tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	e78e26b6fb	cmd/tailscale: fix another up warning with exit nodes The --advertise-routes and --advertise-exit-node flags both mutating one pref is the gift that keeps on giving. I need to rewrite the this up warning code to first map prefs back to flag values and then just compare flags instead of comparing prefs, but this is the minimal fix for now. This also includes work on the tests, to make them easier to write (and more accurate), by letting you write the flag args directly and have that parse into the upArgs/MaskedPrefs directly, the same as the code, rather than them being possibly out of sync being written by hand. Fixes https://twitter.com/EXPbits/status/1390418145047887877 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2585edfaeb	cmd/tailscale: fix tailscale up --advertise-exit-node validation Fixes #1859 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	52e1031428	cmd/tailscale: gofmt From `6d10655dc3` Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Avery Pennarun	6d10655dc3	ipnlocal: accept a new opts.UpdatePrefs field. This is needed because the original opts.Prefs field was at some point subverted for use in frontend->backend state migration for backward compatibility on some platforms. We still need that feature, but we also need the feature of providing the full set of prefs from `tailscale up`, not including overwriting the prefs.Persist keys, so we can't use the original field from `tailscale up`. `tailscale up` had attempted to compensate for that by doing SetPrefs() before Start(), but that violates the ipn.Backend contract, which says you should call Start() before anything else (that's why it's called Start()). As a result, doing SetPrefs({ControlURL=..., WantRunning=true}) would cause a connection to the previous control server (because WantRunning=true), and then connect to the new control server only after running Start(). This problem may have been avoided before, but only by pure luck. It turned out to be relatively harmless since the connection to the old control server was immediately closed and replaced anyway, but it created a race condition that could have caused spurious notifications or rejected keys if the server responded quickly. As already covered by existing TODOs, a better fix would be to have Start() get out of the business of state migration altogether. But we're approaching a release so I want to make the minimum possible fix. Fixes #1840. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Brad Fitzpatrick	962bf74875	cmd/tailscale: fail if tailscaled closes the IPN connection I was going to write a test for this using the tstest/integration test stuff, but the testcontrol implementation isn't quite there yet (it always registers nodes and doesn't provide AuthURLs). So, manually tested for now. Fixes #1843 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	90002be6c0	cmd/tailscale: make pref-revert checks ignore OS-irrelevant prefs This fixes #1833 in two ways: * stop setting NoSNAT on non-Linux. It only matters on Linux and the flag is hidden on non-Linux, but the code was still setting it. Because of that, the new pref-reverting safety checks were failing when it was changing. * Ignore the two Linux-only prefs changing on non-Linux. Fixes #1833 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	fb67d8311c	cmd/tailscale: pull out, parameterize up FlagSet creation for tests Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Avery Pennarun	6caa02428e	cmd/tailscale/cli/up: "LoggedOut" pref is implicit. There's no need to warn that it was not provided on the command line after doing a sequence of up; logout; up --args. If you're asking for tailscale to be up, you always mean that you prefer LoggedOut to become false. Fixes #1828 Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	3 years ago
Ross Zurowski	b062ac5e86	cmd/tailscale: fix typo in error message (#1807 ) Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	3 years ago
Brad Fitzpatrick	5ecc7c7200	cmd/tailscale: make the new 'up' errors prettier and more helpful Fixes #1746 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	ffe6c8e335	cmd/tailscale/cli: don't do a simple up when in state NeedsLogin Fixes #1780 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	30629c430a	cmd/tailscale/cli: don't force an interactive login on --reset. Fixes #1778 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	67ba6aa9fd	cmd/tailscale/cli: fix typo in ExitNodeID mapping. Prevented turning off exit nodes. Fixes #1777 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	820952daba	cmd/tailscale: don't print out old authURL on up --force-reauth Fixes #1671 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c91a22c82e	cmd/tailscale: don't print auth URL when using a --authkey Fixes #1755 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e40e5429c2	cmd/tailscale/cli: make 'tailscale up' protect --advertise-exit-node removal The new "tailscale up" checks previously didn't protect against --advertise-exit-node being omitted in the case that --advertise-routes was also provided. It wasn't done before because there is no corresponding pref for "--advertise-exit-node"; it's a helper flag that augments --advertise-routes. But that's an implementation detail and we can still help users. We just have to special case that pref and look whether the current routes include both the v4 and v6 /0 routes. Fixes #1767 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	dedbd483ea	cmd/tailscale/cli: don't require explicit --operator if it matches $USER This doesn't make --operator implicit (which we might do in the future), but it at least doesn't require repeating it in the future when it already matches $USER. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	8f3e453356	ipn, cmd/tailscale/cli: add pref to configure sudo-free operator user From discussion with @danderson. Fixes #1684 (in a different way) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	49808ae6ea	ipn{,/ipnlocal}, cmd/tailscale/cli: don't check pref reverts on initial up The ipn.NewPrefs func returns a populated ipn.Prefs for historical reasons. It's not used or as important as it once was, but it hasn't yet been removed. Meanwhile, it contains some default values that are used on some platforms. Notably, for this bug (#1725), Windows/Mac use its Prefs.RouteAll true value (to accept subnets), but Linux users have always gotten a "false" value for that, because that's what cmd/tailscale's CLI default flag is _for all operating systems_. That meant that "tailscale up" was rightfully reporting that the user was changing an implicit setting: RouteAll was changing from true with false with the user explicitly saying so. An obvious fix might be to change ipn.NewPrefs to return Prefs.RouteAll == false on some platforms, but the logic is complicated by darwin: we want RouteAll true on windows, android, ios, and the GUI mac app, but not the CLI tailscaled-on-macOS mode. But even if we used build tags (e.g. the "redo" build tag) to determine what the default is, that then means we have duplicated and differing "defaults" between both the CLI up flags and ipn.NewPrefs. Furthering that complication didn't seem like a good idea. So, changing the NewPrefs defaults is too invasive at this stage of the release, as is removing the NewPrefs func entirely. Instead, tweak slightly the semantics of the ipn.Prefs.ControlURL field. This now defines that a ControlURL of the empty string means both "we're uninitialized" and also "just use the default". Then, once we have the "empty-string-means-unintialized" semantics, use that to suppress "tailscale up"'s recent implicit-setting-revert checking safety net, if we've never initialized Tailscale yet. And update/add tests. Fixes #1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4df6e62fbc	ipn: add DefaultControlURL const, replace few literals with it Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	f1d45bc4bb	cmd/tailscale/cli: pull out prefsFromUpArgs for testability, add tests Will add more tests later but this locks in all the existing warnings and errors at least, and some of the existing non-error behavior. Mostly I want this to exist before I actually fix #1725. Updates #1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	4948ff6ecb	cmd/tailscale/cli: treat nil and non-nil zero length slices as equiv prefs Updates #1725 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2f422434aa	cmd/tailscale/cli: wait on the right contexts in up Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Ross Zurowski	c748c20fba	cmd/tailscale: fix command descriptions (#1710 ) Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	3 years ago
Brad Fitzpatrick	a8d95a18b2	cmd/tailscale/cli: add up --unattended for Windows RELNOTE=Windows CLI behavior change: ForceDaemon now off by default Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	1b9d8771dc	ipn/ipnlocal,wgengine/router,cmd/tailscale: add flag to allow local lan access when routing traffic via an exit node. For #1527 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	9972c02b60	cmd/tailscale/cli: don't let up change prefs based on implicit flag values This changes the behavior of "tailscale up". Previously "tailscale up" always did a new Start and reset all the settings. Now "tailscale up" with no flags just brings the world [back] up. (The opposite of "tailscale down"). But with flags, "tailscale up" now only is allowed to change preferences if they're explicitly named in the flags. Otherwise it's an error. Or you need to use --reset to explicitly nuke everything. RELNOTE=tailscale up change Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	958782c737	cmd/{tailscale,tailscaled}: use netstack for subnet routing on Synology Updates #707 Fixes #451 Fixes tailscale/tailscale-synology#52 (just make it work by default) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3b451509dd	cmd/tailscale/cli: make advertise-{routes,exit-node} available unconditionally It was only Linux and BSDs before, but now with netstack mode, it also works on Windows and darwin. It's not worth limiting it to certain platforms. Tailscaled itself can complain/fail if it doesn't like the settings for the mode/OS it's operating under. Updates #707 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	799973a68d	ipn: move Options.Notify to its own method We already had SetNotifyCallback elsewhere on controlclient, so use that name. Baby steps towards some CLI refactor work. Updates tailscale/tailscale#1436	3 years ago
Brad Fitzpatrick	1bd14a072c	cmd/tailscale, ipn/localapi: move IP forwarding check to tailscaled, API Instead of having the CLI check whether IP forwarding is enabled, ask tailscaled. It has a better idea. If it's netstack, for instance, the sysctl values don't matter. And it's possible that only the daemon has permission to know. Fixes #1626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0406a7436a	cmd/tailscale/cli: use double hypens, make default usage func more clear Mash up some code from ffcli and std's flag package to make a default usage func that's super explicit for those not familiar with the Go style flags. Only show double hyphens in usage text (but still accept both), and show default values, and only show the proper usage of boolean flags. Fixes #1353 Fixes #1529 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	d0dffe33c0	cmd/tailscale, ipn/localapi: use localapi for status, not IPN acrobatics Yay simpler code. Tested on Linux, macOS and Windows. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0c3e9722cc	cmd/tailscale/cli: fix typo in comment Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	98ab533324	cmd/tailscale/cli: include GOOS in BSD warning message instead of just lowercase "bsd" Updates #1475 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	380a3526f6	cmd/tailscale/cli: warn if using subnet routing on BSD Fixes #1475. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Christine Dodrill	deff20edc6	cmd/tailscale/cli: don't permit setting self IP as exit node (#1491 ) This change makes it impossible to set your own IP address as the exit node for this system. Fixes #1489 Signed-off-by: Christine Dodrill <xe@tailscale.com>	3 years ago
Brad Fitzpatrick	cc99059fc2	Revert "--advertise-routes option enabled in Mac tailscale CLI; it checks for IP forwarding enabled" This reverts commit `08949d4ef1`. I think this code was aspirational. There's no code that sets up the appropriate NAT code using pfctl/etc. See #911 and #1475. Updates #1475 Updates #911	3 years ago
David Anderson	ebf3f2fd9f	cmd/tailscale/cli: add CLI option to offer an exit node to the tailnet. Finishes up linux part of #1154. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	7ad3af2141	cmd/tailscale/cli: remove outdated TODO Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	b9c2231fdf	ipn: program exit node into the data plane according to user pref. Part of #1153, #1154. Fixes #1224. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	d76334d2f0	ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c7d4bf2333	cmd/tailscale/cli: recommend sudo for 'tailscale up' on failure Fixes #1220	3 years ago
David Anderson	ab9cccb292	cmd/tailscale/cli: require v4 and v6 default routes to be advertised together. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	2fe770ed72	all: replace wgcfg.IP and wgcfg.CIDR with netaddr types Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Avery Pennarun	f99f6608ff	Reverse earlier "allow tag without 'tag:' prefix" changes. These accidentally make the tag syntax more flexible than was intended, which will create forward compatibility problems later. Let's go back to the old stricter parser. Revert "cmd/tailscale/cli: fix double tag: prefix in tailscale up" Revert "cmd/tailscale/cli, tailcfg: allow tag without "tag:" prefix in 'tailscale up'" This reverts commit `a702921620`. This reverts commit `cd07437ade`. Affects #861. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	4 years ago
Brad Fitzpatrick	696e160cfc	cmd/tailscale/cli: fix double tag: prefix in tailscale up Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	cd07437ade	cmd/tailscale/cli, tailcfg: allow tag without "tag:" prefix in 'tailscale up' Fixes #861	4 years ago
Brad Fitzpatrick	515866d7c6	ipn, ipnserver, cmd/tailscale: add "server mode" support on Windows This partially (but not yet fully) migrates Windows to tailscaled's StateStore storage system. This adds a new bool Pref, ForceDaemon, defined as: // ForceDaemon specifies whether a platform that normally // operates in "client mode" (that is, requires an active user // logged in with the GUI app running) should keep running after the // GUI ends and/or the user logs out. // // The only current applicable platform is Windows. This // forced Windows to go into "server mode" where Tailscale is // running even with no users logged in. This might also be // used for macOS in the future. This setting has no effect // for Linux/etc, which always operate in daemon mode. Then, when ForceDaemon becomes true, we now write use the StateStore to track which user started it in server mode, and store their prefs under that key. The ipnserver validates the connections/identities and informs that LocalBackend which userid is currently in charge. The GUI can then enable/disable server mode at runtime, without using the CLI. But the "tailscale up" CLI was also fixed, so Windows users can use authkeys or ACL tags, etc. Updates #275	4 years ago
Brad Fitzpatrick	90b7293b3b	ipn: add/move some constants, update a comment And make the StateStore implementations be Stringers, for error messages.	4 years ago

1 2

63 Commits (e72ed3fcc2fd865b75d4ef52ff3f910f60578751)