tailscale

Commit Graph

Author	SHA1	Message	Date
Maisem Ali	075abd8ec1	tstest: do not panic when a panic logs The panicLogWriter is too strict, and any panics that occur get wrapped up in quotes. This makes it so that it will allow panics to continue writing to Stderr without going through logger.Logf. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	12a2221db2	cmd/testwrapper/flakytest: clearly describe why TestFlakeRun fails Fixes #8474 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Tom DNetto	97ee0bc685	cmd/tailscale: improve error message when signing without a tailnet lock key Updates #8568 Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Brad Fitzpatrick	b0a984dc26	util/lru: add a package for a typed LRU cache Updates tailscale/corp#7355 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
License Updater	626f650033	licenses: update android licenses Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 year ago
License Updater	d4413f723d	licenses: update win/apple licenses Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 year ago
Brad Fitzpatrick	cafd9a2bec	syncs: add ShardedMap.Mutate To let callers do atomic/CAS-like operations. Updates tailscale/corp#7355 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Andrew Dunham	ab310a7f60	derp: use new net/tcpinfo package Updates #8413 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8bf8046517195a6d42cabb32d6ec7f1f79cef860	1 year ago
Andrew Dunham	d9eca20ee2	net/tcpinfo: add package to allow fetching TCP information This package contains platform-independent abstractions for fetching information about an open TCP connection. Updates #8413 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I236657b1060d7e6a45efc7a2f6aacf474547a2fe	1 year ago
KevinLiang10	243ce6ccc1	util/linuxfw: decoupling IPTables logic from linux router This change is introducing new netfilterRunner interface and moving iptables manipulation to a lower leveled iptables runner. For #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	1 year ago
Charlotte Brandhorst-Satzkorn	9c64e015e5	tailcfg: update location docs This change updates the documentation for the fields on the location struct. Updates tailscale/corp#12146 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	1 year ago
Ross Zurowski	832f1028c7	net/netutil: parse IP forwarding val as int, not bool (#8455 ) This commit updates our IP forwarding parsing logic to allow the less common but still valid value of `2` to be parsed as `true`, which fixes an error some users encountered. Fixes #8375 Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	1 year ago
Brad Fitzpatrick	a874f1afd8	all: adjust case of "IPv4" and "IPv6" Updates #docs Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
valscale	e26376194d	ipn/ipnlocal: validate ping type (#8458 ) Correct a minor cut-n-paste error that resulted in an invalid or missing ping type being accepted as a disco ping. Fixes #8457 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Brad Fitzpatrick	77f56794c9	types/key: add test for NodePublic.Shard Updates #cleanup Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Tom DNetto	1377618dbc	tsnet: expose field to configure Wireguard port Signed-off-by: Tom DNetto <tom@tailscale.com> Updates #1748	1 year ago
Maisem Ali	8e840489ed	cmd/testwrapper: only retry flaky failed tests Redo the testwrapper to track and only retry flaky tests instead of retrying the entire pkg. It also fails early if a non-flaky test fails. This also makes it so that the go test caches are used. Fixes #7975 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Anton Tolchanov	2cf6e12790	hostinfo: make lxcfs container check more specific Instead of treating any lxcfs mount as an indicator that we're running in a container, check for one of the mounts actually used by LXC containers. For reference, here's a list of mounts I am seeing in an LXC container: ``` $ grep lxcfs /proc/mounts lxcfs /proc/cpuinfo fuse.lxcfs rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0 lxcfs /proc/diskstats fuse.lxcfs rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0 lxcfs /proc/loadavg fuse.lxcfs rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0 lxcfs /proc/meminfo fuse.lxcfs rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0 lxcfs /proc/stat fuse.lxcfs rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0 lxcfs /proc/swaps fuse.lxcfs rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0 lxcfs /proc/uptime fuse.lxcfs rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0 lxcfs /sys/devices/system/cpu/online fuse.lxcfs rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0 ``` Fixes #8444 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	1 year ago
Maisem Ali	c11af12a49	.github: actually run tests in CI Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	ba41d14320	syncs: add ShardedMap type Updates tailscale/corp#7354 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	1f57088cbd	words: ovuliferous was a bit too much, but... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Charlotte Brandhorst-Satzkorn	3417ddc00c	tailcfg: add location field to hostinfo This change adds Location field to HostInfo. Location contains the option for a Country, CountryCode, City, CityCode and a Priority. Neither of these fields are populated by default. The Priority field is used to determine the priority an exit node should be given for use, if the field is set. The higher the value set, the higher priority the node should be given for use. Updates tailscale/corp#12146 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	1 year ago
phirework	2a9817da39	api.md: add info for key description (#8429 ) Updates tailscale/corp#7773 Signed-off-by: Jenny Zhang <jz@tailscale.com>	1 year ago
David Anderson	bfe5623a86	tool/gocross: make gocross behave with pre-release Go toolchains Also switch the wrapper script to use bash not posix shell. We now depend on bash elsewhere for saner behavior in esoteric areas, so might as well use it everywhere for consistency. Fixes #8425 Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	4a58b1c293	release/dist/synology: remove 'version' field from ui/config As far as I can tell from the DSM documentation and known undocumented fields, there is no 'version' field in this config file that DSM cares about. Updates #8232 Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Brad Fitzpatrick	7c1068b7ac	util/goroutines: let ScrubbedGoroutineDump get only current stack ScrubbedGoroutineDump previously only returned the stacks of all goroutines. I also want to be able to use this for only the current goroutine's stack. Add a bool param to support both ways. Updates tailscale/corp#5149 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
phirework	fbacc0bd39	go.toolchain: switch to tailscale.go1.21 (#8415 ) Updates #8419 Signed-off-by: Jenny Zhang <jz@tailscale.com>	1 year ago
Brad Fitzpatrick	8b80d63b42	wgengine/magicsock: clarify a log message is a warning, not an error Updates #cleanup Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Joe Tsai	61886e031e	ssh/tailssh: fix double race condition with non-pty command (#8405 ) There are two race conditions in output handling. The first race condition is due to a misuse of exec.Cmd.StdoutPipe. The documentation explicitly forbids concurrent use of StdoutPipe with exec.Cmd.Wait (see golang/go#60908) because Wait will close both sides of the pipe once the process ends without any guarantees that all data has been read from the pipe. To fix this, we allocate the os.Pipes ourselves and manage cleanup ourselves when the process has ended. The second race condition is because sshSession.run waits upon exec.Cmd to finish and then immediately proceeds to call ss.Exit, which will close all output streams going to the SSH client. This may interrupt any asynchronous io.Copy still copying data. To fix this, we close the write-side of the os.Pipes after the process has finished (and before calling ss.Exit) and synchronously wait for the io.Copy routines to finish. Fixes #7601 Signed-off-by: Joe Tsai <joetsai@digital-static.net> Co-authored-by: Maisem Ali <maisem@tailscale.com>	1 year ago
dependabot[bot]	d4de60c3ae	.github: Bump actions/checkout from 1 to 3 Bumps [actions/checkout](https://github.com/actions/checkout) from 1 to 3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v1...v3) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	1 year ago
Charlotte Brandhorst-Satzkorn	30d9201a11	VERSION.txt: this is v1.45.0 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	1 year ago
Brad Fitzpatrick	32b8f25ed1	Revert "ssh/tailssh: change to user directory when running login/command" This reverts commit `dc5bc32d8f`. It broke tests. (sadly, ones which we have disabled on CI, but go test ./ssh/tailssh broke)	1 year ago
Aaron Bieber	6829caf6de	tsnet: remove extra wording from Store comment	1 year ago
Brad Fitzpatrick	e48c0bf0e7	ipn/ipnlocal: quiet some spammy network lock logging Updates #cleanup Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
valscale	f314fa4a4a	prober: fix data race when altering derpmap (#8397 ) Move the clearing of STUNOnly flag to the updateMap() function. Fixes #8395 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Derek Burdick	dc5bc32d8f	ssh/tailssh: change to user directory when running login/command On redhat 9 and similarly locked down systems, root user does not have access to a users directory. This fix does not set a directory for the incubator process and instead sets the directory when the actual process requested by remote user is executed. Fixes #8118 Signed-off-by: Derek Burdick <derek-burdick@users.noreply.github.com>	1 year ago
shayne	6697690b55	{cmd/tailscale/cli,ipn}: add http support to tailscale serve (#8358 ) Updates #8357 Signed-off-by: Shayne Sweeney <shayne@tailscale.com>	1 year ago
Brad Fitzpatrick	a2153afeeb	types/views: add Slice methods on Slice views Updates #cleanup for change elsewhere. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Sonia Appasamy	0f5090c526	ipn/ipnlocal: add docs header to serve HTTP proxy Adds a `Tailscale-Headers-Info` header whenever the `Tailscale-User-` headers are filled from the HTTP proxy handler. Planning on hooking this shorturl up to KB docs about the header values (i.e. what's a login name vs. display name) and security considerations to keep in mind while using these headers - notibly that they can also be filled from external requests that do not hit tailscaled. Updates https://github.com/tailscale/tailscale/issues/6954 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
valscale	88097b836a	prober: allow monitoring of nodes marked as STUN only in default derpmap (#8391 ) prober uses NewRegionClient() to connect to a derper using a faked up single-node region, but NewRegionClient() fails to connect if there is no non-STUN only client in the region. Set the STUN only flag to false before we call NewRegionClient() so we can monitor nodes marked as STUN only in the default derpmap. Updates #11492 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Maisem Ali	2ae670eb71	ssh/tailssh: work around lack of scontext in SELinux Trying to SSH when SELinux is enforced results in errors like: ``` ➜ ~ ssh ec2-user@<ip> Last login: Thu Jun 1 22:51:44 from <ip2> ec2-user: no shell: Permission denied Connection to <ip> closed. ``` while the `/var/log/audit/audit.log` has ``` type=AVC msg=audit(1685661291.067:465): avc: denied { transition } for pid=5296 comm="login" path="/usr/bin/bash" dev="nvme0n1p1" ino=2564 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process permissive=0 ``` The right fix here would be to somehow install the appropriate context when tailscale is installed on host, but until we figure out a way to do that stop using the `login` cmd in these situations. Updates #4908 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Ross Zurowski	0ed088b47b	tka: add function for generating signing deeplinks (#8385 ) This commit continues the work from #8303, providing a method for a tka.Authority to generate valid deeplinks for signing devices. We'll use this to provide the necessary deeplinks for users to sign from their mobile devices. Updates #8302 Signed-off-by: Ross Zurowski <ross@rosszurowski.com>	1 year ago
Flakes Updater	909e9eabe4	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	1 year ago
Andrew Dunham	b6d20e6f8f	go.mod, net/dns/recursive: update github.com/miekg/dns Updates #cleanup Change-Id: If4de6a84448a17dd81cc2a8af788bd18c3d0bbe3 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	1 year ago
Maisem Ali	1302295299	Dockerfile.base: install iputils Fixes #8361 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
License Updater	c6794dec11	licenses: update android licenses Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 year ago
Nick O'Neill	c783f28228	tool/gocross: properly set simulator deployment target (#8355 ) Fixes tailscale/corp#11876 Signed-off-by: Nick O'Neill <nick@tailscale.com>	1 year ago
License Updater	c1cbd41fdc	licenses: update win/apple licenses Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 year ago
Sonia Appasamy	e1cdcf7708	ipn/ipnlocal: add identity headers to HTTP serve proxy Adds two new headers to HTTP serve proxy: - `Tailscale-User-Login`: Filled with requester's login name. - `Tailscale-User-Name`: Filled with requester's display name. These headers only get filled when the SrcAddr is associated with a non-tagged (i.e. user-owned) node within the client's Tailnet. The headers are passed through empty when the request originated from another tailnet, or the public internet (via funnel). Updates https://github.com/tailscale/tailscale/issues/6954 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Claire Wang	80692edcb8	.github/workflows: Add docker build check (#8345 ) Fixes #8344 Signed-off-by: Claire Wang <claire@tailscale.com>	1 year ago

... 3 4 5 6 7 ...

6048 Commits (e92adfe5e45f3f464a96a9802aa57a2b1fc13adc) All Branches Search

6048 Commits (e92adfe5e45f3f464a96a9802aa57a2b1fc13adc)

All Branches