6079 Commits (f6615931d70671412b67e7ddf24ca92127ededa7)

 

All Branches   

Search

Author	SHA1	Message	Date
Flakes Updater	f6615931d7	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	10 months ago
Sonia Appasamy	077bbb8403	client/web: add csrf protection to web client api ... Adds csrf protection and hooks up an initial POST request from the React web client. Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
Andrew Dunham	77ff705545	net/portmapper: never select port 0 in UPnP ... Port 0 is interpreted, per the spec (but inconsistently among router software) as requesting to map every single available port on the UPnP gateway to the internal IP address. We'd previously avoided picking ports below 1024 for one of the two UPnP methods (in #7457), and this change moves that logic so that we avoid it in all cases. Updates #8992 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I20d652c0cd47a24aef27f75c81f78ae53cc3c71e	10 months ago
Brad Fitzpatrick	b5ff68a968	control/controlclient: flesh out mapSession to break up gigantic method ... Now mapSession has a bunch more fields and methods, rather than being just one massive func with a ton of local variables. So far there are no major new optimizations, though. It should behave the same as before. This has been done with an eye towards testability (so tests can set all the callback funcs as needed, or not, without a huge Direct client or long-running HTTP requests), but this change doesn't add new tests yet. That will follow in the changes which flesh out the NetmapUpdater interface. Updates #1909 Change-Id: Iad4e7442d5bbbe2614bd4b1dc4b02e27504898df Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	1b223566dd	util/linuxfw: fix typo in unexported doc comment ... And flesh it out and use idiomatic doc style ("whether" for bools) and end in a period while there anyway. Updates #cleanup Change-Id: Ieb82f13969656e2340c3510e7b102dc8e6932611 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Val	c85d7c301a	tool: force HTTP/1.1 in curl to prevent hang behind load balancer ... When running in our github CI environment, curl sometimes hangs while closing the download from the nodejs.org server and fails with INTERNAL_ERROR. This is likely caused by CI running behind some kind of load balancer or proxy that handles HTTP/2 incorrectly in some minor way, so force curl to use HTTP 1.1. Updates #8988 Signed-off-by: Val <valerie@tailscale.com>	10 months ago
Denton Gentry	f486041fd1	tsnet: add support for clientmetrics. ... Updates https://github.com/tailscale/tailscale/issues/1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	10 months ago
Val	c15997511d	wgengine/magicsock: only accept pong sent by CLI ping ... When sending a ping from the CLI, only accept a pong that is in reply to the specific CLI ping we sent. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	10 months ago
Brad Fitzpatrick	165f0116f1	types/netmap: move some mutations earlier, remove, document some fields ... And optimize the Persist setting a bit, allocating later and only mutating fields when there's been a Node change. Updates #1909 Change-Id: Iaddfd9e88ef76e1d18e8d0a41926eb44d0955312 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	21170fb175	control/controlclient: scope a variable tighter, de-pointer a *time.Time ... Just misc cleanups. Updates #1909 Change-Id: I9d64cb6c46d634eb5fdf725c13a6c5e514e02e9a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Maisem Ali	2548496cef	types/views,cmd/viewer: add ByteSlice[T] to replace mem.RO ... Add a new views.ByteSlice[T ~[]byte] to provide a better API to use with views. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	10 months ago
Maisem Ali	8a5ec72c85	cmd/cloner: use maps.Clone and ptr.To ... Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	10 months ago
Brad Fitzpatrick	4511e7d64e	ipn/ipnstate: add PeerStatus.AltSharerUserID, stop mangling Node.User ... In b987b2ab18 (2021-01-12) when we introduced sharing we mapped the sharer to the userid at a low layer, mostly to fix the display of "tailscale status" and the client UIs, but also some tests. The commit earlier today, 7dec09d169, removed the 2.5yo option to let clients disable that automatic mapping, as clearly we were never getting around to it. This plumbs the Sharer UserID all the way to ipnstatus so the CLI itself can choose to print out the Sharer's identity over the node's original owner. Then we stop mangling Node.User and let clients decide how they want to render things. To ease the migration for the Windows GUI (which currently operates on tailcfg.Node via the NetMap from WatchIPNBus, instead of PeerStatus), a new method Node.SharerOrUser is added to do the mapping of Sharer-else-User. Updates #1909 Updates tailscale/corp#1183 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Maisem Ali	d483ed7774	tailcfg: generate RegisterResponse.Clone, remove manually written ... It had a custom Clone func with a TODO to replace with cloner, resolve that todo. Had to pull out the embedded Auth struct into a named struct. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	10 months ago
Brad Fitzpatrick	282dad1b62	tailcfg: update docs on NetInfo.FirewallMode ... Updates #391 Change-Id: Ifef196b31dd145f424fb0c0d0bb04565cc22c717 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	d8191a9813	ipn/ipnlocal: fix regression in printf arg type ... I screwed this up in 58a4fd43d as I expected. I even looked out for cases like this (because this always happens) and I still missed it. Vet doesn't flag these because they're not the standard printf funcs it knows about. TODO: make our vet recognize all our "logger.Logf" types. Updates #8948 Change-Id: Iae267d5f81da49d0876b91c0e6dc451bf7dcd721 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	f35ff84ee2	util/deephash: relax an annoyingly needy test ... I'd added a test case of deephash against a tailcfg.Node to make sure it worked at all more than anything. We don't care what the exact bytes are in this test, just that it doesn't fail. So adjust for that. Then when we make changes to tailcfg.Node and types under it, we don't need to keep adjusting this test. Updates #cleanup Change-Id: Ibf4fa42820aeab8f5292fe65f9f92ffdb0b4407b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	93a806ba31	types/tkatype: add test for MarshaledSignature's JSON format ... Lock in its wire format before a potential change to its Go type. Updates #1909 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	7dec09d169	control/controlclient: remove Opts.KeepSharerAndUserSplit ... It was added 2.5 years ago in c1dabd9436 but was never used. Clearly that migration didn't matter. We can attempt this again later if/when this matters. Meanwhile this simplifies the code and thus makes working on other current efforts in these parts of the code easier. Updates #1909 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Maisem Ali	02b47d123f	tailcfg: remove unused Domain field from Login/User ... Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	10 months ago
Brad Fitzpatrick	58a4fd43d8	types/netmap, all: use read-only tailcfg.NodeView in NetworkMap ... Updates #8948 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
KevinLiang10	b040094b90	util/linuxfw: reorganize nftables rules to allow it to work with ufw ... This commit tries to mimic the way iptables-nft work with the filewall rules. We follow the convention of using tables like filter, nat and the conventional chains, to make our nftables implementation work with ufw. Updates: #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	10 months ago
Will Norris	d4586ca75f	tsnet/example/web-client: listen on localhost ... Serving the web client on the tailscale interface, while useful for remote management, is also inherently risky if ACLs are not configured appropriately. Switch the example to listen only on localhost, which is a much safer default. This is still a valuable example, since it still demonstrates how to have a web client connected to a tsnet instance. Updates #13775 Signed-off-by: Will Norris <will@tailscale.com>	10 months ago
KevinLiang10	93cab56277	wgengine/router: fall back and set iptables as default again ... Due to the conflict between our nftables implementation and ufw, which is a common utility used on linux. We now want to take a step back to prevent regression. This will give us more chance to let users to test our nftables support and heuristic. Updates: #391 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	10 months ago
Brad Fitzpatrick	6e57dee7eb	cmd/viewer, types/views, all: un-special case slice of netip.Prefix ... Make it just a views.Slice[netip.Prefix] instead of its own named type. Having the special case led to circular dependencies in another WIP PR of mine. Updates #8948 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	261cc498d3	types/views: add LenIter method to slice view types ... This is basically https://github.com/bradfitz/iter which was a joke but now that Go's adding range over int soonish, might as well. It simplies our code elsewher that uses slice views. Updates #8948 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	af2e4909b6	all: remove some Debug fields, NetworkMap.Debug, Reconfig Debug arg ... Updates #8923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Andrew Lytvynov	86ad1ea60e	clientupdate: parse /etc/synoinfo.conf to get CPU arch (#8940) ... The hardware version in `/proc/sys/kernel/syno_hw_version` does not map exactly to versions in https://github.com/SynoCommunity/spksrc/wiki/Synology-and-SynoCommunity-Package-Architectures. It contains some slightly different version formats. Instead, `/etc/synoinfo.conf` exists and contains a `unique` line with the CPU architecture encoded. Parse that out and filter through the list of architectures that we have SPKs for. Tested on DS218 and DS413j. Updates #8927 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	10 months ago
Marwan Sulaiman	72d2122cad	cmd/tailscale: change serve and funnel calls to StatusWithoutPeers ... The tailscale serve|funnel commands frequently call the LocalBackend's Status but they never need the peers to be included. This PR changes the call to be StatusWithoutPeers which should gain a noticeable speed improvement Updates #8489 Signed-off-by: Marwan Sulaiman <marwan@tailscale.com>	10 months ago
Brad Fitzpatrick	121d1d002c	tailcfg: add nodeAttrs for forcing OneCGNAT on/off [capver 71] ... Updates #8923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	25663b1307	tailcfg: remove most Debug fields, move bulk to nodeAttrs [capver 70] ... Now a nodeAttr: ForceBackgroundSTUN, DERPRoute, TrimWGConfig, DisableSubnetsIfPAC, DisableUPnP. Kept support for, but also now a NodeAttr: RandomizeClientPort. Removed: SetForceBackgroundSTUN, SetRandomizeClientPort (both never used, sadly... never got around to them. But nodeAttrs are better anyway), EnableSilentDisco (will be a nodeAttr later when that effort resumes). Updates #8923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
David Anderson	e92adfe5e4	net/art: allow non-pointers as values ... Values are still turned into pointers internally to maintain the invariants of strideTable, but from the user's perspective it's now possible to tbl.Insert(pfx, true) rather than tbl.Insert(pfx, ptr.To(true)). Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>	10 months ago
Brad Fitzpatrick	bc0eb6b914	all: import x/exp/maps as xmaps to distinguish from Go 1.21 "maps" ... Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	e8551d6b40	all: use Go 1.21 slices, maps instead of x/exp/{slices,maps} ... Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Denton Gentry	e8d140654a	cmd/derper: count bootstrap dns unique lookups. ... Updates https://github.com/tailscale/corp/issues/13979 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	10 months ago
Denton Gentry	7e15c78a5a	syncs: add map.Clear() method ... Updates https://github.com/tailscale/corp/issues/13979 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	10 months ago
Brad Fitzpatrick	239ad57446	tailcfg: move LogHeapPprof from Debug to c2n [capver 69] ... And delete Debug.GoroutineDumpURL, which was already in c2n. Updates #8923 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Maisem Ali	24509f8b22	cmd/k8s-operator: add support for control plane assigned groups ... Previously we would use the Impersonate-Group header to pass through tags to the k8s api server. However, we would do nothing for non-tagged nodes. Now that we have a way to specify these via peerCaps respect those and send down groups for non-tagged nodes as well. For tagged nodes, it defaults to sending down the tags as groups to retain legacy behavior if there are no caps set. Otherwise, the tags are omitted. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	10 months ago
Brad Fitzpatrick	0913ec023b	CODEOWNERS: add the start of an owners file ... Updates tailscale/corp#13972 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Brad Fitzpatrick	b090d61c0f	tailcfg: rename prototype field to reflect its status ... (Added earlier today in #8916, 57da1f150) Updates tailscale/corp#13969 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
Richard Castro	57da1f1501	client: update DNSConfig type (#8916) ... This PR adds DNSFilterURL to the DNSConfig type to be used by control changes to add DNS filtering logic Fixes #cleanup Signed-off-by: Richard Castro <richard@tailscale.com>	10 months ago
Chris Palmer	37c0b9be63	clientupdate: return NOTREACHED for macsys (#8898) ... * clientupdate: return NOTREACHED for macsys The work is done in Swift; this is now a documentation placeholder. Updates #6995 Signed-off-by: Chris Palmer <cpalmer@tailscale.com>	10 months ago
Sonia Appasamy	18280ebf7d	client/web: hook up data fetching to fill --dev React UI ... Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	10 months ago
David Anderson	623d72c83b	net/art: move child table pointers out of strideEntry ... In preparation for a different refactor, but incidentally also saves 10-25% memory on overall table size in benchmarks. Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>	10 months ago
Charlotte Brandhorst-Satzkorn	f101a75dce	cmd/tailscale/cli: fix comment accuracy ... All exit nodes are shown under this subcommand. Updates tailscale/corp#13025 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>	10 months ago
Adrian Dewhurst	f75a36f9bc	tsweb: add request ID for errors ... If an optional request ID generating func is supplied to StdHandler, then requests that return an error will be logged with a request ID that is also shown as part of the response. Updates tailscale/corp#2549 Change-Id: Ic7499706df42f95b6878d44d4aab253e2fc6a69b Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	10 months ago
Andrew Lytvynov	cf31b58ed1	VERSION.txt: this is v1.49.0 (#8907) ... Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	10 months ago
Brad Fitzpatrick	6c791f7d60	derp: include src IPs in mesh watch messages ... Updates tailscale/corp#13945 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	10 months ago
KevinLiang10	7ed3681cbe	tailcfg: Add FirewallMode to NetInfo to record wether host using iptables or nftables ... To record wether user is using iptables or nftables after we add support to nftables on linux, we are adding a field FirewallMode to NetInfo in HostInfo to reflect what firewall mode the host is running, and form metrics. The information is gained from a global constant in hostinfo.go. We set it when selection heuristic made the decision, and magicsock reports this to control. Updates: tailscale/corp#13943 Signed-off-by: KevinLiang10 <kevinliang@tailscale.com>	10 months ago
Andrew Dunham	95d776bd8c	wgengine/magicsock: only cache N most recent endpoints per-Addr ... If a node is flapping or otherwise generating lots of STUN endpoints, we can end up caching a ton of useless values and sending them to peers. Instead, let's apply a fixed per-Addr limit of endpoints that we cache, so that we're only sending peers up to the N most recent. Updates tailscale/corp#13890 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8079a05b44220c46da55016c0e5fc96dd2135ef8	10 months ago