You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Go to file

James Tucker 8d6793fd70 wgengine/router,util/kmod: load & log xt_mark Attempt to load the xt_mark kernel module when it is not present. If the load fails, log error information. It may be tempting to promote this failure to an error once it has been in use for some time, so as to avoid reaching an error with the iptables invocation, however, there are conditions under which the two stages may disagree - this change adds more useful breadcrumbs. Example new output from tailscaled running under my WSL2: ``` router: ensure module xt_mark: "/usr/sbin/modprobe xt_mark" failed: exit status 1; modprobe: FATAL: Module xt_mark not found in directory /lib/modules/5.10.43.3-microsoft-standard-WSL2 ``` Background: There are two places to lookup modules, one is `/proc/modules` "old", the other is `/sys/module/` "new". There was query_modules(2) in linux <2.6, alas, it is gone. In a docker container in the default configuration, you would get /proc/modules and /sys/module/ both populated. lsmod may work file, modprobe will fail with EPERM at `finit_module()` for an unpriviliged container. In a priviliged container the load may succeed, if some conditions are met. This condition should be avoided, but the code landing in this change does not attempt to avoid this scenario as it is both difficult to detect, and has a very uncertain impact. In an nspawn container `/proc/modules` is populated, but `/sys/module` does not exist. Modern `lsmod` versions will fail to gather most module information, without sysfs being populated with module information. In WSL2 modules are likely missing, as the in-use kernel typically is not provided by the distribution filesystem, and WSL does not mount in a module filesystem of its own. Notably the WSL2 kernel supports iptables marks without listing the xt_mark module in /sys/module, and /proc/modules is empty. On a recent kernel, we can ask the capabilities system about SYS_MODULE, that will help to disambiguate between the non-privileged container case and just being root. On older kernels these calls may fail. Update #4329 Signed-off-by: James Tucker <james@tailscale.com>		3 years ago
.bencher	bencher: add config to suppress failures on benchmark regressions.	3 years ago
.github	Revert ".github/workflows: work around golang/go#51629"	3 years ago
atomicfile	atomicfile: don't Chmod on windows	4 years ago
chirp	all: use any instead of interface{}	3 years ago
client/tailscale	cmd/tailscale, etc: make "tailscale up --ssh" fail fast when unavailable	3 years ago
cmd	wgengine/router,util/kmod: load & log xt_mark	3 years ago
control	tailcfg, logtail: provide Debug bit to disable logtail	3 years ago
derp	derp/derphttp,net/netcheck: improve netcheck behavior under MITM proxies	3 years ago
disco	types/key: export constants for key size, not a method.	3 years ago
docs	fix minor typo	3 years ago
envknob	ipn/ipnlocal: reject tailscale up --ssh if disabled on tailnet	3 years ago
health	net/dns: add health check for particular broken-ish Linux DNS config	3 years ago
hostinfo	hostinfo, tailcfg: add desktop detection on Linux to hostinfo	3 years ago
internal/tooldeps	util/deephash: move internal/deephash to util/deephash	3 years ago
ipn	ipn/ipnlocal: close peerapi listeners on LocalBackend.Shutdown	3 years ago
kube	all: use any instead of interface{}	3 years ago
log	all: use any instead of interface{}	3 years ago
logpolicy	all: use any instead of interface{}	3 years ago
logtail	tailcfg, logtail: provide Debug bit to disable logtail	3 years ago
metrics	all: use testingutil.MinAllocsPerRun	3 years ago
net	cmd/tailscale: add "debug via" subcommand to do CIDR math for via ranges	3 years ago
packages/deb	all: use any instead of interface{}	3 years ago
paths	cmd/tailscaled: default to userspace-networking mode on gokrazy, set paths	3 years ago
portlist	envknob: add new package for all the strconv.ParseBool(os.Getenv(..))	3 years ago
prober	prober: used keyed initializer for LimitedReader.	3 years ago
safesocket	safesocket: add ConnectionStrategy, provide control over fallbacks	3 years ago
scripts	scripts/install: add Alma Linux.	3 years ago
smallzstd	smallzstd: new package that constructs zstd small encoders/decoders.	4 years ago
ssh/tailssh	ssh/tailssh: fix double SSH-2.0- prefix in greeting banner	3 years ago
syncs	syncs: use TryLock and TryRLock instead of unsafe	3 years ago
tailcfg	tailcfg: document SSHPrincipal.PubKeys URL expansions	3 years ago
tempfork	ssh/tailssh: send banner messages during auth, move more to conn	3 years ago
tool	tool/go: add wrapper to download and use go.toolchain.rev go version.	3 years ago
tsconst	net/interfaces/windows: update Tailscale interface detection logic to	3 years ago
tsnet	tsnet: set Hostinfo.Package to "tsnet" on use	3 years ago
tstest	tstest/iosdeps: add test for forbidden iOS dependencies	3 years ago
tstime	tstime/mono: fix Before function comment	3 years ago
tsweb	tsweb: add PrometheusVar, for vars that want to output varz themselves.	3 years ago
types	net/dns: schedule DoH upgrade explicitly, fix Resolver.Addr confusion	3 years ago
util	wgengine/router,util/kmod: load & log xt_mark	3 years ago
version	version: use Go 1.18's git stamping as default implementation	3 years ago
wf	all: use any instead of interface{}	3 years ago
wgengine	wgengine/router,util/kmod: load & log xt_mark	3 years ago
words	words: more hamsters, less hampsters (#3938 )	3 years ago
.gitattributes	.: add .gitattributes entry to use Go hunk-header driver	3 years ago
.gitignore	Makefile: update make spk target to use the new go spk builder	3 years ago
AUTHORS	Move Linux client & common packages into a public repo.	5 years ago
CODE_OF_CONDUCT.md	Add a code of conduct.	5 years ago
Dockerfile	Dockerfile: require Go 1.18	3 years ago
Dockerfile.base	Dockerfile.base: update to alpine:3.15	3 years ago
LICENSE	LICENSE: Reformat for Github	4 years ago
Makefile	Makefile: add tidy target	3 years ago
PATENTS	Move Linux client & common packages into a public repo.	5 years ago
README.md	README.md: update current Go release	3 years ago
SECURITY.md	Add a SECURITY.md for vulnerability reports.	5 years ago
VERSION.txt	VERSION.txt: This is 1.23.	3 years ago
api.md	api: update acl/validate data format (#4366 )	3 years ago
build_dist.sh	tool/go: add wrapper to download and use go.toolchain.rev go version.	3 years ago
build_docker.sh	tool/go: add wrapper to download and use go.toolchain.rev go version.	3 years ago
go.mod	wgengine/router,util/kmod: load & log xt_mark	3 years ago
go.sum	wgengine/router,util/kmod: load & log xt_mark	3 years ago
go.toolchain.branch	go.toolchain.branch: upgrade to Go 1.18	3 years ago
go.toolchain.rev	go.toolchain.rev: update to go1.18.1 (#4438 )	3 years ago
pull-toolchain.sh	go.toolchain.rev: add update script	3 years ago
shell.nix	shell.nix: use tailscale-go for compilation	3 years ago
staticcheck.conf	staticcheck.conf: remove unnecessary warning	3 years ago
version-embed.go	go.toolchain.rev: add Go toolchain rev, tool to print it out	3 years ago

README.md

Tailscale

https://tailscale.com

Private WireGuard® networks made easy

Overview

This repository contains all the open source Tailscale client code and the tailscaled daemon and tailscale CLI tool. The tailscaled daemon runs on Linux, Windows and macOS, and to varying degrees on FreeBSD, OpenBSD, and Darwin. (The Tailscale iOS and Android apps use this repo's code, but this repo doesn't contain the mobile GUI code.)

The Android app is at https://github.com/tailscale/tailscale-android

The Synology package is at https://github.com/tailscale/tailscale-synology

Using

We serve packages for a variety of distros at https://pkgs.tailscale.com .

Other clients

The macOS, iOS, and Windows clients use the code in this repository but additionally include small GUI wrappers that are not open source.

Building

go install tailscale.com/cmd/tailscale{,d}

If you're packaging Tailscale for distribution, use build_dist.sh instead, to burn commit IDs and version info into the binaries:

./build_dist.sh tailscale.com/cmd/tailscale
./build_dist.sh tailscale.com/cmd/tailscaled

If your distro has conventions that preclude the use of build_dist.sh, please do the equivalent of what it does in your distro's way, so that bug reports contain useful version information.

We only guarantee to support the latest Go release and any Go beta or release candidate builds (currently Go 1.18) in module mode. It might work in earlier Go versions or in GOPATH mode, but we're making no effort to keep those working.

Bugs

Please file any issues about this code or the hosted service on the issue tracker.

Contributing

PRs welcome! But please file bugs. Commit messages should reference bugs.

We require Developer Certificate of Origin Signed-off-by lines in commits.

About Us

Tailscale is primarily developed by the people at https://github.com/orgs/tailscale/people. For other contributors, see:

Legal

WireGuard is a registered trademark of Jason A. Donenfeld.