summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2025-10-14VERSION.txt: this is v1.88.4v1.88.4release-branch/1.88releaaseWill Hannah1-1/+1
Signed-off-by: Will Hannah <willh@tailscale.com>
2025-10-14wgengine/magicsock: fix rebind debouncing (#17282)James Tucker2-11/+30
On platforms that are causing EPIPE at a high frequency this is resulting in non-working connections, for example when Apple decides to forcefully close UDP sockets due to an unsoliced packet rejection in the firewall. Too frequent rebinds cause a failure to solicit the endpoints triggering the rebinds, that would normally happen via CallMeMaybe. Updates #14551 Updates tailscale/corp#25648 Signed-off-by: James Tucker <james@tailscale.com>
2025-10-14wgengine/magicsock: fix relayManager deadlock (#17449) (#17511)Jordan Whited2-1/+43
Updates tailscale/corp#32978 (cherry picked from commit e44e28efcd95596c0a86270c177ef912119bf851) Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-09-25VERSION.txt: this is v1.88.3v1.88.3Will Hannah1-1/+1
Signed-off-by: Will Hannah <willh@tailscale.com>
2025-09-23control/controlhttp: simplify, fix race dialing, remove priority conceptBrad Fitzpatrick4-322/+303
controlhttp has the responsibility of dialing a set of candidate control endpoints in a way that minimizes user facing latency. If one control endpoint is unavailable we promptly dial another, racing across the dimensions of: IPv6, IPv4, port 80, and port 443, over multiple server endpoints. In the case that the top priority endpoint was not available, the prior implementation would hang waiting for other results, so as to try to return the highest priority successful connection to the rest of the client code. This hang would take too long with a large dialplan and sufficient client to endpoint latency as to cause the server to timeout the connection due to inactivity in the intermediate state. Instead of trying to prioritize non-ideal candidate connections, the first successful connection is now used unconditionally, improving user facing latency and avoiding any delays that would encroach on the server-side timeout. The tests are converted to memnet and synctest, running on all platforms. Fixes #8442 Fixes tailscale/corp#32534 Co-authored-by: James Tucker <james@tailscale.com> Change-Id: I4eb57f046d8b40403220e40eb67a31c41adb3a38 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com> (cherry picked from commit db048e905d6636006d06c93da06fad3ff075e97b)
2025-09-23cmd/tailscale/cli: add ts2021 debug flag to set a dial planBrad Fitzpatrick1-3/+18
Updates tailscale/corp#32534 Change-Id: Ief4ee0a263ea1edbf652b74d8c335c1e5ee209d7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> (cherry picked from commit d7ec043306ed128e5c5f540e944371a98474f36c)
2025-09-23net/dnscache: fix case where Resolver could return zero IP with single IPv6 ↵Brad Fitzpatrick2-0/+61
address The controlhttp dialer with a ControlDialPlan IPv6 entry was hitting a case where the dnscache Resolver was returning an netip.Addr zero value, where it should've been returning the IPv6 address. We then tried to dial "invalid IP:80", which would immediately fail, at least locally. Mostly this was causing spammy logs when debugging other stuff. Updates tailscale/corp#32534 Change-Id: If8b9a20f10c1a6aa8a662c324151d987fe9bd2f8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> (cherry picked from commit 1b6bc37f2859007dc4ed949b14f1f8531990b3cf)
2025-09-22ipn/ipnauth: don't crash on OpenBSD trying to log username of unknown peerBrad Fitzpatrick2-2/+6
We never implemented the peercred package on OpenBSD (and I just tried again and failed), but we've always documented that the creds pointer can be nil for operating systems where we can't map the unix socket back to its UID. On those platforms, we set the default unix socket permissions such that only the admin can open it anyway and we don't have a read-only vs read-write distinction. OpenBSD was always in that camp, where any access to Tailscale's unix socket meant full access. But during some refactoring, we broke OpenBSD in that we started assuming during one logging path (during login) that Creds was non-nil when looking up an ipnauth.Actor's username, which wasn't relevant (it was called from a function "maybeUsernameOf" anyway, which threw away errors). Verified on an OpenBSD VM. We don't have any OpenBSD integration tests yet. Fixes #17209 Updates #17221 (cherry picked from commit 8ec07b5f7fc31e5d86aa9db4f0c7fe5498d3f9fa, without the one semantic change, limiting it to just the safest part of the fix) Change-Id: I473c5903dfaa645694bcc75e7f5d484f3dd6044d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-17VERSION.txt: this is v1.88.2v1.88.2Will Hannah1-1/+1
Signed-off-by: Will Hannah <willh@tailscale.com>
2025-09-15k8s-operator: reset service status before append (#17120) (#17137)David Bond2-4/+10
This commit fixes an issue within the service reconciler where we end up in a constant reconciliation loop. When reconciling, the loadbalancer status is appended to but not reset between each reconciliation, leading to an ever growing slice of duplicate statuses. Fixes https://github.com/tailscale/tailscale/issues/17105 Fixes https://github.com/tailscale/tailscale/issues/17107 (cherry picked from commit 782c16c5138fb0f83ea80ed1793e3be93791d280) Signed-off-by: David Bond <davidsbond93@gmail.com>
2025-09-11VERSION.txt: this is v1.88.1v1.88.1Will Hannah1-1/+1
Signed-off-by: Will Hannah <willh@tailscale.com>
2025-09-11VERSION.txt: this is v1.88.0Will Hannah1-1/+1
Signed-off-by: Will Hannah <willh@tailscale.com>
2025-09-10wgengine/magicsock: add TS_DEBUG_NEVER_DIRECT_UDP debug knob (#17094)Jordan Whited3-0/+7
Updates tailscale/corp#30903 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-09-10tstest/integration/testcontrol: propagate CapVer (#17093)Jordan Whited1-0/+2
To support integration testing of client features that rely on it, e.g. peer relay. Updates tailscale/corp#30903 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-09-10wgengine/magicsock: add relayManager event logs (#17091)Jordan Whited2-11/+69
These are gated behind magicsock component debug logging. Updates tailscale/corp#30818 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-09-10cmd/k8s-operator: simplify scope of e2e tests (#17076)Tom Proctor4-225/+168
Removes ACL edits from e2e tests in favour of trying to simplify the tests and separate the actual test logic from the environment setup logic as much as possible. Also aims to fit in with the requirements that will generally be filled anyway for most devs working on the operator; in particular using tags that fit in with our documentation. Updates tailscale/corp#32085 Change-Id: I7659246e39ec0b7bcc4ec0a00c6310f25fe6fac2 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-09-09wgengine/magicsock: fix debug disco printing of alloc resp disco keys (#17087)Jordan Whited1-2/+2
Updates tailscale/corp#30818 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-09-09disco: add missing message types to MessageSummary (#17081)Jordan Whited1-0/+6
Updates tailscale/corp#30818 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-09-09cmd/tailscale: use tailnet display name on cli (#17079)nikiUppal-TS2-5/+21
Updates cli to use tailnet display name Updates tailscale/corp#32108 Signed-off-by: nikiUppal-TS <nikita@tailscale.com>
2025-09-09ipn/ipnlocal, types: plumb tailnet display name cap through to network ↵Nick O'Neill4-0/+26
profile (#17045) Updates tailscale/corp#30456 Signed-off-by: Nick O'Neill <nick@tailscale.com>
2025-09-09cmd/tailscaled: add disabled debug file to force reflect for binary size ↵Brad Fitzpatrick1-0/+26
experiments This adds a file that's not compiled by default that exists just to make it easier to do binary size checks, probing what a binary would be like if it included reflect methods (as used by html/template, etc). As an example, once tailscaled uses reflect.Type.MethodByName(non-const-string) anywhere, the build jumps up by 14.5 MB: $ GOOS=linux GOARCH=amd64 ./tool/go build -tags=ts_include_cli,ts_omit_webclient,ts_omit_systray,ts_omit_debugeventbus -o before ./cmd/tailscaled $ GOOS=linux GOARCH=amd64 ./tool/go build -tags=ts_include_cli,ts_omit_webclient,ts_omit_systray,ts_omit_debugeventbus,ts_debug_forcereflect -o after ./cmd/tailscaled $ ls -l before after -rwxr-xr-x@ 1 bradfitz staff 41011861 Sep 9 07:28 before -rwxr-xr-x@ 1 bradfitz staff 55610948 Sep 9 07:29 after This is particularly pronounced with large deps like the AWS SDK. If you compare using ts_omit_aws: -rwxr-xr-x@ 1 bradfitz staff 38284771 Sep 9 07:40 no-aws-no-reflect -rwxr-xr-x@ 1 bradfitz staff 45546491 Sep 9 07:41 no-aws-with-reflect That means adding AWS to a non-reflect binary adds 2.7 MB but adding AWS to a reflect binary adds 10 MB. Updates #17063 Updates #12614 Change-Id: I18e9b77c9cf33565ce5bba65ac5584fa9433f7fb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-09tsnet: remove APIClient() which is deprecated and now unused (#17073)Alex Chan3-28/+6
Updates tailscale/corp#22748 Signed-off-by: Alex Chan <alexc@tailscale.com>
2025-09-08cmd/tailscale, ipn/ipnlocal: add ts_omit_webclientBrad Fitzpatrick8-23/+63
Fixes #17063 Updates #12614 Change-Id: I0a189f6a4d1c4558351e3195839867725774fa96 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-08util/eventbus: add ts_omit_debugeventbusBrad Fitzpatrick3-3/+3
Updates #17063 Change-Id: Ibc98dd2088f82c829effa71f72f3e2a5abda5038 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-08go.toolchain.rev: bump to Go 1.25.1Brad Fitzpatrick2-2/+2
Updates #17064 Change-Id: Ibbca837e0921fe9f82fc931dde8bb51b017e4e48 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-08licenses: update license noticesLicense Updater2-11/+11
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2025-09-08cmd/tailscale/cli, derp: use client/local instead of deprecated ↵Alex Chan13-31/+26
client/tailscale (#17061) * cmd/tailscale/cli: use client/local instead of deprecated client/tailscale Updates tailscale/corp#22748 Signed-off-by: Alex Chan <alexc@tailscale.com> * derp: use client/local instead of deprecated client/tailscale Updates tailscale/corp#22748 Signed-off-by: Alex Chan <alexc@tailscale.com> --------- Signed-off-by: Alex Chan <alexc@tailscale.com>
2025-09-08util/expvarx: deflake TestSafeFuncHappyPath with synctestBrad Fitzpatrick1-14/+15
I probably could've deflaked this without synctest, but might as well use it now that Go 1.25 has it. Fixes #15348 Change-Id: I81c9253fcb7eada079f3e943ab5f1e29ba8e8e31 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-08utils/expvarx, tstest/integration: mark two tests as known flaky (#17052)Alex Chan2-0/+4
* utils/expvarx: mark TestSafeFuncHappyPath as known flaky Updates #15348 Signed-off-by: Alex Chan <alexc@tailscale.com> * tstest/integration: mark TestCollectPanic as known flaky Updates #15865 Signed-off-by: Alex Chan <alexc@tailscale.com> --------- Signed-off-by: Alex Chan <alexc@tailscale.com>
2025-09-08cmd/tailscale/cli: fix the spelling of "routes" (#17039)Alex Chan2-3/+3
Updates #cleanup Signed-off-by: Alex Chan <alexc@tailscale.com>
2025-09-07prober: include current probe results in run-probe text responseAnton Tolchanov2-8/+10
It was a bit confusing that provided history did not include the current probe results. Updates tailscale/corp#20583 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2025-09-05wgengine/magicsock: log the peer failing disco writes are intended forJames Tucker1-1/+1
Updates tailscale/corp#31762 Signed-off-by: James Tucker <james@tailscale.com>
2025-09-05cmd/tailscale/cli: add new line for set --webclient (#17043)Mike O'Driscoll1-1/+1
Fixes #17042 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-09-05ipn/ipnlocal: add state change test for key expiryJames Sanderson1-0/+15
Updates tailscale/corp#31478 Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-09-04util/syspolicy/policyclient: always use no-op policyclient in tests by defaultBrad Fitzpatrick1-1/+9
We should never use the real syspolicy implementation in tests by default. (the machine's configuration shouldn't affect tests) You either specify a test policy, or you get a no-op one. Updates #16998 Change-Id: I3350d392aad11573a5ad7caab919bb3bbaecb225 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-04ipn/ipnlocal, util/syspolicy: convert last RegisterWellKnownSettingsForTest ↵Brad Fitzpatrick5-36/+129
caller, remove Updates #16998 Change-Id: I735d75129a97a929092e9075107e41cdade18944 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-04cmd/containerboot: do not reset state on non-existant secret (#17021)David Bond1-2/+5
This commit modifies containerboot's state reset process to handle the state secret not existing. During other parts of the boot process we gracefully handle the state secret not being created yet, but missed that check within `resetContainerbootState` Fixes https://github.com/tailscale/tailscale/issues/16804 Signed-off-by: David Bond <davidsbond93@gmail.com>
2025-09-03util/syspolicy: remove handler, other dead codeBrad Fitzpatrick3-125/+0
Fixes #17022 Change-Id: I6a0f6488ae3ea75c5844dfcba68e1e8024e930be Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-03cmd/k8s-operator: update connector example (#17020)David Bond1-1/+2
This commit modifies the connector example to use the new hostname prefix and replicas fields Signed-off-by: David Bond <davidsbond93@gmail.com>
2025-09-03ipn/local: fix deadlock in initial suggested exit node query (#17025)Jonathan Nobels1-1/+1
updates tailscale/corp#26369 b.mu is locked here. We need to use suggestExitNodeLocked. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2025-09-03drive: fix StatCache mishandling of paths with spacesCraig Hesling2-5/+11
Fix "file not found" errors when WebDAV clients access files/dirs inside directories with spaces. The issue occurred because StatCache was mixing URL-escaped and unescaped paths, causing cache key mismatches. Specifically, StatCache.set() parsed WebDAV responses containing URL-escaped paths (ex. "Dir%20Space/file1.txt") and stored them alongside unescaped cache keys (ex. "Dir Space/file1.txt"). This mismatch prevented StatCache.get() from correctly determining whether a child file existed. See https://github.com/tailscale/tailscale/issues/13632#issuecomment-3243522449 for the full explanation of the issue. The decision to keep all paths references unescaped inside the StatCache is consistent with net/http.Request.URL.Path and rewrite.go (sole consumer) Update unit test to detect this directory space mishandling. Fixes tailscale#13632 Signed-off-by: Craig Hesling <craig@hesling.com>
2025-09-03util/syspolicy: delete some unused code in handler.goBrad Fitzpatrick1-17/+2
There's a TODO to delete all of handler.go, but part of it's still used in another repo. But this deletes some. Updates #17022 Change-Id: Ic5a8a5a694ca258440307436731cd92b45ee2d21 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-03ipn: warn about self as the exit node if backend is running (#17018)Alex Chan2-3/+20
Before: $ tailscale ip -4 1.2.3.4 $ tailscale set --exit-node=1.2.3.4 no node found in netmap with IP 1.2.3.4 After: $ tailscale set --exit-node=1.2.3.4 cannot use 1.2.3.4 as an exit node as it is a local IP address to this machine; did you mean --advertise-exit-node? The new error message already existed in the code, but would only be triggered if the backend wasn't running -- which means, in practice, it would almost never be triggered. The old error message is technically true, but could be confusing if you don't know the distinction between "netmap" and "tailnet" -- it could sound like the exit node isn't part of your tailnet. A node is never in its own netmap, but it is part of your tailnet. This error confused me when I was doing some local dev work, and it's confused customers before (e.g. #7513). Using the more specific error message should reduce confusion. Updates #7513 Updates https://github.com/tailscale/corp/issues/23596 Signed-off-by: Alex Chan <alexc@tailscale.com>
2025-09-02ipn/ipnlocal: convert more tests to use policytest, de-global-ifyBrad Fitzpatrick3-71/+125
Now that we have policytest and the policyclient.Client interface, we can de-global-ify many of the tests, letting them run concurrently with each other, and just removing global variable complexity. This does ~half of the LocalBackend ones. Updates #16998 Change-Id: Iece754e1ef4e49744ccd967fa83629d0dca6f66a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-02util/syspolicy: finish adding ts_omit_syspolicy build tags, testsBrad Fitzpatrick8-113/+163
Fixes #16998 Updates #12614 Change-Id: Idf2b1657898111df4be31f356091b2376d0d7f0b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-02util/syspolicy/policytest: move policy test helper to its own packageBrad Fitzpatrick2-59/+120
Updates #16998 Updates #12614 Change-Id: I9fd27d653ebee547951705dc5597481e85b60747 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-02util/syspolicy: finish plumbing policyclient, add feature/syspolicy, move ↵Brad Fitzpatrick44-207/+242
global impl This is step 4 of making syspolicy a build-time feature. This adds a policyclient.Get() accessor to return the correct implementation to use: either the real one, or the no-op one. (A third type, a static one for testing, also exists, so in general a policyclient.Client should be plumbed around and not always fetched via policyclient.Get whenever possible, especially if tests need to use alternate syspolicy) Updates #16998 Updates #12614 Change-Id: Iaf19670744a596d5918acfa744f5db4564272978 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-02ipn/ipnlocal: revert some locking changes ahead of release branch cut (#17011)M. J. Fromberger3-220/+211
2025-09-02ipn/ipnlocal: simplify a test with a new simpler syspolicy client test typeBrad Fitzpatrick2-35/+68
Less indirection. Updates #16998 Updates #12614 Change-Id: I5a3a3c3f3b195486b2731ec002d2532337b3d211 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-02ipn/ipnlocal: use policyclient.Client always, stop using global syspolicy funcsBrad Fitzpatrick6-47/+168
Step 4 of N. See earlier commits in the series (via the issue) for the plan. This adds the missing methods to policyclient.Client and then uses it everywhere in ipn/ipnlocal and locks it in with a new dep test. Still plenty of users of the global syspolicy elsewhere in the tree, but this is a lot of them. Updates #16998 Updates #12614 Change-Id: I25b136539ae1eedbcba80124de842970db0ca314 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.