6794 Commits (fb829ea7f1126da933d85d846eed80e659d07a64)

 

All Branches   

Search

Author	SHA1	Message	Date
Brad Fitzpatrick	fb829ea7f1	control/controlclient: support incremental packet filter updates [capver 81] ... Updates #10299 Change-Id: I87e4235c668a1db7de7ef1abc743f0beecb86d3d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Claire Wang	b8a2aedccd	util/syspolicy: add caching handler (#10288) ... Fixes tailscale/corp#15850 Co-authored-by: Adrian Dewhurst <adrian@tailscale.com> Signed-off-by: Claire Wang <claire@tailscale.com>	7 months ago
Ox Cart	719ee4415e	ssh/tailssh: use control server time instead of local time ... This takes advantage of existing functionality in ipn/ipnlocal to adjust the local clock based on periodic time signals from the control server. This way, when checking things like SSHRule expirations, calculations are protected incorrectly set local clocks. Fixes tailscale/corp#15796 Signed-off-by: Percy Wegmann <percy@tailscale.com>	7 months ago
Sonia Appasamy	bd534b971a	{client/web},{ipn/ipnlocal}: replace localapi debug-web-client endpoint ... This change removes the existing debug-web-client localapi endpoint and replaces it with functions passed directly to the web.ServerOpts when constructing a web.ManageServerMode client. The debug-web-client endpoint previously handled making noise requests to the control server via the /machine/webclient/ endpoints. The noise requests must be made from tailscaled, which has the noise connection open. But, now that the full client is served from tailscaled, we no longer need to proxy this request over the localapi. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	7 months ago
Brad Fitzpatrick	4d196c12d9	health: don't report a warning in DERP homeless mode ... Updates #3363 Updates tailscale/corp#396 Change-Id: Ibfb0496821cb58a78399feb88d4206d81e95ca0f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Brad Fitzpatrick	cca27ef96a	ipn/ipnlocal: add c2n method to check on TLS cert fetch status ... So the control plane can delete TXT records more aggressively after client's done with ACME fetch. Updates tailscale/corp#15848 Change-Id: I4f1140305bee11ee3eee93d4fec3aef2bd6c5a7e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Irbe Krumina	664ebb14d9	cmd/containerboot: fix unclean shutdown (#10035) ... * cmd/containerboot: shut down cleanly on SIGTERM Make sure that tailscaled watcher returns when SIGTERM is received and also that it shuts down before tailscaled exits. Updates tailscale/tailscale#10090 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	7 months ago
Sonia Appasamy	7238586652	client/web: fix margins on login popover ... Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	7 months ago
Will Norris	5aa22ff3eb	tsnet: add option to run integrated web client ... Updates #10261 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Tyler Smalley	90eb5379f4	ipn/ipnlocal: log and don't return full file serve error (#10174) ... Previously we would return the full error from Stat or Open, possibily exposing the full file path. This change will log the error and return the generic error message "an error occurred reading the file or directory". Updates tailscale/corp#15485 Signed-off-by: Tyler Smalley <tyler@tailscale.com>	7 months ago
Sonia Appasamy	4f409012c5	client/web: when readonly, add check for TS connection ... When the viewing user is accessing a webclient not over Tailscale, they must connect over Tailscale before being able to log into the full management client, which is served over TS. This change adds a check that the user is able to access the node's tailscale IP. If not able to, the signin button is disabled. We'll also be adding Copy here to help explain to the user that they must connect to Tailscale before proceeding. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	7 months ago
Will Norris	33147c4591	.github: build gocross using regular GOPROXY settings ... This `go get` action has been running very slowly, and I'm pretty sure it's because we're building gocross on the first `./tool/go` run, and because we've set `GOPROXY=direct`, it's going directly to GitHub to fetch all of the gocross dependencies. Updates #cleanup Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Flakes Updater	a3c11b87c6	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	7 months ago
OSS Updater	146c4bacde	go.mod: update web-client-prebuilt module ... Signed-off-by: OSS Updater <noreply+oss-updater@tailscale.com>	7 months ago
Will Norris	d01fa857b1	client/web: allow login client to still run tailscale up ... I don't believe this has ever worked, since we didn't allow POST requests in the login client. But previously, we were primarily using the legacy client, so it didn't really matter. Now that we've removed the legacy client, we have no way to login. This fixes the login client, allowing it to login, but it still needs to be refactored to expose a dedicated login method, without exposing all the node update functionality. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Brad Fitzpatrick	3bd382f369	wgengine/magicsock: add DERP homeless debug mode for testing ... In DERP homeless mode, a DERP home connection is not sought or maintained and the local node is not reachable. Updates #3363 Updates tailscale/corp#396 Change-Id: Ibc30488ac2e3cfe4810733b96c2c9f10a51b8331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Jordan Whited	2ff54f9d12	wgengine/magicsock: move trustBestAddrUntil forward on non-disco rx (#10274) ... This is gated behind the silent disco control knob, which is still in its infancy. Prior to this change disco pong reception was the only event that could move trustBestAddrUntil forward, so even though we weren't heartbeating, we would kick off discovery pings every trustUDPAddrDuration and mirror to DERP. Updates #540 Signed-off-by: Jordan Whited <jordan@tailscale.com>	7 months ago
Maisem Ali	57129205e6	cmd/tailscaled: make tun mode default on gokrazy ... Now that we have nftable support this works fine and force it on gokrazy since 25a8daf405. Updates gokrazy/gokrazy#209 Signed-off-by: Maisem Ali <maisem@tailscale.com>	7 months ago
Sonia Appasamy	96ad9b6138	client/web: remove legacy-client-view.tsx ... Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	7 months ago
Sonia Appasamy	055394f3be	ipn/ipnlocal: add mutex to webClient struct ... Adds a new sync.Mutex field to the webClient struct, rather than using the general LocalBackend mutex. Since webClientGetOrInit (previously WebClientInit) gets called on every connection, we want to avoid holding the lock on LocalBackend just to check if the server is initialized. Moves all web_client.go funcs over to using the webClient.mu field. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	7 months ago
Maisem Ali	7d4221c295	cmd/tsidp: add start of OIDC Tailscale IdP ... Updates #10263 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I240bc9b5ecf2df6f92c45929d105fde66c06a860 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	7 months ago
Sonia Appasamy	2dbd546766	client/web: remove DebugMode from GET /api/data ... No longer using this! Readonly state fully managed via auth endpoint. Also getting rid of old Legacy server mode. A #cleanup Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	7 months ago
Sonia Appasamy	6f7a1b51a8	ipn/ipnlocal: rename SetWebLocalClient to ConfigureWebClient ... For consistency with the "WebClient" naming of the other functions here. Also fixed a doc typo. A #cleanup Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	7 months ago
Naman Sood	d5c460e83c	client/{tailscale,web}: add initial webUI frontend for self-updates (#10191) ... Updates #10187. Signed-off-by: Naman Sood <mail@nsood.in>	7 months ago
James Tucker	245ddb157b	appc: fix DomainRoutes copy ... The non-referential copy destination doesn't extend the map contents, but also the read of a non-key is returning a zero value not bound to the map contents in any way. Updates tailscale/corp#15657 Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
Adrian Dewhurst	b8ac3c5191	util/syspolicy: add some additional policy keys ... These policy keys are supported on Apple platforms in Swift code; in order to support them on platforms using Go (e.g. Windows), they also need to be recorded here. This does not affect any code, it simply adds the constants for now. Updates ENG-2240 Updates ENG-2127 Updates ENG-2133 Change-Id: I0aa9863a3641e5844479da3b162761452db1ef42 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	7 months ago
Adrian Dewhurst	1ef5bd5381	util/osdiag, util/winutil: expose Windows policy key ... The Windows base registry key is already exported but the policy key was not. util/osdiag currently replicates the string rather than the preferred approach of reusing the constant. Updates #cleanup Change-Id: I6c1c45337896c744059b85643da2364fb3f232f2 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	7 months ago
Aaron Klotz	855f79fad7	cmd/tailscaled, util/winutil: changes to process and token APIs in winutil ... This PR changes the internal getTokenInfo function to use generics. I also removed our own implementations for obtaining a token's user and primary group in favour of calling the ones now available in x/sys/windows. Furthermore, I added two new functions for working with tokens, logon session IDs, and Terminal Services / RDP session IDs. I modified our privilege enabling code to allow enabling of multiple privileges via one single function call. Finally, I added the ProcessImageName function and updated the code in tailscaled_windows.go to use that instead of directly calling the underlying API. All of these changes will be utilized by subsequent PRs pertaining to this issue. Updates https://github.com/tailscale/corp/issues/13998 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	7 months ago
Will Norris	03e780e9af	client/web: disable the "disable" button when disabled ... We currently disable the exit-node drop down selector when the user is in read-only mode, but we missed disabling the "Disable" button also. Previously, it would display an error when clicked. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Will Norris	9b537f7c97	ipn: remove the preview-webclient node capability ... Now that 1.54 has released, and the new web client will be included in 1.56, we can remove the need for the node capability. This means that all 1.55 unstable builds, and then eventually the 1.56 build, will work without setting the node capability. The web client still requires the "webclient" user pref, so this does NOT mean that the web client will be on by default for all devices. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Will Norris	303a1e86f5	cmd/tailscale: expose --webclient for all builds ... This removes the dev/unstable build check for the --webclient flag on `tailscale set`, so that it will be included in the next major stable release (1.56) Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Andrew Dunham	e33bc64cff	net/dnsfallback: add singleflight to recursive resolver ... This prevents running more than one recursive resolution for the same hostname in parallel, which can use excessive amounts of CPU when called in a tight loop. Additionally, add tests that hit the network (when run with a flag) to test the lookup behaviour. Updates tailscale/corp#15261 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I39351e1d2a8782dd4c52cb04b3bd982eb651c81e	7 months ago
Denton Gentry	a40e918d63	VERSION.txt: this is v1.55.0 ... Signed-off-by: Denton Gentry <dgentry@tailscale.com>	7 months ago
James Tucker	e866ee9268	types/appctype: correct app-connector cap name in documentation ... Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	7 months ago
Sonia Appasamy	bb31912ea5	cmd/cli: remove --webclient flag from up ... Causing issues building a stable release. Getting rid of the flag for now because it was only available in unstable, can still be turned on through localapi. A #cleanup Co-authored-by: Will Norris <will@tailscale.com> Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	7 months ago
Will Norris	1cb8d2ffdd	ipn/ipnlocal: only call serve handler if non-nil ... return early if handler is nil. Go ahead and return the error from handler, though in this case the caller isn't doing anything with it (which has always been the case). Updates #10177 Updates #10251 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Andrea Barisani	05d4210dbe	adjust build tags for tamago ... Signed-off-by: Andrea Barisani <andrea@inversepath.com>	7 months ago
Will Norris	b7918341f9	ipn/ipnlocal: call serve handler for local traffic ... Tailscale serve maintains a set of listeners so that serve traffic from the local device can be properly served when running in kernel networking mode. #10177 refactored that logic so that it could be reused by the internal web client as well. However, in my refactoring I missed actually calling the serve handler to handle the traffic. Updates #10177 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Flakes Updater	e3dacb3e5e	go.mod.sri: update SRI hash for go.mod changes ... Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	7 months ago
Andrew Lytvynov	c3f1bd4c0a	clientupdate: fix auto-update on Windows over RDP (#10242) ... `winutil.WTSGetActiveConsoleSessionId` only works for physical desktop logins and does not return the session ID for RDP logins. We need to `windows.WTSEnumerateSessions` and find the active session. Fixes https://github.com/tailscale/corp/issues/15772 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	7 months ago
Will Norris	60957e1077	client/web: fix back button on devices with URL prefix ... Move Header component inside Router so that links are relative to the router base URL. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Will Norris	fb984c2b71	client/web: server /index.html on 404 requests ... In production, the asset handler is receiving requests for pages like /details, which results in a 404. Instead, if we know the requested file does not exist, serve the main index page and let wouter route it appropriately on the frontend. Updates tailscale/corp/#14335 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Will Norris	74947ce459	client/web: only trigger check mode if not authed ... After logging in, the `?check=now` query string is still present if it was passed. Reloading the page causes a new check mode to be triggered, even though the user has an active session. Only trigger the automatic check mode if the user is not already able to manage the device. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Will Norris	79719f05a9	ipn/ipnlocal: remove web client listeners after close ... This prevents a panic in some cases where WebClientShutdown is called multiple times. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Sonia Appasamy	7c99a1763b	client/web: fix panic on logout ... Fix panic due to `CurrentTailnet` being nil. Fixes tailscale/corp#15791 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	7 months ago
OSS Updater	063657c65f	go.mod: update web-client-prebuilt module ... Signed-off-by: OSS Updater <noreply+oss-updater@tailscale.com>	7 months ago
Will Norris	7399e56acd	.github: add action for updating web-client-prebuilt module ... Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	7 months ago
Andrew Lytvynov	955e2fcbfb	ipn/ipnlocal: run "tailscale update" via systemd-run on Linux (#10229) ... When we run tailscled under systemd, restarting the unit kills all child processes, including "tailscale update". And during update, the package manager will restart the tailscaled unit. Specifically on Debian-based distros, interrupting `apt-get install` can get the system into a wedged state which requires the user to manually run `dpkg --configure` to recover. To avoid all this, use `systemd-run` where available to run the `tailscale update` process. This launches it in a separate temporary unit and doesn't kill it when parent unit is restarted. Also, detect when `apt-get install` complains about aborted update and try to restore the system by running `dpkg --configure tailscale`. This could help if the system unexpectedly shuts down during our auto-update. Fixes https://github.com/tailscale/corp/issues/15771 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	7 months ago
Jordan Whited	c99488ea19	wgengine/magicsock: fix typo in endpoint.sendDiscoPing() docs (#10232) ... Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>	7 months ago
Tom DNetto	90a0aafdca	cmd/tailscale: warn if app-connector is enabled without ip forwarding ... Fixes: ENG-2446 Signed-off-by: Tom DNetto <tom@tailscale.com>	7 months ago