summaryrefslogtreecommitdiffhomepage
path: root/ipn/localapi
AgeCommit message (Collapse)AuthorFilesLines
2022-09-16ipn/{ipnlocal,localapi}: use strs.CutPrefix, add more domain validationBrad Fitzpatrick2-3/+57
The GitHub CodeQL scanner flagged the localapi's cert domain usage as a problem because user input in the URL made it to disk stat checks. The domain is validated against the ipnstate.Status later, and only authenticated root/configured users can hit this, but add some paranoia anyway. Change-Id: I373ef23832f1d8b3a27208bc811b6588ae5a1ddd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-15refactor: move from io/ioutil to io and os packagesEng Zer Jun1-5/+4
The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
2022-09-15envknob: support changing envknobs post-initBrad Fitzpatrick1-2/+2
Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-13cmd/tailscaled, tailcfg, hostinfo: add flag to disable logging + supportBrad Fitzpatrick1-0/+4
As noted in #5617, our documented method of blocking log.tailscale.io DNS no longer works due to bootstrap DNS. Instead, provide an explicit flag (--no-logs-no-support) and/or env variable (TS_NO_LOGS_NO_SUPPORT=true) to explicitly disable logcatcher uploads. It also sets a bit on Hostinfo to say that the node is in that mode so we can end any support tickets from such nodes more quickly. This does not yet provide an easy mechanism for users on some platforms (such as Windows, macOS, Synology) to set flags/env. On Linux you'd used /etc/default/tailscaled typically. Making it easier to set flags for other platforms is tracked in #5114. Fixes #5617 Fixes tailscale/corp#1475 Change-Id: I72404e1789f9e56ec47f9b7021b44c025f7a373a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-10util/mak: deprecate NonNil, add type-safe NonNilSliceForJSON, NonNilMapForJSONBrad Fitzpatrick1-29/+2
And put the rationale in the name too to save the callers the need for a comment. Change-Id: I090f51b749a5a0641897ee89a8fb2e2080c8b782 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-08-30ipn/localapi: send Tailscale version in ACME User-Agent (#5499)Andrew Dunham1-1/+5
Requested by a friend at Let's Encrypt. Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-08-22client,cmd/tailscale,ipn,tka,types: implement tka initialization flowTom DNetto1-0/+57
This PR implements the client-side of initializing network-lock with the Coordination server. Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-08-02all: gofmt for Go 1.19Brad Fitzpatrick1-1/+1
Updates #5210 Change-Id: Ib02cd5e43d0a8db60c1f09755a8ac7b140b670be Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25all: convert more code to use net/netip directlyBrad Fitzpatrick1-2/+1
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25all: use various net/netip parse funcs directlyBrad Fitzpatrick1-2/+3
Mechanical change with perl+goimports. Changed {Must,}Parse{IP,IPPrefix,IPPort} to their netip variants, then goimports -d . Finally, removed the net/netaddr wrappers, to prevent future use. Updates #5162 Change-Id: I59c0e38b5fbca5a935d701645789cddf3d7863ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25net/netaddr: start migrating to net/netip via new netaddr adapter packageBrad Fitzpatrick1-2/+2
Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-18ipn/localapi: define a cert dir for Synology DSM6Brad Fitzpatrick1-0/+9
Fixes #4060 Change-Id: I5f145d4f56f6edb14825268e858d419c55918673 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-11ipn/localapi: add API for uploading client metricsMihai Parparita1-0/+61
Clients may have platform-specific metrics they would like uploaded (e.g. extracted from MetricKit on iOS). Add a new local API endpoint that allows metrics to be updated by a simple name/value JSON-encoded struct. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-06-06wasm: exclude code that's not used on iOS for Wasm tooMihai Parparita3-6/+6
It has similar size constraints. Saves ~1.9MB from the Wasm build. Updates #3157 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-05-27ipn/localapi: implement LoginInteractive via localapiJoel Cressy1-0/+16
Updates: #4738 Signed-off-by: Joel Cressy <joel@jtcressy.net>
2022-05-03ipn/ipnlocal: move Ping method from IPN bus to LocalBackend (HTTP)Brad Fitzpatrick1-0/+32
Change-Id: I61759f1dae8d9d446353db54c8b1e13bfffb3287 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-18cmd/tailscale, etc: make "tailscale up --ssh" fail fast when unavailableBrad Fitzpatrick1-1/+32
Fail on unsupported platforms (must be Linux or macOS tailscaled with WIP env) or when disabled by admin (with TS_DISABLE_SSH_SERVER=1) Updates #3802 Change-Id: I5ba191ed0d8ba4ddabe9b8fc1c6a0ead8754b286 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-17all: add arbitrary capability supportBrad Fitzpatrick1-0/+1
Updates #4217 RELNOTE=start of WhoIsResponse capability support Change-Id: I6522998a911fe49e2f003077dad6164c017eed9b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-12cmd/tailscale: add id-token subcommandMaisem Ali1-5/+0
RELNOTE=Initial support for getting OIDC ID Tokens Updates tailscale/corp#4347 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-05ipn/localapi: add endpoint to request id tokenMaisem Ali1-0/+52
Updates tailscale/corp#4347 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-24client/tailscale, cmd/tailscale, localapi: add 'tailscale nc'Brad Fitzpatrick1-0/+61
This adds a "tailscale nc" command that acts a bit like "nc", but dials out via tailscaled via localapi. This is a step towards a "tailscale ssh", as we'll use "tailscale nc" as a ProxyCommand for in some cases (notably in userspace mode). But this is also just useful for debugging & scripting. Updates #3802 RELNOTE=tailscale nc Change-Id: Ia5c37af2d51dd0259d5833d80264d3ad5f68446a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-17all: use any instead of interface{}Josh Bleecher Snyder2-3/+3
My favorite part of generics. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-03-16all: use Go 1.18's strings.CutBrad Fitzpatrick1-3/+3
More remain. Change-Id: I6ec562cc1f687600758deae1c9d7dbd0d04004cb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-09control/controlclient, localapi: shorten expiry time via localapi (#4112)Nick O'Neill1-0/+31
Signed-off-by: Nick O'Neill <nick@tailscale.com>
2022-02-19ipn/localapi: treat ACME "invalid" state as terminal, log moreBrad Fitzpatrick1-17/+12
Fixes #3975 Change-Id: Idb2cc8d4730e140939898c7dcc15c2014acca142 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-25ipn/ipnserver: add TS_PERMIT_CERT_UID envknob to give webservers cert accessBrad Fitzpatrick2-1/+8
So you can run Caddy etc as a non-root user and let it have access to get certs. Updates caddyserver/caddy#4541 Change-Id: Iecc5922274530e2b00ba107d4b536580f374109b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-24envknob: add new package for all the strconv.ParseBool(os.Getenv(..))Brad Fitzpatrick1-2/+2
A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-12-28ipn/localapi: add debug handler to Rebind, ReSTUN magicsockBrad Fitzpatrick1-0/+31
And more later probably. Updates #3619 Change-Id: Ia4cba34a7c0dcce4d2eddec8aae17f32b51c207f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-12-01net/tsdial: move more weirdo dialing into new tsdial package, plumbBrad Fitzpatrick1-24/+1
Not done yet, but this move more of the outbound dial special casing from random packages into tsdial, which aspires to be the one unified place for all outbound dialing shenanigans. Then this plumbs it all around, so everybody is ultimately holding on to the same dialer. As of this commit, macOS/iOS using an exit node should be able to reach to the exit node's DoH DNS proxy over peerapi, doing the sockopt to stay within the Network Extension. A number of steps remain, including but limited to: * move a bunch more random dialing stuff * make netstack-mode tailscaled be able to use exit node's DNS proxy, teaching tsdial's resolver to use it when an exit node is in use. Updates #1713 Change-Id: I1e8ee378f125421c2b816f47bc2c6d913ddcd2f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-30cmd/tailscale: make file cp send files via tailscaled localapiBrad Fitzpatrick1-0/+19
So Taildrop sends work even if the local tailscaled is running in netstack mode, as it often is on Synology, etc. Updates #2179 (which is primarily about receiving, but both important) Change-Id: I9bd1afdc8d25717e0ab6802c7cf2f5e0bd89a3b2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-15util/clientmetrics: add new package to add metrics to the clientBrad Fitzpatrick1-0/+14
And annotate magicsock as a start. And add localapi and debug handlers with the Prometheus-format exporter. Updates #3307 Change-Id: I47c5d535fe54424741df143d052760387248f8d3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-09-28all: disable TCP keep-alives on iOS/AndroidBrad Fitzpatrick1-1/+2
Updates #2442 Updates tailscale/corp#2750 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-09-27ipn{,/localapi,ipnlocal}: infer cert dir from state file locationBrad Fitzpatrick1-5/+4
This fixes "tailscale cert" on Synology where the var directory is typically like /volume2/@appdata/Tailscale, or any other tailscaled user who specifies a non-standard state file location. This is a interim fix on the way to #2932. Fixes #2927 Updates #2932 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-09-23ipn/localapi, cmd/tailscale: add CPU & memory profile support, debug commandBrad Fitzpatrick2-0/+50
This was already possible on Linux if you ran tailscaled with --debug (which runs net/http/pprof), but it requires the user have the Go toolchain around. Also, it wasn't possible on macOS, as there's no way to run the IPNExtension with a debug server (it doesn't run tailscaled). And on Windows it's super tedious: beyond what users want to do or what we want to explain. Instead, put it in "tailscale debug" so it works and works the same on all platforms. Then we can ask users to run it when we're debugging something and they can email us the output files. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-08-19client/tailscale,ipn/localapi: warn on tailscale/tailscaled version skewBrad Fitzpatrick1-0/+2
Fixes #1905 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-08-18ipn/localapi: refresh ACME certs in background two weeks in advanceBrad Fitzpatrick2-26/+70
Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-08-17ipn/localapi: move cert fetching code to localapi, cache, add cert subcommandBrad Fitzpatrick3-0/+427
Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-13ipn/localapi: fix inability to receive taildrop files w/ escaped namesBrad Fitzpatrick1-1/+1
The localapi was double-unescaping: once by net/http populating the URL, and once by ourselves later. We need to start with the raw escaped URL if we're doing it ourselves. Started to write a test but it got invasive. Will have to add those tests later in a commit that's not being cherry-picked to a release branch. Fixes #2288 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-06-28cmd/tailscale: make netcheck use active DERP map, delete static copyjulianknodt1-0/+13
After allowing for custom DERP maps, it's convenient to be able to see their latency in netcheck. This adds a query to the local tailscaled for the current DERPMap. Updates #1264 Signed-off-by: julianknodt <julianknodt@gmail.com>
2021-06-18staticcheck.conf: turn off noisy lint errorsDavid Crawshaw1-1/+1
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-07ipn/{ipnlocal,localapi}, control/controlclient: add SetDNS localapiBrad Fitzpatrick1-0/+21
Updates #1235 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-16ipn/ipnlocal, etc: require file sharing capability to send/recv filesBrad Fitzpatrick1-1/+14
tailscale/corp#1582 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-13ipn/localapi: only require read access to list file targetsBrad Fitzpatrick1-2/+2
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-13client/tailscale/apitype: move local API types to new apitype packageBrad Fitzpatrick1-2/+3
They were scattered/duplicated in misc places before. It can't be in the client package itself for circular dep reasons. This new package is basically tailcfg but for localhost communications, instead of to control. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-11ipn/localapi: require write access to PATCH prefsBrad Fitzpatrick1-0/+4
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-11ipn/ipnlocal: use PATCH for EditPrefs, not POSTBrad Fitzpatrick1-2/+6
Addendum to earlier 00d641d9fc69557fdac6500eb889088520010705. Reserve POST for SetPrefs in the future. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-11ipn/localapi: move EditPrefs to localapiBrad Fitzpatrick1-1/+18
Follow-up/revision to recent 53cfff109b01baa3d219697a1a9e2ea16c4b0d3d which added EditPrefs. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-09ipn/{ipnlocal,localapi}, cmd/tailscale: add logout commandBrad Fitzpatrick1-0/+19
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-07ipn/localapi, cmd/tailscale: add API to get prefs, CLI debug command to showBrad Fitzpatrick1-0/+13
Updates #1436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-04-06ipn/{ipnlocal,localapi}: add localapi handler to dial/proxy file PUTsBrad Fitzpatrick1-3/+81
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.