summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2024-02-15cmd/k8s-operator: annotate proxy StatefulSets with operator versionirbekrm/operatorversionIrbe Krumina4-2/+71
Add a tailscale.com/operator-last-version annotation to StatefulSets for ingress/egress proxies and Connectors. Set it to the operator version of the current operator version each time the StatefulSet is re-synced. This will help us to determine the potential proxy state when making changes in proxy configuration in the future. Updates tailscale/tailscale#10407 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-02-14clientupdate: disable auto update on NixOS (#11136)Patrick O'Doherty1-0/+11
Updates #cleanup NixOS packages are immutable and attempts to update via our tarball mechanism will always fail as a result. Instead we now direct users to update their nix channel or nixpkgs flake input to receive the latest Tailscale release. Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2024-02-14util/topk: add package containing a probabilistic top-K trackerAndrew Dunham2-0/+396
This package uses a count-min sketch and a heap to track the top K items in a stream of data. Tracking a new item and adding a count to an existing item both require no memory allocations and is at worst O(log(k)) complexity. Change-Id: I0553381be3fef2470897e2bd806d43396f2dbb36 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
2024-02-13go.mod.sri: update SRI hash for go.mod changesFlakes Updater3-3/+3
Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>
2024-02-13go.mod, all: move away from inet.af domain seized by TalibanBrad Fitzpatrick7-17/+16
Updates inetaf/tcpproxy#39 Change-Id: I7fee276b116bd08397347c6c949011d76a2842cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-02-13net/dns: log more info when openresolv commands failAndrew Dunham3-5/+27
Updates #11129 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic594868ba3bc31f6d3b0721ecba4090749a81f7f
2024-02-13scripts/installer.sh: add tuxedoOS to the Ubuntu copiesNathan Woodburn1-1/+1
Signed-off-by: Nathan Woodburn <github@nathan.woodburn.au>
2024-02-13Revert "tsweb: update ServeMux matching to 1.22.0 syntax (#11090)" (#11125)Patrick O'Doherty1-8/+8
This reverts commit 30c9189ed307df6f2c1567aa7945bde77bb54c52. Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2024-02-13wgengine/router: make the Windows ifconfig implementation reuse existing ↵Aaron Klotz2-95/+125
MibIPforwardRow2 when possible Looking at profiles, we spend a lot of time in winipcfg.LUID.DeleteRoute looking up the routing table entry for the provided RouteData. But we already have the row! We previously obtained that data via the full table dump we did in getInterfaceRoutes. We can make this a lot faster by hanging onto a reference to the wipipcfg.MibIPforwardRow2 and executing the delete operation directly on that. Fixes #11123 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2024-02-13tsweb: update ServeMux matching to 1.22.0 syntax (#11090)Patrick O'Doherty1-8/+8
* tsweb: update ServeMux matching to 1.22.0 syntax Updates #cleanup Go 1.22.0 introduced the ability to use more expressive routing patterns that include HTTP method when constructing ServeMux entries. Applications that attempted to use these patterns in combination with the old `tsweb.Debugger` would experience a panic as Go would not permit the use of matching rules with mixed level of specificity. We now specify the method for each `/debug` handler to prevent incompatibilities. Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2024-02-13cmd/k8s-operator,k8s-operator: proxy configuration mechanism via a new ↵Irbe Krumina25-91/+2584
ProxyClass custom resource (#11074) * cmd/k8s-operator,k8s-operator: introduce proxy configuration mechanism via ProxyClass custom resource. ProxyClass custom resource can be used to specify customizations for the proxy resources created by the operator. Add a reconciler that validates ProxyClass resources and sets a Ready condition to True or False with a corresponding reason and message. This is required because some fields (labels and annotations) require complex validations that cannot be performed at custom resource apply time. Reconcilers that use the ProxyClass to configure proxy resources are expected to verify that the ProxyClass is Ready and not proceed with resource creation if configuration from a ProxyClass that is not yet Ready is required. If a tailscale ingress/egress Service is annotated with a tailscale.com/proxy-class annotation, look up the corresponding ProxyClass and, if it is Ready, apply the configuration from the ProxyClass to the proxy's StatefulSet. If a tailscale Ingress has a tailscale.com/proxy-class annotation and the referenced ProxyClass custom resource is available and Ready, apply configuration from the ProxyClass to the proxy resources that will be created for the Ingress. Add a new .proxyClass field to the Connector spec. If connector.spec.proxyClass is set to a ProxyClass that is available and Ready, apply configuration from the ProxyClass to the proxy resources created for the Connector. Ensure that when Helm chart is packaged, the ProxyClass yaml is added to chart templates. Ensure that static manifest generator adds ProxyClass yaml to operator.yaml. Regenerate operator.yaml Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-02-12types/views: add test that LenIter doesn't allocateBrad Fitzpatrick1-0/+9
For a second we thought this was allocating but we were looking at a CPU profile (which showed calls to mallocgc view makeslice) instead of the alloc profile. Updates golang/go#65685 (which if fixed wouldn't have confused us) Change-Id: Ic0132310d52d8a65758a516142525339aa23b1ed Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-02-12tailfs: listen for local clients only on 100.100.100.100Percy Wegmann3-68/+2
FileSystemForLocal was listening on the node's Tailscale address, which potentially exposes the user's view of TailFS shares to other Tailnet users. Remote nodes should connect to exported shares via the peerapi. This removes that code so that FileSystemForLocal is only avaialable on 100.100.100.100:8080. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-02-12cmd/tailscale: hide share subcommandPercy Wegmann2-7/+8
Fixes #1115 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-02-11flake.nix: build tailscale with go 1.22David Anderson2-11/+11
Updates #cleanup Signed-off-by: David Anderson <danderson@tailscale.com>
2024-02-11tailcfg: remove UserProfile.GroupsMaisem Ali7-26/+14
Removing as per go/group-all-the-things. Updates tailscale/corp#17445 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-02-10util/cloudenv: add support for DigitalOceanAndrew Dunham2-3/+59
Updates #4984 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib229eb40af36a80e6b0fd1dd0cabb07f0d50a7d1
2024-02-10tailscaled: revert to using pointers for subcommandsPercy Wegmann1-9/+17
As part of #10631, we stopped using function pointers for subcommands, preventing us from registering platform-specific installSystemDaemon and uninstallSystemDaemon subcommands. Fixes #11099 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-02-09tailfs: fix startup issues on windowsPercy Wegmann2-1/+4
Starts TailFS for Windows too, initializes shares on startup. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-02-09tailfs: disable TailFSForLocal via policyPercy Wegmann4-3/+31
Adds support for node attribute tailfs:access. If this attribute is not present, Tailscale will not accept connections to the local TailFS server at 100.100.100.100:8080. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-02-09tailfs: clean up naming and package structurePercy Wegmann50-681/+751
- Restyles tailfs -> tailFS - Defines interfaces for main TailFS types - Moves implemenatation of TailFS into tailfsimpl package Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-02-09build(deps-dev): bump vite from 4.4.9 to 4.5.2 in /client/webdependabot[bot]2-5/+5
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 4.4.9 to 4.5.2. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v4.5.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v4.5.2/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
2024-02-09util/rands: add Shuffle and Perm functions with on-stack RNG stateJames Tucker3-0/+179
The new math/rand/v2 package includes an m-local global random number generator that can not be reseeded by the user, which is suitable for most uses without the RNG pools we have in a number of areas of the code base. The new API still does not have an allocation-free way of performing a seeded operations, due to the long term compiler bug around interface parameter escapes, and the Source interface. This change introduces the two APIs that math/rand/v2 can not yet replace efficiently: seeded Perm() and Shuffle() operations. This implementation chooses to use the PCG random source from math/rand/v2, as with sufficient compiler optimization, this source should boil down to only two on-stack registers for random state under ideal conditions. Updates #17243 Signed-off-by: James Tucker <james@tailscale.com>
2024-02-09client/web: only check policy caps for tagged nodesSonia Appasamy3-12/+61
For user-owned nodes, only the owner is ever allowed to manage the node. Updates tailscale/corp#16695 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2024-02-09.github: fuzzing is now unbrokenAndrew Dunham1-1/+1
Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I10dca601c79411b412180a46b3f82136e40544b0
2024-02-09fix toolchain not available error (#11083)Keisuke Umegaki1-1/+1
Relates to golang/go#62278 Updates #11058 Signed-off-by: keisku <keisuke.umegaki.630@gmail.com>
2024-02-09Revert "tsweb: update ServeMux matching to 1.22.0 syntax (#11087)" (#11089)Patrick O'Doherty1-1/+1
This reverts commit 291f91d164f1ec60ca77c0cb935a7895ac4cc555. Updates #cleanup This PR needs additional changes to the registration of child handlers under /debug Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2024-02-09tsweb: update ServeMux matching to 1.22.0 syntax (#11087)Patrick O'Doherty1-1/+1
Updates #cleanup Go 1.22.0 introduced the ability to use more expressive routing patterns that include HTTP method when constructing ServeMux entries. Applications that attempted to use these patterns in combination with the old `tsweb.Debugger` would experience a panic as Go would not permit the use of matching rules with mixed level of specificity. Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2024-02-09cmd/gitops-pusher: only use OAuth creds if non-empty stringJenny Zhang1-1/+3
`os.LookupEnv` may return true if the variable is present in the environment but an empty string. We should only attempt to set OAuth Config if thsoe values are non-empty. Updates gitops-acl-action#33 Signed-off-by: Jenny Zhang <jz@tailscale.com>
2024-02-09tailfs: initial implementationPercy Wegmann61-284/+4919
Add a WebDAV-based folder sharing mechanism that is exposed to local clients at 100.100.100.100:8080 and to remote peers via a new peerapi endpoint at /v0/tailfs. Add the ability to manage folder sharing via the new 'share' CLI sub-command. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-02-08all: use new AppendEncode methods available in Go 1.22 (#11079)Joe Tsai4-42/+8
Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-02-08all: use reflect.TypeFor now available in Go 1.22 (#11078)Joe Tsai18-38/+31
Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-02-08util/deephash: cleanup TODO in TestHash (#11080)Joe Tsai1-7/+1
Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-02-08cmd/tailscale/cli: fix exit node status output (#11076)Charlotte Brandhorst-Satzkorn1-2/+2
This change fixes the format of tailscale status output when location based exit nodes are present. Fixes #11065 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2024-02-08ipnlocal: force-regen new authURL when it is too old (#10971)Andrea Gottardo1-3/+11
Fixes tailscale/support-escalations#23. authURLs returned by control expire after 1 hour from creation. Customer reported that the Tailscale client on macOS would sending users to a stale authentication page when clicking on the `Login...` menu item. This can happen when clicking on Login after leaving the device unattended for several days. The device key expires, leading to the creation of a new authURL, however the client doesn't keep track of when the authURL was created. Meaning that `login-interactive` would send the user to an authURL that had expired server-side a long time before. This PR ensures that whenever `login-interactive` is called via LocalAPI, an authURL that is too old won't be used. We force control to give us a new authURL whenever it's been more than 30 minutes since the last authURL was sent down from control. Apply suggestions from code review Set interval to 6 days and 23 hours Signed-off-by: Andrea Gottardo <andrea@tailscale.com> Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-02-08cmd/dist: update logs for synology buildsSonia Appasamy2-1/+8
Update logs for synology builds to more clearly callout which variant is being built. The two existing variants are: 1. Sideloaded (can be manual installed on a device by anyone) 2. Package center distribution (by the tailscale team) Updates #cleanup Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2024-02-08go.mod: update web-client-prebuilt moduleOSS Updater2-3/+3
Signed-off-by: OSS Updater <noreply+oss-updater@tailscale.com>
2024-02-08client/web: use smart quotes in web UI frontendWill Norris7-6/+14
add the curly-quotes eslint plugin (same that we use for the admin panel), and fix existing straight quotes in the current web UI. Updates #cleanup Signed-off-by: Will Norris <will@tailscale.com>
2024-02-08client/web: add new readonly modeWill Norris4-14/+46
The new read-only mode is only accessible when running `tailscale web` by passing a new `-readonly` flag. This new mode is identical to the existing login mode with two exceptions: - the management client in tailscaled is not started (though if it is already running, it is left alone) - the client does not prompt the user to login or switch to the management client. Instead, a message is shown instructing the user to use other means to manage the device. Updates #10979 Signed-off-by: Will Norris <will@tailscale.com>
2024-02-08licenses: update win/apple licensesLicense Updater2-63/+66
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2024-02-08licenses: update android licensesLicense Updater1-1/+1
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2024-02-08licenses: update tailscale{,d} licensesLicense Updater1-45/+45
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2024-02-08cmd/{containerboot,k8s-operator/deploy/manifests}: optionally allow proxying ↵Irbe Krumina7-55/+390
cluster traffic to a cluster target via ingress proxy (#11036) * cmd/containerboot,cmd/k8s-operator/deploy/manifests: optionally forward cluster traffic via ingress proxy. If a tailscale Ingress has tailscale.com/experimental-forward-cluster-traffic-via-ingress annotation, configure the associated ingress proxy to have its tailscale serve proxy to listen on Pod's IP address. This ensures that cluster traffic too can be forwarded via this proxy to the ingress backend(s). In containerboot, if EXPERIMENTAL_PROXY_CLUSTER_TRAFFIC_VIA_INGRESS is set to true and the node is Kubernetes operator ingress proxy configured via Ingress, make sure that traffic from within the cluster can be proxied to the ingress target. Updates tailscale/tailscale#10499 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-02-07go.mod.sri: update SRI hash for go.mod changesFlakes Updater3-3/+3
Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>
2024-02-07.github/workflows: temporarily disable broken oss-fuzz actionBrad Fitzpatrick1-1/+1
Updates #11064 Updates #11058 Change-Id: I63acc13dece3379a0b2df573afecfd245b7cd6c2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-02-07util/cmpx: delete now that we're using Go 1.22Brad Fitzpatrick24-92/+41
Updates #11058 Change-Id: I09dea8e86f03ec148b715efca339eab8b1f0f644 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-02-07Dockerfile: use Go 1.22Brad Fitzpatrick1-1/+1
Updates #11058 Change-Id: I0f63be498be33d71bd90b7956f9fe9666fd7a696 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-02-07.github/workflows: update golangci-lint for Go 1.22Brad Fitzpatrick1-1/+1
Updates #11058 Change-Id: I3785c1f1bea4a4663e7e5fb6d209d3caedae436d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-02-07go.mod, README.md: use Go 1.22Brad Fitzpatrick2-4/+2
Updates #11058 Change-Id: I95eecdc7afe2b5f8189016fdb8a773f78e9f5c42 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-02-07tsweb: normalize passkey identities in bucketed statsTom DNetto2-3/+5
Signed-off-by: Tom DNetto <tom@tailscale.com> Updates: corp#17075
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.