summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2021-11-30net/dns: windows DNS experimentsbradfitz/windnsBrad Fitzpatrick1-0/+39
2021-11-29cmd/tailscaled: allow running the SOCKS5 and HTTP proxies on the same port.David Anderson7-13/+47
Fixes #3248 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-29net/proxymux: add a listener mux that can run SOCKS and HTTP on a single socket.David Anderson2-0/+317
Updates #3248 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-29tailcfg, ipn/ipnlocal, net/dns: forward exit node DNS on Unix to system DNSBrad Fitzpatrick7-57/+251
Updates #1713 Change-Id: I4c073fec0992d9e01a9a4ce97087d5af0efdc68d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-29control/controlclient: stop logging about goal.url invariantJosh Bleecher Snyder1-5/+3
This isn't the ideal solution, but it's good enough for now. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-29update github.com/aws/aws-sdk-go-v2David Crawshaw3-32/+39
Replaces #3464, #3365, #3366 with a PR that includes the depaware fix. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-11-29cmd/tailscale/cli: don't complain about --accept-routes true->false on SynologyBrad Fitzpatrick2-0/+41
Fixes #3176 Change-Id: I844883e741dccfa5e7771c853180e9f65fb7f7a4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-29ipn/ipnlocal: restrict exit node DoH server based on ACL'ed packet filterBrad Fitzpatrick3-13/+110
Don't be a DoH DNS server to peers unless the Tailnet admin has permitted that peer autogroup:internet access. Updates #1713 Change-Id: Iec69360d8e4d24d5187c26904b6a75c1dabc8979 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-29wgengine/filter: fix, test NewAllowAllForTestBrad Fitzpatrick2-2/+14
I probably broke it when SCTP support was added but nothing apparently ever used NewAllowAllForTest so it wasn't noticed when it broke. Change-Id: Ib5a405be233d53cb7fcc61d493ae7aa2d1d590a2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-29ipn/store/aws: support using sub-paths in parametersThomas Weiß1-1/+1
Fixes #3431 Signed-off-by: Thomas Weiß <panos@unbunt.org>
2021-11-29cmd/tailscaled: log error on state store init failureThomas Weiß1-0/+1
Signed-off-by: Thomas Weiß <panos@unbunt.org>
2021-11-26net/dns/resolver: add clientmetrics for DNSBrad Fitzpatrick2-2/+102
Fixes tailscale/corp#1811 Change-Id: I864d11e0332a177e8c5ff403591bff6fec548f5a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-26ipn/ipnlocal: warn more precisely about IP forwarding issues on linux.David Anderson1-14/+76
If IP forwarding is disabled globally, but enabled per-interface on all interfaces, don't complain. If only some interfaces have forwarding enabled, warn that some subnet routing/exit node traffic may not work. Fixes #1586 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-26cmd/derper: set Content-Security-Policy on DERPs.David Anderson1-4/+11
It's a basic "deny everything" policy, since DERP's HTTP server is very uninteresting from a browser POV. But it stops every security scanner under the sun from reporting "dangerously configured" HTTP servers. Updates tailscale/corp#3119 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-26ipn/ipnlocal: populate self status from netmap in ipnlocal, not magicsock.David Anderson2-15/+12
Fixes #1933 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-26logpolicy: export NewLogtailTransport for AndroidDenton Gentry1-5/+8
Android doesn't use logpolicy and currently has enough unique stuff about its logging that makes it difficult to do so. For example, its logsDir comes from Gio. Export NewLogtailTransport to let Android use it. Updates https://github.com/tailscale/tailscale/issues/3046 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2021-11-23net/dns/resolver, ipn/ipnlocal: wire up peerapi DoH server to DNS forwarderBrad Fitzpatrick3-7/+196
Updates #1713 Change-Id: Ia4ed9d8c9cef0e70aa6d30f2852eaab80f5f695a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-23Merge pull request #3214 from tailscale/mayakacz-patch-1Maya Kaczorowski2-10/+6
.github: feature request template change
2021-11-23Update feature_request.ymlMaya Kaczorowski2-10/+6
Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com>
2021-11-23scripts/installer.sh: add more Linux variants.Denton Gentry1-2/+2
Updates https://github.com/tailscale/tailscale/issues/2915 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2021-11-23net/dns: require space after nameserver/search parsing resolv.confJosh Bleecher Snyder2-4/+26
Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-23net/dns: handle comments in resolv.confJosh Bleecher Snyder2-0/+48
Currently, comments in resolv.conf cause our parser to fail, with error messages like: ParseIP("192.168.0.100 # comment"): unexpected character (at " # comment") Fix that. Noticed while looking through logs. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-23ipn/ipnlocal: fix loggingJosh Bleecher Snyder1-1/+1
We were missing an argument here. Also, switch to %q, in case anything weird is happening with these strings. Updates tailscale/corp#461 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-23net/tstun: rate limit "self disco out packet" loggingJosh Bleecher Snyder3-10/+14
When this happens, it is incredibly noisy in the logs. It accounts for about a third of all remaining "unexpected" log lines from a recent investigation. It's not clear that we know how to fix this, we have a functioning workaround, and we now have a (cheap and efficient) metric for this that we can use for measurements. So reduce the logging to approximately once per minute. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-23cmd/tailscale: add ip -1 flagJosh Bleecher Snyder1-3/+14
This limits the output to a single IP address. RELNOTE=tailscale ip now has a -1 flag (TODO: update docs to use it) Fixes #1921 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-23cmd/tailscale: improve ip subcommand docsJosh Bleecher Snyder1-4/+4
Streamline the prose. Clarify what peer may be. Improve an error message. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-23tsshd: fix double exit with different exit codesJoonas Loppi1-1/+2
Signed-off-by: Joonas Loppi <joonas@joonas.fi>
2021-11-23ipn/ipnlocal: start adding DoH DNS server to peerapi when exit nodeBrad Fitzpatrick6-0/+122
Updates #1713 Change-Id: I8d9c488f779e7acc811a9bc18166a2726198a429 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-22go.mod: bump honnef.co/go/tools from 0.2.1 to 0.2.2dependabot[bot]2-3/+3
Bumps [honnef.co/go/tools](https://github.com/dominikh/go-tools) from 0.2.1 to 0.2.2. - [Release notes](https://github.com/dominikh/go-tools/releases) - [Commits](https://github.com/dominikh/go-tools/compare/v0.2.1...v0.2.2) --- updated-dependencies: - dependency-name: honnef.co/go/tools dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-11-22ipn/ipnstate: clarify PeerStatusLite.LastHandshakeJosh Bleecher Snyder1-2/+7
And document the other fields, as long as we're here. Updates #1182 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-22util/clientmetric: add tests omitted from earlier commitBrad Fitzpatrick1-0/+75
These were supposed to be part of 3b541c833edb7c45eea1b7b2e5b716d33baf13c3 but I guess I forgot to "git add" them. Whoops. Updates #3307 Change-Id: I8c768a61ec7102a01799e81dc502a22399b9e9f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-22wgengine/monitor: ignore adding/removing uninteresting IPsJosh Bleecher Snyder4-15/+83
One of the most common "unexpected" log lines is: "network state changed, but stringification didn't" One way that this can occur is if an interesting interface (non-Tailscale, has interesting IP address) gains or loses an uninteresting IP address (link local or loopback). The fact that the interface is interesting is enough for EqualFiltered to inspect it. The fact that an IP address changed is enough for EqualFiltered to declare that the interfaces are not equal. But the State.String method reasonably declines to print any uninteresting IP addresses. As a result, the network state appears to have changed, but the stringification did not. The String method is correct; nothing interesting happened. This change fixes this by adding an IP address filter to EqualFiltered in addition to the interface filter. This lets the network monitor ignore the addition/removal of uninteresting IP addresses. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-22.github/workflows: check that repo is clean after build and testJosh Bleecher Snyder3-0/+45
Linux-only for now, to avoid having to figure out why powershell doesn't like my shell scripting. (Not that I blame it.) That'll be enough to catch most regressions. Fixes #1083 Co-authored-by: Aaron Klotz <aaron@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-22hostinfo: report when running in Docker Desktop.Denton Gentry1-0/+11
Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2021-11-22net/tshttpproxy: use correct size for Windows BOOL argumentJosh Bleecher Snyder1-1/+1
The Windows BOOL type is an int32. We were using a bool, which is a one byte wide. This could be responsible for the ERROR_INVALID_PARAMETER errors we were seeing for calls to WinHttpGetProxyForUrl. We manually checked all other existing Windows syscalls for similar mistakes and did not find any. Updates #879 Co-authored-by: Aaron Klotz <aaron@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-22cmd/derper: increase HSTS cache lifetime to 2 years.David Anderson1-1/+1
Fixes #3373. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-22build_docker.sh: use github.com/tailscale/mkctr instead of dockerMaisem Ali5-10/+23
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-11-22hostinfo: change Windows implementation to directly query version ↵Aaron Klotz2-14/+33
information using API and registry We replace the cmd.exe invocation with RtlGetNtVersionNumbers for the first three fields. On Windows 10+, we query for the fourth field which is available via the registry. The fourth field is not really documented anywhere; Firefox has been querying it successfully since Windows 10 was released, so we can be pretty confident in its longevity at this point. Fixes https://github.com/tailscale/tailscale/issues/1478 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2021-11-22net/portmapper: mark fewer PMP probe failures as unexpectedJosh Bleecher Snyder1-1/+10
There are lots of lines in the logs of the form: portmapper: unexpected PMP probe response: {OpCode:128 ResultCode:3 SecondsSinceEpoch:NNN MappingValidSeconds:0 InternalPort:0 ExternalPort:0 PublicAddr:0.0.0.0} ResultCode 3 here means a network failure, e.g. the NAT box itself has not obtained a DHCP lease. This is not an indication that something is wrong in the Tailscale client, so use different wording here to reflect that. Keep logging, so that we can analyze and debug the reasons that PMP probes fail. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-11-22wgengine/router: demote TestDebugListRules fail to skipBrad Fitzpatrick1-1/+1
Updates #3360 Change-Id: Ic5c98ea03f3171c13ab9293a0ae74d17fd04d149 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-22cmd/derper: enable HSTS when serving over HTTPS.David Anderson1-0/+8
Starting with a short lifetime, to verify nothing breaks. Updates #3373 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-22go.mod: bump github.com/godbus/dbus/v5 from 5.0.5 to 5.0.6dependabot[bot]2-3/+3
Bumps [github.com/godbus/dbus/v5](https://github.com/godbus/dbus) from 5.0.5 to 5.0.6. - [Release notes](https://github.com/godbus/dbus/releases) - [Commits](https://github.com/godbus/dbus/compare/v5.0.5...v5.0.6) --- updated-dependencies: - dependency-name: github.com/godbus/dbus/v5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-11-21go.mod: bump inet.af/netstackBrad Fitzpatrick4-16/+34
Updates #2642 (I'd hoped, but doesn't seem to fix it) Change-Id: Id54af7c90a1206bc7018215957e20e954782b911 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-19Fuzzing: Add CIFuzzAdamKorcz1-0/+26
Signed-off-by: AdamKorcz <adam@adalogics.com>
2021-11-19wgengine/router: fix checkIPRuleSupportsV6 to actually use IPv6Brad Fitzpatrick2-6/+19
Updates #3358 (should fix it) Updates #391 Change-Id: Ia62437dfa81247b0b5994d554cf279c3d540e4e7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-19wgengine/router: don't assume Linux was built with IP_MULTIPLE_TABLESBrad Fitzpatrick1-3/+8
Updates #3351 Updates #391 Change-Id: I7e66b686e05f3c970846513679cc62556ebe322a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-19net/dns: make constants for the various DBus strings.David Anderson1-14/+36
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-19health: add a health state for net/dns.OSConfigurator.David Anderson3-0/+18
Lets the systemd-resolved OSConfigurator report health changes for out of band config resyncs. Updates #3327 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-19net/dns: resync config to systemd-resolved when it restarts.David Anderson1-17/+96
Fixes #3327 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-19net/dns: remove unused Config struct element.David Anderson1-2/+0
Signed-off-by: David Anderson <danderson@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.