8608 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
James Tucker	82e41ddc42	cmd/natc: expose netstack metrics in client metrics in natc ... Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>	2025-01-24 16:39:09 -08:00
Tom Proctor	2089f4b603	ipn/ipnlocal: add debug envknob for ACME directory URL (#14771) ... Adds an envknob setting for changing the client's ACME directory URL. This allows testing cert issuing against LE's staging environment, as well as enabling local-only test environments, which is useful for avoiding the production rate limits in test and development scenarios. Fixes #14761 Change-Id: I191c840c0ca143a20e4fa54ea3b2f9b7cbfc889f Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	2025-01-25 00:29:00 +00:00
James Tucker	ca39c4e150	cmd/natc,wgengine/netstack: tune buffer size and segment lifetime in natc ... Some natc instances have been observed with excessive memory growth, dominant in gvisor buffers. It is likely that the connection buffers are sticking around for too long due to the default long segment time, and uptuned buffer size applied by default in wgengine/netstack. Apply configurations in natc specifically which are a better match for the natc use case, most notably a 5s maximum segment lifetime. Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>	2025-01-24 16:19:55 -08:00
Brad Fitzpatrick	1a7274fccb	control/controlclient: skip SetControlClientStatus when queue has newer results later ... Updates #1909 Updates #12542 Updates tailscale/corp#26058 Change-Id: I3033d235ca49f9739fdf3deaf603eea4ec3e407e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-24 16:16:22 -08:00
Mario Minardi	cbf1a9abe1	go.{mod,sum}: update web-client-prebuilt (#14772) ... Manually update the `web-client-prebuilt` package as the GitHub action is failing for some reason. Updates https://github.com/tailscale/tailscale/issues/14568 Signed-off-by: Mario Minardi <mario@tailscale.com>	2025-01-24 17:04:12 -07:00
Mario Minardi	716e4fcc97	client/web: remove advanced options from web client login (#14770) ... Removing the advanced options collapsible from the web client login for now ahead of our next client release. Updates https://github.com/tailscale/tailscale/issues/14568 Signed-off-by: Mario Minardi <mario@tailscale.com>	2025-01-24 16:29:58 -07:00
Tom Proctor	69bc164c62	ipn/ipnlocal: include DNS SAN in cert CSR (#14764) ... The CN field is technically deprecated; set the requested name in a DNS SAN extension in addition to maximise compatibility with RFC 8555. Fixes #14762 Change-Id: If5d27f1e7abc519ec86489bf034ac98b2e613043 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	2025-01-24 17:04:26 +00:00
Adrian Dewhurst	d69c70ee5b	tailcfg: adjust ServiceName.Validate to use vizerror ... Updates #cleanup Change-Id: I163b3f762b9d45c2155afe1c0a36860606833a22 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2025-01-24 10:57:46 -05:00
Kristoffer Dalby	05afa31df3	util/clientmetric: use counter in aggcounter ... Fixes #14743 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-24 15:17:44 +01:00
Percy Wegmann	450bc9a6b8	cmd/derper,derp: make TCP write timeout configurable ... The timeout still defaults to 2 seconds, but can now be changed via command-line flag. Updates tailscale/corp#26045 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-01-24 07:50:52 -06:00
Percy Wegmann	5e9056a356	derp: move Conn interface to derp.go ... This interface is used both by the DERP client as well as the server. Defining the interface in derp.go makes it clear that it is shared. Updates tailscale/corp#26045 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-01-24 07:50:52 -06:00
Kristoffer Dalby	f0b63d0eec	wgengine/filter: add check for unknown proto ... Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-24 12:20:44 +01:00
Kristoffer Dalby	f39ee8e520	net/tstun: add back outgoing drop metric ... Using new labels returned from the filter Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-24 12:20:44 +01:00
Kristoffer Dalby	5756bc1704	wgengine/filter: return drop reason for metrics ... Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-24 12:20:44 +01:00
Kristoffer Dalby	3a39f08735	util/usermetric: add more drop labels ... Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-24 12:20:44 +01:00
Brad Fitzpatrick	61bea75092	cmd/tailscale: fix, test some recent doc inconsistencies ... 3dabea0fc2 added some docs with inconsistent usage docs. This fixes them, and adds a test. It also adds some other tests and fixes other verb tense inconsistencies. Updates tailscale/corp#25278 Change-Id: I94c2a8940791bddd7c35c1c3d5fb791a317370c2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-23 18:51:16 -08:00
Nick Khyl	f0db47338e	cmd/tailscaled,util/syspolicy/source,util/winutil/gp: disallow acquiring the GP lock during service startup ... In v1.78, we started acquiring the GP lock when reading policy settings. This led to a deadlock during Tailscale installation via Group Policy Software Installation because the GP engine holds the write lock for the duration of policy processing, which in turn waits for the installation to complete, which in turn waits for the service to enter the running state. In this PR, we prevent the acquisition of GP locks (aka EnterCriticalPolicySection) during service startup and update the Windows Registry-based util/syspolicy/source.PlatformPolicyStore to handle this failure gracefully. The GP lock is somewhat optional; it’s safe to read policy settings without it, but acquiring the lock is recommended when reading multiple values to prevent the Group Policy engine from modifying settings mid-read and to avoid inconsistent results. Fixes #14416 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-23 15:06:47 -06:00
Brad Fitzpatrick	413fb5b933	control/controlclient: delete unreferenced mapSession UserProfiles ... This was a slow memory leak on busy tailnets with lots of tagged ephemeral nodes. Updates tailscale/corp#26058 Change-Id: I298e7d438e3ffbb3cde795640e344671d244c632 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-23 12:58:06 -08:00
Brad Fitzpatrick	d6abbc2e61	net/tstun: move TAP support out to separate package feature/tap ... Still behind the same ts_omit_tap build tag. See #14738 for background on the pattern. Updates #12614 Change-Id: I03fb3d2bf137111e727415bd8e713d8568156ecc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-23 11:00:49 -08:00
Andrew Lytvynov	f1710f4a42	appc,ipn/ipnlocal: log DNS parsing errors in app connectors (#14607) ... If we fail to parse the upstream DNS response in an app connector, we might miss new IPs for the target domain. Log parsing errors to be able to diagnose that. Updates #14606 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	2025-01-23 09:03:56 -08:00
Mike O'Driscoll	a00623e8c4	derp,wgengine/magicsock: remove unexpected label (#14711) ... Remove "unexpected" labelling of PeerGoneReasonNotHere. A peer being no longer connected to a DERP server is not an unexpected case and causes confusion in looking at logs. Fixes tailscale/corp#25609 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>	2025-01-23 09:04:03 -05:00
Tom Proctor	3033a96b02	cmd/k8s-operator: fix reconciler name clash (#14712) ... The new ProxyGroup-based Ingress reconciler is causing a fatal log at startup because it has the same name as the existing Ingress reconciler. Explicitly name both to ensure they have unique names that are consistent with other explicitly named reconcilers. Updates #14583 Change-Id: Ie76e3eaf3a96b1cec3d3615ea254a847447372ea Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	2025-01-23 10:47:21 +00:00
Brad Fitzpatrick	1562a6f2f2	feature/*: make Wake-on-LAN conditional, start supporting modular features ... This pulls out the Wake-on-LAN (WoL) code out into its own package (feature/wakeonlan) that registers itself with various new hooks around tailscaled. Then a new build tag (ts_omit_wakeonlan) causes the package to not even be linked in the binary. Ohter new packages include: * feature: to just record which features are loaded. Future: dependencies between features. * feature/condregister: the package with all the build tags that tailscaled, tsnet, and the Tailscale Xcode project extension can empty (underscore) import to load features as a function of the defined build tags. Future commits will move of our "ts_omit_foo" build tags into this style. Updates #12614 Change-Id: I9c5378dafb1113b62b816aabef02714db3fc9c4a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-22 17:16:15 -08:00
Andrew Lytvynov	3fb8a1f6bf	ipn/ipnlocal: re-advertise appc routes on startup, take 2 (#14740) ... * Reapply "ipn/ipnlocal: re-advertise appc routes on startup (#14609)" This reverts commit 51adaec35a. Signed-off-by: Andrew Lytvynov <awly@tailscale.com> * ipn/ipnlocal: fix a deadlock in readvertiseAppConnectorRoutes Don't hold LocalBackend.mu while calling the methods of appc.AppConnector. Those methods could call back into LocalBackend and try to acquire it's mutex. Fixes https://github.com/tailscale/corp/issues/25965 Fixes #14606 Signed-off-by: Andrew Lytvynov <awly@tailscale.com> --------- Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	2025-01-22 16:50:25 -08:00
Andrea Gottardo	3dabea0fc2	cmd/tailscale: define CLI tools to manipulate macOS network and system extensions (#14727) ... Updates tailscale/corp#25278 Adds definitions for new CLI commands getting added in v1.80. Refactors some pre-existing CLI commands within the `configure` tree to clean up code. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	2025-01-22 16:01:07 -08:00
Adrian Dewhurst	0fa7b4a236	tailcfg: add ServiceName ... Rather than using a string everywhere and needing to clarify that the string should have the svc: prefix, create a separate type for Service names. Updates tailscale/corp#24607 Change-Id: I720e022f61a7221644bb60955b72cacf42f59960 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2025-01-22 15:27:46 -05:00
dependabot[bot]	d1b378504c	.github: Bump slackapi/slack-github-action from 1.27.0 to 2.0.0 (#14141) ... Bumps [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) from 1.27.0 to 2.0.0. - [Release notes](https://github.com/slackapi/slack-github-action/releases) - [Commits](37ebaef184...485a9d42d3) --- updated-dependencies: - dependency-name: slackapi/slack-github-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-01-22 11:46:13 -07:00
Brad Fitzpatrick	8b65598614	util/slicesx: add AppendNonzero ... By request of @agottardo. Updates #cleanup Change-Id: I2f02314eb9533b1581e47b66b45b6fb8ac257bb7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-22 10:20:56 -08:00
Brad Fitzpatrick	17022ad0e9	tailcfg: remove now-unused TailscaleFunnelEnabled method ... As of tailscale/corp#26003 Updates tailscale/tailscale#11572 Change-Id: I5de2a0951b7b8972744178abc1b0e7948087d412 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-22 09:37:24 -08:00
KevinLiang10	e4779146b5	delete extra struct in tailcfg ... Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	2025-01-22 11:02:26 -05:00
KevinLiang10	550923d953	fix handler related and some nit ... Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	2025-01-22 11:02:26 -05:00
KevinLiang10	0a57051f2e	add blank line ... Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	2025-01-22 11:02:26 -05:00
KevinLiang10	ccd1643043	add copyright header ... Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	2025-01-22 11:02:26 -05:00
KevinLiang10	8c8750f1b3	ipn/ipnlocal: Support TCP and Web VIP services ... This commit intend to provide support for TCP and Web VIP services and also allow user to use Tun for VIP services if they want to. The commit includes: 1.Setting TCP intercept function for VIP Services. 2.Update netstack to send packet written from WG to netStack handler for VIP service. 3.Return correct TCP hander for VIP services when netstack acceptTCP. This commit also includes unit tests for if the local backend setServeConfig would set correct TCP intercept function and test if a hander gets returned when getting TCPHandlerForDst. The shouldProcessInbound check is not unit tested since the test result just depends on mocked functions. There should be an integration test to cover shouldProcessInbound and if the returned TCP handler actually does what the serveConfig says. Updates tailscale/corp#24604 Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	2025-01-22 11:02:26 -05:00
Brad Fitzpatrick	cb3b1a1dcf	tsweb: add missing debug pprof endpoints ... Updates tailscale/corp#26016 Change-Id: I47a5671e881cc092d83c1e992e2271f90afcae7e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-22 06:34:59 -08:00
Brad Fitzpatrick	042ed6bf69	net/bakedroots: add LetsEncrypt ISRG Root X2 ... Updates #14690 Change-Id: Ib85e318d48450fc6534f7b0c1d4cc4335de7c0ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-21 17:47:55 -08:00
Brad Fitzpatrick	150cd30b1d	ipn/ipnlocal: also use LetsEncrypt-baked-in roots for cert validation ... We previously baked in the LetsEncrypt x509 root CA for our tlsdial package. This moves that out into a new "bakedroots" package and is now also shared by ipn/ipnlocal's cert validation code (validCertPEM) that decides whether it's time to fetch a new cert. Otherwise, a machine without LetsEncrypt roots locally in its system roots is unable to use tailscale cert/serve and fetch certs. Fixes #14690 Change-Id: Ic88b3bdaabe25d56b9ff07ada56a27e3f11d7159 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-21 17:47:55 -08:00
Brad Fitzpatrick	e12b2a7267	cmd/tailscale/cli: clean up how optional commands get registered ... Both @agottardo and I tripped over this today. Updates #cleanup Change-Id: I64380a03bfc952b9887b1512dbcadf26499ff1cd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-21 15:57:14 -08:00
James Tucker	8b9d5fd6bc	go.mod: bump github.com/inetaf/tcpproxy ... Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>	2025-01-21 11:26:44 -08:00
Brad Fitzpatrick	b50d32059f	tsnet: block in Server.Dial until backend is Running ... Updates #14715 Change-Id: I8c91e94fd1c6278c7f94a6b890274ed8a01e6f25 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-21 10:57:07 -08:00
Percy Wegmann	2729942638	prober: fix nil pointer access in tcp-in-tcp probes ... If unable to accept a connection from the bandwidth probe listener, return from the goroutine immediately since the accepted connection will be nil. Updates tailscale/corp#25958 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-01-21 12:44:56 -06:00
Brad Fitzpatrick	7f3c1932b5	tsnet: fix panic on race between listener.Close and incoming packet ... I saw this panic while writing a new test for #14715: panic: send on closed channel goroutine 826 [running]: tailscale.com/tsnet.(*listener).handle(0x1400031a500, {0x1035fbb00, 0x14000b82300}) /Users/bradfitz/src/tailscale.com/tsnet/tsnet.go:1317 +0xac tailscale.com/wgengine/netstack.(*Impl).acceptTCP(0x14000204700, 0x14000882100) /Users/bradfitz/src/tailscale.com/wgengine/netstack/netstack.go:1320 +0x6dc created by gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*Forwarder).HandlePacket in goroutine 807 /Users/bradfitz/go/pkg/mod/gvisor.dev/gvisor@v0.0.0-20240722211153-64c016c92987/pkg/tcpip/transport/tcp/forwarder.go:98 +0x32c FAIL tailscale.com/tsnet 0.927s Updates #14715 Change-Id: I9924e0a6c2b801d46ee44eb8eeea0da2f9ea17c4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-21 10:32:58 -08:00
Brad Fitzpatrick	51adaec35a	Revert "ipn/ipnlocal: re-advertise appc routes on startup (#14609)" ... This reverts commit 1b303ee5ba (#14609). It caused a deadlock; see tailscale/corp#25965 Updates tailscale/corp#25965 Updates #13680 Updates #14606	2025-01-21 08:10:28 -08:00
dependabot[bot]	bcc262269f	build(deps): bump braces from 3.0.2 to 3.0.3 in /cmd/tsconnect (#12468) ... Bumps [braces](https://github.com/micromatch/braces) from 3.0.2 to 3.0.3. - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/braces/compare/3.0.2...3.0.3) --- updated-dependencies: - dependency-name: braces dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-01-20 22:24:13 -07:00
Irbe Krumina	817ba1c300	cmd/{k8s-operator,containerboot},kube/kubetypes: parse Ingresses for ingress ProxyGroup (#14583) ... cmd/k8s-operator: add logic to parse L7 Ingresses in HA mode - Wrap the Tailscale API client used by the Kubernetes Operator into a client that knows how to manage VIPServices. - Create/Delete VIPServices and update serve config for L7 Ingresses for ProxyGroup. - Ensure that ingress ProxyGroup proxies mount serve config from a shared ConfigMap. Updates tailscale/corp#24795 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2025-01-21 05:21:03 +00:00
Irbe Krumina	69a985fb1e	ipn/ipnlocal,tailcfg: communicate to control whether funnel is enabled (#14688) ... Adds a new Hostinfo.IngressEnabled bool field that holds whether funnel is currently enabled for the node. Triggers control update when this value changes. Bumps capver so that control can distinguish the new field being false vs non-existant in previous clients. This is part of a fix for an issue where nodes with any AllowFunnel block set in their serve config are being displayed as if actively routing funnel traffic in the admin panel. Updates tailscale/tailscale#11572 Updates tailscale/corp#25931 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	2025-01-21 05:17:27 +00:00
dependabot[bot]	70c7b0d77f	build(deps): bump nanoid from 3.3.4 to 3.3.8 in /cmd/tsconnect (#14352) ... Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.4 to 3.3.8. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/3.3.4...3.3.8) --- updated-dependencies: - dependency-name: nanoid dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-01-20 13:05:37 -07:00
dependabot[bot]	682c06a0e7	.github: Bump golangci/golangci-lint-action from 6.1.0 to 6.2.0 (#14696) ... Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 6.1.0 to 6.2.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](aaa42aa062...ec5d18412c) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-01-20 12:48:50 -07:00
dependabot[bot]	33e62a31bd	.github: Bump peter-evans/create-pull-request from 7.0.5 to 7.0.6 (#14695) ... Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.5 to 7.0.6. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](5e914681df...67ccf781d6) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-01-20 11:18:42 -07:00
dependabot[bot]	174af763eb	.github: Bump actions/upload-artifact from 4.4.3 to 4.6.0 (#14697) ... Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.4.3 to 4.6.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](b4b15b8c7c...65c4c4a1dd) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-01-20 10:57:18 -07:00