8822 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Brad Fitzpatrick	05ac21ebe4	all: use new LocalAPI client package location ... It was moved in f57fa3cbc3. Updates tailscale/corp#22748 Change-Id: I19f965e6bded1d4c919310aa5b864f2de0cd6220 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-02-05 14:41:42 -08:00
Percy Wegmann	8ecce0e98d	client: add missing localclient aliases (#14921) ... localclient_aliases.go was missing some package level functions from client/local. This adds them. Updates tailscale/corp#22748 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-02-05 16:06:20 -05:00
Percy Wegmann	f57fa3cbc3	client,localclient: move localclient.go to client/local package ... Updates tailscale/corp#22748 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-02-05 12:39:52 -06:00
Percy Wegmann	3f2bec5f64	ssh: don't use -l option for shells on OpenBSD ... Shells on OpenBSD don't support the -l option. This means that when handling SSH in-process, we can't give the user a login shell, but this change at least allows connecting at all. Updates #13338 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-02-05 12:39:03 -06:00
Nick Khyl	0e6d99cc36	docs/windows/policy: remove an extra closing > ... Something I accidentally added in #14217. It doesn't seem to impact Intune or the Administrative Templates MMC extension, but it should still be fixed. Updates #cleanup Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-05 12:14:41 -06:00
Percy Wegmann	8287842269	ssh: refactor OS names into constants ... Updates #13338 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-02-05 11:46:32 -06:00
Percy Wegmann	e4bee94857	ssh: don't use -l option for shells on FreeBSD ... Shells on FreeBSD don't support the -l option. This means that when handling SSH in-process, we can't give the user a login shell, but this change at least allows connecting at all. Updates #13338 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-02-05 11:46:32 -06:00
Mike O'Driscoll	e6e00012b2	cmd/derper: remove logging of mesh key (#14915) ... A previous PR accidentally logged the key as part of an error. Remove logging of the key. Add log print for Setec store steup. Updates tailscale/corp#25756 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>	2025-02-05 11:36:05 -05:00
Mike O'Driscoll	d5316a4fbb	cmd/derper: add setec secret support (#14890) ... Add setec secret support for derper. Support dev mode via env var, and setec via secrets URL. For backwards compatibility use setec load from file also. Updates tailscale/corp#25756 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>	2025-02-05 10:41:18 -05:00
Andrew Lytvynov	e19c01f5b3	clientupdate: refuse to update in tsnet binaries (#14911) ... When running via tsnet, c2n will be hooked up so requests to update can reach the node. But it will then apply whatever OS-specific update function, upgrading the local tailscaled instead. We can't update tsnet automatically, so refuse it. Fixes #14892 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	2025-02-04 15:51:03 -08:00
Nick Khyl	9726e1f208	ipn/{ipnserver,localapi},tsnet: use ipnauth.Self as the actor in tsnet localapi handlers ... With #14843 merged, (*localapi.Handler).servePrefs() now requires a non-nil actor, and other places may soon require it as well. In this PR, we update localapi.NewHandler with a new required parameter for the actor. We then update tsnet to use ipnauth.Self. We also rearrange the code in (*ipnserver.Server).serveHTTP() to pass the actor via Handler's constructor instead of the field. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-04 16:37:30 -06:00
Joe Tsai	0b7087c401	logpolicy: expose MaxBufferSize and MaxUploadSize options (#14903) ... Updates tailscale/corp#26342 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	2025-02-04 12:51:27 -08:00
Nick Khyl	00fe8845b1	ipn/{ipnauth,ipnlocal,ipnserver}: move the AlwaysOn policy check from ipnserver to ipnauth ... In this PR, we move the code that checks the AlwaysOn policy from ipnserver.actor to ipnauth. It is intended to be used by ipnauth.Actor implementations, and we temporarily make it exported while these implementations reside in ipnserver and in corp. We'll unexport it later. We also update [ipnauth.Actor.CheckProfileAccess] to accept an auditLogger, which is called to write details about the action to the audit log when required by the policy, and update LocalBackend.EditPrefsAs to use an auditLogger that writes to the regular backend log. Updates tailscale/corp#26146 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-04 14:36:01 -06:00
Irbe Krumina	5ef934b62d	cmd/k8s-operator: reinstate HA Ingress reconciler (#14887) ... This change: - reinstates the HA Ingress controller that was disabled for 1.80 release - fixes the API calls to manage VIPServices as the API was changed - triggers the HA Ingress reconciler on ProxyGroup changes Updates tailscale/tailscale#24795 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2025-02-04 13:09:43 +00:00
Jordan Whited	cfe578870d	derp: tcp-write-timeout=0 should disable write deadline (#14895) ... Updates tailscale/corp#26316 Signed-off-by: Jordan Whited <jordan@tailscale.com>	2025-02-03 15:14:16 -08:00
James Tucker	80a100b3cb	net/netmon: add extra panic guard around ParseRIB ... We once again have a report of a panic from ParseRIB. This panic guard should probably remain permanent. Updates #14201 This reverts commit de9d4b2f88. Signed-off-by: James Tucker <james@tailscale.com>	2025-02-03 12:35:35 -08:00
Adrian Dewhurst	97c4c0ecf0	ipn/ipnlocal: add VIP service IPs to localnets ... Without adding this, the packet filter rejects traffic to VIP service addresses before checking the filters sent in the netmap. Fixes tailscale/corp#26241 Change-Id: Idd54448048e9b786cf4873fd33b3b21e03d3ad4c Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2025-02-03 15:34:19 -05:00
Adrian Dewhurst	600f25dac9	tailcfg: add JSON unmarshal helper for view of node/peer capabilities ... Many places that need to work with node/peer capabilities end up with a something-View and need to either reimplement the helper code or make an expensive copy. We have the machinery to easily handle this now. Updates #cleanup Change-Id: Ic3f55be329f0fc6c178de26b34359d0e8c6ca5fc Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2025-02-03 14:49:11 -05:00
Brad Fitzpatrick	95e2353294	wgengine/wgcfg/nmcfg: coalesce, limit some debug logs ... Updates #14881 Change-Id: I708d29244fe901ab037203a5d7c2cae3c77e4c78 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-02-03 10:36:36 -08:00
James Tucker	10fe10ea10	derp/derphttp,ipn/localapi,net/captivedetection: add cache resistance to captive portal detection ... Observed on some airlines (British Airways, WestJet), Squid is configured to cache and transform these results, which is disruptive. The server and client should both actively request that this is not done by setting Cache-Control headers. Send a timestamp parameter to further work against caches that do not respect the cache-control headers. Updates #14856 Signed-off-by: James Tucker <james@tailscale.com>	2025-02-03 10:15:26 -08:00
Nick Khyl	17ca2b7721	cmd/tailscale/cli: update tailscale down to accept an optional --reason ... If specified, the reason is sent via the LocalAPI for auditing purposes. Updates tailscale/corp#26146 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-03 11:07:55 -06:00
Brad Fitzpatrick	496347c724	go.mod: bump inetaf/tcpproxy ... To fix a logging crash. Updates tailscale/corp#20503 Change-Id: I1beafe34afeb577aaaf6800a408faf6454b16912 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-02-03 09:06:30 -08:00
Nick Khyl	d832467461	client/tailscale,ipn/ipn{local,server},util/syspolicy: implement the AlwaysOn.OverrideWithReason policy setting ... In this PR, we update client/tailscale.LocalClient to allow sending requests with an optional X-Tailscale-Reason header. We then update ipn/ipnserver.{actor,Server} to retrieve this reason, if specified, and use it to determine whether ipnauth.Disconnect is allowed when the AlwaysOn.OverrideWithReason policy setting is enabled. For now, we log the reason, along with the profile and OS username, to the backend log. Finally, we update LocalBackend to remember when a disconnect was permitted and do not reconnect automatically unless the policy changes. Updates tailscale/corp#26146 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-01 13:34:45 -06:00
Nick Khyl	2c02f712d1	util/syspolicy/internal/metrics: replace dots with underscores for metric names ... Dots are not allowed in metric names and cause panics. Since we use dots in names like AlwaysOn.OverrideWithReason, let's replace them with underscores. We don’t want to use setting.KeyPathSeparator here just yet to make it fully hierarchical, but we will decide as we progress on the (experimental) AlwaysOn.* policy settings. tailscale/corp#26146 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-02-01 13:10:42 -06:00
Nick Khyl	a0537dc027	ipn/ipnlocal: fix a panic in setPrefsLockedOnEntry when cc is nil ... The AlwaysOn policy can be applied by (*LocalBackend).applySysPolicy, flipping WantRunning from false to true before (*LocalBackend).Start() has been called for the first time and set a control client in b.cc. This results in a nil pointer dereference and a panic when setPrefsLockedOnEntry applies the change and calls controlclient.Client.Login(). In this PR, we fix it by only doing a login if b.cc has been set. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-31 18:41:02 -06:00
Percy Wegmann	2e95313b8b	ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh ... The upstream crypto package now supports sending banners at any time during authentication, so the Tailscale fork of crypto/ssh is no longer necessary. github.com/tailscale/golang-x-crypto is still needed for some custom ACME autocert functionality. tempfork/gliderlabs is still necessary because of a few other customizations, mostly related to TTY handling. Originally implemented in 46fd4e58a2, which was reverted in b60f6b849a to keep the change out of v1.80. Updates #8593 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-01-31 16:36:39 -06:00
Nick Khyl	0a51bbc765	ipn/ipnauth,util/syspolicy: improve comments ... Updates #cleanup Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-31 11:33:13 -06:00
Nick Khyl	02ad21717f	ipn/ipn{auth,server,local}: initial support for the always-on mode ... In this PR, we update LocalBackend to set WantRunning=true when applying policy settings to the current profile's prefs, if the "always-on" mode is enabled. We also implement a new (*LocalBackend).EditPrefsAs() method, which is like EditPrefs but accepts an actor (e.g., a LocalAPI client's identity) that initiated the change. If WantRunning is being set to false, the new EditPrefsAs method checks whether the actor has ipnauth.Disconnect access to the profile and propagates an error if they do not. Finally, we update (*ipnserver.actor).CheckProfileAccess to allow a disconnect only if the "always-on" mode is not enabled by the AlwaysOn policy setting. This is not a comprehensive solution to the "always-on" mode across platforms, as instead of disconnecting a user could achieve the same effect by creating a new empty profile, initiating a reauth, or by deleting the profile. These are the things we should address in future PRs. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-31 10:22:20 -06:00
Nick Khyl	535a3dbebd	ipn/ipnauth: implement an Actor representing tailscaled itself ... Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-31 10:22:20 -06:00
Nick Khyl	081595de63	ipn/{ipnauth, ipnserver}: extend the ipnauth.Actor interface with a CheckProfileAccess method ... The implementations define it to verify whether the actor has the requested access to a login profile. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-31 10:22:20 -06:00
Nick Khyl	4e7f4086b2	ipn: generate LoginProfileView and use it instead of *LoginProfile where appropriate ... Conventionally, we use views (e.g., ipn.PrefsView, tailcfg.NodeView, etc.) when dealing with structs that shouldn't be mutated. However, ipn.LoginProfile has been an exception so far, with a mix of passing and returning LoginProfile by reference (allowing accidental mutations) and by value (which is wasteful, given its current size of 192 bytes). In this PR, we generate an ipn.LoginProfileView and use it instead of passing/returning LoginProfiles by mutable reference or copying them when passing/returning by value. Now, LoginProfiles can only be mutated by (*profileManager).setProfilePrefs. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-30 18:12:54 -06:00
Brad Fitzpatrick	7d5fe13d27	types/views: make SliceEqualAnyOrder also do short slice optimization ... SliceEqualAnyOrderFunc had an optimization missing from SliceEqualAnyOrder. Now they share the same code and both have the optimization. Updates #14593 Change-Id: I550726e0964fc4006e77bb44addc67be989c131c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-30 22:29:35 +00:00
Andrea Gottardo	8ee72cd33c	cli/funnel: fix comment typo (#14840) ... Updates #cleanup Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	2025-01-30 14:21:32 -08:00
Andrea Gottardo	08dd4994d0	VERSION.txt: this is v1.81.0 (#14838) ... Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	2025-01-30 13:04:29 -08:00
Tom Proctor	138a83efe1	cmd/containerboot: wait for consistent state on shutdown (#14263) ... tailscaled's ipn package writes a collection of keys to state after authenticating to control, but one at a time. If containerboot happens to send a SIGTERM signal to tailscaled in the middle of writing those keys, it may shut down with an inconsistent state Secret and never recover. While we can't durably fix this with our current single-use auth keys (no atomic operation to auth + write state), we can reduce the window for this race condition by checking for partial state before sending SIGTERM to tailscaled. Best effort only. Updates #14080 Change-Id: I0532d51b6f0b7d391e538468bd6a0a80dbe1d9f7 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	2025-01-30 13:51:10 +00:00
Anton Tolchanov	c2af1cd9e3	prober: support multiple probes running concurrently ... Some probes might need to run for longer than their scheduling interval, so this change relaxes the 1-at-a-time restriction, allowing us to configure probe concurrency and timeout separately. The default values remain the same (concurrency of 1; timeout of 80% of interval). Updates tailscale/corp#25479 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2025-01-30 12:22:23 +00:00
Irbe Krumina	a49af98b31	cmd/k8s-operator: temporarily disable HA Ingress controller (#14833) ... The HA Ingress functionality is not actually doing anything valuable yet, so don't run the controller in 1.80 release yet. Updates tailscale/tailscale#24795 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2025-01-30 11:36:33 +00:00
Brad Fitzpatrick	0ed4aa028f	control/controlclient: flesh out a recently added comment ... Updates tailscale/corp#26058 Change-Id: Ib46161fbb2e79c080f886083665961f02cbf5949	2025-01-30 08:48:52 +00:00
Brad Fitzpatrick	ed8bb3b564	control/controlclient: add missing word in comment ... Found by review.ai. Updates #cleanup Change-Id: Ib9126de7327527b8b3818d92cc774bb1c7b6f974 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-30 08:48:52 +00:00
Irbe Krumina	3f39211f98	cmd/k8s-operator: check that cluster traffic is routed to egress ProxyGroup Pod before marking it as ready (#14792) ... This change builds on top of #14436 to ensure minimum downtime during egress ProxyGroup update rollouts: - adds a readiness gate for ProxyGroup replicas that prevents kubelet from marking the replica Pod as ready before a corresponding readiness condition has been added to the Pod - adds a reconciler that reconciles egress ProxyGroup Pods and, for each that is not ready, if cluster traffic for relevant egress endpoints is routed via this Pod- if so add the readiness condition to allow kubelet to mark the Pod as ready. During the sequenced StatefulSet update rollouts kubelet does not restart a Pod before the previous replica has been updated and marked as ready, so ensuring that a replica is not marked as ready allows to avoid a temporary post-update situation where all replicas have been restarted, but none of the new ones are yet set up as an endpoint for the egress service, so cluster traffic is dropped. Updates tailscale/tailscale#14326 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2025-01-30 08:47:45 +00:00
Brad Fitzpatrick	8bd04bdd3a	go.mod: bump gorilla/csrf for security fix (#14822) ... For 9dd6af1f6d Update client/web and safeweb to correctly signal to the csrf middleware whether the request is being served over TLS. This determines whether Origin and Referer header checks are strictly enforced. The gorilla library previously did not enforce these checks due to a logic bug based on erroneous use of the net/http.Request API. The patch to fix this also inverts the library behavior to presume that every request is being served over TLS, necessitating these changes. Updates tailscale/corp#25340 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com> Co-authored-by: Patrick O'Doherty <patrick@tailscale.com>	2025-01-29 12:44:01 -08:00
Percy Wegmann	b60f6b849a	Revert "ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh" ... This reverts commit 46fd4e58a2. We don't want to include this in 1.80 yet, but can add it back post 1.80. Updates #8593 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-01-29 10:47:45 -06:00
Irbe Krumina	52f88f782a	cmd/k8s-operator: don't set deprecated configfile hash on new proxies (#14817) ... Fixes the configfile reload logic- if the tailscale capver can not yet be determined because the device info is not yet written to the state Secret, don't assume that the proxy is pre-110. Updates tailscale/tailscale#13032 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2025-01-29 15:48:05 +00:00
Irbe Krumina	b406f209c3	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436) ... cmd/{containerboot,k8s-operator},kube: add preshutdown hook for egress PG proxies This change is part of work towards minimizing downtime during update rollouts of egress ProxyGroup replicas. This change: - updates the containerboot health check logic to return Pod IP in headers, if set - always runs the health check for egress PG proxies - updates ClusterIP Services created for PG egress endpoints to include the health check endpoint - implements preshutdown endpoint in proxies. The preshutdown endpoint logic waits till, for all currently configured egress services, the ClusterIP Service health check endpoint is no longer returned by the shutting-down Pod (by looking at the new Pod IP header). - ensures that kubelet is configured to call the preshutdown endpoint This reduces the possibility that, as replicas are terminated during an update, a replica gets terminated to which cluster traffic is still being routed via the ClusterIP Service because kube proxy has not yet updated routig rules. This is not a perfect check as in practice, it only checks that the kube proxy on the node on which the proxy runs has updated rules. However, overall this might be good enough. The preshutdown logic is disabled if users have configured a custom health check port via TS_LOCAL_ADDR_PORT env var. This change throws a warnign if so and in future setting of that env var for operator proxies might be disallowed (as users shouldn't need to configure this for a Pod directly). This is backwards compatible with earlier proxy versions. Updates tailscale/tailscale#14326 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2025-01-29 07:35:50 +00:00
Andrew Dunham	eb299302ba	types/views: fix SliceEqualAnyOrderFunc short optimization ... This was flagged by @tkhattra on the merge commit; thanks! Updates tailscale/corp#25479 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia8045640f02bd4dcc0fe7433249fd72ac6b9cf52	2025-01-28 23:17:43 -05:00
dependabot[bot]	0aa54151f2	.github: Bump actions/checkout from 3.6.0 to 4.2.2 (#14139) ... Bumps [actions/checkout](https://github.com/actions/checkout) from 3.6.0 to 4.2.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v3.6.0...11bd71901bbe5b1630ceea73d27597364c9af683) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-01-28 15:03:13 -07:00
Mario Minardi	f1514a944a	go.toolchain.rev: bump from Go 1.23.3 to 1.23.5 (#14814) ... Update Go toolchain to 1.23.5. Updates #cleanup Signed-off-by: Mario Minardi <mario@tailscale.com>	2025-01-28 14:35:24 -07:00
Percy Wegmann	46fd4e58a2	ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh ... The upstream crypto package now supports sending banners at any time during authentication, so the Tailscale fork of crypto/ssh is no longer necessary. github.com/tailscale/golang-x-crypto is still needed for some custom ACME autocert functionality. tempfork/gliderlabs is still necessary because of a few other customizations, mostly related to TTY handling. Updates #8593 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-01-28 14:20:55 -06:00
Anton Tolchanov	3abfbf50ae	tsnet: return from Accept when the listener gets closed ... Fixes #14808 Signed-off-by: Anton Tolchanov <anton@tailscale.com>	2025-01-28 14:02:36 +00:00
yejingchen	6f10fe8ab1	cmd/tailscale: add warning to help text of --force-reauth (#14778) ... The warning text is adapted from https://tailscale.com/kb/1028/key-expiry#renewing-keys-for-an-expired-device . There is already https://github.com/tailscale/tailscale/pull/7575 which presents a warning when connected over Tailscale, however the detection is done by checking SSH environment variables, which are absent within systemd's run0*. That means `--force-reauth` will happily bring down Tailscale connection, leaving the user in despair. Changing only the help text is by no means a complete solution, but hopefully it will stop users from blindly trying it out, and motivate them to search for a proper solution. *: https://www.freedesktop.org/software/systemd/man/devel/run0.html Updates #3849 Signed-off-by: yejingchen <ye.jingchen@gmail.com>	2025-01-28 10:05:49 +00:00