You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

James Tucker 8d1249550a net/netcheck,wgengine/magicsock: add potential workaround for Palo Alto DIPP misbehavior ... Palo Alto firewalls have a typically hard NAT, but also have a mode called Persistent DIPP that is supposed to provide consistent port mapping suitable for STUN resolution of public ports. Persistent DIPP works initially on most Palo Alto firewalls, but some models/software versions have a bug which this works around. The bug symptom presents as follows: - STUN sessions resolve a consistent public IP:port to start with - Much later netchecks report the same IP:Port for a subset of sessions, most often the users active DERP, and/or the port related to sustained traffic. - The broader set of DERPs in a full netcheck will now consistently observe a new IP:Port. - After this point of observation, new inbound connections will only succeed to the new IP:Port observed, and existing/old sessions will only work to the old binding. In this patch we now advertise the lowest latency global endpoint discovered as we always have, but in addition any global endpoints that are observed more than once in a single netcheck report. This should provide viable endpoints for potential connection establishment across a NAT with this behavior. Updates tailscale/corp#19106 Signed-off-by: James Tucker <james@tailscale.com>		2 years ago
..
addlicense	all: update tools that manage copyright headers	3 years ago
build-webclient	client/web: precompress assets	2 years ago
cloner	all: use Go 1.22 range-over-int	2 years ago
connector-gen	cmd/connector-gen: add helper tool for wide app connector configurations	2 years ago
containerboot	cmd/containerboot: warn when an ingress proxy with an IPv4 tailnet address is being created for an IPv6 backend(s) (#12159)	2 years ago
derper	derp/derphttp: fix netcheck HTTPS probes	2 years ago
derpprobe	cmd/{derper,derpprobe}: add --version flag	2 years ago
dist	release/dist/qnap: add qnap target builder	2 years ago
get-authkey	util/cmpx: delete now that we're using Go 1.22	2 years ago
gitops-pusher	cmd/gitops-pusher: only use OAuth creds if non-empty string	2 years ago
hello	cmd/hello: link to the Hello KB article (#11022)	2 years ago
k8s-nameserver	cmd/{k8s-operator,k8s-nameserver},k8s-operator: update nameserver config with records for ingress/egress proxies (#11019)	2 years ago
k8s-operator	cmd/k8s-operator,cmd/containerboot,ipn,k8s-operator: turn off stateful filter for egress proxies. (#12075)	2 years ago
mkmanifest	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS	3 years ago
mkpkg	go.mod: upgrade nfpm to v2 (#8786)	2 years ago
mkversion	version/mkversion: open-source version generation logic	3 years ago
nardump	all: update copyright and license headers	3 years ago
netlogfmt	all: use Go 1.22 range-over-int	2 years ago
nginx-auth	tailcfg,all: add and use Node.IsTagged()	3 years ago
pgproxy	tsnet: split user facing and backend logging	2 years ago
printdep	cmd/printdep: print correct toolchain URL	3 years ago
proxy-to-grafana	all: use Go 1.22 range-over-int	2 years ago
sniproxy	tsnet: split user facing and backend logging	2 years ago
speedtest	all: update copyright and license headers	3 years ago
ssh-auth-none-demo	all: replace deprecated ioutil references	2 years ago
stunc	all: update copyright and license headers	3 years ago
stund	build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 (#11410)	2 years ago
sync-containers	all: adjust some build tags for plan9	2 years ago
tailscale	net/netcheck,wgengine/magicsock: add potential workaround for Palo Alto DIPP misbehavior	2 years ago
tailscaled	xcode: allow ICMP ping relay on macOS + iOS platforms (#12048)	2 years ago
testcontrol	all: use Go 1.22 range-over-int	2 years ago
testwrapper	cmd/testwrapper: apply results of all unit tests to coverage for all packages	2 years ago
tsconnect	health, all: remove health.Global, finish plumbing health.Tracker	2 years ago
tsidp	tsnet: split user facing and backend logging	2 years ago
tsshd	all: update copyright and license headers	3 years ago
viewer	all: use Go 1.22 range-over-int	2 years ago