summaryrefslogtreecommitdiffhomepage
path: root/cmd
AgeCommit message (Collapse)AuthorFilesLines
2021-01-15cmd/tailscale/cli: tweak the status name column a bitBrad Fitzpatrick1-2/+2
* make peers without DNS names show their hostnames as always one column, for cut/etc users * remove trailing dot from shared peers' DNS names
2021-01-14all: convert from []wgcfg.Endpoint to stringJosh Bleecher Snyder2-2/+2
This eliminates a dependency on wgcfg.Endpoint, as part of the effort to eliminate our wireguard-go fork. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-01-14wgengine/magicsock: import more of wireguard-go, update docstrings.David Anderson2-2/+2
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-01-14wgengine/magicsock: stop depending on UpdateDst in legacy codepaths.David Anderson2-2/+2
This makes connectivity between ancient and new tailscale nodes slightly worse in some cases, but only in cases where the ancient version would likely have failed to get connectivity anyway. Signed-off-by: David Anderson <danderson@tailscale.com>
2021-01-11wgengine: on TCP connect fail/timeout, log some clues about why it failedBrad Fitzpatrick2-2/+2
So users can see why things aren't working. A start. More diagnostics coming. Updates #1094
2021-01-11all: adjust Unix permissions for those without umasksBrad Fitzpatrick2-2/+2
Fixes tailscale/corp#1165 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-01-11wgengine/magicsock: drop netaddr.IPPort cacheBrad Fitzpatrick2-2/+0
netaddr.IP no longer allocates, so don't need a cache or all its associated code/complexity. This totally removes groupcache/lru from the deps. Also go mod tidy.
2021-01-11Update depaware (removes lru from wgengine/filter)Brad Fitzpatrick2-2/+4
2021-01-11wengine/netstack: bump gvisor to latest versionNaman Sood1-4/+6
* wengine/netstack: bump gvisor to latest version Signed-off-by: Naman Sood <naman@tailscale.com> * update dependencies Signed-off-by: Naman Sood <naman@tailscale.com> * Don't change hardcoded IP Signed-off-by: Naman Sood <naman@tailscale.com>
2021-01-11cmd/tailscaled, wgengine/netstack: add start of gvisor userspace netstack workBrad Fitzpatrick2-2/+37
Not usefully functional yet (mostly a proof of concept), but getting it submitted for some work @namansood is going to do atop this. Updates #707 Updates #634 Updates #48 Updates #835
2021-01-10cmd/tailscale: change formatting of "tailscale status"Brad Fitzpatrick3-27/+75
* show DNS name over hostname, removing domain's common MagicDNS suffix. only show hostname if there's no DNS name. but still show shared devices' MagicDNS FQDN. * remove nerdy low-level details by default: endpoints, DERP relay, public key. They're available in JSON mode still for those who need them. * only show endpoint or DERP relay when it's active with the goal of making debugging easier. (so it's easier for users to understand what's happening) The asterisks are gone. * remove Tx/Rx numbers by default for idle peers; only show them when there's traffic. * include peers' owner login names * add CLI option to not show peers (matching --self=true, --peers= also defaults to true) * sort by DNS/host name, not public key * reorder columns
2021-01-08wgengine/tstun: initialize wireguard-go TUN parametersJosh Bleecher Snyder2-2/+2
This will enable us to remove the corresponding code from our fork of wireguard-go. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-01-07tailscaled.service: Lock down clock and /dev (#1071)Frederik “Freso” S. Olesen1-0/+6
Research in issue #1063 uncovered why tailscaled would fail with ProtectClock enabled (it implicitly enabled DevicePolicy=closed). This knowledge in turn also opens the door for locking down /dev further, e.g. explicitly setting DevicePolicy=strict (instead of closed), and making /dev private for the unit. Additional possible future (or downstream) lockdown that can be done is setting `PrivateDevices=true` (with `BindPaths=/dev/net/`), however, systemd 233 or later is required for this, and tailscaled currently need to work for systemd down to version 215. Closes https://github.com/tailscale/tailscale/issues/1063 Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>
2020-12-30wgkey: new packageJosh Bleecher Snyder3-4/+6
This is a replacement for the key-related parts of the wireguard-go wgcfg package. This is almost a straight copy/paste from the wgcfg package. I have slightly changed some of the exported functions and types to avoid stutter, added and tweaked some comments, and removed some now-unused code. To avoid having wireguard-go depend on this new package, wgcfg will keep its key types. We translate into and out of those types at the last minute. These few remaining uses will be eliminated alongside the rest of the wgcfg package. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2020-12-28all: replace wgcfg.IP and wgcfg.CIDR with netaddr typesJosh Bleecher Snyder1-29/+4
Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2020-12-25Fix typo in cmd/tailscale/cli/cli.go (#1069)Charlotte Brandhorst-Satzkorn1-1/+1
Remove duplicate 'to connect' in error message. Fixes #1068 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@catzkorn.dev>
2020-12-24tailscaled.service: Harden systemd unit somewhat (#1062)Frederik “Freso” S. Olesen1-0/+11
While not a full capability lockdown of the systemd unit, this still improves sandboxing and security of the running process a good deal. Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>
2020-12-23cmd/tailscale*: make updatedepsMatt Layher2-2/+2
Signed-off-by: Matt Layher <mdlayher@gmail.com>
2020-12-22go.mod: bump inet.af/netaddr to non-allocating versionBrad Fitzpatrick2-0/+4
2020-12-21wgengine/router/dns: remove unsafe endianness detection on LinuxBrad Fitzpatrick2-4/+4
2020-12-21cmd/tailscaled, logpolicy, logtail: support log levelsBrad Fitzpatrick1-0/+3
Log levels can now be specified with "[v1] " or "[v2] " substrings that are then stripped and filtered at the final logger. This follows our existing "[unexpected]" etc convention and doesn't require a wholesale reworking of our logging at the moment. cmd/tailscaled then gets a new --verbose=N flag to take a log level that controls what gets logged to stderr (and thus systemd, syslog, etc). Logtail is unaffected by --verbose. This commit doesn't add annotations to any existing log prints. That is in the next commit. Updates #924 Updates #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-12-15Merge branch 'main' into report-status-systemdChristine Dodrill3-17/+11
2020-12-15ipn/ipnserver: enable systemd-notify supportChristine Dodrill3-0/+5
Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>
2020-12-14depaware.txt: updateJosh Bleecher Snyder1-0/+1
Upgrading staticcheck upgraded golang.org/x/sync (one downside of mixing our tools in with our regular go.mod), which introduced a new dependency via https://go-review.googlesource.com/c/sync/+/251677 That CL could and probably should be written without runtime/debug, but it's not clear to me that that is better at this moment than simply accepting the additional package as a dependency. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2020-12-11Update depaware.txt files.Aleksandar Pesic2-16/+6
Signed-off-by: Aleksandar Pesic <peske.nis@gmail.com>
2020-12-09logpolicy: migrate from x/crypto/ssh/terminal to x/termBrad Fitzpatrick1-1/+1
2020-12-01tailcfg, cmd/tailscale: add Hostinfo.ShareeNode, hide in "tailscale status"Brad Fitzpatrick1-0/+3
2020-11-19tstime: add Parse3339B, for byte slicesJosh Bleecher Snyder2-0/+2
Use go4.org/mem for memory safety. A slight performance hit, but a huge performance win for clients who start with a []byte. The perf hit is due largely to the MapHash call, which adds ~25ns. That is necessary to keep the fast path allocation-free. name old time/op new time/op delta GoParse3339/Z-8 281ns ± 1% 283ns ± 2% ~ (p=0.366 n=9+9) GoParse3339/TZ-8 509ns ± 0% 510ns ± 1% ~ (p=0.059 n=9+9) GoParse3339InLocation-8 330ns ± 1% 330ns ± 0% ~ (p=0.802 n=10+6) Parse3339/Z-8 69.3ns ± 1% 74.4ns ± 1% +7.45% (p=0.000 n=9+10) Parse3339/TZ-8 110ns ± 1% 140ns ± 3% +27.42% (p=0.000 n=9+10) ParseInt-8 8.20ns ± 1% 8.17ns ± 1% ~ (p=0.452 n=9+9) name old alloc/op new alloc/op delta GoParse3339/Z-8 0.00B 0.00B ~ (all equal) GoParse3339/TZ-8 160B ± 0% 160B ± 0% ~ (all equal) GoParse3339InLocation-8 0.00B 0.00B ~ (all equal) Parse3339/Z-8 0.00B 0.00B ~ (all equal) Parse3339/TZ-8 0.00B 0.00B ~ (all equal) name old allocs/op new allocs/op delta GoParse3339/Z-8 0.00 0.00 ~ (all equal) GoParse3339/TZ-8 3.00 ± 0% 3.00 ± 0% ~ (all equal) GoParse3339InLocation-8 0.00 0.00 ~ (all equal) Parse3339/Z-8 0.00 0.00 ~ (all equal) Parse3339/TZ-8 0.00 0.00 ~ (all equal) Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2020-11-18tempfork/osexec: remove old fork of os/execBrad Fitzpatrick2-2/+0
This package was a temporary fork of os/exec to fix an EINTR loop bug that was fixed upstream for Go 1.15 in https://github.com/golang/go/commit/8c1db77a92b1d17d3fe07999c5f20602a2080be9 (https://go-review.googlesource.com/c/go/+/232862), in src/os/exec_unix.go: https://github.com/golang/go/commit/8c1db77a92b1d17d3fe07999c5f20602a2080be9#diff-72072cbd53a7240debad8aa506ff7ec795f9cfac7322e779f9bac29a4d0d0bd4
2020-11-16logpolicy: add -race suffix to Go version when race detector in useBrad Fitzpatrick1-0/+1
2020-11-14net/netstat: remove some unsafeBrad Fitzpatrick1-1/+1
Just removing any unnecessary unsafe while auditing unsafe usage for #921.
2020-11-14net/netns: remove use of unsafe on WindowsBrad Fitzpatrick2-2/+4
Found while auditing unsafe for #921 via the list at: https://github.com/tailscale/tailscale/issues/921#issuecomment-727365383 No need for unsafe here, so remove it.
2020-11-11net/dnscache, control/controlclient: use DNS cache when dialing controlBrad Fitzpatrick2-2/+2
Cache DNS results of earlier login.tailscale.com control dials, and use them for future dials if DNS is slow or broken. Fixes various issues with trickier setups with the domain's DNS server behind a subnet router. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-11-11net/netcheck: remove unused DNSCache from netcheckBrad Fitzpatrick1-4/+1
It's easy to add back later if/when the TODO is implemented.
2020-11-11Reverse earlier "allow tag without 'tag:' prefix" changes.Avery Pennarun1-12/+4
These accidentally make the tag syntax more flexible than was intended, which will create forward compatibility problems later. Let's go back to the old stricter parser. Revert "cmd/tailscale/cli: fix double tag: prefix in tailscale up" Revert "cmd/tailscale/cli, tailcfg: allow tag without "tag:" prefix in 'tailscale up'" This reverts commit a702921620f7b6e386f393a9a1340d4218597469. This reverts commit cd07437adefabec35d1f42b0f5b891c83c08e9fe. Affects #861. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>
2020-11-09tailscaled.service: also cleanup prior to starting.David Anderson1-0/+1
Fixes #813. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-11-09net/packet: rename from wgengine/packet.David Anderson2-4/+4
Signed-off-by: David Anderson <danderson@tailscale.com>
2020-11-09wgengine/router/dns: use OpenKeyWait to set DNS configuration.David Anderson2-2/+2
Fixes tailscale/corp#839. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-11-04cmd/tailscale/cli: fix double tag: prefix in tailscale upBrad Fitzpatrick1-3/+4
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-11-02Change some os.IsNotExist to errors.Is(err, os.ErrNotExist) for non-os errors.Brad Fitzpatrick1-1/+1
os.IsNotExist doesn't unwrap errors. errors.Is does. The ioutil.ReadFile ones happened to be fine but I changed them so we're consistent with the rule: if the error comes from os, you can use os.IsNotExist, but from any other package, use errors.Is. (errors.Is always would also work, but not worth updating all the code) The motivation here was that we were logging about failure to migrate legacy relay node prefs file on startup, even though the code tried to avoid that. See golang/go#41122
2020-10-29cmd/tailscaled: update depaware.txtBrad Fitzpatrick1-0/+1
2020-10-28version: use OSS repo's version when building.David Anderson4-4/+14
When building with redo, also include the git commit hash from the proprietary repo, so that we have a precise commit that identifies all build info (including Go toolchain version). Add a top-level build script demonstrating to downstream distros how to burn the right information into builds. Adjust `tailscale version` to print commit hashes when available. Fixes #841. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-10-28cmd/tailscale/cli, tailcfg: allow tag without "tag:" prefix in 'tailscale up'Brad Fitzpatrick1-4/+11
Fixes #861
2020-10-19ipn: use cmd/cloner for Prefs.CloneBrad Fitzpatrick1-18/+21
Also, make cmd/cloner's top-level "func Clone" generation opt-in. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2020-10-19types/logger: move RusagePrefixLog to logger package, disable by defaultBrad Fitzpatrick1-1/+5
The RusagePrefixLog is rarely useful, hasn't been useful in a long time, is rarely the measurement we need, and is pretty spammy (and syscall-heavy). Disable it by default. We can enable it when we're debugging memory.
2020-10-13wgengine/router: unfork winipcfg-go package, use upstreamAlex Brainman2-2/+2
Use golang.zx2c4.com/wireguard/windows/tunnel/winipcfg instead of github.com/tailscale/winipcfg-go package. Updates #760 Signed-off-by: Alex Brainman <alex.brainman@gmail.com>
2020-10-12ipn, ipnserver, cmd/tailscale: add "server mode" support on WindowsBrad Fitzpatrick2-1/+19
This partially (but not yet fully) migrates Windows to tailscaled's StateStore storage system. This adds a new bool Pref, ForceDaemon, defined as: // ForceDaemon specifies whether a platform that normally // operates in "client mode" (that is, requires an active user // logged in with the GUI app running) should keep running after the // GUI ends and/or the user logs out. // // The only current applicable platform is Windows. This // forced Windows to go into "server mode" where Tailscale is // running even with no users logged in. This might also be // used for macOS in the future. This setting has no effect // for Linux/etc, which always operate in daemon mode. Then, when ForceDaemon becomes true, we now write use the StateStore to track which user started it in server mode, and store their prefs under that key. The ipnserver validates the connections/identities and informs that LocalBackend which userid is currently in charge. The GUI can then enable/disable server mode at runtime, without using the CLI. But the "tailscale up" CLI was also fixed, so Windows users can use authkeys or ACL tags, etc. Updates #275
2020-10-02all: upgrade to latest version of depawareJosh Bleecher Snyder2-52/+32
2020-10-01all: update depaware.txtJosh Bleecher Snyder2-2/+2
Broken by 8051ecff557af8ac59b20bb9dfc52e15deedda03. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2020-09-29ipn: add/move some constants, update a commentBrad Fitzpatrick1-10/+1
And make the StateStore implementations be Stringers, for error messages.
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.