summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2024-10-24control/keyfallback: add baked-in fallback for control keyandrew/keyfallbackAndrew Dunham7-6/+196
Similar to how we bake in the DERPMap to ensure that we can reach the DERP servers if DNS isn't working, also bake in the control key for the default control server that we use if the control server is down. Updates #13890 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I18ef0381e266bd3db10063685993bc3cb76b2f42
2024-10-22net/netcheck: add a Now field to the netcheck ReportAndrew Dunham3-7/+24
This allows us to print the time that a netcheck was run, which is useful in debugging. Updates #10972 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id48d30d4eb6d5208efb2b1526a71d83fe7f9320b
2024-10-22health: fix spurious warning about DERP home region '0'Brad Fitzpatrick1-1/+5
Updates #13650 Change-Id: I6b0f165f66da3f881a4caa25d2d9936dc2a7f22c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-21net/tstun: use /10 as subnet for TAP mode; read IP from netmapMaisem Ali2-23/+54
Few changes to resolve TODOs in the code: - Instead of using a hardcoded IP, get it from the netmap. - Use 100.100.100.100 as the gateway IP - Use the /10 CGNAT range instead of a random /24 Updates #2589 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-10-21net/tstun: restore tap mode functionalityMaisem Ali6-90/+88
It had bit-rotted likely during the transition to vector io in 76389d8baf942b10a8f0f4201b7c4b0737a0172c. Tested on Ubuntu 24.04 by creating a netns and doing the DHCP dance to get an IP. Updates #2589 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-10-21cmd/viewer: import types/views when generating a getter for a map fieldNick Khyl3-0/+84
Fixes #13873 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-21health: remove SysDNSOS, add two Warnables for read+set system DNS config ↵Andrea Gottardo3-20/+32
(#13874)
2024-10-21scripts/installer.sh: allow Archcraft for Arch packages (#13870)Erisa A1-1/+1
Fixes #13869 Signed-off-by: Erisa A <erisa@tailscale.com>
2024-10-20derp: track client-advertised non-ideal DERP connections in more placesBrad Fitzpatrick5-7/+36
In f77821fd63 (released in v1.72.0), we made the client tell a DERP server when the connection was not its ideal choice (the first node in its region). But we didn't do anything with that information until now. This adds a metric about how many such connections are on a given derper, and also adds a bit to the PeerPresentFlags bitmask so watchers can identify (and rebalance) them. Updates tailscale/corp#372 Change-Id: Ief8af448750aa6d598e5939a57c062f4e55962be Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-19net/tlsdial: call out firewalls blocking Tailscale in health warnings (#13840)Andrea Gottardo7-2/+192
Updates tailscale/tailscale#13839 Adds a new blockblame package which can detect common MITM SSL certificates used by network appliances. We use this in `tlsdial` to display a dedicated health warning when we cannot connect to control, and a network appliance MITM attack is detected. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-10-18release/dist: clamp min / max version for synology package centre (#13857)Mario Minardi1-2/+16
Clamp the min and max version for DSM 7.0 and DSM 7.2 packages when we are building packages for the synology package centre. This change leaves packages destined for pkgs.tailscale.com with just the min version set to not break packages in the wild / our update flow. Updates https://github.com/tailscale/corp/issues/22908 Signed-off-by: Mario Minardi <mario@tailscale.com>
2024-10-18net/netcheck: remove arbitrary deadlines from GetReport() tests (#13832)Jordan Whited1-2/+29
GetReport() may have side effects when the caller enforces a deadline that is shorter than ReportTimeout. Updates #13783 Updates #13394 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-10-18ipn/{ipnauth,ipnlocal,ipnserver}: send the auth URL to the user who started ↵Nick Khyl8-53/+762
interactive login We add the ClientID() method to the ipnauth.Actor interface and updated ipnserver.actor to implement it. This method returns a unique ID of the connected client if the actor represents one. It helps link a series of interactions initiated by the client, such as when a notification needs to be sent back to a specific session, rather than all active sessions, in response to a certain request. We also add LocalBackend.WatchNotificationsAs and LocalBackend.StartLoginInteractiveAs methods, which are like WatchNotifications and StartLoginInteractive but accept an additional parameter specifying an ipnauth.Actor who initiates the operation. We store these actor identities in watchSession.owner and LocalBackend.authActor, respectively,and implement LocalBackend.sendTo and related helper methods to enable sending notifications to watchSessions associated with actors (or, more broadly, identifiable recipients). We then use the above to change who receives the BrowseToURL notifications: - For user-initiated, interactive logins, the notification is delivered only to the user who initiated the process. If the initiating actor represents a specific connected client, the URL notification is sent back to the same LocalAPI client that called StartLoginInteractive. Otherwise, the notification is sent to all clients connected as that user. Currently, we only differentiate between users on Windows, as it is inherently a multi-user OS. - In all other cases (e.g., node key expiration), we send the notification to all connected users. Updates tailscale/corp#18342 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-18derp: add sclient write deadline timeout metric (#13831)Jordan Whited1-0/+6
Write timeouts can be indicative of stalled TCP streams. Understanding changes in the rate of such events can be helpful in an ops context. Updates tailscale/corp#23668 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-10-18derp: give trusted mesh peers longer write timeoutsBrad Fitzpatrick1-1/+14
Updates tailscale/corp#24014 Change-Id: I700872be48ab337dce8e11cabef7f82b97f0422a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-17scripts/installer.sh: support DNF5Andrew Dunham1-2/+34
This fixes the installation on newer Fedora versions that use dnf5 as the 'dnf' binary. Updates #13828 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I39513243c81640fab244a32b7dbb3f32071e9fce
2024-10-17tool/gocross: add support for tvOS Simulator (#13847)Andrea Gottardo1-1/+5
Updates ENG-5321 Allow gocross to build a static library for the Apple TV Simulator. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-10-16cmd/tailscale,ipn,tailcfg: add `tailscale advertise` subcommand behind ↵Naman Sood9-2/+130
envknob (#13734) Signed-off-by: Naman Sood <mail@nsood.in>
2024-10-16ipn/ipnlocal: error when trying to use exit node on unsupported platform ↵Mario Minardi7-63/+80
(#13726) Adds logic to `checkExitNodePrefsLocked` to return an error when attempting to use exit nodes on a platform where this is not supported. This mirrors logic that was added to error out when trying to use `ssh` on an unsupported platform, and has very similar semantics. Fixes https://github.com/tailscale/tailscale/issues/13724 Signed-off-by: Mario Minardi <mario@tailscale.com>
2024-10-16wgengine/magicsock: fix CI-only test warning of missing health trackerBrad Fitzpatrick1-0/+2
While looking at deflaking TestTwoDevicePing/ping_1.0.0.2_via_SendPacket, there were a bunch of distracting: WARNING: (non-fatal) nil health.Tracker (being strict in CI): ... This pacifies those so it's easier to work on actually deflaking the test. Updates #11762 Updates #11874 Change-Id: I08dcb44511d4996b68d5f1ce5a2619b555a2a773 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-16cmd/tsconnect, logpolicy: fixes for wasm_js.goChristian2-0/+7
* updates to LocalBackend require metrics to be passed in which are now initialized * os.MkdirTemp isn't supported in wasm/js so we simply return empty string for logger * adds a UDP dialer which was missing and led to the dialer being incompletely initialized Fixes #10454 and #8272 Signed-off-by: Christian <christian@devzero.io>
2024-10-16util/syspolicy: add rsop package that provides access to the resultant policyNick Khyl9-18/+1834
In this PR we add syspolicy/rsop package that facilitates policy source registration and provides access to the resultant policy merged from all registered sources for a given scope. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-15cmd/derpprobe: add /healthz endpointAndrew Dunham1-0/+5
For a customer that wants to run their own DERP prober, let's add a /healthz endpoint that can be used to monitor derpprobe itself. Updates #6526 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Iba315c999fc0b1a93d8c503c07cc733b4c8d5b6b
2024-10-15hostinfo,build_docker.sh,tailcfg: more reliably detect being in a container ↵Tom Proctor5-4/+37
(#13826) Our existing container-detection tricks did not work on Kubernetes, where Docker is no longer used as a container runtime. Extends the existing go build tags for containers to the other container packages and uses that to reliably detect builds that were created by Tailscale for use in a container. Unfortunately this doesn't necessarily improve detection for users' custom builds, but that's a separate issue. Updates #13825 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-10-14licenses: update license noticesLicense Updater4-6/+2
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2024-10-14{net/connstats,wgengine/magicsock}: fix packet counting in connstatsKristoffer Dalby4-15/+15
connstats currently increments the packet counter whenever it is called to store a length of data, however when udp batch sending was introduced we pass the length for a series of packages, and it is only incremented ones, making it count wrongly if we are on a platform supporting udp batches. Updates tailscale/corp#22075 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-14wgengine: instrument with usermetricsKristoffer Dalby7-23/+509
Updates tailscale/corp#22075 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-14tstest: avoid Fatal in ResourceCheck to show panic (#13790)Paul Scott1-2/+6
Fixes #13789 Signed-off-by: Paul Scott <paul@tailscale.com>
2024-10-11ssh/tailssh: calculate passthrough environment at latest possible stagePercy Wegmann1-15/+37
This allows passing through any environment variables that we set ourselves, for example DBUS_SESSION_BUS_ADDRESS. Updates #11175 Co-authored-by: Mario Minardi <mario@tailscale.com> Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-10-11types/bools: add Compare to compare boolean values (#13792)Joe Tsai2-0/+38
The bools.Compare function compares boolean values by reporting -1, 0, +1 for ordering so that it can be easily used with slices.SortFunc. Updates #cleanup Updates tailscale/corp#11038 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-10-11net/dns/resolver: add tests for using a forwarder with multiple upstream ↵Nick Khyl1-45/+190
resolvers If multiple upstream DNS servers are available, quad-100 sends requests to all of them and forwards the first successful response, if any. If no successful responses are received, it propagates the first failure from any of them. This PR adds some test coverage for these scenarios. Updates #13571 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-11net/dns/resolver: update (*forwarder).forwardWithDestChan to always return ↵Nick Hill3-16/+15
an error unless it sends a response to responseChan We currently have two executions paths where (*forwarder).forwardWithDestChan returns nil, rather than an error, without sending a DNS response to responseChan. These paths are accompanied by a comment that reads: // Returning an error will cause an internal retry, there is // nothing we can do if parsing failed. Just drop the packet. But it is not (or no longer longer) accurate: returning an error from forwardWithDestChan does not currently cause a retry. Moreover, although these paths are currently unreachable due to implementation details, if (*forwarder).forwardWithDestChan were to return nil without sending a response to responseChan, it would cause a deadlock at one call site and a panic at another. Therefore, we update (*forwarder).forwardWithDestChan to return errors in those two paths and remove comments that were no longer accurate and misleading. Updates #cleanup Updates #13571 Signed-off-by: Nick Hill <mykola.khyl@gmail.com>
2024-10-11net/dns/resolver: translate 5xx DoH server errors into SERVFAIL DNS responsesNick Hill1-0/+4
If a DoH server returns an HTTP server error, rather than a SERVFAIL within a successful HTTP response, we should handle it in the same way as SERVFAIL. Updates #13571 Signed-off-by: Nick Hill <mykola.khyl@gmail.com>
2024-10-11net/dns/resolver: forward SERVFAIL responses over PeerDNSNick Hill2-9/+2
As per the docstring, (*forwarder).forwardWithDestChan should either send to responseChan and returns nil, or returns a non-nil error (without sending to the channel). However, this does not hold when all upstream DNS servers replied with an error. We've been handling this special error path in (*Resolver).Query but not in (*Resolver).HandlePeerDNSQuery. As a result, SERVFAIL responses from upstream servers were being converted into HTTP 503 responses, instead of being properly forwarded as SERVFAIL within a successful HTTP response, as per RFC 8484, section 4.2.1: A successful HTTP response with a 2xx status code (see Section 6.3 of [RFC7231]) is used for any valid DNS response, regardless of the DNS response code. For example, a successful 2xx HTTP status code is used even with a DNS message whose DNS response code indicates failure, such as SERVFAIL or NXDOMAIN. In this PR we fix (*forwarder).forwardWithDestChan to no longer return an error when it sends a response to responseChan, and remove the special handling in (*Resolver).Query, as it is no longer necessary. Updates #13571 Signed-off-by: Nick Hill <mykola.khyl@gmail.com>
2024-10-11client/tailscale,cmd/{cli,get-authkey,k8s-operator}: set distinct User-AgentsPercy Wegmann5-7/+14
This helps better distinguish what is generating activity to the Tailscale public API. Updates tailscale/corp#23838 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-10-10net/netcheck: fix netcheck cli-triggered nil pointer deref (#13782)Jordan Whited1-1/+1
Updates #13780 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-10-10VERSION.txt: this is v1.77.0 (#13779)v1.77.0-preJonathan Nobels1-1/+1
2024-10-10ipn/conffile: don't depend on hujson on iOS/AndroidBrad Fitzpatrick3-2/+37
Fixes #13772 Change-Id: I3ae03a5ee48c801f2e5ea12d1e54681df25d4604 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-10tsnet: fix panic caused by logging after test finishesAndrew Dunham1-1/+1
Updates #13773 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I95e03eb6aef1639bd4a2efd3a415e2c10cdebc5a
2024-10-10clientupdate: don't link distsign on platforms that don't downloadBrad Fitzpatrick7-20/+42
Updates tailscale/corp#20099 Change-Id: Ie3b782379b19d5f7890a8d3a378096b4f3e8a612 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-10k8s-operator/apis: revert ProxyGroup readiness cond name change (#13770)Irbe Krumina1-1/+1
No need to prefix this with 'Tailscale' for tailscale.com custom resource types. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-09clientupdate, ipn/localapi: don't use google/uuid, thin iOS depsBrad Fitzpatrick7-210/+219
We were using google/uuid in two places and that brought in database/sql/driver. We didn't need it in either place. Updates #13760 Updates tailscale/corp#20099 Change-Id: Ieed32f1bebe35d35f47ec5a2a429268f24f11f1f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-09safesocket: don't depend on go-ps on iOSBrad Fitzpatrick2-1/+2
There's never a tailscaled on iOS. And we can't run child processes to look for it anyway. Updates tailscale/corp#20099 Change-Id: Ieb3776f4bb440c4f1c442fdd169bacbe17f23ddb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-09control/controlhttp: don't link ts2021 server + websocket code on iOSBrad Fitzpatrick2-3/+7
We probably shouldn't link it in anywhere, but let's fix iOS for now. Updates #13762 Updates tailscale/corp#20099 Change-Id: Idac116e9340434334c256acba3866f02bd19827c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-09taildrop: fix defer in loop (#13757)Joe Tsai1-1/+1
However, this affects the scope of a defer. Updates #11038 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-10-09syncs: allocate map with Map.WithLock (#13755)Joe Tsai1-0/+3
One primary purpose of WithLock is to mutate the underlying map. However, this can lead to a panic if it happens to be nil. Thus, always allocate a map before passing it to f. Updates tailscale/corp#11038 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-10-09syncs: delete Map.Range, update callers to iteratorsBrad Fitzpatrick5-32/+11
Updates #11038 Change-Id: I2819fed896cc4035aba5e4e141b52c12637373b1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-09util/vizerror: add WrapWithMessagePercy Wegmann2-13/+67
Thus new function allows constructing vizerrors that combine a message appropriate for display to users with a wrapped underlying error. Updates tailscale/corp#23781 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-10-09syncs: add iterators to Map (#13739)Joe Tsai1-0/+48
Add Keys, Values, and All to iterate over all keys, values, and entries, respectively. Updates #11038 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-10-09cmd/k8s-operator,k8s-operator/apis: set a readiness condition on egress ↵Irbe Krumina5-14/+420
Services for ProxyGroup (#13746) cmd/k8s-operator,k8s-operator/apis: set a readiness condition on egress Services Set a readiness condition on ExternalName Services that define a tailnet target to route cluster traffic to via a ProxyGroup's proxies. The condition is set to true if at least one proxy is currently set up to route. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.