summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2022-10-11cmd/ssh-auth-none-demo: WIP demo of KeyboardInteractivebradfitz/keyboard-interactiveBrad Fitzpatrick1-23/+21
Change-Id: I59525f2070ecdaaa5ebf140f39c665e906116c24 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-11ssh/tailssh: add password-forcing workaround for buggy SSH clientsBrad Fitzpatrick5-16/+91
If the username includes a suffix of +password, then we accept password auth and just let them in like it were no auth. This exists purely for SSH clients that get confused by seeing success to their initial auth type "none". Co-authored-by: Maisem Ali <maisem@tailscale.com> Change-Id: I616d4c64d042449fb164f615012f3bae246e91ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-11cmd/tailscaled: handle tailscaled symlink on macOSAnton Tolchanov1-19/+63
When Tailscale is installed via Homebrew, `/usr/local/bin/tailscaled` is a symlink to the actual binary. Now when `tailscaled install-system-daemon` runs, it will not attempt to overwrite that symlink if it already points to the tailscaled binary. However, if executed binary and the link target differ, the path will he overwritten - this can happen when a user decides to replace Homebrew-installed tailscaled with a one compiled from source code. Fixes #5353 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2022-10-11scripts/installer.sh: add OSMCDenton Gentry1-0/+7
Fixes https://github.com/tailscale/tailscale/issues/4960 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2022-10-10all: fix more resource leaks found by staticmajorEmmanuel T Odeke7-3/+45
Updates #5706 Signed-off-by: Emmanuel T Odeke <emmanuel@orijtech.com>
2022-10-10tsweb: sort top-level expvars after removing type prefixesBrad Fitzpatrick2-1/+51
Fixes #5778 Change-Id: I56c367338fa5686da288cc6545209ef4d6b88549 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-10cmd/ssh-auth-none-demo: put the hostname in the package docBrad Fitzpatrick1-3/+4
188.166.70.128 port 2222 for now. Some hostname later maybe. Change-Id: I9c329410035221ed6cdff7a482727d30b77eea8b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-10cmd/ssh-auth-none-demo: add banner as part of the demoMaisem Ali1-1/+16
Send two banners with a second in between, this demonstrates the case where all banners are shown after auth completes and not during. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-10tsweb: remove allocs introduced by earlier changeBrad Fitzpatrick2-28/+76
This removes the ~9 allocs added by #5869, while still keeping struct fields sorted (the previous commit's tests still pass). And add a test to lock it in that this shouldn't allocate. Updates #5778 Change-Id: I4c12b9e2a1334adc1ea5aba1777681cb9fc18fbf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-09licenses: update win/apple licensesLicense Updater1-1/+1
Signed-off-by: License Updater <noreply@tailscale.com>
2022-10-09cmd/ssh-auth-none-demo: add demo SSH server that acts like Tailscale SSHBrad Fitzpatrick1-0/+171
For SSH client authors to fix their clients without setting up Tailscale stuff. Change-Id: I8c7049398512de6cb91c13716d4dcebed4d47b9c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-09ipn/localapi: put all the LocalAPI methods into a mapBrad Fitzpatrick1-66/+79
Rather than a bunch of switch cases. Change-Id: Id1db813ec255bfab59cbc982bee351eb36373245 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-09ssh/tailssh: close sshContext on context cancellationMaisem Ali2-10/+13
This was preventing tailscaled from shutting down properly if there were active sessions in certain states (e.g. waiting in check mode). Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-09tsweb: sort varz by name after stripping prefix (#5778)Hasnain Lakhani2-20/+95
This makes it easier to view prometheus metrics. Added a test case which demonstrates the new behavior - the test initially failed as the output was ordered in the same order as the fields were declared in the struct (i.e. foo_a, bar_a, foo_b, bar_b). For that reason, I also had to change an existing test case to sort the fields in the new expected order. Signed-off-by: Hasnain Lakhani <m.hasnain.lakhani@gmail.com>
2022-10-09licenses: update tailscale{,d} licensesLicense Updater1-1/+1
Signed-off-by: License Updater <noreply@tailscale.com>
2022-10-09ssh/tailssh: add support for sending multiple bannersMaisem Ali6-79/+60
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-09licenses: update win/apple licensesLicense Updater2-5/+5
Signed-off-by: License Updater <noreply@tailscale.com>
2022-10-09ssh/tailssh: add TestSSHAuthFlowMaisem Ali3-15/+299
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-09ssh/tailssh: do the full auth flow during ssh authMaisem Ali5-332/+238
Fixes #5091 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-09licenses: update android licensesLicense Updater1-3/+3
Signed-off-by: License Updater <noreply@tailscale.com>
2022-10-07ipn/ipnlocal: fix taildrop target list UI bugBrad Fitzpatrick1-4/+21
The macOS and iOS apps that used the /localapi/v0/file-targets handler were getting too many candidate targets. They wouldn't actually accept the file. This is effectively just a UI glitch in the wrong hosts being listed as valid targets from the source side. Change-Id: I6907a5a1c3c66920e5ec71601c044e722e7cb888 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-07ssh/tailssh: do not send EOT on session disconnectionMaisem Ali1-3/+0
This was assumed to be the fix for mosh not working, however turns out all we really needed was the duplicate fd also introduced in the same commit (af412e8874e94dc3ac57c37c3ec5e0606aa08fbb). Fixes #5103 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-06wgengine/wgcfg: plumb down audit log IDs (#5855)Joe Tsai5-20/+64
The node and domain audit log IDs are provided in the map response, but are ultimately going to be used in wgengine since that's the layer that manages the tstun.Wrapper. Do the plumbing work to get this field passed down the stack. Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2022-10-06cmd/tsconnect: close the SSH session an unload event instead of beforeunloadMihai Parparita1-5/+5
The window may not end up getting unloaded (if other beforeunload handlers prevent the event), thus we should only close the SSH session if it's truly getting unloaded. Updates tailscale/corp#7304 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-10-06net/tstun: rename statististics method (#5852)Joe Tsai2-12/+12
Rename StatisticsEnable as SetStatisticsEnabled to be consistent with other similarly named methods. Rename StatisticsExtract as ExtractStatistics to follow the convention where methods start with a verb. It was originally named with Statistics as a prefix so that statistics related methods would sort well in godoc, but that property no longer holds. Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2022-10-05net/flowtrack: add json tags to Tuple (#5849)Joe Tsai1-3/+3
By convention, JSON serialization uses camelCase. Specify such names on the Tuple type. Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2022-10-05net/tunstats: add Counts.Add (#5848)Joe Tsai2-7/+11
The Counts.Add method merges two Counts together. Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2022-10-05logtail: always record timestamps in UTC (#5732)Joe Tsai1-2/+2
Upstream optimizations to the Go time package will make unmarshaling of time.Time 3-6x faster. See: * https://go.dev/cl/425116 * https://go.dev/cl/425197 * https://go.dev/cl/429862 The last optimization avoids a []byte -> string allocation if the timestamp string less than than 32B. Unfortunately, the presence of a timezone breaks that optimization. Drop recording of timezone as this is non-essential information. Most of the performance gains is upon unmarshal, but there is also a slight performance benefit to not marshaling the timezone as well. Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2022-10-05logtail: support a copy ID (#5851)Joe Tsai1-2/+7
The copy ID operates similar to a CC in email where a message is sent to both the primary ID and also the copy ID. A given log message is uploaded once, but the log server records it twice for each ID. Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2022-10-05net/tstun: instrument Wrapper with statistics gathering (#5847)Joe Tsai3-0/+58
If Wrapper.StatisticsEnable is enabled, then per-connection counters are maintained. If enabled, Wrapper.StatisticsExtract must be periodically called otherwise there is unbounded memory growth. Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2022-10-05ipn/ipnlocal: fix data race from missing lock in NetworkLockStatusTom DNetto1-0/+3
Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-10-05go.toolchain.rev: update to Go 1.19.2Brad Fitzpatrick1-1/+1
Changes: https://github.com/tailscale/go/commits/build-3fd24dee31726924c1b61c8037a889b30b8aa0f6 Change-Id: I61b83eef2b812879544a5226687606ae792b0786 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-05ipn/ipnlocal,tka: Fix bugs found by integration testingTom DNetto3-122/+82
* tka.State.staticValidateCheckpoint could call methods on a contained key prior to calling StaticValidate on that key * Remove broken backoff / RPC retry logic from tka methods in ipn/ipnlocal, to be fixed at a later time * Fix NetworkLockModify() which would attempt to take b.mu twice and deadlock, remove now-unused dependence on netmap * Add methods on ipnlocal.LocalBackend to be used in integration tests * Use TAILSCALE_USE_WIP_CODE as the feature flag so it can be manipulated in tests Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-10-05ipn/ipnlocal: filter peers with bad signatures when tka is enabledTom DNetto4-0/+101
Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-10-05tailcfg: add views for ControlDialPlan (#5843)Kristoffer Dalby3-3/+83
2022-10-04tsweb: allow HTTPError to unwrap errorsWill Norris2-0/+10
Signed-off-by: Will Norris <will@tailscale.com>
2022-10-04licenses: update tailscale{,d} licensesLicense Updater1-1/+1
Signed-off-by: License Updater <noreply@tailscale.com>
2022-10-04go.mod, ssh/tailssh: fix ImplictAuthMethod typoBrad Fitzpatrick3-4/+4
Fixes #5745 Change-Id: Ie8bc88bd465a9cb35b0ae7782d61ce96480473ee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-04cmd/pgproxy: link to blog post at the top.David Anderson1-1/+3
Signed-off-by: David Anderson <danderson@tailscale.com>
2022-10-04cmd/tsconnect: switch to non-beta versions of xterm and related packagesMihai Parparita2-15/+15
xterm 5.0 was released a few weeks ago, and it picks up xtermjs/xterm.js#4069, which was the main reason why we were on a 5.0 beta. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-10-04net/tunstats: new package to track per-connection counters (#5818)Joe Tsai2-0/+272
High-level API: type Statistics struct { ... } type Counts struct { TxPackets, TxBytes, RxPackets, RxBytes uint64 } func (*Statistics) UpdateTx([]byte) func (*Statistics) UpdateRx([]byte) func (*Statistics) Extract() map[flowtrack.Tuple]Counts The API accepts a []byte instead of a packet.Parsed so that a future implementation can directly hash the address and port bytes, which are contiguous in most IP packets. This will be useful for a custom concurrent-safe hashmap implementation. Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2022-10-04cmd/pgproxy: open-source our postgres TLS-enforcing proxy.David Anderson2-0/+406
From the original commit that implemented it: It accepts Postgres connections over Tailscale only, dials out to the configured upstream database with TLS (using strong settings, not the swiss cheese that postgres defaults to), and proxies the client through. It also keeps an audit log of the sessions it passed through, along with the Tailscale-provided machine and user identity of the connecting client. In our other repo, this was: commit 92e5edf98e8c2be362f564a408939a5fc3f8c539, Change-Id I742959faaa9c7c302bc312c7dc0d3327e677dc28. Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: David Anderson <danderson@tailscale.com>
2022-10-04licenses: update tailscale{,d} licensesLicense Updater1-2/+2
Signed-off-by: License Updater <noreply@tailscale.com>
2022-10-04Address GO-2022-0969Florian Lehner2-8/+6
HTTP/2 server connections can hang forever waiting for a clean shutdown that was preempted by a fatal error. This condition can be exploited by a malicious client to cause a denial of service. Signed-off-by: Florian Lehner <dev@der-flo.net>
2022-10-04Address GO-2020-0042Florian Lehner2-1/+4
Due to improper path santization, RPMs containing relative file paths can cause files to be written (or overwritten) outside of the target directory. Signed-off-by: Florian Lehner <dev@der-flo.net>
2022-10-04wgengine/magicsock: make debug-level stuff not logged by defaultBrad Fitzpatrick10-21/+241
And add a CLI/localapi and c2n mechanism to enable it for a fixed amount of time. Updates #1548 Change-Id: I71674aaf959a9c6761ff33bbf4a417ffd42195a7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-04cmd/tailscale/cli: add --record flag to bugreport (#5826)Andrew Dunham1-0/+19
Change-Id: I02bdc37a5c1a5a5d030c136ec5e84eb4c9ab1752 Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-10-04wgengine: don't re-allocate trimmedNodes map (#5825)Andrew Dunham2-5/+11
Change-Id: I512945b662ba952c47309d3bf8a1b243e05a4736 Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-10-03licenses: update win/apple licensesLicense Updater2-2/+2
Signed-off-by: License Updater <noreply@tailscale.com>
2022-10-03ipn/localapi: print hostinfo and health on bugreport (#5816)Andrew Dunham1-0/+9
This information is super helpful when debugging and it'd be nice to not have to scroll around in the logs to find it near a bugreport. Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.