8619 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Brad Fitzpatrick	bd9725c5f8	health: relax no-derp-home warnable to not fire if not in map poll ... Fixes #14687 Change-Id: I05035df7e075e94dd39b2192bee34d878c15310d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-27 20:39:37 +00:00
Brad Fitzpatrick	bfde8079a0	health: do Warnable dependency filtering in tailscaled ... Previously we were depending on the GUI(s) to do it. By doing it in tailscaled, GUIs can be simplified and be guaranteed to render consistent results. If warnable A depends on warnable B, if both A & B are unhealhy, only B will be shown to the GUI as unhealthy. Once B clears up, only then will A be presented as unhealthy. Updates #14687 Change-Id: Id8566f2672d8d2d699740fa053d4e2a2c8009e83 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-27 20:39:29 +00:00
dependabot[bot]	76dc028b38	.github: Bump github/codeql-action from 3.28.1 to 3.28.5 (#14794) ... Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.1 to 3.28.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](b6a472f63d...f6091c0113) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-01-27 12:36:42 -07:00
dependabot[bot]	3fec806523	.github: Bump actions/setup-go from 5.2.0 to 5.3.0 (#14793) ... Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.2.0 to 5.3.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](3041bf56c9...f111f3307d) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-01-27 12:36:04 -07:00
Brad Fitzpatrick	bce05ec6c3	control/controlclient,tempfork/httprec: don't link httptest, test certs for c2n ... The c2n handling code was using the Go httptest package's ResponseRecorder code but that's in a test package which brings in Go's test certs, etc. This forks the httptest recorder type into its own package that only has the recorder and adds a test that we don't re-introduce a dependency on httptest. Updates #12614 Change-Id: I3546f49972981e21813ece9064cc2be0b74f4b16 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-26 21:30:28 +00:00
Brad Fitzpatrick	8c925899e1	go.mod: bump depaware, add --internal flag to stop hiding internal packages ... The hiding of internal packages has hidden things I wanted to see a few times now. Stop hiding them. This makes depaware.txt output a bit longer, but not too much. Plus we only really look at it with diffs & greps anyway; it's not like anybody reads the whole thing. Updates #12614 Change-Id: I868c89eeeddcaaab63e82371651003629bc9bda8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-26 21:12:34 +00:00
Brad Fitzpatrick	04029b857f	tstest/deptest: verify that tailscale.com BadDeps actually exist ... This protects against rearranging packages and not catching that a BadDeps package got moved. That would then effectively remove a test. Updates #12614 Change-Id: I257f1eeda9e3569c867b7628d5bfb252d3354ba6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-26 18:50:25 +00:00
Brad Fitzpatrick	e701fde6b3	control/controlknobs: make Knobs.AsDebugJSON automatic, not require maintenance ... The AsDebugJSON method (used only for a LocalAPI debug call) always needed to be updated whenever a new controlknob was added. We had a test for it, which was nice, but it was a tedious step we don't need to do. Use reflect instead. Updates #14788 Change-Id: If59cd776920f3ce7c748f86ed2eddd9323039a0b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-26 18:49:11 +00:00
Derek Kaser	66b2e9fd07	envknob/featureknob: allow use of exit node on unraid (#14754) ... Fixes #14372 Signed-off-by: Derek Kaser <11674153+dkaser@users.noreply.github.com>	2025-01-26 15:35:58 +00:00
Brad Fitzpatrick	68a66ee81b	feature/capture: move packet capture to feature/*, out of iOS + CLI ... We had the debug packet capture code + Lua dissector in the CLI + the iOS app. Now we don't, with tests to lock it in. As a bonus, tailscale.com/net/packet and tailscale.com/net/flowtrack no longer appear in the CLI's binary either. A new build tag ts_omit_capture disables the packet capture code and was added to build_dist.sh's --extra-small mode. Updates #12614 Change-Id: I79b0628c0d59911bd4d510c732284d97b0160f10 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-24 17:52:43 -08:00
Brad Fitzpatrick	2c98c44d9a	control/controlclient: sanitize invalid DERPMap nil Region from control ... Fixes #14752 Change-Id: If364603eefb9ac6dc5ec6df84a0d5e16c94dda8d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-24 17:19:12 -08:00
James Tucker	82e41ddc42	cmd/natc: expose netstack metrics in client metrics in natc ... Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>	2025-01-24 16:39:09 -08:00
Tom Proctor	2089f4b603	ipn/ipnlocal: add debug envknob for ACME directory URL (#14771) ... Adds an envknob setting for changing the client's ACME directory URL. This allows testing cert issuing against LE's staging environment, as well as enabling local-only test environments, which is useful for avoiding the production rate limits in test and development scenarios. Fixes #14761 Change-Id: I191c840c0ca143a20e4fa54ea3b2f9b7cbfc889f Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	2025-01-25 00:29:00 +00:00
James Tucker	ca39c4e150	cmd/natc,wgengine/netstack: tune buffer size and segment lifetime in natc ... Some natc instances have been observed with excessive memory growth, dominant in gvisor buffers. It is likely that the connection buffers are sticking around for too long due to the default long segment time, and uptuned buffer size applied by default in wgengine/netstack. Apply configurations in natc specifically which are a better match for the natc use case, most notably a 5s maximum segment lifetime. Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>	2025-01-24 16:19:55 -08:00
Brad Fitzpatrick	1a7274fccb	control/controlclient: skip SetControlClientStatus when queue has newer results later ... Updates #1909 Updates #12542 Updates tailscale/corp#26058 Change-Id: I3033d235ca49f9739fdf3deaf603eea4ec3e407e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-24 16:16:22 -08:00
Mario Minardi	cbf1a9abe1	go.{mod,sum}: update web-client-prebuilt (#14772) ... Manually update the `web-client-prebuilt` package as the GitHub action is failing for some reason. Updates https://github.com/tailscale/tailscale/issues/14568 Signed-off-by: Mario Minardi <mario@tailscale.com>	2025-01-24 17:04:12 -07:00
Mario Minardi	716e4fcc97	client/web: remove advanced options from web client login (#14770) ... Removing the advanced options collapsible from the web client login for now ahead of our next client release. Updates https://github.com/tailscale/tailscale/issues/14568 Signed-off-by: Mario Minardi <mario@tailscale.com>	2025-01-24 16:29:58 -07:00
Tom Proctor	69bc164c62	ipn/ipnlocal: include DNS SAN in cert CSR (#14764) ... The CN field is technically deprecated; set the requested name in a DNS SAN extension in addition to maximise compatibility with RFC 8555. Fixes #14762 Change-Id: If5d27f1e7abc519ec86489bf034ac98b2e613043 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	2025-01-24 17:04:26 +00:00
Adrian Dewhurst	d69c70ee5b	tailcfg: adjust ServiceName.Validate to use vizerror ... Updates #cleanup Change-Id: I163b3f762b9d45c2155afe1c0a36860606833a22 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2025-01-24 10:57:46 -05:00
Kristoffer Dalby	05afa31df3	util/clientmetric: use counter in aggcounter ... Fixes #14743 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-24 15:17:44 +01:00
Percy Wegmann	450bc9a6b8	cmd/derper,derp: make TCP write timeout configurable ... The timeout still defaults to 2 seconds, but can now be changed via command-line flag. Updates tailscale/corp#26045 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-01-24 07:50:52 -06:00
Percy Wegmann	5e9056a356	derp: move Conn interface to derp.go ... This interface is used both by the DERP client as well as the server. Defining the interface in derp.go makes it clear that it is shared. Updates tailscale/corp#26045 Signed-off-by: Percy Wegmann <percy@tailscale.com>	2025-01-24 07:50:52 -06:00
Kristoffer Dalby	f0b63d0eec	wgengine/filter: add check for unknown proto ... Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-24 12:20:44 +01:00
Kristoffer Dalby	f39ee8e520	net/tstun: add back outgoing drop metric ... Using new labels returned from the filter Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-24 12:20:44 +01:00
Kristoffer Dalby	5756bc1704	wgengine/filter: return drop reason for metrics ... Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-24 12:20:44 +01:00
Kristoffer Dalby	3a39f08735	util/usermetric: add more drop labels ... Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-24 12:20:44 +01:00
Brad Fitzpatrick	61bea75092	cmd/tailscale: fix, test some recent doc inconsistencies ... 3dabea0fc2 added some docs with inconsistent usage docs. This fixes them, and adds a test. It also adds some other tests and fixes other verb tense inconsistencies. Updates tailscale/corp#25278 Change-Id: I94c2a8940791bddd7c35c1c3d5fb791a317370c2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-23 18:51:16 -08:00
Nick Khyl	f0db47338e	cmd/tailscaled,util/syspolicy/source,util/winutil/gp: disallow acquiring the GP lock during service startup ... In v1.78, we started acquiring the GP lock when reading policy settings. This led to a deadlock during Tailscale installation via Group Policy Software Installation because the GP engine holds the write lock for the duration of policy processing, which in turn waits for the installation to complete, which in turn waits for the service to enter the running state. In this PR, we prevent the acquisition of GP locks (aka EnterCriticalPolicySection) during service startup and update the Windows Registry-based util/syspolicy/source.PlatformPolicyStore to handle this failure gracefully. The GP lock is somewhat optional; it’s safe to read policy settings without it, but acquiring the lock is recommended when reading multiple values to prevent the Group Policy engine from modifying settings mid-read and to avoid inconsistent results. Fixes #14416 Signed-off-by: Nick Khyl <nickk@tailscale.com>	2025-01-23 15:06:47 -06:00
Brad Fitzpatrick	413fb5b933	control/controlclient: delete unreferenced mapSession UserProfiles ... This was a slow memory leak on busy tailnets with lots of tagged ephemeral nodes. Updates tailscale/corp#26058 Change-Id: I298e7d438e3ffbb3cde795640e344671d244c632 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-23 12:58:06 -08:00
Brad Fitzpatrick	d6abbc2e61	net/tstun: move TAP support out to separate package feature/tap ... Still behind the same ts_omit_tap build tag. See #14738 for background on the pattern. Updates #12614 Change-Id: I03fb3d2bf137111e727415bd8e713d8568156ecc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-23 11:00:49 -08:00
Andrew Lytvynov	f1710f4a42	appc,ipn/ipnlocal: log DNS parsing errors in app connectors (#14607) ... If we fail to parse the upstream DNS response in an app connector, we might miss new IPs for the target domain. Log parsing errors to be able to diagnose that. Updates #14606 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	2025-01-23 09:03:56 -08:00
Mike O'Driscoll	a00623e8c4	derp,wgengine/magicsock: remove unexpected label (#14711) ... Remove "unexpected" labelling of PeerGoneReasonNotHere. A peer being no longer connected to a DERP server is not an unexpected case and causes confusion in looking at logs. Fixes tailscale/corp#25609 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>	2025-01-23 09:04:03 -05:00
Tom Proctor	3033a96b02	cmd/k8s-operator: fix reconciler name clash (#14712) ... The new ProxyGroup-based Ingress reconciler is causing a fatal log at startup because it has the same name as the existing Ingress reconciler. Explicitly name both to ensure they have unique names that are consistent with other explicitly named reconcilers. Updates #14583 Change-Id: Ie76e3eaf3a96b1cec3d3615ea254a847447372ea Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>	2025-01-23 10:47:21 +00:00
Brad Fitzpatrick	1562a6f2f2	feature/*: make Wake-on-LAN conditional, start supporting modular features ... This pulls out the Wake-on-LAN (WoL) code out into its own package (feature/wakeonlan) that registers itself with various new hooks around tailscaled. Then a new build tag (ts_omit_wakeonlan) causes the package to not even be linked in the binary. Ohter new packages include: * feature: to just record which features are loaded. Future: dependencies between features. * feature/condregister: the package with all the build tags that tailscaled, tsnet, and the Tailscale Xcode project extension can empty (underscore) import to load features as a function of the defined build tags. Future commits will move of our "ts_omit_foo" build tags into this style. Updates #12614 Change-Id: I9c5378dafb1113b62b816aabef02714db3fc9c4a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-22 17:16:15 -08:00
Andrew Lytvynov	3fb8a1f6bf	ipn/ipnlocal: re-advertise appc routes on startup, take 2 (#14740) ... * Reapply "ipn/ipnlocal: re-advertise appc routes on startup (#14609)" This reverts commit 51adaec35a. Signed-off-by: Andrew Lytvynov <awly@tailscale.com> * ipn/ipnlocal: fix a deadlock in readvertiseAppConnectorRoutes Don't hold LocalBackend.mu while calling the methods of appc.AppConnector. Those methods could call back into LocalBackend and try to acquire it's mutex. Fixes https://github.com/tailscale/corp/issues/25965 Fixes #14606 Signed-off-by: Andrew Lytvynov <awly@tailscale.com> --------- Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	2025-01-22 16:50:25 -08:00
Andrea Gottardo	3dabea0fc2	cmd/tailscale: define CLI tools to manipulate macOS network and system extensions (#14727) ... Updates tailscale/corp#25278 Adds definitions for new CLI commands getting added in v1.80. Refactors some pre-existing CLI commands within the `configure` tree to clean up code. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>	2025-01-22 16:01:07 -08:00
Adrian Dewhurst	0fa7b4a236	tailcfg: add ServiceName ... Rather than using a string everywhere and needing to clarify that the string should have the svc: prefix, create a separate type for Service names. Updates tailscale/corp#24607 Change-Id: I720e022f61a7221644bb60955b72cacf42f59960 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	2025-01-22 15:27:46 -05:00
dependabot[bot]	d1b378504c	.github: Bump slackapi/slack-github-action from 1.27.0 to 2.0.0 (#14141) ... Bumps [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) from 1.27.0 to 2.0.0. - [Release notes](https://github.com/slackapi/slack-github-action/releases) - [Commits](37ebaef184...485a9d42d3) --- updated-dependencies: - dependency-name: slackapi/slack-github-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-01-22 11:46:13 -07:00
Brad Fitzpatrick	8b65598614	util/slicesx: add AppendNonzero ... By request of @agottardo. Updates #cleanup Change-Id: I2f02314eb9533b1581e47b66b45b6fb8ac257bb7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-22 10:20:56 -08:00
Brad Fitzpatrick	17022ad0e9	tailcfg: remove now-unused TailscaleFunnelEnabled method ... As of tailscale/corp#26003 Updates tailscale/tailscale#11572 Change-Id: I5de2a0951b7b8972744178abc1b0e7948087d412 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-22 09:37:24 -08:00
KevinLiang10	e4779146b5	delete extra struct in tailcfg ... Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	2025-01-22 11:02:26 -05:00
KevinLiang10	550923d953	fix handler related and some nit ... Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	2025-01-22 11:02:26 -05:00
KevinLiang10	0a57051f2e	add blank line ... Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	2025-01-22 11:02:26 -05:00
KevinLiang10	ccd1643043	add copyright header ... Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	2025-01-22 11:02:26 -05:00
KevinLiang10	8c8750f1b3	ipn/ipnlocal: Support TCP and Web VIP services ... This commit intend to provide support for TCP and Web VIP services and also allow user to use Tun for VIP services if they want to. The commit includes: 1.Setting TCP intercept function for VIP Services. 2.Update netstack to send packet written from WG to netStack handler for VIP service. 3.Return correct TCP hander for VIP services when netstack acceptTCP. This commit also includes unit tests for if the local backend setServeConfig would set correct TCP intercept function and test if a hander gets returned when getting TCPHandlerForDst. The shouldProcessInbound check is not unit tested since the test result just depends on mocked functions. There should be an integration test to cover shouldProcessInbound and if the returned TCP handler actually does what the serveConfig says. Updates tailscale/corp#24604 Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>	2025-01-22 11:02:26 -05:00
Brad Fitzpatrick	cb3b1a1dcf	tsweb: add missing debug pprof endpoints ... Updates tailscale/corp#26016 Change-Id: I47a5671e881cc092d83c1e992e2271f90afcae7e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-22 06:34:59 -08:00
Brad Fitzpatrick	042ed6bf69	net/bakedroots: add LetsEncrypt ISRG Root X2 ... Updates #14690 Change-Id: Ib85e318d48450fc6534f7b0c1d4cc4335de7c0ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-21 17:47:55 -08:00
Brad Fitzpatrick	150cd30b1d	ipn/ipnlocal: also use LetsEncrypt-baked-in roots for cert validation ... We previously baked in the LetsEncrypt x509 root CA for our tlsdial package. This moves that out into a new "bakedroots" package and is now also shared by ipn/ipnlocal's cert validation code (validCertPEM) that decides whether it's time to fetch a new cert. Otherwise, a machine without LetsEncrypt roots locally in its system roots is unable to use tailscale cert/serve and fetch certs. Fixes #14690 Change-Id: Ic88b3bdaabe25d56b9ff07ada56a27e3f11d7159 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-21 17:47:55 -08:00
Brad Fitzpatrick	e12b2a7267	cmd/tailscale/cli: clean up how optional commands get registered ... Both @agottardo and I tripped over this today. Updates #cleanup Change-Id: I64380a03bfc952b9887b1512dbcadf26499ff1cd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2025-01-21 15:57:14 -08:00
James Tucker	8b9d5fd6bc	go.mod: bump github.com/inetaf/tcpproxy ... Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>	2025-01-21 11:26:44 -08:00