tailscale

Commit Graph

Author	SHA1	Message	Date
Maisem Ali	8cda647a0f	cmd/testwrapper: handle build failures `go test -json` outputs invalid JSON when a build fails. Handle that case by reseting the json.Decode and continuing to read. Updates #8493 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Andrew Dunham	60ab8089ff	logpolicy, various: allow overriding log function This allows sending logs from the "logpolicy" package (and associated callees) to something other than the log package. The behaviour for tailscaled remains the same, passing in log.Printf Updates #8249 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie1d43b75fa7281933d9225bffd388462c08a5f31	2 years ago
Andrew Dunham	a7648a6723	net/dnsfallback: run recursive resolver and compare results When performing a fallback DNS query, run the recursive resolver in a separate goroutine and compare the results returned by the recursive resolver with the results we get from "regular" bootstrap DNS. This will allow us to gather data about whether the recursive DNS resolver works better, worse, or about the same as "regular" bootstrap DNS. Updates #5853 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ifa0b0cc9eeb0dccd6f7a3d91675fe44b3b34bd48	2 years ago
Maisem Ali	1ca5dcce15	cmd/testwrapper: stream output results Previously it would wait for all tests to run before printing anything, instead stream the results over a channel so that they can be emitted immediately. Updates #8493 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	2e4e7d6b9d	cmd/testwrapper: output packages tested Previously it would only print the failures without providing more information on which package the failures from. This commit makes it so that it prints out the package information as well as the attempt numbers. ``` ➜ tailscale.com git:(main) ✗ go run ./cmd/testwrapper ./cmd/... ok tailscale.com/cmd/derper ok tailscale.com/cmd/k8s-operator ok tailscale.com/cmd/tailscale/cli ok tailscale.com/cmd/tailscaled === RUN TestFlakeRun flakytest.go:38: flakytest: issue tracking this flaky test: https://github.com/tailscale/tailscale/issues/0 flakytest_test.go:41: First run in testwrapper, failing so that test is retried. This is expected. --- FAIL: TestFlakeRun (0.00s) FAIL tailscale.com/cmd/testwrapper/flakytest Attempt #2: Retrying flaky tests: ok tailscale.com/cmd/testwrapper/flakytest ``` Updates #8493 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	2e19790f61	types/views: add JSON marshal/unmarshal and AsMap to Map This allows cloning a Map as well as marshaling the Map as JSON. Updates tailscale/corp#12754 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	12a2221db2	cmd/testwrapper/flakytest: clearly describe why TestFlakeRun fails Fixes #8474 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Tom DNetto	97ee0bc685	cmd/tailscale: improve error message when signing without a tailnet lock key Updates #8568 Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Andrew Dunham	ab310a7f60	derp: use new net/tcpinfo package Updates #8413 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8bf8046517195a6d42cabb32d6ec7f1f79cef860	2 years ago
KevinLiang10	243ce6ccc1	util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	2 years ago
Tom DNetto	1377618dbc	tsnet: expose field to configure Wireguard port Signed-off-by: Tom DNetto <tom@tailscale.com> Updates #1748	2 years ago
Maisem Ali	8e840489ed	cmd/testwrapper: only retry flaky failed tests Redo the testwrapper to track and only retry flaky tests instead of retrying the entire pkg. It also fails early if a non-flaky test fails. This also makes it so that the go test caches are used. Fixes #7975 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
phirework	fbacc0bd39	go.toolchain: switch to tailscale.go1.21 (#8415 ) Updates #8419 Signed-off-by: Jenny Zhang <jz@tailscale.com>	2 years ago
shayne	6697690b55	{cmd/tailscale/cli,ipn}: add http support to tailscale serve (#8358 ) Updates #8357 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	2 years ago
Graham Christensen	4dda949760	tailscale ping: note that `-c` can take 0 for infinity Signed-off-by: Graham Christensen <graham@grahamc.com>	3 years ago
Brad Fitzpatrick	67e912824a	all: adjust some build tags for wasi A start. Updates #8320 Change-Id: I64057f977be51ba63ce635c56d67de7ecec415d1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	eefee6f149	all: use cmpx.Or where it made sense I left a few out where writing it explicitly was better for various reasons. Updates #8296 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Klotz	2aa8299c37	cmd/tailscaled, util/winutil: log our registry keys during tailscaled startup In order to improve our ability to understand the state of policies and registry settings when troubleshooting, we enumerate all values in all subkeys. x/sys/windows does not already offer this, so we need to call RegEnumValue directly. For now we're just logging this during startup, however in a future PR I plan to also trigger this code during a bugreport. I also want to log more than just registry. Fixes #8141 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Vince Prignano	1a691ec5b2	cmd/k8s-operator: update controller-runtime to v0.15 Fixes #8170 Signed-off-by: Vince Prignano <vince@prigna.com>	3 years ago
David Anderson	32e0ba5e68	release/dist/synology: build synology packages with cmd/dist Updates #8217 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Gabriel Martinez	03e848e3b5	cmd/k8s-operator: add support for priorityClassName Updates #8155 Signed-off-by: Gabriel Martinez <gabrielmartinez@sisti.pt>	3 years ago
Derek Kaser	7c88eeba86	cmd/tailscale: allow Tailscale to work with Unraid web interface (#8062 ) Updates tailscale/tailscale#8026 Signed-off-by: Derek Kaser <derek.kaser@gmail.com>	3 years ago
Sonia Appasamy	f0ee03dfaf	cmd/tailscale/cli: [serve] add reset flag Usage: `tailscale serve reset` Fixes #8139 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	3 years ago
Brad Fitzpatrick	4664318be2	client/tailscale: revert CreateKey API change, add Client.CreateKeyWithExpiry The client/tailscale is a stable-ish API we try not to break. Revert the Client.CreateKey method as it was and add a new CreateKeyWithExpiry method to do the new thing. And document the expiry field and enforce that the time.Duration can't be between in range greater than 0 and less than a second. Updates #7143 Updates #8124 (reverts it, effectively) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
shayne	678bb92bb8	cmd/tailscale/cli: [up] fix CreateKey missing argument (#8124 ) Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	3 years ago
Matt Brown	9b6e48658f	client: allow the expiry time to be specified for new keys Adds a parameter for create key that allows a number of seconds (less than 90) to be specified for new keys. Fixes https://github.com/tailscale/tailscale/issues/7965 Signed-off-by: Matthew Brown <matthew@bargrove.com>	3 years ago
Maisem Ali	85215ed58a	cmd/k8s-operator: handle NotFound secrets getSingleObject can return `nil, nil`, getDeviceInfo was not handling that case which resulted in panics. Fixes #7303 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Joe Tsai	84c99fe0d9	logtail: be less aggressive about re-uploads (#8117 ) The retry logic was pathological in the following ways: * If we restarted the logging service, any pending uploads would be placed in a retry-loop where it depended on backoff.Backoff, which was too aggresive. It would retry failures within milliseconds, taking at least 10 retries to hit a delay of 1 second. * In the event where a logstream was rate limited, the aggressive retry logic would severely exacerbate the problem since each retry would also log an error message. It is by chance that the rate of log error spam does not happen to exceed the rate limit itself. We modify the retry logic in the following ways: * We now respect the "Retry-After" header sent by the logging service. * Lacking a "Retry-After" header, we retry after a hard-coded period of 30 to 60 seconds. This avoids the thundering-herd effect when all nodes try reconnecting to the logging service at the same time after a restart. * We do not treat a status 400 as having been uploaded. This is simply not the behavior of the logging service. Updates #tailscale/corp#11213 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Brad Fitzpatrick	cb2fd5be92	cmd/tsconnect: fix forgotten API change for wasm Fix regression from `6e967446e4` Updates #8036 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4f454f4122	util/codegen: support embedded fields I noticed cmd/{cloner,viewer} didn't support structs with embedded fields while working on a change in another repo. This adds support. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Craig Rodrigues	827abbeeaa	cmd/k8s-operator: print version in startup logs Fixes: #7813 Signed-off-by: Craig Rodrigues <rodrigc@crodrigues.org>	3 years ago
Chenyang Gao	b9fb8ac702	fix sys.Set(router) issue will crash the daemon in some OSs Signed-off-by: Chenyang Gao <gps949@outlook.com> in commit `6e96744`, the tsd system type has been added. Which will cause the daemon will crash on some OSs (Windows, darwin and so on). The root cause is that on those OSs, handleSubnetsInNetstack() will return true and set the conf.Router with a wrapper. Later in NewUserspaceEngine() it will do subsystem set and found that early set router mismatch to current value, then panic.	3 years ago
Brad Fitzpatrick	6e967446e4	tsd: add package with System type to unify subsystem init, discovery This is part of an effort to clean up tailscaled initialization between tailscaled, tailscaled Windows service, tsnet, and the mac GUI. Updates #8036 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Derek Kaser	0d7303b798	various: add detection and Taildrop for Unraid Updates tailscale/tailscale#8025 Signed-off-by: Derek Kaser <derek.kaser@gmail.com>	3 years ago
Brad Fitzpatrick	9e9ea6e974	go.mod: bump all deps possible that don't break the build This holds back gvisor, kubernetes, goreleaser, and esbuild, which all had breaking API changes. Updates #8043 Updates #7381 Updates #8042 (updates u-root which adds deps) Change-Id: I889759bea057cd3963037d41f608c99eb7466a5b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Charlotte Brandhorst-Satzkorn	ddb4040aa0	wgengine/magicsock: add address selection for wireguard only endpoints (#7979 ) This change introduces address selection for wireguard only endpoints. If a endpoint has not been used before, an address is randomly selected to be used based on information we know about, such as if they are able to use IPv4 or IPv6. When an address is initially selected, we also initiate a new ICMP ping to the endpoints addresses to determine which endpoint offers the best latency. This information is then used to update which endpoint we should be using based on the best possible route. If the latency is the same for a IPv4 and an IPv6 address, IPv6 will be used. Updates #7826 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	3 years ago
Denton Gentry	a82f275619	cmd/sniproxy: Set App name in tsnet hostinfo Updates #1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Kyle Carberry	d78b334964	cmd/derper: disable http2 DERP doesn't support HTTP/2. If an HTTP/2 proxy was placed in front of a DERP server requests would fail because the connection would be initialized with HTTP/2, which the DERP client doesn't support. Signed-off-by: Kyle Carberry <kyle@carberry.com>	3 years ago
Charlotte Brandhorst-Satzkorn	161d1d281a	net/ping,netcheck: add v6 pinging capabilities to pinger (#7971 ) This change adds a v6conn to the pinger to enable sending pings to v6 addrs. Updates #7826 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	3 years ago
Maisem Ali	a8f10c23b2	cmd/tailscale/cli: [up] reuse --advertise-tags for OAuth key generation We need to always specify tags when creating an AuthKey from an OAuth key. Check for that, and reuse the `--advertise-tags` param. Updates #7982 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	b2b5379348	cmd/tailscale/cli: [up] change oauth authkey format Updates #7982 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	13de36303d	cmd/tailscale/cli: [up] add experimental oauth2 authkey support Updates #7982 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
shayne	018a382729	cmd/tailscale/cli: [serve] fix MinGW path conversion (#7964 ) Fixes #7963 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	3 years ago
Mihai Parparita	7330aa593e	all: avoid repeated default interface lookups On some platforms (notably macOS and iOS) we look up the default interface to bind outgoing connections to. This is both duplicated work and results in logspam when the default interface is not available (i.e. when a phone has no connectivity, we log an error and thus cause more things that we will try to upload and fail). Fixed by passing around a netmon.Monitor to more places, so that we can use its cached interface state. Fixes #7850 Updates #7621 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Mihai Parparita	4722f7e322	all: move network monitoring from wgengine/monitor to net/netmon We're using it in more and more places, and it's not really specific to our use of Wireguard (and does more just link/interface monitoring). Also removes the separate interface we had for it in sockstats -- it's a small enough package (we already pull in all of its dependencies via other paths) that it's not worth the extra complexity. Updates #7621 Updates #7850 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Andrew Dunham	f85dc6f97c	ci: add more lints (#7909 ) This is a follow-up to #7905 that adds two more linters and fixes the corresponding findings. As per the previous PR, this only flags things that are "obviously" wrong, and fixes the issues found. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8739bdb7bc4f75666a7385a7a26d56ec13741b7c	3 years ago
Andrew Dunham	280255acae	various: add golangci-lint, fix issues (#7905 ) This adds an initial and intentionally minimal configuration for golang-ci, fixes the issues reported, and adds a GitHub Action to check new pull requests against this linter configuration. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8f38fbc315836a19a094d0d3e986758b9313f163	3 years ago
Mihai Parparita	9a655a1d58	net/dnsfallback: more explicitly pass through logf function Redoes the approach from #5550 and #7539 to explicitly pass in the logf function, instead of having global state that can be overridden. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Andrew Dunham	228d0c6aea	net/netcheck: use dnscache.Resolver when resolving DERP IPs This also adds a bunch of tests for this function to ensure that we're returning the proper IP(s) in all cases. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I0d9d57170dbab5f2bf07abdf78ecd17e0e635399	3 years ago
Anton Tolchanov	8546ff98fb	tsweb: move varz handler(s) into separate modules This splits Prometheus metric handlers exposed by tsweb into two modules: - `varz.Handler` exposes Prometheus metrics generated by our expvar converter; - `promvarz.Handler` combines our expvar-converted metrics and native Prometheus metrics. By default, tsweb will use the promvarz handler, however users can keep using only the expvar converter. Specifically, `tailscaled` now uses `varz.Handler` explicitly, which avoids a dependency on the (heavyweight) Prometheus client. Updates https://github.com/tailscale/corp/issues/10205 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 years ago
Anton Tolchanov	c153e6ae2f	prober: migrate to Prometheus metric library This provides an example of using native Prometheus metrics with tsweb. Prober library seems to be the only user of PrometheusVar, so I am removing support for it in tsweb. Updates https://github.com/tailscale/corp/issues/10205 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 years ago
Anton Tolchanov	11e6247d2a	tsweb: expose native Prometheus metrics in /debug/varz The handler will expose built-in process and Go metrics by default, which currently duplicate some of the expvar-proxied metrics (`goroutines` vs `go_goroutines`, `memstats` vs `go_memstats`), but as long as their names are different, Prometheus server will just scrape both. This will change /debug/varz behaviour for most tsweb binaries, but notably not for control, which configures a `tsweb.VarzHandler` [explicitly](`a5b5d5167f/cmd/tailcontrol/tailcontrol.go (L779)`) Updates https://github.com/tailscale/corp/issues/10205 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 years ago
Tom DNetto	6a627e5a33	net, wgengine/capture: encode NAT addresses in pcap stream Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
phirework	c0e0a5458f	cmd/tailscale: show reauth etc. links even if no login name (#7803 ) Signed-off-by: Jenny Zhang <jz@tailscale.com>	3 years ago
shayne	81fd00a6b7	cmd/tailscale/cli: [serve] add support for proxy paths (#7800 )	3 years ago
valscale	7bfb7744b7	derp,magicsock: add debug envknobs for HTTP and derp server name (#7744 ) Make developing derp easier by: 1. Creating an envknob telling clients to use HTTP to connect to derp servers, so devs don't have to acquire a valid TLS cert. 2. Creating an envknob telling clients which derp server to connect to, so devs don't have to edit the ACLs in the admin console to add a custom DERP map. 3. Explaining how the -dev and -a command lines args to derper interact. To use this: 1. Run derper with -dev. 2. Run tailscaled with TS_DEBUG_USE_DERP_HTTP=1 and TS_DEBUG_USE_DERP_ADDR=localhost This will result in the client connecting to derp via HTTP on port 3340. Fixes #7700 Signed-off-by: Val <valerie@tailscale.com>	3 years ago
Aaron Klotz	90fd04cbde	ipn/ipnlocal, util/winutil/policy: modify Windows profile migration to load legacy prefs from within tailscaled I realized that a lot of the problems that we're seeing around migration and LocalBackend state can be avoided if we drive Windows pref migration entirely from within tailscaled. By doing it this way, tailscaled can automatically perform the migration as soon as the connection with the client frontend is established. Since tailscaled is already running as LocalSystem, it already has access to the user's local AppData directory. The profile manager already knows which user is connected, so we simply need to resolve the user's prefs file and read it from there. Of course, to properly migrate this information we need to also check system policies. I moved a bunch of policy resolution code out of the GUI and into a new package in util/winutil/policy. Updates #7626 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Andrew Dunham	8d3acc9235	util/sysresources, magicsock: scale DERP buffer based on system memory This adds the util/sysresources package, which currently only contains a function to return the total memory size of the current system. Then, we modify magicsock to scale the number of buffered DERP messages based on the system's available memory, ensuring that we never use a value lower than the previous constant of 32. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib763c877de4d0d4ee88869078e7d512f6a3a148d	3 years ago
shayne	59879e5770	cmd/tailscale/cli: make serve and funnel visible in list (#7737 )	3 years ago
Mihai Parparita	02582083d5	cmd/tsconnect: allow root directory to be passed in #7339 changed the root directory logic to find the ancestor of the cwd with a go.mod file. This works when running the the binary from this repo directly, but breaks when we're a dependency in another repo. Allow the directory to be passed in via a -rootdir flag (the repo that depends on it can then use `go list -m -f '{{.Dir}}' tailscale.com` or similar to pass in the value). Updates tailscale/corp#10165 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Andrew Dunham	38e4d303a2	net/tshttpproxy: don't proxy through ourselves When running a SOCKS or HTTP proxy, configure the tshttpproxy package to drop those addresses from any HTTP_PROXY or HTTPS_PROXY environment variables. Fixes #7407 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6cd7cad7a609c639780484bad521c7514841764b	3 years ago
Maisem Ali	985535aebc	net/tstun,wgengine/*: add support for NAT to routes This adds support to make exit nodes and subnet routers work when in scenarios where NAT is required. It also updates the NATConfig to be generated from a `wgcfg.Config` as that handles merging prefs with the netmap, so it has the required information about whether an exit node is already configured and whether routes are accepted. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Andrew Dunham	c98652c333	doctor/permissions: add new check to print process permissions Since users can run tailscaled in a variety of ways (root, non-root, non-root with process capabilities on Linux), this check will print the current process permissions to the log to aid in debugging. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ida93a206123f98271a0c664775d0baba98b330c7	3 years ago
James Tucker	a31e43f760	go.mod: bump gvisor to 20230320 for dispatcher locking Upstream improved code around an issue showing up in CI, where sometimes shutdown will race on endpoint.dispatcher being nil'd, causing a panic down stack of injectInbound. The upstream patch makes some usage more safe, but it does not itself fix the local issue. See panic in https://github.com/tailscale/tailscale/actions/runs/4548299564/jobs/8019187385#step:7:843 See fix in google/gvisor@13d7bf69d8 Updates #7715 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Anton Tolchanov	2a933c1903	cmd/tailscale: extend hostname validation (#7678 ) In addition to checking the total hostname length, validate characters used in each DNS label and label length. Updates https://github.com/tailscale/corp/issues/10012 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 years ago
shayne	43f7ec48ca	funnel: change references from alpha to beta (#7613 ) Updates CLI and docs to reference Funnel as beta Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	3 years ago
valscale	74eb99aed1	derp, derphttp, magicsock: send new unknown peer frame when destination is unknown (#7552 ) * wgengine/magicsock: add envknob to send CallMeMaybe to non-existent peer For testing older client version responses to the PeerGone packet format change. Updates #4326 Signed-off-by: Val <valerie@tailscale.com> * derp: remove dead sclient struct member replaceLimiter Leftover from an previous solution to the duplicate client problem. Updates #2751 Signed-off-by: Val <valerie@tailscale.com> * derp, derp/derphttp, wgengine/magicsock: add new PeerGone message type Not Here Extend the PeerGone message type by adding a reason byte. Send a PeerGone "Not Here" message when an endpoint sends a disco message to a peer that this server has no record of. Fixes #4326 Signed-off-by: Val <valerie@tailscale.com> --------- Signed-off-by: Val <valerie@tailscale.com>	3 years ago
Maisem Ali	8a11f76a0d	ipn/ipnlocal: fix cert storage in Kubernetes We were checking against the wrong directory, instead if we have a custom store configured just use that. Fixes #7588 Fixes #7665 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	df89b7de10	cmd/k8s-operator: disable HTTP/2 for the auth proxy Kubernetes uses SPDY/3.1 which is incompatible with HTTP/2, disable it in the transport and server. Fixes #7645 Fixes #7646 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Will Norris	57a008a1e1	all: pass log IDs as the proper type rather than strings This change focuses on the backend log ID, which is the mostly commonly used in the client. Tests which don't seem to make use of the log ID just use the zero value. Signed-off-by: Will Norris <will@tailscale.com>	3 years ago
Tom DNetto	60cd4ac08d	cmd/tailscale/cli: move tskey-wrap functionality under lock sign Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Mihai Parparita	e1fb687104	cmd/tailscale/cli: fix inconsistency between serve text and example command Use the same local port number in both, and be more precise about what is being forwarded Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Anton Tolchanov	50d211d1a4	cmd/derpprobe: allow running all probes at the same time This allows disabling spread mode, which is helpful if you are manually running derpprobe in `--once` mode against a small number of DERP machines. Updates https://github.com/tailscale/corp/issues/9916 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 years ago
James 'zofrex' Sanderson	9534783758	tailscale/cmd: Warn for up --force-reauth over SSH without accepting the risk (#7575 ) Fixes #6377 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	3 years ago
shayne	2b892ad6e7	cmd/tailscale/cli: [serve] rework commands based on feedback (#6521 ) ``` $ tailscale serve https:<port> <mount-point> <source> [off] $ tailscale serve tcp:<port> tcp://localhost:<local-port> [off] $ tailscale serve tls-terminated-tcp:<port> tcp://localhost:<local-port> [off] $ tailscale serve status [--json] $ tailscale funnel <serve-port> {on\|off} $ tailscale funnel status [--json] ``` Fixes: #6674 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	3 years ago
Maisem Ali	c87782ba9d	cmd/k8s-operator: drop trailing dot in tagged node name Also update tailcfg docs. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Will Norris	a1d9f65354	ipn,log: add logger for sockstat deltas Signed-off-by: Will Norris <will@tailscale.com> Co-authored-by: Melanie Warrick <warrick@tailscale.com>	3 years ago
Maisem Ali	5e8a80b845	all: replace /kb/ links with /s/ equivalents Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	558735bc63	cmd/k8s-operator: require HTTPS to be enabled for AuthProxy Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	489e27f085	cmd/k8s-operator: make auth proxy pass tags as Impersonate-Group We were not handling tags at all, pass them through as Impersonate-Group headers. And use the FQDN for tagged nodes as Impersonate-User. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	09aed46d44	cmd/tailscale/cli: update docs and unhide configure Also call out Alpha. Updates #7220 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	223713d4a1	tailcfg,all: add and use Node.IsTagged() Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	3ff44b2307	ipn: add Funnel port check from nodeAttr Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	ccdd534e81	tsnet: add ListenFunnel This lets a tsnet binary share a server out over Tailscale Funnel. Signed-off-by: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	3 years ago
Tom DNetto	92fc243755	cmd/tailscale: annotate tailnet-lock keys which wrap pre-auth keys Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Tom DNetto	3471fbf8dc	cmd/tailscale: surface node-key for locked out tailnet-lock peers Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Maisem Ali	be027a9899	control/controlclient: improve handling of concurrent lite map requests This reverts commit `6eca47b16c` and fixes forward. Previously the first ever streaming MapRequest that a client sent would also set ReadOnly to true as it didn't have any endpoints and expected/relied on the map poll to restart as soon as it got endpoints. However with `48f6c1eba4`, we would no longer restart MapRequests as frequently as we used to, so control would only ever get the first streaming MapRequest which had ReadOnly=true. Control would treat this as an uninteresting request and would not send it any further netmaps, while the client would happily stay in the map poll forever while litemap updates happened in parallel. This makes it so that we never set `ReadOnly=true` when we are doing a streaming MapRequest. This is no longer necessary either as most endpoint discovery happens over disco anyway. Co-authored-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Tom DNetto	ce99474317	all: implement preauth-key support with tailnet lock Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Andrew Dunham	be107f92d3	wgengine/magicsock: track per-endpoint changes in ringbuffer This change adds a ringbuffer to each magicsock endpoint that keeps a fixed set of "changes"–debug information about what updates have been made to that endpoint. Additionally, this adds a LocalAPI endpoint and associated "debug peer-status" CLI subcommand to fetch the set of changes for a given IP or hostname. Updates tailscale/corp#9364 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I34f726a71bddd0dfa36ec05ebafffb24f6e0516a	3 years ago
shayne	f7a7957a11	sniproxy: add promote-https (#7487 ) Adds support for an HTTP server that promotes all requests to HTTPS. The flag is `-promote-https` and defaults to true. Updates #1748	3 years ago
Denton Gentry	b46c5ae82a	cmd/sniproxy: draw the rest of the DNS owl. Add a DNS server which always responds as its own IP addresses. Additionally add a tsnet TailscaleIPs() function to return the IP addresses, both IPv4 and IPv6. Updates https://github.com/tailscale/tailscale/issues/1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Tom DNetto	2263d9c44b	cmd/tsconnect: pop CTA to make everything work with tailnet lock Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	0f4359116e	tsnet: add UDP support to Server.Listen No ListenPacket support yet, but Listen with a udp network type fit easier into netstack's model to start. Then added an example of using it to cmd/sniproxy with a little udp :53 handler. No tests in tsnet yet because we don't have support for dialing over UDP in tsnet yet. When that's done, a new test can test both sides. Updates #5871 Updates #1748 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	1a30b2d73f	all: use tstest.Replace more Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	b9ebf7cf14	tstest: add method to Replace values for tests We have many function pointers that we replace for the duration of test and restore it on test completion, add method to do that. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Andrew Dunham	73fa7dd7af	util/slicesx: add package for generic slice functions, use Now that we're using rand.Shuffle in a few locations, create a generic shuffle function and use it instead. While we're at it, move the interleaveSlices function to the same package for use. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I0b00920e5b3eea846b6cedc30bd34d978a049fd3	3 years ago
Tom DNetto	e2d652ec4d	ipn,cmd/tailscale: implement resigning nodes on tka key removal Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Andrew Dunham	3f8e8b04fd	cmd/tailscale, cmd/tailscaled: move portmapper debugging into tailscale CLI The debug flag on tailscaled isn't available in the macOS App Store build, since we don't have a tailscaled binary; move it to the 'tailscale debug' CLI that is available on all platforms instead, accessed over LocalAPI. Updates #7377 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I47bffe4461e036fab577c2e51e173f4003592ff7	3 years ago
Mihai Parparita	3e71e0ef68	net/sockstats: remove explicit dependency on wgengine/monitor Followup to #7177 to avoid adding extra dependencies to the CLI. We instead declare an interface for the link monitor. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
shayne	d92ef4c215	cmd/derper: randomize IPs on refreshBootstrapDNS (#7440 ) This is to address a possible DNS failure on startup. Before this change IPv6 addresses would be listed first, and the client dialer would fail for hosts without IPv6 connectivity.	3 years ago
Brad Fitzpatrick	1410682fb6	cmd/sniproxy: add start of a tsnet-based SNI proxy $ curl https://canhazip.com/ 170.173.0.21 $ curl --resolve canhazip.com:443:100.85.165.81 https://canhazip.com/ 34.223.127.151 Updates #1748 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	e1530cdfcc	cmd/containerboot,kube: consolidate the two kube clients We had two implemenetations of the kube client, merge them. containerboot was also using a raw http.Transport, this also has the side effect of making it use a http.Client Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Denton Gentry	51288221ce	cmd/tailscale: use request Schema+Host for QNAP authLogin.cgi QNAP allows users to set the port number for the management WebUI, which includes authLogin.cgi. If they do, then connecting to localhost:8080 fails. https://github.com/tailscale/tailscale-qpkg/issues/74#issuecomment-1407486911 Fixes https://github.com/tailscale/tailscale/issues/7108 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Aaron Klotz	f18beaa1e4	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS Given recent changes in corp, I originally thought we could remove all of the syso files, but then I realized that we still need them so that binaries built purely from OSS (without going through corp) will still receive a manifest. We can remove the arm32 one though, since we don't support 32-bit ARM on Windows. Updates https://github.com/tailscale/corp/issues/9576 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Sonia Appasamy	7985f5243a	cmd/k8s-operator: update device authorization copy "Device Authorization" was recently renamed to "Device Approval" on the control side. This change updates the k8s operator to match. Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	3 years ago
Sonia Appasamy	bb7033174c	cmd/tsconnect: update device authorization copy "Device Authorization" was recently renamed to "Device Approval" on the control side. This change updates tsconnect to match. Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	3 years ago
Mihai Parparita	9cb332f0e2	sockstats: instrument networking code paths Uses the hooks added by tailscale/go#45 to instrument the reads and writes on the major code paths that do network I/O in the client. The convention is to use "<package>.<type>:<label>" as the annotation for the responsible code path. Enabled on iOS, macOS and Android only, since mobile platforms are the ones we're most interested in, and we are less sensitive to any throughput degradation due to the per-I/O callback overhead (macOS is also enabled for ease of testing during development). For now just exposed as counters on a /v0/sockstats PeerAPI endpoint. We also keep track of the current interface so that we can break out the stats by interface. Updates tailscale/corp#9230 Updates #3363 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Sonia Appasamy	0c1510739c	cmd/tailscale/cli: update device authorization copy "Device Authorization" was recently renamed to "Device Approval" on the control side. This change updates the linux cli to match. Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	3 years ago
Joe Tsai	0d19f5d421	all: replace logtail.{Public,Private}ID with logid.{Public,Private}ID (#7404 ) The log ID types were moved to a separate package so that code that only depend on log ID types do not need to link in the logic for the logtail client itself. Not all code need the logtail client. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Vladimir Pouzanov	e3211ff88b	Add support for OAuth tokens #7394 (#7393 ) Signed-off-by: Vladimir Pouzanov <farcaller@gmail.com>	3 years ago
Maisem Ali	49c206fe1e	tailcfg,hostinfo: add App field to identify tsnet uses This allows us to differentiate between the various tsnet apps that we have like `golinks` and `k8s-operator`. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Denton Gentry	bf7573c9ee	cmd/nginx-auth: build for arm64 Fixes https://github.com/tailscale/tailscale/issues/6978 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Jordan Whited	d4122c9f0a	cmd/tailscale/cli: fix TestUpdatePrefs over Tailscale SSH (#7374 ) Fixes #7373 Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 years ago
David Anderson	587eb32a83	release/dist: add forgotten license headers Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	cf74ee49ee	release/dist/cli: factor out the CLI boilerplace from cmd/dist Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	fc4b25d9fd	release: open-source release build logic for unix packages Updates tailscale/corp#9221 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maisem Ali	06a10125fc	cmd/k8s-operator: set hostinfo.Package This allows identifying the operator. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Anderson	0b8f89c79c	cmd/tsconnect: find the build dir independently of -trimpath trimmed builds don't have absolute path information in executable metadata, which leads the runtime.Caller approach failing mysteriously in yarn with complaints about relative package paths. So, instead of using embedded package metadata to find paths, expect that we're being invoked within the tailscale repo, and locate the tsconnect directory that way. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	1dadbbb72a	version/mkversion: open-source version generation logic In preparation for moving more of the release building here too. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maisem Ali	d811c5a7f0	cmd/tailscale/cli: handle home dir correctly on macOS for kubeconfig This ensures that we put the kubeconfig in the correct directory from within the macOS Sandbox when paired with tailscale/corp@3035ef7 Updates #7220 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	c01c84ea8e	cmd/tailscale/cli: add "configure kubeconfig" subcommand It takes in a node hostname and configures the local kubeconfig file to point to that. Updates #7220 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	181a3da513	cmd/tailscale/cli: add a hidden configure subcommand Also make `tailscale configure-host` an alias to `tailscale configure synology` Updates #7220 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Jenny Zhang	fe5558094c	cmd/tailscale/cli: add logout and debug info to web Fixes #7238 Signed-off-by: Jenny Zhang <jz@tailscale.com>	3 years ago
David Anderson	bd81d520ab	cmd/printdep: print correct toolchain URL In the switch to static toolchains, we removed a legacy oddity from the toolchain URL structure, but forgot to update printdep. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	70a2929a12	version: make all exported funcs compile-time constant or lazy Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	8b2ae47c31	version: unexport all vars, turn Short/Long into funcs The other formerly exported values aren't used outside the package, so just unexport them. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Denton Gentry	5bca44d572	cmd/sync-containers: update latest and stable tags Fixes https://github.com/tailscale/tailscale/issues/7251 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Mihai Parparita	fa932fefe7	net/interfaces: redo how we get the default interface on macOS and iOS With #6566 we added an external mechanism for getting the default interface, and used it on macOS and iOS (see tailscale/corp#8201). The goal was to be able to get the default physical interface even when using an exit node (in which case the routing table would say that the Tailscale utun* interface is the default). However, the external mechanism turns out to be unreliable in some cases, e.g. when multiple cellular interfaces are present/toggled (I have occasionally gotten my phone into a state where it reports the pdp_ip1 interface as the default, even though it can't actually route traffic). It was observed that `ifconfig -v` on macOS reports an "effective interface" for the Tailscale utn* interface, which seems promising. By examining the ifconfig source code, it turns out that this is done via a SIOCGIFDELEGATE ioctl syscall. Though this is a private API, it appears to have been around for a long time (e.g. it's in the 10.13 xnu release at https://opensource.apple.com/source/xnu/xnu-4570.41.2/bsd/net/if_types.h.auto.html) and thus is unlikely to go away. We can thus use this ioctl if the routing table says that a utun* interface is the default, and go back to the simpler mechanism that we had before #6566. Updates #7184 Updates #7188 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Will Norris	6ef834a6b7	get-authkey: require tags to be specified Tailnet-owned auth keys (which all OAuth-created keys are) must include tags, since there is no user to own the registered devices. Signed-off-by: Will Norris <will@tailscale.com>	3 years ago
Maisem Ali	05adf22383	cmd/k8s-operator: add support for running an auth proxy Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Tom DNetto	99b9d7a621	all: implement pcap streaming for datapath debugging Updates: tailscale/corp#8470 Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Denton Gentry	4daba23cd4	cmd/get-authkey: add an OAuth API client to produce an authkey Updates https://github.com/tailscale/tailscale/issues/3243 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Maisem Ali	6bae55e351	ipn/ipnlocal: add support to store certs in k8s secrets Fixes #5676 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Anderson	02a2dcfc86	go.toolchain.rev: use new statically built toolchain Also removes the toolchain builds from flake.nix. For now the flake build uses upstream Go 1.20, a followup change will switch it back to our custom toolchain. Updates tailscale/corp#9005 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	03645f0c27	net/{netns,netstat}: use new x/sys/cpu.IsBigEndian See golang/go#57237 Change-Id: If47ab6de7c1610998a5808e945c4177c561eab45 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Andrew Dunham	2755f3843c	health, net/tlsdial: add healthcheck for self-signed cert When we make a connection to a server, we previously would verify with the system roots, and then fall back to verifying with our baked-in Let's Encrypt root if the system root cert verification failed. We now explicitly check for, and log a health error on, self-signed certificates. Additionally, we now always verify against our baked-in Let's Encrypt root certificate and log an error if that isn't successful. We don't consider this a health failure, since if we ever change our server certificate issuer in the future older non-updated versions of Tailscale will no longer be healthy despite being able to connect. Updates #3198 Change-Id: I00be5ceb8afee544ee795e3c7a2815476abc4abf Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	3 years ago
Brad Fitzpatrick	b1248442c3	all: update to Go 1.20, use strings.CutPrefix/Suffix instead of our fork Updates #7123 Updates #5309 Change-Id: I90bcd87a2fb85a91834a0dd4be6e03db08438672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Will Norris	51e1ab5560	fixup! util/vizerror: add new package for visible errors Signed-off-by: Will Norris <will@tailscale.com>	3 years ago
Brad Fitzpatrick	ca45fe2d46	cmd/tailscale/cli: delete ActLikeCLI It's since been rewritten in Swift. #cleanup Change-Id: I0860d681e8728697804ce565f63c5613b8b1088c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Mihai Parparita	0039993359	cmd/tsconnect: update to xterm.js 5.1 It includes xtermjs/xterm.js#4216, which improves handling of some escape sequences. Unfortunately it's not enough to fix the issue with `ponysay`, but it does not hurt to be up to date. Updates #6090 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Anton Tolchanov	100d8e909e	cmd/derpprobe: migrate to the prober framework `prober.DERP` was created in #5988 based on derpprobe. Having used it instead of derpprobe for a few months, I think we have enough confidence that it works and can now migrate derpprobe to use the prober framework and get rid of code duplication. A few notable changes in behaviour: - results of STUN probes over IPv4 and IPv6 are now reported separately; - TLS probing now includes OCSP verification; - probe names in the output have changed; - ability to send Slack notification from the prober has been removed. Instead, the prober now exports metrics in Expvar (/debug/vars) and Prometheus (/debug/varz) formats. Fixes https://github.com/tailscale/corp/issues/8497 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 years ago
Brad Fitzpatrick	01e736e1d5	go.toolchain.rev: update to Go 1.20rc3 Updates #7123 Change-Id: Ibdf53530251c120e7e20c24abcf4a05f2ff7ac97 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	04b57a371e	ipn/ipnlocal: drop not required StateKey parameter This is #cleanup now that #7121 is merged. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Mihai Parparita	73d33e3f20	cmd/tsconnect: use empty string as the default state store key Makes the Wasm client more similar to the others, and allows the default profile to be correctly picked up when restarting the client in dev mode (where we persist the state in sessionStorage). Also update README to reflect that Go wasm changes can be picked up with just a reload (as of #5383) Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Maisem Ali	4441609d8f	safesocket: remove the now unused WindowsLocalPort Also drop the port param from safesocket.Listen. #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Anderson	e51cf1b09d	cmd/k8s-operator: use unstable tailscale image as well We need a post-1.36 tailscale image to handle custom hostnames correctly. Updates #502 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	0dc9cbc9ab	cmd/k8s-operator: use the unstable operator image There is no stable release yet, and for alpha we want people on the unstable build while we iterate. Updates #502 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Will Norris	947c14793a	all: update tools that manage copyright headers Update all code generation tools, and those that check for license headers to use the new standard header. Also update copyright statement in LICENSE file. Fixes #6865 Signed-off-by: Will Norris <will@tailscale.com>	3 years ago
Will Norris	71029cea2d	all: update copyright and license headers This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>	3 years ago
Brad Fitzpatrick	a1b4ab34e6	util/httpm: add new package for prettier HTTP method constants See package doc. Change-Id: Ibbfc8e1f98294217c56f3a9452bd93ffa3103572 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	7439bc7ba6	cmd/sync-containers: add github.Keychain Running sync-containers in a GitHub workflow will be simpler if we check github.Keychain, which uses the GITHUB_TOKEN if present. Updates https://github.com/tailscale/corp/issues/8461 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
David Anderson	9bd6a2fb8d	cmd/k8s-operator: support setting a custom hostname. Updates #502 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Xe Iaso	038d25bd04	cmd/nginx-auth: update Expected-Tailnet documentation (#6055 ) Signed-off-by: Xe Iaso <xe@tailscale.com>	3 years ago
phirework	2d29f77b24	cmd/tailscale/cli: fix TUNmode display on synology web page (#7064 ) Fixes #7059 Signed-off-by: Jenny Zhang <jz@tailscale.com> Signed-off-by: Jenny Zhang <jz@tailscale.com>	3 years ago
Vince Prignano	30380403d0	cmd/k8s-operator: remove use of InjectClient (deprecated) The dependency injection functionality has been deprecated a while back and it'll be removed in the 0.15 release of Controller Runtime. This changeset sets the Client after creating the Manager, instead of using InjectClient. Signed-off-by: Vince Prignano <vince@prigna.com>	3 years ago
Anton Tolchanov	e8b695626e	cmd/mkpkg: allow specifying recommended dependencies Updates #3151 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 years ago
Brad Fitzpatrick	c8db70fd73	cmd/tailscale/cli: add debug set-expire command for testing Updates tailscale/corp#8811 Updates tailscale/corp#8613 Change-Id: I1c87806ca3ccc5c43e7ddbd6b4d521f73f7d29f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	06fff461dc	ipn/ipnstate: add PeerStatus.KeyExpiry for tailscale status --json Fixes #6712 Change-Id: I817cd5342fac8a956fcefda2d63158fa488f3395 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Andrew Dunham	b74db24149	tstest/integration: mark all integration tests as flaky Updates #7036 Change-Id: I3aec5ad680078199ba984bf8afc20b2f2eb37257 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	3 years ago
Brad Fitzpatrick	fd92fbd69e	cmd/tailscale/cli: only give systemctl hint on systemd systems Per recent user confusion on a QNAP issue. Change-Id: Ibda00013df793fb831f4088b40be8a04dfad17c2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ba5aa2c486	version, cmd/tailscale: add version.Meta, tailscale version --json Add `tailscale version --json` JSON output mode. This will be used later for a double-opt-in (per node consent like Tailscale SSH + control config) to let admins do remote upgrades via `tailscale update` via a c2n call, which would then need to verify the cmd/tailscale found on disk for running tailscale update corresponds to the running tailscaled, refusing if anything looks amiss. Plus JSON output modes are just nice to have, rather than parsing unstable/fragile/obscure text formats. Updates #6995 Updates #6907 Change-Id: I7821ab7fbea4612f4b9b7bdc1be1ad1095aca71b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5ca22a0068	cmd/tailscale/cli: make 'tailscale update' support Debian/Ubuntu apt Updates #6995 Change-Id: I3355435db583755e0fc73d76347f6423b8939dfb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6793685bba	go.mod: bump AWS SDK past a breaking API change of theirs They changed a type in their SDK which meant others using the AWS APIs in their Go programs (with newer AWS modules in their caller go.mod) and then depending on Tailscale (for e.g. tsnet) then couldn't compile ipn/store/awsstore. Thanks to @thisisaaronland for bringing this up. Fixes #7019 Change-Id: I8d2919183dabd6045a96120bb52940a9bb27193b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
shayne	73399f784b	cmd/tailscale/cli: use mock impl of LocalClient for serve cmd (#6422 ) Create an interface and mock implementation of tailscale.LocalClient for serve command tests. Updates #6304 Closes #6372 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	3 years ago
Brad Fitzpatrick	c129bf1da1	cmd/tailscale/cli: un-alpha login+switch in ShortUsage docs Change-Id: I580d4417cf03833dfa8f6a295fb416faa667c477 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	71a7b8581d	cmd/tailscale/cli: make "update" work on Windows Updates #6995 Co-authored-by: Aaron Klotz <aaron@tailscale.com> Change-Id: I16622f43156a70b6fbc8205239fd489d7378d57b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Andrew Dunham	aea251d42a	cmd/testwrapper: move from corp; mark magicsock test as flaky Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ibab5860f5797b3db151d3c27855333e43a9088a4	3 years ago
Tom DNetto	ee6d18e35f	cmd/tailscale/cli: implement --json for lock status and lock log cmds Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	b657187a69	cmd/tailscale, logtail: add 'tailscale debug daemon-logs' logtail mechanism Fixes #6836 Change-Id: Ia6eb39ff8972e1aa149aeeb63844a97497c2cf04 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d9144c73a8	cmd/tailscale: add start of "tailscale update" command Goal: one way for users to update Tailscale, downgrade, switch tracks, regardless of platform (Windows, most Linux distros, macOS, Synology). This is a start. Updates #755, etc Change-Id: I23466da1ba41b45f0029ca79a17f5796c2eedd92 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
phirework	f011a0923a	cmd/tailscale/cli: style synology outgoing access info (#6959 ) Follow-up to #6957. Updates #4015 Signed-off-by: Jenny Zhang <jz@tailscale.com>	3 years ago
Brad Fitzpatrick	5eded58924	cmd/tailscale/cli: make web show/link Synology outgoing connection mode/docs Fixes #4015 Change-Id: I8230bb0cc3d621b6fa02ab2462cea104fa1e9cf9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	61dfbc0a6e	cmd/tailscale/cli: plumb TUN mode into tailscale web template UI works remains, but data is there now. Updates #4015 Change-Id: Ib91e94718b655ad60a63596e59468f3b3b102306 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
salman	8a1201ac42	cmd/tailscale: correct order for -terminate-tls flag in serve tcp usage The -terminate-tls flag is for the tcp subsubcommand, not the serve subcommand like the usage example suggests. Signed-off-by: salman <salman@tailscale.com>	3 years ago
Denton Gentry	22ebb25e83	cmd/tailscale: disable HTTPS verification for QNAP auth. QNAP's "Force HTTPS" mode redirects even localhost HTTP to HTTPS, but uses a self-signed certificate which fails verification. We accommodate this by disabling checking of the cert. Fixes https://github.com/tailscale/tailscale/issues/6903 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	1116602d4c	ssh/tailssh: add OpenBSD support for Tailscale SSH And bump go.mod for https://github.com/u-root/u-root/pull/2593 Change-Id: I36ec94c5b2b76d671cb739f1e9a1a43ca1d9d1b1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	39efba528f	cmd/containerboot: use TS_AUTHKEY as the parameter for auth keys We still accept the previous TS_AUTH_KEY for backwards compatibility, but the documented option name is the spelling we use everywhere else. Updates #6321 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	69c0b7e712	ipn/ipnlocal: add c2n handler to flush logtail for support debugging Updates tailscale/corp#8564 Change-Id: I0c619d4007069f90cffd319fba66bd034d63e84d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Tom DNetto	673b3d8dbd	net/dns,userspace: remove unused DNS paths, normalize query limit on iOS With `a42a594bb3`, iOS uses netstack and hence there are no longer any platforms which use the legacy MagicDNS path. As such, we remove it. We also normalize the limit for max in-flight DNS queries on iOS (it was 64, now its 256 as per other platforms). It was 64 for the sake of being cautious about memory, but now we have 50Mb (iOS-15 and greater) instead of 15Mb so we have the spare headroom. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Tom DNetto	907f85cd67	cmd/tailscale,tka: make KeyID return an error instead of panicking Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Tom DNetto	8724aa254f	cmd/tailscale,tka: implement compat for TKA messages, minor UX tweaks Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
David Anderson	91e64ca74f	cmd/tailscale/cli: redact private key in debug netmap output by default This makes `tailscale debug watch-ipn` safe to use for troubleshooting user issues, in addition to local debugging during development. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Denton Gentry	467ace7d0c	cmd/tailscale: use localhost for QNAP authLogin.cgi When the user clicks on the Tailscale app in the QNAP App Center, we do a GET from /cgi-bin/authLogin.cgi to look up their SID. If the user clicked "secure login" on the QNAP login page to use HTTPS, then our access to authLogin.cgi will also use HTTPS but the certiciate is self-signed. Our GET fails with: Get "https://10.1.10.41/cgi-bin/authLogin.cgi?sid=abcd0123": x509: cannot validate certificate for 10.1.10.41 because it doesn't contain any IP SANs or similar errors. Instead, access QNAP authentication via http://localhost:8080/ as documented in https://download.qnap.com/dev/API_QNAP_QTS_Authentication.pdf Fixes https://github.com/tailscale/tailscale-qpkg/issues/62 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	aad6830df0	util/codegen, all: use latest year, not time.Now, in generated files Updates #6865 Change-Id: I6b86c646968ebbd4553cf37df5e5612fbf5c5f7d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	7bfb9999ee	cmd/printdep: support printing the toolchain SRI hash. Updates #6845. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	3599364312	cmd/nardump: Go tool to build Nix NARs and compute their hashes. Updates #6845. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Claire Wang	a45c9f982a	wgengine/netstack: change netstack API to require LocalBackend The macOS client was forgetting to call netstack.Impl.SetLocalBackend. Change the API so that it can't be started without one, eliminating this class of bug. Then update all the callers. Updates #6764 Change-Id: I2b3a4f31fdfd9fdbbbbfe25a42db0c505373562f Signed-off-by: Claire Wang <claire@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
andig	14e8afe444	go.mod, etc: bump gvisor Fixes #6554 Change-Id: Ia04ae37a47b67fa57091c9bfe1d45a1842589aa8 Signed-off-by: andig <cpuidle@gmx.de>	3 years ago
Brad Fitzpatrick	8aac77aa19	cmd/tailscale: fix "up" warning about netfilter-mode on Synology Fixes #6811 Change-Id: Ia43723e6ebedc9b01729897cec271c462b16e9ae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	a1ded4c166	cmd/sync-containers: add a dry-run option. Updates tailscale/corp#8461 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e5fe205c31	cmd/sync-containers: program to sync tags between container registries. Updates tailscale/corp#8461 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	a06217a8bd	cmd/tailscale/cli: hide Windows named pipe default name in flag help It's long & distracting for how low value it is. Fixes #6766 Change-Id: I51364f25c0088d9e63deb9f692ba44031f12251b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Jordan Whited	914d115f65	go.mod: bump tailscale/wireguard-go for big-endian fix (#6785 ) Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 years ago
David Anderson	af3127711a	cmd/containerboot: allow disabling secret storage in k8s. In some configurations, user explicitly do not want to store tailscale state in k8s secrets, because doing that leads to some annoying permission issues with sidecar containers. With this change, TS_KUBE_SECRET="" and TS_STATE_DIR=/foo will force storage to file when running in kubernetes. Fixes #6704. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	c02ccf6424	go.mod: bump dhcp dep to remove another endian package from our tree To pull in insomniacslk/dhcp#484 to pull in u-root/uio#8 Updates golang/go#57237 Change-Id: I1e56656e0dc9ec0b870f799fe3bc18b3caac1ee4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	8171eb600c	cmd/k8s-operator: move the operator into its own namespace. The operator creates a fair bit of internal cluster state to manage proxying, dumping it all in the default namespace is handy for development but rude for production. Updates #502 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	3a5fc233aa	cmd/k8s-operator: use oauth credentials for API access. This automates both the operator's initial login, and provisioning/deprovisioning of proxies. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	a7ab3429b6	cmd/k8s-operator: refactor reconcile loop, un-plumbing reconcile.Result. We used to need to do timed requeues in a few places in the reconcile logic, and the easiest way to do that was to plumb reconcile.Result return values around. But now we're purely event-driven, so the only thing we care about is whether or not an error occurred. Incidentally also fix a very minor bug where headless services would get completely ignored, rather than reconciled into the correct state. This shouldn't matter in practice because you can't transition from a headful to a headless service without a deletion, but for consistency let's avoid having a path that takes no definite action if a service of interest does exist. Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Denton Gentry	da53b1347b	cmd/gitops-pusher: support alternate api-server URLs Fixes https://github.com/tailscale/coral/issues/90 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
David Anderson	835a73cc1f	cmd/k8s-operator: remove unnecessary timed requeue. Previously, we had to do blind timed requeues while waiting for the tailscale hostname, because we looked up the hostname through the API. But now the proxy container image writes back its hostname to the k8s secret, so we get an event-triggered reconcile automatically when the time is right. Updates #502 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	d857fd00b3	cmd/k8s-operator: sprinkle debug logging throughout. As is convention in the k8s world, use zap for structured logging. For development, OPERATOR_LOGGING=dev switches to a more human-readable output than JSON. Updates #502 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	8ccd707218	cmd/k8s-operator: remove times requeues in proxy deletion path. Our reconcile loop gets triggered again when the StatefulSet object finally disappears (in addition to when its deletion starts, as indicated by DeletionTimestamp != 0). So, we don't need to queue additional reconciliations to proceed with the remainder of the cleanup, that happens organically. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	9c77205ba1	cmd/k8s-operator: add more tests for "normal" paths. Tests cover configuring a proxy through an annotation rather than a LoadBalancerClass, and converting between those two modes at runtime. Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	c902190e67	cmd/k8s-operator: factor out some of the larger expected test outputs. For other test cases, the operator is going to produce similar generated objects in several codepaths, and those objects are large. Move them out to helpers so that the main test code stays a bit more intelligible. The top-level Service that we start and end with remains in the main test body, because its shape at the start and end is one of the main things that varies a lot between test cases. Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	8dbb3b8bbe	cmd/k8s-operator: remove unused structs. Cleanup missed in #6718 . Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	53a9cc76c7	cmd/k8s-operator: rename main.go -> operator.go. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	bc8f5a7734	cmd/k8s-operator: add a basic unit test. The test verifies one of the successful reconcile paths, where a client requests an exposed service via a LoadBalancer class. Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	3b7ae39a06	cmd/k8s-operator: use the client's authkey method to create auth keys. Also introduces an intermediary interface for the tailscale client, in preparation for operator tests that fake out the Tailscale API interaction. Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	ca08e316af	util/endian: delete package; use updated josharian/native instead See josharian/native#3 Updates golang/go#57237 Change-Id: I238c04c6654e5b9e7d9cfb81a7bbc5e1043a84a2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	b2d4abf25a	cmd/k8s-operator: add a kubernetes operator. This was initially developed in a separate repo, but for build/release reasons and because go module management limits the damage of importing k8s things now, moving it into this repo. At time of commit, the operator enables exposing services over tailscale, with the 'tailscale' loadBalancerClass. It also currently requires an unreleased feature to access the Tailscale API, so is not usable yet. Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Aaron Klotz	53e2010b8a	cmd/tailscaled: change Windows implementation to shut down subprocess via closing its stdin We've been doing a hard kill of the subprocess, which is only safe as long as both the cli and gui are not running and the subprocess has had the opportunity to clean up DNS settings etc. If unattended mode is turned on, this is definitely unsafe. I changed babysitProc to close the subprocess's stdin to make it shut down, and then I plumbed a cancel function into the stdin reader on the subprocess side. Fixes https://github.com/tailscale/corp/issues/5621 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
shayne	9d335aabb2	cmd/tailscale/cli: [ssh] fix typo in help text (#6694 ) arugments => arguments Signed-off-by: shayne <79330+shayne@users.noreply.github.com>	3 years ago
Jordan Whited	ea5ee6f87c	all: update golang.zx2c4.com/wireguard to github.com/tailscale/wireguard-go (#6692 ) This is temporary while we work to upstream performance work in https://github.com/WireGuard/wireguard-go/pull/64. A replace directive is less ideal as it breaks dependent code without duplication of the directive. Signed-off-by: Jordan Whited <jordan@tailscale.com>	3 years ago
Walter Poupore	383e203fd2	cmd/tailscale/cli: update lock status help strings (#6675 ) Signed-off-by: Walter Poupore <walterp@tailscale.com> Signed-off-by: Walter Poupore <walterp@tailscale.com>	3 years ago
Jordan Whited	76389d8baf	net/tstun, wgengine/magicsock: enable vectorized I/O on Linux (#6663 ) This commit updates the wireguard-go dependency and implements the necessary changes to the tun.Device and conn.Bind implementations to support passing vectors of packets in tailscaled. This significantly improves throughput performance on Linux. Updates #414 Signed-off-by: Jordan Whited <jordan@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com> Co-authored-by: James Tucker <james@tailscale.com>	3 years ago
James Tucker	389238fe4a	cmd/tailscale/cli: add workaround for improper named socket quoting in ssh command This avoids the issue in the common case where the socket path is the default path, avoiding the immediate need for a Windows shell quote implementation. Updates #6639 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Tom DNetto	e27f4f022e	cmd/tailscale/cli: add progress to tailscale file cp Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
shayne	98114bf608	cmd/tailscale/cli, ipn/localapi: add funnel status to status command (#6402 ) Fixes #6400 open up GETs for localapi serve-config to allow read-only access to ServeConfig `tailscale status` will include "Funnel on" status when Funnel is configured. Prints nothing if Funnel is not running. Example: $ tailscale status <nodes redacted> # Funnel on: # - https://node-name.corp.ts.net # - https://node-name.corp.ts.net:8443 # - tcp://node-name.corp.ts.net:10000 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	3 years ago
David Anderson	1b65630e83	cmd/containerboot: switch to IPN bus monitoring instead of polling. We still have to shell out to `tailscale up` because the container image's API includes "arbitrary flags to tailscale up", unfortunately. But this should still speed up startup a little, and also enables k8s-bound containers to update their device information as new netmap updates come in. Fixes #6657 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Tom DNetto	55e0512a05	ipn/ipnlocal,cmd/tailscale: minor improvements to lock modify command * Do not print the status at the end of a successful operation * Ensure the key of the current node is actually trusted to make these changes Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Aaron Klotz	98f21354c6	cmd/tailscaled: add a special command to tailscaled's Windows service for removing WinTun WinTun is installed lazily by tailscaled while it is running as LocalSystem. Based upon what we're seeing in bug reports and support requests, removing WinTun as a lesser user may fail under certain Windows versions, even when that user is an Administrator. By adding a user-defined command code to tailscaled, we can ask the service to do the removal on our behalf while it is still running as LocalSystem. * The uninstall code is basically the same as it is in corp; * The command code will be sent as a service control request and is protected by the SERVICE_USER_DEFINED_CONTROL access right, which requires Administrator. I'll be adding follow-up patches in corp to engage this functionality. Updates https://github.com/tailscale/tailscale/issues/6433 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
David Anderson	367228ef82	cmd/containerboot: gracefully degrade if missing patch permissions in k8s. Fixes #6629. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Andrew Dunham	a887ca7efe	ipn/ipnlocal: improve redactErr to handle more cases This handles the case where the inner os.PathError is wrapped in another error type, and additionally will redact errors of type os.LinkError. Finally, add tests to verify that redaction works. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie83424ff6c85cdb29fb48b641330c495107aab7c	3 years ago
David Anderson	e36c27bcd1	cmd/containerboot: check that k8s secret permissions are correct. Updates #6629. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e79a1eb24a	cmd/containerboot: refactor tests to have more explicit phases. In preparation for making startup more complex with IPN bus watches. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e04aaa7575	cmd/containerboot: split tailscaled bringup and auth phases. In preparation for reworking auth to use IPN bus watch. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	a469ec8ff6	cmd/containerboot: fix some lint. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Anton Tolchanov	5ff946a9e6	cmd/containerboot: fix TS_STATE_DIR environment variable It's supposed to set `--statedir` rather than `--state` file. Fixes #6634. Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 years ago
Brad Fitzpatrick	1598cd0361	net/tsaddr: remove ContainsFunc helpers (they're now in x/exp/slices) x/exp/slices now has ContainsFunc (golang/go#53983) so we can delete our versions. Change-Id: I5157a403bfc1b30e243bf31c8b611da25e995078 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Mihai Parparita	cb525a1aad	cmd/tailscaled: fix typo in netstack variable name Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Maisem Ali	96cad35870	cmd/tailscaled: rename variables to be more descriptive renamed from `useNetstack` to `onlyNetstack` which is 1 letter more but more descriptive because we always have netstack enabled and `useNetstack` doesn't convey what it is supposed to be used for. e.g. we always use netstack for Tailscale SSH. Also renamed shouldWrapNetstack to handleSubnetsInNetstack as it was only used to configure subnet routing via netstack. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Mihai Parparita	5b8323509f	cmd/tailscale/cli: use "account" instead of "profile" in user-visible text Matches the UI clients Updates #713 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Maya Kaczorowski	d5b4d2e276	cmd/tailscale/cli: improve tailnet lock help (#6583 ) Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com> Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com>	3 years ago
Walter Poupore	74b47eaad6	cmd/tailscale/cli: Fix 'tailscale switch' error message (#6585 ) Updates #713. Signed-off-by: Walter Poupore <walterp@tailscale.com> Signed-off-by: Walter Poupore <walterp@tailscale.com>	3 years ago
Maisem Ali	a5a3188b7e	cmd/tailscale/cli: unhide login and switch subcommands Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maya Kaczorowski	a1084047ce	cmd/tailscale/cli: capitalize Get (#6586 ) Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com> Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com>	3 years ago
Tom DNetto	74c1f632f6	types/key,cmd/tailscale/cli: support tlpub prefix for tailnet-lock keys Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	8dd1418774	ipn{,/ipnlocal}: add ipn.NotifyInitial* flags to WatchIPNBus To simplify clients getting the initial state when they subscribe. Change-Id: I2490a5ab2411253717c74265a46a98012b80db82 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	197a4f1ae8	types/ptr: move all the ptrTo funcs to one new package's ptr.To Change-Id: Ia0b820ffe7aa72897515f19bd415204b6fe743c7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Tom DNetto	9a80b8fb10	cmd/tailscale,ipn: surface TKA-filtered peers in lock status command Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Tom DNetto	731be07777	cmd/tailscale/cli: show rotation key when suggesting lock sign command Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	f710d1cb20	cmd/tailscale/cli: add set --unattended on Windows Fixes #6567 Change-Id: I8cb57196c601466401f8602eb50456e7cf7c31ef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	a200a23f97	Revert "cmd/tailscale: access QNAP via localhost" When running `tailscale web` as a standalone process, it was necessary to send auth requests to QTS using localhost to avoid hitting the proxy recursively. However running `tailscale web` as a process means it is consuming RAM all the time even when it isn't actively doing anything. After switching back to the `tailscale web` CGI mode, we don't need to specifically use localhost for QNAP auth. This reverts commit `e0cadc5496`. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Maisem Ali	adc302f428	all: use named pipes on windows Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Tom DNetto	45042a76cd	cmd/tailscale,ipn: store disallowed TKA's in prefs, lock local-disable Take 2 of https://github.com/tailscale/tailscale/pull/6546 Builds on https://github.com/tailscale/tailscale/pull/6560 Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	390d1bb871	Revert "ipn,types/persist: store disallowed TKA's in prefs, lock local-disable" This reverts commit `f1130421f0`. It was submitted with failing tests (go generate checks) Requires a lot of API changes to fix so rolling back instead of forward. Change-Id: I024e8885c0ed44675d3028a662f386dda811f2ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Tom DNetto	f1130421f0	ipn,types/persist: store disallowed TKA's in prefs, lock local-disable Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	0a10a5632b	cmd/tailscaled: add TS_DEBUG_BACKEND_DELAY_SEC for testing async startup This adds an envknob to make testing async startup more reproducible. We want the Windows GUI to behave well when wintun is not (or it's doing its initial slow driver installation), but during testing it's often too fast to see that it's working. This lets it be slowed down. Updates #6522 Change-Id: I6ae19f46e270ea679cbaea32a53888efcf2943a7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Joe Tsai	2e5d08ec4f	net/connstats: invert network logging data flow (#6272 ) Previously, tstun.Wrapper and magicsock.Conn managed their own statistics data structure and relied on an external call to Extract to extract (and reset) the statistics. This makes it difficult to ensure a maximum size on the statistics as the caller has no introspection into whether the number of unique connections is getting too large. Invert the control flow such that a connstats.Statistics is registered with tstun.Wrapper and magicsock.Conn. Methods on non-nil connstats.Statistics are called for every packet. This allows the implementation of connstats.Statistics (in the future) to better control when it needs to flush to ensure bounds on maximum sizes. The value registered into tstun.Wrapper and magicsock.Conn could be an interface, but that has two performance detriments: 1. Method calls on interface values are more expensive since they must go through a virtual method dispatch. 2. The implementation would need a sync.Mutex to protect the statistics value instead of using an atomic.Pointer. Given that methods on constats.Statistics are called for every packet, we want reduce the CPU cost on this hot path. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Joe Tsai	35c10373b5	types/logid: move logtail ID types here (#6336 ) Many packages reference the logtail ID types, but unfortunately pull in the transitive dependencies of logtail. Fix this problem by putting the log ID types in its own package with minimal dependencies. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Aaron Klotz	6e33d2da2b	ipn/ipnauth, util/winutil: add temporary LookupPseudoUser workaround to address os/user.LookupId errors on Windows I added util/winutil/LookupPseudoUser, which essentially consists of the bits that I am in the process of adding to Go's standard library. We check the provided SID for "S-1-5-x" where 17 <= x <= 20 (which are the known pseudo-users) and then manually populate a os/user.User struct with the correct information. Fixes https://github.com/tailscale/tailscale/issues/869 Fixes https://github.com/tailscale/tailscale/issues/2894 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	3b0de97e07	cmd/tailscaled: unify the two Windows paths + separate IPN server path tailscaled on Windows had two entirely separate start-up paths for running as a service vs in the foreground. It's been causing problems for ages. This unifies the two paths, making them be the same as the path used for every other platform. Also, it uses the new async LocalBackend support in ipnserver.Server so the Server can start serving HTTP immediately, even if tun takes awhile to come up. Updates #6535 Change-Id: Icc8c4f96d4887b54a024d7ac15ad11096b5a58cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ea25ef8236	util/set: add new set package for SetHandle type We use this pattern in a number of places (in this repo and elsewhere) and I was about to add a fourth to this repo which was crossing the line. Add this type instead so they're all the same. Also, we have another Set type (SliceSet, which tracks its keys in order) in another repo we can move to this package later. Change-Id: Ibbdcdba5443fae9b6956f63990bdb9e9443cefa9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Tom DNetto	5c8d2fa695	cmd/tailscale,ipn: improve UX of lock init command, cosmetic changes Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	e8cc78b1af	ipn/ipnserver: change Server to let LocalBackend be supplied async This is step 1 of de-special-casing of Windows and letting the LocalAPI HTTP server start serving immediately, even while the rest of the world (notably the Engine and its TUN device) are being created, which can take a few to dozens of seconds on Windows. With this change, the ipnserver.New function changes to not take an Engine and to return immediately, not returning an error, and let its Run run immediately. If its ServeHTTP is called when it doesn't yet have a LocalBackend, it returns an error. A TODO in there shows where a future handler will serve status before an engine is available. Future changes will: * delete a bunch of tailscaled_windows.go code and use this new API * add the ipnserver.Server ServerHTTP handler to await the engine being available * use that handler in the Windows GUI client Updates #6522 Change-Id: Iae94e68c235e850b112a72ea24ad0e0959b568ee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3b73727e39	cmd/tailscale: de-punycode hostnames in status display Still show original, but show de-punycode version in parens, similar to how we show DNS-less hostnames. Change-Id: I7e57da5e4029c5b49e8cd3014c350eddd2b3c338 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f45106d47c	ipn/ipnserver: move Windows-specific code to tailscaled_windows.go We'll eventually remove it entirely, but for now move get it out of ipnserver where it's distracting and move it to its sole caller. Updates #6522 Change-Id: I9c6f6a91bf9a8e3c5ea997952b7c08c81723d447 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	109aa3b2fb	cmd/tailscale: add start of "debug derp" subcommand Updates #6526 Change-Id: I84e440a8bd837c383000ce0cec4ff36b24249e8b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f3ba268a96	ipn/ipnserver: move BabysitProc to tailscaled_windows.go It's only used by Windows. No need for it to be in ipn/ipnserver, which we're trying to trim down. Change-Id: Idf923ac8b6cdae8b5338ec26c16fb8b5ea548071 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7e016c1d90	ipn/ipnserver: remove IPN protocol server Unused in this repo as of the earlier #6450 (`300aba61a6`) and unused in the Windows GUI as of tailscale/corp#8065. With this ipn.BackendServer is no longer used and could also be removed from this repo. The macOS and iOS clients still temporarily depend on it, but I can move it to that repo instead while and let its migration proceed on its own schedule while we clean this repo up. Updates #6417 Updates tailscale/corp#8051 Change-Id: Ie13f82af3eb9f96b3a21c56cdda51be31ddebdcf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0a842f353c	ipn/ipnserver: move more connection acceptance logic to LocalBackend Follow-up to #6467 and #6506. LocalBackend knows the server-mode state, so move more auth checking there, removing some bookkeeping from ipnserver.Server. Updates #6417 Updates tailscale/corp#8051 Change-Id: Ic5d14a077bf0dccc92a3621bd2646bab2cc5b837 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
shayne	0c4c66948b	cmd/tailscale/cli: Improve messaging when Funnel is unavailable. (#6502 ) There are three specific requirements for Funnel to work: 1) They must accept an invite. 2) They must enable HTTPS. 3) The "funnel" node attribute must be appropriately set up in the ACLs. Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	3 years ago
Aaron Klotz	033bd94d4c	cmd/tailscaled, wgengine/router: use wingoes/com for COM initialization instead of go-ole This patch removes the crappy, half-backed COM initialization used by `go-ole` and replaces that with the `StartRuntime` function from `wingoes`, a library I have started which, among other things, initializes COM properly. In particular, we should always be initializing COM to use the multithreaded apartment. Every single OS thread in the process becomes implicitly initialized as part of the MTA, so we do not need to concern ourselves as to whether or not any particular OS thread has initialized COM. Furthermore, we no longer need to lock the OS thread when calling methods on COM interfaces. Single-threaded apartments are designed solely for working with Win32 threads that have a message pump; any other use of the STA is invalid. Fixes https://github.com/tailscale/tailscale/issues/3137 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
Brad Fitzpatrick	4d3713f631	envknob: add GOOS func Centralize the fake GOOS stuff, start to use it more. To be used more in the future. Change-Id: Iabacfbeaf5fca0b53bf4d5dbcdc0367f05a205f9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	dc75b7cfd1	cmd/derpprobe: add -once flag for one-off CLI diagnostics Updates #6478 Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
James Tucker	b1441d0044	cmd/stunc: add command for making debug stun requests Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
Brad Fitzpatrick	7bff7345cc	ipn/ipnauth: start splitting ipnserver into new ipnauth package We're trying to gut 90% of the ipnserver package. A lot will get deleted, some will move to LocalBackend, and a lot is being moved into this new ipn/ipnauth package which will be leaf-y and testable. This is a baby step towards moving some stuff to ipnauth. Update #6417 Updates tailscale/corp#8051 Change-Id: I28bc2126764f46597d92a2d72565009dc6927ee0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	5f6fec0eba	cmd/tailscale: fix 'debug local-creds' hostname Fixes #6446 Change-Id: I82f0a3dcf6aca25b7f67265533ee30a9d939d86f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	300aba61a6	ipn, cmd/tailscale/cli: add LocalAPI IPN bus watch, Start, convert CLI Updates #6417 Updates tailscale/corp#8051 Change-Id: I1ca360730c45ffaa0261d8422877304277fc5625 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Tom DNetto	6708f9a93f	cmd/tailscale,ipn: implement lock log command This commit implements `tailscale lock log [--limit N]`, which displays an ordered list of changes to network-lock state in a manner familiar to `git log`. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	0f7da5c7dc	ipn{,/ipnlocal}, client/tailscale: move Taildrop recv notifications to LocalAPI HTTP method Updates #6417 Change-Id: Iec544c477a0e5e9f1c6bf23555afec06255e2e22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	41dd49391f	tstest/integration: add --accept-risk=all to tailscale down The test would fail if I was running it over SSH. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Andrew Dunham	a0ef51f570	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries This uses a go:generate statement to create a bunch of .syso files that contain a Windows resource file. We check these in since they're less than 1KiB each, and are only included on Windows. Fixes #6429 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I0512c3c0b2ab9d8d8509cf2037b88b81affcb81f	3 years ago
Maisem Ali	b94b91c168	cmd/tailscale/cli: add ability to set short names for profiles This adds a `--nickname` flag to `tailscale login\|set`. Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Mihai Parparita	33520920c3	all: use strs.CutPrefix and strs.CutSuffix more Updates places where we use HasPrefix + TrimPrefix to use the combined function. Updates #5309 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
shayne	bdd8ce6692	cmd/tailscale/cli: disallow empty text "" from serve CLI (#6416 ) Current behavior is broken. tailscale serve text / "" returns no error and shows up in tailscale serve status but requests return a 500 "empty handler". Adds an error if the user passes in an empty string for the text handler. Closes #6405 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	3 years ago
shayne	f52a6d1b8c	cmd/tailscale/cli, ipn: move serve CLI funcs on to ServeConfig (#6401 ) Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	3 years ago
shayne	a97369f097	cmd/tailscale/cli: flesh out serve CLI and tests (#6304 ) Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	3 years ago
Andrew Dunham	0af61f7c40	cmd/tailscale, util/quarantine: set quarantine flags on files from Taildrop This sets the "com.apple.quarantine" flag on macOS, and the "Zone.Identifier" alternate data stream on Windows. Change-Id: If14f805467b0e2963067937d7f34e08ba1d1fa85 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	3 years ago
Maisem Ali	f3519f7b29	cmd/tailscale/cli: add login and switch subcommands Updates #713 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	1f4669a380	all: standardize on LocalAPI Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	235309adc4	all: store NL keys per profile This moves the NetworkLock key from a dedicated StateKey to be part of the persist.Persist struct. This struct is stored as part for ipn.Prefs and is also the place where we store the NodeKey. It also moves the ChonkDir from "/tka" to "/tka-profile/<profile-id>". The rename was intentional to be able to delete the "/tka" dir if it exists. This means that we will have a unique key per profile, and a unique directory per profile. Note: `tailscale logout` will delete the entire profile, including any keys. It currently does not delete the ChonkDir. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Denton Gentry	e0cadc5496	cmd/tailscale: access QNAP via localhost QNAP 5.x works much better if we let Apache proxy tailscale web, which means the URLs can no longer be relative since apache sends us an internal URL. Access QNAP authentication via http://localhost:8080/ as documented in https://download.qnap.com/dev/API_QNAP_QTS_Authentication.pdf Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Tom DNetto	3271daf7a3	cmd/tailscale,ipn: support disablement args in lock cli, implement disable * Support specifiying disablement values in lock init command * Support specifying rotation key in lock sign command * Implement lock disable command * Implement disablement-kdf command Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	96e1582298	cmd/tailscale/cli: add debug 2021 --verbose flag Change-Id: Ic93c2a8451518755fb44b5c35272d9b9353fe4d4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	13bee8e91c	cmd/tailscale/cli: update serve debug set command after FUS profile change The key changed, but also we have a localapi method to set it anyway, so use that. Updates tailscale/corp#7515 Change-Id: Ia08ea2509f0bdd9b59e4c5de53aacf9a7d7eda36 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	001f482aca	net/dns: make "direct" mode on Linux warn on resolv.conf fights Run an inotify goroutine and watch if another program takes over /etc/inotify.conf. Log if so. For now this only logs. In the future I want to wire it up into the health system to warn (visible in "tailscale status", etc) about the situation, with a short URL to more info about how you should really be using systemd-resolved if you want programs to not fight over your DNS files on Linux. Updates #4254 etc etc Change-Id: I86ad9125717d266d0e3822d4d847d88da6a0daaa Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	8e85227059	cmd/tailscale/cli: [set] handle selectively modifying routes/exit node Noticed this while debugging something else, we would reset all routes if either `--advertise-exit-node` or `--advertise-routes` were set. This handles correctly updating them. Also added tests. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	0544d6ed04	cmd/tailscale/cli: continue fleshing out serve CLI tests The serve CLI doesn't exist yet, but we want nice tests for it when it does exist. Updates tailscale/corp#7515 Change-Id: Ib4c73d606242c4228f87410bbfd29bec52ca6c60 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	b5ac9172fd	cmd/tailscale/cli: move earlier shell test to its own files (I should've done this to start with.) Updates tailscale/corp#7515 Change-Id: I7fb88cf95772790fd415ecf28fc52bde95507641 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	29bc021dcd	cmd/tailscale/cli: add outline of serve CLI tests Updates tailscale/corp#7515 Change-Id: Ib3956d4756bdcea0da89238a3c520ce8ac8004ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	08e110ebc5	cmd/tailscale: make "up", "status" warn if routes and --accept-routes off Example output: # Health check: # - Some peers are advertising routes but --accept-routes is false Also, move "tailscale status" health checks to the bottom, where they won't be lost in large netmaps. Updates #2053 Updates #6266 Change-Id: I5ae76a0cd69a452ce70063875cd7d974bfeb8f1a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	6aab4fb696	cmd/tailscale/cli: start making cert output support pkcs12 (p12) output If the --key-file output filename ends in ".pfx" or ".p12", use pkcs12 format. This might not be working entirely correctly yet but might be enough for others to help out or experiment. Updates #2928 Updates #5011 Change-Id: I62eb0eeaa293b9fd5e27b97b9bc476c23dd27cf6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Tom DNetto	4c31183781	cmd/tailscale,ipn: minor fixes to tailscale lock commands * Fix broken add/remove key commands * Make lock status display whether the node is signed Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Maisem Ali	4d330bac14	ipn/ipnlocal: add support for multiple user profiles Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Pat Maddox	9bf3ef4167	ssh/tailssh: add Tailscale SSH (server) support on FreeBSD Change-Id: I607194b6ef99205e777f3df93a74ffe1a2e0344c Signed-off-by: Pat Maddox <pat@ratiopbc.com>	3 years ago
Mihai Parparita	7a07bc654b	ipn/localapi: rename /profile to /pprof Avoids name collision with profiles for user switching. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Joe Tsai	9a05cdd2b5	syncs: add Map (#6260 ) Map is a concurrent safe map that is a trivial wrapper over a Go map and a sync.RWMutex. It is optimized for use-cases where the entries change often, which is the opposite use-case of what sync.Map is optimized for. The API is patterned off of sync.Map, but made generic. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
David Anderson	65f3dab4c6	cmd/containerboot: make a tests table, add more tests. Also fix a bugs found while adding the tests, oops. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	2111357568	cmd/containerboot: add tests. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	25e26c16ee	ipn/ipnlocal: start implementing web server bits of serve Updates tailscale/corp#7515 Change-Id: I96f4016161ba3c370492da941274c6d9a234c2bb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c35dcd427f	cmd/tailscale/cli: make dev-store-set debug command a bit more magic Temporarily at least. Makes sharing scripts during development easier. Updates tailscale/corp#7515 Change-Id: I0e7aa461accd2c60740c1b37f3492b6bb58f1be3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2daf0f146c	ipn/ipnlocal, wgengine/netstack: start handling ports for future serving Updates tailscale/corp#7515 Change-Id: I966e936e72a2ee99be8d0f5f16872b48cc150258 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Andrew Dunham	e85613aa2d	net/netcheck: don't use a space in the captive portal challenge The derpers don't allow whitespace in the challenge. Change-Id: I93a8b073b846b87854fba127b5c1d80db205f658 Signed-off-by: Andrew Dunham <andrew@tailscale.com>	3 years ago
Brad Fitzpatrick	6d8320a6e9	ipn/{ipnlocal,localapi}: move most of cert.go to ipnlocal Leave only the HTTP/auth bits in localapi. Change-Id: I8e23fb417367f1e0e31483e2982c343ca74086ab Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	6acc27a92f	cmd/containerboot: be more targeted when enabling IP forwarding. Only enable forwarding for an IP family if any forwarding is required for that family. Fixes #6221. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	5bb7e0307c	cmd/tailscale, ipn/ipnlocal: add debug command to write to StateStore for dev Not for end users (unless directed by support). Mostly for ease of development for some upcoming webserver work. Change-Id: I43acfed217514567acb3312367b24d620e739f88 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	bf2d3cd074	cmd/containerboot: don't write device ID when not in Kubernetes. Fixes #6218. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e0669555dd	cmd/containerboot: don't write device ID into non-existent secret. Fixes #6211 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Andrew Dunham	c2d7940ec0	cmd/tailscaled, net/tstun: add build tags to omit BIRD and TAP Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I7a39f4eeeb583b73ecffaf4c5f086a38e3a53e2e	3 years ago
Brad Fitzpatrick	db2cc393af	util/dirwalk, metrics, portlist: add new package for fast directory walking This is similar to the golang.org/x/tools/internal/fastwalk I'd previously written but not recursive and using mem.RO. The metrics package already had some Linux-specific directory reading code in it. Move that out to a new general package that can be reused by portlist too, which helps its scanning of all /proc files: name old time/op new time/op delta FindProcessNames-8 2.79ms ± 6% 2.45ms ± 7% -12.11% (p=0.000 n=10+10) name old alloc/op new alloc/op delta FindProcessNames-8 62.9kB ± 0% 33.5kB ± 0% -46.76% (p=0.000 n=9+10) name old allocs/op new allocs/op delta FindProcessNames-8 2.25k ± 0% 0.38k ± 0% -82.98% (p=0.000 n=9+10) Change-Id: I75db393032c328f12d95c39f71c9742c375f207a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	da8def8e13	all: remove old +build tags The //go:build syntax was introduced in Go 1.17: https://go.dev/doc/go1.17#build-lines gofmt has kept the +build and go:build lines in sync since then, but enough time has passed. Time to remove them. Done with: perl -i -npe 's,^// \+build.*\n,,' $(git grep -l -F '+build') Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	6afe26575c	ipn: make Notify.Prefs be a *ipn.PrefsView It is currently a `ipn.PrefsView` which means when we do a JSON roundtrip, we go from an invalid Prefs to a valid one. This makes it a pointer, which fixes the JSON roundtrip. This was introduced in `0957bc5af2`. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Anderson	76904b82e7	cmd/containerboot: PID1 for running tailscaled in a container. This implements the same functionality as the former run.sh, but in Go and with a little better awareness of tailscaled's lifecycle. Also adds TS_AUTH_ONCE, which fixes the unfortunate behavior run.sh had where it would unconditionally try to reauth every time if you gave it an authkey, rather than try to use it only if auth is actually needed. This makes it a bit nicer to deploy these containers in automation, since you don't have to run the container once, then go and edit its definition to remove authkeys. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	d57cba8655	net/tshttpproxy: add clientmetrics on Windows proxy lookup paths To collect some data on how widespread this is and whether there's any correlation between different versions of Windows, etc. Updates #4811 Change-Id: I003041d0d7e61d2482acd8155c1a4ed413a2c5c4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Tom DNetto	0af57fce4c	cmd/tailscale,ipn: implement lock sign command Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	a7f7e79245	cmd/tailscale/cli: hide old, useless --host-routes flag It was from very early Tailscale and no longer makes sense. Change-Id: I31b4e728789f26b0376ebe73aa1b4bbbb1d62607 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f4ff26f577	types/pad32: delete package Use Go 1.19's new 64-bit alignment ~hidden feature instead. Fixes #5356 Change-Id: Ifcbcb115875a7da01df3bc29e9e7feadce5bc956 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Mihai Parparita	2be951a582	cmd/tsconnect: fix null pointer dereference when DNS lookups fail If we never had a chance to open the SSH session we should not try to close it. Fixes #6089 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Tom DNetto	d98305c537	cmd,ipn/ipnlocal,tailcfg: implement TKA disablement * Plumb disablement values through some of the internals of TKA enablement. * Transmit the node's TKA hash at the end of sync so the control plane understands each node's head. * Implement /machine/tka/disable RPC to actuate disablement on the control plane. There is a partner PR for the control server I'll send shortly. Signed-off-by: Tom DNetto <tom@tailscale.com>	3 years ago
Brad Fitzpatrick	7ad636f5b7	cmd/tailscale/cli: flesh out "tailscale ssh" CLI docs Per user feedback. Fixes #5877 Change-Id: Ib70ad57ec2507244fc54745f4e43c0ce13f51e9c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3336d08d59	cmd/tailscale/cli: make set without args print usage Make "tailscale set" by itself be equivalent to "tailscale set -h" rather than just say "you did it wrong" and make people do another -h step. Change-Id: Iad2b2ddb2595c0121d2536de5b78648f3eded3e3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7b6cd4e659	cmd/tailscale/cli: make set's usage match up's, other than defaults Fixes #6082 Change-Id: I92dc4726d866dcfd87e93ff09772601851d92ccf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Joe Tsai	b2035a1dca	cmd/netlogfmt: handle any stream of network logs (#6108 ) Make netlogfmt useful regardless of the exact schema of the input. If a JSON object looks like a network log message, then unmarshal it as one and then print it. This allows netlogfmt to support both a stream of JSON objects directly serialized from netlogtype.Message, or the schema returned by the /api/v2/tailnet/{{tailnet}}/network-logs API endpoint. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Joe Tsai	c21a3c4733	types/netlogtype: new package for network logging types (#6092 ) The netlog.Message type is useful to depend on from other packages, but doing so would transitively cause gvisor and other large packages to be linked in. Avoid this problem by moving all network logging types to a single package. We also update staticcheck to take in: `003d277bcf` Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Maisem Ali	19b5586573	cmd/tailscale/cli: add beginnings of `tailscale set` Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Mihai Parparita	d60f7fe33f	cmd/tsconnect: run wasm-opt on the generated wasm file Saves about 1.4MB from the generated wasm file. The Brotli size is basically unchanged (it's actually slightly larger, by 40K), suggesting that most of the size delta is due to not inlining and other changes that were easily compressible. However, it still seems worthwhile to have a smaller final binary, to reduce parse time and increase likelihood that we fit in the browser's disk cache. Actual performance appears to be unchanged. Updates #5142 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Will Norris	bff202a290	cmd/nginx-auth: add experimental status badge to README	3 years ago
Brad Fitzpatrick	35bee36549	portlist: use win32 calls instead of running netstat process [windows] Turns out using win32 instead of shelling out to child processes is a bit faster: name old time/op new time/op delta GetListIncremental-4 278ms ± 2% 0ms ± 7% -99.93% (p=0.000 n=8+10) name old alloc/op new alloc/op delta GetListIncremental-4 238kB ± 0% 9kB ± 0% -96.12% (p=0.000 n=10+8) name old allocs/op new allocs/op delta GetListIncremental-4 1.19k ± 0% 0.02k ± 0% -98.49% (p=0.000 n=10+10) Fixes #3876 (sadly) Change-Id: I1195ac5de21a8a8b3cdace5871d263e81aa27e91 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Denton Gentry	dafc822654	cmd/nginx-auth: increment version. We need a new release to handle TCD changes after MagicDNS GA Updates https://github.com/tailscale/tailscale/issues/6048 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Maisem Ali	0957bc5af2	ipn/ipnlocal: use ipn.PrefsView Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Mihai Parparita	660abd7309	cmd/tsconnect: add README to generated NPM package Makes the landing page at https://www.npmjs.com/package/@tailscale/connect look slightly nicer. Fixes #5976 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Brad Fitzpatrick	3697609aaa	portlist: remove unix.Readlink allocs on Linux name old time/op new time/op delta GetList-8 11.2ms ± 5% 11.1ms ± 3% ~ (p=0.661 n=10+9) name old alloc/op new alloc/op delta GetList-8 83.3kB ± 1% 67.4kB ± 1% -19.05% (p=0.000 n=10+10) name old allocs/op new allocs/op delta GetList-8 2.89k ± 2% 2.19k ± 1% -24.24% (p=0.000 n=10+10) (real issue is we're calling this code as much as we are, but easy enough to make it efficient because it'll still need to be called sometimes in any case) Updates #5958 Change-Id: I90c20278d73e80315a840aed1397d24faa308d93 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Andrew Dunham	223126fe5b	cmd/derper, net/netcheck: add challenge/response to generate_204 endpoint The Lufthansa in-flight wifi generates a synthetic 204 response to the DERP server's /generate_204 endpoint. This PR adds a basic challenge/response to the endpoint; something sufficiently complicated that it's unlikely to be implemented by a captive portal. We can then check for the expected response to verify whether we're being MITM'd. Follow-up to #5601 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I94a68c9a16a7be7290200eea6a549b64f02ff48f	3 years ago
Mihai Parparita	9d04ffc782	net/wsconn: add back custom wrapper for turning a websocket.Conn into a net.Conn We removed it in #4806 in favor of the built-in functionality from the nhooyr.io/websocket package. However, it has an issue with deadlines that has not been fixed yet (see nhooyr/websocket#350). Temporarily go back to using a custom wrapper (using the fix from our fork) so that derpers will stop closing connections too aggressively. Updates #5921 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Brad Fitzpatrick	9475801ebe	ipn/ipnlocal: fix E.G.G. port number accounting Change-Id: Id35461fdde79448372271ba54f6e6af586f2304d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Mihai Parparita	7741e9feb0	cmd/tsconnect: add progress and connection callbacks Allows UI to display slightly more fine-grained progress when the SSH connection is being established. Updates tailscale/corp#7186 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Brad Fitzpatrick	45b7e8c23c	cmd/tailscale: make tailscale cert --serve-demo accept optional listen argument Change-Id: I48f2f4f74c9996b9ed4bee02c61f125d42154a34 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Joe Tsai	9116e92718	cmd/netlogfmt: new package to pretty print network traffic logs (#5930 ) This package parses a JSON stream of netlog.Message from os.Stdin and pretty prints the contents as a stream of tables. It supports reverse lookup of tailscale IP addresses if given an API key and the tailnet that these traffic logs belong to. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Denton Gentry	19dfdeb1bb	cmd/tailscale: correct --cpu-profile help text Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Andrew Dunham	c32f9f5865	cmd/tailscale, ipn: enable debug logs when --report flag is passed to bugreport (#5830 ) Change-Id: Id22e9f4a2dcf35cecb9cd19dd844389e38c922ec Signed-off-by: Andrew Dunham <andrew@tailscale.com>	3 years ago
Mihai Parparita	63ad49890f	cmd/tsconnect: pre-compress main.wasm when building the NPM package This way we can do that once (out of band, in the GitHub action), instead of increasing the time of each deploy that uses the package. .wasm is removed from the list of automatically pre-compressed extensions, an OSS bump and small change on the corp side is needed to make use of this change. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Joe Tsai	f9120eee57	wgengine: start network logger in Userspace.Reconfig (#5908 ) If the wgcfg.Config is specified with network logging arguments, then Userspace.Reconfig starts up an asynchronous network logger, which is shutdown either upon Userspace.Close or when Userspace.Reconfig is called again without network logging or route arguments. Signed-off-by: Joe Tsai <joetsai@digital-static.net>	3 years ago
Mihai Parparita	b49eb7d55c	cmd/tsconnect: move NPM package to being under the @tailscale org Signed-off-by: Mihai Parparita <mihai@tailscale.com>	3 years ago
Brad Fitzpatrick	e24de8a617	ssh/tailssh: add password-forcing workaround for buggy SSH clients If the username includes a suffix of +password, then we accept password auth and just let them in like it were no auth. This exists purely for SSH clients that get confused by seeing success to their initial auth type "none". Co-authored-by: Maisem Ali <maisem@tailscale.com> Change-Id: I616d4c64d042449fb164f615012f3bae246e91ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Anton Tolchanov	c070d39287	cmd/tailscaled: handle tailscaled symlink on macOS When Tailscale is installed via Homebrew, `/usr/local/bin/tailscaled` is a symlink to the actual binary. Now when `tailscaled install-system-daemon` runs, it will not attempt to overwrite that symlink if it already points to the tailscaled binary. However, if executed binary and the link target differ, the path will he overwritten - this can happen when a user decides to replace Homebrew-installed tailscaled with a one compiled from source code. Fixes #5353 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	3 years ago
Emmanuel T Odeke	680f8d9793	all: fix more resource leaks found by staticmajor Updates #5706 Signed-off-by: Emmanuel T Odeke <emmanuel@orijtech.com>	3 years ago
Brad Fitzpatrick	0475ed4a7e	cmd/ssh-auth-none-demo: put the hostname in the package doc 188.166.70.128 port 2222 for now. Some hostname later maybe. Change-Id: I9c329410035221ed6cdff7a482727d30b77eea8b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	7df85c6031	cmd/ssh-auth-none-demo: add banner as part of the demo Send two banners with a second in between, this demonstrates the case where all banners are shown after auth completes and not during. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	8a187159b2	cmd/ssh-auth-none-demo: add demo SSH server that acts like Tailscale SSH For SSH client authors to fix their clients without setting up Tailscale stuff. Change-Id: I8c7049398512de6cb91c13716d4dcebed4d47b9c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago

... 5 6 7 8 9 ...

1613 Commits (c6a274611e01768f2d77201436f11a45dbc0c75f)