tailscale, branch 13685-low-memory-mode-in-logtail-may-no-longer-be-needed

logtail: remove LowMemory mode

2024-10-04T16:48:50Z

Fixes tailscale/tailscale#13685 logtail currently has a LowMemory flag, which is enabled upon initialization on memory-constrained platforms like iOS. This flag reduces the ring buffer size from 256 log lines to 64. It was introduced over four years ago, back when Tailscale supported iOS 14 and earlier, where network extensions were limited to 15 MB of RAM. Since the memory limit has now increased to 50 MB on all supported iOS versions (with our minimum requirement being iOS 15.0), the need to conserve a few kilobytes of RAM by reducing buffer entries and the size of each flush is minimal. The additional code paths are more things we need to maintain over time... with little benefit. This PR removes that. To be merged after we cut the first 1.77 unstable, as this might be a risky change. Signed-off-by: Andrea Gottardo

hostinfo: update SetPackage doc with new Android values (#13537)

2024-10-04T16:35:19Z

Fixes tailscale/corp#23283 Signed-off-by: kari-ts

cmd/tailscale/cli: don't print disablement secrets if init fails (#13673)

2024-10-04T15:01:48Z

* cmd/tailscale/cli: don't print disablement secrets if init fails Fixes tailscale/corp#11355 Signed-off-by: Erisa A * cmd/tailscale/cli: changes from code review Signed-off-by: Erisa A * cmd/tailscale/cli: small grammar change Signed-off-by: Erisa A --------- Signed-off-by: Erisa A

cmd/{k8s-operator,containerboot},k8s-operator,kube: reconcile ExternalName Services for ProxyGroup (#13635)

2024-10-04T12:11:35Z

Adds a new reconciler that reconciles ExternalName Services that define a tailnet target that should be exposed to cluster workloads on a ProxyGroup's proxies. The reconciler ensures that for each such service, the config mounted to the proxies is updated with the tailnet target definition and that and EndpointSlice and ClusterIP Service are created for the service. Adds a new reconciler that ensures that as proxy Pods become ready to route traffic to a tailnet target, the EndpointSlice for the target is updated with the Pods' endpoints. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina

cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658)

2024-10-03T19:15:00Z

The AddSNATRuleForDst rule was adding a new rule each time it was called including: - if a rule already existed - if a rule matching the destination, but with different desired source already existed This was causing issues especially for the in-progress egress HA proxies work, where the rules are now refreshed more frequently, so more redundant rules were being created. This change: - only creates the rule if it doesn't already exist - if a rule for the same dst, but different source is found, delete it - also ensures that egress proxies refresh firewall rules if the node's tailnet IP changes Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina

safeweb: add StrictTransportSecurityOptions config (#13679)

2024-10-03T18:38:29Z

Add the ability to specify Strict-Transport-Security options in response to BrowserMux HTTP requests in safeweb. Updates https://github.com/tailscale/corp/issues/23375 Signed-off-by: Patrick O'Doherty

ssh/tailssh: pass window size pixels in IoctlSetWinsize events

2024-10-03T16:24:28Z

Fixes #13669 Change-Id: Id44cfbb83183f1bbcbdc38c29238287b9d288707 Signed-off-by: Brad Fitzpatrick

logpolicy: force TLS 1.3 handshake

2024-10-03T16:16:23Z

Updates tailscale/tailscale#3363 We know `log.tailscale.io` supports TLS 1.3, so we can enforce its usage in the client to shake some bytes off the TLS handshake each time a connection is opened to upload logs. Signed-off-by: Andrea Gottardo

wgengine/netstack: check userspace ping success on Windows

2024-10-03T16:07:39Z

Hacky temporary workaround until we do #13654 correctly. Updates #13654 Change-Id: I764eaedbb112fb3a34dddb89572fec1b2543fd4a Signed-off-by: Brad Fitzpatrick

control/controlclient: include HTTP status string in error message too

2024-10-03T15:37:16Z

Not just its code. Updates tailscale/corp#23584 Change-Id: I8001a675372fe15da797adde22f04488d8683448 Signed-off-by: Brad Fitzpatrick