tailscale

Commit Graph

Author	SHA1	Message	Date
Andrew Lytvynov	be54dde0eb	clientupdate: allow switching from unstable to stable tracks (#12477 ) Previously, we would only compare the current version to resolved latest version for track. When running `tailscale update --track=stable` from an unstable build, it would almost always fail because the stable version is "older". But we should support explicitly switching tracks like that. Fixes #12347 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Kristoffer Dalby	a1ab7f7c94	client/tailscale: add NodeID to device Updates tailscale/corp#20514 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	5 months ago
Brad Fitzpatrick	1f6645b19f	net/ipset: skip the loop over Prefixes when there's only one For pprof cosmetic/confusion reasons more than performance, but it might have tiny speed benefit. Updates #12486 Change-Id: I40e03714f3afa3a7e7f5e1fa99b81c7e889b91b6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	20a5f939ba	wgengine/filter: add UDP flow benchmark To show the effects of the flow LRU accounting on e.g. QUIC traffic. For an open TCP connection: BenchmarkFilterMatch/tcp-not-syn-v4-8 66602070 16.74 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 67718179 16.60 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 68403351 16.84 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 66076416 16.87 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 67159012 16.67 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 65009526 16.58 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 66588055 16.62 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 63037071 16.58 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 69124975 21.15 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 54482922 20.41 ns/op And an open UDP connection: BenchmarkFilterMatch/udp-existing-flow-v4-8 25570020 44.09 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 26725958 46.99 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 25936412 47.11 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 25418325 45.99 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 25759848 44.73 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 25212488 46.26 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 25344370 44.55 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 26399372 45.26 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 26274159 47.51 ns/op BenchmarkFilterMatch/udp-existing-flow-v4-8 26070472 46.79 ns/op Updates #12486 Change-Id: Ica4263fb77972cf43db5a2e9433b4429506edfde Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	bf2d13cfa0	net/ipset: return all closures from named wrappers So profiles show more useful names than just func1, func2, func3, etc. There will still be func1 on them all, but the symbol before will say what the lookup type is. Updates #12486 Change-Id: I910b024a7861394eb83d07f5a899eae338cb1f22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	86e0f9b912	net/ipset, wgengine/filter/filtertype: add split-out packages This moves NewContainsIPFunc from tsaddr to new ipset package. And wgengine/filter types gets split into wgengine/filter/filtertype, so netmap (and thus the CLI, etc) doesn't need to bring in ipset, bart, etc. Then add a test making sure the CLI deps don't regress. Updates #1278 Change-Id: Ia246d6d9502bbefbdeacc4aef1bed9c8b24f54d5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	36b1b4af2f	wgengine/filter: split local+logging lookups by IPv4-vs-IPv6 If we already know it's an incoming IPv4 packet, no need to match against the set of IPv6s and vice versa. goos: darwin goarch: arm64 pkg: tailscale.com/wgengine/filter │ before │ after │ │ sec/op │ sec/op vs base │ FilterMatch/not-local-v4-8 21.40n ± 3% 16.04n ± 1% -25.09% (p=0.000 n=10) FilterMatch/not-local-v6-8 20.75n ± 9% 15.71n ± 0% -24.31% (p=0.000 n=10) FilterMatch/no-match-v4-8 81.37n ± 1% 78.57n ± 3% -3.43% (p=0.005 n=10) FilterMatch/no-match-v6-8 77.73n ± 2% 73.71n ± 3% -5.18% (p=0.002 n=10) FilterMatch/tcp-not-syn-v4-8 21.41n ± 3% 16.86n ± 0% -21.25% (p=0.000 n=10) FilterMatch/tcp-not-syn-v4-no-logs-8 10.04n ± 0% 10.05n ± 0% ~ (p=0.446 n=10) geomean 29.07n 25.05n -13.84% Updates #12486 Change-Id: I70e5024af03893327d26629a994ab2aa9811f4f3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	d4220a76da	wgengine/filter: add TCP non-SYN benchmarks To show performance during heavy flows on established connections. BenchmarkFilterMatch/tcp-not-syn-v4-8 52125848 21.46 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 52388781 21.43 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 52916954 21.32 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 52590730 21.43 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-8 53015923 21.32 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-no-logs-8 122795029 9.783 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-no-logs-8 100000000 10.09 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-no-logs-8 120090948 9.747 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-no-logs-8 122350448 10.55 ns/op BenchmarkFilterMatch/tcp-not-syn-v4-no-logs-8 122943025 9.813 ns/op Updates #12486 Change-Id: I8e7c9380bf969ad646851d53f8a4c287717694ea Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	10e8a2a05c	wgengine/filter: fix copy/pasteo in new benchmark's v6 CIDR I noticed the not-local-v6 numbers were nowhere near the v4 numbers (they should be identical) and then saw this. It meant the Addr().Next() wasn't picking an IP that was no longer local, as assumed. Updates #12486 Change-Id: I18dfb641f00c74c6252666bc41bd2248df15fadd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	64ac64fb66	net/tsaddr: use bart in NewContainsIPFunc, add tests, benchmarks NewContainsIPFunc was previously documented as performing poorly if there were many netip.Prefixes to search over. As such, we never it used it in such cases. This updates it to use bart at a certain threshold (over 6 prefixes, currently), at which point the bart lookup overhead pays off. This is currently kinda useless because we're not using it. But now we can and get wins elsewhere. And we can remove the caveat in the docs. goos: darwin goarch: arm64 pkg: tailscale.com/net/tsaddr │ before │ after │ │ sec/op │ sec/op vs base │ NewContainsIPFunc/empty-8 2.215n ± 11% 2.239n ± 1% +1.08% (p=0.022 n=10) NewContainsIPFunc/cidr-list-1-8 17.44n ± 0% 17.59n ± 6% +0.89% (p=0.000 n=10) NewContainsIPFunc/cidr-list-2-8 27.85n ± 0% 28.13n ± 1% +1.01% (p=0.000 n=10) NewContainsIPFunc/cidr-list-3-8 36.05n ± 0% 36.56n ± 13% +1.41% (p=0.000 n=10) NewContainsIPFunc/cidr-list-4-8 43.73n ± 0% 44.38n ± 1% +1.50% (p=0.000 n=10) NewContainsIPFunc/cidr-list-5-8 51.61n ± 2% 51.75n ± 0% ~ (p=0.101 n=10) NewContainsIPFunc/cidr-list-10-8 95.65n ± 0% 68.92n ± 0% -27.94% (p=0.000 n=10) NewContainsIPFunc/one-ip-8 4.466n ± 0% 4.469n ± 1% ~ (p=0.491 n=10) NewContainsIPFunc/two-ip-8 8.002n ± 1% 7.997n ± 4% ~ (p=0.697 n=10) NewContainsIPFunc/three-ip-8 27.98n ± 1% 27.75n ± 0% -0.82% (p=0.012 n=10) geomean 19.60n 19.07n -2.71% Updates #12486 Change-Id: I2e2320cc4384f875f41721374da536bab995c1ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Maisem Ali	491483d599	cmd/viewer,type/views: add MapSlice for maps of slices This abstraction provides a nicer way to work with maps of slices without having to write out three long type params. This also allows it to provide an AsMap implementation which copies the map and the slices at least. Updates tailscale/corp#20910 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Brad Fitzpatrick	7574f586aa	wgengine/filter: add more benchmarks, make names more explicit Updates #12486 Change-Id: If2e6d9c70212644eb4a0bc8ec6768512894a646a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	21ed31e33a	wgengine/filter: use NewContainsIPFunc for Srcs matches NewContainsIPFunc returns a contains matcher optimized for its input. Use that instead of what this did before, always doing a test over each of a list of netip.Prefixes. goos: darwin goarch: arm64 pkg: tailscale.com/wgengine/filter │ before │ after │ │ sec/op │ sec/op vs base │ FilterMatch/file1-8 32.60n ± 1% 18.87n ± 1% -42.12% (p=0.000 n=10) Updates #12486 Change-Id: I8f902bc064effb431e5b46751115942104ff6531 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	e2c0d69c9c	wgengine/filter: add filter benchmark Baseline, on 2020 M1 Macbook Pro, on power: goos: darwin goarch: arm64 pkg: tailscale.com/wgengine/filter BenchmarkFilterMatch/file1-8 34089133 32.79 ns/op BenchmarkFilterMatch/file1-8 35423917 32.59 ns/op BenchmarkFilterMatch/file1-8 35208598 32.80 ns/op BenchmarkFilterMatch/file1-8 35180470 33.39 ns/op BenchmarkFilterMatch/file1-8 36671608 32.82 ns/op BenchmarkFilterMatch/file1-8 35435991 33.13 ns/op BenchmarkFilterMatch/file1-8 34689181 33.29 ns/op BenchmarkFilterMatch/file1-8 34786053 32.94 ns/op BenchmarkFilterMatch/file1-8 35366235 32.56 ns/op BenchmarkFilterMatch/file1-8 35342799 32.47 ns/op Updates #12486 Change-Id: I8f902bc064effb431e5b46751115942104ff6531 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	7bc9d453c2	health: fix data race in new warnable code Fixes #12479 Change-Id: Ice84d5eb12d835eeddf6fc8cc337ea6b4dddcf6c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Nick Khyl	c32efd9118	various: create a catch-all NRPT rule when "Override local DNS" is enabled on Windows Without this rule, Windows 8.1 and newer devices issue parallel DNS requests to DNS servers associated with all network adapters, even when "Override local DNS" is enabled and/or a Mullvad exit node is being used, resulting in DNS leaks. This also adds "disable-local-dns-override-via-nrpt" nodeAttr that can be used to disable the new behavior if needed. Fixes tailscale/corp#20718 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Aaron Klotz	7354547bd8	util/winutil: update UserProfile to ensure any environment variables in the roaming profile path are expanded Updates #12383 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Andrea Gottardo	a8ee83e2c5	health: begin work to use structured health warnings instead of strings, pipe changes into ipn.Notify (#12406 ) Updates tailscale/tailscale#4136 This PR is the first round of work to move from encoding health warnings as strings and use structured data instead. The current health package revolves around the idea of Subsystems. Each subsystem can have (or not have) a Go error associated with it. The overall health of the backend is given by the concatenation of all these errors. This PR polishes the concept of Warnable introduced by @bradfitz a few weeks ago. Each Warnable is a component of the backend (for instance, things like 'dns' or 'magicsock' are Warnables). Each Warnable has a unique identifying code. A Warnable is an entity we can warn the user about, by setting (or unsetting) a WarningState for it. Warnables have: - an identifying Code, so that the GUI can track them as their WarningStates come and go - a Title, which the GUIs can use to tell the user what component of the backend is broken - a Text, which is a function that is called with a set of Args to generate a more detailed error message to explain the unhappy state Additionally, this PR also begins to send Warnables and their WarningStates through LocalAPI to the clients, using ipn.Notify messages. An ipn.Notify is only issued when a warning is added or removed from the Tracker. In a next PR, we'll get rid of subsystems entirely, and we'll start using structured warnings for all errors affecting the backend functionality. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Andrea Gottardo	e8ca30a5c7	xcode/iOS: support serial number collection via MDM on iOS (#11429 ) Fixes tailscale/corp#18366. This PR provides serial number collection on iOS, by allowing system administrators to pass a `DeviceSerialNumber` MDM key which can be read by the `posture` package in Go. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Aaron Klotz	bd2a6d5386	util/winutil: add UserProfile type for (un)loading user profiles S4U logons do not automatically load the associated user profile. In this PR we add UserProfile to handle that part. Windows docs indicate that we should try to resolve a remote profile path when present, so we attempt to do so when the local computer is joined to a domain. Updates #12383 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Jordan Whited	9189fe007b	cmd/stunc: support user-specified port (#12469 ) Updates tailscale/corp#20689 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
James Tucker	85ad0c276c	tailcfg: update PeerAPIDNS Port value documentation We do not intend to use this value for feature support communication in the future, and have applied changes elsewhere that now fix the expected value. Updates tailscale/corp#19391 Updates tailscale/corp#20398 Signed-off-by: James Tucker <james@tailscale.com>	5 months ago
Jordan Whited	65888d95c9	derp/xdp,cmd/xdpderper: initial skeleton (#12390 ) This commit introduces a userspace program for managing an experimental eBPF XDP STUN server program. derp/xdp contains the eBPF pseudo-C along with a Go pkg for loading it and exporting its metrics. cmd/xdpderper is a package main user of derp/xdp. Updates tailscale/corp#20689 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Brad Fitzpatrick	6908fb0de3	ipn/localapi,client/tailscale,cmd/derper: add WhoIs lookup by nodekey, use in derper Fixes #12465 Change-Id: I9b7c87315a3d2b2ecae2b8db9e94b4f5a1eef74a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Andrew Dunham	72c8f7700b	wgengine/netstack: add test for #12448 This refactors the logic for determining whether a packet should be sent to the host or not into a function, and then adds tests for it. Updates #11304 Updates #12448 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ief9afa98eaffae00e21ceb7db073c61b170355e5	5 months ago
Irbe Krumina	88f2d234a4	wgengine/netstack: fix 4via6 subnet routes (#12454 ) Fix a bug where, for a subnet router that advertizes 4via6 route, all packets with a source IP matching the 4via6 address were being sent to the host itself. Instead, only send to host packets whose destination address is host's local address. Fixes tailscale/tailscale#12448 Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Andrew Dunham <andrew@du.nham.ca>	5 months ago
Brad Fitzpatrick	ccdd2e6650	cmd/derper: add a README Updates tailscale/corp#20844 Change-Id: Ie3ca5dd7f582f4f298339dd3cd2039243c204ef8 Co-authored-by: James Tucker <james@tailscale.com> Co-authored-by: Maisem Ali <maisem@tailscale.com> Co-authored-by: Andrew Dunham <andrew@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Percy Wegmann	d7fdc01f7f	ssh/tailssh: check IsSELinuxEnforcing in tailscaled process Checking in the incubator as this used to do fails because the getenforce command is not on the PATH. Updates #12442 Signed-off-by: Percy Wegmann <percy@tailscale.com>	5 months ago
Jonathan Nobels	02e3c046aa	net/dns: re-query system resolvers on no-upstream resolver failure on apple platforms (#12398 ) Fixes tailscale/corp#20677 On macOS sleep/wake, we're encountering a condition where reconfigure the network a little bit too quickly - before apple has set the nameservers for our interface. This results in a persistent condition where we have no upstream resolver and fail all forwarded DNS queries. No upstream nameservers is a legitimate configuration, and we have no (good) way of determining when Apple is ready - but if we need to forward a query, and we have no nameservers, then something has gone badly wrong and the network is very broken. A simple fix here is to simply inject a netMon event, which will go through the configuration dance again when we hit the SERVFAIL condition. Tested by artificially/randomly returning [] for the list of nameservers in the bespoke ipn-bridge code responsible for getting the nameservers. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	5 months ago
Andrew Dunham	d0f1a838a6	net/dnscache: use parent context to perform lookup As an alterative to #11935 using #12003. Updates #11935 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I05f643fe812ceeaec5f266e78e3e529cab3a1ac3	5 months ago
Mario Minardi	5f121396e9	VERSION.txt: this is v1.69.0 (#12441 ) Signed-off-by: Mario Minardi <mario@tailscale.com>	5 months ago
JunYanBJSS	4c01ce9f43	tsnet: fix error formatting bug Fixes #12411 Signed-off-by: JunYanBJSS <johnnycocoyan@hotmail.com>	5 months ago
Irbe Krumina	f5936d132a	kube: fix typo (#12437 ) Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Irbe Krumina	a95ea31a4e	kube,tailcfg: store parsed recorder tags in a separate field (#12429 ) Add an additional RecorderAddrs field to tailscale.com/cap/kubernetes capability. RecorderAddrs will only be populated by control with the addresses of any tsrecorder tags set via Recorder. Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Aaron Klotz	3511d1f8a2	cmd/tailscaled, net/dns, wgengine/router: start Windows child processes with DETACHED_PROCESS when I/O is being piped When we're starting child processes on Windows that are CLI programs that don't need to output to a console, we should pass in DETACHED_PROCESS as a CreationFlag on SysProcAttr. This prevents the OS from even creating a console for the child (and paying the associated time/space penalty for new conhost processes). This is more efficient than letting the OS create the console window and then subsequently trying to hide it, which we were doing at a few callsites. Fixes #12270 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Nick Khyl	4cdc4ed7db	net/dns/resolver: return an empty successful response instead of NXDomain when resolving A records for 4via6 domains As quad-100 is an authoritative server for 4via6 domains, it should always return responses with a response code of 0 (indicating no error) when resolving records for these domains. If there's no resource record of the specified type (e.g. A), it should return a response with an empty answer section rather than NXDomain. Such a response indicates that there is at least one RR of a different type (e.g., AAAA), suggesting the Windows stub resolver to look for it. Fixes tailscale/corp#20767 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Maisem Ali	4b6a0c42c8	safesocket: add ConnectContext This adds a variant for Connect that takes in a context.Context which allows passing through cancellation etc by the caller. Updates tailscale/corp#18266 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Nick Khyl	3672f66c74	tailcfg: bump capver for NodeAttrDisableSplitDNSWhenNoCustomResolvers Missed in `b65221999c`. Updates tailscale/corp#15802 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Andrew Dunham	93cd2ab224	util/singleflight: add DoChanContext This is a variant of DoChan that supports context propagation, such that the context provided to the inner function will only be canceled when there are no more waiters for a given key. This can be used to deduplicate expensive and cancelable calls among multiple callers safely. Updates #11935 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ibe1fb67442a854babbc6924fd8437b02cc9e7bcf	5 months ago
Irbe Krumina	bc53ebd4a0	ipn/{ipnlocal,localapi},net/netkernelconf,client/tailscale,cmd/containerboot: optionally enable UDP GRO forwarding for containers (#12410 ) Add a new TS_EXPERIMENTAL_ENABLE_FORWARDING_OPTIMIZATIONS env var that can be set for tailscale/tailscale container running as a subnet router or exit node to enable UDP GRO forwarding for improved performance. See https://tailscale.com/kb/1320/performance-best-practices#linux-optimizations-for-subnet-routers-and-exit-nodes This is currently considered an experimental approach; the configuration support is partially to allow further experimentation with containerized environments to evaluate the performance improvements. Updates tailscale/tailscale#12295 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Irbe Krumina	6f2bae019f	cmd/k8s-nameserver: fix AAAA record query response (#12412 ) Return empty response and NOERROR for AAAA record queries for DNS names for which we have an A record. This is to allow for callers that might be first sending an AAAA query and then, if that does not return a response, follow with an A record query. Previously we were returning NOTIMPL that caused some callers to potentially not follow with an A record query or misbehave in different ways. Also return NXDOMAIN for AAAA record queries for names that we DO NOT have an A record for to ensure that the callers do not follow up with an A record query. Returning an empty response and NOERROR is the behaviour that RFC 4074 recommends: https://datatracker.ietf.org/doc/html/rfc4074 Updates tailscale/tailscale#12321 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Aaron Klotz	df86576989	util/winutil: add AllocateContiguousBuffer and SetNTString helper funcs AllocateContiguousBuffer is for allocating structs with trailing buffers containing additional data. It is to be used for various Windows structures containing pointers to data located immediately after the struct. SetNTString performs in-place setting of windows.NTString and windows.NTUnicodeString. Updates #12383 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Irbe Krumina	c3e2b7347b	tailcfg,cmd/k8s-operator,kube: move Kubernetes cap to a location that can be shared with control (#12236 ) This PR is in prep of adding logic to control to be able to parse tailscale.com/cap/kubernetes grants in control: - moves the type definition of PeerCapabilityKubernetes cap to a location shared with control. - update the Kubernetes cap rule definition with fields for granting kubectl exec session recording capabilities. - adds a convenience function to produce tailcfg.RawMessage from an arbitrary cap rule and a test for it. An example grant defined via ACLs: "grants": [{ "src": ["tag:eng"], "dst": ["tag:k8s-operator"], "app": { "tailscale.com/cap/kubernetes": [{ "recorder": ["tag:my-recorder"] “enforceRecorder”: true }], }, } ] This grant enforces `kubectl exec` sessions from tailnet clients, matching `tag:eng` via API server proxy matching `tag:k8s-operator` to be recorded and recording to be sent to a tsrecorder instance, matching `tag:my-recorder`. The type needs to be shared with control because we want control to parse this cap and resolve tags to peer IPs. Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	5 months ago
Fran Bull	ba46495e11	appc: log how many routes are being written So that we can debug customer problems more easily. Updates #11008 Signed-off-by: Fran Bull <fran@tailscale.com>	6 months ago
Irbe Krumina	807934f00c	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388 ) Add a new .spec.tailscale.acceptRoutes field to ProxyClass, that can be optionally set to true for the proxies to accept routes advertized by other nodes on tailnet (equivalent of setting --accept-routes to true). Updates tailscale/tailscale#12322,tailscale/tailscale#10684 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Irbe Krumina	53d9cac196	k8s-operator/apis/v1alpha1,cmd/k8s-operator/deploy/examples: update DNSConfig description (#11971 ) Also removes hardcoded image repo/tag from example DNSConfig resource as the operator now knows how to default those. Updates tailscale/tailscale#11019 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Tom Proctor	23e26e589f	cmd/k8s-operator,k8s-opeerator: include Connector's MagicDNS name and tailnet IPs in status (#12359 ) Add new fields TailnetIPs and Hostname to Connector Status. These contain the addresses of the Tailscale node that the operator created for the Connector to aid debugging. Fixes #12214 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	6 months ago
Irbe Krumina	3a6d3f1a5b	cmd/k8s-operator,k8s-operator,go.{mod,sum}: make individual proxy images/image pull policies configurable (#11928 ) cmd/k8s-operator,k8s-operator,go.{mod,sum}: make individual proxy images/image pull policies configurable Allow to configure images and image pull policies for individual proxies via ProxyClass.Spec.StatefulSet.Pod.{TailscaleContainer,TailscaleInitContainer}.Image, and ProxyClass.Spec.StatefulSet.Pod.{TailscaleContainer,TailscaleInitContainer}.ImagePullPolicy fields. Document that we have images in ghcr.io on the relevant Helm chart fields. Updates tailscale/tailscale#11675 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Brad Fitzpatrick	916c4db75b	net/dns: fix crash in tests Looks like #12346 as submitted with failing tests. Updates #12346 Change-Id: I582cd0dfb117686330d935d763d972373c5ae598 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Adrian Dewhurst	0219317372	ipn/ipnlocal: improve sticky last suggestion The last suggested exit node needs to be incorporated in the decision making process when a new suggestion is requested, but currently it is not quite right: it'll be used if the suggestion code has an error or a netmap is unavailable, but it won't be used otherwise. Instead, this makes the last suggestion into a tiebreaker when making a random selection between equally-good options. If the last suggestion does not make it to the final selection pool, then a different suggestion will be made. Since LocalBackend.SuggestExitNode is back to being a thin shim that sets up the parameters to suggestExitNode, it no longer needs a test. Its test was unable to be comprehensive anyway as the code being tested contains an uncontrolled random number generator. Updates tailscale/corp#19681 Change-Id: I94ecc9a0d1b622de3df4ef90523f1d3e67b4bfba Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	6 months ago

1 2 3 4 5 ...

7730 Commits (be54dde0ebc164ff73a03a8b7bb27b616c508e68) All Branches Search

7730 Commits (be54dde0ebc164ff73a03a8b7bb27b616c508e68)

All Branches