tailscale

Commit Graph

Author	SHA1	Message	Date
David Anderson	bc8f5a7734	cmd/k8s-operator: add a basic unit test. The test verifies one of the successful reconcile paths, where a client requests an exposed service via a LoadBalancer class. Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	3b7ae39a06	cmd/k8s-operator: use the client's authkey method to create auth keys. Also introduces an intermediary interface for the tailscale client, in preparation for operator tests that fake out the Tailscale API interaction. Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Brad Fitzpatrick	ca08e316af	util/endian: delete package; use updated josharian/native instead See josharian/native#3 Updates golang/go#57237 Change-Id: I238c04c6654e5b9e7d9cfb81a7bbc5e1043a84a2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
David Anderson	b2d4abf25a	cmd/k8s-operator: add a kubernetes operator. This was initially developed in a separate repo, but for build/release reasons and because go module management limits the damage of importing k8s things now, moving it into this repo. At time of commit, the operator enables exposing services over tailscale, with the 'tailscale' loadBalancerClass. It also currently requires an unreleased feature to access the Tailscale API, so is not usable yet. Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Aaron Klotz	53e2010b8a	cmd/tailscaled: change Windows implementation to shut down subprocess via closing its stdin We've been doing a hard kill of the subprocess, which is only safe as long as both the cli and gui are not running and the subprocess has had the opportunity to clean up DNS settings etc. If unattended mode is turned on, this is definitely unsafe. I changed babysitProc to close the subprocess's stdin to make it shut down, and then I plumbed a cancel function into the stdin reader on the subprocess side. Fixes https://github.com/tailscale/corp/issues/5621 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
shayne	9d335aabb2	cmd/tailscale/cli: [ssh] fix typo in help text (#6694 ) arugments => arguments Signed-off-by: shayne <79330+shayne@users.noreply.github.com>	2 years ago
Jordan Whited	ea5ee6f87c	all: update golang.zx2c4.com/wireguard to github.com/tailscale/wireguard-go (#6692 ) This is temporary while we work to upstream performance work in https://github.com/WireGuard/wireguard-go/pull/64. A replace directive is less ideal as it breaks dependent code without duplication of the directive. Signed-off-by: Jordan Whited <jordan@tailscale.com>	2 years ago
Walter Poupore	383e203fd2	cmd/tailscale/cli: update lock status help strings (#6675 ) Signed-off-by: Walter Poupore <walterp@tailscale.com> Signed-off-by: Walter Poupore <walterp@tailscale.com>	2 years ago
Jordan Whited	76389d8baf	net/tstun, wgengine/magicsock: enable vectorized I/O on Linux (#6663 ) This commit updates the wireguard-go dependency and implements the necessary changes to the tun.Device and conn.Bind implementations to support passing vectors of packets in tailscaled. This significantly improves throughput performance on Linux. Updates #414 Signed-off-by: Jordan Whited <jordan@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com> Co-authored-by: James Tucker <james@tailscale.com>	2 years ago
James Tucker	389238fe4a	cmd/tailscale/cli: add workaround for improper named socket quoting in ssh command This avoids the issue in the common case where the socket path is the default path, avoiding the immediate need for a Windows shell quote implementation. Updates #6639 Signed-off-by: James Tucker <james@tailscale.com>	2 years ago
Tom DNetto	e27f4f022e	cmd/tailscale/cli: add progress to tailscale file cp Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
shayne	98114bf608	cmd/tailscale/cli, ipn/localapi: add funnel status to status command (#6402 ) Fixes #6400 open up GETs for localapi serve-config to allow read-only access to ServeConfig `tailscale status` will include "Funnel on" status when Funnel is configured. Prints nothing if Funnel is not running. Example: $ tailscale status <nodes redacted> # Funnel on: # - https://node-name.corp.ts.net # - https://node-name.corp.ts.net:8443 # - tcp://node-name.corp.ts.net:10000 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
David Anderson	1b65630e83	cmd/containerboot: switch to IPN bus monitoring instead of polling. We still have to shell out to `tailscale up` because the container image's API includes "arbitrary flags to tailscale up", unfortunately. But this should still speed up startup a little, and also enables k8s-bound containers to update their device information as new netmap updates come in. Fixes #6657 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Tom DNetto	55e0512a05	ipn/ipnlocal,cmd/tailscale: minor improvements to lock modify command * Do not print the status at the end of a successful operation * Ensure the key of the current node is actually trusted to make these changes Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Aaron Klotz	98f21354c6	cmd/tailscaled: add a special command to tailscaled's Windows service for removing WinTun WinTun is installed lazily by tailscaled while it is running as LocalSystem. Based upon what we're seeing in bug reports and support requests, removing WinTun as a lesser user may fail under certain Windows versions, even when that user is an Administrator. By adding a user-defined command code to tailscaled, we can ask the service to do the removal on our behalf while it is still running as LocalSystem. * The uninstall code is basically the same as it is in corp; * The command code will be sent as a service control request and is protected by the SERVICE_USER_DEFINED_CONTROL access right, which requires Administrator. I'll be adding follow-up patches in corp to engage this functionality. Updates https://github.com/tailscale/tailscale/issues/6433 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
David Anderson	367228ef82	cmd/containerboot: gracefully degrade if missing patch permissions in k8s. Fixes #6629. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Andrew Dunham	a887ca7efe	ipn/ipnlocal: improve redactErr to handle more cases This handles the case where the inner os.PathError is wrapped in another error type, and additionally will redact errors of type os.LinkError. Finally, add tests to verify that redaction works. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie83424ff6c85cdb29fb48b641330c495107aab7c	2 years ago
David Anderson	e36c27bcd1	cmd/containerboot: check that k8s secret permissions are correct. Updates #6629. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	e79a1eb24a	cmd/containerboot: refactor tests to have more explicit phases. In preparation for making startup more complex with IPN bus watches. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	e04aaa7575	cmd/containerboot: split tailscaled bringup and auth phases. In preparation for reworking auth to use IPN bus watch. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	a469ec8ff6	cmd/containerboot: fix some lint. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Anton Tolchanov	5ff946a9e6	cmd/containerboot: fix TS_STATE_DIR environment variable It's supposed to set `--statedir` rather than `--state` file. Fixes #6634. Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2 years ago
Brad Fitzpatrick	1598cd0361	net/tsaddr: remove ContainsFunc helpers (they're now in x/exp/slices) x/exp/slices now has ContainsFunc (golang/go#53983) so we can delete our versions. Change-Id: I5157a403bfc1b30e243bf31c8b611da25e995078 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Mihai Parparita	cb525a1aad	cmd/tailscaled: fix typo in netstack variable name Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maisem Ali	96cad35870	cmd/tailscaled: rename variables to be more descriptive renamed from `useNetstack` to `onlyNetstack` which is 1 letter more but more descriptive because we always have netstack enabled and `useNetstack` doesn't convey what it is supposed to be used for. e.g. we always use netstack for Tailscale SSH. Also renamed shouldWrapNetstack to handleSubnetsInNetstack as it was only used to configure subnet routing via netstack. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Mihai Parparita	5b8323509f	cmd/tailscale/cli: use "account" instead of "profile" in user-visible text Matches the UI clients Updates #713 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	2 years ago
Maya Kaczorowski	d5b4d2e276	cmd/tailscale/cli: improve tailnet lock help (#6583 ) Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com> Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com>	2 years ago
Walter Poupore	74b47eaad6	cmd/tailscale/cli: Fix 'tailscale switch' error message (#6585 ) Updates #713. Signed-off-by: Walter Poupore <walterp@tailscale.com> Signed-off-by: Walter Poupore <walterp@tailscale.com>	2 years ago
Maisem Ali	a5a3188b7e	cmd/tailscale/cli: unhide login and switch subcommands Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maya Kaczorowski	a1084047ce	cmd/tailscale/cli: capitalize Get (#6586 ) Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com> Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com>	2 years ago
Tom DNetto	74c1f632f6	types/key,cmd/tailscale/cli: support tlpub prefix for tailnet-lock keys Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	8dd1418774	ipn{,/ipnlocal}: add ipn.NotifyInitial* flags to WatchIPNBus To simplify clients getting the initial state when they subscribe. Change-Id: I2490a5ab2411253717c74265a46a98012b80db82 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	197a4f1ae8	types/ptr: move all the ptrTo funcs to one new package's ptr.To Change-Id: Ia0b820ffe7aa72897515f19bd415204b6fe743c7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	9a80b8fb10	cmd/tailscale,ipn: surface TKA-filtered peers in lock status command Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	731be07777	cmd/tailscale/cli: show rotation key when suggesting lock sign command Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	f710d1cb20	cmd/tailscale/cli: add set --unattended on Windows Fixes #6567 Change-Id: I8cb57196c601466401f8602eb50456e7cf7c31ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Denton Gentry	a200a23f97	Revert "cmd/tailscale: access QNAP via localhost" When running `tailscale web` as a standalone process, it was necessary to send auth requests to QTS using localhost to avoid hitting the proxy recursively. However running `tailscale web` as a process means it is consuming RAM all the time even when it isn't actively doing anything. After switching back to the `tailscale web` CGI mode, we don't need to specifically use localhost for QNAP auth. This reverts commit `e0cadc5496`. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Maisem Ali	adc302f428	all: use named pipes on windows Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	45042a76cd	cmd/tailscale,ipn: store disallowed TKA's in prefs, lock local-disable Take 2 of https://github.com/tailscale/tailscale/pull/6546 Builds on https://github.com/tailscale/tailscale/pull/6560 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	390d1bb871	Revert "ipn,types/persist: store disallowed TKA's in prefs, lock local-disable" This reverts commit `f1130421f0`. It was submitted with failing tests (go generate checks) Requires a lot of API changes to fix so rolling back instead of forward. Change-Id: I024e8885c0ed44675d3028a662f386dda811f2ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	f1130421f0	ipn,types/persist: store disallowed TKA's in prefs, lock local-disable Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	0a10a5632b	cmd/tailscaled: add TS_DEBUG_BACKEND_DELAY_SEC for testing async startup This adds an envknob to make testing async startup more reproducible. We want the Windows GUI to behave well when wintun is not (or it's doing its initial slow driver installation), but during testing it's often too fast to see that it's working. This lets it be slowed down. Updates #6522 Change-Id: I6ae19f46e270ea679cbaea32a53888efcf2943a7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Joe Tsai	2e5d08ec4f	net/connstats: invert network logging data flow (#6272 ) Previously, tstun.Wrapper and magicsock.Conn managed their own statistics data structure and relied on an external call to Extract to extract (and reset) the statistics. This makes it difficult to ensure a maximum size on the statistics as the caller has no introspection into whether the number of unique connections is getting too large. Invert the control flow such that a connstats.Statistics is registered with tstun.Wrapper and magicsock.Conn. Methods on non-nil connstats.Statistics are called for every packet. This allows the implementation of connstats.Statistics (in the future) to better control when it needs to flush to ensure bounds on maximum sizes. The value registered into tstun.Wrapper and magicsock.Conn could be an interface, but that has two performance detriments: 1. Method calls on interface values are more expensive since they must go through a virtual method dispatch. 2. The implementation would need a sync.Mutex to protect the statistics value instead of using an atomic.Pointer. Given that methods on constats.Statistics are called for every packet, we want reduce the CPU cost on this hot path. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Joe Tsai	35c10373b5	types/logid: move logtail ID types here (#6336 ) Many packages reference the logtail ID types, but unfortunately pull in the transitive dependencies of logtail. Fix this problem by putting the log ID types in its own package with minimal dependencies. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2 years ago
Aaron Klotz	6e33d2da2b	ipn/ipnauth, util/winutil: add temporary LookupPseudoUser workaround to address os/user.LookupId errors on Windows I added util/winutil/LookupPseudoUser, which essentially consists of the bits that I am in the process of adding to Go's standard library. We check the provided SID for "S-1-5-x" where 17 <= x <= 20 (which are the known pseudo-users) and then manually populate a os/user.User struct with the correct information. Fixes https://github.com/tailscale/tailscale/issues/869 Fixes https://github.com/tailscale/tailscale/issues/2894 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	2 years ago
Brad Fitzpatrick	3b0de97e07	cmd/tailscaled: unify the two Windows paths + separate IPN server path tailscaled on Windows had two entirely separate start-up paths for running as a service vs in the foreground. It's been causing problems for ages. This unifies the two paths, making them be the same as the path used for every other platform. Also, it uses the new async LocalBackend support in ipnserver.Server so the Server can start serving HTTP immediately, even if tun takes awhile to come up. Updates #6535 Change-Id: Icc8c4f96d4887b54a024d7ac15ad11096b5a58cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	ea25ef8236	util/set: add new set package for SetHandle type We use this pattern in a number of places (in this repo and elsewhere) and I was about to add a fourth to this repo which was crossing the line. Add this type instead so they're all the same. Also, we have another Set type (SliceSet, which tracks its keys in order) in another repo we can move to this package later. Change-Id: Ibbdcdba5443fae9b6956f63990bdb9e9443cefa9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Tom DNetto	5c8d2fa695	cmd/tailscale,ipn: improve UX of lock init command, cosmetic changes Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Brad Fitzpatrick	e8cc78b1af	ipn/ipnserver: change Server to let LocalBackend be supplied async This is step 1 of de-special-casing of Windows and letting the LocalAPI HTTP server start serving immediately, even while the rest of the world (notably the Engine and its TUN device) are being created, which can take a few to dozens of seconds on Windows. With this change, the ipnserver.New function changes to not take an Engine and to return immediately, not returning an error, and let its Run run immediately. If its ServeHTTP is called when it doesn't yet have a LocalBackend, it returns an error. A TODO in there shows where a future handler will serve status before an engine is available. Future changes will: * delete a bunch of tailscaled_windows.go code and use this new API * add the ipnserver.Server ServerHTTP handler to await the engine being available * use that handler in the Windows GUI client Updates #6522 Change-Id: Iae94e68c235e850b112a72ea24ad0e0959b568ee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	3b73727e39	cmd/tailscale: de-punycode hostnames in status display Still show original, but show de-punycode version in parens, similar to how we show DNS-less hostnames. Change-Id: I7e57da5e4029c5b49e8cd3014c350eddd2b3c338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago

1 2 3 4 5 ...

1107 Commits (bc8f5a773414f8c70276dc9b22f47cb329a0f385)