tailscale - The easiest, most secure way to use WireGuard and 2FA

Age	Commit message (Collapse)	Author	Files	Lines
2022-04-07	control/controlbase: don't enforce a max protocol version at handshake time.	David Anderson	2	-3/+3
	Doing so makes development unpleasant, because we have to first break the client by bumping to a version the control server rejects, then upgrade the control server to make it accept the new version. This strict rejection at handshake time is only necessary if we want to blocklist some vulnerable protocol versions in the future. So, switch to a default-permissive stance: until we have such a version that we have to eagerly block early, we'll accept whatever version the client presents, and leave it to the user of controlbase.Conn to make decisions based on that version. Noise still enforces that the client and server agree on what protocol version is being used, and the control server still has the option to finish the handshake and then hang up with an in-noise error, rather than abort at the handshake level. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-04-07	control/controlbase: make the protocol version number selectable.	David Anderson	3	-6/+10
	This is so that we can plumb our client capability version through the protocol as the Noise version. The capability version increments more frequently than strictly required (the Noise version only needs to change when cryptographically-significant changes are made to the protocol, whereas the capability version also indicates changes in non-cryptographically-significant parts of the protocol), but this gives us a safe pre-auth way to determine if the client supports future protocol features, while still relying on Noise's strong assurance that the client and server have agreed on the same version. Currently, the server executes the same protocol regardless of the version number, and just presents the version to the caller so they can do capability-based things in the upper RPC protocol. In future, we may add a ratchet to disallow obsolete protocols, or vary the Noise handshake behavior based on requested version. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-03-24	net/netutil: move some net utils from control/controlhttp to netutil	Brad Fitzpatrick	2	-42/+4
	In prep for reuse elsewhere. Change-Id: I1b804edf76ac66b9108e6f434e77eab7a7472d69 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-02-26	controlhttp: add some docs, change Dial's path from /switch to /ts2021	Brad Fitzpatrick	1	-4/+15
	When I deployed server-side changes, I put the upgrade handler at /ts2021 instead of /switch. We could move the server to /switch, but ts2021 seems more specific and better, but I don't feel strongly. Updates #3488 Change-Id: Ifbf8ea60a815fd2fa1bfbe1b7af1ac2a27218354 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-17	control/controlhttp: package to get a controlbase.Conn over HTTP(S).	David Anderson	3	-0/+735
	Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>