summaryrefslogtreecommitdiffhomepage
path: root/cmd
AgeCommit message (Collapse)AuthorFilesLines
2022-09-23net/speedtest: retune to meet iperf on localhost in a VMJames Tucker1-1/+2
- removed some in-flow time calls - increase buffer size to 2MB to overcome syscall cost - move relative time computation from record to report time Signed-off-by: James Tucker <james@tailscale.com>
2022-09-23tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan ↵Andrew Dunham1-0/+1
field (#5648) * tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan field This field allows the control server to provide explicit information about how to connect to it; useful if the client's link status can change after the initial connection, or if the DNS settings pushed by the control server break future connections. Change-Id: I720afe6289ec27d40a41b3dcb310ec45bd7e5f3e Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-22cmd/tailscaled: use explicit equal sign in --port=$PORT in tailscaled.serviceBrad Fitzpatrick1-1/+1
Personal preference (so it's obvious it's not a bool flag), but it also matches the --state= before it. Bonus: stop allowing PORT to sneak in extra flags to be passed as their own arguments, as $FOO and ${FOO} expand differently. (${FOO} is required to concat to strings) Change-Id: I994626a5663fe0948116b46a971e5eb2c4023216 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-21cmd/tsconnect: add error callback for SSH sessionsMihai Parparita2-2/+3
We were just logging them to the console, which is useful for debugging, but we may want to show them in the UI too. Updates tailscale/corp#6939 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-21control/controlclient,ipn/ipnlocal: wire tka enable/disableTom DNetto1-1/+1
Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-20net/netcheck: add check for captive portal (#5593)Andrew Dunham1-0/+3
This doesn't change any behaviour for now, other than maybe running a full netcheck more often. The intent is to start gathering data on captive portals, and additionally, seeing this in the 'tailscale netcheck' command should provide a bit of additional information to users. Updates #1634 Change-Id: I6ba08f9c584dc0200619fa97f9fde1a319f25c76 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
2022-09-19cmd/tailscale: fix configure-host command for SynologyBerk D. Demir1-4/+4
d5e7e309 changed the `hostinfo.GetVersion` from distro and distro version to UTS Name Release and moved distribution information under `hostinfo.Distro*`. `tailscale configure-host` command implementation for Synology DSM environments relies on the old semantics of this string for matching DSM Major version so it's been broken for a few days. Pull in `hostinfo` and prefix match `hostinfo.DistroVersion` to match DSM major version. Signed-off-by: Berk D. Demir <bdd@mindcast.org>
2022-09-19cmd/tailscale: remove leftover debug prints from earlier commitBrad Fitzpatrick1-1/+0
From 6632504f452 Change-Id: If21789232b3ecc14c1639cf87814af6fa73f535f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-19cmd/tsconnect: allow SSH connection timeout to be overriddenMihai Parparita3-1/+10
5 seconds may not be enough if we're still loading the derp map and connecting to a slow machine. Updates #5693 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-19cmd/tailscale/cli: [up] move lose-ssh check after other validationsMaisem Ali4-27/+195
The check was happening too early and in the case of error would wait 5 s and then error out. This makes it so that it does validations before the SSH check. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-09-17cmd/tailscaled: respect $PORT on all platforms, not just LinuxBrad Fitzpatrick1-1/+16
Updates #5114 Change-Id: I6c6e28c493d6a026a03088157d08f9fd182ef373 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-17envknob, health: support Synology, show parse errors in statusBrad Fitzpatrick2-7/+5
Updates #5114 Change-Id: I8ac7a22a511f5a7d0dcb8cac470d4a403aa8c817 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-16envknob: generalize Windows tailscaled-env.txt supportBrad Fitzpatrick2-0/+11
ipnserver previously had support for a Windows-only environment variable mechanism that further only worked when Windows was running as a service, not from a console. But we want it to work from tailscaed too, and we want it to work on macOS and Synology. So move it to envknob, now that envknob can change values at runtime post-init. A future change will wire this up for more platforms, and do something more for CLI flags like --port, which the bug was originally about. Updates #5114 Change-Id: I9fd69a9a91bb0f308fc264d4a6c33e0cbe352d71 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-16control/controlhttp: move Dial options into options struct (#5661)Andrew Dunham1-1/+9
This turns 'dialParams' into something more like net.Dialer, where configuration fields are public on the struct. Split out of #5648 Change-Id: I0c56fd151dc5489c3c94fb40d18fd639e06473bc Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-15refactor: move from io/ioutil to io and os packagesEng Zer Jun9-19/+10
The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
2022-09-15cmd/derper, control/controlhttp: disable WebSocket compressionMihai Parparita1-0/+6
The data that we send over WebSockets is encrypted and thus not compressible. Additionally, Safari has a broken implementation of compression (see nhooyr/websocket#218) that makes enabling it actively harmful. Fixes tailscale/corp#6943 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-15envknob: support changing envknobs post-initBrad Fitzpatrick2-6/+5
Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-14cmd/tsconnect: use the parent window for `beforeunload` event listenerMihai Parparita1-6/+4
The SSH session may be rendered in a different window that the one that is executing the script. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-13cmd/tailscaled, tailcfg, hostinfo: add flag to disable logging + supportBrad Fitzpatrick1-0/+6
As noted in #5617, our documented method of blocking log.tailscale.io DNS no longer works due to bootstrap DNS. Instead, provide an explicit flag (--no-logs-no-support) and/or env variable (TS_NO_LOGS_NO_SUPPORT=true) to explicitly disable logcatcher uploads. It also sets a bit on Hostinfo to say that the node is in that mode so we can end any support tickets from such nodes more quickly. This does not yet provide an easy mechanism for users on some platforms (such as Windows, macOS, Synology) to set flags/env. On Linux you'd used /etc/default/tailscaled typically. Making it easier to set flags for other platforms is tracked in #5114. Fixes #5617 Fixes tailscale/corp#1475 Change-Id: I72404e1789f9e56ec47f9b7021b44c025f7a373a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-12cmd/tsconnect: allow xterm.js terminal options to be passed inMihai Parparita1-2/+4
Allows clients to use a custom theme and other xterm.js customization options. Fixes #5610 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-12cmd/tsconnect: allow hostname to be specifiedMihai Parparita2-14/+16
The auto-generated hostname is nice as a default, but there are cases where the client has a more specific name that it can generate. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-12cmd/tsconnect: fix xterm.js link opening not working when rendered into ↵Mihai Parparita1-1/+3
another window The default WebLinksAddon handler uses window.open(), but that gets blocked by the popup blocker when the event being handled is another window. We instead need to invoke open() on the window that the event was triggered in. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-12cmd/tailscale: add licenses link to web UIWill Norris3-8/+16
The `tailscale web` UI is the primary interface for Synology and Home Assistant users (and perhaps others), so is the logical place to put our open source license notices. I don't love adding things to what is currently a very minimal UI, but I'm not sure of a better option. Updates tailscale/corp#5780 Signed-off-by: Will Norris <will@tailscale.com>
2022-09-12cmd/derper: add /generate_204 endpoint (#5601)Andrew Dunham1-1/+10
For captive portal detection. Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-09cmd/tsconnect: enable web links addon in the terminalMihai Parparita4-1/+19
More user friendly, and as a side-effect we handle SSH check mode better, since the URL that's output is now clickable. Fixes #5247 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-09cmd/tsconnect: switch back to public version of xterm npm packageMihai Parparita2-4/+5
xtermjs/xterm.js#4069 was merged and published (in 5.0.0-beta.58), no need for the fork added by 01e6565e8a0193ec940a8eca9129dadb2c05e29d. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-09cmd/derper: add robots.txt to disallow allBrad Fitzpatrick1-0/+3
Fixes #5565 Change-Id: I5626ec2116d9be451caef651dc301b7a82e35550 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-08net/dns/{publicdns,resolver}: add NextDNS DoH supportBrad Fitzpatrick1-2/+2
NextDNS is unique in that users create accounts and then get user-specific DNS IPs & DoH URLs. For DoH, the customer ID is in the URL path. For IPv6, the IP address includes the customer ID in the lower bits. For IPv4, there's a fragile "IP linking" mechanism to associate your public IPv4 with an assigned NextDNS IPv4 and that tuple maps to your customer ID. We don't use the IP linking mechanism. Instead, NextDNS is DoH-only. Which means using NextDNS necessarily shunts all DNS traffic through 100.100.100.100 (programming the OS to use 100.100.100.100 as the global resolver) because operating systems can't usually do DoH themselves. Once it's in Tailscale's DoH client, we then connect out to the known NextDNS IPv4/IPv6 anycast addresses. If the control plane sends the client a NextDNS IPv6 address, we then map it to the corresponding NextDNS DoH with the same client ID, and we dial that DoH server using the combination of v4/v6 anycast IPs. Updates #2452 Change-Id: I3439d798d21d5fc9df5a2701839910f5bef85463 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-08cmd/tsconnect: temporarily switch to xterm.js fork that handles popup windowsMihai Parparita4-24/+74
Allows other work to be unblocked while xtermjs/xterm.js#4069 is worked through. To enable testing the popup window handling, the standalone app allows opening of SSH sessions in new windows by holding down the alt key while pressing the SSH button. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-08cmd/tsconnect: handle terminal resizes before the SSH session is createdMihai Parparita1-0/+16
Store the requested size is a struct field, and use that when actually creating the SSH session. Fixes #5567 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-07cmd/derper: filter out useless HTTP error logs (#5563)Andrew Dunham1-2/+25
These errors aren't actionable and just fill up logs with useless data. See the following Go issue for more details: https://golang.org/issue/26918 Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-06cmd/tsconnect: add dev-pkg command for two-sided developmentMihai Parparita6-28/+64
Allows imports of the NPM package added by 1a093ef4822b973ec86d481924690349eddba5cb to be replaced with import("http://localhost:9090/pkg/pkg.js"), so that changes can be made in parallel to both the module and code that uses it (without any need for NPM publishing or even building of the package). Updates #5415 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-09-03cmd/derper: add flag to run derper in bootstrap-dns-only modeBrad Fitzpatrick1-3/+13
Change-Id: Iba128e94464afa605bc9df1f06a91d296380eed0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-02cmd/derper: add support for unpublished bootstrap DNS entries (#5529)Andrew Dunham3-21/+206
Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
2022-09-01cmd/tailscale/cli: add backwards compatibility 'up' processing for legacy clientBrad Fitzpatrick2-1/+9
Updates tailscale/corp#6781 Change-Id: I843fc810cbec0140d423d65db81e90179d6e0fa5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-01cli/cert: Fix help message for --key-fileBertrand Lorentz1-1/+1
Signed-off-by: Bertrand Lorentz <bertrand.lorentz@gmail.com>
2022-09-01cmd/gitops-pusher: standardize hujson before posting to validate (#5525)Xe Iaso1-3/+7
Apparently the validate route doesn't check content-types or handle hujson with comments correctly. This patch makes gitops-pusher convert the hujson to normal json. Signed-off-by: Xe <xe@tailscale.com> Signed-off-by: Xe <xe@tailscale.com>
2022-08-31cmd/nginx-auth/nginx-auth: update auth to allow for new domainsnyghtowl1-6/+1
With MagicDNS GA, we are giving every tailnet a tailnet-<hex>.ts.net name. We will only parse out if legacy domains include beta.tailscale.net; otherwise, set tailnet to the full domain format going forward. Signed-off-by: nyghtowl <warrick@tailscale.com>
2022-08-31wgengine/magicsock: use AF_PACKET socket + BPF to read disco messagesAndrew Dunham1-1/+1
This is entirely optional (i.e. failing in this code is non-fatal) and only enabled on Linux for now. Additionally, this new behaviour can be disabled by setting the TS_DEBUG_DISABLE_AF_PACKET environment variable. Updates #3824 Replaces #5474 Co-authored-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: David Anderson <danderson@tailscale.com>
2022-08-31cmd/tsconnect: remove debugging codeMihai Parparita1-1/+1
Remove test prefix added to validate the error code from 27f36f77c364562bc1ca660c241291e23606e54d. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-08-30cmd/tsconnect: output errors to the JS console tooMihai Parparita3-9/+24
We were just outputting them to the terminal, but that's hard to debug because we immediately tear down the terminal when getting an error. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-08-30cmd/gitops-pusher: be less paranoid about external modifications (#5488)Xe Iaso1-8/+1
This makes a "modified externally" error turn into a "modified externally" warning. It means CI won't fail if someone does something manually in the admin console. Signed-off-by: Xe <xe@tailscale.com>
2022-08-29cmd/tsconnect: add npm publish workflowMihai Parparita3-10/+52
Adds an on-demand GitHub Action that publishes the package to the npm registry (currently under tailscale-connect, will be moved to @tailscale/connect once we get control of the npm org). Makes the package.json for the NPM package be dynamically generated to have the current Tailscale client version. Updates #5415 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-08-29wgengine: use Go API rather than UAPI for statusJames Tucker1-0/+1
Signed-off-by: James Tucker <james@tailscale.com>
2022-08-29tailcfg, control/controlclient, ipn/ipnlocal: add c2n (control-to-node) systemBrad Fitzpatrick1-0/+1
This lets the control plane can make HTTP requests to nodes. Then we can use this for future things rather than slapping more stuff into MapResponse, etc. Change-Id: Ic802078c50d33653ae1f79d1e5257e7ade4408fd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-26cmd/tailscale: use platform specific license linkWill Norris1-1/+14
2022-08-26cmd/tailscale: add licenses subcommandWill Norris2-0/+30
Signed-off-by: Will Norris <will@tailscale.com>
2022-08-26cmd/tsconnect: expose runSSHSession in npm packageMihai Parparita3-52/+55
Move it to lib/ so that it can be used in both the app and the package. Updates #5415 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-08-24cmd/tsconnect: extract NPM package for reusing in other projectsMihai Parparita23-81/+300
`src/` is broken up into several subdirectories: - `lib/` and `types`/ for shared code and type definitions (more code will be moved here) - `app/` for the existing Preact-app - `pkg/` for the new NPM package A new `build-pkg` esbuild-based command is added to generate the files for the NPM package. To generate type definitions (something that esbuild does not do), we set up `dts-bundle-generator`. Includes additional cleanups to the Wasm type definitions (we switch to string literals for enums, since exported const enums are hard to use via packages). Also allows the control URL to be set a runtime (in addition to the current build option), so that we don't have to rebuild the package for dev vs. prod use. Updates #5415 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-08-24cmd/nginx-auth: allow use of shared nodesWill Norris1-11/+18
When sharing nodes, the name of the sharee node is not exposed (instead it is hardcoded to "device-of-shared-to-user"), which means that we can't determine the tailnet of that node. Don't immediately fail when that happens, since it only matters if "Expected-Tailnet" is used. Signed-off-by: Will Norris <will@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.