tailscale

Commit Graph

Author	SHA1	Message	Date
dependabot[bot]	59fab8bda7	.github: Bump github/codeql-action from 3.28.19 to 3.29.0 (#16287 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.19 to 3.29.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`fca7ace96b...ce28f5bb42`) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.29.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	6 months ago
Irbe Krumina	e29e3c150f	cmd/k8s-operator: ensure that TLS resources are updated for HA Ingress (#16262 ) Ensure that if the ProxyGroup for HA Ingress changes, the TLS Secret and Role and RoleBinding that allow proxies to read/write to it are updated. Fixes #16259 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Nick Khyl	733bfaeffe	ipn/ipnlocal: signal nodeBackend readiness and shutdown We update LocalBackend to shut down the current nodeBackend when switching to a different node, and to mark the new node's nodeBackend as ready when the switch completes. Updates tailscale/corp#28014 Updates tailscale/corp#29543 Updates #12614 Signed-off-by: Nick Khyl <nickk@tailscale.com>	6 months ago
M. J. Fromberger	fe391d5694	client/local: use an iterator to stream bus events (#16269 ) This means the caller does not have to remember to close the reader, and avoids having to duplicate the logic to decode JSON into events. Updates #15160 Change-Id: I20186fabb02f72522f61d5908c4cc80b86b8936b Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	6 months ago
Nick Khyl	6a4d92ecef	ipn/ipnlocal: replace nodeContext with nodeBackend in comments We renamed the type in #15866 but didn't update the comments at the time. Updates #cleanup Signed-off-by: Nick Khyl <nickk@tailscale.com>	6 months ago
Andrew Lytvynov	dac00e9916	go.mod: bump github.com/cloudflare/circl (#16264 ) See https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm This dependency is used in our release builder indirectly via `3b22d8539b/go.mod (L6)` We should not be affected, since this is used indirectly for pgp signatures on our .deb releases, where we use only trusted inputs. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	6 months ago
James Tucker	923bbd696f	prober: record DERP dropped packets as they occur Record dropped packets as soon as they time out, rather than after tx record queues spill over, this will more accurately capture small amounts of packet loss in a timely fashion. Updates tailscale/corp#24522 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
James Tucker	9206e766ed	net/packet: cleanup IPv4 fragment guards The first packet fragment guard had an additional guard clause that was incorrectly comparing a length in bytes to a length in octets, and was also comparing what should have been an entire IPv4 through transport header length to a subprotocol payload length. The subprotocol header size guards were otherwise protecting against short transport headers, as is the conservative non-first fragment minimum offset size. Add an explicit disallowing of fragmentation for TSMP for the avoidance of doubt. Updates #cleanup Updates #5727 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
James Tucker	b0f7b23efe	net/netcheck: preserve live home DERP through packet loss During a short period of packet loss, a TCP connection to the home DERP may be maintained. If no other regions emerge as winners, such as when all regions but one are avoided/disallowed as candidates, ensure that the current home region, if still active, is not dropped as the preferred region until it has failed two keepalives. Relatedly apply avoid and no measure no home to ICMP and HTTP checks as intended. Updates tailscale/corp#12894 Updates tailscale/corp#29491 Signed-off-by: James Tucker <james@tailscale.com>	6 months ago
Jordan Whited	3ed76ceed3	feature/relayserver,net/{netcheck,udprelay}: implement addr discovery (#16253 ) The relay server now fetches IPs from local interfaces and external perspective IP:port's via netcheck (STUN). Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Brad Fitzpatrick	3b5ce9d1bc	tsweb/varz: add binary name to version metric Fixes tailscale/corp#29530 Change-Id: Iae04456d7ac5527897f060370e90c9517c00a818 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Irbe Krumina	3219de4cb8	cmd/k8s-operator: ensure status update errors are displayed to users (#16251 ) Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
dependabot[bot]	7c05811af0	.github: Bump actions/setup-go from 5.4.0 to 5.5.0 (#15947 ) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.4.0 to 5.5.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](`0aaccfd150...d35c59abb0`) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	6 months ago
dependabot[bot]	75a42977c7	.github: Bump slackapi/slack-github-action from 2.0.0 to 2.1.0 (#15948 ) Bumps [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) from 2.0.0 to 2.1.0. - [Release notes](https://github.com/slackapi/slack-github-action/releases) - [Commits](`485a9d42d3...b0fa283ad8`) --- updated-dependencies: - dependency-name: slackapi/slack-github-action dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	6 months ago
dependabot[bot]	8baa016a23	.github: Bump github/codeql-action from 3.28.15 to 3.28.19 (#16227 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.15 to 3.28.19. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`45775bd823...fca7ace96b`) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.28.19 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	6 months ago
Claus Lensbøl	6010812f0c	ipn/localapi,client/local: add debug watcher for bus events (#16239 ) Updates: #15160 Signed-off-by: Claus Lensbøl <claus@tailscale.com>	6 months ago
Fran Bull	3b25e94352	cmd/natc: allow specifying the tsnet state dir Which can make operating the service more convenient. It makes sense to put the cluster state with this if specified, so rearrange the logic to handle that. Updates #14667 Signed-off-by: Fran Bull <fran@tailscale.com>	6 months ago
Jordan Whited	6a93b17c8c	types/netmap,wgengine/magicsock: propagate CapVer to magicsock.endpoint (#16244 ) This enables us to mark nodes as relay capable or not. We don't actually do that yet, as we haven't established a relay CapVer. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Patrick O'Doherty	8114260019	go.toolchain.rev: bump to go 1.24.4 (#16230 ) Updates #cleanup Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>	6 months ago
Mike O'Driscoll	e72c528a5f	cmd/{derp,derpprobe},prober,derp: add mesh support to derpprobe (#15414 ) Add mesh key support to derpprobe for probing derpers with verify set to true. Move MeshKey checking to central point for code reuse. Fix a bad error fmt msg. Fixes tailscale/corp#27294 Fixes tailscale/corp#25756 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>	6 months ago
Anton Tolchanov	db34cdcfe7	cmd/tailscale/cli: add a risk message about rp_filter We already present a health warning about this, but it is easy to miss on a server when blackholing traffic makes it unreachable. In addition to a health warning, present a risk message when exit node is enabled. Example: ``` $ tailscale up --exit-node=lizard The following issues on your machine will likely make usage of exit nodes impossible: - interface "ens4" has strict reverse-path filtering enabled - interface "tailscale0" has strict reverse-path filtering enabled Please set rp_filter=2 instead of rp_filter=1; see https://github.com/tailscale/tailscale/issues/3310 To skip this warning, use --accept-risk=linux-strict-rp-filter $ ``` Updates #3310 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	6 months ago
Jordan Whited	cc8dc9e4dc	types/netmap: fix NodeMutationEndpoints docs typo (#16234 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Jordan Whited	9501f66985	wgengine/magicsock: don't cancel in-progress relayManager work (#16233 ) It might complete, interrupting it reduces the chances of establishing a relay path. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Jordan Whited	c343bffa72	wgengine/relaymanager: don't start runLoop() on init() (#16231 ) This is simply for consistency with relayManagerInputEvent(), which should be the sole launcher of runLoop(). Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Jordan Whited	67b1693c13	wgengine/magicsock: enable setting relay epAddr's as bestAddr (#16229 ) relayManager can now hand endpoint a relay epAddr for it to consider as bestAddr. endpoint and Conn disco ping/pong handling are now VNI-aware. Updates tailscale/corp#27502 Updates tailscale/corp#29422 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Tom Meadows	4456f77af7	cmd/k8s-operator: explicitly set tcp on VIPService port configuration for Ingress with ProxyGroup (#16199 ) Updates tailscale/corp#24795 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>	6 months ago
James Sanderson	5716d0977d	health: prefix Warnables received from the control plane Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	6 months ago
KevinLiang10	7b06532ea1	ipn/ipnlocal: Update hostinfo to control on service config change (#16146 ) This commit fixes the bug that c2n requests are skiped when updating vipServices in serveConfig. This then resulted netmap update being skipped which caused inaccuracy of Capmap info on client side. After this fix, client always inform control about it's vipServices config changes. Fixes tailscale/corp#29219 Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	6 months ago
Jordan Whited	66ae8737f4	wgengine/magicsock: make endpoint.bestAddr Geneve-aware (#16195 ) This commit adds a new type to magicsock, epAddr, which largely ends up replacing netip.AddrPort in packet I/O paths throughout, enabling Geneve encapsulation over UDP awareness. The conn.ReceiveFunc for UDP has been revamped to fix and more clearly distinguish the different classes of packets we expect to receive: naked STUN binding messages, naked disco, naked WireGuard, Geneve-encapsulated disco, and Geneve-encapsulated WireGuard. Prior to this commit, STUN matching logic in the RX path could swallow a naked WireGuard packet if the keypair index, which is randomly generated, happened to overlap with a subset of the STUN magic cookie. Updates tailscale/corp#27502 Updates tailscale/corp#29326 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Claus Lensbøl	3f7a9f82e3	wgengine/magicsock: fix bpf fragmentation jump offsets (#16204 ) Fragmented datagrams would be processed instead of being dumped right away. In reality, thse datagrams would be dropped anyway later so there should functionally not be any change. Additionally, the feature is off by default. Closes #16203 Signed-off-by: Claus Lensbøl <claus@tailscale.com>	6 months ago
Fran Bull	3e08eab21e	cmd/natc: use new on disk state store for consensus Fixes #16027 Signed-off-by: Fran Bull <fran@tailscale.com>	6 months ago
Jordan Whited	75a7d28b07	net/packet: fix Parsed docs (#16200 ) Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Fran Bull	486a55f0a9	cmd/natc: add optional consensus backend Enable nat connector to be run on a cluster of machines for high availability. Updates #14667 Signed-off-by: Fran Bull <fran@tailscale.com>	6 months ago
James Sanderson	13ee285675	health: show DisplayMessage actions in 'tailscale status' Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	6 months ago
James Sanderson	5fde183754	ipn: add watch opt to include actions in health messages Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	6 months ago
Percy Wegmann	1635ccca27	ssh/tailssh: display more useful error messages when authentication fails Also add a trailing newline to error banners so that SSH client messages don't print on the same line. Updates tailscale/corp#29138 Signed-off-by: Percy Wegmann <percy@tailscale.com>	6 months ago
Raj Singh	5f0e139012	cmd/tsidp: add Docker image building support (#16078 ) - Add tsidp target to build_docker.sh for standard Tailscale image builds - Add publishdevtsidp Makefile target for development image publishing - Remove Dockerfile, using standard build process - Include tsidp in depaware dependency tracking - Update README with comprehensive Docker usage examples This enables tsidp to be built and published like other Tailscale components (tailscale/tailscale, tailscale/k8s-operator, tailscale/k8s-nameserver). Fixes #16077 Signed-off-by: Raj Singh <raj@tailscale.com>	6 months ago
Anton Tolchanov	cc988596a2	posture: propagate serial number from MDM on Android Updates #16010 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	6 months ago
James Sanderson	8a3afa5963	ipn/ipnlocal: fix deadlock when filtering DisplayMessage URLs Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	6 months ago
Jordan Whited	5f35143d83	go.mod,wgengine/magicsock: update wireguard-go (#16148 ) Our conn.Bind implementation is updated to make Send() offset-aware for future VXLAN/Geneve encapsulation support. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>	6 months ago
Fran Bull	c9a5d638e9	tsconsensus: enable writing state to disk The comments in the raft code say to only use the InMemStore for tests. Updates #16027 Signed-off-by: Fran Bull <fran@tailscale.com>	6 months ago
Joe Tsai	84aa7ff3bb	syncs: fix AtomicValue.CompareAndSwap (#16137 ) Fix CompareAndSwap in the edge-case where the underlying sync.AtomicValue is uninitialized (i.e., Store was never called) and the oldV is the zero value, then perform CompareAndSwap with any(nil). Also, document that T must be comparable. This is a pre-existing restriction. Fixes #16135 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	6 months ago
James Sanderson	11e83f9da5	controlclient,health,ipnlocal,tailcfg: add DisplayMessage support Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>	6 months ago
Irbe Krumina	5b670eb3a5	cmd/containerboot: allow setting --accept-dns via TS_EXTRA_ARGS again (#16129 ) In 1.84 we made 'tailscale set'/'tailscale up' error out if duplicate command line flags are passed. This broke some container configurations as we have two env vars that can be used to set --accept-dns flag: - TS_ACCEPT_DNS- specifically for --accept-dns - TS_EXTRA_ARGS- accepts any arbitrary 'tailscale up'/'tailscale set' flag. We default TS_ACCEPT_DNS to false (to make the container behaviour more declarative), which with the new restrictive CLI behaviour resulted in failure for users who had set --accept-dns via TS_EXTRA_ARGS as the flag would be provided twice. This PR re-instates the previous behaviour by checking if TS_EXTRA_ARGS contains --accept-dns flag and if so using its value to override TS_ACCEPT_DNS. Updates tailscale/tailscale#16108 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Brad Fitzpatrick	ef49e75b10	util/set: add SmallSet.SoleElement, fix bug, add more tests This adds SmallSet.SoleElement, which I need in another repo for efficiency. I added tests, but those tests failed because Add(1) + Add(1) was promoting the first Add's sole element to a map of one item. So fix that, and add more tests. Updates tailscale/corp#29093 Change-Id: Iadd5ad08afe39721ee5449343095e389214d8389 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Brad Fitzpatrick	401d6c0cfa	go.mod: bump golang.org/x deps Updates #8043 Change-Id: I8702a17130559353ccdecbe8b64eeee461ff09c3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Nick Khyl	191afd3390	net/tshttpproxy: fix WDAP/PAC proxy detection on Win10 1607 and earlier Using WINHTTP_AUTOPROXY_ALLOW_AUTOCONFIG on Windows versions older than Windows 10 1703 (build 15063) is not supported and causes WinHttpGetProxyForUrl to fail with ERROR_INVALID_PARAMETER. This results in failures reaching the control on environments where a proxy is required. We use wingoes version detection to conditionally set the WINHTTP_AUTOPROXY_ALLOW_AUTOCONFIG flag on Windows builds greater than 15063. While there, we also update proxy detection to use WINHTTP_AUTO_DETECT_TYPE_DNS_A, as DNS-based proxy discovery might be required with Active Directory and in certain other environments. Updates tailscale/corp#29168 Fixes #879 Signed-off-by: Nick Khyl <nickk@tailscale.com>	6 months ago
Nick Khyl	4cccd15eeb	ipn/ipnlocal: fix data race when accessing b.appConnector The field must only be accessed while holding LocalBackend's mutex, but there are two places where it's accessed without the mutex: - (LocalBackend).MaybeClearAppConnector() - handleC2NAppConnectorDomainRoutesGet() Fixes #16123 Signed-off-by: Nick Khyl <nickk@tailscale.com>	6 months ago
Brad Fitzpatrick	dca4036a20	util/set: add SmallSet Updates tailscale/corp#29093 Change-Id: I0e07e83dee51b4915597a913b0583c99756d90e2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	6 months ago
Andrew Lytvynov	b0d35975c0	go.toolchain.rev: bump to 1.24.3 (#16060 ) Updates https://github.com/tailscale/corp/issues/28916 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	6 months ago

... 5 6 7 8 9 ...

9458 Commits (d05e6dc09e7a36e2b6082ce259e33eb3eecd0c0c) All Branches Search

9458 Commits (d05e6dc09e7a36e2b6082ce259e33eb3eecd0c0c)

All Branches