tailscale

Commit Graph

Author	SHA1	Message	Date
License Updater	18fa1a0ad7	licenses: update win/apple licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Joe Tsai	2327c6b05f	wgengine/netlog: preserve Tailscale addresses for exit traffic (#6165 ) Exit node traffic is aggregated to protect the privacy of those using an exit node. However, it is reasonable to at least log which nodes are making most use of an exit node. For a node using an exit node, the source will be the taiscale IP address of itself, while the destination will be zeroed out. For a node that serves as an exit node, the source will be zeroed out, while the destination will be tailscale IP address of the node that initiated the exit traffic. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Andrew Dunham	e975cb6b05	ipn/ipnlocal: fix test flake when we log after a test completes This switches from using an atomic.Bool to a mutex for reasons that are described in the commit, and should address the flakes that we're still seeing. Fixes #3020 Change-Id: I4e39471c0eb95886db03020ea1ccf688c7564a11 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Tom DNetto	0af57fce4c	cmd/tailscale,ipn: implement lock sign command Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Joe Tsai	7d6775b082	wgengine: respect --no-logs-no-support flag for network logging (#6172 ) In the future this will cause a node to be unable to join the tailnet if network logging is enabled. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	910db02652	client/tailscale, tsnet, ipn/ipnlocal: prove nodekey ownership over noise Fixes #5972 Change-Id: Ic33a93d3613ac5dbf172d6a8a459ca06a7f9e547 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
License Updater	8c790207a0	licenses: update tailscale{,d} licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Brad Fitzpatrick	a0ed2c2eb5	go.mod: bump golang-x-crypto Fixes #5533 Change-Id: I403de0e9ed5a9a63055242a86720d6f4e0899af7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	06b55ab50f	prober: fix test flake This was tested by running 10000 test iterations and observing no flakes after this change was made. Change-Id: Ib036fd03a3a17800132c53c838cc32bfe2961306 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago
Brad Fitzpatrick	988c1f0ac7	control/controlclient, tailcfg: add support for EarlyNoise payload before http/2 Not yet used, but skipped over, parsed, and tested. Updates #5972 Change-Id: Icd00196959ce266ae16a6c9244bd5e458e2c2947 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	a7f7e79245	cmd/tailscale/cli: hide old, useless --host-routes flag It was from very early Tailscale and no longer makes sense. Change-Id: I31b4e728789f26b0376ebe73aa1b4bbbb1d62607 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	f4ff26f577	types/pad32: delete package Use Go 1.19's new 64-bit alignment ~hidden feature instead. Fixes #5356 Change-Id: Ifcbcb115875a7da01df3bc29e9e7feadce5bc956 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Aoang	60f77ba515	Fix vm ci tests clogging in fork repository pull request fix: https://github.com/tailscale/tailscale/issues/5771 Signed-off-by: Aoang <aoang@x2oe.com>	2 years ago
Maisem Ali	1440742a1c	ssh/tailssh: use root / as cmd.Dir when users HomeDir doesn't exist Fixes #5224 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	2be951a582	cmd/tsconnect: fix null pointer dereference when DNS lookups fail If we never had a chance to open the SSH session we should not try to close it. Fixes #6089 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
License Updater	e2519813b1	licenses: update win/apple licenses Signed-off-by: License Updater <noreply@tailscale.com>	2 years ago
Maisem Ali	42f7ef631e	wgengine/netstack: use 72h as the KeepAlive Idle time for Tailscale SSH Setting TCP KeepAlives for Tailscale SSH connections results in them unnecessarily disconnecting. However, we can't turn them off completely as that would mean we start leaking sessions waiting for a peer to come back which may have gone away forever (e.g. if the node was deleted from the tailnet during a session). Updates #5021 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	d98305c537	cmd,ipn/ipnlocal,tailcfg: implement TKA disablement * Plumb disablement values through some of the internals of TKA enablement. * Transmit the node's TKA hash at the end of sync so the control plane understands each node's head. * Implement /machine/tka/disable RPC to actuate disablement on the control plane. There is a partner PR for the control server I'll send shortly. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Denton Gentry	3d8eda5b72	scripts/install.sh: add RHEL7. Fixes https://github.com/tailscale/tailscale/issues/5729 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Denton Gentry	5677ed1e85	scripts/installer.sh: add Debian Sid (rolling release) There is no VERSION_ID. root@sid:~# cat /etc/os-release PRETTY_NAME="Debian GNU/Linux bookworm/sid" NAME="Debian GNU/Linux" VERSION_CODENAME=bookworm ID=debian HOME_URL="https://www.debian.org/" SUPPORT_URL="https://www.debian.org/support" BUG_REPORT_URL="https://bugs.debian.org/" Fixes https://github.com/tailscale/tailscale/issues/5522 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Denton Gentry	798dba14eb	scripts/install.sh: add openSUSE Leap 15.4 Fixes https://github.com/tailscale/tailscale/issues/6095 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Brad Fitzpatrick	ea24895e08	client/tailscale/apitype, tailcfg: delete never used mysterious PerDomain field It does nothing and never did and I don't think anybody remembers what the original goal for it was. Updates #5229 (fixes, but need to clean it up in another repo too) Change-Id: I81cc6ff44d6d2888bc43e9145437f4c407907ea6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7ad636f5b7	cmd/tailscale/cli: flesh out "tailscale ssh" CLI docs Per user feedback. Fixes #5877 Change-Id: Ib70ad57ec2507244fc54745f4e43c0ce13f51e9c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3336d08d59	cmd/tailscale/cli: make set without args print usage Make "tailscale set" by itself be equivalent to "tailscale set -h" rather than just say "you did it wrong" and make people do another -h step. Change-Id: Iad2b2ddb2595c0121d2536de5b78648f3eded3e3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7b6cd4e659	cmd/tailscale/cli: make set's usage match up's, other than defaults Fixes #6082 Change-Id: I92dc4726d866dcfd87e93ff09772601851d92ccf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	231b88cc51	control/controlclient: add start of noise+http2 upgrade test Basic HTTP/2-over-noise client test. To be fleshed out in subsequent commits that add more functionality to the noise client. Updates #5972 Change-Id: I0178343523ef4ae8e8fc87bae53cbc81f4e32fde Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Anton Tolchanov	e25ab75795	net/dns: getting base DNS config is not supported on macOS Instead of returning a custom error, use ErrGetBaseConfigNotSupported that seems to be intended for this use case. This fixes DNS resolution on macOS clients compiled from source. Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Anton Tolchanov	193afe19cb	ipn/ipnlocal: add tags and a few other details to self status This makes tags, creation time, exit node option and primary routes for the current node exposed via `tailscale status --json` Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Brad Fitzpatrick	120bfc97ce	control/controlclient: refactor noiseClient, connections, http2 In prep for stateful http2 noise connections. Updates #5972 Change-Id: I9ebecc3b2d5d193621b87d39b506f231d6c82145 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	4e6e3bd13d	ipn/ipnlocal: fix a log line having function pointers instead of values Followup to using ipn.PrefsView (#6031). Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Joe Tsai	cfef47ddcc	wgengine: perform router reconfig for netlog-only changes (#6118 ) If the network logging configruation changes (and nothing else) we will tear down the network logger and start it back up. However, doing so will lose the router configuration state. Manually reconfigure it with the routing state. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	dfe67afb4a	control/controlhttp: remove ClientConn.UntrustedUpgradeHeaders It was just added and unreleased but we've decided to go a different route. Details are in `5e9e57ecf5`. Updates #5972 Change-Id: I49016af469225f58535f63a9b0fbe5ab6a5bf304 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	b2035a1dca	cmd/netlogfmt: handle any stream of network logs (#6108 ) Make netlogfmt useful regardless of the exact schema of the input. If a JSON object looks like a network log message, then unmarshal it as one and then print it. This allows netlogfmt to support both a stream of JSON objects directly serialized from netlogtype.Message, or the schema returned by the /api/v2/tailnet/{{tailnet}}/network-logs API endpoint. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	48ddb3af2a	wgengine/netlog: enforce hard limit on network log message sizes (#6109 ) This is a temporary hack to prevent logtail getting stuck uploading the same excessive message over and over. A better solution will be discussed and implemented. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	a3602c28bd	wgengine/netlog: embed the StableNodeID of the authoring node (#6105 ) This allows network messages to be annotated with which node it came from. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	81fd259133	wgengine/magicsock: gather physical-layer statistics (#5925 ) There is utility in logging traffic statistics that occurs at the physical layer. That is, in order to send packets virtually to a particular tailscale IP address, what physical endpoints did we need to communicate with? This functionality logs IP addresses identical to what had always been logged in magicsock prior to #5823, so there is no increase in PII being logged. ExtractStatistics returns a mapping of connections to counts. The source is always a Tailscale IP address (without port), while the destination is some endpoint reachable on WAN or LAN. As a special case, traffic routed through DERP will use 127.3.3.40 as the destination address with the port being the DERP region. This entire feature is only enabled if data-plane audit logging is enabled on the tailnet (by default it is disabled). Example of type of information logged: ------------------------------------ Tx[P/s] Tx[B/s] Rx[P/s] Rx[B/s] PhysicalTraffic: 25.80 3.39Ki 38.80 5.57Ki 100.1.2.3 -> 143.11.22.33:41641 15.40 2.00Ki 23.20 3.37Ki 100.4.5.6 -> 192.168.0.100:41641 10.20 1.38Ki 15.60 2.20Ki 100.7.8.9 -> 127.3.3.40:2 0.20 6.40 0.00 0.00 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Brad Fitzpatrick	5e9e57ecf5	control/controlhttp: add AcceptHTTP hook to add coalesced Server->Client write New plan for #5972. Instead of sending the public key in the clear (from earlier unreleased `246274b8e9`) where the client might have to worry about it being dropped or tampered with and retrying, we'll instead send it post-Noise handshake but before the HTTP/2 connection begins. This replaces the earlier extraHeaders hook with a different sort of hook that allows us to combine two writes on the wire in one packet. Updates #5972 Change-Id: I42cdf7c1859b53ca4dfa5610bd1b840c6986e09c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	c21a3c4733	types/netlogtype: new package for network logging types (#6092 ) The netlog.Message type is useful to depend on from other packages, but doing so would transitively cause gvisor and other large packages to be linked in. Avoid this problem by moving all network logging types to a single package. We also update staticcheck to take in: `003d277bcf` Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Aaron Klotz	a44687e71f	wgengine/winnet: invoke some COM methods directly instead of through IDispatch. Intermittently in the wild we are seeing failures when calling `INetworkConnection::GetNetwork`. It is unclear what the root cause is, but what is clear is that the error is happening inside the object's `IDispatch` invoker (as opposed to the method implementation itself). This patch replaces our wrapper for `INetworkConnection::GetNetwork` with an alternate implementation that directly invokes the method, instead of using `IDispatch`. I also replaced the implementations of `INetwork::SetCategory` and `INetwork::GetCategory` while I was there. This patch is speculative and tightly-scoped so that we could possibly add it to a dot-release if necessary. Updates https://github.com/tailscale/tailscale/issues/4134 Updates https://github.com/tailscale/tailscale/issues/6037 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Brad Fitzpatrick	4021ae6b9d	types/key: add missing ChallengePublic.UnmarshalText Forgot it when adding the Challenge types earlier. Change-Id: Ie0872c4e6dc25e5d832aa58c7b3f66d450bf6b71 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Adrian Dewhurst	8c09ae9032	tka, types/key: add NLPublic.KeyID This allows direct use of NLPublic with tka.Authority.KeyTrusted() and similar without using tricks like converting the return value of Verifier. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2 years ago
Sonia Appasamy	944f43f1c8	docs/webhooks: add sample endpoint code Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	2 years ago
Andrew Dunham	95f3dd1346	net/interfaces: don't dereference null pointer if no destination/netmask Fixes #6065 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I7159b8cbb8d5f47c0668cf83e59167f182f1defd	2 years ago
Maisem Ali	19b5586573	cmd/tailscale/cli: add beginnings of `tailscale set` Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Jordan Whited	a471681e28	wgengine/netstack: enable TCP SACK (#6066 ) TCP selective acknowledgement can improve throughput by an order of magnitude in the presence of loss. Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
Mihai Parparita	d60f7fe33f	cmd/tsconnect: run wasm-opt on the generated wasm file Saves about 1.4MB from the generated wasm file. The Brotli size is basically unchanged (it's actually slightly larger, by 40K), suggesting that most of the size delta is due to not inlining and other changes that were easily compressible. However, it still seems worthwhile to have a smaller final binary, to reduce parse time and increase likelihood that we fit in the browser's disk cache. Actual performance appears to be unchanged. Updates #5142 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	2a9ba28def	ipn/ipnlocal: set prefs before calling tkaSyncIfNeeded Caught this in a test in a different repo. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Will Norris	bff202a290	cmd/nginx-auth: add experimental status badge to README	2 years ago
Brad Fitzpatrick	35bee36549	portlist: use win32 calls instead of running netstat process [windows] Turns out using win32 instead of shelling out to child processes is a bit faster: name old time/op new time/op delta GetListIncremental-4 278ms ± 2% 0ms ± 7% -99.93% (p=0.000 n=8+10) name old alloc/op new alloc/op delta GetListIncremental-4 238kB ± 0% 9kB ± 0% -96.12% (p=0.000 n=10+8) name old allocs/op new allocs/op delta GetListIncremental-4 1.19k ± 0% 0.02k ± 0% -98.49% (p=0.000 n=10+10) Fixes #3876 (sadly) Change-Id: I1195ac5de21a8a8b3cdace5871d263e81aa27e91 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Andrew Dunham	527741d41f	shell.nix: add graphviz Change-Id: Ic25e11a056a7624ebba923d2b87d947e24c41a20 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	2 years ago

... 2 3 4 5 6 ...

4880 Commits (b94b91c1689954542a783fa58386008fecb623bf) All Branches Search

4880 Commits (b94b91c1689954542a783fa58386008fecb623bf)

All Branches