5304 Commits (f9667e494646021610a70f94634e25e163230345)

 

All Branches   

Search

Author	SHA1	Message	Date
David Anderson	f9667e4946	Dockerfile: fix docker build ... The stamp vars got renamed and I forgot to update these scripts. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Denton Gentry	fdc2018d67	wgengine/magicsock: remove superfluous "discokey" from log ... The stringification of the discokey type now prepends "discokey:" Fixes https://github.com/tailscale/tailscale/issues/3074 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
License Updater	10b20fd1c7	licenses: update android licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	1 year ago
David Anderson	2eb25686d7	.github/workflows: simplify build-only go test invocation ... Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	253333b8a3	.github/workflows: support disabling fuzz testing safely ... OSS-Fuzz doesn't update their version of Go as quickly as we do, so we sometimes end up with OSS-Fuzz being unable to build our code for a few weeks. We don't want CI to be red for that entire time, but we also don't want to forget to reenable fuzzing when OSS-Fuzz does start working again. This change makes two configurations worthy of a CI pass: - Fuzzing works, and we expected it to work. This is a normal happy state. - Fuzzing didn't compile, and we expected it to not compile. This is the "OSS-Fuzz temporarily broken" state. If fuzzing is unexpectedly broken, or unexpectedly not broken, that's a CI failure because we need to either address a fuzz finding, or update TS_FUZZ_CURRENTLY_BROKEN to reflect the state of OSS-Fuzz. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	5e186f9fbf	.github/workflows: pin version of Windows we run on ... Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	471053a054	.github/workflows: pin version of Ubuntu we run on ... Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	2a43fa4421	.github/workflows: use variant=race instead of race=true for race test ... Github's matrix runner formats the race variant as '(amd64, true)' if we use race=true. So, change the way the variable is defined so that it says '(amd64, race)' even if that makes the if statements a bit more complex. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	9fc3d00c17	.github/workflows: add back forgotten android CI job ... Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	4022796484	.github/workflows: unify and matrixify all our CI steps ... Instead of having a dozen files that contribute CI steps with inconsistent configs, this one file lists out everything that, for us, constitutes "a CI run". It also enables the slack notification webhook to notify us exactly once on a mass breakage, rather than once for every sub-job that fails. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	afe19d1d81	tool/go: don't use the names GOOS/GOARCH in script ... The use of GOOS to mean "the compiler's host architecture" ends up overriding whatever GOOS the user passed in, resulting in befuddling errors like "unsupported GOOS/GOARCH pair linux/wasm" when the caller requests js/wasm. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Jenny Zhang	fe5558094c	cmd/tailscale/cli: add logout and debug info to web ... Fixes #7238 Signed-off-by: Jenny Zhang <jz@tailscale.com>	1 year ago
David Anderson	ea8b896c6c	.github/workflows: remove 'ci skip' boilerplate ... We've never used the "[ci skip]" magic commit header in our history, across all our repos. This seems to be boilerplate we imported years ago and have since been copying around our CI configs. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
License Updater	11fafdac8f	licenses: update android licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	1 year ago
Denton Gentry	01d58c9b61	scripts/installer.sh: add Mendel OS and OpenMandriva. ... Fixes https://github.com/tailscale/tailscale/issues/6926 Fixes https://github.com/tailscale/tailscale/issues/7076 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
David Anderson	bd81d520ab	cmd/printdep: print correct toolchain URL ... In the switch to static toolchains, we removed a legacy oddity from the toolchain URL structure, but forgot to update printdep. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	b64d900f0f	version: fix version output for "go run" ... Before (note attempted use of absent date and commit hash): "short": "1.37.0-dev", "long": "1.37.0-dev-t", After: "short": "1.37.0-ERR-BuildInfo", "long": "1.37.0-ERR-BuildInfo", Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	70a2929a12	version: make all exported funcs compile-time constant or lazy ... Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	8b2ae47c31	version: unexport all vars, turn Short/Long into funcs ... The other formerly exported values aren't used outside the package, so just unexport them. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	9e6b4d7ad8	types/lazy: helpers for lazily computed values ... Co-authored-by: Maisem Ali <maisem@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Denton Gentry	5bca44d572	cmd/sync-containers: update latest and stable tags ... Fixes https://github.com/tailscale/tailscale/issues/7251 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	1 year ago
Mihai Parparita	fa932fefe7	net/interfaces: redo how we get the default interface on macOS and iOS ... With #6566 we added an external mechanism for getting the default interface, and used it on macOS and iOS (see tailscale/corp#8201). The goal was to be able to get the default physical interface even when using an exit node (in which case the routing table would say that the Tailscale utun* interface is the default). However, the external mechanism turns out to be unreliable in some cases, e.g. when multiple cellular interfaces are present/toggled (I have occasionally gotten my phone into a state where it reports the pdp_ip1 interface as the default, even though it can't actually route traffic). It was observed that `ifconfig -v` on macOS reports an "effective interface" for the Tailscale utn* interface, which seems promising. By examining the ifconfig source code, it turns out that this is done via a SIOCGIFDELEGATE ioctl syscall. Though this is a private API, it appears to have been around for a long time (e.g. it's in the 10.13 xnu release at https://opensource.apple.com/source/xnu/xnu-4570.41.2/bsd/net/if_types.h.auto.html) and thus is unlikely to go away. We can thus use this ioctl if the routing table says that a utun* interface is the default, and go back to the simpler mechanism that we had before #6566. Updates #7184 Updates #7188 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Mihai Parparita	21fda7f670	net/routetable: include unknown flags in the routetable doctor output ... As part of the work on #7248 I wanted to know all of the flags on the RouteMessage struct that we get back from macOS. Though it doesn't turn out to be useful (when using an exit node/Tailscale is the default route, the flags for the physical interface routes are the same), it still seems useful from a debugging/comprehensiveness perspective. Adds additional Darwin flags that were output once I enabled this mode. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Mihai Parparita	7d204d89c2	ipn/ipnlocal: fix passthrough of formatting arguments in PeerAPI doctor output ... Followup to #7235, we were not treating the formatting arguments as variadic. This worked OK for single values, but stopped working when we started passing multiple values (noticed while trying out #7244). Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
David Anderson	9ad36d17a3	version: undo previous "optimization", do more work lazily ... Commit 59c254579e moved a lot of work from functions that could be eliminated at compile time (because tests against runtime.GOOS are compile-time constant), into code that must always run before main(). So, revert that, and instead optimize the package only by moving the remaining string processing code behind sync.Onces. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Tom DNetto	2ca6dd1f1d	wgengine: start logging DISCO frames to pcap stream ... Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
David Anderson	da75e49223	version: return correct Meta.MajorMinorPatch in non-dev builds ... Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
License Updater	78980a4ccf	licenses: update win/apple licenses ... Signed-off-by: License Updater <noreply@tailscale.com>	1 year ago
Mihai Parparita	6799ef838f	ipn/ipnlocal: add PeerAPI endpoint for doctor output ... Useful when debugging issues (e.g. to see the full routing table), and easier to refer to the output via a browser than trying to read it from the logs generated by `bugreport --diagnose`. Behind a canDebug() check, similar to the /magicsock and /interfaces endpoints. Updates #7184 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Brad Fitzpatrick	9e4d99305b	go.toolchain.rev: bump Go toolchain ... For tailscale/go#55 experimentation in another repo primarily, but this is our source of truth, so we bump here. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
David Anderson	0e4f2bdd0c	pull-toolchain.sh: don't run update-flake.sh ... We no longer carry an SRI hash for the toolchain, so flake updating is no longer needed for toolchain changes. Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	33f29a1532	go.toolchain.rev: update toolchain to test iOS Go fix ... Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Andrew Dunham	ba48ec5e39	util/linuxfw: initial implementation of package ... This package is an initial implementation of something that can read netfilter and iptables rules from the Linux kernel without needing to shell out to an external utility; it speaks directly to the kernel using syscalls and parses the data returned. Currently this is read-only since it only knows how to parse a subset of the available data. Signed-off-by: Andrew Dunham <andrew@tailscale.com> Change-Id: Iccadf5dcc081b73268d8ccf8884c24eb6a6f1ff5	1 year ago
Colin Adler	3c107ff301	net/connstats: fix ticker in NewStatistics (#7225) ... `:=` was accidentally used, so `maxPeriod` never worked. Signed-off-by: Colin Adler <colin1adler@gmail.com>	1 year ago
Will Norris	6ef834a6b7	get-authkey: require tags to be specified ... Tailnet-owned auth keys (which all OAuth-created keys are) must include tags, since there is no user to own the registered devices. Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Maisem Ali	89bd414be6	ipn/ipnstate: update field docs on PeerStatus. ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Mihai Parparita	2f4df30c75	.github/workflows: re-enable CIFuzz job ... Having an empty `on` spec results in the job still running, but it immediately fails with a "No jobs were run" message. Go back to the original `on: [pull_request]` spec, and disable the workflow in the GitHub UI instead. This reverts commit f7b3156f16. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Mihai Parparita	62f4df3257	net/interfaces, net/netns: add node attributes to control default interface getting and binding ... With #6566 we started to more aggressively bind to the default interface on Darwin. We are seeing some reports of the wrong cellular interface being chosen on iOS. To help with the investigation, this adds to knobs to control the behavior changes: - CapabilityDebugDisableAlternateDefaultRouteInterface disables the alternate function that we use to get the default interface on macOS and iOS (implemented in tailscale/corp#8201). We still log what it would have returned so we can see if it gets things wrong. - CapabilityDebugDisableBindConnToInterface is a bigger hammer that disables binding of connections to the default interface altogether. Updates #7184 Updates #7188 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Brad Fitzpatrick	fb84ccd82d	control/controlhttp: don't require valid TLS cert for Noise connection ... We don't require any cert at all for Noise-over-plaintext-port-80-HTTP, so why require a valid cert chain for Noise-over-HTTPS? The reason we use HTTPS at all is to get through firewalls that allow tcp/443 but not tcp/80, not because we need the security properties of TLS. Updates #3198 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	2477fc4952	net/netutil: only check Linux sysctls w/ procfs, assume absent means false ... Fixes #7217 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	05adf22383	cmd/k8s-operator: add support for running an auth proxy ... Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Mihai Parparita	31e2e9a300	ipn: remove unused NLKeyStateKey constant ... We stopped writing network lock keys as separate items with #6315, the constant is no longer used. Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
Mihai Parparita	f0f2b2e22b	logtail: increase maximum log line size in low memory mode ... The 255 byte limit was chosen more than 3 years ago (tailscale/corp@929635c9d9), when iOS was operating under much more significant memory constraints. With iOS 15 the network extension has an increased limit, so increasing it to 4K should be fine. The motivating factor was that the network interfaces being logged by linkChange in wgengine/userspace.go were getting truncated, and it would be useful to know why in some cases we're choosing the pdp_ip1 cell interface instead of the pdp_ip0 one. Updates #7184 Updates #7188 Signed-off-by: Mihai Parparita <mihai@tailscale.com>	1 year ago
M. J. Fromberger	9be47f789c	ipn/ipnlocal: fix the path for writing cert files (#7203) ... Fixes #7202. Change-Id: I1f8e9c59d5e42e7df7a3fbbd82ae2b4293845916 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>	1 year ago
Andrew Dunham	cab2b2b59e	ipn/localapi: print envknobs on bugreport ... Previously, we only printed these at startup; print those when the user generates a bugreport as we so we don't have to go spelunking through the logs. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If5b0970f09fcb4cf8839958af5d37f84e0ba6ed2	1 year ago
David Anderson	59c254579e	version: unify and optimize the various not-version funcs ... Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Maisem Ali	0fd2f71a1e	ipn/ipnlocal: use presence of NodeID to identify logins ... The profileManager was using the LoginName as a proxy to figure out if the profile had logged in, however the LoginName is not present if the node was created with an Auth Key that does not have an associated user. Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	2a094181df	.github/workflows: use ./tool/go in go mod tidy ... Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Andrew Dunham	6d84f3409b	ipn/ipnlocal: handle more edge cases in netmap expiry timer ... We now handle the case where the NetworkMap.SelfNode has already expired and do not return an expiry time in the past (which causes an ~infinite loop of timers to fire). Additionally, we now add an explicit check to ensure that the next expiry time is never before the current local-to-the-system time, to ensure that we don't end up in a similar situation due to clock skew. Finally, we add more tests for this logic to ensure that we don't regress on these edge cases. Fixes #7193 Change-Id: Iaf8e3d83be1d133a7aab7f8d62939e508cc53f9c Signed-off-by: Andrew Dunham <andrew@du.nham.ca>	1 year ago
Tom DNetto	99b9d7a621	all: implement pcap streaming for datapath debugging ... Updates: tailscale/corp#8470 Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago