8830 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
James Tucker	4903d6c80b	wgengine/netstack: block link writes when full rather than drop ... Originally identified by Coder and documented in their blog post, this implementation differs slightly as our link endpoint was introduced for a different purpose, but the behavior is the same: apply backpressure rather than dropping packets. This reduces the negative impact of large packet count bursts substantially. An alternative would be to swell the size of the channel buffer substantially, however that's largely just moving where buffering occurs and may lead to reduced signalling back to lower layer or upstream congestion controls. Updates #9707 Updates #10408 Updates #12393 Updates tailscale/corp#24483 Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>	2025-02-06 16:17:25 -08:00
Erisa A	caafe68eb2	scripts/installer.sh: add BigLinux as a Manjaro derivative (#14936) ... Fixes #13343 Signed-off-by: Erisa A <erisa@tailscale.com>	2025-02-06 22:19:16 +00:00
Sandro Jäckel	08a96a86af	cmd/tailscale: make ssh command work when tailscaled is built with the ts_include_cli tag ... Fixes #12125 Signed-off-by: Sandro Jäckel <sandro.jaeckel@gmail.com>	2025-02-06 12:55:40 -06:00
James Tucker	83808029d8	wgengine/netstack: disable RACK on all platforms ... The gVisor RACK implementation appears to perfom badly, particularly in scenarios with higher BDP. This may have gone poorly noticed as a result of it being gated on SACK, which is not enabled by default in upstream gVisor, but itself has a higher positive impact on performance. Both the RACK and DACK implementations (which are now one) have overlapping non-completion of tasks in their work streams on the public tracker. Updates #9707 Signed-off-by: James Tucker <james@tailscale.com>	2025-02-06 10:10:44 -08:00
Erisa A	431216017b	scripts/installer.sh: add FreeBSD 14 (#14925) ... Fixes #14745 Also adds --yes to pkg to match other package managers Signed-off-by: Erisa A <erisa@tailscale.com>	2025-02-06 16:32:51 +00:00
Mike O'Driscoll	d08f830d50	cmd/derper: support no mesh key (#14931) ... Incorrect disabled support for not having a mesh key in d5316a4fbb Allow for no mesh key to be set. Fixes #14928 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>	2025-02-06 10:53:08 -05:00
Mike O'Driscoll	9a9ce12a3e	cmd/derper: close setec after use (#14929) ... Since dynamic reload of setec is not supported in derper at this time, close the server after the secret is loaded. Updates tailscale/corp#25756 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>	2025-02-06 10:52:42 -05:00
Jonathan Nobels	1bf4c6481a	safesocket: add ability for Darwin clients to set explicit credentials (#14702) ... updates tailscale/corp#25687 The darwin appstore and standalone clients now support XPC and the keychain for passing user credentials securely between the gui process and an NEVPNExtension hosted tailscaled. Clients that can communicate directly with the network extension, via XPC or the keychain, are now expected to call SetCredentials and supply credentials explicitly, fixing issues with the cli breaking if the current user cannot read the contents of /Library/Tailscale due to group membership restrictions. This matches how those clients source and supply credentials to the localAPI http client. Non-platform-specific code that has traditionally been in the client is moved to safesocket. /Libraray/Tailscaled/sameuserproof has its permissions changed to that it's readably only by users in the admin group. This restricts standalone CLI access for and direct use of localAPI to admins. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>	2025-02-06 09:51:00 -05:00
Brad Fitzpatrick	05ac21ebe4	all: use new LocalAPI client package location ... It was moved in f57fa3cbc3. Updates tailscale/corp#22748 Change-Id: I19f965e6bded1d4c919310aa5b864f2de0cd6220 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-02-05 14:41:42 -08:00
Percy Wegmann	8ecce0e98d	client: add missing localclient aliases (#14921) ... localclient_aliases.go was missing some package level functions from client/local. This adds them. Updates tailscale/corp#22748 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-02-05 16:06:20 -05:00
Percy Wegmann	f57fa3cbc3	client,localclient: move localclient.go to client/local package ... Updates tailscale/corp#22748 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-02-05 12:39:52 -06:00
Percy Wegmann	3f2bec5f64	ssh: don't use -l option for shells on OpenBSD ... Shells on OpenBSD don't support the -l option. This means that when handling SSH in-process, we can't give the user a login shell, but this change at least allows connecting at all. Updates #13338 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-02-05 12:39:03 -06:00
Nick Khyl	0e6d99cc36	docs/windows/policy: remove an extra closing > ... Something I accidentally added in #14217. It doesn't seem to impact Intune or the Administrative Templates MMC extension, but it should still be fixed. Updates #cleanup Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-05 12:14:41 -06:00
Percy Wegmann	8287842269	ssh: refactor OS names into constants ... Updates #13338 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-02-05 11:46:32 -06:00
Percy Wegmann	e4bee94857	ssh: don't use -l option for shells on FreeBSD ... Shells on FreeBSD don't support the -l option. This means that when handling SSH in-process, we can't give the user a login shell, but this change at least allows connecting at all. Updates #13338 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-02-05 11:46:32 -06:00
Mike O'Driscoll	e6e00012b2	cmd/derper: remove logging of mesh key (#14915) ... A previous PR accidentally logged the key as part of an error. Remove logging of the key. Add log print for Setec store steup. Updates tailscale/corp#25756 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>	2025-02-05 11:36:05 -05:00
Mike O'Driscoll	d5316a4fbb	cmd/derper: add setec secret support (#14890) ... Add setec secret support for derper. Support dev mode via env var, and setec via secrets URL. For backwards compatibility use setec load from file also. Updates tailscale/corp#25756 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>	2025-02-05 10:41:18 -05:00
Andrew Lytvynov	e19c01f5b3	clientupdate: refuse to update in tsnet binaries (#14911) ... When running via tsnet, c2n will be hooked up so requests to update can reach the node. But it will then apply whatever OS-specific update function, upgrading the local tailscaled instead. We can't update tsnet automatically, so refuse it. Fixes #14892 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	2025-02-04 15:51:03 -08:00
Nick Khyl	9726e1f208	ipn/{ipnserver,localapi},tsnet: use ipnauth.Self as the actor in tsnet localapi handlers ... With #14843 merged, (*localapi.Handler).servePrefs() now requires a non-nil actor, and other places may soon require it as well. In this PR, we update localapi.NewHandler with a new required parameter for the actor. We then update tsnet to use ipnauth.Self. We also rearrange the code in (*ipnserver.Server).serveHTTP() to pass the actor via Handler's constructor instead of the field. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-04 16:37:30 -06:00
Joe Tsai	0b7087c401	logpolicy: expose MaxBufferSize and MaxUploadSize options (#14903) ... Updates tailscale/corp#26342 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2025-02-04 12:51:27 -08:00
Nick Khyl	00fe8845b1	ipn/{ipnauth,ipnlocal,ipnserver}: move the AlwaysOn policy check from ipnserver to ipnauth ... In this PR, we move the code that checks the AlwaysOn policy from ipnserver.actor to ipnauth. It is intended to be used by ipnauth.Actor implementations, and we temporarily make it exported while these implementations reside in ipnserver and in corp. We'll unexport it later. We also update [ipnauth.Actor.CheckProfileAccess] to accept an auditLogger, which is called to write details about the action to the audit log when required by the policy, and update LocalBackend.EditPrefsAs to use an auditLogger that writes to the regular backend log. Updates tailscale/corp#26146 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-04 14:36:01 -06:00
Irbe Krumina	5ef934b62d	cmd/k8s-operator: reinstate HA Ingress reconciler (#14887) ... This change: - reinstates the HA Ingress controller that was disabled for 1.80 release - fixes the API calls to manage VIPServices as the API was changed - triggers the HA Ingress reconciler on ProxyGroup changes Updates tailscale/tailscale#24795 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2025-02-04 13:09:43 +00:00
Jordan Whited	cfe578870d	derp: tcp-write-timeout=0 should disable write deadline (#14895) ... Updates tailscale/corp#26316 Signed-off-by: Jordan Whited <jordan@tailscale.com>	2025-02-03 15:14:16 -08:00
James Tucker	80a100b3cb	net/netmon: add extra panic guard around ParseRIB ... We once again have a report of a panic from ParseRIB. This panic guard should probably remain permanent. Updates #14201 This reverts commit de9d4b2f88. Signed-off-by: James Tucker <james@tailscale.com>	2025-02-03 12:35:35 -08:00
Adrian Dewhurst	97c4c0ecf0	ipn/ipnlocal: add VIP service IPs to localnets ... Without adding this, the packet filter rejects traffic to VIP service addresses before checking the filters sent in the netmap. Fixes tailscale/corp#26241 Change-Id: Idd54448048e9b786cf4873fd33b3b21e03d3ad4c Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2025-02-03 15:34:19 -05:00
Adrian Dewhurst	600f25dac9	tailcfg: add JSON unmarshal helper for view of node/peer capabilities ... Many places that need to work with node/peer capabilities end up with a something-View and need to either reimplement the helper code or make an expensive copy. We have the machinery to easily handle this now. Updates #cleanup Change-Id: Ic3f55be329f0fc6c178de26b34359d0e8c6ca5fc Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2025-02-03 14:49:11 -05:00
Brad Fitzpatrick	95e2353294	wgengine/wgcfg/nmcfg: coalesce, limit some debug logs ... Updates #14881 Change-Id: I708d29244fe901ab037203a5d7c2cae3c77e4c78 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-02-03 10:36:36 -08:00
James Tucker	10fe10ea10	derp/derphttp,ipn/localapi,net/captivedetection: add cache resistance to captive portal detection ... Observed on some airlines (British Airways, WestJet), Squid is configured to cache and transform these results, which is disruptive. The server and client should both actively request that this is not done by setting Cache-Control headers. Send a timestamp parameter to further work against caches that do not respect the cache-control headers. Updates #14856 Signed-off-by: James Tucker <james@tailscale.com>	2025-02-03 10:15:26 -08:00
Nick Khyl	17ca2b7721	cmd/tailscale/cli: update tailscale down to accept an optional --reason ... If specified, the reason is sent via the LocalAPI for auditing purposes. Updates tailscale/corp#26146 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-03 11:07:55 -06:00
Brad Fitzpatrick	496347c724	go.mod: bump inetaf/tcpproxy ... To fix a logging crash. Updates tailscale/corp#20503 Change-Id: I1beafe34afeb577aaaf6800a408faf6454b16912 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-02-03 09:06:30 -08:00
Nick Khyl	d832467461	client/tailscale,ipn/ipn{local,server},util/syspolicy: implement the AlwaysOn.OverrideWithReason policy setting ... In this PR, we update client/tailscale.LocalClient to allow sending requests with an optional X-Tailscale-Reason header. We then update ipn/ipnserver.{actor,Server} to retrieve this reason, if specified, and use it to determine whether ipnauth.Disconnect is allowed when the AlwaysOn.OverrideWithReason policy setting is enabled. For now, we log the reason, along with the profile and OS username, to the backend log. Finally, we update LocalBackend to remember when a disconnect was permitted and do not reconnect automatically unless the policy changes. Updates tailscale/corp#26146 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-01 13:34:45 -06:00
Nick Khyl	2c02f712d1	util/syspolicy/internal/metrics: replace dots with underscores for metric names ... Dots are not allowed in metric names and cause panics. Since we use dots in names like AlwaysOn.OverrideWithReason, let's replace them with underscores. We don’t want to use setting.KeyPathSeparator here just yet to make it fully hierarchical, but we will decide as we progress on the (experimental) AlwaysOn.* policy settings. tailscale/corp#26146 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-01 13:10:42 -06:00
Nick Khyl	a0537dc027	ipn/ipnlocal: fix a panic in setPrefsLockedOnEntry when cc is nil ... The AlwaysOn policy can be applied by (*LocalBackend).applySysPolicy, flipping WantRunning from false to true before (*LocalBackend).Start() has been called for the first time and set a control client in b.cc. This results in a nil pointer dereference and a panic when setPrefsLockedOnEntry applies the change and calls controlclient.Client.Login(). In this PR, we fix it by only doing a login if b.cc has been set. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-31 18:41:02 -06:00
Percy Wegmann	2e95313b8b	ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh ... The upstream crypto package now supports sending banners at any time during authentication, so the Tailscale fork of crypto/ssh is no longer necessary. github.com/tailscale/golang-x-crypto is still needed for some custom ACME autocert functionality. tempfork/gliderlabs is still necessary because of a few other customizations, mostly related to TTY handling. Originally implemented in 46fd4e58a2, which was reverted in b60f6b849a to keep the change out of v1.80. Updates #8593 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-01-31 16:36:39 -06:00
Nick Khyl	0a51bbc765	ipn/ipnauth,util/syspolicy: improve comments ... Updates #cleanup Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-31 11:33:13 -06:00
Nick Khyl	02ad21717f	ipn/ipn{auth,server,local}: initial support for the always-on mode ... In this PR, we update LocalBackend to set WantRunning=true when applying policy settings to the current profile's prefs, if the "always-on" mode is enabled. We also implement a new (*LocalBackend).EditPrefsAs() method, which is like EditPrefs but accepts an actor (e.g., a LocalAPI client's identity) that initiated the change. If WantRunning is being set to false, the new EditPrefsAs method checks whether the actor has ipnauth.Disconnect access to the profile and propagates an error if they do not. Finally, we update (*ipnserver.actor).CheckProfileAccess to allow a disconnect only if the "always-on" mode is not enabled by the AlwaysOn policy setting. This is not a comprehensive solution to the "always-on" mode across platforms, as instead of disconnecting a user could achieve the same effect by creating a new empty profile, initiating a reauth, or by deleting the profile. These are the things we should address in future PRs. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-31 10:22:20 -06:00
Nick Khyl	535a3dbebd	ipn/ipnauth: implement an Actor representing tailscaled itself ... Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-31 10:22:20 -06:00
Nick Khyl	081595de63	ipn/{ipnauth, ipnserver}: extend the ipnauth.Actor interface with a CheckProfileAccess method ... The implementations define it to verify whether the actor has the requested access to a login profile. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-31 10:22:20 -06:00
Nick Khyl	4e7f4086b2	ipn: generate LoginProfileView and use it instead of *LoginProfile where appropriate ... Conventionally, we use views (e.g., ipn.PrefsView, tailcfg.NodeView, etc.) when dealing with structs that shouldn't be mutated. However, ipn.LoginProfile has been an exception so far, with a mix of passing and returning LoginProfile by reference (allowing accidental mutations) and by value (which is wasteful, given its current size of 192 bytes). In this PR, we generate an ipn.LoginProfileView and use it instead of passing/returning LoginProfiles by mutable reference or copying them when passing/returning by value. Now, LoginProfiles can only be mutated by (*profileManager).setProfilePrefs. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-30 18:12:54 -06:00
Brad Fitzpatrick	7d5fe13d27	types/views: make SliceEqualAnyOrder also do short slice optimization ... SliceEqualAnyOrderFunc had an optimization missing from SliceEqualAnyOrder. Now they share the same code and both have the optimization. Updates #14593 Change-Id: I550726e0964fc4006e77bb44addc67be989c131c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-30 22:29:35 +00:00
Andrea Gottardo	8ee72cd33c	cli/funnel: fix comment typo (#14840) ... Updates #cleanup Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	2025-01-30 14:21:32 -08:00
Andrea Gottardo	08dd4994d0	VERSION.txt: this is v1.81.0 (#14838) ... Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	2025-01-30 13:04:29 -08:00
Tom Proctor	138a83efe1	cmd/containerboot: wait for consistent state on shutdown (#14263) ... tailscaled's ipn package writes a collection of keys to state after authenticating to control, but one at a time. If containerboot happens to send a SIGTERM signal to tailscaled in the middle of writing those keys, it may shut down with an inconsistent state Secret and never recover. While we can't durably fix this with our current single-use auth keys (no atomic operation to auth + write state), we can reduce the window for this race condition by checking for partial state before sending SIGTERM to tailscaled. Best effort only. Updates #14080 Change-Id: I0532d51b6f0b7d391e538468bd6a0a80dbe1d9f7 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	2025-01-30 13:51:10 +00:00
Anton Tolchanov	c2af1cd9e3	prober: support multiple probes running concurrently ... Some probes might need to run for longer than their scheduling interval, so this change relaxes the 1-at-a-time restriction, allowing us to configure probe concurrency and timeout separately. The default values remain the same (concurrency of 1; timeout of 80% of interval). Updates tailscale/corp#25479 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2025-01-30 12:22:23 +00:00
Irbe Krumina	a49af98b31	cmd/k8s-operator: temporarily disable HA Ingress controller (#14833) ... The HA Ingress functionality is not actually doing anything valuable yet, so don't run the controller in 1.80 release yet. Updates tailscale/tailscale#24795 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2025-01-30 11:36:33 +00:00
Brad Fitzpatrick	0ed4aa028f	control/controlclient: flesh out a recently added comment ... Updates tailscale/corp#26058 Change-Id: Ib46161fbb2e79c080f886083665961f02cbf5949	2025-01-30 08:48:52 +00:00
Brad Fitzpatrick	ed8bb3b564	control/controlclient: add missing word in comment ... Found by review.ai. Updates #cleanup Change-Id: Ib9126de7327527b8b3818d92cc774bb1c7b6f974 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-30 08:48:52 +00:00
Irbe Krumina	3f39211f98	cmd/k8s-operator: check that cluster traffic is routed to egress ProxyGroup Pod before marking it as ready (#14792) ... This change builds on top of #14436 to ensure minimum downtime during egress ProxyGroup update rollouts: - adds a readiness gate for ProxyGroup replicas that prevents kubelet from marking the replica Pod as ready before a corresponding readiness condition has been added to the Pod - adds a reconciler that reconciles egress ProxyGroup Pods and, for each that is not ready, if cluster traffic for relevant egress endpoints is routed via this Pod- if so add the readiness condition to allow kubelet to mark the Pod as ready. During the sequenced StatefulSet update rollouts kubelet does not restart a Pod before the previous replica has been updated and marked as ready, so ensuring that a replica is not marked as ready allows to avoid a temporary post-update situation where all replicas have been restarted, but none of the new ones are yet set up as an endpoint for the egress service, so cluster traffic is dropped. Updates tailscale/tailscale#14326 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2025-01-30 08:47:45 +00:00
Brad Fitzpatrick	8bd04bdd3a	go.mod: bump gorilla/csrf for security fix (#14822) ... For 9dd6af1f6d Update client/web and safeweb to correctly signal to the csrf middleware whether the request is being served over TLS. This determines whether Origin and Referer header checks are strictly enforced. The gorilla library previously did not enforce these checks due to a logic bug based on erroneous use of the net/http.Request API. The patch to fix this also inverts the library behavior to presume that every request is being served over TLS, necessitating these changes. Updates tailscale/corp#25340 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com> Co-authored-by: Patrick O'Doherty <patrick@tailscale.com>	2025-01-29 12:44:01 -08:00
Percy Wegmann	b60f6b849a	Revert "ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh" ... This reverts commit 46fd4e58a2. We don't want to include this in 1.80 yet, but can add it back post 1.80. Updates #8593 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-01-29 10:47:45 -06:00