summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2023-08-03tool/gocross: ensure there is no mid-build toolchain changeraggi/gotoolchainJames Tucker1-0/+3
Set GOTOOLCHAIN=local as per https://go.dev/doc/toolchain to prevent dynamic switching of the toolchain during a build. I haven't reproduced directly that this contributes to symptoms we are presently diagnosing, but I am confident this is the behavior that we want. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>
2023-08-03go.mod: upgrade nfpm to v2 (#8786)Andrew Lytvynov6-427/+167
Upgrade the nfpm package to the latest version to pick up https://github.com/goreleaser/nfpm/commit/24a43c5ad7cfc549e8a4ec930521a97a30f26cc8. The upgrade is from v0 to v2, so there was some breakage to fix. Generated packages should have the same contents as before. Updates https://github.com/tailscale/tailscale/issues/1882 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-08-03go.mod, cmd/tailscaled, ipn/localapi, util/osdiag, util/winutil, ↵Aaron Klotz17-305/+575
util/winutil/authenticode: add Windows module list to OS-specific logs that are written upon bugreport * We update wingoes to pick up new version information functionality (See pe/version.go in the https://github.com/dblohm7/wingoes repo); * We move the existing LogSupportInfo code (including necessary syscall stubs) out of util/winutil into a new package, util/osdiag, and implement the public LogSupportInfo function may be implemented for other platforms as needed; * We add a new reason argument to LogSupportInfo and wire that into localapi's bugreport implementation; * We add module information to the Windows implementation of LogSupportInfo when reason indicates a bugreport. We enumerate all loaded modules in our process, and for each one we gather debug, authenticode signature, and version information. Fixes #7802 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2023-08-02tailcfg,ipn/localapi,client/tailscale: add QueryFeature endpointSonia Appasamy5-0/+128
Updates tailscale/corp#10577 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-08-02go.toolchain.rev: go1.21rc4 (now that VERSION file is updated upstream)Brad Fitzpatrick1-1/+1
Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-02cmd/tailscale/cli: add latest version output to "tailscale version" (#8700)Andrew Lytvynov2-3/+34
Add optional `--upstream` flag to `tailscale version` to fetch the latest upstream release version from `pkgs.tailscale.com`. This is useful to diagnose `tailscale update` behavior or write other tooling. Example output: $ tailscale version --upstream --json { "majorMinorPatch": "1.47.35", "short": "1.47.35", "long": "1.47.35-t6afffece8", "unstableBranch": true, "gitCommit": "6afffece8a32509aa7a4dc2972415ec58d8316de", "cap": 66, "upstream": "1.45.61" } Fixes #8669 RELNOTE=adds "tailscale version --upstream" Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-08-01licenses: update android licensesLicense Updater1-9/+11
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2023-08-01go.toolchain.rev: bump to ~go1.21rc4Brad Fitzpatrick1-1/+1
Updates tailscale/go#69 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-01tailcfg: add CapabilityHTTPS constSonia Appasamy1-0/+1
A #cleanup Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-08-01ipnlocal, net/*: deprecate interfaces.GetState, use netmon more for itBrad Fitzpatrick5-10/+10
Updates #cleanup Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-01licenses: update tailscale{,d} licensesLicense Updater1-1/+1
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2023-08-01all: implement lock revoke-keys commandTom DNetto7-3/+709
The revoke-keys command allows nodes with tailnet lock keys to collaborate to erase the use of a compromised key, and remove trust in it. Signed-off-by: Tom DNetto <tom@tailscale.com> Updates ENG-1848
2023-08-01cmd/tailscale/cli, util/winutil/authenticode: flesh out authenticode supportAaron Klotz7-29/+681
Previously, tailscale upgrade was doing the bare minimum for checking authenticode signatures via `WinVerifyTrustEx`. This is fine, but we can do better: * WinVerifyTrustEx verifies that the binary's signature is valid, but it doesn't determine *whose* signature is valid; tailscale upgrade should also ensure that the binary is actually signed *by us*. * I added the ability to check the signatures of MSI files. * In future PRs I will be adding diagnostic logging that lists details about every module (ie, DLL) loaded into our process. As part of that metadata, I want to be able to extract information about who signed the binaries. This code is modelled on some C++ I wrote for Firefox back in the day. See https://searchfox.org/mozilla-central/rev/27e4816536c891d85d63695025f2549fd7976392/toolkit/xre/dllservices/mozglue/Authenticode.cpp for reference. Fixes #8284 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2023-08-01cmd/sniproxy: add client metricsDenton Gentry1-0/+18
Count number of sessions, number of DNS queries answered successfully and in error, and number of http->https redirects. Updates #1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2023-07-31cmd/dist,release/dist: sign release tarballs with an ECDSA key (#8759)Andrew Lytvynov4-10/+63
Pass an optional PEM-encoded ECDSA key to `cmd/dist` to sign all built tarballs. The signature is stored next to the tarball with a `.sig` extension. Tested this with an `openssl`-generated key pair and verified the resulting signature. Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-07-31client/tailscale/apitype: document never-nil property of WhoIsResponseDavid Anderson2-2/+3
Every time I use WhoIsResponse I end up writing mildly irritating nil-checking for both Node and UserProfile, but it turns out our code guarantees that both are non-nil in successful whois responses. Updates #cleanup Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-30derp/derphttp: add optional Client.BaseContext hookBrad Fitzpatrick1-5/+23
Like net/http.Server.BaseContext, this lets callers specify a base context for dials. Updates tailscale/corp#12702 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-07-29tailcfg: add helper to unmarshal PeerCap valuesMaisem Ali1-0/+19
Updates #4217 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-07-29wgengine/magicsock: remove dead code (#8745)salman aljammaz1-5/+0
The nonce value is not read by anything, and di.sharedKey.Seal() a few lines below generates its own. #cleanup Signed-off-by: salman <salman@tailscale.com>
2023-07-28licenses: update tailscale{,d} licensesLicense Updater1-2/+2
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2023-07-28types/logid: add a Compare methodDavid Anderson1-1/+5
Updates #cleanup Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-28all: update exp/slices and fix call sitesDavid Anderson16-50/+91
slices.SortFunc suffered a late-in-cycle API breakage. Updates #cleanup Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-27derp: use tstime (#8634)Claire Wang8-27/+43
Updates #8587 Signed-off-by: Claire Wang <claire@tailscale.com>
2023-07-27ipn: use tstime (#8597)Claire Wang8-43/+52
Updates #8587 Signed-off-by: Claire Wang <claire@tailscale.com>
2023-07-27ipn/{ipnlocal,localapi}: actually renew certs before expiry (#8731)Andrew Lytvynov5-40/+63
While our `shouldStartDomainRenewal` check is correct, `getCertPEM` would always bail if the existing cert is not expired. Add the same `shouldStartDomainRenewal` check to `getCertPEM` to make it proceed with renewal when existing certs are still valid but should be renewed. The extra check is expensive (ARI request towards LetsEncrypt), so cache the last check result for 1hr to not degrade `tailscale serve` performance. Also, asynchronous renewal is great for `tailscale serve` but confusing for `tailscale cert`. Add an explicit flag to `GetCertPEM` to force a synchronous renewal for `tailscale cert`. Fixes #8725 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-07-27api.md: update device authorize API docs to allow for deauth (#8728)tinku-tailscale1-1/+2
Signed-off-by: tinku-tailscale <139132124+tinku-tailscale@users.noreply.github.com>
2023-07-26cli: introduce exit-node subcommand to list and filter exit nodesCharlotte Brandhorst-Satzkorn7-1/+571
This change introduces a new subcommand, `exit-node`, along with a subsubcommand of `list` and a `--filter` flag. Exit nodes without location data will continue to be displayed when `status` is used. Exit nodes with location data will only be displayed behind `exit-node list`, and in status if they are the active exit node. The `filter` flag can be used to filter exit nodes with location data by country. Exit nodes with Location.Priority data will have only the highest priority option for each country and city listed. For countries with multiple cities, a <Country> <Any> option will be displayed, indicating the highest priority node within that country. Updates tailscale/corp#13025 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-07-26wgengine/magicsock: document mysterious-looking assignmentDavid Anderson1-0/+2
Updates #cleanup Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-26wgengine/magicsock: factor out more separable partsDavid Anderson7-1285/+1350
Updates #8720 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-26disco: move disco pcap helper to disco packageDavid Anderson4-42/+52
Updates tailscale/corp#13464 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-26wgengine/magicsock: factor out peerMap into separate fileDavid Anderson2-173/+183
Updates tailscale/corp#13464 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-26wgengine/magicsock: factor out endpoint into its own fileDavid Anderson2-1125/+1140
Updates tailscale/corp#13464 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-26wgengine/magicsock: delete unused stuffDavid Anderson4-65/+0
Updates tailscale/corp#13464 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-25cmd/tailscale/cli: implement update on FreeBSD (#8710)Andrew Lytvynov1-4/+45
Implement `tailscale update` on FreeBSD. This is much simpler than other platforms because `pkg rquery` lets us get the version in their repos without any extra parsing. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-07-25tailcfg,ipn/ipnlocal,wgengine: add values to PeerCapabilitiesMaisem Ali13-68/+139
Define PeerCapabilty and PeerCapMap as the new way of sending down inter-peer capability information. Previously, this was unstructured and you could only send down strings which got too limiting for certain usecases. Instead add the ability to send down raw JSON messages that are opaque to Tailscale but provide the applications to define them however they wish. Also update accessors to use the new values. Updates #4217 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-07-24cmd/tailscale/cli,version/distro: update support for Alpine (#8701)Andrew Lytvynov3-3/+140
Similar to Arch support, use the latest version info from the official `apk` repo and don't offer explicit track or version switching. Add detection for Alpine Linux in version/distro along the way. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-07-24net/art: use more intelligible, go-ish state tracking in table.GetDavid Anderson1-10/+10
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: use encoding/binary for address bit twiddlingDavid Anderson1-4/+3
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: move slice closer to its useDavid Anderson1-3/+2
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: factor out picking the right strideTable for addr familyDavid Anderson1-18/+13
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: make Table.Get alloc-freeDavid Anderson1-2/+14
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: document return value of strideTable.deleteDavid Anderson1-1/+3
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: reword confusing function docstringDavid Anderson1-2/+2
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: use "index", not "idx" in function namesDavid Anderson2-8/+4
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: document valid values of strideTable.prefixDavid Anderson1-2/+5
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: fix comment typoDavid Anderson1-1/+1
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: fix slowPrefixTable bugs found by fuzzingDavid Anderson1-2/+4
One is a straight "I forgot how to Go" bug, the others are semantic mismatches with the main implementation around masking the prefixes passed to insert/delete. Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: add another consistency test for insert/deleteDavid Anderson1-0/+29
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: add more exhaustive table testingDavid Anderson1-12/+705
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-24net/art: fix format of debug outputDavid Anderson1-1/+1
Updates #7781 Signed-off-by: David Anderson <danderson@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.