tailscale

Commit Graph

Author	SHA1	Message	Date
Jordan Whited	cb7a0b1dca	net/udprelay: log socket read errors (#16573 ) Socket read errors currently close the server, so we need to understand when and why they occur. Updates tailscale/corp#27502 Updates tailscale/corp#30118 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Jordan Whited	d65c0fd2d0	tailcfg,wgengine/magicsock: set peer relay CapVer (#16531 ) Updates tailscale/corp#27502 Updates tailscale/corp#30051 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
dependabot[bot]	ffe8cc9442	.github: Bump github/codeql-action from 3.29.1 to 3.29.2 (#16480 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.1 to 3.29.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`39edc492db...181d5eefc2`) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.29.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	5 months ago
James Sanderson	e0fcd596bf	tailcfg: send health update if DisplayMessage URL changes Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	5 months ago
dependabot[bot]	7a3221177e	.github: Bump slackapi/slack-github-action from 2.1.0 to 2.1.1 (#16553 ) Bumps [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) from 2.1.0 to 2.1.1. - [Release notes](https://github.com/slackapi/slack-github-action/releases) - [Commits](`b0fa283ad8...91efab103c`) --- updated-dependencies: - dependency-name: slackapi/slack-github-action dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	5 months ago
Simon Law	205f822372	ipn/ipnlocal: check if suggested exit node is online @nickkyl added an peer.Online check to suggestExitNodeUsingDERP, so it should also check when running suggestExitNodeUsingTrafficSteering. Updates tailscale/corp#29966 Signed-off-by: Simon Law <sfllaw@tailscale.com>	5 months ago
Simon Law	bfb344905f	ipn/ipnlocal: modernize nm.Peers with AppendMatchingPeers Thanks to @nickkhyl for pointing out that NetMap.Peers doesn’t get incremental updates since the last full NetMap update. Instead, he recommends using ipn/ipnlocal.nodeBackend.AppendMatchingPeers. Updates #cleanup Signed-off-by: Simon Law <sfllaw@tailscale.com>	5 months ago
Jordan Whited	b63f8a457d	wgengine/magicsock: prioritize trusted peer relay paths over untrusted (#16559 ) A trusted peer relay path is always better than an untrusted direct or peer relay path. Updates tailscale/corp#30412 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Joe Tsai	f338c4074d	util/jsonutil: remove unused package (#16563 ) This package promises more performance, but was never used. The intent of the package is somewhat moot as "encoding/json" in Go 1.25 (while under GOEXPERIMENT=jsonv2) has been completely re-implemented using "encoding/json/v2" such that unmarshal is dramatically faster. Updates #cleanup Updates tailscale/corp#791 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	5 months ago
Jordan Whited	fc5050048e	wgengine/magicsock: don't acquire Conn.mu in udpRelayEndpointReady (#16557 ) udpRelayEndpointReady used to write into the peerMap, which required holding Conn.mu, but this changed in `f9e7131`. Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Tom Meadows	fe46f33885	cmd/{k8s-operator,k8s-proxy},kube/k8s-proxy: add static endpoints for kube-apiserver type ProxyGroups (#16523 ) Updates #13358 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>	5 months ago
Tom Meadows	bcaea4f245	k8s-operator,sessionrecording: fixing race condition between resize (#16454 ) messages and cast headers when recording `kubectl attach` sessions Updates #16490 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>	5 months ago
Simon Law	f23e4279c4	types/lazy: add lazy.GMap: a map of lazily computed GValues (#16532 ) Fixes tailscale/corp#30360 Signed-off-by: Simon Law <sfllaw@tailscale.com>	5 months ago
Jordan Whited	24062e33d1	net/udprelay: fix peer relay server deadlock (#16542 ) Fixes tailscale/corp#30381 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Andrew Lytvynov	39bf84d1c7	cmd/tsidp: set hostinfo.App in tsnet mode (#16544 ) This makes it easier to track how widely tsidp is used in practice. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Brad Fitzpatrick	30da2e1c32	cmd/tailscale/cli: add "configure jetkvm" subcommand To write the init script. And fix the JetKVM detection to work during early boot while the filesystem and modules are still being loaded; it wasn't being detected on early boot and then tailscaled was failing to start because it didn't know it was on JetKVM and didn't modprobe tun. Updates #16524 Change-Id: I0524ca3abd7ace68a69af96aab4175d32c07e116 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Jordan Whited	04e8d21b0b	go.mod: bump wg-go to fix keepalive detection (#16535 ) Updates tailscale/corp#30364 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Simon Law	c18ba4470b	ipn/ipnlocal: add traffic steering support to exit-node suggestions (#16527 ) When `tailscale exit-node suggest` contacts the LocalAPI for a suggested exit node, the client consults its netmap for peers that contain the `suggest-exit-node` peercap. It currently uses a series of heuristics to determine the exit node to suggest. When the `traffic-steering` feature flag is enabled on its tailnet, the client will defer to Control’s priority scores for a particular peer. These scores, in `tailcfg.Hostinfo.Location.Priority`, were historically only used for Mullvad exit nodes, but they have now been extended to score any peer that could host a redundant resource. Client capability version 119 is the earliest client that understands these traffic steering scores. Control tells the client to switch to rely on these scores by adding `tailcfg.NodeAttrTrafficSteering` to its `AllCaps`. Updates tailscale/corp#29966 Signed-off-by: Simon Law <sfllaw@tailscale.com>	5 months ago
Jordan Whited	bd29a1c8c1	feature/relayserver,wgengine/magicsock: remove WIP gating of peer relay (#16533 ) Updates tailscale/corp#30051 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Nick Khyl	5f678b9bec	docs/windows/policy: add ExitNode.AllowOverride as an option to ExitNodeID policy In this PR, we make ExitNode.AllowOverride configurable as part of the Exit Node ADMX policy setting, similarly to Always On w/ "Disconnect with reason" option. Updates tailscale/corp#29969 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Dylan Bargatze	fed72e2aa9	cmd/tailscale, ipn/ipnstate, wgengine/magicsock: update ping output for peer relay (#16515 ) Updates the output for "tailscale ping" to indicate if a peer relay was traversed, just like the output for DERP or direct connections. Fixes tailscale/corp#30034 Signed-off-by: Dylan Bargatze <dylan@tailscale.com>	5 months ago
Brad Fitzpatrick	fbc6a9ec5a	all: detect JetKVM and specialize a handful of things for it Updates #16524 Change-Id: I183428de8c65d7155d82979d2d33f031c22e3331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Simon Law	bebc796e6c	ipn/ipnlocal: add traffic-steering nodecap (#16529 ) To signal when a tailnet has the `traffic-steering` feature flag, Control will send a `traffic-steering` NodeCapability in netmap’s AllCaps. This patch adds `tailcfg.NodeAttrTrafficSteering` so that it can be used in the control plane. Future patches will implement the actual steering mechanisms. Updates tailscale/corp#29966 Signed-off-by: Simon Law <sfllaw@tailscale.com>	5 months ago
Jordan Whited	f9bfd8118a	wgengine/magicsock: resolve epAddr collisions across peer relay conns (#16526 ) Updates tailscale/corp#30042 Updates tailscale/corp#29422 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
David Bond	d0cafc0a67	cmd/{k8s-operator,k8s-proxy}: apply accept-routes configuration to k8s-proxy (#16522 ) This commit modifies the k8s-operator and k8s-proxy to support passing down the accept-routes configuration from the proxy class as a configuration value read and used by the k8s-proxy when ran as a distinct container managed by the operator. Updates #13358 Signed-off-by: David Bond <davidsbond93@gmail.com>	5 months ago
David Bond	2b665c370c	cmd/{k8s-operator,k8s-proxy}: allow setting login server url (#16504 ) This commit modifies the k8s proxy application configuration to include a new field named `ServerURL` which, when set, modifies the tailscale coordination server used by the proxy. This works in the same way as the operator and the proxies it deploys. If unset, the default coordination server is used. Updates https://github.com/tailscale/tailscale/issues/13358 Signed-off-by: David Bond <davidsbond93@gmail.com>	5 months ago
David Bond	cf0460b9da	cmd/k8s-operator: allow letsencrypt staging on k8s proxies (#16521 ) This commit modifies the operator to detect the usage of k8s-apiserver type proxy groups that wish to use the letsencrypt staging directory and apply the appropriate environment variable to the statefulset it produces. Updates #13358 Signed-off-by: David Bond <davidsbond93@gmail.com>	5 months ago
Claus Lensbøl	fbc4c34cf7	ipn/localapi: do not break client on event marshalling errors (#16503 ) Errors were mashalled without the correct newlines. Also, they could generally be mashalled with more data, so an intermediate was introduced to make them slightly nicer to look at. Updates #15160 Signed-off-by: Claus Lensbøl <claus@tailscale.com>	5 months ago
Jordan Whited	6a0fad1e10	wgengine/magicsock: don't peer relay if NodeAttrOnlyTCP443 is set (#16517 ) Updates tailscale/corp#30138 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Jordan Whited	ae8641735d	cmd/tailscale/cli,ipn/ipnstate,wgengine/magicsock: label peer-relay (#16510 ) Updates tailscale/corp#30033 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Dylan Bargatze	d40b25326c	tailcfg, wgengine/magicsock: disable all UDP relay usage if disable-relay-client is set (#16492 ) If the NodeAttrDisableRelayClient node attribute is set, ensures that a node cannot allocate endpoints on a UDP relay server itself, and cannot use newly-discovered paths (via disco/CallMeMaybeVia) that traverse a UDP relay server. Fixes tailscale/corp#30180 Signed-off-by: Dylan Bargatze <dylan@tailscale.com>	5 months ago
Nick Khyl	ff1803158a	ipn/ipnlocal: change order of exit node refresh and netmap update so that clients receive the new netmap first If the GUI receives a new exit node ID before the new netmap, it may treat the node as offline or invalid if the previous netmap didn't include the peer at all, or if the peer was offline or not advertised as an exit node. This may result in briefly issuing and dismissing a warning, or a similar issue, which isn't ideal. In this PR, we change the operation order to send the new netmap to clients first before selecting the new exit node and notifying them of the Exit Node change. Updates tailscale/corp#30252 (an old issue discovered during testing this) Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Nick Khyl	21a4058ec7	ipn/ipnlocal: add test to verify handling of unknown auto exit node expressions We already check this for cases where ipn.Prefs.AutoExitNode is configured via syspolicy. Configuring it directly through EditPrefs should behave the same, so we add a test for that as well. Additionally, we clarify the implementation and future extensibility in (*LocalBackend).resolveAutoExitNodeLocked, where the AutoExitNode is actually enforced. Updates tailscale/corp#29969 Updates #cleanup Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Nick Khyl	c5fdf9e1db	cmd/tailscale/cli: add support for tailscale {up,set} --exit-node=auto:any If the specified exit node string starts with "auto:" (i.e., can be parsed as an ipn.ExitNodeExpression), we update ipn.Prefs.AutoExitNode instead of ipn.Prefs.ExitNodeID. Fixes #16459 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Nick Khyl	cc2f4ac921	ipn: move ParseAutoExitNodeID from ipn/ipnlocal to ipn So it can be used from the CLI without importing ipnlocal. While there, also remove isAutoExitNodeID, a wrapper around parseAutoExitNodeID that's no longer used. Updates tailscale/corp#29969 Updates #cleanup Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Jordan Whited	008a238acd	wgengine/magicsock: support self as candidate peer relay (#16499 ) Updates tailscale/corp#30247 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Tom Proctor	27fa2ad868	cmd/k8s-operator: don't require generation for Available condition (#16497 ) The observed generation was set to always 0 in #16429, but this had the knock-on effect of other controllers considering ProxyGroups never ready because the observed generation is never up to date in proxyGroupCondition. Make sure the ProxyGroupAvailable function does not requires the observed generation to be up to date, and add testing coverage to catch regressions. Updates #16327 Change-Id: I42f50ad47dd81cc2d3c3ce2cd7b252160bb58e40 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	5 months ago
Tom Proctor	4dfed6b146	cmd/{k8s-operator,k8s-proxy}: add kube-apiserver ProxyGroup type (#16266 ) Adds a new k8s-proxy command to convert operator's in-process proxy to a separately deployable type of ProxyGroup: kube-apiserver. k8s-proxy reads in a new config file written by the operator, modelled on tailscaled's conffile but with some modifications to ensure multiple versions of the config can co-exist within a file. This should make it much easier to support reading that config file from a Kube Secret with a stable file name. To avoid needing to give the operator ClusterRole{,Binding} permissions, the helm chart now optionally deploys a new static ServiceAccount for the API Server proxy to use if in auth mode. Proxies deployed by kube-apiserver ProxyGroups currently work the same as the operator's in-process proxy. They do not yet leverage Tailscale Services for presenting a single HA DNS name. Updates #13358 Change-Id: Ib6ead69b2173c5e1929f3c13fb48a9a5362195d8 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	5 months ago
Tom Proctor	90bf0a97b3	cmd/k8s-operator/deploy: clarify helm install notes (#16449 ) Based on feedback that it wasn't clear what the user is meant to do with the output of the last command, clarify that it's an optional command to explore what got created. Updates #13427 Change-Id: Iff64ec6d02dc04bf4bbebf415d7ed1a44e7dd658 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	5 months ago
Simon Law	bad17a1bfa	cmd/tailscale: format empty cities and countries as hyphens (#16495 ) When running `tailscale exit-node list`, an empty city or country name should be displayed as a hyphen "-". However, this only happened when there was no location at all. If a node provides a Hostinfo.Location, then the list would display exactly what was provided. This patch changes the listing so that empty cities and countries will either render the provided name or "-". Fixes #16500 Signed-off-by: Simon Law <sfllaw@tailscale.com>	5 months ago
Jordan Whited	a60e0caf6a	wgengine/magicsock: remove conn.InitiationAwareEndpoint TODO (#16498 ) It was implemented in `5b0074729d`. Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Nick Khyl	740b77df59	ipn/ipnlocal,util/syspolicy: add support for ExitNode.AllowOverride policy setting When the policy setting is enabled, it allows users to override the exit node enforced by the ExitNodeID or ExitNodeIP policy. It's primarily intended for use when ExitNodeID is set to auto:any, but it can also be used with specific exit nodes. It does not allow disabling exit node usage entirely. Once the exit node policy is overridden, it will not be enforced again until the policy changes, the user connects or disconnects Tailscale, switches profiles, or disables the override. Updates tailscale/corp#29969 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Nick Khyl	2c630e126b	ipn/ipnlocal: make applySysPolicy a method on LocalBackend Now that applySysPolicy is only called by (*LocalBackend).reconcilePrefsLocked, we can make it a method to avoid passing state via parameters and to support future extensibility. Also factor out exit node-specific logic into applyExitNodeSysPolicyLocked. Updates tailscale/corp#29969 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Nick Khyl	9bf99741dd	ipn/ipnlocal: refactor resolveExitNodeInPrefsLocked, setExitNodeID and resolveExitNodeIP Now that resolveExitNodeInPrefsLocked is the only caller of setExitNodeID, and setExitNodeID is the only caller of resolveExitNodeIP, we can restructure the code with resolveExitNodeInPrefsLocked now calling both resolveAutoExitNodeLocked and resolveExitNodeIPLocked directly. This prepares for factoring out resolveAutoExitNodeLocked and related auto-exit-node logic into an ipnext extension in a future commit. While there, we also update exit node by IP lookup to use (nodeBackend).NodeByAddr and (nodeBackend).NodeByID instead of iterating over all peers in the most recent netmap. Updates tailscale/corp#29969 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Nick Khyl	1fe82d6ef5	cmd/tailscale/cli,ipn/ipnlocal: restrict logout when AlwaysOn mode is enabled In this PR, we start passing a LocalAPI actor to (*LocalBackend).Logout to make it subject to the same access check as disconnects made via tailscale down or the GUI. We then update the CLI to allow `tailscale logout` to accept a reason, similar to `tailscale down`. Updates tailscale/corp#26249 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Jordan Whited	5b0074729d	go.mod,wgengine/magicsock: implement conn.InitiationAwareEndpoint (#16486 ) Since a [lazyEndpoint] makes wireguard-go responsible for peer ID, but wireguard-go may not yet be configured for said peer, we need a JIT hook around initiation message reception to call what is usually called from an [endpoint]. Updates tailscale/corp#30042 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Jordan Whited	47f431b656	net/udprelay: fix relaying between mixed address family sockets (#16485 ) We can't relay a packet received over the IPv4 socket back out the same socket if destined to an IPv6 address, and vice versa. Updates tailscale/corp#30206 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Nick Khyl	ea4018b757	ipn/ipnlocal: fix missing defer in testExtension.Shutdown Updates #cleanup Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Nick Khyl	f1c7b463cd	ipn/{ipnauth,ipnlocal,localapi}: make EditPrefs return an error if changing exit node is restricted by policy We extract checkEditPrefsAccessLocked, adjustEditPrefsLocked, and onEditPrefsLocked from the EditPrefs execution path, defining when each step is performed and what behavior is allowed at each stage. Currently, this is primarily used to support Always On mode, to handle the Exit Node enablement toggle, and to report prefs edit metrics. We then use it to enforce Exit Node policy settings by preventing users from setting an exit node and making EditPrefs return an error when an exit node is restricted by policy. This enforcement is also extended to the Exit Node toggle. These changes prepare for supporting Exit Node overrides when permitted by policy and preventing logout while Always On mode is enabled. In the future, implementation of these methods can be delegated to ipnext extensions via the feature hooks. Updates tailscale/corp#29969 Updates tailscale/corp#26249 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago
Nick Khyl	a6f6478129	util/syspolicy: add HasAnyOf to check if any specified policy settings are configured Updates tailscale/corp#29969 Signed-off-by: Nick Khyl <nickk@tailscale.com>	5 months ago

... 2 3 4 5 6 ...

9458 Commits (d05e6dc09e7a36e2b6082ce259e33eb3eecd0c0c) All Branches Search

9458 Commits (d05e6dc09e7a36e2b6082ce259e33eb3eecd0c0c)

All Branches