summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2024-04-30drive: don't allow DELETE on read-only sharesPercy Wegmann2-1/+32
Fixes tailscale/corp#19646 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-04-30util/slicesx: add AppendMatchingBrad Fitzpatrick2-0/+25
We had this in a different repo, but moving it here, as this a more fitting package. Updates #cleanup Change-Id: I5fb9b10e465932aeef5841c67deba4d77d473d57 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-30ipn/ipnlocal: reset the dialPlan only when the URL is unchangedAndrew Dunham1-4/+26
Also, reset it in a few more places (e.g. logout, new blank profiles, etc.) to avoid a few more cases where a pre-existing dialPlan can cause a new Headscale server take 10+ seconds to connect. Updates #11938 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I3095173a5a3d9720507afe4452548491e9e45a3e
2024-04-30types/views: use slices.Contains{,Func}Brad Fitzpatrick1-12/+2
Updates #8419 Change-Id: Ib1a9cb3fb425284b7e02684072a4e7a35975f35c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-30syncs: fix AtomicValue for interface kinds (#11943)Joe Tsai2-6/+68
If AtomicValue[T] is used with a T that is an interface kind, then Store may panic if different concret types are ever stored. Fix this by always wrapping in a concrete type. Technically, this is only needed if T is an interface kind, but there is no harm in doing it also for non-interface kinds. Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-04-30cmd/{k8s-nameserver,k8s-operator},k8s-operator: add a kube nameserver, make ↵Irbe Krumina25-14/+1853
operator deploy it (#11919) * cmd/k8s-nameserver,k8s-operator: add a nameserver that can resolve ts.net DNS names in cluster. Adds a simple nameserver that can respond to A record queries for ts.net DNS names. It can respond to queries from in-memory records, populated from a ConfigMap mounted at /config. It dynamically updates its records as the ConfigMap contents changes. It will respond with NXDOMAIN to queries for any other record types (AAAA to be implemented in the future). It can respond to queries over UDP or TCP. It runs a miekg/dns DNS server with a single registered handler for ts.net domain names. Queries for other domain names will be refused. The intended use of this is: 1) to allow non-tailnet cluster workloads to talk to HTTPS tailnet services exposed via Tailscale operator egress over HTTPS 2) to allow non-tailnet cluster workloads to talk to workloads in the same cluster that have been exposed to tailnet over their MagicDNS names but on their cluster IPs. DNSConfig CRD can be used to configure the operator to deploy kube nameserver (./cmd/k8s-nameserver) to cluster. Updates tailscale/tailscale#10499 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-04-30Reset dial plan when switching profile (#11933)Shaw Drastin1-0/+5
When switching profile, the server URL can change (e.g. because of switching to a self-hosted headscale instance). If it is not reset here, dial plans returned by old server (e.g. tailscale control server) will be used to connect to new server (e.g. self-hosted headscale server), and the register request will be blocked by it until timeout, leading to very slow profile switches. Updates #11938 11938 Signed-off-by: Shaw Drastin <showier.drastic0a@icloud.com>
2024-04-30net/tstun: implement env var for disabling UDP GRO on Linux (#11924)Jordan Whited5-3/+39
Certain device drivers (e.g. vxlan, geneve) do not properly handle coalesced UDP packets later in the stack, resulting in packet loss. Updates #11026 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-04-30api.md: add documentation for new split DNS endpoints (#11922)Mario Minardi1-0/+162
Add documentation for GET/PATCH/PUT `api/v2/tailnet/<ID>/dns/split-dns`. These endpoints allow for reading, partially updating, and replacing the split DNS settings for a given tailnet. Updates https://github.com/tailscale/corp/issues/19483 Signed-off-by: Mario Minardi <mario@tailscale.com>
2024-04-29ipn/ipnlocal: fix TestOnTailnetDefaultAutoUpdate on unsupported platforms ↵Andrew Lytvynov1-5/+8
(#11921) Fixes #11894 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2024-04-29cmd/k8s-operator/deploy/manifests: check if IPv6 module is loaded before ↵Irbe Krumina2-6/+4
using it (#11867) Before attempting to enable IPv6 forwarding in the proxy init container check if the relevant module is found, else the container crashes on hosts that don't have it. Updates#11860 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-04-29scripts/installer.sh: enable Alpine community repo if needed (#11837)Andrew Lytvynov1-0/+8
The tailscale package is in the community Alpine repo. Check if it's commented out in `/etc/apk/repositories` and run `setup-apkrepos -c -1` if it's not. Fixes #11263 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2024-04-29tailcfg: add suggest exit node UI node attribute (#11918)Claire Wang1-0/+3
Add node attribute to determine whether or not to show suggested exit node in UI. Updates tailscale/corp#19515 Signed-off-by: Claire Wang <claire@tailscale.com>
2024-04-29clientupdate: exec systemctl instead of using dbus to restart (#11923)Andrew Lytvynov7-61/+16
Shell out to "systemctl", which lets us drop an extra dependency. Updates https://github.com/tailscale/corp/issues/18935 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2024-04-29appc: setting AdvertiseRoutes explicitly discards app connector routesFran Bull3-0/+29
This fixes bugs where after using the cli to set AdvertiseRoutes users were finding that they had to restart tailscaled before the app connector would advertise previously learned routes again. And seems more in line with user expectations. Fixes #11006 Signed-off-by: Fran Bull <fran@tailscale.com>
2024-04-29appc: unadvertise routes when reconfiguring app connectorFran Bull2-2/+205
If the controlknob to persist app connector routes is enabled, when reconfiguring an app connector unadvertise routes that are no longer relevant. Updates #11008 Signed-off-by: Fran Bull <fran@tailscale.com>
2024-04-29appc: write discovered domains to StateStoreFran Bull1-0/+18
If the controlknob is on. This will allow us to remove discovered routes associated with a particular domain. Updates #11008 Signed-off-by: Fran Bull <fran@tailscale.com>
2024-04-29appc: add flag shouldStoreRoutes and controlknob for itFran Bull7-321/+443
When an app connector is reconfigured and domains to route are removed, we would like to no longer advertise routes that were discovered for those domains. In order to do this we plan to store which routes were discovered for which domains. Add a controlknob so that we can enable/disable the new behavior. Updates #11008 Signed-off-by: Fran Bull <fran@tailscale.com>
2024-04-29appc: add RouteInfo struct and persist it to StateStoreFran Bull3-0/+113
Lays the groundwork for the ability to persist app connectors discovered routes, which will allow us to stop advertising routes for a domain if the app connector no longer monitors that domain. Updates #11008 Signed-off-by: Fran Bull <fran@tailscale.com>
2024-04-29wgengine/wgcfg/nmcfg: skip expired peersAndrew Dunham1-0/+8
Updates tailscale/corp#19315 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1ad0c8796efe3dd456280e51efaf81f6d2049772
2024-04-29api.md: explicitly set content-type headers in POST CURL examples (#11916)Mario Minardi1-5/+21
Explicitly set `-H "Content-Type: application/json"` in CURL examples for POST endpoints as the default content type used by CURL is otherwise `application/x-www-form-urlencoded` and these endpoints expect JSON data. Updates https://github.com/tailscale/tailscale/issues/11914 Signed-off-by: Mario Minardi <mario@tailscale.com>
2024-04-29cmd/containerboot,kube,ipn/store/kubestore: allow interactive login on kube, ↵Irbe Krumina6-77/+366
check Secret create perms, allow empty state Secret (#11326) cmd/containerboot,kube,ipn/store/kubestore: allow interactive login and empty state Secrets, check perms * Allow users to pre-create empty state Secrets * Add a fake internal kube client, test functionality that has dependencies on kube client operations. * Fix an issue where interactive login was not allowed in an edge case where state Secret does not exist * Make the CheckSecretPermissions method report whether we have permissions to create/patch a Secret if it's determined that these operations will be needed Updates tailscale/tailscale#11170 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-04-29api.md: fix missing links after move of device postureKristoffer Dalby1-2/+2
Updates tailscale/corp#18572 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-04-28net/{interfaces,netmon}, all: merge net/interfaces package into net/netmonBrad Fitzpatrick45-874/+846
In prep for most of the package funcs in net/interfaces to become methods in a long-lived netmon.Monitor that can cache things. (Many of the funcs are very heavy to call regularly, whereas the long-lived netmon.Monitor can subscribe to things from the OS and remember answers to questions it's asked regularly later) Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: Ie4e8dedb70136af2d611b990b865a822cd1797e5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-28net/netmon, add: add netmon.State type alias of interfaces.StateBrad Fitzpatrick11-27/+32
... in prep for merging the net/interfaces package into net/netmon. This is a no-op change that updates a bunch of the API signatures ahead of a future change to actually move things (and remove the type alias) Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: I477613388f09389214db0d77ccf24a65bff2199c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-27cmd/containerboot: wait on tailscaled process only (#11897)Irbe Krumina1-10/+11
Modifies containerboot to wait on tailscaled process only, not on any child process of containerboot. Waiting on any subprocess was racing with Go's exec.Cmd.Run, used to run iptables commands and that starts its own subprocesses and waits on them. Containerboot itself does not run anything else except for tailscaled, so there shouldn't be a need to wait on anything else. Updates tailscale/tailscale#11593 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-04-27net/netns, net/dns/resolver, etc: make netmon required in most placesBrad Fitzpatrick34-86/+228
The goal is to move more network state accessors to netmon.Monitor where they can be cheaper/cached. But first (this change and others) we need to make sure the one netmon.Monitor is plumbed everywhere. Some notable bits: * tsdial.NewDialer is added, taking a now-required netmon * because a tsdial.Dialer always has a netmon, anything taking both a Dialer and a NetMon is now redundant; take only the Dialer and get the NetMon from that if/when needed. * netmon.NewStatic is added, primarily for tests Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: I877f9cb87618c4eb037cee098241d18da9c01691 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-27ipn/ipnlocal: skip TestOnTailnetDefaultAutoUpdate on macOS for nowBrad Fitzpatrick1-0/+4
While it's broken. Updates #11894 Change-Id: I24698707ffe405471a14ab2683aea7e836531da8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-26net/netcheck, wgengine/magicsock: make netmon.Monitor requiredBrad Fitzpatrick5-67/+78
This has been a TODO for ages. Time to do it. The goal is to move more network state accessors to netmon.Monitor where they can be cheaper/cached. Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: I60fc6508cd2d8d079260bda371fc08b6318bcaf1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-26net/netutil: remove a use of deprecated interfaces.GetStateBrad Fitzpatrick2-8/+11
I'm working on moving all network state queries to be on netmon.Monitor, removing old APIs. Updates tailscale/corp#10910 Updates tailscale/corp#18960 Updates #7967 Updates #3299 Change-Id: If0de137e0e2e145520f69e258597fb89cf39a2a3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-26health, wgengine/magicsock: remove last of health package globalsBrad Fitzpatrick3-36/+73
Fixes #11874 Updates #4136 Change-Id: Ib70e6831d4c19c32509fe3d7eee4aa0e9f233564 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-26ipn/ipnlocal: fix null dereference for early suggested exit node queries ↵Jonathan Nobels1-0/+4
(#11885) Fixes tailscale/corp#19558 A request for the suggested exit nodes that occurs too early in the VPN lifecycle would result in a null deref of the netmap and/or the netcheck report. This checks both and errors out. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2024-04-26health, all: remove health.Global, finish plumbing health.TrackerBrad Fitzpatrick40-125/+151
Updates #11874 Updates #4136 Change-Id: I414470f71d90be9889d44c3afd53956d9f26cd61 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-26control/controlclient: plumb health.TrackerBrad Fitzpatrick3-16/+19
Updates #11874 Updates #4136 Change-Id: Ia941153bd83523f0c8b56852010f5231d774d91a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-26ipn/{ipnlocal,localapi},wgengine{,/magicsock}: plumb health.TrackerBrad Fitzpatrick15-46/+79
Down to 25 health.Global users. After this remains controlclient & net/dns & wgengine/router. Updates #11874 Updates #4136 Change-Id: I6dd1856e3d9bf523bdd44b60fb3b8f7501d5dc0d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-26cmd/k8s-operator,k8s-operator: optionally serve tailscaled metrics on Pod IP ↵Irbe Krumina10-15/+169
(#11699) Adds a new .spec.metrics field to ProxyClass to allow users to optionally serve client metrics (tailscaled --debug) on <Pod-IP>:9001. Metrics cannot currently be enabled for proxies that egress traffic to tailnet and for Ingress proxies with tailscale.com/experimental-forward-cluster-traffic-via-ingress annotation (because they currently forward all cluster traffic to their respective backends). The assumption is that users will want to have these metrics enabled continuously to be able to monitor proxy behaviour (as opposed to enabling them temporarily for debugging). Hence we expose them on Pod IP to make it easier to consume them i.e via Prometheus PodMonitor. Updates tailscale/tailscale#11292 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-04-25tsd, ipnlocal, etc: add tsd.System.HealthTracker, start some plumbingBrad Fitzpatrick19-45/+91
This adds a health.Tracker to tsd.System, accessible via a new tsd.System.HealthTracker method. In the future, that new method will return a tsd.System-specific HealthTracker, so multiple tsnet.Servers in the same process are isolated. For now, though, it just always returns the temporary health.Global value. That permits incremental plumbing over a number of changes. When the second to last health.Global reference is gone, then the tsd.System.HealthTracker implementation can return a private Tracker. The primary plumbing this does is adding it to LocalBackend and its dozen and change health calls. A few misc other callers are also plumbed. Subsequent changes will flesh out other parts of the tree (magicsock, controlclient, etc). Updates #11874 Updates #4136 Change-Id: Id51e73cfc8a39110425b6dc19d18b3975eac75ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-25health: permit Tracker method calls on nil receiverBrad Fitzpatrick2-0/+103
In prep for tsd.System Tracker plumbing throughout tailscaled, defensively permit all methods on Tracker to accept a nil receiver without crashing, lest I screw something up later. (A health tracking system that itself causes crashes would be no good.) Methods on nil receivers should not be called, so a future change will also collect their stacks (and panic during dev/test), but we should at least not crash in prod. This also locks that in with a test using reflect to automatically call all methods on a nil receiver and check they don't crash. Updates #11874 Updates #4136 Change-Id: I8e955046ebf370ec8af0c1fb63e5123e6282a9d3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-25safeweb: handle mux pattern collisions more generally (#11801)Chris Palmer2-15/+107
Fixes #11800 Signed-off-by: Chris Palmer <cpalmer@tailscale.com>
2024-04-25health: break Warnable into a global and per-Tracker value halvesBrad Fitzpatrick5-58/+49
Previously it was both metadata about the class of warnable item as well as the value. Now it's only metadata and the value is per-Tracker. Updates #11874 Updates #4136 Change-Id: Ia1ed1b6c95d34bc5aae36cffdb04279e6ba77015 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-25health: add Tracker type, in prep for removing global variablesBrad Fitzpatrick17-256/+268
This moves most of the health package global variables to a new `health.Tracker` type. But then rather than plumbing the Tracker in tsd.System everywhere, this only goes halfway and makes one new global Tracker (`health.Global`) that all the existing callers now use. A future change will eliminate that global. Updates #11874 Updates #4136 Change-Id: I6ee27e0b2e35f68cb38fecdb3b2dc4c3f2e09d68 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-25tailcfg: add auto exit node attribute (#11871)Claire Wang1-0/+3
Updates tailscale/corp#19515 Signed-off-by: Claire Wang <claire@tailscale.com>
2024-04-25release/dist/qnap: omit .qpkg.codesigning filesSonia Appasamy1-0/+8
Updates tailscale/tailscale-qpkg#135 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2024-04-24ipn/ipnlocal: only show Taildrive peers to which ACLs grant us accessPercy Wegmann3-25/+37
This improves convenience and security. * Convenience - no need to see nodes that can't share anything with you. * Security - malicious nodes can't expose shares to peers that aren't allowed to access their shares. Updates tailscale/corp#19432 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-04-24release/dist/qnap: update perms for tmpDir filesSonia Appasamy1-4/+5
Allows all users to read all files, and .sh/.cgi files to be executable. Updates tailscale/tailscale-qpkg#135 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2024-04-24cmd/k8s-operator,k8s-operator: proxyclass affinity (#11862)Lee Briggs8-1/+2420
add ability to set affinity rules to proxyclass Updates#11861 Signed-off-by: Lee Briggs <lee@leebriggs.co.uk>
2024-04-24ipn/ipnlocal: always stop the engine on auth when key has expiredAnton Tolchanov1-2/+5
If seamless key renewal is enabled, we typically do not stop the engine (deconfigure networking). However, if the node key has expired there is no point in keeping the connection up, and it might actually prevent key renewal if auth relies on endpoints routed via app connectors. Fixes tailscale/corp#5800 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-04-23util/syspolicy: add ReadStringArray interface (#11857)Andrea Gottardo9-0/+81
Fixes tailscale/corp#19459 This PR adds the ability for users of the syspolicy handler to read string arrays from the MDM solution configured on the system. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-04-23release/dist/qnap: use tmp file directory for qpkg buildingSonia Appasamy14-48/+97
This change allows for the release/dist/qnap package to be used outside of the tailscale repo (notably, will be used from corp), by using an embedded file system for build files which gets temporarily written to a new folder during qnap build runs. Without this change, when used from corp, the release/dist/qnap folder will fail to be found within the corp repo, causing various steps of the build to fail. The file renames in this change are to combine the build files into a /files folder, separated into /scripts and /Tailscale. Updates tailscale/tailscale-qpkg#135 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2024-04-23wgengine/router: consolidate routes before reconfiguring router for mobile ↵Percy Wegmann3-1/+146
clients This helps reduce memory pressure on tailnets with large numbers of routes. Updates tailscale/corp#19332 Signed-off-by: Percy Wegmann <percy@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.