summaryrefslogtreecommitdiffhomepage
path: root/cmd
AgeCommit message (Collapse)AuthorFilesLines
2023-08-16client/web: hook up data fetching to fill --dev React UISonia Appasamy1-1/+1
Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-08-16cmd/tailscale/cli: fix comment accuracyCharlotte Brandhorst-Satzkorn1-1/+1
All exit nodes are shown under this subcommand. Updates tailscale/corp#13025 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-08-16derp: include src IPs in mesh watch messagesBrad Fitzpatrick1-1/+2
Updates tailscale/corp#13945 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-15wgengine/magicsock: only cache N most recent endpoints per-AddrAndrew Dunham1-0/+3
If a node is flapping or otherwise generating lots of STUN endpoints, we can end up caching a ton of useless values and sending them to peers. Instead, let's apply a fixed per-Addr limit of endpoints that we cache, so that we're only sending peers up to the N most recent. Updates tailscale/corp#13890 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8079a05b44220c46da55016c0e5fc96dd2135ef8
2023-08-15cli/serve: add interactive flow for enabling HTTPS certsSonia Appasamy1-0/+16
When trying to use serve with https, send users through https cert provisioning enablement before editing the ServeConfig. Updates tailscale/corp#10577 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-08-15cli/serve: funnel interactive enablement flow tweaksSonia Appasamy3-7/+22
1. Add metrics to funnel flow. 2. Stop blocking users from turning off funnels when no longer in their node capabilities. 3. Rename LocalClient.IncrementMetric to IncrementCounter to better callout its usage is only for counter clientmetrics. Updates tailscale/corp#10577 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-08-11tstime/mono: remove unsafeBrad Fitzpatrick3-3/+3
This removes the unsafe/linkname and only uses the standard library. It's a bit slower, for now, but https://go.dev/cl/518336 should get us back. On darwin/arm64, without https://go.dev/cl/518336 pkg: tailscale.com/tstime/mono │ before │ after │ │ sec/op │ sec/op vs base │ MonoNow-8 16.20n ± 0% 19.75n ± 0% +21.92% (p=0.000 n=10) TimeNow-8 39.46n ± 0% 39.40n ± 0% -0.16% (p=0.002 n=10) geomean 25.28n 27.89n +10.33% And with it, MonoNow-8 16.34n ± 1% 16.93n ± 0% +3.67% (p=0.001 n=10) TimeNow-8 39.55n ± 15% 38.46n ± 1% -2.76% (p=0.000 n=10) geomean 25.42n 25.52n +0.41% Updates #8839 Updates tailscale/go#70 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-11net/netcheck,wgengine/magicsock: reduce coupling between netcheck and magicsockJames Tucker1-1/+4
Netcheck no longer performs I/O itself, instead it makes requests via SendPacket and expects users to route reply traffic to ReceiveSTUNPacket. Netcheck gains a Standalone function that stands up sockets and goroutines to implement I/O when used in a standalone fashion. Magicsock now unconditionally routes STUN traffic to the netcheck.Client that it hosts, and plumbs the send packet sink. The CLI is updated to make use of the Standalone mode. Fixes #8723 Signed-off-by: James Tucker <james@tailscale.com>
2023-08-11cmd/tailscale: add debug commands to break connectionsBrad Fitzpatrick1-0/+10
For testing reconnects. Updates tailscale/corp#5761 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-10client/web: add barebones vite dev setupSonia Appasamy2-3/+4
Currently just serving a "Hello world" page when running the web cli in --dev mode. Updates tailscale/corp#13775 Co-authored-by: Will Norris <will@tailscale.com> Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-08-10cmd/tailscale/cli,clientupdate: extract new clientupdate package (#8827)Andrew Lytvynov6-1326/+25
Extract the self-update logic from cmd/tailscale/cli into a standalone package that could be used from tailscaled later. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-08-10tool/{node,yarn}: update node and yarn toolsSonia Appasamy2-1/+4
Syncing these up with what we've got in corp. Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-08-09client/web: add web client Server structSonia Appasamy1-4/+6
Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-08-09tailscale/cli: add interactive flow for enabling FunnelSonia Appasamy3-5/+232
Updates tailscale/corp#10577 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-08-09client/web: extract web client from cli packageWill Norris6-2135/+11
move the tailscale web client out of the cmd/tailscale/cli package, into a new client/web package. The remaining cli/web.go file is still responsible for parsing CLI flags and such, and then calls into client/web. This will allow the web client to be hooked into from other contexts (for example, from a tsnet server), and provide a dedicated space to add more functionality to this client. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>
2023-08-09cmd/tailscale: refactor shared utility methodsWill Norris5-100/+13
Refactor two shared functions used by the tailscale cli, calcAdvertiseRoutes and licensesURL. These are used by the web client as well as other tailscale subcommands. The web client is being moved out of the cli package, so move these two functions to new locations. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>
2023-08-08all: require Go 1.21Brad Fitzpatrick1-2/+2
Updates #8419 Change-Id: I809b6a4d59d92a2ab6ec587ccbb9053376bf02c2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-08util/testenv: add new package to hold InTestMaisem Ali4-3/+5
Removes duplicated code. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-08-08types/persist: drop duplicated Persist.LoginNameMaisem Ali2-13/+14
It was duplicated from Persist.UserProfile.LoginName, drop it. Updates #7726 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-08-08wgengine,ipn,cmd/tailscale: add size option to ping (#8739)salman aljammaz1-1/+4
This adds the capability to pad disco ping message payloads to reach a specified size. It also plumbs it through to the tailscale ping -size flag. Disco pings used for actual endpoint discovery do not use this yet. Updates #311. Signed-off-by: salman <salman@tailscale.com> Co-authored-by: Val <valerie@tailscale.com>
2023-08-04control: use tstime instead of time (#8595)Claire Wang1-1/+1
Updates #8587 Signed-off-by: Claire Wang <claire@tailscale.com>
2023-08-03cmd/dist,release/dist: expose RPM signing hook (#8789)Andrew Lytvynov1-3/+2
Plumb a signing callback function to `unixpkgs.rpmTarget` to allow signing RPMs. This callback is optional and RPMs will build unsigned if not set, just as before. Updates https://github.com/tailscale/tailscale/issues/1882 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-08-03go.mod: upgrade nfpm to v2 (#8786)Andrew Lytvynov1-17/+25
Upgrade the nfpm package to the latest version to pick up https://github.com/goreleaser/nfpm/commit/24a43c5ad7cfc549e8a4ec930521a97a30f26cc8. The upgrade is from v0 to v2, so there was some breakage to fix. Generated packages should have the same contents as before. Updates https://github.com/tailscale/tailscale/issues/1882 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-08-03go.mod, cmd/tailscaled, ipn/localapi, util/osdiag, util/winutil, ↵Aaron Klotz2-3/+10
util/winutil/authenticode: add Windows module list to OS-specific logs that are written upon bugreport * We update wingoes to pick up new version information functionality (See pe/version.go in the https://github.com/dblohm7/wingoes repo); * We move the existing LogSupportInfo code (including necessary syscall stubs) out of util/winutil into a new package, util/osdiag, and implement the public LogSupportInfo function may be implemented for other platforms as needed; * We add a new reason argument to LogSupportInfo and wire that into localapi's bugreport implementation; * We add module information to the Windows implementation of LogSupportInfo when reason indicates a bugreport. We enumerate all loaded modules in our process, and for each one we gather debug, authenticode signature, and version information. Fixes #7802 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2023-08-02tailcfg,ipn/localapi,client/tailscale: add QueryFeature endpointSonia Appasamy2-0/+6
Updates tailscale/corp#10577 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-08-02cmd/tailscale/cli: add latest version output to "tailscale version" (#8700)Andrew Lytvynov2-3/+34
Add optional `--upstream` flag to `tailscale version` to fetch the latest upstream release version from `pkgs.tailscale.com`. This is useful to diagnose `tailscale update` behavior or write other tooling. Example output: $ tailscale version --upstream --json { "majorMinorPatch": "1.47.35", "short": "1.47.35", "long": "1.47.35-t6afffece8", "unstableBranch": true, "gitCommit": "6afffece8a32509aa7a4dc2972415ec58d8316de", "cap": 66, "upstream": "1.45.61" } Fixes #8669 RELNOTE=adds "tailscale version --upstream" Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-08-01all: implement lock revoke-keys commandTom DNetto1-0/+113
The revoke-keys command allows nodes with tailnet lock keys to collaborate to erase the use of a compromised key, and remove trust in it. Signed-off-by: Tom DNetto <tom@tailscale.com> Updates ENG-1848
2023-08-01cmd/tailscale/cli, util/winutil/authenticode: flesh out authenticode supportAaron Klotz2-26/+13
Previously, tailscale upgrade was doing the bare minimum for checking authenticode signatures via `WinVerifyTrustEx`. This is fine, but we can do better: * WinVerifyTrustEx verifies that the binary's signature is valid, but it doesn't determine *whose* signature is valid; tailscale upgrade should also ensure that the binary is actually signed *by us*. * I added the ability to check the signatures of MSI files. * In future PRs I will be adding diagnostic logging that lists details about every module (ie, DLL) loaded into our process. As part of that metadata, I want to be able to extract information about who signed the binaries. This code is modelled on some C++ I wrote for Firefox back in the day. See https://searchfox.org/mozilla-central/rev/27e4816536c891d85d63695025f2549fd7976392/toolkit/xre/dllservices/mozglue/Authenticode.cpp for reference. Fixes #8284 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2023-08-01cmd/sniproxy: add client metricsDenton Gentry1-0/+18
Count number of sessions, number of DNS queries answered successfully and in error, and number of http->https redirects. Updates #1748 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2023-07-31cmd/dist,release/dist: sign release tarballs with an ECDSA key (#8759)Andrew Lytvynov1-2/+3
Pass an optional PEM-encoded ECDSA key to `cmd/dist` to sign all built tarballs. The signature is stored next to the tarball with a `.sig` extension. Tested this with an `openssl`-generated key pair and verified the resulting signature. Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-07-28all: update exp/slices and fix call sitesDavid Anderson4-7/+11
slices.SortFunc suffered a late-in-cycle API breakage. Updates #cleanup Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-27derp: use tstime (#8634)Claire Wang2-0/+2
Updates #8587 Signed-off-by: Claire Wang <claire@tailscale.com>
2023-07-26cli: introduce exit-node subcommand to list and filter exit nodesCharlotte Brandhorst-Satzkorn5-1/+567
This change introduces a new subcommand, `exit-node`, along with a subsubcommand of `list` and a `--filter` flag. Exit nodes without location data will continue to be displayed when `status` is used. Exit nodes with location data will only be displayed behind `exit-node list`, and in status if they are the active exit node. The `filter` flag can be used to filter exit nodes with location data by country. Exit nodes with Location.Priority data will have only the highest priority option for each country and city listed. For countries with multiple cities, a <Country> <Any> option will be displayed, indicating the highest priority node within that country. Updates tailscale/corp#13025 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-07-25cmd/tailscale/cli: implement update on FreeBSD (#8710)Andrew Lytvynov1-4/+45
Implement `tailscale update` on FreeBSD. This is much simpler than other platforms because `pkg rquery` lets us get the version in their repos without any extra parsing. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-07-25tailcfg,ipn/ipnlocal,wgengine: add values to PeerCapabilitiesMaisem Ali1-0/+2
Define PeerCapabilty and PeerCapMap as the new way of sending down inter-peer capability information. Previously, this was unstructured and you could only send down strings which got too limiting for certain usecases. Instead add the ability to send down raw JSON messages that are opaque to Tailscale but provide the applications to define them however they wish. Also update accessors to use the new values. Updates #4217 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-07-24cmd/tailscale/cli,version/distro: update support for Alpine (#8701)Andrew Lytvynov2-3/+137
Similar to Arch support, use the latest version info from the official `apk` repo and don't offer explicit track or version switching. Add detection for Alpine Linux in version/distro along the way. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-07-24cmd/tailscale/cli: implement update for dnf/yum-based distros (#8678)Andrew Lytvynov2-56/+269
This is the Fedora family of distros, including CentOS, RHEL and others. Tested in `fedora:latest` and `centos:7` containers. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-07-20util/linuxfw: remove yet-unused code to fix linux/arm64 crashBrad Fitzpatrick4-44/+9
The util/linuxfw/iptables.go had a bunch of code that wasn't yet used (in prep for future work) but because of its imports, ended up initializing code deep within gvisor that panicked on init on arm64 systems not using 4KB pages. This deletes the unused code to delete the imports and remove the panic. We can then cherry-pick this back to the branch and restore it later in a different way. A new test makes sure we don't regress in the future by depending on the panicking package in question. Fixes #8658 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-07-20tstest/deptest: add test-only package to unify negative dep testsBrad Fitzpatrick1-1/+25
Updates #8658 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-07-20cmd/tailscale/cli: ensure custom UsageFunc is always set (#8665)Chris Palmer1-5/+6
Updates #6995 Signed-off-by: Chris Palmer <cpalmer@tailscale.com>
2023-07-20cmd/tailscale/cli: limit Darwin-only option to Darwin (#8657)Chris Palmer1-1/+1
2023-07-19cmd/tailscale/cli: implement update for arch-based distros (#8655)Andrew Lytvynov2-7/+174
Arch version of tailscale is not maintained by us, but is generally up-to-date with our releases. Therefore "tailscale update" is just a thin wrapper around "pacman -Sy tailscale" with different flags. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-07-19cmd/tailscale/cli: make `tailscale update` query `softwareupdate` (#8641)Chris Palmer2-7/+140
* cmd/tailscale/cli: make `tailscale update` query `softwareupdate` Even on macOS when Tailscale was installed via the App Store, we can check for and even install new versions if people ask explicitly. Also, warn if App Store AutoUpdate is not turned on. Updates #6995
2023-07-19cmd/gitops-pusher: re-use existing types from acl packageJenny Zhang2-14/+78
This changes the ACLTestError type to reuse the existing/identical types from the ACL implementation, to avoid issues in the future if the two types fall out of sync. Updates #8645 Signed-off-by: Jenny Zhang <jz@tailscale.com>
2023-07-19cmd/tailscale: warn if node is locked out on bringupTom DNetto1-1/+2
Updates https://github.com/tailscale/corp/issues/12718 Signed-off-by: Tom DNetto <tom@tailscale.com>
2023-07-17serve: fix hostname for custom http portsWill Norris1-1/+1
When using a custom http port like 8080, this was resulting in a constructed hostname of `host.tailnet.ts.net:8080.tailnet.ts.net` when looking up the serve handler. Instead, strip off the port before adding the MagicDNS suffix. Also use the actual hostname in `serve status` rather than the literal string "host". Fixes #8635 Signed-off-by: Will Norris <will@tailscale.com>
2023-07-13ipn/ipnlocal: add optional support for ACME Renewal Info (ARI) (#8599)Andrew Lytvynov3-12/+3
2023-07-13cmd/tailscale: remove TS_EXPERIMENT_OAUTH_AUTHKEY guardrailDenton Gentry1-4/+0
We've had support for OAuth client keys in `--authkey=...` for several releases, and we're using it in https://github.com/tailscale/github-action Remove the TS_EXPERIMENT_* guardrail, it is fully supported now. Fixes https://github.com/tailscale/tailscale/issues/8403 Signed-off-by: Denton Gentry <dgentry@tailscale.com>
2023-07-11cmd/derper,tsweb: consistently add HTTP security headers (#8579)Andrew Lytvynov1-13/+3
Add a few helper functions in tsweb to add common security headers to handlers. Use those functions for all non-tailscaled-facing endpoints in derper. Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-07-11cmd/testwrapper: handle build failuresMaisem Ali1-0/+10
`go test -json` outputs invalid JSON when a build fails. Handle that case by reseting the json.Decode and continuing to read. Updates #8493 Signed-off-by: Maisem Ali <maisem@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.