summaryrefslogtreecommitdiffhomepage
path: root/control/controlclient
AgeCommit message (Collapse)AuthorFilesLines
2025-06-19tstest/tlstest: simplify, don't even bake in any keysBrad Fitzpatrick1-2/+2
I earlier thought this saved a second of CPU even on a fast machine, but I think when I was previously measuring, I still had a 4096 bit RSA key being generated in the code I was measuring. Measuring again for this, it's plenty fast. Prep for using this package more, for derp, etc. Updates #16315 Change-Id: I4c9008efa9aa88a3d65409d6ffd7b3807f4d75e9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-06-18net/tlsdial: fix TLS cert validation of HTTPS proxiesBrad Fitzpatrick2-6/+226
If you had HTTPS_PROXY=https://some-valid-cert.example.com running a CONNECT proxy, we should've been able to do a TLS CONNECT request to e.g. controlplane.tailscale.com:443 through that, and I'm pretty sure it used to work, but refactorings and lack of integration tests made it regress. It probably regressed when we added the baked-in LetsEncrypt root cert validation fallback code, which was testing against the wrong hostname (the ultimate one, not the one which we were being asked to validate) Fixes #16222 Change-Id: If014e395f830e2f87f056f588edacad5c15e91bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-06-09health: prefix Warnables received from the control planeJames Sanderson2-7/+7
Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-05-30controlclient,health,ipnlocal,tailcfg: add DisplayMessage supportJames Sanderson2-8/+265
Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-05-22control/controlclient,health,tailcfg: refactor control health messages (#15839)James 'zofrex' Sanderson4-18/+57
* control/controlclient,health,tailcfg: refactor control health messages Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com> Signed-off-by: Paul Scott <408401+icio@users.noreply.github.com> Co-authored-by: Paul Scott <408401+icio@users.noreply.github.com>
2025-05-07control/controlclient: send optional ConnectionHandleForTest with map ↵Brian Palmer1-20/+31
requests (#15904) This handle can be used in tests and debugging to identify the specific client connection. Updates tailscale/corp#28368 Change-Id: I48cc573fc0bcf018c66a18e67ad6c4f248fb760c Signed-off-by: Brian Palmer <brianp@tailscale.com>
2025-04-29control/controlclient,health: add tests for control health trackingJames Sanderson1-0/+32
Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-04-08net/{netx,memnet},all: add netx.DialFunc, move memnet Network implBrad Fitzpatrick1-4/+3
This adds netx.DialFunc, unifying a type we have a bazillion other places, giving it now a nice short name that's clickable in editors, etc. That highlighted that my earlier move (03b47a55c7956) of stuff from nettest into netx moved too much: it also dragged along the memnet impl, meaning all users of netx.DialFunc who just wanted netx for the type definition were instead also pulling in all of memnet. So move the memnet implementation netx.Network into memnet, a package we already had. Then use netx.DialFunc in a bunch of places. I'm sure I missed some. And plenty remain in other repos, to be updated later. Updates tailscale/corp#27636 Change-Id: I7296cd4591218e8624e214f8c70dab05fb884e95 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-07nettest, *: add option to run HTTP tests with in-memory networkBrad Fitzpatrick1-2/+7
To avoid ephemeral port / TIME_WAIT exhaustion with high --count values, and to eventually detect leaked connections in tests. (Later the memory network will register a Cleanup on the TB to verify that everything's been shut down) Updates tailscale/corp#27636 Change-Id: Id06f1ae750d8719c5a75d871654574a8226d2733 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02all: use network less when running in v86 emulatorBrad Fitzpatrick2-1/+34
Updates #5794 Change-Id: I1d8b005a1696835c9062545f87b7bab643cfc44d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-12control/controlclient, ipn: add client audit logging (#14950)Jonathan Nobels4-2/+147
updates tailscale/corp#26435 Adds client support for sending audit logs to control via /machine/audit-log. Specifically implements audit logging for user initiated disconnections. This will require further work to optimize the peristant storage and exclusion via build tags for mobile: tailscale/corp#27011 tailscale/corp#27012 Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2025-03-07wgengine/magicsock: use learned DERP route as send path of last resortBrad Fitzpatrick2-0/+5
If we get a packet in over some DERP and don't otherwise know how to reply (no known DERP home or UDP endpoint), this makes us use the DERP connection on which we received the packet to reply. This will almost always be our own home DERP region. This is particularly useful for large one-way nodes (such as hello.ts.net) that don't actively reach out to other nodes, so don't need to be told the DERP home of peers. They can instead learn the DERP home upon getting the first connection. This can also help nodes from a slow or misbehaving control plane. Updates tailscale/corp#26438 Change-Id: I6241ec92828bf45982e0eb83ad5c7404df5968bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-02-14control/controlclient,tailcfg:types: remove MaxKeyduration from NetMapJames Sanderson1-5/+0
This reverts most of 124dc10261ea (#10401). Removing in favour of adding this in CapMaps instead (#14829). Updates tailscale/corp#16016 Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-02-11Revert "control/controlclient: delete unreferenced mapSession UserProfiles"Brad Fitzpatrick1-30/+1
This reverts commit 413fb5b93311972e3a8d724bb696607ef3afe6f2. See long story in #14992 Updates #14992 Updates tailscale/corp#26058 Change-Id: I3de7d080443efe47cbf281ea20887a3caf202488 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-02-11types/netmap,*: pass around UserProfiles as views (pointers) insteadBrad Fitzpatrick2-5/+7
Smaller. Updates tailscale/corp#26058 (@andrew-d noticed during this) Change-Id: Id33cddd171aaf8f042073b6d3c183b0a746e9931 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-30control/controlclient: flesh out a recently added commentBrad Fitzpatrick1-6/+11
Updates tailscale/corp#26058 Change-Id: Ib46161fbb2e79c080f886083665961f02cbf5949
2025-01-30control/controlclient: add missing word in commentBrad Fitzpatrick1-1/+1
Found by review.ai. Updates #cleanup Change-Id: Ib9126de7327527b8b3818d92cc774bb1c7b6f974 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-26control/controlclient,tempfork/httprec: don't link httptest, test certs for c2nBrad Fitzpatrick1-2/+2
The c2n handling code was using the Go httptest package's ResponseRecorder code but that's in a test package which brings in Go's test certs, etc. This forks the httptest recorder type into its own package that only has the recorder and adds a test that we don't re-introduce a dependency on httptest. Updates #12614 Change-Id: I3546f49972981e21813ece9064cc2be0b74f4b16 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-24control/controlclient: sanitize invalid DERPMap nil Region from controlBrad Fitzpatrick1-0/+9
Fixes #14752 Change-Id: If364603eefb9ac6dc5ec6df84a0d5e16c94dda8d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-24control/controlclient: skip SetControlClientStatus when queue has newer ↵Brad Fitzpatrick2-2/+154
results later Updates #1909 Updates #12542 Updates tailscale/corp#26058 Change-Id: I3033d235ca49f9739fdf3deaf603eea4ec3e407e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-23control/controlclient: delete unreferenced mapSession UserProfilesBrad Fitzpatrick1-1/+30
This was a slow memory leak on busy tailnets with lots of tagged ephemeral nodes. Updates tailscale/corp#26058 Change-Id: I298e7d438e3ffbb3cde795640e344671d244c632 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-15tailcfg,control/controlclient: treat nil AllowedIPs as Addresses [capver 112]Brad Fitzpatrick2-0/+36
Updates #14635 Change-Id: I21e2bd1ec4eb384eb7a3fc8379f0788a684893f3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-14control/controlclient: remove misleading TS_DEBUG_NETMAP, make it ↵Brad Fitzpatrick1-18/+18
TS_DEBUG_MAP=2 (or more) Updates #cleanup Change-Id: Ic1edaed46b7b451ab58bb2303640225223eba9ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-14all: add Node.HomeDERP int, phase out "127.3.3.40:$region" hack [capver 111]Brad Fitzpatrick2-31/+101
This deprecates the old "DERP string" packing a DERP region ID into an IP:port of 127.3.3.40:$REGION_ID and just uses an integer, like PeerChange.DERPRegion does. We still support servers sending the old form; they're converted to the new form internally right when they're read off the network. Updates #14636 Change-Id: I9427ec071f02a2c6d75ccb0fcbf0ecff9f19f26f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-14cmd/viewer,types/views,various: avoid allocations in pointer field getters ↵Nick Khyl1-8/+6
whenever possible In this PR, we add a generic views.ValuePointer type that can be used as a view for pointers to basic types and struct types that do not require deep cloning and do not have corresponding view types. Its Get/GetOk methods return stack-allocated shallow copies of the underlying value. We then update the cmd/viewer codegen to produce getters that return either concrete views when available or ValuePointer views when not, for pointer fields in generated view types. This allows us to avoid unnecessary allocations compared to returning pointers to newly allocated shallow copies. Updates #14570 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-01-07controlclient: do not set HTTPS port for any private coordination server IP ↵Andrea Gottardo2-6/+140
(#14564) Fixes tailscale/tailscale#14563 When creating a NoiseClient, ensure that if any private IP address is provided, with both an `http` scheme and an explicit port number, we do not ever attempt to use HTTPS. We were only handling the case of `127.0.0.1` and `localhost`, but `192.168.x.y` is a private IP as well. This uses the `netip` package to check and adds some logging in case we ever need to troubleshoot this. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2025-01-04all: use iterators in more places instead of Range funcsBrad Fitzpatrick1-9/+11
And misc cleanup along the way. Updates #12912 Change-Id: I0cab148b49efc668c6f5cdf09c740b84a713e388 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-03control/controlclient: remove optimization that was more convoluted than usefulBrad Fitzpatrick2-51/+30
While working on #13390, I ran across this non-idiomatic pointer-to-view and parallel-sorted-map accounting code that was all just to avoid a sort later. But the sort later when building a new netmap.NetworkMap is already a drop in the bucket of CPU compared to how much work & allocs mapSession.netmap and LocalBackend's spamming of the full netmap (potentially tens of thousands of peers, MBs of JSON) out to IPNBus clients for any tiny little change (node changing online status, etc). Removing the parallel sorted slice let everything be simpler to reason about, so this does that. The sort might take a bit more CPU time now in theory, but in practice for any netmap size for which it'd matter, the quadratic netmap IPN bus spam (which we need to fix soon) will overshadow that little sort. Updates #13390 Updates #1909 Change-Id: I3092d7c67dc10b2a0f141496fe0e7e98ccc07712 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-12-31all: add means to set device posture attributes from nodeBrad Fitzpatrick2-2/+55
Updates tailscale/corp#24690 Updates #4077 Change-Id: I05fe799beb1d2a71d1ec3ae08744cc68bcadae2a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-22control/controlclient: use the most recent ↵Nick Khyl1-11/+2
syspolicy.MachineCertificateSubject value This PR removes the sync.Once wrapper around retrieving the MachineCertificateSubject policy setting value, ensuring the most recent version is always used if it changes after the service starts. Although this policy setting is used by a very limited number of customers, recent support escalations have highlighted issues caused by outdated or incorrect policy values being applied. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-11-14control/controlclient: disable https on for http://localhost:$port URLsBrad Fitzpatrick1-8/+1
Previously we required the program to be running in a test or have TS_CONTROL_IS_PLAINTEXT_HTTP before we disabled its https fallback on "http" schema control URLs to localhost with ports. But nobody accidentally does all three of "http", explicit port number, localhost and doesn't mean it. And when they mean it, they're testing a localhost dev control server (like I was) and don't want 443 getting involved. As of the changes for #13597, this became more annoying in that we were trying to use a port which wasn't even available. Updates #13597 Change-Id: Icd00bca56043d2da58ab31de7aa05a3b269c490f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-07control/controlhttp/controlhttpserver: split out Accept to its own packageBrad Fitzpatrick1-2/+2
Otherwise all the clients only using control/controlhttp for the ts2021 HTTP client were also pulling in WebSocket libraries, as the server side always needs to speak websockets, but only GOOS=js clients speak it. This doesn't yet totally remove the websocket dependency on Linux because Linux has a envknob opt-in to act like GOOS=js for manual testing and force the use of WebSockets for DERP only (not control). We can put that behind a build tag in a future change to eliminate the dep on all GOOSes. Updates #1278 Change-Id: I4f60508f4cad52bf8c8943c8851ecee506b7ebc9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-03control/controlclient: include HTTP status string in error message tooBrad Fitzpatrick1-1/+1
Not just its code. Updates tailscale/corp#23584 Change-Id: I8001a675372fe15da797adde22f04488d8683448 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-02control/control{client,http}: don't noise dial localhost:443 in http-only testsBrad Fitzpatrick1-6/+17
1eaad7d3deb regressed some tests in another repo that were starting up a control server on `http://127.0.0.1:nnn`. Because there was no https running, and because of a bug in 1eaad7d3deb (which ended up checking the recently-dialed-control check twice in a single dial call), we ended up forcing only the use of TLS dials in a test that only had plaintext HTTP running. Instead, plumb down support for explicitly disabling TLS fallbacks and use it only when running in a test and using `http` scheme control plane URLs to 127.0.0.1 or localhost. This fixes the tests elsewhere. Updates #13597 Change-Id: I97212ded21daf0bd510891a278078daec3eebaa6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-02control/controlclient: bound ReportHealthChange context lifetime to Direct ↵Brad Fitzpatrick1-1/+7
client's Fixes #13651 Change-Id: I8154d3cc0ca40fe7a0223b26ae2e77e8d6ba874b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-09-04all: use new Go 1.23 slices.Sorted moreBrad Fitzpatrick1-4/+1
Updates #12912 Change-Id: If1294e5bc7b5d3cf0067535ae10db75e8b988d8b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-09-04control/controlclient,posture,util/syspolicy: use predefined syspolicy keys ↵Nick Khyl1-1/+1
instead of string literals With the upcoming syspolicy changes, it's imperative that all syspolicy keys are defined in the syspolicy package for proper registration. Otherwise, the corresponding policy settings will not be read. This updates a couple of places where we still use string literals rather than syspolicy consts. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-08-05{control,net}: close idle connections of custom transportsAnton Tolchanov1-0/+3
I noticed a few places with custom http.Transport where we are not closing idle connections when transport is no longer used. Updates tailscale/corp#21609 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-06-27tka: test SigCredential signatures and netmap filteringAnton Tolchanov2-90/+3
This change moves handling of wrapped auth keys to the `tka` package and adds a test covering auth key originating signatures (SigCredential) in netmap. Updates tailscale/corp#19764 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-06-20control/controlclient: add more Screen Time blocking detectionBrad Fitzpatrick1-2/+57
Updates #9658 Updates #12545 Change-Id: Iec1dad354a75f145567b4055d77b1c1db27c89e2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Co-authored-by: Andrea Gottardo <andrea@gottardo.me>
2024-06-19cmd/tailscale/cli: actually perform Noise request in 'debug ts2021'Andrew Dunham2-17/+17
This actually performs a Noise request in the 'debug ts2021' command, instead of just exiting once we've dialed a connection. This can help debug certain forms of captive portals and deep packet inspection that will allow a connection, but will RST the connection when trying to send data on the post-upgraded TCP connection. Updates #1634 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I1e46ca9c9a0751c55f16373a6a76cdc24fec1f18
2024-06-19control/controlclient: move noiseConn to internal packageAndrew Dunham1-136/+15
So that it can be later used in the 'tailscale debug ts2021' function in the CLI, to aid in debugging captive portals/WAFs/etc. Updates #1634 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Iec9423f5e7570f2c2c8218d27fc0902137e73909
2024-06-14health: begin work to use structured health warnings instead of strings, ↵Andrea Gottardo1-6/+7
pipe changes into ipn.Notify (#12406) Updates tailscale/tailscale#4136 This PR is the first round of work to move from encoding health warnings as strings and use structured data instead. The current health package revolves around the idea of Subsystems. Each subsystem can have (or not have) a Go error associated with it. The overall health of the backend is given by the concatenation of all these errors. This PR polishes the concept of Warnable introduced by @bradfitz a few weeks ago. Each Warnable is a component of the backend (for instance, things like 'dns' or 'magicsock' are Warnables). Each Warnable has a unique identifying code. A Warnable is an entity we can warn the user about, by setting (or unsetting) a WarningState for it. Warnables have: - an identifying Code, so that the GUI can track them as their WarningStates come and go - a Title, which the GUIs can use to tell the user what component of the backend is broken - a Text, which is a function that is called with a set of Args to generate a more detailed error message to explain the unhappy state Additionally, this PR also begins to send Warnables and their WarningStates through LocalAPI to the clients, using ipn.Notify messages. An ipn.Notify is only issued when a warning is added or removed from the Tracker. In a next PR, we'll get rid of subsystems entirely, and we'll start using structured warnings for all errors affecting the backend functionality. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-06-03ipn/ipnlocal: discard node keys that have been rotated outAnton Tolchanov1-40/+1
A non-signing node can be allowed to re-sign its new node keys following key renewal/rotation (e.g. via `tailscale up --force-reauth`). To be able to do this, node's TLK is written into WrappingPubkey field of the initial SigDirect signature, signed by a signing node. The intended use of this field implies that, for each WrappingPubkey, we typically expect to have at most one active node with a signature tracing back to that key. Multiple valid signatures referring to the same WrappingPubkey can occur if a client's state has been cloned, but it's something we explicitly discourage and don't support: https://tailscale.com/s/clone This change propagates rotation details (wrapping public key, a list of previous node keys that have been rotated out) to netmap processing, and adds tracking of obsolete node keys that, when found, will get filtered out. Updates tailscale/corp#19764 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-05-17control/controlclient: delete unused Client.Login Oauth2Token fieldBrad Fitzpatrick3-15/+11
Updates #12172 (then need to update other repos) Change-Id: I439f65e0119b09e00da2ef5c7a4f002f93558578 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-05-07cmd/tailscale,controlclient,ipnlocal: fix 'up', deflake tests moreBrad Fitzpatrick2-4/+31
The CLI's "up" is kinda chaotic and LocalBackend.Start is kinda chaotic and they both need to be redone/deleted (respectively), but this fixes some buggy behavior meanwhile. We were previously calling StartLoginInteractive (to start the controlclient's RegisterRequest) redundantly in some cases, causing test flakes depending on timing and up's weird state machine. We only need to call StartLoginInteractive in the client if Start itself doesn't. But Start doesn't tell us that. So cheat a bit and a put the information about whether there's a current NodeKey in the ipn.Status. It used to be accessible over LocalAPI via GetPrefs as a private key but we removed that for security. But a bool is fine. So then only call StartLoginInteractive if that bool is false and don't do it in the WatchIPNBus loop. Fixes #12028 Updates #12042 Change-Id: I0923c3f704a9d6afd825a858eb9a63ca7c1df294 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-05-07ipn/ipnlocal: acquire b.mu once in StartMaisem Ali1-1/+2
We used to Lock, Unlock, Lock, Unlock quite a few times in Start resulting in all sorts of weird race conditions. Simplify it all and only Lock/Unlock once. Updates #11649 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-05-07control/controlclient: early return and outdent some codeBrad Fitzpatrick1-25/+23
I found this too hard to read before. This is pulled out of #12033 as it's unrelated cleanup in retrospect. Updates #12028 Change-Id: I727c47e573217e3d1973c5b66a76748139cf79ee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-05-06tailcfg,all: add/plumb Node.IsJailedMaisem Ali1-0/+4
This adds a new bool that can be sent down from control to do jailing on the client side. Previously this would only be done from control by modifying the packet filter we sent down to clients. This would result in a lot of additional work/CPU on control, we could instead just do this on the client. This has always been a TODO which we keep putting off, might as well do it now. Updates tailscale/corp#19623 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-05-06tstest/integration: add more debugging, logs to catch flaky testBrad Fitzpatrick1-0/+3
Updates #11962 Change-Id: I1ab0db69bdf8d1d535aa2cef434c586311f0fe18 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.