summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2025-01-28various: bump go dependeny to 1.23.5mpminardi/bump-go-patchMario Minardi6-6/+6
Bump to latest patch version of 1.23 to get security fixes. Updates #cleanup Signed-off-by: Mario Minardi <mario@tailscale.com>
2025-01-28tsnet: return from Accept when the listener gets closedAnton Tolchanov2-3/+35
Fixes #14808 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2025-01-28cmd/tailscale: add warning to help text of `--force-reauth` (#14778)yejingchen1-1/+1
The warning text is adapted from https://tailscale.com/kb/1028/key-expiry#renewing-keys-for-an-expired-device . There is already https://github.com/tailscale/tailscale/pull/7575 which presents a warning when connected over Tailscale, however the detection is done by checking SSH environment variables, which are absent within systemd's run0*. That means `--force-reauth` will happily bring down Tailscale connection, leaving the user in despair. Changing only the help text is by no means a complete solution, but hopefully it will stop users from blindly trying it out, and motivate them to search for a proper solution. *: https://www.freedesktop.org/software/systemd/man/devel/run0.html Updates #3849 Signed-off-by: yejingchen <ye.jingchen@gmail.com>
2025-01-27tempfork/acme: fix TestSyncedToUpstream with Windows line endingsBrad Fitzpatrick1-1/+1
Updates #10238 Change-Id: Ic85811c267679a9f79377f376d77dee3a9d92ce7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-27types/persist: remove Persist.LegacyFrontendPrivateMachineKeyBrad Fitzpatrick7-80/+21
It was a temporary migration over four years ago. It's no longer relevant. Updates #610 Change-Id: I1f00c9485fab13ede6f77603f7d4235222c2a481 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-27tempfork/acme: add new package for x/crypto package acme fork, moveBrad Fitzpatrick16-3/+5679
We've been maintaining temporary dev forks of golang.org/x/crypto/{acme,ssh} in https://github.com/tailscale/golang-x-crypto instead of using this repo's tempfork directory as we do with other packages. The reason we were doing that was because x/crypto/ssh depended on x/crypto/ssh/internal/poly1305 and I hadn't noticed there are forwarding wrappers already available in x/crypto/poly1305. It also depended internal/bcrypt_pbkdf but we don't use that so it's easy to just delete that calling code in our tempfork/ssh. Now that our SSH changes have been upstreamed, we can soon unfork from SSH. That leaves ACME remaining. This change copies our tailscale/golang-x-crypto/acme code to tempfork/acme but adds a test that our vendored copied still matches our tailscale/golang-x-crypto repo, where we can continue to do development work and rebases with upstream. A comment on the new test describes the expected workflow. While we could continue to just import & use tailscale/golang-x-crypto/acme, it seems a bit nicer to not have that entire-fork-of-x-crypto visible at all in our transitive deps and the questions that invites. Showing just a fork of an ACME client is much less scary. It does add a step to the process of hacking on the ACME client code, but we do that approximately never anyway, and the extra step is very incremental compared to the existing tedious steps. Updates #8593 Updates #10238 Change-Id: I8af4378c04c1f82e63d31bf4d16dba9f510f9199 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-27health: relax no-derp-home warnable to not fire if not in map pollBrad Fitzpatrick3-23/+88
Fixes #14687 Change-Id: I05035df7e075e94dd39b2192bee34d878c15310d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-27health: do Warnable dependency filtering in tailscaledBrad Fitzpatrick3-3/+39
Previously we were depending on the GUI(s) to do it. By doing it in tailscaled, GUIs can be simplified and be guaranteed to render consistent results. If warnable A depends on warnable B, if both A & B are unhealhy, only B will be shown to the GUI as unhealthy. Once B clears up, only then will A be presented as unhealthy. Updates #14687 Change-Id: Id8566f2672d8d2d699740fa053d4e2a2c8009e83 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-27.github: Bump github/codeql-action from 3.28.1 to 3.28.5 (#14794)dependabot[bot]1-3/+3
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.1 to 3.28.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/b6a472f63d85b9c78a3ac5e89422239fc15e9b3c...f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-27.github: Bump actions/setup-go from 5.2.0 to 5.3.0 (#14793)dependabot[bot]3-3/+3
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.2.0 to 5.3.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/3041bf56c941b39c61721a86cd11f3bb1338122a...f111f3307d8850f501ac008e886eec1fd1932a34) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-26control/controlclient,tempfork/httprec: don't link httptest, test certs for c2nBrad Fitzpatrick5-7/+265
The c2n handling code was using the Go httptest package's ResponseRecorder code but that's in a test package which brings in Go's test certs, etc. This forks the httptest recorder type into its own package that only has the recorder and adds a test that we don't re-introduce a dependency on httptest. Updates #12614 Change-Id: I3546f49972981e21813ece9064cc2be0b74f4b16 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-26go.mod: bump depaware, add --internal flag to stop hiding internal packagesBrad Fitzpatrick9-6/+314
The hiding of internal packages has hidden things I wanted to see a few times now. Stop hiding them. This makes depaware.txt output a bit longer, but not too much. Plus we only really look at it with diffs & greps anyway; it's not like anybody reads the whole thing. Updates #12614 Change-Id: I868c89eeeddcaaab63e82371651003629bc9bda8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-26tstest/deptest: verify that tailscale.com BadDeps actually existBrad Fitzpatrick1-0/+25
This protects against rearranging packages and not catching that a BadDeps package got moved. That would then effectively remove a test. Updates #12614 Change-Id: I257f1eeda9e3569c867b7628d5bfb252d3354ba6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-26control/controlknobs: make Knobs.AsDebugJSON automatic, not require maintenanceBrad Fitzpatrick2-21/+19
The AsDebugJSON method (used only for a LocalAPI debug call) always needed to be updated whenever a new controlknob was added. We had a test for it, which was nice, but it was a tedious step we don't need to do. Use reflect instead. Updates #14788 Change-Id: If59cd776920f3ce7c748f86ed2eddd9323039a0b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-26envknob/featureknob: allow use of exit node on unraid (#14754)Derek Kaser1-2/+1
Fixes #14372 Signed-off-by: Derek Kaser <11674153+dkaser@users.noreply.github.com>
2025-01-24feature/capture: move packet capture to feature/*, out of iOS + CLIBrad Fitzpatrick23-484/+620
We had the debug packet capture code + Lua dissector in the CLI + the iOS app. Now we don't, with tests to lock it in. As a bonus, tailscale.com/net/packet and tailscale.com/net/flowtrack no longer appear in the CLI's binary either. A new build tag ts_omit_capture disables the packet capture code and was added to build_dist.sh's --extra-small mode. Updates #12614 Change-Id: I79b0628c0d59911bd4d510c732284d97b0160f10 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-24control/controlclient: sanitize invalid DERPMap nil Region from controlBrad Fitzpatrick1-0/+9
Fixes #14752 Change-Id: If364603eefb9ac6dc5ec6df84a0d5e16c94dda8d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-24cmd/natc: expose netstack metrics in client metrics in natcJames Tucker1-0/+4
Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>
2025-01-25ipn/ipnlocal: add debug envknob for ACME directory URL (#14771)Tom Proctor2-2/+19
Adds an envknob setting for changing the client's ACME directory URL. This allows testing cert issuing against LE's staging environment, as well as enabling local-only test environments, which is useful for avoiding the production rate limits in test and development scenarios. Fixes #14761 Change-Id: I191c840c0ca143a20e4fa54ea3b2f9b7cbfc889f Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-01-24cmd/natc,wgengine/netstack: tune buffer size and segment lifetime in natcJames Tucker2-0/+39
Some natc instances have been observed with excessive memory growth, dominant in gvisor buffers. It is likely that the connection buffers are sticking around for too long due to the default long segment time, and uptuned buffer size applied by default in wgengine/netstack. Apply configurations in natc specifically which are a better match for the natc use case, most notably a 5s maximum segment lifetime. Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>
2025-01-24control/controlclient: skip SetControlClientStatus when queue has newer ↵Brad Fitzpatrick4-2/+167
results later Updates #1909 Updates #12542 Updates tailscale/corp#26058 Change-Id: I3033d235ca49f9739fdf3deaf603eea4ec3e407e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-24go.{mod,sum}: update web-client-prebuilt (#14772)Mario Minardi2-3/+3
Manually update the `web-client-prebuilt` package as the GitHub action is failing for some reason. Updates https://github.com/tailscale/tailscale/issues/14568 Signed-off-by: Mario Minardi <mario@tailscale.com>
2025-01-24client/web: remove advanced options from web client login (#14770)Mario Minardi1-35/+1
Removing the advanced options collapsible from the web client login for now ahead of our next client release. Updates https://github.com/tailscale/tailscale/issues/14568 Signed-off-by: Mario Minardi <mario@tailscale.com>
2025-01-24ipn/ipnlocal: include DNS SAN in cert CSR (#14764)Tom Proctor1-3/+4
The CN field is technically deprecated; set the requested name in a DNS SAN extension in addition to maximise compatibility with RFC 8555. Fixes #14762 Change-Id: If5d27f1e7abc519ec86489bf034ac98b2e613043 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-01-24tailcfg: adjust ServiceName.Validate to use vizerrorAdrian Dewhurst2-4/+6
Updates #cleanup Change-Id: I163b3f762b9d45c2155afe1c0a36860606833a22 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>
2025-01-24util/clientmetric: use counter in aggcounterKristoffer Dalby1-1/+1
Fixes #14743 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2025-01-24cmd/derper,derp: make TCP write timeout configurablePercy Wegmann2-3/+19
The timeout still defaults to 2 seconds, but can now be changed via command-line flag. Updates tailscale/corp#26045 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-24derp: move Conn interface to derp.goPercy Wegmann2-12/+12
This interface is used both by the DERP client as well as the server. Defining the interface in derp.go makes it clear that it is shared. Updates tailscale/corp#26045 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-24wgengine/filter: add check for unknown protoKristoffer Dalby3-1/+10
Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2025-01-24net/tstun: add back outgoing drop metricKristoffer Dalby1-5/+6
Using new labels returned from the filter Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2025-01-24wgengine/filter: return drop reason for metricsKristoffer Dalby2-27/+30
Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2025-01-24util/usermetric: add more drop labelsKristoffer Dalby1-0/+13
Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2025-01-23cmd/tailscale: fix, test some recent doc inconsistenciesBrad Fitzpatrick9-28/+68
3dabea0fc2c added some docs with inconsistent usage docs. This fixes them, and adds a test. It also adds some other tests and fixes other verb tense inconsistencies. Updates tailscale/corp#25278 Change-Id: I94c2a8940791bddd7c35c1c3d5fb791a317370c2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-23cmd/tailscaled,util/syspolicy/source,util/winutil/gp: disallow acquiring the ↵Nick Khyl4-8/+138
GP lock during service startup In v1.78, we started acquiring the GP lock when reading policy settings. This led to a deadlock during Tailscale installation via Group Policy Software Installation because the GP engine holds the write lock for the duration of policy processing, which in turn waits for the installation to complete, which in turn waits for the service to enter the running state. In this PR, we prevent the acquisition of GP locks (aka EnterCriticalPolicySection) during service startup and update the Windows Registry-based util/syspolicy/source.PlatformPolicyStore to handle this failure gracefully. The GP lock is somewhat optional; it’s safe to read policy settings without it, but acquiring the lock is recommended when reading multiple values to prevent the Group Policy engine from modifying settings mid-read and to avoid inconsistent results. Fixes #14416 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-01-23control/controlclient: delete unreferenced mapSession UserProfilesBrad Fitzpatrick1-1/+30
This was a slow memory leak on busy tailnets with lots of tagged ephemeral nodes. Updates tailscale/corp#26058 Change-Id: I298e7d438e3ffbb3cde795640e344671d244c632 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-23net/tstun: move TAP support out to separate package feature/tapBrad Fitzpatrick7-20/+85
Still behind the same ts_omit_tap build tag. See #14738 for background on the pattern. Updates #12614 Change-Id: I03fb3d2bf137111e727415bd8e713d8568156ecc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-23appc,ipn/ipnlocal: log DNS parsing errors in app connectors (#14607)Andrew Lytvynov5-35/+78
If we fail to parse the upstream DNS response in an app connector, we might miss new IPs for the target domain. Log parsing errors to be able to diagnose that. Updates #14606 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-01-23derp,wgengine/magicsock: remove unexpected label (#14711)Mike O'Driscoll2-5/+4
Remove "unexpected" labelling of PeerGoneReasonNotHere. A peer being no longer connected to a DERP server is not an unexpected case and causes confusion in looking at logs. Fixes tailscale/corp#25609 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-01-23cmd/k8s-operator: fix reconciler name clash (#14712)Tom Proctor1-0/+7
The new ProxyGroup-based Ingress reconciler is causing a fatal log at startup because it has the same name as the existing Ingress reconciler. Explicitly name both to ensure they have unique names that are consistent with other explicitly named reconcilers. Updates #14583 Change-Id: Ie76e3eaf3a96b1cec3d3615ea254a847447372ea Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-01-22feature/*: make Wake-on-LAN conditional, start supporting modular featuresBrad Fitzpatrick18-242/+355
This pulls out the Wake-on-LAN (WoL) code out into its own package (feature/wakeonlan) that registers itself with various new hooks around tailscaled. Then a new build tag (ts_omit_wakeonlan) causes the package to not even be linked in the binary. Ohter new packages include: * feature: to just record which features are loaded. Future: dependencies between features. * feature/condregister: the package with all the build tags that tailscaled, tsnet, and the Tailscale Xcode project extension can empty (underscore) import to load features as a function of the defined build tags. Future commits will move of our "ts_omit_foo" build tags into this style. Updates #12614 Change-Id: I9c5378dafb1113b62b816aabef02714db3fc9c4a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-22ipn/ipnlocal: re-advertise appc routes on startup, take 2 (#14740)Andrew Lytvynov2-3/+87
* Reapply "ipn/ipnlocal: re-advertise appc routes on startup (#14609)" This reverts commit 51adaec35a3e4d25df88d81e6264584e151bd33d. Signed-off-by: Andrew Lytvynov <awly@tailscale.com> * ipn/ipnlocal: fix a deadlock in readvertiseAppConnectorRoutes Don't hold LocalBackend.mu while calling the methods of appc.AppConnector. Those methods could call back into LocalBackend and try to acquire it's mutex. Fixes https://github.com/tailscale/corp/issues/25965 Fixes #14606 Signed-off-by: Andrew Lytvynov <awly@tailscale.com> --------- Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-01-22cmd/tailscale: define CLI tools to manipulate macOS network and system ↵Andrea Gottardo8-68/+213
extensions (#14727) Updates tailscale/corp#25278 Adds definitions for new CLI commands getting added in v1.80. Refactors some pre-existing CLI commands within the `configure` tree to clean up code. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2025-01-22tailcfg: add ServiceNameAdrian Dewhurst12-72/+95
Rather than using a string everywhere and needing to clarify that the string should have the svc: prefix, create a separate type for Service names. Updates tailscale/corp#24607 Change-Id: I720e022f61a7221644bb60955b72cacf42f59960 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>
2025-01-22.github: Bump slackapi/slack-github-action from 1.27.0 to 2.0.0 (#14141)dependabot[bot]2-8/+7
Bumps [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) from 1.27.0 to 2.0.0. - [Release notes](https://github.com/slackapi/slack-github-action/releases) - [Commits](https://github.com/slackapi/slack-github-action/compare/37ebaef184d7626c5f204ab8d3baff4262dd30f0...485a9d42d3a73031f12ec201c457e2162c45d02d) --- updated-dependencies: - dependency-name: slackapi/slack-github-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-22util/slicesx: add AppendNonzeroBrad Fitzpatrick4-4/+26
By request of @agottardo. Updates #cleanup Change-Id: I2f02314eb9533b1581e47b66b45b6fb8ac257bb7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-22tailcfg: remove now-unused TailscaleFunnelEnabled methodBrad Fitzpatrick1-8/+0
As of tailscale/corp#26003 Updates tailscale/tailscale#11572 Change-Id: I5de2a0951b7b8972744178abc1b0e7948087d412 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-22delete extra struct in tailcfgKevinLiang101-16/+0
Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>
2025-01-22fix handler related and some nitKevinLiang105-43/+39
Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>
2025-01-22add blank lineKevinLiang101-0/+1
Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>
2025-01-22add copyright headerKevinLiang101-0/+2
Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.