summaryrefslogtreecommitdiffhomepage
path: root/ipn
AgeCommit message (Collapse)AuthorFilesLines
2025-06-18feature/tpm: implement ipn.StateStore using TPM sealing (#16030)Andrew Lytvynov1-0/+2
Updates #15830 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-06-18ipn/ipnlocal,wgengine{/magicsock}: replace SetNetworkMap with eventbus (#16299)Jordan Whited4-30/+69
Same with UpdateNetmapDelta. Updates tailscale/corp#27502 Updates #15160 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-18ipn/ipnlocal: make pricing restriction message for Tailnet Lock clearerAnton Tolchanov2-6/+14
Fixes tailscale/corp#24417 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2025-06-17ipn: add missing entries for OpenBSDJuan Francisco Cantero Hurtado2-2/+2
Signed-off-by: Juan Francisco Cantero Hurtado <jfch@30041993.xyz>
2025-06-17ipn/ipnlocal: add some verbose logging to taildrive peerapi handlerPercy Wegmann1-14/+21
Updates tailscale/corp#29702 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-06-16scripts/check_license_headers.sh: delete, rewrite as a Go testBrad Fitzpatrick1-0/+1
Updates tailscale/corp#29650 Change-Id: Iad4e4ccd9d68ebb1d1a12f335cc5295d0bd05b60 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-06-16ipn/ipnlocal,wgengine/magicsock: use eventbus for node & filter updates (#16271)Jordan Whited3-14/+54
nodeBackend now publishes filter and node changes to eventbus topics that are consumed by magicsock.Conn Updates tailscale/corp#27502 Updates tailscale/corp#29543 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-13ipn/ipnlocal: signal nodeBackend readiness and shutdownNick Khyl3-16/+230
We update LocalBackend to shut down the current nodeBackend when switching to a different node, and to mark the new node's nodeBackend as ready when the switch completes. Updates tailscale/corp#28014 Updates tailscale/corp#29543 Updates #12614 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-06-13ipn/ipnlocal: replace nodeContext with nodeBackend in commentsNick Khyl1-24/+24
We renamed the type in #15866 but didn't update the comments at the time. Updates #cleanup Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-06-11ipn/localapi,client/local: add debug watcher for bus events (#16239)Claus Lensbøl1-37/+100
Updates: #15160 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2025-06-10cmd/tailscale/cli: add a risk message about rp_filterAnton Tolchanov2-67/+94
We already present a health warning about this, but it is easy to miss on a server when blackholing traffic makes it unreachable. In addition to a health warning, present a risk message when exit node is enabled. Example: ``` $ tailscale up --exit-node=lizard The following issues on your machine will likely make usage of exit nodes impossible: - interface "ens4" has strict reverse-path filtering enabled - interface "tailscale0" has strict reverse-path filtering enabled Please set rp_filter=2 instead of rp_filter=1; see https://github.com/tailscale/tailscale/issues/3310 To skip this warning, use --accept-risk=linux-strict-rp-filter $ ``` Updates #3310 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2025-06-09health: prefix Warnables received from the control planeJames Sanderson1-9/+17
Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-06-06ipn/ipnlocal: Update hostinfo to control on service config change (#16146)KevinLiang102-8/+76
This commit fixes the bug that c2n requests are skiped when updating vipServices in serveConfig. This then resulted netmap update being skipped which caused inaccuracy of Capmap info on client side. After this fix, client always inform control about it's vipServices config changes. Fixes tailscale/corp#29219 Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>
2025-06-04ipn: add watch opt to include actions in health messagesJames Sanderson3-17/+161
Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-06-03ipn/ipnlocal: fix deadlock when filtering DisplayMessage URLsJames Sanderson2-2/+13
Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-05-30controlclient,health,ipnlocal,tailcfg: add DisplayMessage supportJames Sanderson2-1/+73
Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-05-29ipn/ipnlocal: fix data race when accessing b.appConnectorNick Khyl2-7/+15
The field must only be accessed while holding LocalBackend's mutex, but there are two places where it's accessed without the mutex: - (LocalBackend).MaybeClearAppConnector() - handleC2NAppConnectorDomainRoutesGet() Fixes #16123 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-28ipn: set RouteAll=true by default for new accounts on iOS and Android (#16110)Jonathan Nobels1-1/+2
fixes tailscale/tailscale#16082 RouteAll should be true by default on iOS and Android. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2025-05-23ipn/ipnlocal: improve dohQuery error to suggest `?dns=` and `?q=` (#16056)Zach Buchheit1-1/+1
Previously, a missing or invalid `dns` parameter on GET `/dns-query` returned only “missing ‘dns’ parameter”. Now the error message guides users to use `?dns=` or `?q=`. Updates: #16055 Signed-off-by: Zach Buchheit <zachb@tailscale.com>
2025-05-22control/controlclient,health,tailcfg: refactor control health messages (#15839)James 'zofrex' Sanderson1-6/+10
* control/controlclient,health,tailcfg: refactor control health messages Updates tailscale/corp#27759 Signed-off-by: James Sanderson <jsanderson@tailscale.com> Signed-off-by: Paul Scott <408401+icio@users.noreply.github.com> Co-authored-by: Paul Scott <408401+icio@users.noreply.github.com>
2025-05-21ipn/store: remove a layer of indirection for registering stores (#15986)Andrew Lytvynov4-21/+4
Registering a new store is cheap, it just adds a map entry. No need to lazy-init it with sync.Once and an intermediate slice holding init functions. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-05-19ipn/ipnlocal: make GetExt work earlier, before extension initBrad Fitzpatrick3-8/+59
Taildrop wasn't working on iOS since #15971 because GetExt didn't work until after init, but that PR moved Init until after Start. This makes GetExt work before LocalBackend.Start (ExtensionHost.Init). Updates #15812 Change-Id: I6e87257cd97a20f86083a746d39df223e5b6791b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-14feature/taildrop,ipn/ipn{ext,local}: initialize taildrop for initial profileNick Khyl2-3/+14
Currently, LocalBackend/ExtensionHost doesn't invoke the profile change callback for the initial profile. Since the initial profile may vary depending on loaded extensions and applied policy settings, it can't be reliably determined until all extensions are initialized. Additionally, some extensions may asynchronously trigger a switch to the "best" profile (based on system state and policy settings) during initialization. We intended to address these issues as part of the ongoing profileManager/LocalBackend refactoring, but the changes didn't land in time for the v1.84 release and the Taildrop refactoring. In this PR, we update the Taildrop extension to retrieve the current profile at initialization time and handle it as a profile change. We also defer extension initialization until LocalBackend has started, since the Taildrop extension already relies on this behavior (e.g., it requires clients to call SetDirectFileRoot before Init). Fixes #15970 Updates #15812 Updates tailscale/corp#28449 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-13ipn/ipnlocal: attach Tailnet Lock status to bugreportsAnton Tolchanov1-0/+9
Fixes tailscale/corp#28524 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2025-05-12ipn/ipnlocal,wgengine: move (*tsdial.Dialer).SetRoutes() calls from ↵Nick Khyl1-7/+0
LocalBackend to userspaceEngine This avoids reconfiguring the dialer unless the router config has changed. Updates #12027 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-09ipn/ipnlocal: move nodeBackend methods from local.go to node_backend.goNick Khyl3-480/+490
We previously kept these methods in local.go when we started moving node-specific state from LocalBackend to nodeBackend, to make those changes easier to review. But it's time to move them to node_backend.go. Updates #cleanup Updates #12614 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-09ipn/ipn{server,test}: extract the LocalAPI test client and server into ipntestNick Khyl9-335/+846
In this PR, we extract the in-process LocalAPI client/server implementation from ipn/ipnserver/server_test.go into a new ipntest package to be used in high‑level black‑box tests, such as those for the tailscale CLI. Updates #15575 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-09ipn/ipnlocal,net/dns/resolver: use the user dialer and routes for DNS ↵Nick Khyl1-2/+2
forwarding by default, except on iOS and Android In this PR, we make the "user-dial-routes" behavior default on all platforms except for iOS and Android. It can be disabled by setting the TS_DNS_FORWARD_USE_ROUTES envknob to 0 or false. Updates #12027 Updates #13837 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-09health, ipn/ipnlocal: add metrics for various client events (#15828)Jonathan Nobels5-9/+146
updates tailscale/corp#28092 Adds metrics for various client events: * Enabling an exit node * Enabling a mullvad exit node * Enabling a preferred exit node * Setting WantRunning to true/false * Requesting a bug report ID * Profile counts * Profile deletions * Captive portal detection Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2025-05-08feature/taildrop, ipn/ipnlocal: remove leftover dup calls to osshareBrad Fitzpatrick2-27/+13
I'd moved the osshare calls to feature/taildrop hooks, but forgot to remove them from ipnlocal, or lost them during a rebase. But then I noticed cmd/tailscaled also had some, so turn those into a hook. Updates #12614 Change-Id: I024fb1d27fbcc49c013158882ee5982c2737037d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-08tsnet: add test for packet filter generation from netmapJames Sanderson2-2/+6
This is an integration test that covers all the code in Direct, Auto, and LocalBackend that processes NetMaps and creates a Filter. The test uses tsnet as a convenient proxy for setting up all the client pieces correctly, but is not actually a test specific to tsnet. Updates tailscale/corp#20514 Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-05-07all: remove non-applicable "linux" deps on AndroidBrad Fitzpatrick2-2/+2
Updates #12614 Change-Id: I0e2a18eca3515d3d6206c059110556d2bbbb0c5c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-07ipn/store: don't link in AWS & Kubernetes stuff on AndroidBrad Fitzpatrick2-2/+2
Android is Linux, but that not much Linux. Updates #12614 Change-Id: Ice80bd3e3d173511c30d05a43d25a31e18928db7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-06feature/taildrop: move rest of Taildrop out of LocalBackendBrad Fitzpatrick9-466/+151
Updates #12614 Change-Id: If451dec1d796f6a4216fe485975c87f0c62a53e5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Co-authored-by: Nick Khyl <nickk@tailscale.com>
2025-05-06cmd/tailscale/cli: rename "--posture-checking" to "--report-posture"Brad Fitzpatrick1-0/+5
For consistency with other flags, per Slack chat. Updates #5902 Change-Id: I7ae1e4c97b37185573926f5fafda82cf8b46f071 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-05ipn/ipnlocal, tailcfg: add MagicDNS opt-in attr for IPv6 AAAA recordsBrad Fitzpatrick1-1/+3
Until we turn on AAAA by default (which might make some people rely on Happy Eyeballs for targets without IPv6), this lets people turn it on explicitly if they want. We still should add a peer cap as well in the future to let a peer explicitly say that it's cool with IPv6. Related: #9574 Updates #1813 Updates #1152 Change-Id: Iec6ec9b4b5db7a4dc700ecdf4a11146cc5303989 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-02ipn/ipnlocal: use "nb" consistently as receiver for nodeBackendBrad Fitzpatrick2-136/+136
Cleanup after #15866. It was using a mix of "b" and "c" before. But "b" is ambiguous with LocalBackend's usual "b". Updates #12614 Change-Id: I8c2e84597555ec3db0d783a00ac1c12549ce6706 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-02ipn/ipnlocal: rename localNodeContext to nodeBackendBrad Fitzpatrick2-53/+53
As just discussed on Slack with @nickkhyl. Updates #12614 Change-Id: I138dd7eaffb274494297567375d969b4122f3f50 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-01ipn/ipnlocal: fix Taildrop regression from refactoringBrad Fitzpatrick1-2/+2
This fixes a refactoring bug introduced in 8b72dd7873201 Tests (that failed on this) are coming in a separate change. Updates #15812 Change-Id: Ibbf461b4eaefe22ad3005fc243d0a918e8af8981 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-30ipn/ipnlocal: fix Taildrop deadlockBrad Fitzpatrick1-6/+21
This fixes the Taildrop deadlock from 8b72dd787320. Fixes #15824 Change-Id: I5ca583de20dd0d0b513ce546439dc632408ca1f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-25feature,ipn/ipnlocal: add profileManager.StateChangeHookNick Khyl3-19/+583
We update profileManager to allow registering a single state (profile+prefs) change hook. This is to invert the dependency between the profileManager and the LocalBackend, so that instead of LocalBackend asking profileManager for the state, we can have profileManager call LocalBackend when the state changes. We also update feature.Hook with a new (*feature.Hook).GetOk method to avoid calling both IsSet and Get. Updates tailscale/corp#28014 Updates #12614 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-04-25ipn/ipnlocal: update profileManager to use SwitchToProfile when switching to ↵Nick Khyl1-53/+40
the initial profile This further minimizes the number of places where the profile manager updates the current profile and prefs. We also document a scenario where an implicit profile switch can occur. We should be able to address it after (partially?) inverting the dependency between LocalBackend and profileManager, so that profileManager notifies LocalBackend of profile changes instead of the other way around. Updates tailscale/corp#28014 Updates #12614 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-04-25ipn/ipnlocal: add localNodeContext with netmap-related fields and methodsNick Khyl13-351/+648
Updates #12614 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-04-25types/mapx, ipn/ipnext: add ordered map, akin to set.SliceBrad Fitzpatrick2-23/+13
We had an ordered set type (set.Slice) already but we occasionally want to do the same thing with a map, preserving the order things were added, so add that too, as mapsx.OrderedMap[K, V], and then use in ipnext. Updates #12614 Change-Id: I85e6f5e11035571a28316441075e952aef9a0863 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-25ipn/ipnext: remove some interface indirection to add hooksBrad Fitzpatrick5-111/+64
Now that 25c4dc5fd70 removed unregistering hooks and made them into slices, just expose the slices and remove the setter funcs. This removes boilerplate ceremony around adding new hooks. This does export the hooks and make them mutable at runtime in theory, but that'd be a data race. If we really wanted to lock it down in the future we could make the feature.Hooks slice type be an opaque struct with an All() iterator and a "frozen" bool and we could freeze all the hooks after init. But that doesn't seem worth it. This means that hook registration is also now all in one place, rather than being mixed into ProfilesService vs ipnext.Host vs FooService vs BarService. I view that as a feature. When we have a ton of hooks and the list is long, then we can rearrange the fields in the Hooks struct as needed, or make sub-structs, or big comments. Updates #12614 Change-Id: I05ce5baa45a61e79c04591c2043c05f3288d8587 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-24ipn/{ipnext,ipnlocal}: add a SafeBackend interfaceBrad Fitzpatrick6-21/+68
Updates #12614 Change-Id: I197e673666e86ea74c19e3935ed71aec269b6c94 Co-authored-by: Nick Khyl <nickk@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-24ipn/ipnext: remove support for unregistering extensionBrad Fitzpatrick5-176/+98
Updates #12614 Change-Id: I893e3ea74831deaa6f88e31bba2d95dc017e0470 Co-authored-by: Nick Khyl <nickk@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-23ipn/ipnlocal: use tsd.NewSystem instead of &tsd.System in a few more testsNick Khyl2-3/+3
These were likely added after everything else was updated to use tsd.NewSystem, in a feature branch, and before it was merged back into main. Updates #15160 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-04-18ipn/ipnlocal: use MagicDNSName of the current profile instead of generating ↵Nick Khyl1-1/+1
a full ipnstate.Status Both are populated from the current netmap's MagicDNSSuffix. But building a full ipnstate.Status (with peers!) is expensive and unnecessary. Updates #cleanup Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-04-17ipn/ipnlocal: remove another copy of slicesx.MapValuesBrad Fitzpatrick1-19/+6
We added this helper in 1e2e319e7d26. Remove this copy. Updates #cleanup Change-Id: I5b0681acc23692beed35951c9902ac9ceca0a8b9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.