summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2024-08-08net/netcheck: change DERP HTTPS latency measurement to TCP connect timejwhited/derp-https-tcp-connectJordan Whited1-3/+3
HTTPS and ICMP latency are fallbacks when STUN doesn't work. The lowest value wins. When ICMP doesn't work you just get HTTPS. HTTPS latency was way more variable than it needed to be as we were measuring "server processing time" (inclusive of TLS, HTTPS) instead of just TCP connect time. We don't need to perform an HTTPS request, we really just need a TCP ping, but aiming for a simpler change to start. Updates tailscale/corp#22114 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-08-08net/dns/resolver: log forwarded query details when TS_DEBUG_DNS_FORWARD_SEND ↵Nick Khyl2-9/+28
is enabled Troubleshooting DNS resolution issues often requires additional information. This PR expands the effect of the TS_DEBUG_DNS_FORWARD_SEND envknob to forwarder.forwardWithDestChan, and includes the request type, domain name length, and the first 3 bytes of the domain's SHA-256 hash in the output. Fixes #13070 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-08-08go.toolchain.rev: bump Go toolchain for net pkg resolv.conf fixBrad Fitzpatrick1-1/+1
Updates tailscale/corp#22206 Change-Id: I9d995d408d4be3fd552a0d6e12bf79db8461d802 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-08-08cmd/gitops-pusher: ignore previous etag if local acls match control (#13068)Andrew Lytvynov1-11/+11
In a situation when manual edits are made on the admin panel, around the GitOps process, the pusher will be stuck if `--fail-on-manual-edits` is set, as expected. To recover from this, there are 2 options: 1. revert the admin panel changes to get back in sync with the code 2. check in the manual edits to code The former will work well, since previous and local ETags will match control ETag again. The latter will still fail, since local and control ETags match, but previous does not. For this situation, check the local ETag against control first and ignore previous when things are already in sync. Updates https://github.com/tailscale/corp/issues/22177 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2024-08-08cmd/gitops-pusher: add --fail-on-manual-edits flag (#13066)Andrew Lytvynov1-11/+24
For cases where users want to be extra careful about not overwriting manual changes, add a flag to hard-fail. This is only useful if the etag cache is persistent or otherwise reliable. This flag should not be used in ephemeral CI workers that won't persist the cache. Updates https://github.com/tailscale/corp/issues/22177 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2024-08-08prober: make status page more clearAnton Tolchanov3-7/+8
Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-08-08cmd/tsidp: add funnel support (#12591)Naman Sood3-38/+411
* cmd/tsidp: add funnel support Updates #10263. Signed-off-by: Naman Sood <mail@nsood.in> * look past funnel-ingress-node to see who we're authenticating Signed-off-by: Naman Sood <mail@nsood.in> * fix comment typo Signed-off-by: Naman Sood <mail@nsood.in> * address review feedback, support Basic auth for /token Turns out you need to support Basic auth if you do client ID/secret according to OAuth. Signed-off-by: Naman Sood <mail@nsood.in> * fix typos Signed-off-by: Naman Sood <mail@nsood.in> * review fixes Signed-off-by: Naman Sood <mail@nsood.in> * remove debugging log Signed-off-by: Naman Sood <mail@nsood.in> * add comments, fix header Signed-off-by: Naman Sood <mail@nsood.in> --------- Signed-off-by: Naman Sood <mail@nsood.in>
2024-08-07tstest/natlab/vnet: add start of virtual network-based NAT LabBrad Fitzpatrick11-4/+2062
Updates #13038 Change-Id: I3c74120d73149c1329288621f6474bbbcaa7e1a6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-08-06cmd/derper: move 204 handler from package main to derphttpBrad Fitzpatrick3-31/+34
Updates #13038 Change-Id: I28a8284dbe49371cae0e9098205c7c5f17225b40 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-08-06wgengine/magicsock: refactor batchingUDPConn to batchingConn interface (#13042)Jordan Whited9-655/+693
This commit adds a batchingConn interface, and renames batchingUDPConn to linuxBatchingConn. tryUpgradeToBatchingConn() may return a platform- specific implementation of batchingConn. So far only a Linux implementation of this interface exists, but this refactor is being done in anticipation of a Windows implementation. Updates tailscale/corp#21874 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-08-06control/controlhttp: extract the last network connectionAnton Tolchanov2-12/+60
The same context we use for the HTTP request here might be re-used by the dialer, which could result in `GotConn` being called multiple times. We only care about the last one. Fixes #13009 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-08-06cmd/derpprobe: use a status page from the prober libraryAnton Tolchanov1-27/+7
Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-08-06prober: support JSON response in RunHandlerAnton Tolchanov2-2/+119
Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-08-06prober: add a status page handlerAnton Tolchanov2-0/+256
This change adds an HTTP handler with a table showing a list of all probes, their status, and a button that allows triggering a specific probe. Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-08-06prober: add an HTTP endpoint for triggering a probeAnton Tolchanov2-40/+311
- Keep track of the last 10 probe results and successful probe latencies; - Add an HTTP handler that triggers a given probe by name and returns it result as a plaintext HTML page, showing recent probe results as a baseline Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-08-05{control,net}: close idle connections of custom transportsAnton Tolchanov3-0/+5
I noticed a few places with custom http.Transport where we are not closing idle connections when transport is no longer used. Updates tailscale/corp#21609 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-08-05net/socks5: support UDPVimT2-81/+484
Updates #7581 Signed-off-by: VimT <me@vimt.me>
2024-08-05words: raccoon dog, dog with the raccoon in 'imKot C1-0/+2
Signed-off-by: Kot C <kot@yukata.dev>
2024-08-05licenses: update license noticesLicense Updater3-14/+14
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2024-08-05cmd/tailscale/cli: fix `revoke-keys` command name in CLI outputAnton Tolchanov1-3/+3
During review of #8644 the `recover-compromised-key` command was renamed to `revoke-key`, but the old name remained in some messages printed by the command. Fixes tailscale/corp#19446 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-08-03net/captivedetection: mark TestAllEndpointsAreUpAndReturnExpectedResponse ↵Jordan Whited1-0/+2
flaky (#13021) Updates #13019 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-08-03wgengine/netstack: use build tags to exclude gVisor GRO importation on iOS ↵Jordan Whited3-2/+47
(#13015) Updates tailscale/corp#22125 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-08-03tstest/integration: mark TestNATPing flakyMaisem Ali1-0/+1
Updates #12169 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-08-03wgengine/capture: fix v6 field typo in wireshark dissectorMaisem Ali1-3/+3
It was using a v4 field for a v6 address. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-08-03tsweb: mark TestStdHandler_ConnectionClosedDuringBody flakyMaisem Ali1-0/+2
Updates #13107 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-08-03go.mod.sri: update SRI hash for go.mod changesFlakes Updater3-3/+3
Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>
2024-08-03net/packet/checksum: fix v6 NATMaisem Ali3-6/+34
We were copying 12 out of the 16 bytes which meant that the 1:1 NAT required would only work if the last 4 bytes happened to match between the new and old address, something that our tests accidentally had. Fix it by copying the full 16 bytes and make the tests also verify the addr and use rand addresses. Updates #9511 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-08-03util/linuxfw: return nil interface not concrete typeMaisem Ali2-3/+17
It was returning a nil `*iptablesRunner` instead of a nil `NetfilterRunner` interface which would then fail checks later. Fixes #13012 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-08-02util/winutil/gp: fix a busy loop bugNick Khyl1-0/+1
Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-08-02wgengine/netstack: increase gVisor's TCP send and receive buffer sizes (#12994)Jordan Whited3-3/+87
This commit increases gVisor's TCP max send (4->6MiB) and receive (4->8MiB) buffer sizes on all platforms except iOS. These values are biased towards higher throughput on high bandwidth-delay product paths. The iperf3 results below demonstrate the effect of this commit between two Linux computers with i5-12400 CPUs. 100ms of RTT latency is introduced via Linux's traffic control network emulator queue discipline. The first set of results are from commit f0230ce prior to TCP buffer resizing. gVisor write direction: Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 180 MBytes 151 Mbits/sec 0 sender [ 5] 0.00-10.10 sec 179 MBytes 149 Mbits/sec receiver gVisor read direction: Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.10 sec 337 MBytes 280 Mbits/sec 20 sender [ 5] 0.00-10.00 sec 323 MBytes 271 Mbits/sec receiver The second set of results are from this commit with increased TCP buffer sizes. gVisor write direction: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 297 MBytes 249 Mbits/sec 0 sender [ 5] 0.00-10.10 sec 297 MBytes 247 Mbits/sec receiver gVisor read direction: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.10 sec 501 MBytes 416 Mbits/sec 17 sender [ 5] 0.00-10.00 sec 485 MBytes 407 Mbits/sec receiver Updates #9707 Updates tailscale/corp#22119 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-08-02wgengine/magicsock: use cloud metadata to get public IPsAndrew Dunham5-9/+360
Updates #12774 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1661b6a2da7966ab667b075894837afd96f4742f
2024-08-02net/captivedetection: exclude cellular data interfaces (#13002)Andrea Gottardo1-1/+7
Updates tailscale/tailscale#1634 This PR optimizes captive portal detection on Android and iOS by excluding cellular data interfaces (`pdp*` and `rmnet`). As cellular networks do not present captive portals, frequent network switches between Wi-Fi and cellular would otherwise trigger captive detection unnecessarily, causing battery drain. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-08-02go.mod,net/tstun,wgengine/netstack: implement gVisor TCP GRO for Linux (#12921)Jordan Whited8-48/+307
This commit implements TCP GRO for packets being written to gVisor on Linux. Windows support will follow later. The wireguard-go dependency is updated in order to make use of newly exported IP checksum functions. gVisor is updated in order to make use of newly exported stack.PacketBuffer GRO logic. TCP throughput towards gVisor, i.e. TUN write direction, is dramatically improved as a result of this commit. Benchmarks show substantial improvement, sometimes as high as 2x. High bandwidth-delay product paths remain receive window limited, bottlenecked by gVisor's default TCP receive socket buffer size. This will be addressed in a follow-on commit. The iperf3 results below demonstrate the effect of this commit between two Linux computers with i5-12400 CPUs. There is roughly ~13us of round trip latency between them. The first result is from commit 57856fc without TCP GRO. Starting Test: protocol: TCP, 1 streams, 131072 byte blocks - - - - - - - - - - - - - - - - - - - - - - - - - Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 4.77 GBytes 4.10 Gbits/sec 20 sender [ 5] 0.00-10.00 sec 4.77 GBytes 4.10 Gbits/sec receiver The second result is from this commit with TCP GRO. Starting Test: protocol: TCP, 1 streams, 131072 byte blocks - - - - - - - - - - - - - - - - - - - - - - - - - Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 10.6 GBytes 9.14 Gbits/sec 20 sender [ 5] 0.00-10.00 sec 10.6 GBytes 9.14 Gbits/sec receiver Updates #6816 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-08-01health: don't show login error details with context cancelationsBrad Fitzpatrick1-1/+6
Fixes #12991 Change-Id: I2a5e109395761b720ecf1069d0167cf0caf72876 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-07-31net/netns: remove some logspam by avoiding logging parse errors due to ↵Aaron Klotz3-2/+12
unspecified addresses I updated the address parsing stuff to return a specific error for unspecified hosts passed as empty strings, and look for that when logging errors. I explicitly did not make parseAddress return a netip.Addr containing an unspecified address because at this layer, in the absence of any host, we don't necessarily know the address family we're dealing with. For the purposes of this code I think this is fine, at least until we implement #12588. Fixes #12979 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2024-07-31net/tlsdial: relax self-signed cert health warningBrad Fitzpatrick1-8/+21
It seems some security software or macOS itself might be MITMing TLS (for ScreenTime?), so don't warn unless it fails x509 validation against system roots. Updates #3198 Change-Id: I6ea381b5bb6385b3d51da4a1468c0d803236b7bf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-07-31net/netns: on Windows, fall back to default interface index when unspecified ↵Aaron Klotz1-14/+15
address is passed to ControlC and bindToInterfaceByRoute is enabled We were returning an error instead of binding to the default interface. Updates #12979 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2024-07-31go.mod,net/tstun,wgengine/netstack: implement gVisor TCP GSO for Linux (#12869)Jordan Whited7-28/+360
This commit implements TCP GSO for packets being read from gVisor on Linux. Windows support will follow later. The wireguard-go dependency is updated in order to make use of newly exported GSO logic from its tun package. A new gVisor stack.LinkEndpoint implementation has been established (linkEndpoint) that is loosely modeled after its predecessor (channel.Endpoint). This new implementation supports GSO of monster TCP segments up to 64K in size, whereas channel.Endpoint only supports up to 32K. linkEndpoint will also be required for GRO, which will be implemented in a follow-on commit. TCP throughput from gVisor, i.e. TUN read direction, is dramatically improved as a result of this commit. Benchmarks show substantial improvement through a wide range of RTT and loss conditions, sometimes as high as 5x. The iperf3 results below demonstrate the effect of this commit between two Linux computers with i5-12400 CPUs. There is roughly ~13us of round trip latency between them. The first result is from commit 57856fc without TCP GSO. Starting Test: protocol: TCP, 1 streams, 131072 byte blocks - - - - - - - - - - - - - - - - - - - - - - - - - Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.51 GBytes 2.15 Gbits/sec 154 sender [ 5] 0.00-10.00 sec 2.49 GBytes 2.14 Gbits/sec receiver The second result is from this commit with TCP GSO. Starting Test: protocol: TCP, 1 streams, 131072 byte blocks - - - - - - - - - - - - - - - - - - - - - - - - - Test Complete. Summary Results: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 12.6 GBytes 10.8 Gbits/sec 6 sender [ 5] 0.00-10.00 sec 12.6 GBytes 10.8 Gbits/sec receiver Updates #6816 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-07-30net/captivedetection: call SetHealthy once connectivity restored (#12974)Andrea Gottardo2-1/+4
Fixes tailscale/tailscale#12973 Updates tailscale/tailscale#1634 There was a logic issue in the captive detection code we shipped in https://github.com/tailscale/tailscale/pull/12707. Assume a captive portal has been detected, and the user notified. Upon switching to another Wi-Fi that does *not* have a captive portal, we were issuing a signal to interrupt any pending captive detection attempt. However, we were not also setting the `captive-portal-detected` warnable to healthy. The result was that any "captive portal detected" alert would not be cleared from the UI. Also fixes a broken log statement value. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-07-30net/dns, cmd/tailscaled: plumb system health tracker into dns cleanup (#12969)Jonathan Nobels2-3/+5
fixes tailscale#12968 The dns manager cleanup func was getting passed a nil health tracker, which will panic. Fixed to pass it the system health tracker. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2024-07-30build_docker.sh: update script comment (#12970)Irbe Krumina1-16/+6
It is no longer correct to state that we don't support running Tailscale in containers or on Kubernetes. Updates tailscale/tailscale#12842 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-07-30build(deps): bump github.com/docker/docker (#12966)dependabot[bot]2-3/+6
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 25.0.5+incompatible to 26.1.4+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v25.0.5...v26.1.4) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-30Dockerfile: add a warning that this is not used to build our published ↵Irbe Krumina1-0/+7
images (#12955) Add a warning that the Dockerfile in the OSS repo is not the currently used mechanism to build the images we publish - for folks who want to contribute to image build scripts or otherwise need to understand the image build process that we use. Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-07-29go.mod.sri: update SRI hash for go.mod changesFlakes Updater3-3/+3
Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>
2024-07-29util/osuser: turn wasm check into a const expressionBrad Fitzpatrick1-1/+1
All wasi* are GOARCH wasm, so check that instead. Updates #12732 Change-Id: Id3cc346295c1641bcf80a6c5eb1ad65488509656 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-07-29gokrazy/tsapp: add go.mod replacing two tailscale.com binaries with parent ↵Brad Fitzpatrick5-120/+61
module Updates #1866 Change-Id: I1ee7d41f7ee55806fb7ad94d0333dd0ec33d8efd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-07-29words: add some associated with scalesBrad Fitzpatrick1-0/+2
Updates tailscale/corp#14698 Change-Id: Ica7f179bd368d3c15f58fb236d377881cd80efcf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-07-29cmd/tailscale/cli: release portmap after netcheckAndrew Dunham1-1/+7
Updates #12954 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic14f037b48a79b1263b140c6699579b466d89310
2024-07-29net/dns, health: raise health warning for failing forwarded DNS queries (#12888)Jonathan Nobels7-8/+53
updates tailscale/corp#21823 Misconfigured, broken, or blocked DNS will often present as "internet is broken'" to the end user. This plumbs the health tracker into the dns manager and forwarder and adds a health warning with a 5 second delay that is raised on failures in the forwarder and lowered on successes. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2024-07-29go.mod: pull in latest github.com/tailscale/xnetPercy Wegmann2-3/+3
This picks up https://github.com/tailscale/xnet/pull/1 so that clients can move files even when holding only a lock for the source file. Updates #12941 Signed-off-by: Percy Wegmann <percy@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.