7928 Commits (e3f047618bd09f352e755bebcbbeb7db06734679)

 

All Branches   

Search

Author	SHA1	Message	Date
Irbe Krumina	ba517ab388	cmd/k8s-operator,ssh/tailssh,tsnet: optionally record 'kubectl exec' sessions via Kubernetes operator's API server proxy (#12274) ... cmd/k8s-operator,ssh/tailssh,tsnet: optionally record kubectl exec sessions The Kubernetes operator's API server proxy, when it receives a request for 'kubectl exec' session now reads 'RecorderAddrs', 'EnforceRecorder' fields from tailcfg.KubernetesCapRule. If 'RecorderAddrs' is set to one or more addresses (of a tsrecorder instance(s)), it attempts to connect to those and sends the session contents to the recorder before forwarding the request to the kube API server. If connection cannot be established or fails midway, it is only allowed if 'EnforceRecorder' is not true (fail open). Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Maisem Ali <maisem@tailscale.com>	5 months ago
Maisem Ali	2b638f550d	cmd/k8s-operator: add depaware.txt ... Updates #12742 Signed-off-by: Maisem Ali <maisem@tailscale.com>	5 months ago
License Updater	9102a5bb73	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	5 months ago
Flakes Updater	c8fe9f0064	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	5 months ago
Brad Fitzpatrick	42dac7c5c2	wgengine/magicsock: add debug envknob for injecting an endpoint ... For testing. Lee wants to play with 'AWS Global Accelerator Custom Routing with Amazon Elastic Kubernetes Service'. If this works well enough, we can promote it. Updates #12578 Change-Id: I5018347ed46c15c9709910717d27305d0aedf8f4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	d2fef01206	control/controlknobs,tailcfg,wgengine/magicsock: remove DRPO shutoff switch ... The DERP Return Path Optimization (DRPO) is over four years old (and on by default for over two) and we haven't had problems, so time to remove the emergency shutoff code (controlknob) which we've never used. The controlknobs are only meant for new features, to mitigate risk. But we don't want to keep them forever, as they kinda pollute the code. Updates #150 Change-Id: If021bc8fd1b51006d8bddd1ffab639bb1abb0ad1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	9df107f4f0	wgengine/magicsock: use derp-region-as-magic-AddrPort hack in fewer places ... And fix up a bogus comment and flesh out some other comments. Updates #cleanup Change-Id: Ia60a1c04b0f5e44e8d9587914af819df8e8f442a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Aaron Klotz	e181f12a7b	util/winutil/s4u: fix some doc comments in the s4u package ... This is #cleanup Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Brad Fitzpatrick	c4b20c5411	go.mod: bump github.com/tailscale/wireguard-go ... Updates tailscale/corp#20732 Change-Id: Ic0272fe9a226afef4e23dfca5da8cd1d550c1cd6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Tom Proctor	01a7726cf7	cmd/containerboot,cmd/k8s-operator: enable IPv6 for fqdn egress proxies (#12577) ... cmd/containerboot,cmd/k8s-operator: enable IPv6 for fqdn egress proxies Don't skip installing egress forwarding rules for IPv6 (as long as the host supports IPv6), and set headless services `ipFamilyPolicy` to `PreferDualStack` to optionally enable both IP families when possible. Note that even with `PreferDualStack` set, testing a dual-stack GKE cluster with the default DNS setup of kube-dns did not correctly set both A and AAAA records for the headless service, and instead only did so when switching the cluster DNS to Cloud DNS. For both IPv4 and IPv6 to work simultaneously in a dual-stack cluster, we require headless services to return both A and AAAA records. If the host doesn't support IPv6 but the FQDN specified only has IPv6 addresses available, containerboot will exit with error code 1 and an error message because there is no viable egress route. Fixes #12215 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	5 months ago
Andrea Gottardo	309afa53cf	health: send ImpactsConnectivity value over LocalAPI (#12700) ... Updates tailscale/tailscale#4136 We should make sure to send the value of ImpactsConnectivity over to the clients using LocalAPI as they need it to display alerts in the GUI properly. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Charlotte Brandhorst-Satzkorn	42f01afe26	cmd/tailscale/cli: exit node filter should display all exit node options (#12699) ... This change expands the `exit-node list -filter` command to display all location based exit nodes for the filtered country. This allows users to switch to alternative servers when our recommended exit node is not working as intended. This change also makes the country filter matching case insensitive, e.g. both USA and usa will work. Updates #12698 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	5 months ago
Chris Palmer	59936e6d4a	scripts: don't refresh the pacman repository on Arch (#12194) ... Fixes #12186 Signed-off-by: Chris Palmer <cpalmer@tailscale.com> Co-authored-by: Chris Palmer <cpalmer@tailscale.com>	5 months ago
Andrea Gottardo	732af2f6e0	health: reduce severity of some warnings, improve update messages (#12689) ... Updates tailscale/tailscale#4136 High severity health warning = a system notification will appear, which can be quite disruptive to the user and cause unnecessary concern in the event of a temporary network issue. Per design decision (@sonovawolf), the severity of all warnings but "network is down" should be tuned down to medium/low. ImpactsConnectivity should be set, to change the icon to an exclamation mark in some cases, but without a notification bubble. I also tweaked the messaging for update-available, to reflect how each platform gets updates in different ways. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	5 months ago
Andrew Lytvynov	458decdeb0	go.toolchain.rev: update to Go 1.22.5 (#12690) ... Updates https://github.com/tailscale/corp/issues/21304 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Jonathan Nobels	4e5ef5b628	net/dns: fix broken dns benchmark tests (#12686) ... Updates tailscale/corp#20677 The recover function wasn't getting set in the benchmark tests. Default changed to an empty func. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	5 months ago
Flakes Updater	012933635b	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	5 months ago
Brad Fitzpatrick	da32468988	version/mkversion: allow env config of oss git cache dir ... Updates tailscale/corp#21262 Change-Id: I80bd880b53f6d851c15479f39fad62b25f1095f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Jordan Whited	ddf94a7b39	cmd/stunstamp: fix handling of invalid DERP map resp (#12679) ... Updates tailscale/corp#20344 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Brad Fitzpatrick	b56058d7e3	tool/gocross: fix regression detecting when gocross needs rebuild ... Fix regression from #8108 (Mar 2023). Since that change, gocross has always been rebuilt on each run of ./tool/go (gocross-wrapper.sh), adding ~100ms. (Well, not totally rebuilt; cmd/go's caching still ends up working fine.) The problem was $gocross_path was just "gocross", which isn't in my path (and "." isn't in my $PATH, as it shouldn't be), so this line was always evaluating to the empty string: gotver="$($gocross_path gocross-version 2>/dev/null || echo '')" The ./gocross is fine because of the earlier `cd "$repo_root"` Updates tailscale/corp#21262 Updates tailscale/corp#21263 Change-Id: I80d25446097a3bb3423490c164352f0b569add5f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
License Updater	d780755340	licenses: update license notices ... Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	5 months ago
Percy Wegmann	489b990240	tailcfg: bump CurrentCapabilityVersion to capture SSH agent forwarding fix ... Updates #12467 Signed-off-by: Percy Wegmann <percy@tailscale.com>	5 months ago
Tom Proctor	d15250aae9	go.{mod,sum}: bump mkctr (#12654) ... go get github.com/tailscale/mkctr@main Pulls in changes to support a local target that only pushes a single-platform image to the machine's local image store. Fixes tailscale/mkctr#18 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	5 months ago
Claire Wang	8965e87fa8	ipn/ipnlocal: handle auto value for ExitNodeID syspolicy (#12512) ... Updates tailscale/corp#19681 Signed-off-by: Claire Wang <claire@tailscale.com>	5 months ago
James Tucker	114d1caf55	derp/xdp: retain the link so that the fd is not closed ... BPF links require that the owning FD remains open, this FD is embedded into the RawLink returned by the attach function and must live for the duration of the server. Updates ENG-4274 Signed-off-by: James Tucker <james@tailscale.com>	5 months ago
James Tucker	b565a9faa7	cmd/xdpderper: add autodetection for default interface name ... This makes deployment easier in hetrogenous environments. Updates ENG-4274 Signed-off-by: James Tucker <james@tailscale.com>	5 months ago
Anton Tolchanov	781f79408d	ipn/ipnlocal: allow multiple signature chains from the same SigCredential ... Detection of duplicate Network Lock signature chains added in 01847e0123 failed to account for chains originating with a SigCredential signature, which is used for wrapped auth keys. This results in erroneous removal of signatures that originate from the same re-usable auth key. This change ensures that multiple nodes created by the same re-usable auth key are not getting filtered out by the network lock. Updates tailscale/corp#19764 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	5 months ago
Anton Tolchanov	4651827f20	tka: test SigCredential signatures and netmap filtering ... This change moves handling of wrapped auth keys to the `tka` package and adds a test covering auth key originating signatures (SigCredential) in netmap. Updates tailscale/corp#19764 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	5 months ago
Adrian Dewhurst	8f7588900a	ipn/ipnlocal: fix nil pointer dereference and add related test ... Fixes #12644 Change-Id: I3589b01a9c671937192caaedbb1312fd906ca712 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	5 months ago
Jordan Whited	0bb82561ba	go.mod: update wireguard-go (#12645) ... This pulls in device.WaitPool fixes from tailscale/wireguard-go@1e08883 and tailscale/wireguard-go@cfa4567. Updates tailscale/corp#21095 Signed-off-by: Jordan Whited <jordan@tailscale.com>	5 months ago
Andrew Lytvynov	2064dc20d4	health,ipn/ipnlocal: hide update warning when auto-updates are enabled (#12631) ... When auto-udpates are enabled, we don't need to nag users to update after a new release, before we release auto-updates. Updates https://github.com/tailscale/corp/issues/20081 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	5 months ago
Anton Tolchanov	23c5870bd3	tsnet: do not log an error on shutdown ... Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	5 months ago
Josh McKinney	18939df0a7	fix: broken tests for localhost ... Signed-off-by: Josh McKinney <joshka@users.noreply.github.com>	5 months ago
Josh McKinney	1d6ab9f9db	cmd/serve: don't convert localhost to 127.0.0.1 ... This is not valid in many situations, specifically when running a local astro site that listens on localhost, but ignores 127.0.0.1 Fixes: https://github.com/tailscale/tailscale/issues/12201 Signed-off-by: Josh McKinney <joshka@users.noreply.github.com>	5 months ago
Brad Fitzpatrick	210264f942	cmd/derper: clarify that derper and tailscaled need to be in sync ... Fixes #12617 Change-Id: Ifc87b7d9cf699635087afb57febd01fb9a6d11b7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Brad Fitzpatrick	6b801a8e9e	cmd/derper: link to various derper docs in more places ... In hopes it'll be found more. Updates tailscale/corp#20844 Change-Id: Ic92ee9908f45b88f8770de285f838333f9467465 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
Flakes Updater	b3f91845dc	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	5 months ago
James Tucker	46fda6bf4c	cmd/derper: add some DERP diagnostics pointers ... A few other minor language updates. Updates tailscale/corp#20844 Change-Id: Idba85941baa0e2714688cc8a4ec3e242e7d1a362 Signed-off-by: James Tucker <james@tailscale.com>	5 months ago
Brad Fitzpatrick	9766f0e110	net/dns: move mutex before the field it guards ... And some misc doc tweaks for idiomatic Go style. Updates #cleanup Change-Id: I3ca45f78aaca037f433538b847fd6a9571a2d918 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 months ago
dependabot[bot]	94defc4056	build(deps): bump golang.org/x/image from 0.15.0 to 0.18.0 ... Bumps [golang.org/x/image](https://github.com/golang/image) from 0.15.0 to 0.18.0. - [Commits](https://github.com/golang/image/compare/v0.15.0...v0.18.0) --- updated-dependencies: - dependency-name: golang.org/x/image dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	5 months ago
Aaron Klotz	b292f7f9ac	util/winutil/s4u: fix incorrect token type specified in s4u Login ... This was correct before, I think I just made a copy/paste error when updating that PR. Updates #12383 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Aaron Klotz	5f177090e3	util/winutil: ensure domain controller address is used when retrieving remote profile information ... We cannot directly pass a flat domain name into NetUserGetInfo; we must resolve the address of a domain controller first. This PR implements the appropriate resolution mechanisms to do that, and also exposes a couple of new utility APIs for future needs. Fixes #12627 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago
Andrew Dunham	0323dd01b2	ci: enable checklocks workflow for specific packages ... This turns the checklocks workflow into a real check, and adds annotations to a few basic packages as a starting point. Updates #12625 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I2b0185bae05a843b5257980fc6bde732b1bdd93f	5 months ago
Andrew Dunham	8487fd2ec2	wgengine/magicsock: add more DERP home clientmetrics ... Updates tailscale/corp#18095 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I423adca2de0730092394bb5fd5796cd35557d352	5 months ago
Adrian Dewhurst	a6b13e6972	cmd/tailscale/cli: correct command emitted by exit node suggestion ... The exit node suggestion CLI command was written with the assumption that it's possible to provide a stableid on the command line, but this is incorrect. Instead, it will now emit the name of the exit node. Fixes #12618 Change-Id: Id7277f395b5fca090a99b0d13bfee7b215bc9802 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	5 months ago
Naman Sood	75254178a0	ipn/ipnlocal: don't bind localListener if its context is canceled (#12621) ... The context can get canceled during backoff, and binding after that makes the listener impossible to close afterwards. Fixes #12620. Signed-off-by: Naman Sood <mail@nsood.in>	5 months ago
Anton Tolchanov	787ead835f	tsweb: accept a function to call before request handling ... To complement the existing `onCompletion` callback, which is called after request handler. Updates tailscale/corp#17075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	5 months ago
Andrea Gottardo	6e55d8f6a1	health: add warming-up warnable (#12553)	5 months ago
Andrew Dunham	30f8d8199a	ipn/ipnlocal: fix data race in tests ... We can observe a data race in tests when logging after a test is finished. `b.onHealthChange` is called in a goroutine after being registered with `health.Tracker.RegisterWatcher`, which calls callbacks in `setUnhealthyLocked` in a new goroutine. See: https://github.com/tailscale/tailscale/actions/runs/9672919302/job/26686038740 Updates #12054 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ibf22cc994965d88a9e7236544878d5373f91229e	5 months ago
Aaron Klotz	da078b4c09	util/winutil: add package for logging into Windows via Service-for-User (S4U) ... This PR ties together pseudoconsoles, user profiles, s4u logons, and process creation into what is (hopefully) a simple API for various Tailscale services to obtain Windows access tokens without requiring knowledge of any Windows passwords. It works both for domain-joined machines (Kerberos) and non-domain-joined machines. The former case is fairly straightforward as it is fully documented. OTOH, the latter case is not documented, though it is fully defined in the C headers in the Windows SDK. The documentation blanks were filled in by reading the source code of Microsoft's Win32 port of OpenSSH. We need to do a bit of acrobatics to make conpty work correctly while creating a child process with an s4u token; see the doc comments above startProcessInternal for details. Updates #12383 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	5 months ago