summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2026-03-10tsnet: add opt-in SSH supportbradfitz/ssh_tsnetBrad Fitzpatrick5-0/+487
This adds tsnet.Server.ListenSSH which, if the SSH feature is linked, returns a net.Listener whose Accept yields *tailssh.Session values (as net.Conn). This lets tsnet apps accept incoming SSH connections to implement custom TUI applications. Basic apps can use net.Conn directly (Read/Write/Close). Rich apps import ssh/tailssh and type-assert for peer identity, PTY, signals, etc. If feature/ssh isn't imported, ListenSSH returns an error. Includes a demo guess-the-number game in tsnet/example/ssh-game. Change-Id: I4e7c3c96afb030cdf4da8f2d8b2253820628129a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-10ipn/ipnlocal, feature/ssh: move SSH code out of LocalBackend to featureBrad Fitzpatrick23-423/+371
This makes tsnet apps not depend on x/crypto/ssh and locks that in with a test. It also paves the wave for tsnet apps to opt-in to SSH support via a blank feature import in the future. Updates #12614 Change-Id: Ica85628f89c8f015413b074f5001b82b27c953a9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-10ssh/tailssh: mark TestSSHRecordingCancelsSessionsOnUploadFailure as flaky againBrad Fitzpatrick1-0/+3
Updates #7707 Change-Id: I98cdace78cd5060643894fb0c9be02574edb2894 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-10tstest/integration: deflake TestCollectPanicBrad Fitzpatrick1-4/+15
Two issues caused TestCollectPanic to flake: 1. ETXTBSY: The test exec'd the tailscaled binary directly without going through StartDaemon/awaitTailscaledRunnable, so it lacked the retry loop that other tests use to work around a mysterious ETXTBSY on GitHub Actions. 2. Shared filch files: The test didn't pass --statedir or TS_LOGS_DIR, so all parallel test instances wrote panic logs to the shared system state directory (~/.local/share/tailscale). Concurrent runs would clobber each other's filch log files, causing the second run to not find the panic data from the first. Fix both by adding awaitTailscaledRunnable before the first exec, and passing --statedir and TS_LOGS_DIR to isolate each test's log files, matching what StartDaemon does. It now passes x/tools/cmd/stress. Fixes #15865 Change-Id: If18b9acf8dbe9a986446a42c5d98de7ad8aae098 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-10util/linuxfw: fix nil pointer panic in connmark rules without IPv6 (#18946)Mike O'Driscoll3-12/+154
When IPv6 is unavailable on a system, AddConnmarkSaveRule() and DelConnmarkSaveRule() would panic with a nil pointer dereference. Both methods directly iterated over []iptablesInterface{i.ipt4, i.ipt6} without checking if ipt6 was nil. Use `getTables()` instead to properly retrieve the available tables on a given system Fixes #3310 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2026-03-10types/key: add NodePrivate.Raw32 and DiscoPrivateFromRaw32Brad Fitzpatrick2-0/+13
Raw byte accessors for key types, mirroring existing patterns (NodePublic.Raw32 and DiscoPublicFromRaw32 already exist). NodePrivate.Raw32 returns the raw 32 bytes of a node private key. DiscoPrivateFromRaw32 parses a 32-byte raw value as a DiscoPrivate. Updates tailscale/corp#24454 Change-Id: Ibc08bed14ab359eddefbebd811c375b6365c7919 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-10pull-toolchain.sh: advance the next hash if it's behindBrad Fitzpatrick1-1/+27
Updates tailscale/corp#36382 Change-Id: Ida55b7b1a2cdd0a4653bb41852008e7088fc4a48 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-10go.toolchain.next.rev: update to final Go 1.26.1 [next] (#18939)Jason O'Donnell1-1/+1
This updates the TS_GO_NEXT=1 (testing) toolchain to Go 1.26.1 The default one is still Go 1.26.0. Updates #18682 Signed-off-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>
2026-03-10cmd/k8s-operator: use correct tailnet client for L7 & L3 ingresses (#18749)David Bond12-322/+403
* cmd/k8s-operator: use correct tailnet client for L7 & L3 ingresses This commit fixes a bug when using multi-tailnet within the operator to spin up L7 & L3 ingresses where the client used to create the tailscale services was not switching depending on the tailnet used by the proxygroup backing the service/ingress. Updates: https://github.com/tailscale/corp/issues/34561 Signed-off-by: David Bond <davidsbond93@gmail.com> * cmd/k8s-operator: adding server url to proxygroups when a custom tailnet has been specified Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> (cherry picked from commit 3b21ac5504e713e32dfcd43d9ee21e7e712ac200) --------- Signed-off-by: David Bond <davidsbond93@gmail.com> Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> Co-authored-by: chaosinthecrd <tom@tmlabs.co.uk>
2026-03-09.github/workflows: use tailscale/go for Windows CI tooBrad Fitzpatrick1-21/+6
We did so for Linux and macOS already, so also do so for Windows. We only didn't already because originally we never produced binaries for it (due to our corp repo not needing them), and later because we had no ./tool/go wrapper. But we have both of those things now. Updates #18884 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-09go.mod: bump for internal/poll: move rsan to heap on windowsNick Khyl2-2/+2
This picks up the change in tailscale/go@5cce30e20c1fc6d8463b0a99acdd9777c4ad124b Updates #18884 Updates tailscale/go#158 Updates golang/go#77975 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2026-03-09ssh/tailssh: fix race between termination message write and session teardownBrad Fitzpatrick2-6/+12
When a recording upload fails mid-session, killProcessOnContextDone writes the termination message to ss.Stderr() and kills the process. Meanwhile, run() takes the ss.ctx.Done() path and proceeds to ss.Exit(), which tears down the SSH channel. The termination message write races with the channel teardown, so the client sometimes never receives it. Fix by adding an exitHandled channel that killProcessOnContextDone closes when done. run() now waits on this channel after ctx.Done() fires, ensuring the termination message is fully written before the SSH channel is torn down. Fixes #7707 Change-Id: Ib60116c928d3af46d553a4186a72963c2c731e3e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-09appc,feature/conn25: conn25: send address assignments to connectorFran Bull10-37/+486
After we intercept a DNS response and assign magic and transit addresses we must communicate the assignment to our connector so that it can direct traffic when it arrives. Use the recently added peerapi endpoint to send the addresses. Updates tailscale/corp#34258 Signed-off-by: Fran Bull <fran@tailscale.com>
2026-03-09tailcfg: reintroduce UserProfile.GroupsGesa Stupperich11-15/+35
This change reintroduces UserProfile.Groups, a slice that contains the ACL-defined and synced groups that a user is a member of. The slice will only be non-nil for clients with the node attribute see-groups, and will only contain groups that the client is allowed to see as per the app payload of the see-groups node attribute. For example: ``` "nodeAttrs": [ { "target": ["tag:dev"], "app": { "tailscale.com/see-groups": [{"groups": ["group:dev"]}] } }, [...] ] ``` UserProfile.Groups will also be gated by a feature flag for the time being. Updates tailscale/corp#31529 Signed-off-by: Gesa Stupperich <gesa@tailscale.com>
2026-03-09util/osuser: extend id command fallback for group IDs to freebsdGesa Stupperich2-4/+17
Users on FreeBSD run into a similar problem as has been reported for Linux #11682 and fixed in #11682: because the tailscaled binaries that we distribute are static and don't link cgo tailscaled fails to fetch group IDs that are returned via NSS when spawning an ssh child process. This change extends the fallback on the 'id' command that was put in place as part of #11682 to FreeBSD. More precisely, we try to fetch the group IDs with the 'id' command first, and only if that fails do we fall back on the logic in the os/user package. Updates #14025 Signed-off-by: Gesa Stupperich <gesa@tailscale.com>
2026-03-06cmd/testwrapper: make test tolerant of a GOEXPERIMENT being setBrad Fitzpatrick1-2/+5
Otherwise it generates an syntactically invalid go.mod file and subsequently fails. Updates #18884 Change-Id: I1a0ea17a57b2a37bde3770187e1a6e2d8aa55bfe Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-06all: use Go 1.26 things, run most gofix modernizersBrad Fitzpatrick168-618/+431
I omitted a lot of the min/max modernizers because they didn't result in more clear code. Some of it's older "for x := range 123". Also: errors.AsType, any, fmt.Appendf, etc. Updates #18682 Change-Id: I83a451577f33877f962766a5b65ce86f7696471c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-06go.mod: bump to Go 1.26.1Brad Fitzpatrick4-4/+4
Updates #18682 Change-Id: I855c0dfa4c61eb33123bbb7b00c1ab5506e80b09 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-06prober: fix queuing delay probe txRecords overflow under high DERP server ↵Mike O'Driscoll1-10/+7
load (#18803) The txRecords buffer had two compounding bugs that caused the overflow guard to fire on every send tick under high DERP server load, spamming logs at the full send rate (e.g. 100x/second). First, int(packetTimeout.Seconds()) truncates fractional-second timeouts, under-allocating the buffer. Second, the capacity was sized to exactly the theoretical maximum number of in-flight records with no headroom, and the expiry check used strict > rather than >=, so records at exactly the timeout boundary were never evicted by applyTimeouts, leaving len==cap on the very next tick. Fixes tailscale/corp#37696 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2026-03-06ipnext,ipnlocal: add ExtraWireGuardAllowedIPs hookMichael Ben-Ami2-0/+36
This hook addition is motivated by the Connectors 2025 work, in which NATed "Transit IPs" are used to route interesting traffic to the appropriate peer, without advertising the actual real IPs. It overlaps with #17858, and specifically with the WIP PR #17861. If that work completes, this hook may be replaced by other ones that fit the new WireGuard configuration paradigm. Fixes tailscale/corp#37146 Signed-off-by: Michael Ben-Ami <mzb@tailscale.com>
2026-03-06control/controlbase: deflake, speed up TestConnMemoryOverheadBrad Fitzpatrick1-73/+24
This had gotten flaky with Go 1.26. Use synctest + AllocsPerRun to make it fast and deterministic. Updates #18682 Change-Id: If673d6ecd8c1177f59c1b9c0f3fca42309375dff Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-06nix: update flakes to get a nixpkgs version with go 1.26Kristoffer Dalby1-6/+6
We override 1.26, but its not in the old commit we are tracking. Updates #18682 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2026-03-05types/ptr: deprecate ptr.To, use Go 1.26 newBrad Fitzpatrick96-532/+429
Updates #18682 Change-Id: I62f6aa0de2a15ef8c1435032c6aa74a181c25f8f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-05go.mod: bump staticcheck to version that supports Go 1.26Brad Fitzpatrick5-15/+15
Otherwise it gets confused on new(123) etc. Updates #18682 Change-Id: I9e2e93ea24f2b952b2396dceaf094b4db64424b0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-05all: fix typos in commentsBrad Fitzpatrick14-16/+16
Fix its/it's, who's/whose, wether/whether, missing apostrophes in contractions, and other misspellings across the codebase. Updates #cleanup Change-Id: I20453b81a7aceaa14ea2a551abba08a2e7f0a1d8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-05tstest/natlab: add test for no control and rotated disco key (#18261)Claus Lensbøl4-29/+140
Updates #12639 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2026-03-05VERSION.txt: this is v1.97.0 (#18898)v1.97.0-preJonathan Nobels1-1/+1
Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2026-03-05cmd/k8s-proxy: use L4 TCPForward instead of L7 HTTP proxy (#18179)Raj Singh3-14/+21
considerable latency was seen when using k8s-proxy with ProxyGroup in the kubernetes operator. Switching to L4 TCPForward solves this. Fixes tailscale#18171 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> Co-authored-by: chaosinthecrd <tom@tmlabs.co.uk>
2026-03-05clientupdate,net/tstun: add support for OpenWrt 25.12.0 using apk (#18545)Claus Lensbøl3-29/+188
OpenWrt is changing to using alpine like `apk` for package installation over its previous opkg. Additionally, they are not using the same repo files as alpine making installation fail. Add support for the new repository files and ensure that the required package detection system uses apk. Updates #18535 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2026-03-05cli: `--json` for `tailscale dns status|query`Kristoffer Dalby5-163/+514
This commit adds `--json` output mode to dns debug commands. It defines structs for the data that is returned from: `tailscale dns status` and `tailscale dns query <DOMAIN>` and populates that as it runs the diagnostics. When all the information is collected, it is serialised to JSON or string built into an output and returned to the user. The structs are defined and exported to golang consumers of this command can use them for unmarshalling. Updates #13326 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2026-03-05cmd/k8s-operator: remove deprecated TS_EXPERIMENTAL_KUBE_API_EVENTS (#18893)BeckyPauley2-22/+13
Remove the TS_EXPERIMENTAL_KUBE_API_EVENTS env var from the operator and its helm chart. This has already been marked as deprecated, and has been scheduled to be removed in release 1.96. Add a check in helm chart to fail if the removed variable is set to true, prompting users to move to ACLs instead. Fixes: #18875 Signed-off-by: Becky Pauley <becky@tailscale.com>
2026-03-04go.toolchain.branch: switch to Go 1.26Brad Fitzpatrick25-169/+219
Updates #18682 Change-Id: I1eadfab950e55d004484af880a5d8df6893e85e8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-04net/porttrack: change magic listen address format for Go 1.26Brad Fitzpatrick1-17/+25
Go 1.26's url.Parser is stricter and made our tests elsewhere fail with this scheme because when these listen addresses get shoved into a URL, it can't parse back out. I verified this makes tests elsewhere pass with Go 1.26. Updates #18682 Change-Id: I04dd3cee591aa85a9417a0bbae2b6f699d8302fa Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-04net/udprelay: use GOMAXPROCS instead of NumCPU for socket countDaniel Pañeda1-2/+3
runtime.NumCPU() returns the number of CPUs on the host, which in containerized environments is the node's CPU count rather than the container's CPU limit. This causes excessive memory allocation in pods with low CPU requests running on large nodes, as each socket's packetReadLoop allocates significant buffer memory. Use runtime.GOMAXPROCS(0) instead, which is container-aware since Go 1.25 and respects CPU limits set via cgroups. Fixes #18774 Signed-off-by: Daniel Pañeda <daniel.paneda@clickhouse.com>
2026-03-04ipn/ipnlocal: skip writing netmaps to disk when disabled (#18883)M. J. Fromberger1-2/+4
We use the TS_USE_CACHED_NETMAP knob to condition loading a cached netmap, but were hitherto writing the map out to disk even when it was disabled. Let's not do that; the two should travel together. Updates #12639 Change-Id: Iee5aa828e2c59937d5b95093ea1ac26c9536721e Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2026-03-04.github/workflows: enable natlab in CIClaus Lensbøl1-2/+8
After fixing the flakey tests in #18811 and #18814 we can enable running the natlab testsuite running on CI generally. Fixes #18810 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2026-03-04feature/portlist: address case where poller misses CollectServices updatesBrad Fitzpatrick1-0/+13
This is a minimal hacky fix for a case where the portlist poller extension could miss updates to NetMap's CollectServices bool. Updates tailscale/corp#36813 Change-Id: I9b50de8ba8b09e4a44f9fbfe90c9df4d8ab4d586 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-04cmd/tailscale,ipn,net/netutil: remove rp_filter strict mode warnings (#18863)Mike O'Driscoll14-237/+6
PR #18860 adds firewall rules in the mangle table to save outbound packet marks to conntrack and restore them on reply packets before the routing decision. When reply packets have their marks restored, the kernel uses the correct routing table (based on the mark) and the packets pass the rp_filter check. This makes the risk check and reverse path filtering warnings unnecessary. Updates #3310 Fixes tailscale/corp#37846 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2026-03-04util/linuxfw,wgengine/router: add connmark rules for rp_filter workaround ↵Mike O'Driscoll6-12/+814
(#18860) When a Linux system acts as an exit node or subnet router with strict reverse path filtering (rp_filter=1), reply packets may be dropped because they fail the RPF check. Reply packets arrive on the WAN interface but the routing table indicates they should have arrived on the Tailscale interface, causing the kernel to drop them. This adds firewall rules in the mangle table to save outbound packet marks to conntrack and restore them on reply packets before the routing decision. When reply packets have their marks restored, the kernel uses the correct routing table (based on the mark) and the packets pass the rp_filter check. Implementation adds two rules per address family (IPv4/IPv6): - mangle/OUTPUT: Save packet marks to conntrack for NEW connections with non-zero marks in the Tailscale fwmark range (0xff0000) - mangle/PREROUTING: Restore marks from conntrack to packets for ESTABLISHED,RELATED connections before routing decision and rp_filter check The workaround is automatically enabled when UseConnmarkForRPFilter is set in the router configuration, which happens when subnet routes are advertised on Linux systems. Both iptables and nftables implementations are provided, with automatic backend detection. Fixes #3310 Fixes #14409 Fixes #12022 Fixes #15815 Fixes #9612 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2026-03-04go.mod: bump github.com/cloudflare/circl version (#18878)Andrew Lytvynov5-6/+6
Pick up a fix in https://pkg.go.dev/vuln/GO-2026-4550 Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2026-03-03net/porttrack: add net.Listen wrapper to help tests allocate ports race-freeBrad Fitzpatrick2-0/+271
Updates tailscale/corp#27805 Updates tailscale/corp#27806 Updates tailscale/corp#37964 Change-Id: I7bb5ed7f258e840a8208e5d725c7b2f126d7ef96 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-03feature/conn25: stop adding multiple entries for same domain+dstFran Bull2-69/+139
We should only add one entry to our magic ips for each domain+dst and look up any existing entry instead of always creating a new one. Fixes tailscale/corp#34252 Signed-off-by: Fran Bull <fran@tailscale.com>
2026-03-03wgengine/magicsoc,net/tstun: put disco key advertisement behind a nob (#18857)Claus Lensbøl2-4/+11
To be less spammy in stable, add a nob that disables the creation and processing of TSMPDiscoKeyAdvertisements until we have a proper rollout mechanism. Updates #12639 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2026-03-03wgengine/magicsock: improve error message for moving Mullvad node keysAlex Chan1-2/+12
The "public key moved" panic has caused confusion on multiple occasions, and is a known issue for Mullvad. Add a loose heuristic to detect Mullvad nodes, and trigger distinct panics for Mullvad and non-Mullvad instances, with a link to the associated bug. When this occurs again with Mullvad, it'll be easier for somebody to find the existing bug. If it occurs again with something other than Mullvad, it'll be more obvious that it's a distinct issue. Updates tailscale/corp#27300 Change-Id: Ie47271f45f2ff28f767578fcca5e6b21731d08a1 Signed-off-by: Alex Chan <alexc@tailscale.com>
2026-03-02types/geo: fix floating point bug causing NaN returns in SphericalAngleTo ↵Amal Bansode2-58/+92
(#18777) Subtle floating point imprecision can propagate and lead to trigonometric functions receiving inputs outside their domain, thus returning NaN. Clamp the input to the valid domain to prevent this. Also adds a fuzz test for SphericalAngleTo. Updates tailscale/corp#37518 Signed-off-by: Amal Bansode <amal@tailscale.com>
2026-03-02scripts/installer.sh: handle KDE Linux (#18861)Erisa A1-0/+5
Display a message pointing to KDE Linux documentation on installing Tailscale Fixes #18306 Signed-off-by: Erisa A <erisa@tailscale.com>
2026-03-02.github: Bump actions/setup-go from 6.2.0 to 6.3.0dependabot[bot]3-3/+3
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5...4b73464bb391d4059bd26b0524d20df3927bd417) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-03-02.github: Bump github/codeql-action from 4.32.3 to 4.32.5dependabot[bot]1-3/+3
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.3 to 4.32.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9e907b5e64f6b83e7804b09294d44122997950d6...c793b717bc78562f491db7b0e93a3a178b099162) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2026-03-02licenses: update license noticesLicense Updater4-8/+8
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2026-03-02.github/actions/go-cache: check for pre-built cigocacher (#18833)Tom Proctor1-14/+19
Some CI runner images now have cigocacher baked in. Skip building if it's already present. Updates tailscale/corp#35667 Change-Id: I5ea0d606d44b1373bc1c8f7bca4ab780e763e2a9 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.