summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2023-05-09release: enable mipsle and mips64le pkgs for Debiankristoffer/enable-mips-pkgsKristoffer Dalby2-11/+13
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-05-09release: enable mips and mips64 pkgs for DebianKristoffer Dalby1-4/+4
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-05-08cmd/k8s-operator: print version in startup logsCraig Rodrigues1-1/+2
Fixes: #7813 Signed-off-by: Craig Rodrigues <rodrigc@crodrigues.org>
2023-05-08licenses: update win/apple licensesLicense Updater2-53/+54
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2023-05-08ssh/tailssh: move some user-related code into new user.goBrad Fitzpatrick2-109/+113
The previous commit 58ab66e added ssh/tailssh/user.go as part of working on #4945. So move some more user-related code over to it. Updates #cleanup Change-Id: I24de66df25ffb8f867e1a0a540d410f9ef16d7b0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-08ssh/tailssh: support LDAP users for Tailscale SSHBrad Fitzpatrick4-28/+140
Fixes #4945 Change-Id: Ie013cb47684cb87928a44f92c66352310bfe53f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-07version: properly handle vcs.modified when it's "false"Chenyang Gao1-1/+1
Current code will set the "dirty" field of VersionInfo always "true" if vcs.modified flag is there. No matter whether the flag is "true" or "false". It will make sense to set this field due to vcs.modified value, not only the existence of the key. Signed-off-by: Chenyang Gao <gps949@outlook.com>
2023-05-06licenses: update tailscale{,d} licensesLicense Updater1-4/+4
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2023-05-06licenses: update android licensesLicense Updater1-40/+42
Signed-off-by: License Updater <noreply@tailscale.com>
2023-05-06fix sys.Set(router) issue will crash the daemon in some OSsChenyang Gao1-1/+1
Signed-off-by: Chenyang Gao <gps949@outlook.com> in commit 6e96744, the tsd system type has been added. Which will cause the daemon will crash on some OSs (Windows, darwin and so on). The root cause is that on those OSs, handleSubnetsInNetstack() will return true and set the conf.Router with a wrapper. Later in NewUserspaceEngine() it will do subsystem set and found that early set router mismatch to current value, then panic.
2023-05-06tsweb/promvarz: fix repeated expvar definition in testJames Tucker1-4/+7
expvar can only be defined once, so running tests with a repeat counter will fail if the variables are defined inside of the test function. Observed failure: ``` --- FAIL: TestHandler (0.00s) panic: Reuse of exported var name: gauge_promvarz_test_expvar [recovered] panic: Reuse of exported var name: gauge_promvarz_test_expvar goroutine 9 [running]: testing.tRunner.func1.2({0x100f267e0, 0x1400026e770}) /usr/local/go/src/testing/testing.go:1526 +0x1c8 testing.tRunner.func1() /usr/local/go/src/testing/testing.go:1529 +0x364 panic({0x100f267e0, 0x1400026e770}) /usr/local/go/src/runtime/panic.go:884 +0x1f4 log.Panicln({0x140000b8e20?, 0x1a?, 0x1400026e750?}) /usr/local/go/src/log/log.go:398 +0x60 expvar.Publish({0x100e2b21d, 0x1a}, {0x100fd7a08?, 0x140000232c0}) /usr/local/go/src/expvar/expvar.go:284 +0xc0 expvar.NewInt(...) /usr/local/go/src/expvar/expvar.go:304 tailscale.com/tsweb/promvarz.TestHandler(0x14000082b60) /Users/charlotte/ts-src/tailscale/tsweb/promvarz/promvarz_test.go:18 +0x5c testing.tRunner(0x14000082b60, 0x100fd5858) /usr/local/go/src/testing/testing.go:1576 +0x104 created by testing.(*T).Run /usr/local/go/src/testing/testing.go:1629 +0x370 FAIL tailscale.com/tsweb/promvarz 0.149s ``` Fixes #8065 Signed-off-by: James Tucker <james@tailscale.com>
2023-05-05tailcfg: bump capability versionCharlotte Brandhorst-Satzkorn1-1/+2
This change bumps the capability version to 62, after support for sending SSHEventNotificationRequests to control via noise for failure events was introduced. Updates tailscale/corp#9967 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-05-05ssh/tailssh,tailcfg: add connID to ssheventnotifyrequest and castheaderCharlotte Brandhorst-Satzkorn2-13/+22
This change adds a ConnectionID field to both SSHEventNotifyRequest and CastHeader that identifies the ID of a connection to the SSH server. Updates tailscale/corp#9967 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-05-05ssh/tailssh: send ssh event notifications on recording failuresCharlotte Brandhorst-Satzkorn2-10/+91
This change sends an SSHEventNotificationRequest over noise when a SSH session is set to fail closed and the session is unable to start because a recorder is not available or a session is terminated because connection to the recorder is ended. Each of these scenarios have their own event type. Updates tailscale/corp#9967 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-05-05tailcfg: update rename SSHFailureNotifyRequest and add EventTypeCharlotte Brandhorst-Satzkorn1-5/+16
This change renames SSHFailureNotifyRequest to SSHEventNotifyRequest to better reflect the additional events we could add in the future. This change also adds an EventType used to catagories the events. Updates tailscale/corp#9967 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-05-05ipn/ipnlocal: add NodeKey func to return the public node NodeKeyCharlotte Brandhorst-Satzkorn1-0/+13
This change introduces a NodeKey func on localbackend that returns the public node key. Updates tailscale/corp#9967 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-05-05ipn/ipnlocal: bound how long cert fetchher checks for existing DNS recordsBrad Fitzpatrick1-10/+10
It was supposed to be best effort but in some cases (macsys at least, per @marwan-at-work) it hangs and exhausts the whole context.Context deadline so we fail to make the SetDNS call to the server. Updates #8067 Updates #3273 etc Change-Id: Ie1f04abe9689951484748aecdeae312afbafdb0f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-05net/netns: fix segv when no tailscale interface is foundJames Tucker1-1/+1
`interfaces.Tailscale()` returns all zero values when it finds no Tailscale interface and encounters no errors. The netns package was treating no error as a signal that it would receive a non-zero pointer value leading to nil pointer dereference. Observed in: ``` --- FAIL: TestGetInterfaceIndex (0.00s) --- FAIL: TestGetInterfaceIndex/IP_and_port (0.00s) panic: runtime error: invalid memory address or nil pointer dereference [recovered] panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x1029eb7d8] goroutine 7 [running]: testing.tRunner.func1.2({0x102a691e0, 0x102bc05c0}) /Users/raggi/.cache/tailscale-go/src/testing/testing.go:1526 +0x1c8 testing.tRunner.func1() /Users/raggi/.cache/tailscale-go/src/testing/testing.go:1529 +0x384 panic({0x102a691e0, 0x102bc05c0}) /Users/raggi/.cache/tailscale-go/src/runtime/panic.go:884 +0x204 tailscale.com/net/netns.getInterfaceIndex(0x14000073f28, 0x1028d0284?, {0x1029ef3b7, 0xa}) /Users/raggi/src/github.com/tailscale/tailscale/net/netns/netns_darwin.go:114 +0x228 tailscale.com/net/netns.TestGetInterfaceIndex.func2(0x14000138000) /Users/raggi/src/github.com/tailscale/tailscale/net/netns/netns_darwin_test.go:37 +0x54 testing.tRunner(0x14000138000, 0x140000551b0) /Users/raggi/.cache/tailscale-go/src/testing/testing.go:1576 +0x10c created by testing.(*T).Run /Users/raggi/.cache/tailscale-go/src/testing/testing.go:1629 +0x368 FAIL tailscale.com/net/netns 0.824s ``` Fixes #8064 Signed-off-by: James Tucker <jftucker@gmail.com>
2023-05-04tsd: add package with System type to unify subsystem init, discoveryBrad Fitzpatrick26-260/+373
This is part of an effort to clean up tailscaled initialization between tailscaled, tailscaled Windows service, tsnet, and the mac GUI. Updates #8036 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-04various: add detection and Taildrop for UnraidDerek Kaser5-2/+38
Updates tailscale/tailscale#8025 Signed-off-by: Derek Kaser <derek.kaser@gmail.com>
2023-05-04go.mod.sri: update SRI hash for go.mod changesFlakes Updater3-3/+3
Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>
2023-05-04go.mod: bump goreleaser depsJames Tucker2-7/+16
Periodic update for start of cycle. goreleaser is not updated to v2 yet, but indirects updated. Updates #8043 Signed-off-by: James Tucker <james@tailscale.com>
2023-05-04go.mod.sri: update SRI hash for go.mod changesFlakes Updater3-3/+3
Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>
2023-05-04go.mod: bump gvisorJames Tucker2-3/+3
Periodic update for start of cycle. Updates #8043 Signed-off-by: James Tucker <james@tailscale.com>
2023-05-04go.mod: bump k8s libsMaisem Ali2-22/+20
The key is to update sigs.k8s.io/controller-runtime and let it update others. Updates #8043 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-05-04envknob: support tailscaled-env.txt on macOS tooBrad Fitzpatrick1-8/+25
Updates #3707 Co-authored-by: Marwan Sulaiman <marwan@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-04scripts/installer.sh: check connectivity with pkgs.tailscale.comAnton Tolchanov1-0/+11
Installer script relies on pkgs.tailscale.com being reachable, both for checking what Linux distros are supported, but also for actually downloading repo configuration files, gpg keys and packages themselves. This change adds a simple reachability check which will print an error message when pkgs.tailscale.com is not reachable. Fixes https://github.com/tailscale/corp/issues/8952 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2023-05-03go.mod.sri: update SRI hash for go.mod changesFlakes Updater3-3/+3
Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>
2023-05-03licenses: update tailscale{,d} licensesLicense Updater1-46/+48
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2023-05-03go.mod: bump all deps possible that don't break the buildBrad Fitzpatrick5-812/+446
This holds back gvisor, kubernetes, goreleaser, and esbuild, which all had breaking API changes. Updates #8043 Updates #7381 Updates #8042 (updates u-root which adds deps) Change-Id: I889759bea057cd3963037d41f608c99eb7466a5b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-03.github: mark bots for exemption by issuebot (#8041)M. J. Fromberger2-4/+4
#cleanup Change-Id: I13757ee20240166af72606d166e840ae3ee797d7 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2023-05-03licenses: update tailscale{,d} licensesLicense Updater1-0/+1
Signed-off-by: License Updater <noreply@tailscale.com>
2023-05-03build(deps): bump github.com/docker/dockerdependabot[bot]2-3/+3
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 20.10.16+incompatible to 20.10.24+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v20.10.16...v20.10.24) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
2023-05-03ssh/tailssh: restore support for recording locallyMaisem Ali1-32/+64
We removed it earlier in 916aa782af5d43ccfa92f6245201796df212fb8a, but we still want to support it for some time longer. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-05-03wgengine/magicsock: annotate, skip flaky TestIsWireGuardOnlyPickEndpointByPingBrad Fitzpatrick1-0/+2
Updates #8037 Updates #7826 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-02wgengine/magicsock: add address selection for wireguard only endpoints (#7979)Charlotte Brandhorst-Satzkorn3-74/+714
This change introduces address selection for wireguard only endpoints. If a endpoint has not been used before, an address is randomly selected to be used based on information we know about, such as if they are able to use IPv4 or IPv6. When an address is initially selected, we also initiate a new ICMP ping to the endpoints addresses to determine which endpoint offers the best latency. This information is then used to update which endpoint we should be using based on the best possible route. If the latency is the same for a IPv4 and an IPv6 address, IPv6 will be used. Updates #7826 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-05-02derp: add a README.md with some docsBrad Fitzpatrick1-0/+61
Updates #docs Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-02net/tstun: handle exit nodes in NAT configsMaisem Ali2-33/+74
In the case where the exit node requires SNAT, we would SNAT all traffic not just the traffic meant to go through the exit node. This was a result of the default route being added to the routing table which would match basically everything. In this case, we need to account for all peers in the routing table not just the ones that require NAT. Fix and add a test. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-05-02wgengine/magicsock: add hysteresis to endpoint selectionAndrew Dunham2-1/+27
Avoid selecting an endpoint as "better" than the current endpoint if the total latency improvement is less than 1%. This adds some hysteresis to avoid flapping between endpoints for a minimal improvement in latency. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: If8312e1768ea65c4b4d4e13d8de284b3825d7a73
2023-05-01ssh/tailssh: improve debug logging around revoked sessionsTom DNetto1-0/+11
Updates https://github.com/tailscale/corp/issues/10943 Signed-off-by: Tom DNetto <tom@tailscale.com>
2023-05-01control/controlclient: use dnscache.Resolver for Noise clientAndrew Dunham5-24/+87
This passes the *dnscache.Resolver down from the Direct client into the Noise client and from there into the controlhttp client. This retains the Resolver so that it can share state across calls instead of creating a new resolver. Updates #4845 Updates #6110 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ia5d6af1870f3b5b5d7dd5685d775dcf300aec7af
2023-05-01licenses: update win/apple licensesLicense Updater2-11/+11
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2023-04-29.github: test installer script in CI in dockerAnton Tolchanov2-5/+111
Every time we change `installer.sh`, run it in a few docker containers based on different Linux distros, just as a simple test. Also includes a few changes to the installer script itself to make installation work in docker: - install dnf config-manager command before running it - run zypper in non-interactive mode - update pacman indexes before installing packages Updates https://github.com/tailscale/corp/issues/8952 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2023-04-28cmd/sniproxy: Set App name in tsnet hostinfoDenton Gentry1-0/+3
Updates #1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2023-04-27syncs: add Map.Len to get the length of the MapJames Tucker1-0/+7
I need this for a corp change where I have a set as a queue, and make a different decisison if the set is empty. Updates tailscale/corp#10344 Signed-off-by: James Tucker <james@tailscale.com>
2023-04-27build_dist.sh: make cross-compilation friendly for env CC specifiedayanamist1-1/+1
Signed-off-by: ayanamist <ayanamist@gmail.com>
2023-04-27.github: Bump actions/setup-go from 3 to 4dependabot[bot]1-1/+1
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3 to 4. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v3...v4) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2023-04-27syncs: add documentation to Map.RangeJames Tucker1-0/+2
Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>
2023-04-27words: charlotte 1 spell-checking-linter 0 (#7993)Charlotte Brandhorst-Satzkorn1-1/+0
Can't have a dupe when the dupe is wrong. Clearly we need to up our spell checking game. Did anyone say AI? Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-04-26.github/workflows: add recency bias to action cache keysJames Tucker1-4/+8
The action cache restore process either matches the restore key pattern exactly, or uses a matching prefix with the most recent date. If the restore key is an exact match, then no updates are uploaded, but if we've just computed tests executions for more recent code then we will likely want to use those results in future runs. Appending run_id to the cache key will give us an always new key, and then we will be restore a recently uploaded cache that is more likely has a higher overlap with the code being tested. Updates #7975 Signed-off-by: James Tucker <james@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.