summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2024-11-09derp: add a unique.Make-vs-local map benchmarkbradfitz/benchBrad Fitzpatrick1-0/+38
goos: darwin goarch: arm64 pkg: tailscale.com/derp cpu: Apple M1 BenchmarkUnique-8 139699720 10.59 ns/op BenchmarkUnique-8 138409840 8.619 ns/op BenchmarkUnique-8 134697708 8.521 ns/op BenchmarkUnique-8 136568799 8.653 ns/op BenchmarkUnique-8 134478981 8.647 ns/op BenchmarkLocalMap-8 675015452 1.643 ns/op BenchmarkLocalMap-8 717245598 1.648 ns/op BenchmarkLocalMap-8 697626253 1.657 ns/op BenchmarkLocalMap-8 729024962 1.670 ns/op BenchmarkLocalMap-8 712870580 1.668 ns/op PASS ok tailscale.com/derp 19.038s Updates tailscale/corp#24485 Change-Id: Ie8008b07c8c4625cf2b83e38eff169e2248b2d05 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-08safeweb: add a Shutdown method to the Server type (#14048)M. J. Fromberger1-0/+5
Updates #14047 Change-Id: I2d20454c715b11ad9c6aad1d81445e05a170c3a2 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2024-11-08ipn/ipnlocal: log a summary of posture identity responseAnton Tolchanov1-0/+2
Perhaps I was too opimistic in #13323 thinking we won't need logs for this. Let's log a summary of the response without logging specific identifiers. Updates tailscale/corp#24437 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-11-07derp/derphttp: don't link websockets other than on GOOS=jsBrad Fitzpatrick11-26/+56
Or unless the new "ts_debug_websockets" build tag is set. Updates #1278 Change-Id: Ic4c4f81c1924250efd025b055585faec37a5491d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-07control/controlhttp/controlhttpserver: split out Accept to its own packageBrad Fitzpatrick10-42/+68
Otherwise all the clients only using control/controlhttp for the ts2021 HTTP client were also pulling in WebSocket libraries, as the server side always needs to speak websockets, but only GOOS=js clients speak it. This doesn't yet totally remove the websocket dependency on Linux because Linux has a envknob opt-in to act like GOOS=js for manual testing and force the use of WebSockets for DERP only (not control). We can put that behind a build tag in a future change to eliminate the dep on all GOOSes. Updates #1278 Change-Id: I4f60508f4cad52bf8c8943c8851ecee506b7ebc9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-07cmd/tailscaled: support "ts_omit_ssh" build tag to remove SSHBrad Fitzpatrick3-2/+33
Some environments would like to remove Tailscale SSH support for the binary for various reasons when not needed (either for peace of mind, or the ~1MB of binary space savings). Updates tailscale/corp#24454 Updates #1278 Updates #12614 Change-Id: Iadd6c5a393992c254b5dc9aa9a526916f96fd07a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-07client/tailscale,ipn/{ipnlocal,localapi}: add a pre-shutdown localAPI ↵Irbe Krumina3-0/+41
endpoint that terminates control connections. (#14028) Adds a /disconnect-control local API endpoint that just shuts down control client. This can be run before shutting down an HA subnet router/app connector replica - it will ensure that all connection to control are dropped and control thus considers this node inactive and tells peers to switch over to another replica. Meanwhile the existing connections keep working (assuming that the replica is given some graceful shutdown period). Updates tailscale/tailscale#14020 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-07tsweb/varz: optimize some allocs, add helper func for othersBrad Fitzpatrick1-2/+8
Updates #cleanup Updates tailscale/corp#23546 (noticed when doing this) Change-Id: Ia9f627fe32bb4955739b2787210ba18f5de27f4d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-07envknob,kube/kubetypes,cmd/k8s-operator: add app type for ProxyGroup (#14029)Irbe Krumina4-9/+17
Sets a custom hostinfo app type for ProxyGroup replicas, similarly to how we do it for all other Kubernetes Operator managed components. Updates tailscale/tailscale#13406,tailscale/corp#22920 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-06cmd/derper: show more information on home pagePercy Wegmann3-19/+92
- Basic description of DERP If configured to do so, also show - Mailto link to security@tailscale.com - Link to Tailscale Security Policies - Link to Tailscale Acceptable Use Policy Updates tailscale/corp#24092 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-11-05licenses: update license noticesLicense Updater1-2/+2
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2024-11-05types/result, util/lineiter: add package for a result type, use itBrad Fitzpatrick20-138/+289
This adds a new generic result type (motivated by golang/go#70084) to try it out, and uses it in the new lineutil package (replacing the old lineread package), changing that package to return iterators: sometimes over []byte (when the input is all in memory), but sometimes iterators over results of []byte, if errors might happen at runtime. Updates #12912 Updates golang/go#70084 Change-Id: Iacdc1070e661b5fb163907b1e8b07ac7d51d3f83 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-04cmd/k8s-operator: allow to optionally configure tailscaled port (#14005)Irbe Krumina1-0/+8
Updates tailscale/tailscale#13981 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-03tsnet: add accessor to get tsd.SystemBrad Fitzpatrick1-0/+9
Pulled of otherwise unrelated PR #13884. Updates tailscale/corp#22075 Change-Id: I5b539fcb4aca1b93406cf139c719a5e3c64ff7f7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-03cmd/tsconnect: block after starting esbuild dev serverBrad Fitzpatrick1-0/+1
Thanks to @davidbuzz for raising the issue in #13973. Fixes #8272 Fixes #13973 Change-Id: Ic413e14d34c82df3c70a97e591b90316b0b4946b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-01net/socks5: optimize UDP relayVimT2-99/+119
Key changes: - No mutex for every udp package: replace syncs.Map with regular map for udpTargetConns - Use socksAddr as map key for better type safety - Add test for multi udp target Updates #7581 Change-Id: Ic3d384a9eab62dcbf267d7d6d268bf242cc8ed3c Signed-off-by: VimT <me@vimt.me>
2024-11-01net/socks5: fix UDP relay in userspace-networking modeVimT1-38/+63
This commit addresses an issue with the SOCKS5 UDP relay functionality when using the --tun=userspace-networking option. Previously, UDP packets were not being correctly routed into the Tailscale network in this mode. Key changes: - Replace single UDP connection with a map of connections per target - Use c.srv.dial for creating connections to ensure proper routing Updates #7581 Change-Id: Iaaa66f9de6a3713218014cf3f498003a7cac9832 Signed-off-by: VimT <me@vimt.me>
2024-11-01wgengine/netstack: remove unused taildrive depsBrad Fitzpatrick5-22/+17
A filesystem was plumbed into netstack in 993acf4475b22d693 but hasn't been used since 2d5d6f5403f3. Remove it. Noticed while rebasing a Tailscale fork elsewhere. Updates tailscale/corp#16827 Change-Id: Ib76deeda205ffe912b77a59b9d22853ebff42813 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-01ipn/ipnlocal: reload prefs correctly on ReloadConfigMaisem Ali2-22/+85
We were only updating the ProfileManager and not going down the EditPrefs path which meant the prefs weren't applied till either the process restarted or some other pref changed. This makes it so that we reconfigure everything correctly when ReloadConfig is called. Updates #13032 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-11-01Fix MagicDNS on OpenBSDRenato Aguiar1-1/+1
Add OpenBSD to the list of platforms that need DNS reconfigured on link changes. Signed-off-by: Renato Aguiar <renato@renatoaguiar.net>
2024-10-31net/netcheck: add addReportHistoryAndSetPreferredDERP() test case (#13989)Jordan Whited1-0/+9
Add an explicit case for exercising preferred DERP hysteresis around the branch that compares latencies on a percentage basis. Updates #cleanup Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-10-31util/syspolicy: add policy key for onboarding flow visibilityAaron Klotz1-0/+4
Updates https://github.com/tailscale/corp/issues/23789 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2024-10-31safeweb: add support for custom CSP (#13975)Andrew Lytvynov2-24/+92
To allow more flexibility with CSPs, add a fully customizable `CSP` type that can be provided in `Config` and encodes itself into the correct format. Preserve the `CSPAllowInlineStyles` option as is today, but maybe that'll get deprecated later in favor of the new CSP field. In particular, this allows for pages loading external JS, or inline JS with nonces or hashes (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_inline_script) Updates https://github.com/tailscale/corp/issues/8027 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2024-10-31net/sockstats: prevent crash in setNetMon (#13985)Andrea Gottardo1-1/+7
2024-10-31safeweb: add support for "/" and "/foo" handler distinction (#13980)Andrew Lytvynov2-3/+24
By counting "/" elements in the pattern we catch many scenarios, but not the root-level handler. If either of the patterns is "/", compare the pattern length to pick the right one. Updates https://github.com/tailscale/corp/issues/8027 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2024-10-31cmd/tailscale/cli, client/tailscale, ipn/localapi: add tailscale syspolicy ↵Nick Khyl6-2/+191
{list,reload} commands In this PR, we add the tailscale syspolicy command with two subcommands: list, which displays policy settings, and reload, which forces a reload of those settings. We also update the LocalAPI and LocalClient to facilitate these additions. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-31ipn,tailcfg: add app connector config knob to conffile (#13942)Irbe Krumina2-1/+8
Make it possible to advertise app connector via a new conffile field. Also bumps capver - conffile deserialization errors out if unknonw fields are set, so we need to know which clients understand the new field. Updates tailscale/tailscale#11113 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-31wgengine/magicsock: export packet drop metric for outbound errorsAnton Tolchanov7-38/+127
This required sharing the dropped packet metric between two packages (tstun and magicsock), so I've moved its definition to util/usermetric. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-10-31wgengine/magicsock: exclude disco from throughput metricsAnton Tolchanov3-10/+14
The user-facing metrics are intended to track data transmitted at the overlay network level. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-10-30net/netcheck: ensure prior preferred DERP is always in netchecksJames Tucker2-17/+93
In an environment with unstable latency, such as upstream bufferbloat, there are cases where a full netcheck could drop the prior preferred DERP (likely home DERP) from future netcheck probe plans. This will then likely result in a home DERP having a missing sample on the next incremental netcheck, ultimately resulting in a home DERP move. This change does not fix our overall response to highly unstable latency, but it is an incremental improvement to prevent single spurious samples during a full netcheck from alone triggering a flapping condition, as now the prior changes to include historical latency will still provide the desired resistance, and the home DERP should not move unless latency is consistently worse over a 5 minute period. Note that there is a nomenclature and semantics issue remaining in the difference between a report preferred DERP and a home DERP. A report preferred DERP is aspirational, it is what will be picked as a home DERP if a home DERP connection needs to be established. A nodes home DERP may be different than a recent preferred DERP, in which case a lot of netcheck logic is fallible. In future enhancements much of the DERP move logic should move to consider the home DERP, rather than recent report preferred DERP. Updates #8603 Updates #13969 Signed-off-by: James Tucker <james@tailscale.com>
2024-10-30util/syspolicy/source: put EnvPolicyStore env keys in their own namespaceBrad Fitzpatrick2-41/+46
... all prefixed with TS_DEBUGSYSPOLICY_*. Updates #13193 Updates #12687 Updates #13855 Change-Id: Ia8024946f53e2b3afda4456a7bb85bbcf6d12bfc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-30util/syspolicy/setting: make setting.Snapshot JSON-marshallableNick Khyl2-0/+180
We make setting.Snapshot JSON-marshallable in preparation for returning it from the LocalAPI. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-30util/syspolicy/setting: make setting.RawItem JSON-marshallableNick Khyl4-141/+336
We add setting.RawValue, a new type that facilitates unmarshalling JSON numbers and arrays as uint64 and []string (instead of float64 and []any) for policy setting values. We then use it to make setting.RawItem JSON-marshallable and update the tests. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-30util/syspolicy/source: use errors instead of github.com/pkg/errorsNick Khyl1-1/+1
Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-30util/syspolicy: implement a syspolicy store that reads settings from ↵Nick Khyl5-5/+518
environment variables In this PR, we implement (but do not use yet, pending #13727 review) a syspolicy/source.Store that reads policy settings from environment variables. It converts a CamelCase setting.Key, such as AuthKey or ExitNodeID, to a SCREAMING_SNAKE_CASE, TS_-prefixed environment variable name, such as TS_AUTH_KEY and TS_EXIT_NODE_ID. It then looks up the variable and attempts to parse it according to the expected value type. If the environment variable is not set, the policy setting is considered not configured in this store (the syspolicy package will still read it from other sources). Similarly, if the environment variable has an invalid value for the setting type, it won't be used (though the reported/logged error will differ). Updates #13193 Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-30cmd/k8s-operator,k8s-operator: add topology spread constraints to ProxyClass ↵Irbe Krumina7-0/+378
(#13959) Now when we have HA for egress proxies, it makes sense to support topology spread constraints that would allow users to define more complex topologies of how proxy Pods need to be deployed in relation with other Pods/across regions etc. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-29wgengine/magicsock: log home DERP changes with latencyTim Walters1-3/+8
This adds additional logging on DERP home changes to allow better troubleshooting. Updates tailscale/corp#18095 Signed-off-by: Tim Walters <tim@tailscale.com>
2024-10-29tstest/tailmac: add support for mounting host directories in the guest (#13957)Jonathan Nobels5-14/+35
updates tailscale/corp#24197 tailmac run now supports the --share option which will allow you to specify a directory on the host which can be mounted in the guest using mount_virtiofs vmshare <path>. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2024-10-29tstest/tailmac: fix Host.app path generation (#13953)Jonathan Nobels1-2/+5
updates tailscale/corp#24197 Generation of the Host.app path was erroneous and tailmac run would not work unless the pwd was tailmac/bin. Now you can be able to invoke tailmac from anywhere. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2024-10-29cmd/tailscale/cli: add 'tailscale metrics' commandAnton Tolchanov3-9/+91
- `tailscale metrics print`: to show metric values in console - `tailscale metrics write`: to write metrics to a file (with a tempfile & rename dance, which is atomic on Unix). Also, remove the `TS_DEBUG_USER_METRICS` envknob as we are getting more confident in these metrics. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-10-29ipn/ipnlocal: remove the primary routes gauge for nowAnton Tolchanov2-21/+0
Not confident this is the right way to expose this, so let's remote it for now. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-10-29wgengine/magicsock: fix stats packet counter on derp egressAnton Tolchanov1-1/+1
Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-10-29ipn/ipnlocal: log errors while fetching serial numbersAnton Tolchanov1-4/+2
If the client cannot fetch a serial number, write a log message helping the user understand what happened. Also, don't just return the error immediately, since we still have a chance to collect network interface addresses. Updates #5902 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-10-28tool/gocross: remove trimpath from test buildsJames Tucker2-2/+5
trimpath can be inconvenient for IDEs and LSPs that do not always correctly handle module relative paths, and can also contribute to caching bugs taking effect. We rarely have a real need for trimpath of test produced binaries, so avoiding it should be a net win. Updates #2988 Signed-off-by: James Tucker <james@tailscale.com>
2024-10-28tstest/natlab: add latency & loss simulationJames Tucker3-3/+56
A simple implementation of latency and loss simulation, applied to writes to the ethernet interface of the NIC. The latency implementation could be optimized substantially later if necessary. Updates #13355 Signed-off-by: James Tucker <james@tailscale.com>
2024-10-28licenses: update license noticesLicense Updater2-8/+8
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2024-10-28net/dns: fix blank lines being added to resolv.conf on OpenBSD (#13928)Renato Aguiar1-1/+2
During resolv.conf update, old 'search' lines are cleared but '\n' is not deleted, leaving behind a new blank line on every update. This adds 's' flag to regexp, so '\n' is included in the match and deleted when old lines are cleared. Also, insert missing `\n` when updated 'search' line is appended to resolv.conf. Signed-off-by: Renato Aguiar <renato@renatoaguiar.net>
2024-10-27ipn/store/kubestore: don't error if state cannot be preloaded (#13926)Irbe Krumina1-1/+1
Preloading of state from kube Secret should not error if the Secret does not exist. Updates tailscale/tailscale#7671 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-26ipn/store/kubestore: cache state in memory (#13918)Irbe Krumina2-31/+67
Cache state in memory on writes, read from memory in reads. kubestore was previously always reading state from a Secret. This change should fix bugs caused by temporary loss of access to kube API server and imporove overall performance Fixes #7671 Updates tailscale/tailscale#12079,tailscale/tailscale#13900 Signed-off-by: Maisem Ali <maisem@tailscale.com> Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Maisem Ali <maisem@tailscale.com>
2024-10-26cmd/k8s-operator: validate that tailscale.com/tailnet-ip annotation value is ↵Nick Kirby2-3/+150
a valid IP Fixes #13836 Signed-off-by: Nick Kirby <nrkirb@gmail.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.