summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2022-04-26wgengine/netstack: close forwarded TCP connections when incoming TCP diesbradfitz/netstack_fwd_closeBrad Fitzpatrick1-4/+8
Updates #4522 Change-Id: I31a430da422b1e5fab834a2a670cddf448889ee6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-26net/tshttpproxy: fix typoBrad Fitzpatrick1-1/+1
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-26cmd/tailscale: mostly fix 'tailscale ssh' on macOS (sandbox)Brad Fitzpatrick1-25/+37
Still a little wonky, though. See the tcsetattr error and inability to hit Ctrl-D, for instance: bradfitz@laptop ~ % tailscale.app ssh foo@bar tcsetattr: Operation not permitted # Authentication checked with Tailscale SSH. # Time since last authentication: 1h13m22s foo@bar:~$ ^D ^D ^D Updates #4518 Updates #4529 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-26cmd/tailscale/cli: add 'debug stat' subcommandBrad Fitzpatrick1-0/+27
For debugging what's visible inside the macOS sandbox. But could also be useful for giving users portable commands during debugging without worrying about which OS they're on. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-25safesocket: fix CLI on standalone mac GUI buildBrad Fitzpatrick1-62/+13
Tested three macOS Tailscale daemons: - App Store (Network Extension) - Standalone (macsys) - tailscaled And two types of local IPC each: - IPN - HTTP And two CLI modes: - sandboxed (running the GUI binary as the CLI; normal way) - open source CLI hitting GUI (with #4525) Bonus: simplifies the code. Fixes tailscale/corp#4559 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-25ipn: add IPCVersion override funcBrad Fitzpatrick3-10/+23
I've done this a handful of times in the past and again today. Time to make it a supported thing for the future. Used while debugging tailscale/corp#4559 (macsys CLI issues) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-25cmd/tailscale: s/-authkey/-auth-key/ in help textJames Tucker1-1/+1
Signed-off-by: James Tucker <james@tailscale.com>
2022-04-25net/dns/resolver: add metric for number of truncated dns packetsTom DNetto2-2/+28
Updates #2067 This should help us determine if more robust control of edns parameters + implementing answer truncation is warranted, given its likely complexity. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-04-25wgengine/monitor: do not ignore changes to pdp_ip*Maisem Ali1-1/+2
One current theory (among other things) on battery consumption is that magicsock is resorting to using the IPv6 over LTE even on WiFi. One thing that could explain this is that we do not get link change updates for the LTE modem as we ignore them in this list. This commit makes us not ignore changes to `pdp_ip` as a test. Updates #3363 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-25ipn/ipnlocal: do not initialize peer api listeners when shutting downMaisem Ali2-1/+6
Updates tailscale/corp#4824 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-23net/dns: add tailscaled-on-macOS DNS OSConfiguratorBrad Fitzpatrick2-2/+129
This populates DNS suffixes ("ts.net", etc) in /etc/resolver/* files to point to 100.100.100.100 so MagicDNS works. It also sets search domains. Updates #4276 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-22tsnet: fix mem.Store check for normal nodesMaisem Ali1-2/+3
There was a typo in the check it was doing `!ok` instead of `ok`, this restructures it a bit to read better. Fixes #4506 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-22VERSION.txt: This is 1.25.0Denton Gentry1-1/+1
Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2022-04-22wgengine/{,magicsock}: add metrics for rebinds and restunsMaisem Ali2-2/+15
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-22net/dns/resolver: support magic resolution of via-<siteid>.<ip4> domainsTom DNetto2-0/+48
Updates #3616 Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-04-21util/mak: move tailssh's mapSet into a new package for reuse elsewhereBrad Fitzpatrick8-34/+140
Change-Id: Idfe95db82275fd2be6ca88f245830731a0d5aecf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-21ssh/tailssh: avoid user ssh configuration in testsJames Tucker1-0/+2
Signed-off-by: James Tucker <james@tailscale.com>
2022-04-21tshttpproxy: support synology proxy configurationJames Tucker3-0/+446
Fixes #4395 Fixes #2605 Signed-off-by: James Tucker <james@tailscale.com>
2022-04-21cmd/tailscale: use double quotes in the ssh subcommandsMaisem Ali4-11/+4
Single-quote escaping is insufficient apparently. Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-21cmd/tailscale/cli: do not use syscall.Exec from macOS sandboxMaisem Ali1-2/+3
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-21shell.nix: update go toolchainTom DNetto1-2/+2
Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-04-21ssh/tailssh: various typo fixes, clarifications.David Anderson2-18/+19
Signed-off-by: David Anderson <danderson@tailscale.com>
2022-04-21ssh/tailssh: simplify matchRule with Reject rulesBrad Fitzpatrick1-1/+4
Updates #3802 Change-Id: I59fe111eef5ac8abbcbcec922e293712a65a4830 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-21ssh/tailssh: chmod the auth socket to be only user accessibleMaisem Ali1-1/+5
Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-21ssh/tailssh: set groups and gid in the incubated processMaisem Ali2-4/+32
Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-21ssh/tailssh: filter accepted environment variablesBrad Fitzpatrick2-1/+35
Noted by @danderson Updates #3802 Change-Id: Iac70717ed57f11726209ac1ea93ddc6696605f94 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-21tailcfg: fix typo in SessionDuration field nameBrad Fitzpatrick2-5/+5
Noted by @danderson. Updates #3802 Change-Id: Ide15f3f28e30f6abb5c94d7dcd218bd9482752a0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-21ssh/tailssh: add support for sftpMaisem Ali3-45/+103
Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-21Revert "wgengine/router,util/kmod: load & log xt_mark"Brad Fitzpatrick6-225/+0
This reverts commit 8d6793fd7047d1c9b59e939e7644edbb75b4790f. Reason: breaks Android build (cgo/pthreads addition) We can try again next cycle. Change-Id: I5e7e1730a8bf399a8acfce546a6d22e11fb835d5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-21net/dns/resolver, net/tsaddr: fix reverse lookups in 4to6 IP rangeTom DNetto3-2/+29
Fixes #4439 Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-04-20wgengine/router,util/kmod: load & log xt_markJames Tucker6-0/+225
Attempt to load the xt_mark kernel module when it is not present. If the load fails, log error information. It may be tempting to promote this failure to an error once it has been in use for some time, so as to avoid reaching an error with the iptables invocation, however, there are conditions under which the two stages may disagree - this change adds more useful breadcrumbs. Example new output from tailscaled running under my WSL2: ``` router: ensure module xt_mark: "/usr/sbin/modprobe xt_mark" failed: exit status 1; modprobe: FATAL: Module xt_mark not found in directory /lib/modules/5.10.43.3-microsoft-standard-WSL2 ``` Background: There are two places to lookup modules, one is `/proc/modules` "old", the other is `/sys/module/` "new". There was query_modules(2) in linux <2.6, alas, it is gone. In a docker container in the default configuration, you would get /proc/modules and /sys/module/ both populated. lsmod may work file, modprobe will fail with EPERM at `finit_module()` for an unpriviliged container. In a priviliged container the load may *succeed*, if some conditions are met. This condition should be avoided, but the code landing in this change does not attempt to avoid this scenario as it is both difficult to detect, and has a very uncertain impact. In an nspawn container `/proc/modules` is populated, but `/sys/module` does not exist. Modern `lsmod` versions will fail to gather most module information, without sysfs being populated with module information. In WSL2 modules are likely missing, as the in-use kernel typically is not provided by the distribution filesystem, and WSL does not mount in a module filesystem of its own. Notably the WSL2 kernel supports iptables marks without listing the xt_mark module in /sys/module, and /proc/modules is empty. On a recent kernel, we can ask the capabilities system about SYS_MODULE, that will help to disambiguate between the non-privileged container case and just being root. On older kernels these calls may fail. Update #4329 Signed-off-by: James Tucker <james@tailscale.com>
2022-04-20tailcfg: document SSHPrincipal.PubKeys URL expansionsBrad Fitzpatrick1-0/+4
From f74ee80abe8819f3d3bfd9138056a46820f4fc54 which lacked docs. Updates #3802 Change-Id: Ia7df05a486ae383cc6d9aca9dfe487b04e243ad5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20ssh/tailssh: fix double SSH-2.0- prefix in greeting bannerBrad Fitzpatrick1-1/+1
gliderlabs/ssh was already adding the "SSH-2.0-" prefix. Updates #3802 Change-Id: I19a1cd9308371a2898e7883cf26e94c9b54bab29 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20ipn/ipnlocal: close peerapi listeners on LocalBackend.ShutdownBrad Fitzpatrick1-0/+1
For tests. Now that we can always listen (whereas we used to fail prior to a2c330c4961aea883a674aa530cc40bf74047bac), some goroutine leak checks were failing in tests in another repo after that change. Change-Id: Id95a4b71167eca61962a48616d79741b9991e0bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20ssh/tailssh: send banner messages during auth, move more to connMaisem Ali8-193/+212
(VSCode Live Share between Brad & Maisem!) Updates #3802 Change-Id: Id8edca4481b0811debfdf56d4ccb1a46f71dd6d3 Co-Authored-By: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-20scripts/install: add Alma Linux.Denton Gentry1-1/+1
Tested using an Alma Linux 8.5 VM. Updates https://github.com/tailscale/tailscale/issues/2915 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2022-04-20scripts/installer: support LinuxMint Debian.Denton Gentry1-7/+20
The primary distribution for LinuxMint is based on Ubuntu, but there is an alternate Debian-based distribution called LMDE. Both variations identify themselves as "linuxmint" We added UBUNTU_VERSION to the Ubuntu handling for linuxmint, the only distribution so far found to do this. Instead, split linuxmint out into its own case and use either UBUNTU_VERSION or DEBIAN_VERSION, whichever is present. Tested on an LMDE 5 (elsie) VM. Updates https://github.com/tailscale/tailscale/issues/2915 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2022-04-20scripts/installer: call emerge with --ask=nDenton Gentry1-1/+1
Fixes https://github.com/tailscale/tailscale/issues/4354 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2022-04-20scripts/installer: add ParrotOS supportDenton Gentry1-0/+11
Support ParrotSec https://parrotsec.org/ Tested using a Parrot 5.0 VM. Updates https://github.com/tailscale/tailscale/issues/2915 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2022-04-20cmd/tailscale: add "debug via" subcommand to do CIDR math for via rangesBrad Fitzpatrick2-0/+67
$ tailscale debug via 0xb 10.2.0.0/16 fd7a:115c:a1e0:b1a:0:b:a02:0/112 $ tailscale debug via fd7a:115c:a1e0:b1a:0:b:a02:0/112 site 11 (0xb), 10.2.0.0/16 Previously: 3ae701f0ebe053a1f7b6a3fa345a56b3132c818f This adds a little debug tool to do CIDR math to make converting between those ranges easier for now. Updates #3616 Change-Id: I98302e95d17765bfaced3ecbb71cbd43e84bff46 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20ssh/tailssh: support expansions in public key fetch URL tooBrad Fitzpatrick2-1/+37
Updates #3802 Change-Id: I5aa98bdab14fd1c1c00ba63b93f8d7e670f72437 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20ssh/tailssh: terminate ssh auth early if no policy can matchMaisem Ali5-154/+221
Also bump github.com/tailscale/golang-x-crypto/ssh Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-20ipn/ipnlocal: use the fake peerapi listener as fallback if netstack availableBrad Fitzpatrick1-2/+9
The previous commit (1b89662eff) this for Android, but we can also use this on any platform if we we would otherwise fail. Change-Id: I4cd78b40e9e77fca5cc8e717dd48ac173101bed4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20wgengine/monitor: split the unexpected stringification log lineMaisem Ali1-2/+3
It unfortuantely gets truncated because it's too long, split it into 3 different log lines to circumvent truncation. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-20wgengine/monitor: ignore OS-specific uninteresting interfacesMaisem Ali6-4/+32
Currently we ignore these interfaces in the darwin osMon but then would consider it interesting when checking if anything had changed. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-20ipn/ipnlocal: make peerapi listener on Android avoid the kernelBrad Fitzpatrick1-0/+54
We intercept the peerapi port in netstack anyway, so there's no reason the linux kernel on Android needs to know about it. It's only getting in the way and causing problems for reasons we don't fully understand. But we don't even need to understand it because it's not relevant anymore. Instead, provide a dummy net.Listener that just sits and blocks to pacify the rest of the code that assumes it can be stuck in a Listener.Accept call and call Listener.Close and Listener.Addr. We'll likely do this for all platforms in the future, if/when we also link in netstack on iOS. Updates #4449 Updates #4293 Updates #3986 Change-Id: Ic2d3fe2f3cee60fc527356a3368830f17aeb75ae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20tstest/iosdeps: add test for forbidden iOS dependenciesBrad Fitzpatrick2-0/+104
Fixes #4463 Change-Id: I8305710e8a075263ae9a88a29624b19032d5beeb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20ipn/ipnlocal: reject tailscale up --ssh if disabled on tailnetBrad Fitzpatrick3-2/+12
Updates #3802 Change-Id: I3f1e839391fe9b28270f506f4bb8d8e3d36716f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20wgengine/router: make supportsV6NAT check catch more casesBrad Fitzpatrick1-2/+8
Updates #4459 Change-Id: Ic27621569d2739298e652769d10e38608c6012be Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20cmd/nginx-auth: maintainer scripts and tailnet checking (#4460)Xe Iaso9-11/+107
* cmd/nginx-auth: add maintainer scripts Signed-off-by: Xe <xe@tailscale.com> * cmd/nginx-auth: add Expected-Tailnet header and documentation Signed-off-by: Xe <xe@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.