summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2022-01-26cmd/derper: provide support for forcing autocert renewalsbradfitz/autocert_forceBrad Fitzpatrick1-0/+29
Change-Id: I127a803144ec5ca989823610f1bbd21dc5cfadba Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-26go.mod: bump netstack, switch to upstream netstackBrad Fitzpatrick6-75/+66
Now that Go 1.17 has module graph pruning (https://go.dev/doc/go1.17#go-command), we should be able to use upstream netstack without breaking our private repo's build that then depends on the tailscale.com Go module. This is that experiment. Updates #1518 (the original bug to break out netstack to own module) Updates #2642 (this updates netstack, but doesn't remove workaround) Change-Id: I27a252c74a517053462e5250db09f379de8ac8ff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-26ipn/ipnstate: add TailnetName to statusBrad Fitzpatrick3-1/+8
RELNOTE=tailscale status --json | jq .TailnetName Fixes tailscale/corp#3665 Change-Id: I85de027ba2781eb31ee1e0c5ab913b0dfa5b4c86 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-26scripts/installer: add Centos Stream 9 support (#3818)Xe Iaso1-2/+3
Blocked on package server support being deployed Signed-off-by: Xe <xe@tailscale.com>
2022-01-25wgengine/magicsock: make debugUseDerpRoute an opt.Bool.David Anderson1-7/+9
Can still be constant, just needs the extra methods. Fixes #3812 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-26words: fallout from mudpuppy-gate.David Anderson1-1/+0
Salamanders also have no scales. I checked the interweb, and there doesn't seem to be any subspecies that would let us claim that *some* salamanders are scaley. But they are tailey, for sure. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-25ipn/ipnserver: add TS_PERMIT_CERT_UID envknob to give webservers cert accessBrad Fitzpatrick3-1/+30
So you can run Caddy etc as a non-root user and let it have access to get certs. Updates caddyserver/caddy#4541 Change-Id: Iecc5922274530e2b00ba107d4b536580f374109b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-25cmd/derper: export TLS vars with derper_ prefix, not stun_David Anderson1-2/+2
Updates tailscale/corp#3568 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-25cmd/tailscale: propagate tailscaled 403s as AccessDeniedErrorsdavideger4-12/+11
So Linux/etc CLI users get helpful advice to run tailscale with --operator=$USER when they try to 'tailscale file {cp,get}' but are mysteriously forbidden. Signed-off-by: David Eger <eger@google.com> Signed-off-by: David Eger <david.eger@gmail.com>
2022-01-24wgengine/netstack: add an SSH server experimentBrad Fitzpatrick11-14/+233
Disabled by default. To use, run tailscaled with: TS_SSH_ALLOW_LOGIN=you@bar.com And enable with: $ TAILSCALE_USE_WIP_CODE=true tailscale up --ssh=true Then ssh [any-user]@[your-tailscale-ip] for a root bash shell. (both the "root" and "bash" part are temporary) Updates #3802 Change-Id: I268f8c3c95c8eed5f3231d712a5dc89615a406f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-24envknob: add new package for all the strconv.ParseBool(os.Getenv(..))Brad Fitzpatrick39-128/+195
A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-24net/dns: log why resolved does not look like it's on use [Linux]Brad Fitzpatrick2-7/+11
Updates #3742 Updates #3531 Change-Id: I9fc7fa0f4bcab1cf8001ba92408c660a5b25f105 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-22cmd/derper: record TLS versions used for requests.David Anderson1-3/+24
Surveying the fleet prior to turning off old/unused/insecure TLS versions. Updates tailscale/corp#3615 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-21Makefile: update make spk target to use the new go spk builderMaisem Ali2-4/+11
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-01-20words: correct inexcusable oversight re: mudpuppies.David Anderson2-2/+2
Mudpuppies are salamanders, and as such have tails but no scales. The management apologizes for the error. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-20cmd/tailscaled: include Go runtime metrics in /debug/metricsBrad Fitzpatrick7-1/+9
Fixes #3772 Change-Id: I237ea23268664d99e83d27890146018b04474556 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-19net/dns/resolvd: store nameserversAaron Bieber1-0/+20
Currently only search domains are stored. This was an oversight (under?) on my part. As things are now, when MagicDNS is on and "Override local DNS" is off, the dns forwarder has to timeout before names resolve. This introduces a pretty annoying lang that makes everything feel extremely slow. You will also see an error: "upstream nameservers not set". I tested with "Override local DNS" on and off. In both situations things seem to function as expected (and quickly). Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>
2022-01-19wgengine/netstack: clear TCP ECN bits before giving to gvisorBrad Fitzpatrick3-10/+134
Updates #2642 Change-Id: Ic219442a2656dd9dc99ae1dd91e907fd3d924987 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-19wgengine/magicsock: fix deadlock on shutdownJosh Bleecher Snyder1-1/+3
This fixes a deadlock on shutdown. One goroutine is waiting to send on c.derpRecvCh before unlocking c.mu. The other goroutine is waiting to lock c.mu before receiving from c.derpRecvCh. #3736 has a more detailed explanation of the sequence of events. Fixes #3736 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-01-19net/packet: fix typo in commentBrad Fitzpatrick1-1/+1
Change-Id: Ia666609fde18db44bf38d4e656f490fc372ac3b6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-19go.toolchain.rev: pick up new bufio.Writer API for Go1.18 (#3768)Joe Tsai1-1/+1
https://github.com/tailscale/go/commit/25fe91a25c9630a50138a135105af19ae7c7c3e7 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2022-01-19wgengine/netstack: add a missing refcount decrement after packet injectionBrad Fitzpatrick2-0/+77
Fixes #3762 Updates #3745 (probably fixes?) Change-Id: I1d3f0590fd5b8adfbc9110bc45ff717bb9e79aae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-19wgengine/netstack: add an Impl.Close method for testsBrad Fitzpatrick1-8/+20
Change-Id: Idbb3fd6d749d3e4effdf96de77a1106584822fef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-18wgengine/netstack: add missing error logging in a RST caseBrad Fitzpatrick1-2/+3
Updates #2642 Change-Id: I9f2f8fd28fc980208b0739eb9caf9db7b0977c09 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-18wgengine/netstack: fix netstack ping timeout on darwinBrad Fitzpatrick1-1/+14
-W is milliseconds on darwin, not seconds, and empirically it's milliseconds after a 1 second base. Change-Id: I2520619e6699d9c505d9645ce4dfee4973555227 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-17control/controlhttp: package to get a controlbase.Conn over HTTP(S).David Anderson3-0/+735
Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-17control/controlbase: enable asynchronous client handshaking.David Anderson5-35/+84
With this change, the client can obtain the initial handshake message separately from the rest of the handshake, for embedding into another protocol. This enables things like RTT reduction by stuffing the handshake initiation message into an HTTP header. Similarly, the server API optionally accepts a pre-read Noise initiation message, in addition to reading the message directly off a net.Conn. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-17control/controlbase: rename from control/noise.David Anderson8-8/+8
Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-17Update installer.shJay Stapleton1-2/+2
2022-01-13tstime/rate: deflake TestLongRunningQPSXe/winui-bugreport-without-tailscaledJosh Bleecher Snyder1-3/+4
This test set the bar too high. Just a couple of missed timers was enough to fail. Change the test to more of a sanity check. While we're here, run it for just 1s instead of 5s. Prior to this change, on a 13" M1 MPB, with stress -p 512 ./rate.test -test.run=QPS I saw 90%+ failures. After this change, I'm at 30k runs with no failures yet. Fixes #3733 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-01-13net/dnscache: use tls.Conn.HandshakeContext.David Anderson1-14/+1
Go 1.17 added a HandshakeContext func to take care of timeouts during TLS handshaking, so switch from our homegrown goroutine implementation to the standard way. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-13net/dnscache: don't cancel the TLS context before writing to the result channel.David Anderson1-3/+1
Cancelling the context makes the timeout goroutine race with the write that reports a successful TLS handshake, so you can end up with a successful TLS handshake that mysteriously reports that it timed out after ~0s in flight. The context is always canceled and cleaned up as the function exits, which happens mere microseconds later, so just let function exit clean up and thereby avoid races. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-01-13logtail: cap the buffer size in encodeTextJosh Bleecher Snyder2-9/+32
This started as an attempt to placate GitHub's code scanner, but it's also probably generally a good idea. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-01-13wgengine/magicsock: remove a per-DERP-packet map lookup in common caseBrad Fitzpatrick1-3/+7
Updates #150 Change-Id: Iffb6eccbe7ca97af97d29be63b7e37d487b3ba28 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-13wgengine/magicsock: enable DERP Return Path Optimization (DRPO)Brad Fitzpatrick1-1/+3
Turning this on at the beginning of the 1.21.x dev cycle, for 1.22. Updates #150 Change-Id: I1de567cfe0be3df5227087de196ab88e60c9eb56 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-13wgengine/magicsock: fix lock ordering deadlock with derphttpBrad Fitzpatrick1-8/+20
Fixes #3726 Change-Id: I32631a44dcc1da3ae47764728ec11ace1c78190d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-13cmd/tailscale: use html/template for synoTokenRedirectJosh Bleecher Snyder1-4/+4
The GitHub code scanner flagged this as a security vulnerability. I don't believe it was, but I couldn't convince myself of it 100%. Err on the safe side and use html/template to generate the HTML, with all necessary escaping. Fixes tailscale/corp#2698 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-01-12VERSION.txt: This is 1.21.Denton Gentry1-1/+1
Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2022-01-12tailcfg: no-op bump of MapRequest.VersionBrad Fitzpatrick1-1/+2
So 1.18 and 1.20 don't have the same. Change-Id: Ib2cac7c11eb37d9a0c2fcb66630f1cae619a97f4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-12wgengine/netstack: make userspace ping work when tailscaled has CAP_NET_RAWBrad Fitzpatrick2-2/+39
Updates #3710 Change-Id: Ief56c7ac20f5f09a2f940a1906b9efbf1b0d6932 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-12scripts/installer.sh: add support to use the unstable track.Maisem Ali1-8/+18
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-01-12cmd/tailscale/cli/web: fix typo where the html template data was beingMaisem Ali1-1/+1
replaced instead of being appended to. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-01-12net/dns/resolver: handle tabs as whitespace when ExitDNS parses resolv.confBrad Fitzpatrick1-0/+10
On Synology, the /etc/resolv.conf has tabs in it, which this resolv.conf parser (we have two, sigh) didn't handle. Updates #3710 Change-Id: I86f8e09ad1867ee32fa211e85c382a27191418ea Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-11net/netns: remove a useless probe of the "ip" commandBrad Fitzpatrick1-3/+1
We stopped using it in 1.18. Change-Id: If5adf1d99275286a89e2a05f0bce5193d9f6e5e3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-11cmd/tailscale: let 'tailscale up --reset' do a pref editBrad Fitzpatrick2-1/+10
The --reset shouldn't imply that a Backend.Start is necessary. With this, it can do a Backend.EditPrefs instead, which then doesn't do all the heavy work that Start does. Also, Start on Windows behaves slightly differently than Linux etc in some cases because of tailscaled running in client mode on Windows (where the GUI supplies the prefs). Fixes #3702 Change-Id: I75c9f08d5e0052bf623074030a3a7fcaa677abf6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-11net/dns: make WSL network configuration opt-in for nowBrad Fitzpatrick1-7/+13
Tailscale seems to be breaking WSL configurations lately. Until we understand what changed, turn off Tailscale's involvement by default and make it opt-in. Updates #2815 Change-Id: I9977801f8debec7d489d97761f74000a4a33f71b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-11scripts: install gnupg deb, pass --yes to apt-getBrad Fitzpatrick1-4/+3
Fixes #3685 Fixes #3528 Fixes #3649 Change-Id: Ie029fca6cf3d07a77d228e9591ec1c1c828e68af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-11net/dns: teach OpenBSD's manager to talk to resolvd(8). (#2789)Aaron Bieber2-2/+206
OpenBSD 6.9 and up has a daemon which handles nameserver configuration. This PR teaches the OpenBSD dns manager to check if resolvd is being used. If it is, it will use the route(8) command to tell resolvd to add the Tailscale dns entries to resolv.conf Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>
2022-01-11cmd/derper: in manual cert mode, don't discard error from VerifyHostnameBrad Fitzpatrick1-2/+2
Updates #3701 Change-Id: If8ca5104bd8221c99cc390ca49ee3401aff09b62 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-10.github: Bump actions/setup-go from 2.1.4 to 2.1.5dependabot[bot]14-14/+14
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 2.1.4 to 2.1.5. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v2.1.4...v2.1.5) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.