSP revocation status for the leaf cert. Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
License Updater	39d03b6b63	licenses: update win/apple licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Maisem Ali	3555a49518	net/dns: always attempt to read the OS config on macOS/iOS Also reconfigure DNS on iOS/macOS on link changes. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
James Tucker	539c073cf0	wgengine/magicsock: set UDP socket buffer sizes to 7MB - At high data rates more buffer space is required in order to avoid packet loss during any cause of delay. - On slower machines more buffer space is required in order to avoid packet loss while decryption & tun writing is underway. - On higher latency network paths more buffer space is required in order to overcome BDP. - On Linux set with SO_*BUFFORCE to bypass net.core.{r,w}mem_max. - 7MB is the current default maximum on macOS 12.6 - Windows test is omitted, as Windows does not support getsockopt for these options. Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Brad Fitzpatrick	a315336287	logtail: change batched upload mechanism to not use CPU when idle The mobile implementation had a 2 minute ticker going all the time to do a channel send. Instead, schedule it as needed based on activity. Then we can be actually idle for long periods of time. Updates #3363 Change-Id: I0dba4150ea7b94f74382fbd10db54a82f7ef6c29 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Will Norris	d05dd41bc1	api.md: document using '-' value as default tailnet Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Brad Fitzpatrick	9a264dac01	net/netcheck: fix crash in checkCaptivePortal If netcheck happens before there's a derpmap. This seems to only affect Headscale because it doesn't send a derpmap as early? Change-Id: I51e0dfca8e40623e04702bc9cc471770ca20d2c2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	b2855cfd86	derp/derphttp: fix nil pointer dereference when closing a netcheck client NewNetcheckClient only initializes a subset of fields of derphttp.Client, and the Close() call added by #5707 was result in a nil pointer dereference. Make Close() safe to call when using NewNetcheckClient() too. Fixes #5919 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago

1 2 3 4 5 ...

4757 Commits (acf5839dd23dd661edfed1d159ac963251e2380d) All Branches Search

4757 Commits (acf5839dd23dd661edfed1d159ac963251e2380d)

All Branches